[SOLVED] Openhab2 - Xiaomi Mi Gateway - does not respond

selbolder · March 20, 2019, 4:58pm

Hello, when I connect through Putty, all I see are hyroglyphs:

 ▒-7▒▒▒▒▒%5/!7▒▒▒▒▒=%▒▒  ▒-''%-#=-!#▒▒▒▒▒▒▒▒▒▒RDR**▒Q=▒9!##59-#1▒!▒▒753='▒▒3=-'57▒▒I=3E▒Q=▒#5!%1▒Qg}c▒▒#5!#!▒3!#7▒▒RDR**▒Q=▒9!##59-#1▒!▒▒753='▒▒3=-'57▒▒I=3E▒Q=▒#5!%1▒Qg}c▒▒#5!#!▒3!#7▒▒RDR**▒Q=▒9!##59-#1▒!▒▒753='▒▒3=-'57▒▒I=3E▒Q=▒#5!%1▒Qg}c▒▒#5!#!▒3!#7▒▒RDR**▒Q=▒9!##59-#1▒!▒▒753='▒▒3=-'57▒▒I=3E▒Q=▒#5!%1▒Qg}c▒▒#5!#!▒3!#7▒▒

Does anyone have any idea what I’m doing wrong?

I have the firmware 167…

Settings with Putty are 115200, 8,1,N,N

However, the gateway flashes blue all the time and does not stop.

I have connected the gateway to a computer with a SUB D connector. I assume I have to connect TX to RX, don’t I?

Orfait · March 20, 2019, 7:30pm

I haven’t done this connection to gateway but… I think you need USB to UART adapter.
The RS232 port of your computer:
1/ can kill serial port of your gateway (signal levels are much higher)
2/ have inverted logic signal

Use a USB to UART cable like FTDI or things used with arduino. Be careful to use 3.3v logic.

cadavre · March 20, 2019, 9:29pm

@jsiemins I’m going to hack my Mijia Gateway EU version as soon as I get my new soldering iron. I hope I’ll find RxTx easily and not blow things up… I’ll try then to issue command from above. I hope it will be running same firmware.

selbolder · March 21, 2019, 7:07am

Hello, I already ordered such a UART Adapter.

Hopefully the device still works now after connection to the Computer RS232.

Then, should I connect RX on the Gateway with TX on the UART Converter?

Orfait · March 21, 2019, 12:56pm

I don’t know, because the picture of the gateway pinout is not clear.
The best way to stay safe is to connect only USB/UART RX to gateway TX and check if you get some data.

A_R · March 21, 2019, 5:00pm

If I have good old “square text” gateway, is it safe to update firmware from to 1.4.1_159 to 1.4.1_167? Could please somebody confirm?

Thanks!

pagm · March 21, 2019, 6:34pm

I followed Dirk description further up in this thread.

Connect USB-TTL Serial Modul FT232RL GND to GND on Gateway and RX from UART to TX on Gateway

Plug in USB Modul to PC –> red light in corner of module turns on

Turn on Gateway –> flashes blue for a few seconds, then turns off

In Putty, select COM3 (Speed 115200, Data bits 8, Stop bits 1, Parity None, Flow control None) –> Open

Connect TX from UART to RX on Gateway. No additional LED turn on on UART

I only used TX,RX and GND(connected to the metal case of the button). As you see lack of steady hand of soldering I used tape to connect the wires.

USB UART

Cables to easily to connect:

Send following command a couple of times:

psm-set network.open_pf 3

Verify with:

psm-get network.open_pf

Check Port 9898 192.168.0.147 is your gateway ip:

sudo nmap -Pn -sU 192.168.0.147 -p 9898

Bat_Kobra · March 22, 2019, 4:03pm

So if we follow your guide, the gateway will be able to connect to openhab2 ?
And the only thing I need is the USB to UART adapter (and maybe some jumper cables)?

pagm · March 22, 2019, 6:20pm

It’s not really my guide it’s info from the other guys in this thread and I just shared what I used.
This will only open up port 9898 on the Xiaomi device then you need to follow Xiaomi Mi Smart Home - Binding setup/configuration. It’s the the binding that will connect to the Xiaomi device and send commands and fetch answers from the multicast replies.

You need the stuff I described above. If you want to solder you need of course proper equipment for that.

