Xiaomi Mi WiFi R4 exploration

0shape · October 16, 2018, 3:32pm

Have on hands device and some pictures and logs.
Specs like Mi WiFi Router 3G
7621soc with less ram 128 mb, 128 mb nand !!!NO USB!!! and new MI button on top
com connected to usb dongle blocking device to startup
if connect after power up works fine with 115200 8n1
Successfully boot initramfs from mi3g.
Failed mtd write kernel, because partitions mismatch ?
Partitions from origin log:

Creating 14 MTD partitions on "MT7621-NAND":
0x000000000000-0x000007f80000 : "ALL"
0x000000000000-0x000000080000 : "Bootloader"
0x000000080000-0x0000000c0000 : "Config"
0x0000000c0000-0x000000100000 : "Bdata"
0x000000100000-0x000000140000 : "Factory"
0x000000140000-0x000000180000 : "crash"
0x000000180000-0x0000001c0000 : "crash_syslog"
0x0000001c0000-0x000000200000 : "cfg_bak"
0x000000200000-0x000000600000 : "kernel0"
0x000000600000-0x000000a00000 : "kernel1"
0x000000a00000-0x000002400000 : "rootfs0"
0x000002400000-0x000003e00000 : "rootfs1"
0x000003e00000-0x000006400000 : "overlay"
0x000006400000-0x000007f80000 : "obr"

Photos:
Case
Front
Back
SOC
WIFI
Ports
Original LOG
For now i am bricked it with flashing u-boot from jwangac
Need help with how to switch SOC from NAND flash to SPI flash. Аnd how to build uboot for it.
I have backup of original uboot binary.
found on MTK7621 Datasheet control pins for selecting nand or spi chip on page 21:
{RTS2_N, RTS3_N, TXD1, GPIO0}
have w25q128fv free chips, datasheet page 86 shows it have 4-byte qpi adressing.

RTS2_N, ball J3
RTS3_N, ball J4
TXD1, ball R14
GPIO0, ball P12

PIN ND_CS_N, ball G2, SPI_CS0, SPI chip select 0

kbecao85 · December 30, 2018, 4:11am

I also with my router in "brick", can you tell me how to return the original firmware? Alguem pode me ajudar a voltar o firmware original?

tienthanh2509 · June 3, 2019, 2:46am

any updates, very hard to find out soc pinout switch SOC from NAND flash to SPI flash.

-- update --

Install uboot breed for easy recovery

heychirag · September 11, 2019, 6:39pm

Openwrt is now available for both 4A and 4Q both of which were released after R4. Can someone care to explain why not this device?

nicmorais · October 12, 2019, 11:43am

The stock firmware isn't avaliable in Xiaomi's website. The only thing you can do, for now, is install Padavan for Mi Router 3G, which works on Mi Router 4.

ioiot · April 24, 2020, 9:09am

To enable writing to the console, you must reset to factory settings
Then you see uboot boot, press the keyboard 4 button (enter uboot command line)

Please choose the operation: 
   1: Load system code to SDRAM via TFTP. 
   2: Load system code then write to Flash via TFTP. 
   3: Boot system code via Flash (default).
   4: Entr boot command line interface.
   7: Load Boot Loader code then write to Flash via Serial. 
   9: Load Boot Loader code then write to Flash via TFTP.

If it is not successful, repeat the above operation of restoring the factory settings.
After entering the uboot command line, type:

setenv uart_en 1
saveenv
boot

Serial port (UART) will work

windows ：
Create a simple http server with caddy（ V1.0 ）
like E:/working

.\caddy.exe -port 80 -root E:\working

then

cd /tmp
wget http://you computer ip:80/openwrt-ramips-mt7621-xiaomi_mir4-squashfs-kernel1.bin
wget http://you computer ip:80/openwrt-ramips-mt7621-xiaomi_mir4-squashfs-rootfs0.bin
mtd write openwrt-ramips-mt7621-xiaomi_mir4-squashfs-kernel1.bin kernel1
mtd write openwrt-ramips-mt7621-xiaomi_mir4-squashfs-rootfs0.bin rootfs0
nvram set flag_try_sys1_failed=1
nvram commit
reboot

scp openwrt-ramips-mt7621-xiaomi_mir4-squashfs-sysupgrade.bin root@192.168.1.1:/root/

using ssh connect mir4

sysupgrade  openwrt-ramips-mt7621-xiaomi_mir4-squashfs-sysupgrade.bin 
reboot

it's done

check md5sum !!! check md5sum !!! check md5sum !!!

