Xiaomi Mi Router 4A - R4AC New revision

For Developers
1

Hello everyone, i got myself a xiaomi router, model is R4AC and the SKU is DVB4230GL on the motherboard the revision appears to be 1.2 and to have the serial port working i had to remove 2 resistors that actually pulled the uart lines to ground followed the procedures found on the other posts and i was able to upload an image over tftp named : openwrt-ramips-mt76x8-xiaomi_mir4a-100m-initramfs-kernel.bin it flashed without problems, after that i logged in in LuCi and upgraded the system with the: openwrt-ramips-mt76x8-xiaomi_mir4a-100m-squashfs-sysupgrade.bin but after flashing the device go into a bootloop and on the console i can read :

Booting image at bc260000 ...

Bad Magic Number,930F6EB0, try to reboot

If someone will join it would be awesome, thank you very much

2

Hi,

That's the same R4AC sku as the two I have here. They come with international version of firmware which uses a different mtd layout (overlay has been doubled in size which moves where OS1 starts).

When you write from the ramfs image it will be writing halfway through overlay.

You need to compile with a matching mtd layout as what the supplied uboot is expecting,

See Xiaomi R4AC - Problems installing OpenWrt - #17 by markky
and
Xiaomi R4AC - Problems installing OpenWrt - #21 by markky

  • Mark
1 Like
3

remove flash chip attached to programer flash this file http://fumacrom.com/cFKY and resolder the chip to your router and enjoy open wrt to your router dump file [http://fumacrom.com/cFKY] update file update
spi flash programer use . 100 percent :white_check_mark:

20210601_051346_copy_824x824
20210601_051346_copy_824x824824×824 181 KB

20210601_051447_copy_792x792
20210601_051447_copy_792x792792×792 192 KB

Screenshot_20210601-013326_Chrome
Screenshot_20210601-013326_Chrome1080×1920 200 KB

4

would you please share the original dump file and openwrt dump file? or where can i found it? I've messed up my R4AC. i've flashed it with R4C, because R4AC only have snapshot version. now, i'm missing its 5G radio.

5

can you share the .bin file , please?

6

Good morning everyone!
after 2 days of hard struggle, I finally installed openwrt on mine Xiaomi MI router 4A (100M Edition)!!!!

The box and the label on the bottom said it was the version: R4AC
Despite following hoddys guide i couldn't install a version of openwrt without bricking the device!

Here is the procedure (it worked for me):

    • initial firmware version 3.0.5 (international edition because the label on the bottom and the web page were in English)
    • downgrade to 2.18.28 then upgrade to 2.18.58 follow this post and use that program (false virus positive!):
      Debrick Xiaomi Mi Router 4A

I don't know if they mislabelled or whatever, obviously I don't want to have anyone on my conscience, so choose to risk it, but it worked for me.

I bought the router on December 22, 2022

1 Like
7

please sent me mi 4rac global firmware....

8
9

this didn't work and also bricked the 4a (r4AC) router

1 Like
10

after some days of bricking/debricking a
Mi Router 4A 100M
labelled DVB4230GL on the box
i finally got OpenWrt installed and can share these steps.

first of all debricking works reliably with pxesrv.exe from any of the packages

of course you will need to jailbreak with and as documented on https://github.com/acecilia/OpenWRTInvasion

and on to the main course

Lesson learned
"Flash layout matters", check the flash layout before flashing!

for some reason this device has the following flash layout

root@XiaoQiang:~# cat /proc/mtd
dev:    size   erasesize  name
mtd0: 01000000 00010000 "ALL"
mtd1: 00020000 00010000 "Bootloader"
mtd2: 00010000 00010000 "Config"
mtd3: 00010000 00010000 "Factory"
mtd4: 00010000 00010000 "crash"
mtd5: 00010000 00010000 "cfg_bak"
mtd6: 00100000 00010000 "overlay"
mtd7: 00c60000 00010000 "OS1"
mtd8: 00b00000 00010000 "rootfs"
mtd9: 00240000 00010000 "disk"

note the line mtd6: 00100000 00010000 "overlay", which concidentally matches the flash layout of Xiaomi Mi Router 4C but neither Mi Router 4A (MIR4A) 100M nor Mi Router 4A 100m International

long story short.
1.
flashing the chip compatible Xiaomi Mi Router 4C image
openwrt-22.03.3-ramips-mt76x8-xiaomi_mi-router-4c-squashfs-sysupgrade.bin
as described on the device page
mtd -r write openwrt.bin OS1
results in a working OpenWrt with LAN/2GHz-WLAN only.
2.
after this comes up under default OpenWrt ip 192.168.1.1, you can force upgrade (it'll complain of course), do not keep settings with the intended Mi Router 4A (MIR4A) 100M image
openwrt-22.03.3-ramips-mt76x8-xiaomi_mi-router-4a-100m-squashfs-sysupgrade.bin
and voila Bob's your uncle!

and again. if anything breaks do not worry. just DEBRICK watch @hoddy 's tutorial https://www.youtube.com/watch?v=SLbkce-M2nE and use the downloads he provides. you may need to play with the images though, as you can see, in my case the device was labelled DVB4230GL international version but needed chinese firmware to recover!

good luck!

