First Impression on the Xiaomi WiFi+
Here a first look at the Xiaomi WiFi+ PCB and Software is given.
Hardware:
- CPU MIPS MediaTek MT7628K/N
- 8MB SPI Flash MX25L1605D
Connecting over UART:
There is a very basic console on the Xiaomi WiFi+.
It is possible to view some debug information or switch a LED off.
CMD>ls cfg net os nvram miio diag CMD>cd diag DIAG>ls led button DIAG>led Usuage: ledArguments: id: 0, blue; 1, yellow; 2, red. status: 0, off; 1, on DIAG>led 1 off
Boot Output:
[04010D09][04010C0A][85890000][22244448][00222447] DU Setting Cal Done U-Boot 1.1.3 (Apr 21 2017 - 10:57:16) Board: Ralink APSoC DRAM: 8 MB relocate_code Pointer at: 807b8000 flash manufacture id: c2, device id 20 15 find flash: MX25L1605D ============================================ Ralink UBoot Version: 4.3.0.0 -------------------------------------------- ASIC 7628_MP (Port5<->None) DRAM component: 64 Mbits DDR, width 16 DRAM bus: 16 bit Total memory: 8 MBytes Flash component: SPI Flash Date:Apr 21 2017 Time:10:57:16 ============================================ icache: sets:512, ways:4, linesz:32 ,total:65536 dcache: sets:256, ways:4, linesz:32 ,total:32768 ##### The CPU freq = 575 MHZ #### estimate memory size =8 Mbytes 3: System Boot system code via Flash. Booting System 1 Erasing SPI Flash... . Writing to SPI Flash... . done ## Booting image at bc050000 ... Image Name: zxrouter Image Type: MIPS Linux Standalone Program (uncompressed) Data Size: 721648 Bytes = 704.7 kB Load Address: 80500000 Entry Point: 80500000 Verifying Checksum ... OK OK ZzOK diag init attach irq vector = 5 isr =0x8018b024 Init device '/dev/ttydiag' Init device '/dev/tty0' Init device '/dev/tty1' Init device '/dev/haldiag' Init device '/dev/ser0' ra305x SERIAL init - dev: b0000c00.26 %��сdevice '/dev/ser1' isr =0x80014044 ra305x SERIAL init - dev: b0000d00.27 attach irq vector = 27 isr =0x80014044 Init device '/dev/ser2' ra305x SERIAL init - dev: b0000e00.28 attach irq vector = 28 isr =0x80014044 [cyg_net_init] Init: mbinit(0x00000000) [cyg_net_init] Init: cyg_net_init_devs(0x00000000) Init device 'ra305x_eth0' ifra305x eth0: init pnde=80219cd0, sc=801f011c, ifp=801f0370 ifra305x: driver init ifra305x: init numtxd=4 txd-base=800 at a0224460 ifra305x: init num_rxd=4 rxd_base=900 at a02244a0 attach irq vector = 3 isr =0x80017648 attach irq vector = 23 isr =0x800175f0 flash manufacture id: c2, device id 20 15 flash: mx25l1605d flsh_cfg_boot_off: 40000! CFG_load: flash offset=32c4, len=10ec cfg_parse: add cfg item=325 (4332 bytes) CFG_load: flash read 325 items(4332 bytes) into ram cfg_parse: null config! cfg_load_static: read-only 2 items(48 bytes) into ram CFG_load: total 327 items(4380 bytes) cfg_parse_wlan: parse 3026 bytes! Parsing WIFI configuration succeeds LAN port mask =1f Init device 'ra305x_eth1' ifra305x eth1: init pnde=80219ce0, sc=801f0230, ifp=801f03b8 WAN port mask =0 Init device 'ra0' === pAd = 0x80272db0, size = 1039536 === <-- RTMPAllocTxRxRingMemory, Status=0, ErrorValue=0x <-- RTMPAllocAdapterBlock, Status=0 rt_ecos_init:150 RtmpChipOpsHook(536): Not support for HIF_MT yet! mt7628_init()--> mt7628_init(FW(8a00), HW(8a01), CHIPID(7628)) e2.bin mt7628_init(1108)::(2), pChipCap->fw_len(63536) mt_bcn_buf_init(262): Not support for HIF_MT yet! <--mt7628_init() attach irq vector = 4 isr =0x800ca938 Init device 'apcli0' [cyg_net_init] Init: loopattach(0x00000000) [cyg_net_init] Init: ifinit(0x00000000) [cyg_net_init] Init: domaininit(0x00000000) [cyg_net_init] Init: cyg_net_add_domain(0x80213598) New domain internet at 0x00000000 [cyg_net_init] Init: cyg_net_add_domain(0x80213268) New domain route at 0x00000000 [cyg_net_init] Init: call_route_init(0x00000000) [cyg_net_init] Init: sysctl_register_all(0x00000000) [cyg_net_init] Done [cpuload_init]:calibration=9659180RPST_set, old:Uninitialized, new:Uninitialized Operation Mode: AP Client opmode = 2 [ra305x_close]====> [ra305x_close]<==== [ra305x_restart]====> ifra305x eth0: init pnde=80219cd0, sc=801f011c, ifp=801f0370 ifra305x: driver init ifra305x: init numtxd=4 txd-base=800 at a0224460 ifra305x: init num_rxd=4 rxd_base=900 at a02244a0 LAN port mask =1f ifra305x eth1: init pnde=80219ce0, sc=801f0230, ifp=801f03b8 WAN port mask =0 ifra305x1: start [ra305x_restart]<==== ifra305x0: start ifra305x0: start ----------------------------------------- eth0: Get IP by manual IP address:10.10.10.1 MASK:255.255.255.0 Broadcast:10.10.10.255 Gateway:255.255.255.255 Server:0.0.0.0 mtu:0 Domain Name: ----------------------------------------- interface eth0 init_net successed! ifra305x1: start TX_BCN DESC 0xa02269e4 size = 320 RX[0] DESC 0xa02271e4 size = 1024 RX[1] DESC 0xa02275e4 size = 1024 cfg_mode=9 cfg_mode=9 wmode_band_equal(): Band Equal! RTMPReadParametersHook->first wifi load fw image from fw_header_image AndesMTLoadFwMethod1(2187)::pChipCap->fw_len(63536) CmdAddressLenReq:(ret = 0) CmdFwStartReq: override = 1, address = 1048576 CmdStartDLRsp: WiFI FW Download Success MtAsicDMASchedulerInit(): DMA Scheduler Mode=0(LMAC) RtmpChipOpsEepromHook::e2p_type=0, inf_Type=4 RtmpEepromGetDefault::e2p_dafault=2 RtmpChipOpsEepromHook: E2P type(2), E2pAccessMode = 2, E2P default = 2 NVM is FLASH mode 1. Phy Mode = 14 Country Region from e2p = ffff tssi_1_target_pwr_g_band = 34 2. Phy Mode = 14 3. Phy Mode = 14 NICInitPwrPinCfg(11): Not support for HIF_MT yet! NICInitializeAsic(599): Not support rtmp_mac_sys_reset () for HIF_MT yet! mt_mac_init()--> MtAsicInitMac()--> mt7628_init_mac_cr()--> MtAsicSetMacMaxLen(1211): Set the Max RxPktLen=1024! <--mt_mac_init() WTBL Segment 1 info: MemBaseAddr/FID:0x28000/0 EntrySize/Cnt:32/128 WTBL Segment 2 info: MemBaseAddr/FID:0x40000/0 EntrySize/Cnt:64/128 WTBL Segment 3 info: MemBaseAddr/FID:0x42000/64 EntrySize/Cnt:64/128 WTBL Segment 4 info: MemBaseAddr/FID:0x44000/128 EntrySize/Cnt:32/128 AntCfgInit(2529): Not support for HIF_MT yet! MCS Set = ff ff 00 00 00 MtAsicSetChBusyStat(818): Not support for HIF_MT yet! MtAsicSetPiggyBack(754): Not support for HIF_MT yet! MtAsicSetTxPreamble(2833): Not support for HIF_MT yet! MtAsicSetPreTbtt(): bss_idx=0, PreTBTT timeout = 0xf0 Main bssid = 34:ce:00:70:6c:c9 <==== rt28xx_init, Status=0 ==>Set_Debug_Proc() <==Set_Debug_Proc(RTDebugLevel = 1) bridge_cfg : eth0 eth1, ra0 RPST_set, old:Uninitialized, new:Initialized BRIDGE 020214 loaded eth0: promiscuous mode enabled eth1: promiscuous mode enabled ra0: promiscuous mode enabled ----------------------------------------- Bridge Id: 1 eth0: if_flags=0xffff8943 bdg_flags=0x5 eth1: if_flags=0xffff8943 bdg_flags=0x5 ra0: if_flags=0xffff8943 bdg_flags=0x5 (max cache: 128, timeout: 300) ----------------------------------------- CFG_commit: 0 update! DNS_daemon dnsMasqstart interfaceGet(): bind socket successful on 10.10.10.1:53 serverInit(): DNS Server List 0. 