Hope that gives some help and clarity to you

rsx2007 · March 24, 2019, 11:25am

Hello.
Can you show another side of board? (rotate it)
Looks like P4 is what you are looking for but…
Better check another side of board!

jsiemins · March 24, 2019, 7:13pm

Other side:

F_C · March 26, 2019, 6:58pm

may i know which is which?
the green cable is TX or RX?
I should connect the RX to TX and TX to RX, and GND connect to reset button metal case. right?
thanks for your reply

pagm · March 26, 2019, 7:33pm

Green cable is TX
Black cable is RX

Yes, that is correct how to connect the cables

F_C · March 27, 2019, 2:54am

I have to use 5V or 3.3V to connect?
thanks.

F_C · March 27, 2019, 2:55am

Did you connect the gateway to 220V or 3.3V VCC?
I can’t turn on the gateway by connecting the VCC.
How can you do that?

F_C · March 27, 2019, 5:36am

should I have to connect it to power? 5V? 3.3V?
I don’t think the gateway can be turned on (flashes blue for a few seconds) without power?

Pawel_Kowalski · March 28, 2019, 7:47pm

Hi,
I have got Aqara Gateway. As you can see below, board is slightly different, so I have no idea how connect to UART device. Any idea which are TX/RX pins?

cadavre · March 28, 2019, 9:24pm

Ok, I managed to find UART RX/TX on lumi.gateway EU version – the one pictured by @jsiemins and @F_C . I also made connection to the gateway successfully!

The problem is after booting we’re getting into factory testing mode, which can be exited, but then it asks about password to access the OS.

Here is complete boot snapshot:

U-Boot 2016.03 (Nov 07 2017 - 20:11:55 +0800) 

CPU:   Freescale i.MX6ULL rev1.1 528 MHz (running at 396 MHz)
CPU:   Commercial temperature grade (0C to 95C) at 39C
Reset cause: POR
Board: Lumi international Gateway
I2C:   ready
DRAM:  256 MiB
NAND:  256 MiB
MMC:   FSL_SDHC: 0, FSL_SDHC: 1
*** Warning - bad CRC, using default environment

Display: TFT43AB (480x272)
Video: LCDIF@0x21c8000 is fused, disable it
In:    serial
Out:   serial
Err:   serial
Net:   Ethernet@0x20b4000 is fused, disable it
Board Net Initialization Failed
No ethernet found.

## Enter main_loop() Now##
Normal Boot
Hit any key to stop autoboot:  0 

NAND read: device 0 offset 0x300000, size 0x700000
 7340032 bytes read: OK

NAND read: device 0 offset 0xa00000, size 0x100000
 1048576 bytes read: OK
Kernel image @ 0x80800000 [ 0x000000 - 0x617290 ]
## Flattened Device Tree blob at 83000000
   Booting using the fdt blob at 0x83000000
   Using Device Tree in place at 83000000, end 8300c0e1
Modify /soc/aips-bus@02000000/tsc@02040000:status disabled
Modify /soc/aips-bus@02000000/can@02090000:status disabled
Modify /soc/aips-bus@02000000/can@02094000:status disabled
Modify /soc/aips-bus@02100000/lcdif@021c8000:status disabled
Modify /soc/aips-bus@02100000/pxp@021cc000:status disabled
Modify /soc/aips-bus@02100000/csi@021c4000:status disabled
Modify /soc/aips-bus@02000000/ethernet@020b4000:status disabled
Modify /soc/aips-bus@02100000/usb@02184200:status disabled
Modify /soc/aips-bus@02000000/spba-bus@02000000/sai@0202c000:status disabled
Modify /soc/aips-bus@02000000/spba-bus@02000000/sai@02030000:status disabled
Modify /soc/aips-bus@02100000/serial@021f4000:status disabled
Modify /soc/aips-bus@02100000/serial@021fc000:status disabled
Modify /soc/aips-bus@02000000/spba-bus@02000000/serial@02018000:status disabled
Modify /soc/aips-bus@02000000/pwm@020f0000:status disabled
Modify /soc/aips-bus@02000000/pwm@020f4000:status disabled
Modify /soc/aips-bus@02000000/pwm@020f8000:status disabled
Modify /soc/aips-bus@02000000/pwm@020fc000:status disabled
Modify /soc/aips-bus@02000000/spba-bus@02000000/ecspi@02010000:status disabled
Modify /soc/aips-bus@02000000/spba-bus@02000000/ecspi@02014000:status disabled
Modify /soc/aips-bus@02100000/i2c@021a8000:status disabled
Modify /soc/aips-bus@02100000/i2c@021f8000:status disabled
Modify /soc/aips-bus@02000000/gpt@020e8000:status disabled
Modify /soc/aips-bus@02000000/epit@020d4000:status disabled
ft_system_setup for mx6
No PMIC found!

Starting kernel ...

