Xiaomi Mi Router 4A Gigabit Edition

Warning.!! This hardware not same with Mi Router 4A 100m don't brick your router

Warning 05/2022 Some differences have been observed with chinese model made in Sept 2021. Serial input may require modification Click Link

Warning 10/2022 Xiaomi is currently shipping v2 of the 4A Gigabit Edition, it's identifiable by fw version 2.30.20, and the name when assigned an IP from a DHCP (not your ISPs) via the WAN port, MiWiFi-R4AV2. This model cannot be flashed with Openwrt. Click Link

The Xiaomi Mi Router 4A Gigabit Edition is an indoor wireless router based on the MediaTek MT7621 SoC, with three 10/100/1000 Ethernet ports (2xLAN + 1xWAN), dual band 802.11bgn+ac (dual radio) WiFi and four external non-detachable antennae. It is offered with either Chinese firmware, or Global International firmware.

The hardware is identical to the OpenWrt Xiaomi R3G v2. But.!! different bootloader, don't use 4A-Giga firmware on R3Gv2

Support Forums https://forum.openwrt.org/t/feedback-xiaomi-4a-gigabit-router-switch-patches/78468

How to tell the different versions apart

There are multiple versions of the Xiaomi Mi Router 4A, International and Chinese and the method used to install OpenWRT differs. The SKU printed on the box differs according to the year of manufacture. This table is an intent to list them all so as to avoid bricking.

Model	Mi Router 4A (MIR4A)
Alternate model name	R4AC		R4AG
Version	100M		Gigabit
Target market	Chinese	International?	Chinese	International	International	¿?
SKU	DVB4222CN	DVB4230GL	DVB4218CN	DVB4224GL	¿?	¿?
Firmware				2.28.132	2.28.84	2.20.30
Firmware language		English	Chinese	English?
Label language		English	Chinese	English?
PCB marking code	M49 R0101	¿?	M43 R0101		M43 R0201
Year available	2019?		2019		2021	2022?
Other notes			2019 model is shielded	unshielded since 2020

OpenWrt support

The device is the same as MIR3G v2 (which is supported as per the Git Commit), but explicit support was added in commit a51e46e543ef2e923fb97fb092d04355dfca7d7d.

The new EON/cFeon EN25QX128A chip support was added by “generic: add support for EON EN25QX128A spi nor flash”. It is supported starting from 22.03.3 and 21.02.6 stable releases.

For installing OpenWrt there are the following methods:

Using a firmware exploit (Does not require extra hardware): for instructions follow the OpenWRTInvasion repository.

Warning.!! snapshot build may brick your router if you use this method, You need to custom firmware server to older or more stable build.

A Video guide for this method can be found here:External Link

Using a chip programmer (Requires extra hardware): requires reading the stock firmware directly from the SPI flash chip (e.g., using a chip programmer), modifying the flash memory dump and writing it back to the SPI flash. For instructions follow this post on the OpenWrt forum.

Once flash chip has been modified, the Uboot can be interrupted and initramfs-kernel.bin can be loaded via TFTP. Then use sysupgrade to install squashfs-sysupgrade.bin

This particular post may be of interest too: OpenWrt forum Xiaomi 3G v2

Warning: The MAC addresses contained in the edited SPI flash files mentioned in this link will NOT match your router's original MAC addresses. It is recommended to read the SPI flash from the router, edit the dump and write the file back to your router.

Tip: It is recommended to read the original SPI flash twice and verify the MD5 checksum is the same each time to avoid creating a corrupted flash dump file. There is one report that using Windows SPI flash utils may result in dumps with mismatched MD5 checksums (ie. corrupted dump file).

Commands for using Linux flashrom util:

Reading from SPI flash: 

flashrom --programmer ch341a_spi --read r3gv2.bin -c "GD25Q128C"


Writing to SPI flash: 

flashrom --programmer ch341a_spi --write r3gv2-edited.bin -c "GD25Q128C"

Installation via Software exploit

The OpenWRTInvasion is an exploit that allows to get a shell access to the router. You will be able to connect with Telnet, SSH and FTP. Then you can upload OpenWrt image and overwrite the stock firmware.

Find the instructions in the OpenWRTInvasion repository and a video guide can be found here: Installing OpenWrt on the Xiaomi 4A, 4C, 3Gv2, 4Q, miWifi 3C and debrick method OLD VERSION or a new version Installing OpenWrt on the Xiaomi 4A, 4C, 3Gv2, 4Q, miWifi 3C and debrick method New 2022.

Notes on firmware exploit procedure

Some instructions that may help you:

To get stok
- Reset router if necessary to restore default settings.
- Connect computer to Ethernet LAN port.
- Connect Xiaomi router to the internet with the wan port
- Open in a browser http://192.168.31.1
- Configure device
  - select language, accept terms
  - Enter a wifi password (that is the admin password)
  - go to http://192.168.31.1 and enter the root password
  - when you are in, your link changed and now it have a part with something similar to stok=3700b146c87e45fea51170f87f47d34c
- git clone https://github.com/acecilia/OpenWRTInvasion
- cd OpenWRTInvasion
- python3 remote_command_execution_vulnerability.py , and put the ip and stok, it should work
[download your openwrt image, use squashfs-sysupgrade.bin image]
ftp session with user root and password root
- ftp 192.168.31.1
- cd tmp
- put path/to/openwrt-etc.bin
telnet session with user root and password root
- telnet 192.168.31.1
- cd /tmp
- mtd -e OS1 -r write openwrt.bin OS1

Warning: If you got the below error message when trying to write the openwrt image with mtd command

Could not open mtd device: OS1
Can't open device for writing!

You can run cat /proc/mtd to check the flash layout. In this case, your router is having a different flash layout and you should not proceed with the installation using mtd.

Alternative installation procedure using Microsoft Windows

Warning: Use at your own risk.

If you are unable to use a linux computer, there is an alternative to use Microsoft Windows 10 utilising the same exploit, to install OpenWrt onto 4A Gigabit router. Scroll to the bottom of this wiki page for 'Microsoft Windows installation instructions for R4A Gigabit' section.

See section at bottom of this device page which refers to the english **Quick Guide to installing OpenWrt firmware for Xiaomi Mi Router 4A Giga version.PDF** contained in the Dropbox link for instructions.

Installation

OpenWrt Factory Firmware: Use this file the first time you flash OpenWrt onto the router - i.e. use with the above mentioned exploit / install method.
OpenWrt Sysupgrade Firmware: Use this file to upgrade an OpenWrt “system” to a newer OpenWrt version.
OEM Stock Firmware: The above mentioned exploit provides a stock firmware image in its repository.

Flash Layout

This is the Flash layout under the 2.28.62 OEM firmware, after using OpenWRTInvasion to get root access.

Xiaomi Mi Router 4A (100M, Chinese version) Flash Layout
Layer0	spi0.0: 25Q127CSIG 16384KiB
Layer1	mtd0 *ALL* 16384KiB
Layer2	mtd1 *Bootloader* 192KiB	mtd2 *Config* 64KiB	mtd3 *Bdata* 64KiB	mtd4 *Factory* 64KiB	mtd5 *crash* 64KiB	mtd6 *cfg_bak* 64KiB	mtd7 *overlay* 1024KiB	mtd8 *OS1* 13312KiB		mtd10 *disk* 1536KiB
Layer2 boundaries	0x0000000-0x0030000	0x0030000-0x0040000	0x0040000-0x0050000	0x0050000-0x0060000	0x0060000-0x0070000	0x00070000-0x00080000	0x00080000-0x00180000	0x00180000-0x00e80000		0x00e80000-0x01000000
Layer3								firmware_partition 1856KiB	mtd9 *rootfs* 11456KiB
Layer3 boundaries								0x0180000-0x0350000	0x0350000-0x0e80000
Size in KiB	192KiB	64KiB	64KiB	64KiB	64KiB	64KiB	1024KiB	1856KiB	11456KiB	1536KiB
Name	*Bootloader*	*Config*	*Bdata*	*Factory*	*crash*	*cfg_bak*	*overlay*	*firmware_partition*	*rootfs*	*disk*
mountpoint	none	none	none	none	none	none	`/etc/data/mnt`	none	`/`
filesystem	unknown	unknown	unknown	unknown	unknown	unknown	JFFS2		SquashFS	JFFS2

*Note* The partitions “mtd1 config”, “mtd5 caldata”, “mtd6 unkown” and “mtd8 caldata_copy” contain vendor specific raw (without filesystem) config values about your router, like WiFi calibration data, MAC addresses, etc. It's a good idea to make a backup from them.

*Note2* You can check mtd partitions of your router yourself by using commands “cat /proc/mtd” and “dmesg”. Refer to this link.

Debricking

Using Mi Wifi Repair tool: Using MIWIFIRepairTool.x86 Mi Wifi download
Numerous antivirus tools report Mi Wifi Repair Tool (files date stamped January 2019) identify it as a 'Potentially Unwanted App'. Unclear whether there is a genuine threat or it is a 'false positive'.
PDF guide PDF guide - Mirror

Hoddys Guide Link to Hoddys Guide Youtube guide here

Zorro Router debrick method: forum info here

micky0867 bootp/tftp-server procedure: documented by Albertcp

If you have 4A Gigabit Global International model and have difficulty returning to Global International stock firmware, please read this thread: Link to Owrt forum using Mi Wifi repair tool. See also Using 2to3 firmware file.