10.10.10.1:53 CMD> 0 'bootcmd'->'tftp' 0 'bootdelay'->'0' 0 'baudrate'->'115200' 0 'ethaddr'->'"00:AA:BB:CC:DD:10"' 0 'ipaddr'->'10.10.10.123' 0 'serverip'->'10.10.10.3' 0 'stdin'->'serial' 0 'stdout'->'serial' 0 'stderr'->'serial' 0 'flag_boot_rootfs'->'0' CFG_commit: 1 update! ...+.miio: connect to ot.io.mi.com ott.io.mi.com AP Client Ssid: RPST_set, old:Initialized, new:AP Mode rf cmd:[1] ======<<<<<<=====Repeater Status: AP Mode======<<<<<<====== (ApCliCtrlDisconnectReqAction) 2. Before do ApCliLinkDown. ...+....+....+.Started WatchDog Timer. AddTxSType: already registered TxSType (PID = 32, Format = 0 The 2-BSSID mode is enabled, the BSSID byte5 MUST be the multiple of 2 ======<<<<<< Stop apcli0 <<<<<<===== (ApCliCtrlDisconnectReqAction) 2. Before do ApCliLinkDown. mcmd:[20] link[0] chk_link[0] flsh_cfg_boot_off: 40000! CFG_load: flash offset=32c4, len=10ec cfg_parse: add cfg item=325 (4332 bytes) CFG_load: flash read 325 items(4332 bytes) into ram cfg_parse: null config! cfg_load_static: read-only 2 items(48 bytes) into ram CFG_load: total 327 items(4380 bytes) cfg_parse_wlan: parse 3026 bytes! Parsing WIFI configuration succeeds ======<<<<<< Start ssid: SSID=xiaomi-repeater-v2_miap6cc9 <<<<<<===== MtAsicSetPreTbtt(): bss_idx=0, PreTBTT timeout = 0x0 MtAsicSetPiggyBack(754): Not support for HIF_MT yet! MtAsicSetPiggyBack(754): Not support for HIF_MT yet! MtAsicSetTxPreamble(2833): Not support for HIF_MT yet! AddTxSType: already registered TxSType (PID = 32, Format = 0 The 2-BSSID mode is enabled, the BSSID byte5 MUST be the multiple of 2 AddTxSType: already registered TxSType (PID = 6, Format = 0 MtAsicSetPreTbtt(): bss_idx=0, PreTBTT timeout = 0xf0 Main bssid = 34:ce:00:70:6c:c9 MtAsicSetPreTbtt(): bss_idx=0, PreTBTT timeout = 0x0 MtAsicSetPiggyBack(754): Not support for HIF_MT yet! MtAsicSetPiggyBack(754): Not support for HIF_MT yet! MtAsicSetTxPreamble(2833): Not support for HIF_MT yet! AddTxSType: already registered TxSType (PID = 32, Format = 0 The 2-BSSID mode is enabled, the BSSID byte5 MUST be the multiple of 2 AddTxSType: already registered TxSType (PID = 6, Format = 0 MtAsicSetPreTbtt(): bss_idx=0, PreTBTT timeout = 0xf0 Main bssid = 34:ce:00:70:6c:c9 MtAsicSetPreTbtt(): bss_idx=0, PreTBTT timeout = 0x0 MtAsicSetPiggyBack(754): Not support for HIF_MT yet! MtAsicSetPiggyBack(754): Not support for HIF_MT yet! MtAsicSetTxPreamble(2833): Not support for HIF_MT yet! AddTxSType: already registered TxSType (PID = 32, Format = 0 The 2-BSSID mode is enabled, the BSSID byte5 MUST be the multiple of 2 AddTxSType: already registered TxSType (PID = 6, Format = 0 MtAsicSetPreTbtt(): bss_idx=0, PreTBTT timeout = 0xf0 Main bssid = 34:ce:00:70:6c:c9 ======<<<<<< start_lan_dhcpd <<<<<<===== CFG_commit: 0 update! CFG_commit: 0 update! CFG_save: write 4320 bytes to flash:CFG_CHKSUM=f89ec60d, len=4320 CFG_save: flsh run-out, erase. ....+. CMD>
Hello sir/mam, I have a question about the xiaomi mi wifi repeater 2 that was posted to your website.
https://nm-projects.de/2017/12/first-impression-on-the-xiaomi-wifi/
My question is did you know where is the receiver part of the wifi where this part scan wifi routers, hotspots etc. I just want to connect a cantenna to improve the signal strenght. I’m working this thing now and thinking where to connect the cantenna, where on the pcb part you must connect the cantenna. I will appreciate if you reply thank you!