11

Hi! I have same flash layout as yours, replicated all moves you mentioned, and it works!

But i have a minor problem.

after flashing 4a-100m-squashfs-sysupgrade.bin it still works at this mode.

So any ideas on how to get 5ghz chip to work? Thanks

12

there are two 100Mbit versions, did you try both?

Mi Router 4A (MIR4A) 100M nor Mi Router 4A 100m International

13

Yep.

Mir4a firmware works fine, but, as I mentioned- without 5ghz. It just not on wireless tab.

Trying to flash r4ac firmware results in constant reboot cycle after second led goes blue and off. First led always flash orange or so, before goes down, so I think my system just don’t start properly.

Im pretty sure I have r4ac version (scu,model number and English initial router firmware matches), but with different flash layout, just like yours, and confused why mir4a works, and intended firmware - doesn’t.

14

can you post a dmesg dump? of the mir4a image after boot

15 
root@OpenWrt:~# dmesg
[    0.000000] Linux version 5.10.146 (builder@buildhost) (mipsel-openwrt-linux-musl-gcc (OpenWrt GCC 11.2.0 r19803-9a599fee93) 11.2.0, GNU ld (GNU Binutils) 2.37) #0 Fri Oct 14 22:44:41 2022
[    0.000000] Board has DDR2
[    0.000000] Analog PMU set to hw control
[    0.000000] Digital PMU set to hw control
[    0.000000] SoC Type: MediaTek MT7628AN ver:1 eco:2
[    0.000000] printk: bootconsole [early0] enabled
[    0.000000] CPU0 revision is: 00019655 (MIPS 24KEc)
[    0.000000] MIPS: machine is Xiaomi Mi Router 4A (100M Edition)
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x0000000000000000-0x0000000003ffffff]
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000000000000-0x0000000003ffffff]
[    0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000003ffffff]
[    0.000000] On node 0 totalpages: 16384
[    0.000000]   Normal zone: 144 pages used for memmap
[    0.000000]   Normal zone: 0 pages reserved
[    0.000000]   Normal zone: 16384 pages, LIFO batch:3
[    0.000000] pcpu-alloc: s0 r0 d32768 u32768 alloc=1*32768
[    0.000000] pcpu-alloc: [0] 0
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 16240
[    0.000000] Kernel command line: console=ttyS0,115200 rootfstype=squashfs,jffs2
[    0.000000] Dentry cache hash table entries: 8192 (order: 3, 32768 bytes, linear)
[    0.000000] Inode-cache hash table entries: 4096 (order: 2, 16384 bytes, linear)
[    0.000000] Writing ErrCtl register=0007b3a0
[    0.000000] Readback ErrCtl register=0007b3a0
[    0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
[    0.000000] Memory: 56416K/65536K available (5669K kernel code, 616K rwdata, 692K rodata, 1204K init, 209K bss, 9120K reserved, 0K cma-reserved)
[    0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[    0.000000] NR_IRQS: 256
[    0.000000] intc: using register map from devicetree
[    0.000000] CPU Clock: 575MHz
[    0.000000] timer_probe: no matching timers found
[    0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 6647862422 ns
[    0.000010] sched_clock: 32 bits at 287MHz, resolution 3ns, wraps every 7469508094ns
[    0.007645] Calibrating delay loop... 380.92 BogoMIPS (lpj=1904640)
[    0.073532] pid_max: default: 32768 minimum: 301
[    0.078169] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.085190] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.095085] dyndbg: Ignore empty _ddebug table in a CONFIG_DYNAMIC_DEBUG_CORE build
[    0.106411] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.115931] futex hash table entries: 256 (order: -1, 3072 bytes, linear)
[    0.122572] pinctrl core: initialized pinctrl subsystem
[    0.132690] NET: Registered protocol family 16
[    0.137846] thermal_sys: Registered thermal governor 'step_wise'
[    0.247651] mt7620-pci 10140000.pcie: Port 0 N_FTS = 1b105000
[    0.408107] PCI host bridge /pcie@10140000 ranges:
[    0.412686]  MEM 0x0000000020000000..0x000000002fffffff
[    0.417718]   IO 0x0000000010160000..0x000000001016ffff
[    0.472480] PCI host bridge to bus 0000:00
[    0.476402] pci_bus 0000:00: root bus resource [mem 0x20000000-0x2fffffff]
[    0.483127] pci_bus 0000:00: root bus resource [io  0x10160000-0x1016ffff]
[    0.489709] pci_bus 0000:00: root bus resource [??? 0x00000000 flags 0x0]
[    0.496269] pci_bus 0000:00: No busn resource found for root bus, will use [bus 00-ff]
[    0.503960] pci 0000:00:00.0: [14c3:0801] type 01 class 0x060400
[    0.509724] pci 0000:00:00.0: reg 0x10: [mem 0x00000000-0x7fffffff]
[    0.515751] pci 0000:00:00.0: reg 0x14: [mem 0x20200000-0x2020ffff]
[    0.521875] pci 0000:00:00.0: supports D1
[    0.525680] pci 0000:00:00.0: PME# supported from D0 D1 D3hot
