First Impression on the Xiaomi WiFi+

First Impression on the Xiaomi WiFi+


Here a first look at the Xiaomi WiFi+ PCB and Software is given.

Hardware:

  • CPU MIPS MediaTek MT7628K/N
  • 8MB SPI Flash MX25L1605D

Connecting over UART:

There is a very basic console on the Xiaomi WiFi+.
It is possible to view some debug information or switch a LED off.

CMD>ls
cfg         net         os          nvram       miio        diag  
CMD>cd diag
DIAG>ls
led         button      
DIAG>led
Usuage:   led  
Arguments:
        id: 0, blue; 1, yellow; 2, red.
        status: 0, off; 1, on

DIAG>led 1 off

Boot Output:

[04010D09][04010C0A][85890000][22244448][00222447]
DU Setting Cal Done


U-Boot 1.1.3 (Apr 21 2017 - 10:57:16)

Board: Ralink APSoC DRAM:   8 MB
relocate_code Pointer at: 807b8000
flash manufacture id: c2, device id 20 15
find flash: MX25L1605D
============================================ 
Ralink UBoot Version: 4.3.0.0
-------------------------------------------- 
ASIC 7628_MP (Port5<->None)
DRAM component: 64 Mbits DDR, width 16
DRAM bus: 16 bit
Total memory: 8 MBytes
Flash component: SPI Flash
Date:Apr 21 2017  Time:10:57:16
============================================ 
icache: sets:512, ways:4, linesz:32 ,total:65536
dcache: sets:256, ways:4, linesz:32 ,total:32768 

 ##### The CPU freq = 575 MHZ #### 
 estimate memory size =8 Mbytes
   
3: System Boot system code via Flash.
Booting System 1
Erasing SPI Flash...
.
Writing to SPI Flash...
.
done
## Booting image at bc050000 ...
   Image Name:   zxrouter
   Image Type:   MIPS Linux Standalone Program (uncompressed)
   Data Size:    721648 Bytes = 704.7 kB
   Load Address: 80500000
   Entry Point:  80500000
   Verifying Checksum ... OK
OK
  ZzOK
      diag init
attach irq vector = 5 isr =0x8018b024
Init device '/dev/ttydiag'
Init device '/dev/tty0'
Init device '/dev/tty1'
Init device '/dev/haldiag'
Init device '/dev/ser0'
ra305x SERIAL init - dev: b0000c00.26
%��сdevice '/dev/ser1' isr =0x80014044
ra305x SERIAL init - dev: b0000d00.27
attach irq vector = 27 isr =0x80014044
Init device '/dev/ser2'
ra305x SERIAL init - dev: b0000e00.28
attach irq vector = 28 isr =0x80014044
[cyg_net_init] Init: mbinit(0x00000000)
[cyg_net_init] Init: cyg_net_init_devs(0x00000000)
Init device 'ra305x_eth0'
ifra305x eth0: init pnde=80219cd0, sc=801f011c, ifp=801f0370
ifra305x: driver init
ifra305x: init numtxd=4 txd-base=800 at a0224460
ifra305x: init num_rxd=4 rxd_base=900 at a02244a0
attach irq vector = 3 isr =0x80017648
attach irq vector = 23 isr =0x800175f0
flash manufacture id: c2, device id 20 15
flash: mx25l1605d
flsh_cfg_boot_off: 40000!
CFG_load: flash offset=32c4, len=10ec
cfg_parse: add cfg item=325 (4332 bytes)
CFG_load: flash read 325 items(4332 bytes) into ram
cfg_parse: null config!
cfg_load_static: read-only 2 items(48 bytes) into ram
CFG_load: total 327 items(4380 bytes)
cfg_parse_wlan: parse 3026 bytes!
Parsing WIFI configuration succeeds
LAN port mask =1f
Init device 'ra305x_eth1'
ifra305x eth1: init pnde=80219ce0, sc=801f0230, ifp=801f03b8
WAN  port mask =0
Init device 'ra0'


=== pAd = 0x80272db0, size = 1039536 ===

<-- RTMPAllocTxRxRingMemory, Status=0, ErrorValue=0x
<-- RTMPAllocAdapterBlock, Status=0
rt_ecos_init:150
RtmpChipOpsHook(536): Not support for HIF_MT yet!
mt7628_init()-->
mt7628_init(FW(8a00), HW(8a01), CHIPID(7628))
e2.bin mt7628_init(1108)::(2), pChipCap->fw_len(63536)
mt_bcn_buf_init(262): Not support for HIF_MT yet!
<--mt7628_init()
attach irq vector = 4 isr =0x800ca938
Init device 'apcli0'
[cyg_net_init] Init: loopattach(0x00000000)
[cyg_net_init] Init: ifinit(0x00000000)
[cyg_net_init] Init: domaininit(0x00000000)
[cyg_net_init] Init: cyg_net_add_domain(0x80213598)
New domain internet at 0x00000000
[cyg_net_init] Init: cyg_net_add_domain(0x80213268)
New domain route at 0x00000000
[cyg_net_init] Init: call_route_init(0x00000000)
[cyg_net_init] Init: sysctl_register_all(0x00000000)
[cyg_net_init] Done