[    0.000000] Booting Linux on physical CPU 0x0
[    0.000000] Linux version 4.1.15+gb63f3f5 (chenlong@gitlab) (gcc version 5.3.0 (GCC) ) #37 SMP PREEMPT Tue Jun 19 15:28:38 CST 2018
[    0.000000] CPU: ARMv7 Processor [410fc075] revision 5 (ARMv7), cr=10c53c7d
[    0.000000] CPU: PIPT / VIPT nonaliasing data cache, VIPT aliasing instruction cache
[    0.000000] Machine model: Freescale i.MX6 ULL 14x14 EVK Board
[    0.000000] Reserved memory: failed to allocate memory for node 'linux,cma'
[    0.000000] cma: Reserved 96 MiB at 0x8a000000
[    0.000000] Memory policy: Data cache writealloc
[    0.000000] PERCPU: Embedded 12 pages/cpu @89da3000 s16908 r8192 d24052 u49152
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 65024
[    0.000000] Kernel command line: console=ttymxc0,115200 ubi.mtd=3 root=ubi0:rootfs rootfstype=ubifs cma=96M mtdparts=gpmi-nand:3m(boot),7m(kernel),1m(dtb),-(rootfs) 
[    0.000000] PID hash table entries: 1024 (order: 0, 4096 bytes)
[    0.000000] Dentry cache hash table entries: 32768 (order: 5, 131072 bytes)
[    0.000000] Inode-cache hash table entries: 16384 (order: 4, 65536 bytes)
[    0.000000] Memory: 148920K/262144K available (8035K kernel code, 423K rwdata, 2812K rodata, 540K init, 426K bss, 14920K reserved, 98304K cma-reserved, 0K highmem)
[    0.000000] Virtual kernel memory layout:
[    0.000000]     vector  : 0xffff0000 - 0xffff1000   (   4 kB)
[    0.000000]     fixmap  : 0xffc00000 - 0xfff00000   (3072 kB)
[    0.000000]     vmalloc : 0x90800000 - 0xff000000   (1768 MB)
[    0.000000]     lowmem  : 0x80000000 - 0x90000000   ( 256 MB)
[    0.000000]     pkmap   : 0x7fe00000 - 0x80000000   (   2 MB)
[    0.000000]     modules : 0x7f000000 - 0x7fe00000   (  14 MB)
[    0.000000]       .text : 0x80008000 - 0x80aa01f8   (10849 kB)
[    0.000000]       .init : 0x80aa1000 - 0x80b28000   ( 540 kB)
[    0.000000]       .data : 0x80b28000 - 0x80b91fa0   ( 424 kB)
[    0.000000]        .bss : 0x80b94000 - 0x80bfeb5c   ( 427 kB)
[    0.000000] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[    0.000000] Preemptible hierarchical RCU implementation.
[    0.000000]  Additional per-CPU info printed with stalls.
[    0.000000]  RCU restricting CPUs from NR_CPUS=4 to nr_cpu_ids=1.
[    0.000000] RCU: Adjusting geometry for rcu_fanout_leaf=16, nr_cpu_ids=1
[    0.000000] NR_IRQS:16 nr_irqs:16 16
[    0.000000] mxc_clocksource_init 24000000
[    0.000000] Switching to timer-based delay loop, resolution 41ns
[    0.000016] sched_clock: 32 bits at 24MHz, resolution 41ns, wraps every 89478484971ns
[    0.000055] clocksource mxc_timer1: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 79635851949 ns
[    0.002576] Console: colour dummy device 80x30
[    0.002617] Calibrating delay loop (skipped), value calculated using timer frequency.. 48.00 BogoMIPS (lpj=240000)
[    0.002651] pid_max: default: 32768 minimum: 301
[    0.002871] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.002902] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.004249] CPU: Testing write buffer coherency: ok
[    0.004743] /cpus/cpu@0 missing clock-frequency property
[    0.004784] CPU0: thread -1, cpu 0, socket 0, mpidr 80000000
[    0.004894] Setting up static identity map for 0x80008280 - 0x800082d8
[    0.041169] Brought up 1 CPUs
[    0.041209] SMP: Total of 1 processors activated (48.00 BogoMIPS).
[    0.041229] CPU: All CPU(s) started in SVC mode.
[    0.042328] devtmpfs: initialized
[    0.063995] VFP support v0.3: implementor 41 architecture 2 part 30 variant 7 rev 5
[    0.064876] clocksource jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.072728] pinctrl core: initialized pinctrl subsystem
[    0.075402] NET: Registered protocol family 16
[    0.093456] DMA: preallocated 256 KiB pool for atomic coherent allocations
[    0.120891] cpuidle: using governor ladder
[    0.150945] cpuidle: using governor menu
[    0.193816] hw-breakpoint: found 5 (+1 reserved) breakpoint and 4 watchpoint registers.
[    0.193852] hw-breakpoint: maximum watchpoint size is 8 bytes.
[    0.197045] imx6ul-pinctrl 20e0000.iomuxc: Invalid fsl,pins property in node /soc/aips-bus@02000000/iomuxc@020e0000/imx6ul-evk/hoggrp-1
[    0.197751] imx6ul-pinctrl 20e0000.iomuxc: initialized IMX pinctrl driver
[    0.198424] imx6ul-pinctrl 2290000.iomuxc-snvs: initialized IMX pinctrl driver
[    0.258291] mxs-dma 1804000.dma-apbh: initialized
[    0.264946] SCSI subsystem initialized
[    0.266389] usbcore: registered new interface driver usbfs
[    0.266580] usbcore: registered new interface driver hub
[    0.266808] usbcore: registered new device driver usb
[    0.269337] i2c i2c-0: IMX I2C adapter registered
[    0.269384] i2c i2c-0: can't use DMA
[    0.270959] i2c i2c-1: IMX I2C adapter registered
[    0.271000] i2c i2c-1: can't use DMA
[    0.271306] Linux video capture interface: v2.00
[    0.271540] pps_core: LinuxPPS API ver. 1 registered
[    0.271564] pps_core: Software ver. 5.3.6 - Copyright 2005-2007 Rodolfo Giometti <giometti@linux.it>
[    0.271838] PTP clock support registered