[    0.533085] pci 0000:01:00.0: [14c3:7663] type 00 class 0x000280
[    0.538875] pci 0000:01:00.0: reg 0x10: [mem 0x00000000-0x000fffff 64bit pref]
[    0.545860] pci 0000:01:00.0: reg 0x18: [mem 0x00000000-0x00003fff 64bit pref]
[    0.552796] pci 0000:01:00.0: reg 0x20: [mem 0x00000000-0x00000fff 64bit pref]
[    0.559877] pci 0000:01:00.0: supports D1 D2
[    0.563934] pci 0000:01:00.0: PME# supported from D0 D1 D2 D3hot D3cold
[    0.570367] pci 0000:01:00.0: 2.000 Gb/s available PCIe bandwidth, limited by 2.5 GT/s PCIe x1 link at 0000:00:00.0 (capable of 4.000 Gb/s with 5.0 GT/s PCIe x1 link)
[    0.586217] pci_bus 0000:01: busn_res: [bus 01-ff] end is updated to 01
[    0.592561] pci_bus 0000:00: busn_res: [bus 00-ff] end is updated to 01
[    0.599010] pci 0000:00:00.0: BAR 0: no space for [mem size 0x80000000]
[    0.605338] pci 0000:00:00.0: BAR 0: failed to assign [mem size 0x80000000]
[    0.612074] pci 0000:00:00.0: BAR 9: assigned [mem 0x20000000-0x201fffff pref]
[    0.619032] pci 0000:00:00.0: BAR 1: assigned [mem 0x20200000-0x2020ffff]
[    0.625603] pci 0000:01:00.0: BAR 0: assigned [mem 0x20000000-0x200fffff 64bit pref]
[    0.633077] pci 0000:01:00.0: BAR 2: assigned [mem 0x20100000-0x20103fff 64bit pref]
[    0.640563] pci 0000:01:00.0: BAR 4: assigned [mem 0x20104000-0x20104fff 64bit pref]
[    0.648026] pci 0000:00:00.0: PCI bridge to [bus 01]
[    0.652811] pci 0000:00:00.0:   bridge window [mem 0x20000000-0x201fffff pref]
[    0.667117] clocksource: Switched to clocksource MIPS
[    0.673445] NET: Registered protocol family 2
[    0.677958] IP idents hash table entries: 2048 (order: 2, 16384 bytes, linear)
[    0.685814] tcp_listen_portaddr_hash hash table entries: 512 (order: 0, 4096 bytes, linear)
[    0.693986] TCP established hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.701368] TCP bind hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.708157] TCP: Hash tables configured (established 1024 bind 1024)
[    0.714443] UDP hash table entries: 256 (order: 0, 4096 bytes, linear)
[    0.720776] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes, linear)
[    0.727818] NET: Registered protocol family 1
[    0.732048] PCI: CLS 80 bytes, default 32
[    0.743645] workingset: timestamp_bits=14 max_order=14 bucket_order=0
[    0.755181] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.760841] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.772522] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 252)
[    0.782234] mt7621_gpio 10000600.gpio: registering 32 gpios
[    0.787958] mt7621_gpio 10000600.gpio: registering 32 gpios
[    0.793513] mt7621_gpio 10000600.gpio: registering 32 gpios
[    0.799246] Serial: 8250/16550 driver, 16 ports, IRQ sharing enabled
[    0.808179] printk: console [ttyS0] disabled
[    0.812348] 10000c00.uartlite: ttyS0 at MMIO 0x10000c00 (irq = 28, base_baud = 2500000) is a 16550A
[    0.821130] printk: console [ttyS0] enabled
[    0.829528] printk: bootconsole [early0] disabled
[    0.840524] spi-mt7621 10000b00.spi: sys_freq: 191666666
[    0.865189] spi-nor spi0.0: gd25q128 (16384 Kbytes)
[    0.870312] 7 fixed-partitions partitions found on MTD device spi0.0
[    0.876813] OF: Bad cell count for /palmbus@10000000/spi@b00/flash@0/partitions
[    0.884283] OF: Bad cell count for /palmbus@10000000/spi@b00/flash@0/partitions
[    0.892278] OF: Bad cell count for /palmbus@10000000/spi@b00/flash@0/partitions
[    0.899792] OF: Bad cell count for /palmbus@10000000/spi@b00/flash@0/partitions
[    0.907491] Creating 7 MTD partitions on "spi0.0":
[    0.912365] 0x000000000000-0x000000020000 : "bootloader"
[    0.921488] 0x000000020000-0x000000030000 : "config"
[    0.927849] 0x000000030000-0x000000040000 : "factory"
[    0.936023] 0x000000040000-0x000000050000 : "crash"
[    0.942378] 0x000000050000-0x000000060000 : "cfg_bak"
[    0.950610] 0x000000060000-0x000000160000 : "overlay"
[    0.956967] 0x000000160000-0x000001000000 : "firmware"
[    0.965410] 2 uimage-fw partitions found on MTD device firmware
[    0.971522] Creating 2 MTD partitions on "firmware":
[    0.976574] 0x000000000000-0x000000218337 : "kernel"
[    0.981622] mtd: partition "kernel" doesn't end on an erase/write block -- force read-only
[    0.992278] 0x000000218337-0x000000ea0000 : "rootfs"
[    0.997404] mtd: partition "rootfs" doesn't start on an erase/write block boundary -- force read-only
[    1.007967] mtd: device 8 (rootfs) set to be root filesystem
[    1.014827] 1 squashfs-split partitions found on MTD device rootfs
[    1.021207] 0x0000005a0000-0x000000ea0000 : "rootfs_data"
[    1.085695] rt3050-esw 10110000.esw: mediatek esw at 0xb0110000, irq 25 initialized