[cpuload_init]:calibration=9659180RPST_set, old:Uninitialized, new:Uninitialized
Operation Mode: AP Client
opmode = 2
[ra305x_close]====>
[ra305x_close]<====
[ra305x_restart]====>
ifra305x eth0: init pnde=80219cd0, sc=801f011c, ifp=801f0370
ifra305x: driver init
ifra305x: init numtxd=4 txd-base=800 at a0224460
ifra305x: init num_rxd=4 rxd_base=900 at a02244a0
LAN port mask =1f
ifra305x eth1: init pnde=80219ce0, sc=801f0230, ifp=801f03b8
WAN  port mask =0
ifra305x1: start
[ra305x_restart]<====
ifra305x0: start
ifra305x0: start
-----------------------------------------
eth0: Get IP by manual
IP address:10.10.10.1 
MASK:255.255.255.0
Broadcast:10.10.10.255
Gateway:255.255.255.255
Server:0.0.0.0
mtu:0
Domain Name:
-----------------------------------------
interface eth0 init_net successed!
ifra305x1: start
TX_BCN DESC 0xa02269e4 size = 320
RX[0] DESC 0xa02271e4 size = 1024
RX[1] DESC 0xa02275e4 size = 1024
cfg_mode=9
cfg_mode=9
wmode_band_equal(): Band Equal!
RTMPReadParametersHook->first wifi
load fw image from fw_header_image
AndesMTLoadFwMethod1(2187)::pChipCap->fw_len(63536)
CmdAddressLenReq:(ret = 0)
CmdFwStartReq: override = 1, address = 1048576
CmdStartDLRsp: WiFI FW Download Success
MtAsicDMASchedulerInit(): DMA Scheduler Mode=0(LMAC)
RtmpChipOpsEepromHook::e2p_type=0, inf_Type=4
RtmpEepromGetDefault::e2p_dafault=2
RtmpChipOpsEepromHook: E2P type(2), E2pAccessMode = 2, E2P default = 2
NVM is FLASH mode
1. Phy Mode = 14
Country Region from e2p = ffff
tssi_1_target_pwr_g_band = 34
2. Phy Mode = 14
3. Phy Mode = 14
NICInitPwrPinCfg(11): Not support for HIF_MT yet!
NICInitializeAsic(599): Not support rtmp_mac_sys_reset () for HIF_MT yet!
mt_mac_init()-->
MtAsicInitMac()-->
mt7628_init_mac_cr()-->
MtAsicSetMacMaxLen(1211): Set the Max RxPktLen=1024!
<--mt_mac_init()
        WTBL Segment 1 info:
                MemBaseAddr/FID:0x28000/0
                EntrySize/Cnt:32/128
        WTBL Segment 2 info:
                MemBaseAddr/FID:0x40000/0
                EntrySize/Cnt:64/128
        WTBL Segment 3 info:
                MemBaseAddr/FID:0x42000/64
                EntrySize/Cnt:64/128
        WTBL Segment 4 info:
                MemBaseAddr/FID:0x44000/128
                EntrySize/Cnt:32/128
AntCfgInit(2529): Not support for HIF_MT yet!
MCS Set = ff ff 00 00 00
MtAsicSetChBusyStat(818): Not support for HIF_MT yet!
MtAsicSetPiggyBack(754): Not support for HIF_MT yet!
MtAsicSetTxPreamble(2833): Not support for HIF_MT yet!
MtAsicSetPreTbtt(): bss_idx=0, PreTBTT timeout = 0xf0
Main bssid = 34:ce:00:70:6c:c9
<==== rt28xx_init, Status=0
==>Set_Debug_Proc()
<==Set_Debug_Proc(RTDebugLevel = 1)
bridge_cfg : eth0 eth1, ra0
RPST_set, old:Uninitialized, new:Initialized
BRIDGE 020214 loaded
eth0: promiscuous mode enabled
eth1: promiscuous mode enabled
ra0: promiscuous mode enabled
-----------------------------------------
Bridge Id: 1
  eth0: if_flags=0xffff8943 bdg_flags=0x5
  eth1: if_flags=0xffff8943 bdg_flags=0x5
  ra0: if_flags=0xffff8943 bdg_flags=0x5
(max cache: 128, timeout: 300)
-----------------------------------------
CFG_commit: 0 update!
DNS_daemon
dnsMasqstart
interfaceGet(): bind socket successful on 10.10.10.1:53
serverInit(): DNS Server List 0. 10.10.10.1:53
CMD>  0 'bootcmd'->'tftp'
  0 'bootdelay'->'0'
  0 'baudrate'->'115200'
  0 'ethaddr'->'"00:AA:BB:CC:DD:10"'
  0 'ipaddr'->'10.10.10.123'
  0 'serverip'->'10.10.10.3'
