Success on EU version M2 gateway

[himekifee]

Even though it's said to be incompatible with EU version of M2 gw, I still managed to flash the rootfs using the Chinese modified ver. Result as below.

[BarakaAka1Only]

Interesting, well i went ahead and tried it and it failed console comes out with no root_fs. Restoring root_3_3_0_0021_0526.bin via signed works only for me. So i wonder what default firmware you were running before the flash?

Did you edit the boot_info?

[himekifee]

I forgot which one but I updated to the latest in aqara home app before flashing.

[BarakaAka1Only]

I forgot which one but I updated to the latest in aqara home app before flashing.

Gotcha okay, gonna flash back mine to root_3_3_0_0021_0526 then do an update on the app and then flash the modified fw to see what occurs.

[BarakaAka1Only]

Did not work at all so i am shocked

[himekifee]

Any screenshoots for me to have a look?

[BarakaAka1Only]

No as it just does

Info: loading rootfs 0 ...  Done
Info: checking rootfs 0 ... Info: checking rootfs 0 ... 
Fail
Info: loading rootfs 1 ...  Done
Info: checking rootfs 1 ... Info: checking rootfs 1 ... 
Fail
Warn: no rootfs available.

and

Info: loading kernel 1 ... size 2233348
Info: checking kernel 1 ... 
Info: loading kernel 0 ... size 2233348
Info: checking kernel 0 ... 
Warn: all kernels are invalid !

if i edit the boot_info

[himekifee]

Could you get a acreenshot of that aqaragateway.exe?

[BarakaAka1Only]

Currently i am restoring AIOT_V3.4.6_0010.0618_20220822

[himekifee]

Did it success on flashing? I used a monitor to check all com port traffics. You may want to have a look at the packets sent back.

[BarakaAka1Only]

I do actually know what i am doing as far as that goes, and yes it did complete

Example:

Do NOT power up your gateway.
IF it is already power up, remove power cable!

Generating padded firmware, please wait...!
Please power up gateway!
If your gateway is powered up, disconnect usb cable and reconnect it.
Downloading the flasher.
Now transmitting C:\Temp\root.bin_raw
Transmit Done! Please wait for programming to flash.
Programming C:\Temp\root.bin_raw Done!
Do NOT power up your gateway.
IF it is already power up, remove power cable!

Baud Rate is 38400 ... and not using that tool i am on a Mac to do all my monitoring as on my windows machine free doesn't apply with modbus

[himekifee]

Maybe you can try flash the stock chinese version? To mention that after flashing the modified firmware, I used that update.sh to crossflash. It ends up with all functionalities are working and it show as a chinese model from getprop.

[himekifee]

Or maybe simply just two batch of hardwarse with two different pcbs. I bought it from UK amazon 3 days ago.

[BarakaAka1Only]

After many attempts flashing other firmwares both EU and CN nothing works only the signed firmware(s) works as stated many times by @niceboygithub

I myself got mine via Amazon and i am in the USA yet mine is and looks exactly like yours so not sure whats the case in this and with the update.sh doesn't do anything for me, however i can go from 3.3.0_0021_0526 (original) to 3.4.6_0007.0618 M2 CN original and it boots up but again with the modified fw doesn't boot but it reports the version as 3.4.6_0010.0618 even tho M2 CN 3.4.6_0007.0618 (original) was flashed on rootfs_1 and on rootfs_0 its in invalid state

[himekifee]

Maybe because of the bootloader. If you want I can dump whatever you want.

[BarakaAka1Only]

After closely looking at yours to mine, this is how mines looks like

and cool if you could dump it all would be great.

[Nismonx]

I got mine from amazon UK several months ago, if I have a little spare time I can try the same steps as suggested. Would be interesting what happens.

[BarakaAka1Only]

After looking back, @niceboygithub did state and i quote "BTW, there will be another EU model of M2 and it does not use signed fw." so to me @himekifee you may got the EU version that doesn't use signed FW which is the issue on my end, mine is signed. Well just gonna have to wait or until i am able to find a way to get telnet, would be great to get a CN version or even the one you have but aliexpress doesn't have them and amazon is a hit or miss..

[himekifee]

Do you wanna maybe try flashing my bootloader? I'm still finding a way to extract that.

[BarakaAka1Only]

I am open to trying anything at this point.

[himekifee]

So what you got now? Do you have any access to a shell inside? Otherwise I don't really think you have a way to write to nand

[BarakaAka1Only]

Only serial is what i have at this point but its better to have a dump, i do have some tools to dump the winbond chip but i haven't gotten around to doing that at all (not sure if the nand or what is what on what chip)

[himekifee]

I dumped some bit using dd. There are some errors when dumping using nanddump so have to do that. I think you are more experienced on this so I just give all the mtd dump(except data partition) to you to have a look. mtd.zip

[rezmus]

@himekifee can you do getprop | grep lumi.gateway? there is 2nd gen eu hub lumi.gateway.agl001 100% same as 1st gen cn. that would explain why not signed rootfs works for you.