[    1.094384] mtk_soc_eth 10100000.ethernet eth0: mediatek frame engine at 0xb0100000, irq 5
[    1.104720] NET: Registered protocol family 10
[    1.115284] Segment Routing with IPv6
[    1.119228] NET: Registered protocol family 17
[    1.123836] bridge: filtering via arp/ip/ip6tables is no longer available by default. Update your scripts to load br_netfilter if you need this.
[    1.137014] 8021q: 802.1Q VLAN Support v1.8
[    1.156461] VFS: Mounted root (squashfs filesystem) readonly on device 31:8.
[    1.170548] Freeing unused kernel memory: 1204K
[    1.175143] This architecture does not have kernel memory protection.
[    1.181714] Run /sbin/init as init process
[    1.185861]   with arguments:
[    1.185866]     /sbin/init
[    1.185871]   with environment:
[    1.185876]     HOME=/
[    1.185881]     TERM=linux
[    2.266856] init: Console is alive
[    2.271023] init: - watchdog -
[    3.507714] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[    3.676924] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
[    3.694945] init: - preinit -
[    4.048889] rt3050-esw 10110000.esw: port 2 link up
[    4.805886] rt3050-esw 10110000.esw: port 0 link up
[    5.913050] random: jshn: uninitialized urandom read (4 bytes read)
[    6.181327] random: jshn: uninitialized urandom read (4 bytes read)
[    6.380599] random: jshn: uninitialized urandom read (4 bytes read)
[    7.115629] rt3050-esw 10110000.esw: port 0 link down
[    7.120773] rt3050-esw 10110000.esw: port 2 link down
[    7.417477] random: procd: uninitialized urandom read (4 bytes read)
[   10.258862] rt3050-esw 10110000.esw: port 2 link up
[   10.263880] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready
[   10.270850] IPv6: ADDRCONF(NETDEV_CHANGE): eth0.1: link becomes ready
[   10.882476] rt3050-esw 10110000.esw: port 0 link up
[   11.895765] jffs2: notice: (414) jffs2_build_xattr_subsystem: complete building xattr subsystem, 12 of xdatum (7 unchecked, 3 orphan) and 14 of xref (3 dead, 0 orphan) found.
[   11.914168] mount_root: switching to jffs2 overlay
[   11.925767] overlayfs: upper fs does not support tmpfile.
[   11.940546] urandom-seed: Seeding with /etc/urandom.seed
[   12.156275] procd: - early -
[   12.160824] procd: - watchdog -
[   12.987277] procd: - watchdog -
[   12.992507] procd: - ubus -
[   13.133944] random: ubusd: uninitialized urandom read (4 bytes read)
[   13.143860] random: ubusd: uninitialized urandom read (4 bytes read)
[   13.160488] random: ubusd: uninitialized urandom read (4 bytes read)
[   13.179802] procd: - init -
[   14.633039] random: jshn: uninitialized urandom read (4 bytes read)
[   14.848664] random: ubusd: uninitialized urandom read (4 bytes read)
[   14.855597] random: ubus: uninitialized urandom read (4 bytes read)
[   14.944373] kmodloader: loading kernel modules from /etc/modules.d/*
[   15.569044] Loading modules backported from Linux version v5.15.58-0-g7d8048d4e064
[   15.576742] Backport generated by backports.git v5.15.58-1-0-g42a95ce7
[   15.872276] urngd: v1.0.2 started.
[   15.940612] mt76_wmac 10300000.wmac: ASIC revision: 76280001
[   16.168067] random: crng init done
[   16.171535] random: 22 urandom warning(s) missed due to ratelimiting
[   16.979913] mt76_wmac 10300000.wmac: Firmware Version: 20151201
[   16.985939] mt76_wmac 10300000.wmac: Build Time: 20151201183641
[   17.007122] mt76_wmac 10300000.wmac: firmware init done
[   17.175853] ieee80211 phy0: Selected rate control algorithm 'minstrel_ht'
[   17.384691] PPP generic driver version 2.4.2
[   17.400533] NET: Registered protocol family 24
[   17.580428] kmodloader: done loading kernel modules from /etc/modules.d/*
[   30.495708] rt3050-esw 10110000.esw: port 0 link down
[   30.500855] rt3050-esw 10110000.esw: port 2 link down
[   33.448992] rt3050-esw 10110000.esw: port 2 link up
[   34.194971] rt3050-esw 10110000.esw: port 0 link up
[   40.245510] br-lan: port 1(eth0.1) entered blocking state
[   40.251102] br-lan: port 1(eth0.1) entered disabled state
[   40.256967] device eth0.1 entered promiscuous mode
[   40.262080] device eth0 entered promiscuous mode
[   40.294613] br-lan: port 1(eth0.1) entered blocking state
[   40.300178] br-lan: port 1(eth0.1) entered forwarding state
[   41.277629] IPv6: ADDRCONF(NETDEV_CHANGE): br-lan: link becomes ready
[   46.213582] br-lan: port 2(wlan0) entered blocking state
[   46.219251] br-lan: port 2(wlan0) entered disabled state
[   46.225072] device wlan0 entered promiscuous mode
[   53.228311] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready
[   53.235029] br-lan: port 2(wlan0) entered blocking state
[   53.240499] br-lan: port 2(wlan0) entered forwarding state
16