  0 'stdin'->'serial'
  0 'stdout'->'serial'
  0 'stderr'->'serial'
  0 'flag_boot_rootfs'->'0'
CFG_commit: 1 update!
...+.miio: connect to ot.io.mi.com ott.io.mi.com
AP Client Ssid: 
RPST_set, old:Initialized, new:AP Mode
rf cmd:[1]
======<<<<<<=====Repeater Status: AP Mode======<<<<<<======
(ApCliCtrlDisconnectReqAction) 2. Before do ApCliLinkDown.
...+....+....+.Started WatchDog Timer.
AddTxSType: already registered TxSType (PID = 32, Format = 0
The 2-BSSID mode is enabled, the BSSID byte5 MUST be the multiple of 2
======<<<<<< Stop apcli0 <<<<<<=====
(ApCliCtrlDisconnectReqAction) 2. Before do ApCliLinkDown.
mcmd:[20] link[0] chk_link[0]
flsh_cfg_boot_off: 40000!
CFG_load: flash offset=32c4, len=10ec
cfg_parse: add cfg item=325 (4332 bytes)
CFG_load: flash read 325 items(4332 bytes) into ram
cfg_parse: null config!
cfg_load_static: read-only 2 items(48 bytes) into ram
CFG_load: total 327 items(4380 bytes)
cfg_parse_wlan: parse 3026 bytes!
Parsing WIFI configuration succeeds
======<<<<<< Start ssid: SSID=xiaomi-repeater-v2_miap6cc9 <<<<<<=====
MtAsicSetPreTbtt(): bss_idx=0, PreTBTT timeout = 0x0
MtAsicSetPiggyBack(754): Not support for HIF_MT yet!
MtAsicSetPiggyBack(754): Not support for HIF_MT yet!
MtAsicSetTxPreamble(2833): Not support for HIF_MT yet!
AddTxSType: already registered TxSType (PID = 32, Format = 0
The 2-BSSID mode is enabled, the BSSID byte5 MUST be the multiple of 2
AddTxSType: already registered TxSType (PID = 6, Format = 0
MtAsicSetPreTbtt(): bss_idx=0, PreTBTT timeout = 0xf0
Main bssid = 34:ce:00:70:6c:c9
MtAsicSetPreTbtt(): bss_idx=0, PreTBTT timeout = 0x0
MtAsicSetPiggyBack(754): Not support for HIF_MT yet!
MtAsicSetPiggyBack(754): Not support for HIF_MT yet!
MtAsicSetTxPreamble(2833): Not support for HIF_MT yet!
AddTxSType: already registered TxSType (PID = 32, Format = 0
The 2-BSSID mode is enabled, the BSSID byte5 MUST be the multiple of 2
AddTxSType: already registered TxSType (PID = 6, Format = 0
MtAsicSetPreTbtt(): bss_idx=0, PreTBTT timeout = 0xf0
Main bssid = 34:ce:00:70:6c:c9
MtAsicSetPreTbtt(): bss_idx=0, PreTBTT timeout = 0x0
MtAsicSetPiggyBack(754): Not support for HIF_MT yet!
MtAsicSetPiggyBack(754): Not support for HIF_MT yet!
MtAsicSetTxPreamble(2833): Not support for HIF_MT yet!
AddTxSType: already registered TxSType (PID = 32, Format = 0
The 2-BSSID mode is enabled, the BSSID byte5 MUST be the multiple of 2
AddTxSType: already registered TxSType (PID = 6, Format = 0
MtAsicSetPreTbtt(): bss_idx=0, PreTBTT timeout = 0xf0
Main bssid = 34:ce:00:70:6c:c9
======<<<<<< start_lan_dhcpd <<<<<<=====
CFG_commit: 0 update!
CFG_commit: 0 update!
CFG_save: write 4320 bytes to flash:CFG_CHKSUM=f89ec60d, len=4320
CFG_save: flsh run-out, erase.
....+.
CMD>

1 Comment on “First Impression on the Xiaomi WiFi+

  1. Hello sir/mam, I have a question about the xiaomi mi wifi repeater 2 that was posted to your website.
    https://nm-projects.de/2017/12/first-impression-on-the-xiaomi-wifi/
    My question is did you know where is the receiver part of the wifi where this part scan wifi routers, hotspots etc. I just want to connect a cantenna to improve the signal strenght. I’m working this thing now and thinking where to connect the cantenna, where on the pcb part you must connect the cantenna. I will appreciate if you reply thank you!

Leave a Reply

Your email address will not be published. Required fields are marked *

*