[himekifee]

# getprop | grep lumi.gateway
[persist.sys.model]: [lumi.gateway.agl001]
[ro.sys.model]: [lumi.gateway.iragl5]

Note that I flashed Chinese modified firmware.

[rezmus]

it does not matter because fw does not touch device db (stored on userdata and restored from /res mtd). as you can see you have 2nd gen eu hub agl001, it has 100% same firmware as 1st gen cn iragl5. unfortunately it does not change anything for owners of 1st gen eu irag7 with signed rootfs.

[rezmus]

@himekifee can you check production date from sticker? may be handy for some users, because last batch of irag7 was probably made months ago.

[himekifee]

SKU: AG035EUB01 Production Date: 2022/05

[rezmus]

1st gen m2 eu has sku AG022GLB02.

[BarakaAka1Only]

I went and took a risk on Amazon and purchased a new unit and looks like its the same as @himekifee but its the US version from that the box states.

I took some photos:

Here is the first boot UART Console Log:

uart ok
strap pin:0x412b8ae2
enable spi-nand
ROM ver:v1.1, sig:455cc27, time:2016.01.04-18:42+0800, CPU(400 MHz), DDR2(533 MHz)
load efuse ok
init IP ok
img sig ok
chksum ok
load img ok
jump 0xbfe01550

Booting...
SPI NAND clock not enable

SPI Nand ID=00efaa21
SPI Nand die chipsize=0x08000000 byte
SPI Nand dienum=1,
SPI Nand blocksize=0x00020000 byte,
SPI Nand pagesize=0x00000800 byte,
SPI Nand oobsize=0x00000040 byte,
[rtkn_scan_bbt, line 1812], RBA=51, this->RBA_PERCENT = 5,block_v2r_num=1024
[rtkn_scan_bbt, line 1822] block_v2r_num 00000400
[rtk_scan_v2r_bbt]:678,RBA=00000033,2=00000400,
[rtk_scan_v2r_bbt]:684,block_v2r_num=000003cd
INFO: Stored BBT in Die 0: block=8 , block_status_p1=0x000000bb
load bbt v2r table:0 page:512
[rtk_scan_v2r_bbt] have created v2r bbt table:0 on block 8, just loads it !!
check v2r bbt table:0 OK
[rtk_nand_scan_bbt, line 393] mem_page_num=1 bbt_page 704
INFO: Stored BBT in Die 0: block=11 , block_status_p1=0x000000bb
load bbt table:0 page:704
[rtk_nand_scan_bbt] have created bbt table:0 on block 11, just loads it !!
check bbt table:0 OK
[dump_BBT] Nand BBT Content
Congratulation!! No BBs in this Nand.
=>CPU Wake-up interrupt happen! GISR=89000084 