can't see it detect MT7612EN supposedly doing the 5GHz.

can you post a picture of the label on the device?

17

Nevermind.

After serching all posible solutions at night i figured out, that there is a version of this router mentioned as R4AC v2, so i just install firmware from one of my native language forums and it worked perfectly for me!

I think same version of router mentioned at this thread Xiaomi 4a R4ACV2 new version / bricked - #16 by Azello

So i think diffirence in this versions is mtd layout(as i mentioned - same as yours), and diffirent 5ghz chipset MT7613BE(i suppose it was actually a reason why 5GHz not worked for me initially)

изображение
изображение1227×326 24 KB

Anyway, thanks for your help, your replys was my initial reason to not give up in my journey, and it actually ended well for me.

18

Nice!

where did you get the R4ACv2 image? did you compile it yourself?

19

Nope, i just get it from https://4pda.to/forum/index.php?showtopic=975951&st=5680#entry123743005

In this topic there is in instructions on how i can restore international firmware, and, in addition - openwrt.bin for v2 router. I think this is slightly modified copy of firmware in forum thread i mentioned earlier(russian language pack is preinstalled, some luci packets for wireguard etc)

20

sadly the changes didn't find their way to Openwrt obviously. so you will depend on the 4pda guys to supply updated versions or not.

maybe you can ask them for a patchset?

EDIT: or maybe not needed. just found this thread

linking a patchset on github that's looking proper

as i don't own the device anymore i will leave others to maybe set up a PR to the OpenWrt project.

3 Likes