Backport Build

unofficial stable build

(araujorm Build) https://github.com/araujorm/openwrt/releases/
(Byte-bite Build) https://github.com/Byte-bite/OpenWRT-19.07.3-Stable-MI4A-Gigabit/releases
(db260179 Build) https://gitlab.com/db260179/xiaomi-m4a/-/releases

Supporting activities

Check this post on the OpenWrt forum for all the information.

Hardware Highlights

Hardware

Info

Architecture	MIPS
Vendor	Mediatek
bootloader	U-Boot
System-On-Chip	Mediatek MT7621
CPU/Speed	mipsel_24kc @ 880MHz
Flash size	16 MB
RAM	128 MB
Wireless 2.4 GHz	Mediatek MT7603, b/g/n
Wireless 5 GHz	Mediatek MT7612, a/n/ac
Ethernet	3x 10/100/1000 BASE-TX Ethernet Interface (1x WAN, 2x LAN)
Serial	Yes

Photos

Here are pictures of the chinese version which ships with chinese language firmware v2.x. The earliest Global international model is labelled the 'Giga' version (SKU: DVB4224GL, Model R4A) which shipped with v2.28.132, upgradable to v3.0.x. A revised Global international model is labelled the 'Gigabit' version shipped with v3.x firmware.

Retail box (chinese)
Top view
Rear view
Bottom view (chinese)
Label (R4A Giga, first international version)
Label (R4A Gigabit, revised International version)

BOARD

Top view
Top view of model shipped without shielding since 2020 (Global Gigabit model was FCC approved in April 2021. The PCB in photo shows week 14 of 2021 manufacture date)

Supplied with a 12v @ 1A DC power adapter, fitted with a regular 2.1 x 5.5mm dia. x 12mm long barrel plug. Ensure the barrel plug is 12mm long. A shorter 10mm plug may result in intermittent power connection.

Opening the case

There are 2 screws on the bottom of the case both are covered by the product label. Carefully lift the ends of the label for access to the screws. There are also clips around the edge of the case you will need to prize open. Use a thin spudger/pry tool or blunt knife and start on the long edge next to the ethernet sockets and aerials. The remaining 3 sides of the cover unclip very easily by pulling the bottom cover away from the case body.

Serial

How to connect to the Serial Port of this specific device:
The pinout is described next to the port. (TX GND RX 3.3v)

Replace EXAMPLE by real values.

Serial connection parameters for Xiaomi Mi Router 4A Gigabit Edition @@Version@@	EXAMPLE 115200, 8N1

RJ45 socket DIY modification

If the ethernet plugs will not latch properly into the RJ45 sockets, the solution is to modify the case as shown below

To prevent accidental damage to the 'fragile' blue & black RJ45 sockets, the PCB can be slid slightly to one side, and the sockets taped over to block dust. Use a square file to carefully carve out the notch in the white ABS case.

The ethernet cables will latch into the RJ45 sockets with a positive and Loud click.

