Xiaomi Mi WiFi R4 exploration

Have on hands device and some pictures and logs.
Specs like Mi WiFi Router 3G
7621soc with less ram 128 mb, 128 mb nand !!!NO USB!!! and new MI button on top
com connected to usb dongle blocking device to startup :frowning:
if connect after power up works fine with 115200 8n1
Successfully boot initramfs from mi3g.
Failed mtd write kernel, because partitions mismatch ?
Partitions from origin log:

Creating 14 MTD partitions on "MT7621-NAND":
0x000000000000-0x000007f80000 : "ALL"
0x000000000000-0x000000080000 : "Bootloader"
0x000000080000-0x0000000c0000 : "Config"
0x0000000c0000-0x000000100000 : "Bdata"
0x000000100000-0x000000140000 : "Factory"
0x000000140000-0x000000180000 : "crash"
0x000000180000-0x0000001c0000 : "crash_syslog"
0x0000001c0000-0x000000200000 : "cfg_bak"
0x000000200000-0x000000600000 : "kernel0"
0x000000600000-0x000000a00000 : "kernel1"
0x000000a00000-0x000002400000 : "rootfs0"
0x000002400000-0x000003e00000 : "rootfs1"
0x000003e00000-0x000006400000 : "overlay"
0x000006400000-0x000007f80000 : "obr"

Original LOG
For now i am bricked it :frowning: with flashing u-boot from jwangac
Need help with how to switch SOC from NAND flash to SPI flash. Аnd how to build uboot for it.
I have backup of original uboot binary.
found on MTK7621 Datasheet control pins for selecting nand or spi chip on page 21:
have w25q128fv free chips, datasheet page 86 shows it have 4-byte qpi adressing.

RTS2_N, ball J3
RTS3_N, ball J4
TXD1, ball R14
GPIO0, ball P12

PIN ND_CS_N, ball G2, SPI_CS0, SPI chip select 0

1 Like

I also with my router in "brick", can you tell me how to return the original firmware? Alguem pode me ajudar a voltar o firmware original?

any updates, very hard to find out soc pinout :frowning: switch SOC from NAND flash to SPI flash.

-- update --

Install uboot breed for easy recovery

Openwrt is now available for both 4A and 4Q both of which were released after R4. Can someone care to explain why not this device?

The stock firmware isn't avaliable in Xiaomi's website. The only thing you can do, for now, is install Padavan for Mi Router 3G, which works on Mi Router 4.

To enable writing to the console, you must reset to factory settings
Then you see uboot boot, press the keyboard 4 button (enter uboot command line)

Please choose the operation: 
   1: Load system code to SDRAM via TFTP. 
   2: Load system code then write to Flash via TFTP. 
   3: Boot system code via Flash (default).
   4: Entr boot command line interface.
   7: Load Boot Loader code then write to Flash via Serial. 
   9: Load Boot Loader code then write to Flash via TFTP. 

If it is not successful, repeat the above operation of restoring the factory settings.
After entering the uboot command line, type:

setenv uart_en 1

Serial port (UART) will work

windows :
Create a simple http server with caddy( V1.0 )
like E:/working

.\caddy.exe -port 80 -root E:\working


cd /tmp
wget http://you computer ip:80/openwrt-ramips-mt7621-xiaomi_mir4-squashfs-kernel1.bin
wget http://you computer ip:80/openwrt-ramips-mt7621-xiaomi_mir4-squashfs-rootfs0.bin
mtd write openwrt-ramips-mt7621-xiaomi_mir4-squashfs-kernel1.bin kernel1
mtd write openwrt-ramips-mt7621-xiaomi_mir4-squashfs-rootfs0.bin rootfs0
nvram set flag_try_sys1_failed=1
nvram commit
scp openwrt-ramips-mt7621-xiaomi_mir4-squashfs-sysupgrade.bin root@

using ssh connect mir4

sysupgrade  openwrt-ramips-mt7621-xiaomi_mir4-squashfs-sysupgrade.bin 

it's done

check md5sum !!! check md5sum !!! check md5sum !!!

fea0fc7382fc1c4e25255319ab42bf7c openwrt-ramips-mt7621-xiaomi_mir4-initramfs-kernel.bin
70c322e7627570cc1a31cf4e16a352cb openwrt-ramips-mt7621-xiaomi_mir4-squashfs-kernel1.bin
97c574488be2718b65ee140947c0b608 openwrt-ramips-mt7621-xiaomi_mir4-squashfs-rootfs0.bin
6b68c59617a9ecb39f3c0638ef6ee89e openwrt-ramips-mt7621-xiaomi_mir4-squashfs-sysupgrade.bin

caddy V1.0.4

image openwrt 19.07.2

This thread is about R4, not R4A.
Solution for R4 is described here: Support for Xiaomi Mi Wifi 4

Sorry, but someone asked a question about mir4 on the mir4a thread

Hi All.

So what is the current status of support for 4 (not 4a/c or anything else. Just number 4)...

And if I have access to the router, using the Invasion exploit, what is the next step?

Upload an image (which image?) and use mtd (with what options??)

Thank you All

see my previous post

This one?

Hi @ioiot

None of the files is available for download.

What is the alternative?


Hi @ioiot, i`m flashed openwrt with https://github.com/acecilia/OpenWRTInvasion method , however using firmware files from your repo:


All seems to work fine untill i try to setup openvpn ... i`ve got :

ERROR: Cannot open TUN/TAP dev /dev/net/tun: No such device (errno=19)

looks like it cannot load kmod-tun module although should be compatible with the kernel version ... :

root@mi4-home-pchelina:/dev/net# uname -r

root@mi4-home-pchelina:/dev/net# lsmod | grep tun
tun                    24106 -1 [permanent]

root@mi4-home-pchelina:/dev/net# opkg list-installed | grep tun
kcptun-client - 20200409-1
kmod-tun - 4.14.171-1

root@mi4-home-pchelina:/dev/net# opkg files kmod-tun
Package kmod-tun (4.14.171-1) is installed on root and has the following files:

Do you have any suggestion on this ? perhaps i`m missing something.
Thanks in advance!

Hi @ioiot
Do you plan to release 19.07.4 for R4?
Also found PR for merging R4 support into master: https://github.com/openwrt/openwrt/pull/3330

Can you please help on how to unbrick this device by having TFTP access? I can upload files using the same r4a instructions from Xiaomi Mi Router 4A Gigabit Edition (R4AG/R4A Gigabit) -- fully supported and flashable with OpenWRTInvasion

Can you please indicate which bin file to tftp?
I bricked it by updating to openwrt for r4a

I've tried TFTP flashing this Bootloader.bin and many others bin files for the device and with all of them I get a blincking red light.

Did you manage to unbrick it?
Thank you for your patience

1 Like

Support added to master. Snapshots available in https://downloads.openwrt.org/snapshots/targets/ramips/mt7621/

1 Like