[    0.274555] MIPI CSI2 driver module loaded
[    0.275251] Advanced Linux Sound Architecture Driver Initialized.
[    0.277394] Bluetooth: Core ver 2.20
[    0.277520] NET: Registered protocol family 31
[    0.277541] Bluetooth: HCI device and connection manager initialized
[    0.277581] Bluetooth: HCI socket layer initialized
[    0.277614] Bluetooth: L2CAP socket layer initialized
[    0.277697] Bluetooth: SCO socket layer initialized
[    0.279816] Switched to clocksource mxc_timer1
[    0.306527] NET: Registered protocol family 2
[    0.308171] TCP established hash table entries: 2048 (order: 1, 8192 bytes)
[    0.308275] TCP bind hash table entries: 2048 (order: 2, 16384 bytes)
[    0.308368] TCP: Hash tables configured (established 2048 bind 2048)
[    0.308505] UDP hash table entries: 256 (order: 1, 8192 bytes)
[    0.308565] UDP-Lite hash table entries: 256 (order: 1, 8192 bytes)
[    0.308988] NET: Registered protocol family 1
[    0.312418] imx rpmsg driver is registered.
[    0.315091] Bus freq driver module loaded
[    0.317442] futex hash table entries: 256 (order: 2, 16384 bytes)
[    0.335580] VFS: Disk quotas dquot_6.6.0
[    0.336041] VFS: Dquot-cache hash table entries: 1024 (order 0, 4096 bytes)
[    0.340311] jffs2: version 2.2. (NAND) © 2001-2006 Red Hat, Inc.
[    0.342101] fuse init (API version 7.23)
[    0.353298] io scheduler noop registered
[    0.353346] io scheduler deadline registered
[    0.353881] io scheduler cfq registered (default)
[    0.354905] imx-weim 21b8000.weim: Driver registered.
[    0.359458] lumi_r supply power not found, using dummy regulator
[    0.361643] lumi_b supply power not found, using dummy regulator
[    0.363409] lumi_g supply power not found, using dummy regulator
[    0.365696] MIPI DSI driver module loaded
[    0.366140] MIPI DSI driver module loaded
[    0.371933] imx-sdma 20ec000.sdma: no event needs to be remapped
[    0.372150] imx-sdma 20ec000.sdma: loaded firmware 3.3
[    0.380061] imx-sdma 20ec000.sdma: initialized
[    0.382144] 2020000.serial: ttymxc0 at MMIO 0x2020000 (irq = 19, base_baud = 5000000) is a IMX
[    1.031395] console [ttymxc0] enabled
[    1.036929] 21e8000.serial: ttymxc1 at MMIO 0x21e8000 (irq = 217, base_baud = 5000000) is a IMX
[    1.082853] imx-rng 2284000.rngb: iMX RNG Registered.
[    1.088576] imx sema4 driver is registered.
[    1.093064] [drm] Initialized drm 1.1.0 20060810
[    1.099023] [drm] Initialized vivante 1.0.0 20120216 on minor 0
[    1.131970] brd: module loaded
[    1.148912] loop: module loaded
[    1.152884] pn54x_dev_init-->lumi
[    1.156403] pn54x_probe
[    1.158923] pn544 1-0028: FIRM GPIO <OPTIONAL> error getting from OF node
[    1.165915] pn544 1-0028: CLKREQ GPIO <OPTIONAL> error getting from OF node
[    1.172985] 1-0028 supply nxp,pn54x-pvdd not found, using dummy regulator
[    1.180005] 1-0028 supply nxp,pn54x-vbat not found, using dummy regulator
[    1.186952] 1-0028 supply nxp,pn54x-pmuvcc not found, using dummy regulator
[    1.194109] 1-0028 supply nxp,pn54x-sevdd not found, using dummy regulator
[    1.201164] pn54x_probe: request irq_gpio 7
[    1.205391] pn54x_probe: request ven_gpio 3
[    1.210086] pn54x_probe : requesting IRQ 35
[    1.229557] nand: device found, Manufacturer ID: 0x2c, Chip ID: 0xda
[    1.236052] nand: Micron MT29F2G08ABAEAWP
[    1.240149] nand: 256 MiB, SLC, erase size: 128 KiB, page size: 2048, OOB size: 64
[    1.248534] gpmi-nand 1806000.gpmi-nand: enable the asynchronous EDO mode 5
[    1.256011] Bad block table found at page 131008, version 0x01
[    1.262160] Bad block table found at page 130944, version 0x01
[    1.268397] 4 cmdlinepart partitions found on MTD device gpmi-nand
[    1.274685] Creating 4 MTD partitions on "gpmi-nand":
[    1.279830] 0x000000000000-0x000000300000 : "boot"
[    1.287270] 0x000000300000-0x000000a00000 : "kernel"
[    1.294799] 0x000000a00000-0x000000b00000 : "dtb"
[    1.302051] 0x000000b00000-0x000010000000 : "rootfs"
[    1.310458] gpmi-nand 1806000.gpmi-nand: driver registered.
[    1.322448] ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
[    1.329052] ehci-mxc: Freescale On-Chip EHCI Host driver
[    1.334959] usbcore: registered new interface driver usb-storage
[    1.341269] usbcore: registered new interface driver usb_ehset_test
[    1.350183] 2184800.usbmisc supply vbus-wakeup not found, using dummy regulator
[    1.359244] 2184000.usb supply vbus not found, using dummy regulator
[    1.373860] mousedev: PS/2 mouse device common for all mice
[    1.381584] input: 20cc000.snvs:snvs-powerkey as /devices/platform/soc/2000000.aips-bus/20cc000.snvs/20cc000.snvs:snvs-powerkey/input/input0
[    1.399350] snvs_rtc 20cc000.snvs:snvs-rtc-lp: rtc core: registered 20cc000.snvs:snvs-r as rtc0
[    1.408562] i2c /dev entries driver
[    1.414997] IR NEC protocol handler initialized
[    1.419596] IR RC5(x/sz) protocol handler initialized
[    1.424788] IR RC6 protocol handler initialized
[    1.429372] IR JVC protocol handler initialized