Bootlogs

OEM bootlog

Starting kernel ... LINUX started... THIS IS ASIC SDK 5.0.S.0 [ 0.000000] Initializing cgroup subsys cpuset [ 0.000000] Initializing cgroup subsys cpu [ 0.000000] Linux version 3.10.14 (jenkins@220e348357e7) (gcc version 4.8.5 (crosstool-NG crosstool-ng-1.22.0) ) #1 MiWiFi-R4A-2.28.37 SMP Thu Jan 24 07:53:59 UTC 2019 [ 0.000000] [ 0.000000] The CPU feqenuce set to 880 MHz [ 0.000000] GCMP present [ 0.000000] CPU0 revision is: 0001992f (MIPS 1004Kc) [ 0.000000] Software DMA cache coherency [ 0.000000] Determined physical RAM map: [ 0.000000] memory: 08000000 @ 00000000 (usable) [ 0.000000] User-defined physical RAM map: [ 0.000000] memory: 08000000 @ 00000000 (usable) [ 0.000000] Initrd not found or empty - disabling initrd [ 0.000000] Zone ranges: [ 0.000000] DMA [mem 0x00000000-0x00ffffff] [ 0.000000] Normal [mem 0x01000000-0x07ffffff] [ 0.000000] Movable zone start for each node [ 0.000000] Early memory node ranges [ 0.000000] node 0: [mem 0x00000000-0x07ffffff] [ 0.000000] Detected 3 available secondary CPU(s) [ 0.000000] Primary instruction cache 32kB, 4-way, VIPT, linesize 32 bytes. [ 0.000000] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes [ 0.000000] MIPS secondary cache 256kB, 8-way, linesize 32 bytes. [ 0.000000] PERCPU: Embedded 7 pages/cpu @8167e000 s6912 r8192 d13568 u32768 [ 0.000000] Built 1 zonelists in Zone order, mobility grouping on. Total pages: 32512 [ 0.000000] Kernel command line: console=ttyS1,115200n8 uart_en=0 factory_mode=0 mem=128m root=/dev/mtdblock9 [ 0.000000] drivers/mtd/mtdpart.c mtd_init_bootos 1085 [ 0.000000] PID hash table entries: 512 (order: -1, 2048 bytes) [ 0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes) [ 0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes) [ 0.000000] Writing ErrCtl register=0004264a [ 0.000000] Readback ErrCtl register=0004264a [ 0.000000] allocated 262144 bytes of page_cgroup [ 0.000000] please try 'cgroup_disable=memory' option if you don't want memory cgroups [ 0.000000] Memory: 123944k/131072k available (4062k kernel code, 7128k reserved, 1044k data, 264k init, 0k highmem) [ 0.000000] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=4, Nodes=1 [ 0.000000] Hierarchical RCU implementation. [ 0.000000] NR_IRQS:128 [ 0.000000] console [ttyS1] enabled [ 0.150000] Calibrating delay loop... 577.53 BogoMIPS (lpj=2887680) [ 0.210000] pid_max: default: 32768 minimum: 301 [ 0.210000] Mount-cache hash table entries: 512 [ 0.220000] Initializing cgroup subsys memory [ 0.220000] launch: starting cpu1 [ 0.230000] launch: cpu1 gone! [ 0.230000] CPU1 revision is: 0001992f (MIPS 1004Kc) [ 0.230000] Primary instruction cache 32kB, 4-way, VIPT, linesize 32 bytes. [ 0.230000] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes [ 0.230000] MIPS secondary cache 256kB, 8-way, linesize 32 bytes. [ 0.290000] Synchronize counters for CPU 1: done. [ 0.300000] launch: starting cpu2 [ 0.300000] launch: cpu2 gone! [ 0.300000] CPU2 revision is: 0001992f (MIPS 1004Kc) [ 0.300000] Primary instruction cache 32kB, 4-way, VIPT, linesize 32 bytes. [ 0.300000] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes [ 0.300000] MIPS secondary cache 256kB, 8-way, linesize 32 bytes. [ 0.360000] Synchronize counters for CPU 2: done. [ 0.370000] launch: starting cpu3 [ 0.370000] launch: cpu3 gone! [ 0.370000] CPU3 revision is: 0001992f (MIPS 1004Kc) [ 0.370000] Primary instruction cache 32kB, 4-way, VIPT, linesize 32 bytes. [ 0.370000] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes [ 0.370000] MIPS secondary cache 256kB, 8-way, linesize 32 bytes. [ 0.430000] Synchronize counters for CPU 3: done. [ 0.440000] Brought up 4 CPUs [ 0.440000] devtmpfs: initialized [ 0.440000] NET: Registered protocol family 16 [ 0.750000] release PCIe RST: RALINK_RSTCTRL = 7000000 [ 0.750000] PCIE PHY initialize [ 0.750000] ***** Xtal 40MHz ***** [ 0.760000] start MT7621 PCIe register access [ 1.350000] RALINK_RSTCTRL = 7000000 [ 1.360000] RALINK_CLKCFG1 = 73ffeff8 [ 1.360000] [ 1.360000] *************** MT7621 PCIe RC mode ************* [ 1.860000] pcie_link status = 0x3 [ 1.860000] RALINK_RSTCTRL= 7000000 [ 1.870000] *** Configure Device number setting of Virtual PCI-PCI bridge *** [ 1.870000] RALINK_PCI_PCICFG_ADDR = 21007f2 -> 21007f2 [ 1.880000] PCIE0 enabled [ 1.880000] PCIE1 enabled [ 1.880000] interrupt enable status: 300000 [ 1.890000] Port 1 N_FTS = 1b105000 [ 1.890000] Port 0 N_FTS = 1b105000 [ 1.900000] config reg done [ 1.900000] init_rt2880pci done [ 1.920000] bio: create slab <bio-0> at 0 [ 1.930000] SCSI subsystem initialized [ 1.930000] PCI host bridge to bus 0000:00 [ 1.940000] pci_bus 0000:00: root bus resource [mem 0x60000000-0x6fffffff] [ 1.940000] pci_bus 0000:00: root bus resource [io 0x1e160000-0x1e16ffff] [ 1.950000] pci_bus 0000:00: No busn resource found for root bus, will use [bus 00-ff] [ 1.960000] pci 0000:00:00.0: bridge configuration invalid ([bus 00-00]), reconfiguring [ 1.970000] pci 0000:00:01.0: bridge configuration invalid ([bus 00-00]), reconfiguring [ 1.980000] pci 0000:00:00.0: BAR 0: can't assign mem (size 0x80000000) [ 1.980000] pci 0000:00:01.0: BAR 0: can't assign mem (size 0x80000000) [ 1.990000] pci 0000:00:00.0: BAR 8: assigned [mem 0x60000000-0x600fffff] [ 2.000000] pci 0000:00:00.0: BAR 9: assigned [mem 0x60100000-0x601fffff pref] [ 2.000000] pci 0000:00:01.0: BAR 8: assigned [mem 0x60200000-0x602fffff] [ 2.010000] pci 0000:00:00.0: BAR 1: assigned [mem 0x60300000-0x6030ffff] [ 2.020000] pci 0000:00:01.0: BAR 1: assigned [mem 0x60310000-0x6031ffff] [ 2.020000] pci 0000:01:00.0: BAR 0: assigned [mem 0x60000000-0x600fffff 64bit] [ 2.030000] pci 0000:01:00.0: BAR 6: assigned [mem 0x60100000-0x6010ffff pref] [ 2.040000] pci 0000:00:00.0: PCI bridge to [bus 01] [ 2.040000] pci 0000:00:00.0: bridge window [mem 0x60000000-0x600fffff] [ 2.050000] pci 0000:00:00.0: bridge window [mem 0x60100000-0x601fffff pref] [ 2.060000] pci 0000:02:00.0: BAR 0: assigned [mem 0x60200000-0x602fffff] [ 2.060000] pci 0000:00:01.0: PCI bridge to [bus 02] [ 2.070000] pci 0000:00:01.0: bridge window [mem 0x60200000-0x602fffff] [ 2.080000] PCI: Enabling device 0000:00:00.0 (0004 -> 0006) [ 2.080000] PCI: Enabling device 0000:00:01.0 (0004 -> 0006) [ 2.090000] BAR0 at slot 0 = 0 [ 2.090000] bus=0x0, slot = 0x0 [ 2.090000] res[0]->start = 0 [ 2.100000] res[0]->end = 0 [ 2.100000] res[1]->start = 60300000 [ 2.100000] res[1]->end = 6030ffff [ 2.110000] res[2]->start = 0 [ 2.110000] res[2]->end = 0 [ 2.110000] res[3]->start = 0 [ 2.110000] res[3]->end = 0 [ 2.120000] res[4]->start = 0 [ 2.120000] res[4]->end = 0 [ 2.120000] res[5]->start = 0 [ 2.130000] res[5]->end = 0 [ 2.130000] BAR0 at slot 1 = 0 [ 2.130000] bus=0x0, slot = 0x1 [ 2.130000] res[0]->start = 0 [ 2.140000] res[0]->end = 0 [ 2.140000] res[1]->start = 60310000 [ 2.140000] res[1]->end = 6031ffff [ 2.150000] res[2]->start = 0 [ 2.150000] res[2]->end = 0 [ 2.150000] res[3]->start = 0 [ 2.160000] res[3]->end = 0 [ 2.160000] res[4]->start = 0 [ 2.160000] res[4]->end = 0 [ 2.160000] res[5]->start = 0 [ 2.170000] res[5]->end = 0 [ 2.170000] bus=0x1, slot = 0x0, irq=0x4 [ 2.170000] res[0]->start = 60000000 [ 2.180000] res[0]->end = 600fffff [ 2.180000] res[1]->start = 0 [ 2.180000] res[1]->end = 0 [ 2.190000] res[2]->start = 0 [ 2.190000] res[2]->end = 0 [ 2.190000] res[3]->start = 0 [ 2.200000] res[3]->end = 0 [ 2.200000] res[4]->start = 0 [ 2.200000] res[4]->end = 0 [ 2.200000] res[5]->start = 0 [ 2.210000] res[5]->end = 0 [ 2.210000] bus=0x2, slot = 0x1, irq=0x18 [ 2.210000] res[0]->start = 60200000 [ 2.220000] res[0]->end = 602fffff [ 2.220000] res[1]->start = 0 [ 2.220000] res[1]->end = 0 [ 2.230000] res[2]->start = 0 [ 2.230000] res[2]->end = 0 [ 2.230000] res[3]->start = 0 [ 2.230000] res[3]->end = 0 [ 2.240000] res[4]->start = 0 [ 2.240000] res[4]->end = 0 [ 2.240000] res[5]->start = 0 [ 2.250000] res[5]->end = 0 [ 2.250000] Switching to clocksource MIPS [ 2.250000] cfg80211: Calling CRDA to update world regulatory domain [ 2.260000] NET: Registered protocol family 2 [ 2.260000] TCP established hash table entries: 1024 (order: 1, 8192 bytes) [ 2.260000] TCP bind hash table entries: 1024 (order: 1, 8192 bytes) [ 2.260000] TCP: Hash tables configured (established 1024 bind 1024) [ 2.260000] TCP: reno registered [ 2.260000] UDP hash table entries: 256 (order: 1, 8192 bytes) [ 2.260000] UDP-Lite hash table entries: 256 (order: 1, 8192 bytes) [ 2.260000] NET: Registered protocol family 1 [ 2.270000] squashfs: version 4.0 (2009/01/31) Phillip Lougher [ 2.270000] jffs2: version 2.2. (NAND) (SUMMARY) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc. [ 2.270000] msgmni has been set to 242 [ 2.270000] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 253) [ 2.270000] io scheduler noop registered (default) [ 2.270000] MIWIFI panic notifier registeredreg_int_mask=0, INT_MASK= 0 [ 2.270000] HSDMA_init [ 2.270000] [ 2.270000] hsdma_phy_tx_ring0 = 0x00c00000, hsdma_tx_ring0 = 0xa0c00000 [ 2.270000] [ 2.270000] hsdma_phy_rx_ring0 = 0x00c04000, hsdma_rx_ring0 = 0xa0c04000 [ 2.270000] TX_CTX_IDX0 = 0 [ 2.270000] TX_DTX_IDX0 = 0 [ 2.270000] RX_CRX_IDX0 = 3ff [ 2.270000] RX_DRX_IDX0 = 0 [ 2.270000] set_fe_HSDMA_glo_cfg [ 2.270000] HSDMA_GLO_CFG = 465 [ 2.270000] Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled [ 2.270000] serial8250: ttyS0 at MMIO 0x1e000d00 (irq = 27) is a 16550A [ 2.270000] serial8250: ttyS1 at MMIO 0x1e000c00 (irq = 26) is a 16550A [ 2.280000] led=10, on=4000, off=1, blinks,=1, reset=1, time=4000 [ 2.280000] Ralink gpio driver initialized [ 2.280000] brd: module loaded [ 2.280000] flash manufacture id: c8, device id 40 18 [ 2.280000] GD25Q128C(c8 40180000) (16384 Kbytes) [ 2.280000] mtd .name = raspi, .size = 0x01000000 (16M) .erasesize = 0x00010000 (64K) .numeraseregions = 0 [ 2.280000] Creating 10 MTD partitions on "raspi": [ 2.280000] 0x000000000000-0x000001000000 : "ALL" [ 2.280000] 0x000000000000-0x000000030000 : "Bootloader" [ 2.280000] 0x000000030000-0x000000040000 : "Config" [ 2.280000] 0x000000040000-0x000000050000 : "Bdata" [ 2.280000] 0x000000050000-0x000000060000 : "Factory" [ 2.290000] 0x000000060000-0x000000070000 : "crash" [ 2.290000] 0x000000070000-0x000000080000 : "cfg_bak" [ 2.290000] 0x000000080000-0x000000180000 : "overlay" [ 2.290000] 0x000000180000-0x000000e80000 : "OS1" [ 2.290000] mtd: try split OS1 partition [ 2.290000] mtd: split_firmware [ 2.290000] mtd: firmware_partition->size 0xd00000 [ 2.290000] mtd: firmware_partition->offset 0x180000 [ 2.290000] mtd: uimage_len 1855601 [ 2.290000] mtd: uimage_len 1900544 [ 2.290000] mtd: rootfs_partition->size 0xb30000 [ 2.290000] mtd: rootfs_partition->offset 0x350000 [ 2.290000] mtd: partition "rootfs" created automatically, ofs=350000, len=B30000 [ 2.290000] 0x000000350000-0x000000e80000 : "rootfs" [ 2.290000] 0x000000e80000-0x000001000000 : "disk" [ 2.290000] PPP generic driver version 2.4.2 [ 2.290000] PPP BSD Compression module registered [ 2.290000] PPP Deflate Compression module registered [ 2.290000] PPP MPPE Compression module registered [ 2.290000] NET: Registered protocol family 24 [ 2.290000] PPTP driver version 0.8.5 [ 2.300000] ps: can't get major 253 [ 2.300000] GMAC1_MAC_ADRH -- : 0x0000aabb [ 2.300000] GMAC1_MAC_ADRL -- : 0xccddeef2 [ 2.300000] Ralink APSoC Ethernet Driver Initilization. v3.1 1024 rx/tx descriptors allocated, mtu = 1500! [ 2.300000] GMAC1_MAC_ADRH -- : 0x0000aabb [ 2.300000] GMAC1_MAC_ADRL -- : 0xccddeef2 [ 2.300000] PROC INIT OK! [ 2.300000] softdog: Software Watchdog Timer: 0.08 initialized. soft_noboot=0 soft_margin=60 sec soft_panic=0 (nowayout=0) [ 2.300000] Netfilter messages via NETLINK v0.30. [ 2.300000] nfnl_acct: registering with nfnetlink. [ 2.300000] nf_conntrack version 0.5.0 (1936 buckets, 7744 max) [ 2.300000] ipip: IPv4 over IPv4 tunneling driver [ 2.300000] gre: GRE over IPv4 demultiplexor driver [ 2.300000] ip_tables: (C) 2000-2006 Netfilter Core Team [ 2.300000] Type=Restricted Cone [ 2.300000] TCP: cubic registered [ 2.300000] NET: Registered protocol family 10 [ 2.300000] NET: Registered protocol family 17 [ 2.300000] l2tp_core: L2TP core driver, V2.0 [ 2.300000] l2tp_ppp: PPPoL2TP kernel driver, V2.0 [ 2.300000] l2tp_netlink: L2TP netlink interface [ 2.300000] 8021q: 802.1Q VLAN Support v1.8 [ 2.300000] find mtd name error reserved0 [ 2.300000] Failed to lock mtd reserved0 [ 2.300000] miqef: usr otp read not available [ 2.300000] miqef: mtd otp probe fail [ 2.670000] csd: CSD deadlock debugging initiated! [ 2.680000] VFS: Mounted root (squashfs filesystem) readonly on device 31:9. [ 2.690000] Freeing unused kernel memory: 264K (814fe000 - 81540000) config core 'version' # ROM ver option ROM '2.28.37' # channel option CHANNEL 'release' # hardware platform R1AC or R1N etc. option HARDWARE 'R4A' # CFE ver option UBOOT '1.0.2' # Linux Kernel ver option LINUX '0.0.1' # RAMFS ver option RAMFS '0.0.1' # SQUASHFS ver option SQAFS '0.0.1' # ROOTFS ver option ROOTFS '0.0.1' #build time option BUILDTIME 'Thu, 24 Jan 2019 07:45:23 +0000' #build timestamp option BUILDTS '1548315923' #build git tag option GTAG 'commit 0672ea2d789bb6ce0674800a379f12c515ed99d2' [ 3.970000] FFFFFFAA:BB:CC:FFFFFFDD:FFFFFFEE:FFFFFFF2 [ 3.970000] Raeth v3.1 (Tasklet,SkbRecycle) [ 3.980000] set CLK_CFG_0 = 0x40a00020!!!!!!!!!!!!!!!!!!1 [ 3.990000] phy_free_head is 0xc08000!!! [ 3.990000] phy_free_tail_phy is 0xc09ff0!!! [ 4.000000] txd_pool=a0c10000 phy_txd_pool=00C10000 [ 4.000000] ei_local->skb_free start address is 0x874226dc. [ 4.010000] free_txd: 00c10010, ei_local->cpu_ptr: 00C10000 [ 4.010000] POOL HEAD_PTR | DMA_PTR | CPU_PTR [ 4.020000] ----------------+---------+-------- [ 4.020000] 0xa0c10000 0x00C10000 0x00C10000 [ 4.030000] [ 4.030000] phy_qrx_ring = 0x00c0a000, qrx_ring = 0xa0c0a000 [ 4.040000] [ 4.040000] phy_rx_ring0 = 0x00c0c000, rx_ring0 = 0xa0c0c000 [ 4.060000] MT7530 Reset Completed!! [ 4.070000] change HW-TRAP to 0x17c8f [ 4.080000] set LAN/WAN LLLLW [ 4.090000] GMAC1_MAC_ADRH -- : 0x0000aabb [ 4.090000] GMAC1_MAC_ADRL -- : 0xccddeef2 [ 4.090000] GDMA2_MAC_ADRH -- : 0x0000aabb [ 4.100000] GDMA2_MAC_ADRL -- : 0xccddeef3 [ 4.100000] eth1: ===> VirtualIF_open [ 4.110000] MT7621 GE2 link rate to 1G [ 4.110000] CDMA_CSG_CFG = 81000000 [ 4.110000] GDMA1_FWD_CFG = 20710000 [ 4.110000] GDMA2_FWD_CFG = 20710000 - preinit - Thu Jan 24 07:53:59 UTC 2019 - regular preinit - /lib/preinit.sh: line 1: pi_indicate_led: not found 85190320 [ 5.170000] jffs2: notice: (499) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 5.320000] jffs2: notice: (513) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. jffs2 not ready yet; using ramdisk - init - [ 6.170000] ra2880stop()...Done [ 6.180000] eth1: ===> VirtualIF_close [ 6.180000] Free TX/RX Ring Memory! init started: BusyBox v1.19.4 (2019-01-24 07:43:07 UTC) Please press Enter to activate this console. rcS S boot: INFO: rc script run time limit to 65 seconds. [ 6.430000] find mtd name error crash_syslog [ 6.430000] MIWIFI crash syslog initialize skiped! Code=1 [ 7.610000] Mirror/redirect action on [ 7.630000] u32 classifier [ 7.640000] input device check on [ 7.640000] Actions configured [ 7.830000] ip_gre: GRE over IPv4 tunneling driver [ 7.930000] xt_time: kernel timezone is +0800 [ 8.040000] ip6_tables: (C) 2000-2006 Netfilter Core Team [ 8.370000] nf_nat_amanda: Unknown symbol nf_nat_amanda_hook (err 0) [ 8.530000] ip_set: protocol 6 [ 8.590000] ipaccount: ifname [lo] event[5] [ 8.590000] ipaccount: ifname [ifb0] event[5] [ 8.600000] ipaccount: ifname [eth0] event[5] [ 8.600000] ipaccount: ifname [tunl0] event[5] [ 8.610000] ipaccount: ifname [eth1] event[5] [ 8.610000] ipaccount: ifname [gre0] event[5] [ 8.610000] ipaccount: ifname [gretap0] event[5] [ 8.670000] dev_redirect OFF.dev_redirect load success. [ 9.290000] <-- RTMPAllocTxRxRingMemory, Status=0, ErrorValue=0x [ 9.290000] <-- RTMPAllocAdapterBlock, Status=0 [ 9.300000] ipaccount: ifname [wl1] event[16] [ 9.300000] ipaccount: ifname [wl1] event[5] [ 9.900000] <-- RTMPAllocTxRxRingMemory, Status=0 [ 9.920000] <-- RTMPAllocAdapterBlock, Status=0 [ 9.920000] pAd->CSRBaseAddress =0xc0d00000, csr_addr=0xc0d00000! [ 9.930000] <dbg> MAC_CSR0=1986146304, RtmpChipOpsHook [ 9.940000] <dbg> dev idx = 1! [ 9.940000] <dbg> get_dev_config_idx pAd->MACVersion = 76623000, pAd->ChipID = 76120044 [ 