md5sum
fea0fc7382fc1c4e25255319ab42bf7c openwrt-ramips-mt7621-xiaomi_mir4-initramfs-kernel.bin
70c322e7627570cc1a31cf4e16a352cb openwrt-ramips-mt7621-xiaomi_mir4-squashfs-kernel1.bin
97c574488be2718b65ee140947c0b608 openwrt-ramips-mt7621-xiaomi_mir4-squashfs-rootfs0.bin
6b68c59617a9ecb39f3c0638ef6ee89e openwrt-ramips-mt7621-xiaomi_mir4-squashfs-sysupgrade.bin

files
caddy V1.0.4
https://github.com/caddyserver/caddy/releases/download/v1.0.4/caddy_v1.0.4_windows_amd64.zip

image openwrt 19.07.2
https://github.com/ioiotor/mir4-autobuild/releases/download/v0.1/openwrt-ramips-mt7621-xiaomi_mir4-initramfs-kernel.bin
https://github.com/ioiotor/mir4-autobuild/releases/download/v0.1/openwrt-ramips-mt7621-xiaomi_mir4-squashfs-kernel1.bin
https://github.com/ioiotor/mir4-autobuild/releases/download/v0.1/openwrt-ramips-mt7621-xiaomi_mir4-squashfs-rootfs0.bin
https://github.com/ioiotor/mir4-autobuild/releases/download/v0.1/openwrt-ramips-mt7621-xiaomi_mir4-squashfs-sysupgrade.bin

AndrewZ · April 24, 2020, 6:27am

This thread is about R4, not R4A.
Solution for R4 is described here: Support for Xiaomi Mi Wifi 4

ioiot · April 24, 2020, 9:11am

Sorry, but someone asked a question about mir4 on the mir4a thread
edited

tkontogi · August 1, 2020, 11:32pm

Hi All.

So what is the current status of support for 4 (not 4a/c or anything else. Just number 4)...

And if I have access to the router, using the Invasion exploit, what is the next step?

Upload an image (which image?) and use mtd (with what options??)

Thank you All

AndrewZ · August 2, 2020, 8:36am

see my previous post

tkontogi · August 2, 2020, 11:46am

This one?

tkontogi · August 26, 2020, 12:22pm

Hi @ioiot

None of the files is available for download.

What is the alternative?

BR
Theo

nkolev2 · September 2, 2020, 9:12am

Hi @ioiot, i`m flashed openwrt with https://github.com/acecilia/OpenWRTInvasion method , however using firmware files from your repo:

openwrt-ramips-mt7621-xiaomi_mir4-squashfs-kernel1.bin
openwrt-ramips-mt7621-xiaomi_mir4-squashfs-rootfs0.bin
openwrt-ramips-mt7621-xiaomi_mir4-squashfs-sysupgrade.bin

All seems to work fine untill i try to setup openvpn ... i`ve got :

ERROR: Cannot open TUN/TAP dev /dev/net/tun: No such device (errno=19)

looks like it cannot load kmod-tun module although should be compatible with the kernel version ... :

root@mi4-home-pchelina:/dev/net# uname -r
4.14.171

root@mi4-home-pchelina:/dev/net# lsmod | grep tun
tun                    24106 -1 [permanent]

root@mi4-home-pchelina:/dev/net# opkg list-installed | grep tun
kcptun-client - 20200409-1
kmod-tun - 4.14.171-1

root@mi4-home-pchelina:/dev/net# opkg files kmod-tun
Package kmod-tun (4.14.171-1) is installed on root and has the following files:
/etc/modules.d/30-tun
/lib/modules/4.14.171/tun.ko

Do you have any suggestion on this ? perhaps i`m missing something.
Thanks in advance!

sequentiality · September 22, 2020, 11:29am

Hi @ioiot
Do you plan to release 19.07.4 for R4?
Also found PR for merging R4 support into master: https://github.com/openwrt/openwrt/pull/3330

sequentiality · October 10, 2020, 7:51pm

brauliobo · November 22, 2020, 12:06am

Can you please help on how to unbrick this device by having TFTP access? I can upload files using the same r4a instructions from Xiaomi Mi Router 4A Gigabit Edition (R4AG/R4A Gigabit) -- fully supported and flashable with OpenWRTInvasion

Can you please indicate which bin file to tftp?
I bricked it by updating to openwrt for r4a

brauliobo · November 22, 2020, 12:19am

I've tried TFTP flashing this Bootloader.bin and many others bin files for the device and with all of them I get a blincking red light.

Did you manage to unbrick it?
Thank you for your patience

sequentiality · November 28, 2020, 1:00pm

sequentiality · December 12, 2020, 8:58am

sequentiality · December 21, 2020, 9:20am

OpenWrt 19.07.5 for Xiaomi Mi Router 4