[    1.433996] IR Sony protocol handler initialized
[    1.438658] IR SANYO protocol handler initialized
[    1.443449] IR Sharp protocol handler initialized
[    1.448203] IR MCE Keyboard/mouse protocol handler initialized
[    1.454124] IR XMP protocol handler initialized
[    1.464955] imx2-wdt 20bc000.wdog: use WDOG_B to reboot.
[    1.471366] imx2-wdt 20bc000.wdog: timeout 60 sec (nowayout=0)
[    1.478625] sdhci: Secure Digital Host Controller Interface driver
[    1.484961] sdhci: Copyright(c) Pierre Ossman
[    1.489378] sdhci-pltfm: SDHCI platform and OF driver helper
[    1.496842] /soc/aips-bus@02100000/usdhc@02190000: voltage-ranges unspecified
[    1.504130] sdhci-esdhc-imx 2190000.usdhc: could not get ultra high speed state, work on normal mode
[    1.514730] sdhci-esdhc-imx 2190000.usdhc: No vmmc regulator found
[    1.521028] sdhci-esdhc-imx 2190000.usdhc: No vqmmc regulator found
[    1.570060] mmc0: SDHCI controller on 2190000.usdhc [2190000.usdhc] using ADMA
[    1.604211] usbcore: registered new interface driver usbhid
[    1.610176] usbhid: USB HID core driver
[    1.614845] vf610-adc 2198000.adc: Debug vf610_adc_proble()
[    1.621166] 2198000.adc supply vref not found, using dummy regulator
[    1.627844] vf610-adc 2198000.adc: Debug[0] channels[2]
[    1.643496] wm8524_i2c_probe: 
[    1.650025] mmc0: new high speed SDIO card at address 0001
[    1.656475] wm8960 1-001a: Failed to issue reset
[    1.661537] wm8960: probe of 1-001a failed with error -5
[    1.670218] fsl-asrc 2034000.asrc: driver registered
[    1.683059] imx_wm8524_probe: 
[    1.686751] wm8524_probe: 
[    1.690973] imx-wm8524 sound2: wm8524-hifi <-> 2028000.sai mapping ok
[    1.698867] imx-wm8524 sound2: snd-soc-dummy-dai <-> 2034000.asrc mapping ok
[    1.706468] imx-wm8524 sound2: wm8524-hifi <-> 2028000.sai mapping ok
[    1.720174] NET: Registered protocol family 26
[    1.726819] NET: Registered protocol family 10
[    1.733626] sit: IPv6 over IPv4 tunneling driver
[    1.740329] NET: Registered protocol family 17
[    1.745151] Bluetooth: RFCOMM TTY layer initialized
[    1.750308] Bluetooth: RFCOMM socket layer initialized
[    1.755527] Bluetooth: RFCOMM ver 1.11
[    1.759345] Bluetooth: BNEP (Ethernet Emulation) ver 1.3
[    1.764758] Bluetooth: BNEP filters: protocol multicast
[    1.770082] Bluetooth: BNEP socket layer initialized
[    1.775095] Bluetooth: HIDP (Human Interface Emulation) ver 1.2
[    1.781109] Bluetooth: HIDP socket layer initialized
[    1.786121] 8021q: 802.1Q VLAN Support v1.8
[    1.790437] lib80211: common routines for IEEE802.11 drivers
[    1.796331] Key type dns_resolver registered
[    1.802586] cpu cpu0: dev_pm_opp_get_opp_count: device OPP not found (-19)
[    1.837399] ubi0: attaching mtd3
[    2.168158] random: nonblocking pool is initialized
[    2.525547] ubi0: scanning is finished
[    2.543900] ubi0: attached mtd3 (name "rootfs", size 245 MiB)
[    2.549703] ubi0: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
[    2.556735] ubi0: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
[    2.563959] ubi0: VID header offset: 2048 (aligned 2048), data offset: 4096
[    2.571008] ubi0: good PEBs: 1956, bad PEBs: 4, corrupted PEBs: 0
[    2.577126] ubi0: user volume: 1, internal volumes: 1, max. volumes count: 128
[    2.584479] ubi0: max/mean erase counter: 8/1, WL threshold: 4096, image sequence number: 1813099077
[    2.593678] ubi0: available PEBs: 0, total reserved PEBs: 1956, PEBs reserved for bad PEB handling: 36
[    2.603059] ubi0: background thread "ubi_bgt0d" started, PID 73
[    2.609050] dhd_module_init in
[    2.613906] input: regulators:gpio-keys as /devices/platform/regulators/regulators:gpio-keys/input/input1
[    2.624240] snvs_rtc 20cc000.snvs:snvs-rtc-lp: setting system clock to 1970-01-01 00:11:40 UTC (700)
[    2.654574] gpio_dvfs: disabling
[    2.657853] vref-3v3: disabling
[    2.661122] can-3v3: disabling
[    2.664553] ALSA device list:
[    2.667544]   #0: wm8524-audio
[    2.692163] UBIFS (ubi0:0): recovery needed
[    2.730261] UBIFS (ubi0:0): recovery deferred
[    2.734814] UBIFS (ubi0:0): UBIFS: mounted UBI device 0, volume 0, name "rootfs", R/O mode
[    2.743266] UBIFS (ubi0:0): LEB size: 126976 bytes (124 KiB), min./max. I/O unit sizes: 2048 bytes/2048 bytes
[    2.753255] UBIFS (ubi0:0): FS size: 241635328 bytes (230 MiB, 1903 LEBs), journal size 12062720 bytes (11 MiB, 95 LEBs)
[    2.764175] UBIFS (ubi0:0): reserved for root: 4952683 bytes (4836 KiB)
[    2.770926] UBIFS (ubi0:0): media format: w4/r0 (latest is w4/r0), UUID AD7DD6E8-1329-4760-93D9-E1A4D3A2465D, small LPT model
[    2.783076] VFS: Mounted root (ubifs filesystem) readonly on device 0:14.
[    2.790952] devtmpfs: mounted
[    2.795054] Freeing unused kernel memory: 540K (80aa1000 - 80b28000)
INIT: version 2.88 booting
Starting udev
[    3.875137] udevd[105]: starting version 3.1.5
[    4.380347] UBIFS (ubi0:0): completing deferred recovery
[    4.429536] UBIFS (ubi0:0): background thread "ubifs_bgt0_0" started, PID 129