9.950000] ipaccount: ifname [wl0] event[16] [ 9.950000] ipaccount: ifname [wl0] event[5] [ 10.080000] ipaccount: ifname [eth0] event[11] Thu Jan 24 15:54:05 CST 2019 netconfig[832]: INFO: loading exist /etc/config/network. Thu Jan 24 15:54:05 CST 2019 netconfig[832]: config interface 'loopback' Thu Jan 24 15:54:05 CST 2019 netconfig[832]: option ifname 'lo' Thu Jan 24 15:54:05 CST 2019 netconfig[832]: option proto 'static' Thu Jan 24 15:54:05 CST 2019 netconfig[832]: option ipaddr '127.0.0.1' Thu Jan 24 15:54:05 CST 2019 netconfig[832]: option netmask '255.0.0.0' Thu Jan 24 15:54:05 CST 2019 netconfig[832]: config interface 'lan' Thu Jan 24 15:54:05 CST 2019 netconfig[832]: option ifname 'eth0' Thu Jan 24 15:54:05 CST 2019 netconfig[832]: option type 'bridge' Thu Jan 24 15:54:05 CST 2019 netconfig[832]: option proto 'static' Thu Jan 24 15:54:05 CST 2019 netconfig[832]: option ipaddr '192.168.31.1' Thu Jan 24 15:54:05 CST 2019 netconfig[832]: option netmask '255.255.255.0' Thu Jan 24 15:54:05 CST 2019 netconfig[832]: config interface 'wan' Thu Jan 24 15:54:05 CST 2019 netconfig[832]: option ifname 'eth1' Thu Jan 24 15:54:05 CST 2019 netconfig[832]: option proto 'dhcp' Thu Jan 24 15:54:05 CST 2019 netconfig[832]: config interface 'ifb' Thu Jan 24 15:54:05 CST 2019 netconfig[832]: option ifname 'ifb0' Thu Jan 24 15:54:05 CST 2019 netconfig[832]: config interface 'ready' Thu Jan 24 15:54:05 CST 2019 netconfig[832]: option proto 'static' Thu Jan 24 15:54:05 CST 2019 netconfig[832]: option ipaddr '169.254.29.1' Thu Jan 24 15:54:05 CST 2019 netconfig[832]: option netmask '255.255.255.0' Thu Jan 24 15:54:05 CST 2019 netconfig[832]: config interface 'openvpn' Thu Jan 24 15:54:05 CST 2019 netconfig[832]: option ifname 'tun0' Thu Jan 24 15:54:05 CST 2019 netconfig[832]: option proto 'openvpn' [ 12.490000] ipaccount: ifname [br-lan] event[16] [ 12.500000] ipaccount: ifname [br-lan] event[5] [ 12.500000] ipaccount: ifname [eth0] event[13] [ 12.510000] FFFFFFAA:BB:CC:FFFFFFDD:FFFFFFEE:FFFFFFF2 [ 12.510000] Raeth v3.1 (Tasklet,SkbRecycle) [ 12.520000] set CLK_CFG_0 = 0x40a00020!!!!!!!!!!!!!!!!!!1 [ 12.530000] phy_free_head is 0xc46000!!! [ 12.530000] phy_free_tail_phy is 0xc47ff0!!! [ 12.540000] txd_pool=a0c50000 phy_txd_pool=00C50000 [ 12.540000] ei_local->skb_free start address is 0x874226dc. [ 12.550000] free_txd: 00c50010, ei_local->cpu_ptr: 00C50000 [ 12.550000] POOL HEAD_PTR | DMA_PTR | CPU_PTR [ 12.560000] ----------------+---------+-------- [ 12.560000] 0xa0c50000 0x00C50000 0x00C50000 [ 12.570000] [ 12.570000] phy_qrx_ring = 0x00c45000, qrx_ring = 0xa0c45000 [ 12.580000] [ 12.580000] phy_rx_ring0 = 0x00c58000, rx_ring0 = 0xa0c58000 [ 12.610000] MT7530 Reset Completed!! [ 12.620000] change HW-TRAP to 0x17c8f [ 12.620000] set LAN/WAN LLLLW [ 12.630000] GMAC1_MAC_ADRH -- : 0x0000aabb [ 12.640000] GMAC1_MAC_ADRL -- : 0xccddeef2 [ 12.640000] eth1: ===> VirtualIF_open [ 12.640000] MT7621 GE2 link rate to 1G [ 12.640000] CDMA_CSG_CFG = 81000000 [ 12.640000] GDMA1_FWD_CFG = 20710000 [ 12.640000] GDMA2_FWD_CFG = 20710000 [ 12.650000] ipaccount: ifname [eth0] event[1] [ 12.650000] ipaccount: ifname [eth0] event[20] [ 12.650000] device eth0 entered promiscuous mode [ 12.650000] ipaccount: ifname [br-lan] event[11] [ 12.650000] ipaccount: ifname [br-lan] event[8] [ 12.650000] ipaccount: ifname [br-lan] event[8] [ 12.650000] ipaccount: ifname [br-lan] event[13] [ 12.650000] br-lan: port 1(eth0) entered forwarding state [ 12.650000] br-lan: port 1(eth0) entered forwarding state [ 12.650000] ipaccount: ifname [br-lan] event[1] [ 12.710000] ipaccount: ifname [ifb0] event[13] [ 12.720000] ipaccount: ifname [ifb0] event[1] [ 12.720000] ipaccount: ifname [lo] event[13] [ 12.730000] ipaccount: ifname [lo] event[1] [ 12.740000] ipaccount: ifname [eth1] event[13] [ 12.740000] eth1: ===> VirtualIF_open [ 12.750000] ipaccount: ifname [eth1] event[1] [ 13.490000] ipaccount: ifname [wl1] event[13] [ 13.490000] pAd->ApBootFlag = TRUE [ 13.580000] efuse_probe: efuse = 10000002 [ 13.760000] tssi_1_target_pwr_g_band = 34 [ 14.650000] br-lan: port 1(eth0) entered forwarding state [ 16.460000] <==== rt28xx_init, Status=0 [ 16.460000] ipaccount: ifname [wl2] event[16] [ 16.470000] ipaccount: ifname [wl2] event[5] [ 16.470000] ipaccount: ifname [wl3] event[16] [ 16.480000] ipaccount: ifname [wl3] event[5] [ 16.480000] ipaccount: ifname [apcli0] event[16] [ 16.490000] ipaccount: ifname [apcli0] event[5] [ 16.500000] pAd->ApBootFlag = FALSE [ 16.500000] ipaccount: ifname [wl1] event[1] [ 16.500000] ipaccount: ifname [br-lan] event[4] [ 17.270000] ipaccount: ifname [wl1] event[20] [ 17.270000] device wl1 entered promiscuous mode [ 17.280000] br-lan: port 2(wl1) entered forwarding state [ 17.280000] br-lan: port 2(wl1) entered forwarding state [ 17.310000] ipaccount: ifname [wl2] event[13] [ 17.310000] ##### mbss_cr_enable, BssId = 1 [ 17.320000] ipaccount: ifname [wl2] event[1] [ 18.450000] ipaccount: ifname [wl0] event[13] [ 18.450000] <dbg> MAC_CSR0=1986146304, rtmp_asic_top_init [ 18.490000] Set defult RDRegion value: CountryCode=CN , RDRegion=0 [ 18.710000] dev_redirect: add(+) dev redirect mapping: src:eth1->dst:ifb0 [ 19.280000] br-lan: port 2(wl1) entered forwarding state [ 20.850000] <==== rt28xx_init, Status=0 [ 20.850000] ipaccount: ifname [apclii0] event[16] [ 20.860000] ipaccount: ifname [apclii0] event[5] [ 20.860000] ipaccount: ifname [wl0] event[1] [ 21.550000] ipaccount: ifname [wl0] event[20] [ 21.550000] device wl0 entered promiscuous mode [ 21.560000] br-lan: port 3(wl0) entered forwarding state [ 21.560000] br-lan: port 3(wl0) entered forwarding state [ 23.560000] br-lan: port 3(wl0) entered forwarding state [ 24.970000] dev_redirect: add(+) dev redirect mapping: src:eth1->dst:ifb0 [ 25.870000] Ralink HW NAT Module Enabled [ 25.880000] eth0 ifindex =3 [ 25.890000] eth1 ifindex =5 [ 25.890000] HNAT: switch HNAT ON..... [ 25.890000] *hwnat reg dev ******* set dev[lo]->ifindex = 1 [ 25.900000] *hwnat reg dev ******* set dev[ifb0]->ifindex = 2 [ 25.900000] *hwnat reg dev ******* set dev[tunl0]->ifindex = 4 [ 25.920000] *hwnat reg dev ******* set dev[gre0]->ifindex = 6 [ 25.920000] *hwnat reg dev ******* set dev[gretap0]->ifindex = 7 [ 25.930000] *hwnat reg dev ******* set dev[wl1]->ifindex = 8 [ 25.940000] *hwnat reg dev ******* set dev[wl0]->ifindex = 9 [ 25.940000] *hwnat reg dev ******* set dev[br-lan]->ifindex = 10 [ 25.950000] *hwnat reg dev ******* set dev[wl2]->ifindex = 11 [ 25.950000] *hwnat reg dev ******* set dev[wl3]->ifindex = 12 [ 25.960000] *hwnat reg dev ******* set dev[apcli0]->ifindex = 13 [ 25.970000] *hwnat reg dev ******* set dev[apclii0]->ifindex = 14 [ 26.030000] HNAT: switch HNAT ON..... Thu Jan 24 15:54:21 CST 2019 boot_check[3504]: INFO: Wireless OK [ 27.970000] ipaccount: refresh dev ifname to [eth0 wl0 wl1 wl3] [ 27.970000] ipaccount: landev_init_all() add dev [eth0] is_wireless: 0. [ 27.980000] ipaccount: landev_init_all() add dev [wl0] is_wireless: 1. [ 27.990000] ipaccount: landev_init_all() add dev [wl1] is_wireless: 1. [ 27.990000] ipaccount: landev_init_all() add dev [wl3] is_wireless: 1. [ 28.170000] nf_tcp_proxy: module license 'Proprietary' taints kernel. [ 28.170000] Disabling lock debugging due to kernel taint [ 28.180000] tcpproxy_keyinfo_proc_init, create keyinfo proc entry ok! [ 28.190000] tcpproxy_init, succeed! [ 36.720000] dev_redirect: add(+) dev redirect mapping: src:eth1->dst:ifb0 [ 37.320000] dev_redirect OFF.rcS S boot: INFO: rcS S boot timing 33 seconds. Thu Jan 24 15:54:34 CST 2019 INFO: rcS S boot timing 33 seconds. rcS S boot: system type(R4A/2): SQUASH/3 Thu Jan 24 15:54:34 CST 2019 system type(R4A/2): SQUASH/3 rcS S boot: ROOTFS: /dev/root on / type squashfs (ro,relatime) Thu Jan 24 15:54:34 CST 2019 ROOTFS: /dev/root on / type squashfs (ro,relatime) [ 40.270000] led=10, on=1, off=4000, blinks,=1, reset=1, time=4000 [ 40.280000] led=8, on=1, off=4000, blinks,=1, reset=1, time=4000 [ 40.290000] led=10, on=1, off=4000, blinks,=1, reset=1, time=4000 [ 40.300000] led=8, on=4000, off=1, blinks,=1, reset=1, time=4000 uci: Entry not found Thu Jan 24 15:54:42 CST 2019 boot_check[5330]: Booting up finished.

OpenWrt bootlog

=================================================================== MT7621 stage1 code Mar 26 2019 09:44:48 (ASIC) CPU=500000000 HZ BUS=166666666 HZ ================================================================== SPI-NOR flash has JEDEC ID: c84018 Change MPLL source from XTAL to CR... do MEMPLL setting.. MEMPLL Config : 0x11100000 3PLL mode + External loopback === XTAL-40Mhz === DDR-1200Mhz === PLL3 FB_DL: 0xd, 1/0 = 584/440 35000000 PLL4 FB_DL: 0x14, 1/0 = 678/346 51000000 PLL2 FB_DL: 0x17, 1/0 = 590/434 5D000000 do DDR setting..[01F40000] Apply DDR3 Setting...(use customer AC) 0 8 16 24 32 40 48 56 64 72 80 88 96 104 11 2 120 -------------------------------------------------------------------------- ------ 0000:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0001:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0002:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0003:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0004:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0005:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0006:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0007:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0008:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0009:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 000A:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 000B:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 000C:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 000D:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 1 000E:| 0 0 0 0 0 0 0 0 1 1 1 1 1 1 1 1 000F:| 0 0 0 1 1 1 1 1 1 1 1 1 1 0 0 0 0010:| 1 1 1 1 1 1 1 1 0 0 0 0 0 0 0 0 0011:| 1 1 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0012:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0013:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0014:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0015:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0016:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0017:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0018:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0019:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 001A:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 001B:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 001C:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 001D:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 001E:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 001F:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 DRAMC_DQSCTL1[0e0]=13000000 DRAMC_DQSGCTL[124]=80000033 rank 0 coarse = 15 rank 0 fine = 64 B:| 0 0 0 0 0 0 0 0 0 0 1 1 1 0 0 0 opt_dle value:11 DRAMC_DDR2CTL[07c]=C287223D DRAMC_PADCTL4[0e4]=000022B3 DRAMC_DQIDLY1[210]=0C0A090A DRAMC_DQIDLY2[214]=070A090A DRAMC_DQIDLY3[218]=0B080807 DRAMC_DQIDLY4[21c]=0A070B08 DRAMC_R0DELDLY[018]=00001E1E ================================================================== RX DQS perbit delay software calibration ================================================================== 1.0-15 bit dq delay value ================================================================== bit| 0 1 2 3 4 5 6 7 8 9 -------------------------------------- 0 | 9 8 9 12 9 8 9 6 6 6 10 | 8 9 7 9 6 9 -------------------------------------- ================================================================== 2.dqs window x=pass dqs delay value (min~max)center y=0-7bit DQ of every group input delay:DQS0 =30 DQS1 = 30 ================================================================== bit DQS0 bit DQS1 0 (1~58)29 8 (1~57)29 1 (1~58)29 9 (1~56)28 2 (1~58)29 10 (1~60)30 3 (1~60)30 11 (1~56)28 4 (1~58)29 12 (1~58)29 5 (1~58)29 13 (1~56)28 6 (1~58)29 14 (1~58)29 7 (0~59)29 15 (1~57)29 ================================================================== 3.dq delay value last ================================================================== bit| 0 1 2 3 4 5 6 7 8 9 -------------------------------------- 0 | 10 9 10 12 10 9 10 7 7 8 10 | 8 11 8 11 7 10 ================================================================== ================================================================== TX perbyte calibration ================================================================== DQS loop = 15, cmp_err_1 = ffff0000 dqs_perbyte_dly.last_dqsdly_pass[0]=15, finish count=1 dqs_perbyte_dly.last_dqsdly_pass[1]=15, finish count=2 DQ loop=15, cmp_err_1 = ffff0000 dqs_perbyte_dly.last_dqdly_pass[0]=15, finish count=1 dqs_perbyte_dly.last_dqdly_pass[1]=15, finish count=2 byte:0, (DQS,DQ)=(8,8) byte:1, (DQS,DQ)=(8,8) DRAMC_DQODLY1[200]=88888888 DRAMC_DQODLY2[204]=88888888 20,data:88 [EMI] DRAMC calibration passed =================================================================== MT7621 stage1 code done CPU=500000000 HZ BUS=166666666 HZ =================================================================== U-Boot 1.1.3 (Jun 11 2019 - 03:30:45) Board: Ralink APSoC DRAM: 128 MB Power on memory test. Memory size= 128 MB...OK! relocate_code Pointer at: 87fb0000 Config XHCI 40M PLL RT2880_RSTSTAT_REG 0xc0030000 *************************** Board power on Occurred *************************** flash manufacture id: c8, device id 40 18 find flash: GD25Q128C ============================================ Ralink UBoot Version: 5.0.0.0 -------------------------------------------- ASIC MT7621A DualCore (MAC to MT7530 Mode) DRAM_CONF_FROM: Auto-Detection DRAM_TYPE: DDR3 DRAM bus: 16 bit Xtal Mode=3 OCP Ratio=1/3 Flash component: SPI Flash Date:Jun 11 2019 Time:03:30:45 ============================================ icache: sets:256, ways:4, linesz:32 ,total:32768 dcache: sets:256, ways:4, linesz:32 ,total:32768 ##### The CPU freq = 880 MHZ #### estimate memory size =128 Mbytes #Reset_MT7530 set LAN/WAN LLLLW restore_defaults:1 Please choose the operation: 1: Load system code to SDRAM via TFTP. 2: Load system code then write to Flash via TFTP. 3: Boot system code via Flash (default). 4: Entr boot command line interface. 7: Load Boot Loader code then write to Flash via Serial. 9: Load Boot Loader code then write to Flash via TFTP. 0 n3: System Boot system code via Flash. Booting System 1 Erasing SPI Flash... raspi_erase: offs:30000 len:10000 . Writing to SPI Flash... . done ## Booting image at bc180000 ... Image Name: MIPS OpenWrt Linux-4.14.158 Image Type: MIPS Linux Kernel Image (lzma compressed) Data Size: 2010562 Bytes = 1.9 MB Load Address: 80001000 Entry Point: 80001000 Verifying Checksum ... OK Uncompressing Kernel Image ... OK Erasing SPI Flash... raspi_erase: offs:30000 len:10000 . Writing to SPI Flash... . done commandline uart_en=0 factory_mode=0 mem=128m root=/dev/mtdblock9 No initrd ## Transferring control to Linux (at address 80001000) ... ## Giving linux memsize in MB, 128 Starting kernel ... [ 0.000000] Linux version 4.14.158 (user@opnwrt) (gcc version 8.3.0 (OpenWrt GCC 8.3.0 r11655-a283b1788a)) #0 SMP Wed Dec 11 22:00:32 2019 [ 0.000000] SoC Type: MediaTek MT7621 ver:1 eco:3 [ 0.000000] bootconsole [early0] enabled [ 0.000000] CPU0 revision is: 0001992f (MIPS 1004Kc) [ 0.000000] MIPS: machine is Xiaomi Mi Router 3G v2 [ 0.000000] Determined physical RAM map: [ 0.000000] memory: 08000000 @ 00000000 (usable) [ 0.000000] Initrd not found or empty - disabling initrd [ 0.000000] VPE topology {2,2} total 4 [ 0.000000] Primary instruction cache 32kB, VIPT, 4-way, linesize 32 bytes. [ 0.000000] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 byt es [ 0.000000] MIPS secondary cache 256kB, 8-way, linesize 32 bytes. [ 0.000000] Zone ranges: [ 0.000000] Normal [mem 0x0000000000000000-0x0000000007ffffff] [ 0.000000] HighMem empty [ 0.000000] Movable zone start for each node [ 0.000000] Early memory node ranges [ 0.000000] node 0: [mem 0x0000000000000000-0x0000000007ffffff] [ 0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000007ffffff] [ 0.000000] random: get_random_bytes called from start_kernel+0x9c/0x4d8 with crng_init=0 [ 0.000000] percpu: Embedded 14 pages/cpu s26064 r8192 d23088 u57344 [ 0.000000] Built 1 zonelists, mobility grouping on. Total pages: 32480 [ 0.000000] Kernel command line: console=ttyS0,115200n8 rootfstype=squashfs,j ffs2 [ 0.000000] PID hash table entries: 512 (order: -1, 2048 bytes) [ 0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes) [ 0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes) [ 0.000000] Writing ErrCtl register=0001294c [ 0.000000] Readback ErrCtl register=0001294c [ 0.000000] Memory: 121872K/131072K available (4785K kernel code, 247K rwdata , 1040K rodata, 1276K init, 253K bss, 9200K reserved, 0K cma-reserved, 0K highme m) [ 0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=4, Nodes=1 [ 0.000000] Hierarchical RCU implementation. [ 0.000000] NR_IRQS: 256 [ 0.000000] CPU Clock: 880MHz [ 0.000000] clocksource: GIC: mask: 0xffffffffffffffff max_cycles: 0xcaf478ab b4, max_idle_ns: 440795247997 ns [ 0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_i dle_ns: 4343773742 ns [ 0.000009] sched_clock: 32 bits at 440MHz, resolution 2ns, wraps every 48806 45118ns [ 0.007804] Calibrating delay loop... 586.13 BogoMIPS (lpj=2930688) [ 0.073977] pid_max: default: 32768 minimum: 301 [ 0.078789] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes) [ 0.085298] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes) [ 0.094430] Hierarchical SRCU implementation. [ 0.099632] smp: Bringing up secondary CPUs ... [ 0.105806] Primary instruction cache 32kB, VIPT, 4-way, linesize 32 bytes. [ 0.105816] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 byt es [ 0.105827] MIPS secondary cache 256kB, 8-way, linesize 32 bytes. [ 0.105963] CPU1 revision is: 0001992f (MIPS 1004Kc) [ 0.164381] Synchronize counters for CPU 1: done. [ 0.205910] Primary instruction cache 32kB, VIPT, 4-way, linesize 32 bytes. [ 0.205918] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 byt es [ 0.205926] MIPS secondary cache 256kB, 8-way, linesize 32 bytes. [ 0.205999] CPU2 revision is: 0001992f (MIPS 1004Kc) [ 0.255603] Synchronize counters for CPU 2: done. [ 0.287010] Primary instruction cache 32kB, VIPT, 4-way, linesize 32 bytes. [ 0.287018] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 byt es [ 0.287026] MIPS secondary cache 256kB, 8-way, linesize 32 bytes. [ 0.287100] CPU3 revision is: 0001992f (MIPS 1004Kc) [ 0.340786] Synchronize counters for CPU 3: done. [ 0.370653] smp: Brought up 1 node, 4 CPUs [ 0.378990] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, ma x_idle_ns: 19112604462750000 ns [ 0.388788] futex hash table entries: 1024 (order: 3, 32768 bytes) [ 0.395190] pinctrl core: initialized pinctrl subsystem [ 0.401798] NET: Registered protocol family 16 [ 0.416503] pull PCIe RST: RALINK_RSTCTRL = 4000000 [ 0.721720] release PCIe RST: RALINK_RSTCTRL = 7000000 [ 0.726753] ***** Xtal 40MHz ***** [ 0.730124] release PCIe RST: RALINK_RSTCTRL = 7000000 [ 0.735231] Port 0 N_FTS = 1b102800 [ 0.738675] Port 1 N_FTS = 1b102800 [ 0.742135] Port 2 N_FTS = 1b102800 [ 1.897071] PCIE2 no card, disable it(RST&CLK) [ 1.901418] -> 21007f2 [ 1.903837] PCIE0 enabled [ 1.906425] PCIE1 enabled [ 1.909045] PCI host bridge /pcie@1e140000 ranges: [ 1.913789] MEM 0x0000000060000000..0x000000006fffffff [ 1.918958] IO 0x000000001e160000..0x000000001e16ffff [ 1.924166] PCI coherence region base: 0xbfbf8000, mask/settings: 0x60000000 [ 1.940663] mt7621_gpio 1e000600.gpio: registering 32 gpios [ 1.946520] mt7621_gpio 1e000600.gpio: registering 32 gpios [ 1.952283] mt7621_gpio 1e000600.gpio: registering 32 gpios [ 1.959379] PCI host bridge to bus 0000:00 [ 1.963418] pci_bus 0000:00: root bus resource [mem 0x60000000-0x6fffffff] [ 1.970277] pci_bus 0000:00: root bus resource [io 0xffffffff] [ 1.976104] pci_bus 0000:00: root bus resource [??? 