[    4.441919] UBIFS (ubi0:0): deferred recovery completed
INIT: Entering runlevel: 5
Configuring network interfaces... eth0: ERROR while getting interface flags: No such device
Running local boot scripts (/etc/rc.local)[    7.739683] RTL871X: module init start
[    7.747651] RTL871X: rtl8723bs v4.4.2_17831.20160519_BTCOEX20151223-654a
[    7.754687] RTL871X: build time: Mar 29 2017 03:05:03
[    7.759763] RTL871X: rtl8723bs BT-Coex version = BTCOEX20151223-654a
[    7.775264] RTL871X: rtw_hal_config_rftype RF_Type is 3 TotalTxPath is 1 
[    7.782169] RTL871X: Chip Version Info: CHIP_8723B_Normal_Chip_TSMC_F_CUT_1T1R_RomVer(0)
[    7.793764] RTL871X: SetHwReg8723B: bMacPwrCtrlOn=1
[    7.799470] RTL871X: PowerOnCheck: val_mix:0x0000063f, res:0x0000063f
[    7.805982] RTL871X: PowerOnCheck: 0x100 the result of cmd52 and cmd53 is the same.
[    7.813840] RTL871X: PowerOnCheck: 0x1B8 test Pass.
[    7.819359] RTL871X: ReadAdapterInfo8723BS, 0x4e=0xe2
[    7.824620] RTL871X: EEPROM type is E-FUSE
[    7.829414] RTL871X: hal_EfuseSwitchToBank: Efuse switch bank to 0
[    7.910866] RTL871X: hal_ReadEFuse_WiFi: data end at address=0xad
[    7.916985] RTL871X: Efuse Realmap:
[    7.920524] 
[    7.922032] 29 81 03 7C 51 08 28 00 62 07 0D 45 10 02 00 00 
[    7.927968] 2B 2B 2B 2B 2B 2B 2D 2D 2D 2D 2D E0 FF FF FF FF 
[    7.933938] FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF 
[    7.939900] FF FF FF FF FF FF FF FF FF FF 2D 2D 2D 2D 2D 2D 
[    7.945834] 2D 2D 2D 2D 2D E0 FF FF FF FF FF FF FF FF FF FF 
[    7.951802] FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF 
[    7.957735] FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF 
[    7.963767] FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF 
[    7.969700] FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF 
[    7.975719] FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF 
[    7.981689] FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF 
[    7.987622] FF FF FF FF FF FF FF FF 20 23 1C 00 00 00 FF FF 
[    7.993590] FF 29 20 11 00 00 00 FF 00 FF 12 FF FF FF FF FF 
[    7.999521] 3E 10 01 02 23 00 00 FF 20 04 4C 02 23 B7 21 02 
[    8.005485] 0C 00 22 04 00 08 00 32 FF 21 02 0C 00 22 2A 01 
[    8.011448] 01 00 00 00 00 00 00 00 00 00 00 00 02 00 FF FF 
[    8.017377] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
[    8.023333] 00 EB 00 6E 01 00 00 00 00 FF 58 B3 FC 71 E3 04 
[    8.029264] FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF 
[    8.035223] FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF 
[    8.041185] FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF 
[    8.047118] FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF 
[    8.053120] FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF 
[    8.059054] FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF 
[    8.065079] FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF 
[    8.071048] FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF 
[    8.076980] FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF 
[    8.082946] FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF 
[    8.088878] FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF 
[    8.094840] FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF 
[    8.100799] FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF 
[    8.106732] FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF 
[    8.120782] RTL871X: Hal_EfuseParseBTCoexistInfo_8723B: Enable BT-coex, ant_num=1
[    8.128294] RTL871X: hal_com_config_channel_plan chplan:0x20
[    8.134822] RTL871X: Hal_EfuseParsePackageType_8723B phy efuse read 0x1FB =fc 
[    8.142249] RTL871X: PackageType = 0x4
[    8.146017] RTL871X: Hal_EfuseParseVoltage_8723B hwinfo[EEPROM_Voltage_ADDR_8723B] =62 
[    8.154135] RTL871X: Hal_EfuseParseVoltage_8723B pHalData->adjuseVoltageVal =6 
[    8.161496] RTL871X: AutoloadFail =0,
[    8.165509] RTL871X: pHalData->EEPROMRFGainVal=33
[    8.170276] RTL871X: EEPRORFGainOffset = 0x29
[    8.175803] RTL871X: SetHwReg8723B: bMacPwrCtrlOn=0
[    8.181748] RTL871X: rtw_hal_read_chip_info in 390 ms
[    8.187099] RTL871X: init_channel_set((null)) ChannelPlan ID:0x20, ch num:13
[    8.195421] RTL871X: rtw_alloc_macid((null)) if1, hwaddr:ff:ff:ff:ff:ff:ff macid:1
[    8.203190] RTL871X: Init_ODM_ComInfo_8723b(): fab_ver=0 cut_ver=0
[    8.209413] RTL871X: rtw_macaddr_cfg mac addr:58:b3:fc:71:e3:04
[    8.215731] RTL871X: bDriverStopped:True, bSurpriseRemoved:False, bup:0, hw_init_completed:0
[    8.224331] RTL871X: rtw_wiphy_alloc(phy0)
[    8.228450] RTL871X: rtw_wdev_alloc(padapter=90d39000)
[    8.233663] RTL871X: rtw_wiphy_register(phy0)
[    8.238036] RTL871X: Register RTW cfg80211 vendor cmd(0x67) interface 
[    8.248770] RTL871X: rtw_ndev_init(wlan0) if1 mac_addr=58:b3:fc:71:e3:04
[    8.281940] RTL871X: module init ret=0
====================================
========== start mi=================
====================================
fac_test bulid time:06:57:28 Aug 31 2018
gobal_cmd_list size 3204
Input cmd:

When I enter help:

help
    --Print help.
ver
    --Get fireware version.
LED01
    --LED RED ON.
LED11
    --LED Green ON.
LED21
    --LED BLUE ON.
LED3
    --LED white ON.
LED00
    --LED OFF.
LUMEN
    --Return illumination value.
speaker
    --Play 1khz sinusoidal sound.
key
    --Test key.
m_play
    --Play music.Usage : m_play name volume.
test_mfi
    --Test the mfi chip.
cmd_chk_zig
    --Test the zigbee chip communication, return zigbee chip firmware version
join
    --Zigbee join.
remove
    --remove device.
get_zig_temp
    --Get zigbee temperature.
cali_temp
    --Cal zigbee temperature.
test_zig_rf
    --Test zigbee rf.
test_ota
    --Test zigbee ota.
devices
    --Show the device in zigbee.
wifi_mac
    --Return wifi mac.
wifi
    --Return wifi rssi.
set_wifi_mac
    --set wifi mac for realtek modual.
set_wifi_modual
    --set wifi modual.
set_sn
    --Set soft version,usage:set_sn 123456.
get_sn
    --Get soft version.
set_hd_ver
    --Set hardware version,usage:set_hd_ver 123.
get_hd_ver
    --Get hardware version.
setup_code
    --Set homekit setup code.
set_language
    --Set homekit language.
set_hk_model
    --Set homekit model.
get_setup_code
    --get homekit setup code.
set_did
    --set mi did key mac model.
get_did
    --get mi did key mac model.
nfc_poll
    --NFC polling.
exit_factory
    --Exit test.
test_ok
    --Create the test ok file and exit test.
test_pcba
    --PCBA Test.
get_result
    --Get PCBA Test result.
reboot
    --Reboot.