0x00000000 flags 0x0] [ 1.982863] pci_bus 0000:00: No busn resource found for root bus, will use [b us 00-ff] [ 1.991536] pci 0000:00:00.0: bridge configuration invalid ([bus 00-00]), rec onfiguring [ 1.999475] pci 0000:00:01.0: bridge configuration invalid ([bus 00-00]), rec onfiguring [ 2.008788] pci 0000:00:00.0: BAR 0: no space for [mem size 0x80000000] [ 2.015339] pci 0000:00:00.0: BAR 0: failed to assign [mem size 0x80000000] [ 2.022214] pci 0000:00:01.0: BAR 0: no space for [mem size 0x80000000] [ 2.028798] pci 0000:00:01.0: BAR 0: failed to assign [mem size 0x80000000] [ 2.035699] pci 0000:00:00.0: BAR 8: assigned [mem 0x60000000-0x600fffff] [ 2.042458] pci 0000:00:00.0: BAR 9: assigned [mem 0x60100000-0x601fffff pref ] [ 2.049605] pci 0000:00:01.0: BAR 8: assigned [mem 0x60200000-0x602fffff] [ 2.056362] pci 0000:00:00.0: BAR 1: assigned [mem 0x60300000-0x6030ffff] [ 2.063084] pci 0000:00:01.0: BAR 1: assigned [mem 0x60310000-0x6031ffff] [ 2.069854] pci 0000:01:00.0: BAR 0: assigned [mem 0x60000000-0x600fffff 64bi t] [ 2.077094] pci 0000:01:00.0: BAR 6: assigned [mem 0x60100000-0x6010ffff pref ] [ 2.084274] pci 0000:00:00.0: PCI bridge to [bus 01] [ 2.089177] pci 0000:00:00.0: bridge window [mem 0x60000000-0x600fffff] [ 2.095930] pci 0000:00:00.0: bridge window [mem 0x60100000-0x601fffff pref ] [ 2.103089] pci 0000:02:00.0: BAR 0: assigned [mem 0x60200000-0x602fffff] [ 2.109845] pci 0000:00:01.0: PCI bridge to [bus 02] [ 2.114746] pci 0000:00:01.0: bridge window [mem 0x60200000-0x602fffff] [ 2.122922] clocksource: Switched to clocksource GIC [ 2.129552] NET: Registered protocol family 2 [ 2.134592] TCP established hash table entries: 1024 (order: 0, 4096 bytes) [ 2.141464] TCP bind hash table entries: 1024 (order: 1, 8192 bytes) [ 2.147817] TCP: Hash tables configured (established 1024 bind 1024) [ 2.154232] UDP hash table entries: 256 (order: 1, 8192 bytes) [ 2.159988] UDP-Lite hash table entries: 256 (order: 1, 8192 bytes) [ 2.166491] NET: Registered protocol family 1 [ 2.402871] 4 CPUs re-calibrate udelay(lpj = 2924544) [ 2.409404] Crashlog allocated RAM at address 0x3f00000 [ 2.414817] workingset: timestamp_bits=14 max_order=15 bucket_order=1 [ 2.426392] random: fast init done [ 2.433367] squashfs: version 4.0 (2009/01/31) Phillip Lougher [ 2.439117] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORIT Y) (c) 2001-2006 Red Hat, Inc. [ 2.452503] io scheduler noop registered [ 2.456387] io scheduler deadline registered (default) [ 2.462428] Serial: 8250/16550 driver, 3 ports, IRQ sharing disabled [ 2.470255] console [ttyS0] disabled [ 2.473969] 1e000c00.uartlite: ttyS0 at MMIO 0x1e000c00 (irq = 19, base_baud = 3125000) is a 16550A [ 2.482974] console [ttyS0] enabled [ 2.482974] console [ttyS0] enabled [ 2.489835] bootconsole [early0] disabled [ 2.489835] bootconsole [early0] disabled [ 2.499861] MediaTek Nand driver init, version v2.1 Fix AHB virt2phys error [ 2.507259] spi-mt7621 1e000b00.spi: sys_freq: 220000000 [ 2.515113] m25p80 spi0.0: gd25q128 (16384 Kbytes) [ 2.519954] 8 fixed-partitions partitions found on MTD device spi0.0 [ 2.526313] Creating 8 MTD partitions on "spi0.0": [ 2.531089] 0x000000000000-0x000000030000 : "u-boot" [ 2.537146] 0x000000030000-0x000000040000 : "u-boot-env" [ 2.543574] 0x000000040000-0x000000050000 : "Bdata" [ 2.549393] 0x000000050000-0x000000060000 : "factory" [ 2.555448] 0x000000060000-0x000000070000 : "crash" [ 2.561240] 0x000000070000-0x000000080000 : "cfg_bak" [ 2.567263] 0x000000080000-0x000000180000 : "overlay" [ 2.573279] 0x000000180000-0x000001000000 : "firmware" [ 2.579478] 2 uimage-fw partitions found on MTD device firmware [ 2.585420] Creating 2 MTD partitions on "firmware": [ 2.590370] 0x000000000000-0x0000001eae02 : "kernel" [ 2.596383] 0x0000001eae02-0x000000e80000 : "rootfs" [ 2.602256] mtd: device 9 (rootfs) set to be root filesystem [ 2.608015] 1 squashfs-split partitions found on MTD device rootfs [ 2.614211] 0x000000550000-0x000000e80000 : "rootfs_data" [ 2.621231] libphy: Fixed MDIO Bus: probed [ 2.694912] libphy: mdio: probed [ 4.099228] mtk_soc_eth 1e100000.ethernet: loaded mt7530 driver [ 4.105904] mtk_soc_eth 1e100000.ethernet eth0: mediatek frame engine at 0xbe 100000, irq 21 [ 4.117067] NET: Registered protocol family 10 [ 4.123192] Segment Routing with IPv6 [ 4.126935] NET: Registered protocol family 17 [ 4.131422] 8021q: 802.1Q VLAN Support v1.8 [ 4.138153] hctosys: unable to open rtc device (rtc0) [ 4.146912] VFS: Mounted root (squashfs filesystem) readonly on device 31:9. [ 4.158234] Freeing unused kernel memory: 1276K [ 4.162756] This architecture does not have kernel memory protection. [ 4.409625] mtk_soc_eth 1e100000.ethernet eth0: port 4 link up [ 4.632706] init: Console is alive [ 4.636431] init: - watchdog - [ 5.093151] kmodloader: loading kernel modules from /etc/modules-boot.d/* [ 5.172565] kmodloader: done loading kernel modules from /etc/modules-boot.d/ * [ 5.193225] init: - preinit - [ 6.031998] mtk_soc_eth 1e100000.ethernet: PPE started Press the [f] key and hit [enter] to enter failsafe mode Press the [1], [2], [3] or [4] key and hit [enter] to [ 6.100676] mtk_soc_eth 1e100000.ethernet eth0: port 3 link up select the debug level [ 6.111687] random: procd: uninitialized urandom read (4 bytes read) [ 9.276270] jffs2: notice: (451) jffs2_build_xattr_subsystem: complete buildi ng xattr subsystem, 5 of xdatum (2 unchecked, 2 orphan) and 25 of xref (2 dead, 0 orphan) found. [ 9.293308] mount_root: switching to jffs2 overlay [ 9.315307] overlayfs: upper fs does not support tmpfile. [ 9.325645] urandom-seed: Seeding with /etc/urandom.seed [ 9.417055] mtk_soc_eth 1e100000.ethernet: 0x100 = 0x6060000c, 0x10c = 0x8081 8 [ 9.433329] procd: - early - [ 9.436308] procd: - watchdog - [ 10.123061] procd: - watchdog - [ 10.126556] procd: - ubus - [ 10.178642] random: ubusd: uninitialized urandom read (4 bytes read) [ 10.186643] random: ubusd: uninitialized urandom read (4 bytes read) [ 10.193420] random: ubusd: uninitialized urandom read (4 bytes read) [ 10.200629] procd: - init - Please press Enter to activate this console. [ 10.738285] kmodloader: loading kernel modules from /etc/modules.d/* [ 10.750296] ip6_tables: (C) 2000-2006 Netfilter Core Team [ 10.763449] Loading modules backported from Linux version v5.4-rc8-0-gaf42d34 66bdc [ 10.771013] Backport generated by backports.git v5.4-rc8-1-0-g368e8c51 [ 10.779852] ip_tables: (C) 2000-2006 Netfilter Core Team [ 10.792671] nf_conntrack version 0.5.0 (2048 buckets, 8192 max) [ 10.838409] xt_time: kernel timezone is -0000 [ 10.892218] bus=0x2, slot = 0x1, irq=0xff [ 10.896298] PCI: Enabling device 0000:00:01.0 (0004 -> 0006) [ 10.902118] mt7603e 0000:02:00.0: ASIC revision: 76030010 [ 11.044347] urngd: v1.0.1 started. [ 11.179301] random: crng init done [ 11.182689] random: 6 urandom warning(s) missed due to ratelimiting [ 11.994084] mt7603e 0000:02:00.0: Firmware Version: ap_pcie [ 11.999655] mt7603e 0000:02:00.0: Build Time: 20160107100755 [ 12.042907] mt7603e 0000:02:00.0: firmware init done [ 12.227556] bus=0x1, slot = 0x0, irq=0xff [ 12.231603] PCI: Enabling device 0000:00:00.0 (0004 -> 0006) [ 12.237495] mt76x2e 0000:01:00.0: ASIC revision: 76120044 [ 12.990671] mt76x2e 0000:01:00.0: ROM patch build: 20141115060606a [ 13.004552] mt76x2e 0000:01:00.0: Firmware Version: 0.0.00 [ 13.010063] mt76x2e 0000:01:00.0: Build: 1 [ 13.014205] mt76x2e 0000:01:00.0: Build Time: 201507311614____ [ 13.043000] mt76x2e 0000:01:00.0: Firmware running! [ 13.059186] PPP generic driver version 2.4.2 [ 13.065181] NET: Registered protocol family 24 [ 13.072568] kmodloader: done loading kernel modules from /etc/modules.d/* [ 19.385484] mtk_soc_eth 1e100000.ethernet: PPE started [ 19.398046] br-lan: port 1(eth0.1) entered blocking state [ 19.403556] br-lan: port 1(eth0.1) entered disabled state [ 19.409608] device eth0.1 entered promiscuous mode [ 19.414464] device eth0 entered promiscuous mode [ 19.422877] br-lan: port 1(eth0.1) entered blocking state [ 19.428371] br-lan: port 1(eth0.1) entered forwarding state [ 19.434481] IPv6: ADDRCONF(NETDEV_UP): br-lan: link is not ready [ 20.524815] IPv6: ADDRCONF(NETDEV_CHANGE): br-lan: link becomes ready [ 22.525790] IPv6: ADDRCONF(NETDEV_UP): wlan1: link is not ready [ 22.539354] br-lan: port 2(wlan1) entered blocking state [ 22.544755] br-lan: port 2(wlan1) entered disabled state [ 22.550903] device wlan1 entered promiscuous mode [ 22.615386] IPv6: ADDRCONF(NETDEV_UP): wlan0: link is not ready [ 22.628715] br-lan: port 3(wlan0) entered blocking state [ 22.634161] br-lan: port 3(wlan0) entered disabled state [ 22.640333] device wlan0 entered promiscuous mode [ 22.645667] br-lan: port 3(wlan0) entered blocking state [ 22.651041] br-lan: port 3(wlan0) entered forwarding state [ 23.556023] br-lan: port 3(wlan0) entered disabled state [ 23.561952] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 23.568718] br-lan: port 2(wlan1) entered blocking state [ 23.574065] br-lan: port 2(wlan1) entered forwarding state [ 24.581174] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 24.587874] br-lan: port 3(wlan0) entered blocking state [ 24.593217] br-lan: port 3(wlan0) entered forwarding state BusyBox v1.31.1 () built-in shell (ash) _______ ________ __ | |.-----.-----.-----.| | | |.----.| |_ | - || _ | -__| || | | || _|| _| |_______|| __|_____|__|__||________||__| |____| |__| W I R E L E S S F R E E D O M ----------------------------------------------------- OpenWrt SNAPSHOT, r11655-a283b1788a ----------------------------------------------------- root@mi4ag:/#