get_did is quite interesting because it responds with:

did=...
key=...
mac=...
vendor=lumi
model=lumi.gateway.mieu01

exit_factory and we get to:

Exit test...
OK
.
umount: /mnt/.psplash: not mounted

Freescale i.MX Release Distro 4.1.15-2.0.0 imx6ull14x14evk /dev/ttymxc0

imx6ull14x14evk login:

And I’m stuck. root:root isn’t working. I tried some combinations but without success.

Any ideas?

cadavre · March 28, 2019, 10:33pm

Update:

I managed to get to bootloader.
I managed to change root password.
I managed to get into the OS! Success!

Now: there’s no psm-... commands in it!

Update 2:

netstat -tlpun
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp        0      0 127.0.0.1:54322         0.0.0.0:*               LISTEN      377/miio_client 
tcp        0      0 127.0.0.1:54323         0.0.0.0:*               LISTEN      377/miio_client 
udp        0      0 0.0.0.0:10008           0.0.0.0:*                           11982/gw        
udp        0      0 0.0.0.0:54321           0.0.0.0:*                           377/miio_client 
udp        0      0 0.0.0.0:5353            0.0.0.0:*                           377/miio_client

F_C · March 28, 2019, 11:42pm

Finally I can make it reopen port 9898.

My gateway is CHINA version. I don”t think other region version can open lan control.