Notes

Warning Xiaomi is currently shipping Mi Router 4A Gigabit Edition devices without proper shielding since 2020. Be aware that those might cause problems due to radio interference. Nevertheless, it's flashable.

Alternative firmware for R4A Gigabit

Warning: Use at your own risk. Do not install Padavan firmware on later models with Eon or CFeon flash chips. Also not for latest v2 model. Padavan has been tested on very early 'Giga' 2019 model.

For a quite long time, there is an alternative firmware called “Padavan”.

For Xiaomi Mi Router 4A Gigabit Edition, the Padavan firmware is based on the deprecated Linux kernel version 3.4.113 that has reached EOL as of October 2016. Despite that this is rather outdated firmware, it was quite popular some time in certain countries because of its convenient and user-friendly interface, which is suitable even for non-advanced users, albeit potentially vulnerable due to the lack of updates and security patches. There is a community of enthusiasts that still produces fixes and custom builds for this firmware. The most popular fork for this firmware with a stable version can be found in this repository: Github link.

On the '4pda' forum, there are Windows scripts for flashing the alternative Padavan firmware on the Xiaomi 4A Gigabit (R3Gv2). In addition to being able to flash alternative firmware, these scripts can be reused for flashing OpenWrt. The original post with details and instructions can be found here: Link to 4pda.to forum

Microsoft Windows installation instructions for R4A Gigabit

Warning: Use at your own risk. Successfully tested by a number of OpenWrt users for Giga and Gigabit models.

Windows-based scripts that are provided in the '4pda' forum allow to flash OpenWrt into Xiaomi 4A Gigabit (R3Gv2) on the Windows 10 PC via Windows command prompt. These scripts use OpenWRTInvasion vulnerability method too. The original instructions for this process are available in this post: Link to 4pda.to forum

Note: the files with instructions from this forum (dated upto September 2020) were translated to English and uploaded to this dropbox folder: Link to dropbox. Link to dropbox mirror

The PDF guide in the dropbox folder contains the most up to date instructions:
-- Quick Guide to installing OpenWrt firmware for Xiaomi Mi Router 4A Giga version 1.1.PDF

100mb WAN port negotiation issues

Owrt forum Issue known to exist up to 21.02.2 (and possibly later - TBC), when R4AG WAN port is connected to certain 100mb ports. The problem appears to be resolved in snapshots since 22 Feb 2022, and from 22.03.0-rc1.

FS#3839

5 GHz wireless issues

FS#3989

Unable to install OpenWrt to new R4A 'Gigabit' edition

Update (2023): EON EN25QX128 flash chip is supported starting from 22.03.3 and 21.02.6 stable releases.

New EON EN25QX128 flash chip found in Chinese Language firmware model Second reported case found in Chinese Language firmware model Same flash chip (EON EN25QX128A, ID 1c7118) found in a new 4C

Issue: 9442 - xiaomi-4a-gigabit-edition has a new flash which is EN25QX128@44Mhz cause a endless reboot Add support for Eon flash chip

You can determine which flash chip is fitted by inspecting the markings on the 8 legged chip which is near the DC power socket. It is just about visible by looking through the holes in the bottom of the case, or by opening the case.

As of August 2022, devices with global international v3.x firmware with manufacture date of 2022, and devices with chinese firmware from later half of 2021 have so far been found to contain the Eon flash chip. The manufacture date may be found on the barcode label attached to the cardboard shipping box.

The Debrick instruction for the MiWiFiRepairToolx86 can be used to restore Xiaomi stock firmware on these devices fitted with Eon flash chip.