---Realtek RTL8197F boot code at 2021.12.06-21:28+0800 v3.4T-pre2.1 (993MHz)
Info: Load boot_info success!
== RTL8197 Aqara Gateway bootloader ==
boot_info: ver:0
kernel: newest:0, curr:0
rootfs: newest:0, curr:0
kernel[0]: sum:0x81cb, size:2233348, fail:0
      [1]: sum:0x81cb, size:2233348, fail:0
rootfs[0]: sum:0xb7ea, size:9515012, fail:0
      [1]: sum:0xb7ea, size:9515012, fail:0
root_sum_check: off
watchdog_time: 0
boot_version: 1.0.0_0001
boot_magic: 0000917c
priv mode
Info: loading kernel 0 ...  Done
Info: checking kernel 0 ... Success
Info: select rootfs 0
cmdline:root=/dev/mtdblock5 console=ttyS0,38400
Info: booting...
Jump to image start=0x80a00000...
decompressing kernel:
Uncompressing Linux... done, booting the kernel.
done decompressing kernel.
start address: 0x804e4f10
[    0.000000] Linux version 3.10.90 (huangpingjie-e0051@compilex64-ipg) (gcc version 4.9.4 20151028 (prerelease) (Realtek MSDK-4.9.4p1 Build 2648) ) #18 Tue Dec 28 14:46:15 CST 2021
[    0.000000] bootconsole [early0] enabled
[    0.000000] CPU revision is: 00019385 (MIPS 24Kc)
[    0.000000] Determined physical RAM map:
[    0.000000]  memory: 08000000 @ 00000000 (usable)
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x00000000-0x07ffffff]
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x00000000-0x07ffffff]
[    0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 8176
[    0.000000] Kernel command line: root=/dev/mtdblock5 console=ttyS0,38400
[    0.000000] PID hash table entries: 512 (order: -3, 2048 bytes)
[    0.000000] Dentry cache hash table entries: 16384 (order: 2, 65536 bytes)
[    0.000000] Inode-cache hash table entries: 8192 (order: 1, 32768 bytes)
[    0.000000] Writing ErrCtl register=00020631
[    0.000000] Readback ErrCtl register=00020631
[    0.000000] Memory: 122848k/131072k available (5043k kernel code, 8224k reserved, 1243k data, 240k init, 0k highmem)
[    0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[    0.000000] NR_IRQS:192
[    0.000000] Realtek GPIO IRQ init
[    0.000000] Calibrating delay loop... 660.68 BogoMIPS (lpj=3303424)
[    0.070000] pid_max: default: 32768 minimum: 301
[    0.080000] Mount-cache hash table entries: 2048
[    0.090000] NET: Registered protocol family 16
[    0.100000] <<<<<Register PCI Controller>>>>>
[    0.120000] Do MDIO_RESET
[    0.150000] 40MHz
[    0.510000] PCIE ->  Cannot LinkUP
[    0.520000] INFO: initializing USB devices ...
[    0.570000] enable port 0 two port enable
[    0.730000] patch new usb phy para for 40M OSC
[    1.270000] Realtek GPIO controller driver init
[    1.280000] INFO: initializing i2c devices ...
[    1.290000] INFO: registering sheipa spi device
[    1.310000] bio: create slab <bio-0> at 0
[    1.320000] SCSI subsystem initialized
[    1.330000] INFO: sheipa spi driver register
[    1.340000] INFO: sheipa spi probe
[    1.350000] usbcore: registered new interface driver usbfs
[    1.360000] usbcore: registered new interface driver hub
[    1.370000] usbcore: registered new device driver usb
[    1.380000] Advanced Linux Sound Architecture Driver Initialized.
[    1.390000] cfg80211: Calling CRDA to update world regulatory domain
[    1.400000] Switching to clocksource MIPS
[    1.410000] NET: Registered protocol family 2
[    1.420000] TCP established hash table entries: 2048 (order: 0, 16384 bytes)
[    1.440000] TCP bind hash table entries: 2048 (order: -1, 8192 bytes)
[    1.460000] TCP: Hash tables configured (established 2048 bind 2048)
[    1.480000] TCP: reno registered
[    1.490000] UDP hash table entries: 1024 (order: 0, 16384 bytes)
[    1.510000] UDP-Lite hash table entries: 1024 (order: 0, 16384 bytes)
[    1.530000] NET: Registered protocol family 1
[    1.550000] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    1.570000] exFAT: Version 1.2.9
[    1.580000] NTFS driver 2.1.30 [Flags: R/O].
[    1.590000] msgmni has been set to 239
[    1.610000] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 254)
[    1.630000] io scheduler noop registered (default)
[    1.640000] pwm_probe
[    1.770000] Serial: 8250/16550 driver, 3 ports, IRQ sharing disabled
[    1.780000] serial8250: ttyS0 at MMIO 0x18147000 (irq = 17) is a 16550A
[    1.800000] console [ttyS0] enabled, bootconsole disabled
[    1.800000] console [ttyS0] enabled, bootconsole disabled
[    1.840000] serial8250: ttyS1 at MMIO 0x18147400 (irq = 5) is a 16550A
[    1.860000] serial8250: ttyS2 at MMIO 0x18147800 (irq = 47) is a 16550A
[    1.880000] Realtek GPIO Driver for Flash Reload Default
[    1.900000] id_chain value=efaa21ff
[    1.910000] id_chain value=efaa21ff
[    1.920000] NAND device: Manufacturer ID: 0xef, Chip ID: 0xaa (Unknown W25M01GV 1G SPI NAND), 128MiB, page size: 2048, OOB size: 64
[    1.950000] [rtkn_scan_bbt, line 1812], RBA=51, this->RBA_PERCENT = 5,block_v2r_num=1024
[    1.980000] [rtkn_scan_bbt, line 1822] block_v2r_num 400
[rtk_scan_v2r_bbt]:678,RBA=33,2=400,
[    2.000000] [rtk_scan_v2r_bbt]:684,block_v2r_num=3cd
[    2.020000] INFO: Stored BBT in Die 0: block=8 , block_status_p1=0xbb
[    2.040000] load bbt v2r table:0 page:512
[rtk_scan_v2r_bbt] have created v2r bbt table:0 on block 8, just loads it !!
check v2r bbt table:0 OK
[rtk_nand_scan_bbt, line 393] mem_page_num=1 bbt_page 704
[    2.110000] INFO: Stored BBT in Die 0: block=11 , block_status_p1=0xbb
[    2.130000] load bbt table:0 page:704
[rtk_nand_scan_bbt] have created bbt table:0 on block 11, just loads it !!
check bbt table:0 OK
[dump_BBT] Nand BBT Content
[    2.170000] Congratulation!! No BBs in this Nand.
[    2.190000] 9 rtkxxpart partitions found on MTD device rtk_nand
[    2.200000] Creating 9 MTD partitions on "rtk_nand":
[    2.220000] 0x000000000000-0x0000000a0000 : "bootloader"
[    2.240000] 0x0000000a0000-0x0000000e0000 : "boot_info"
[    2.250000] 0x0000000e0000-0x000000120000 : "factory"
[    2.270000] 0x000000120000-0x000000200000 : "bbt"
[    2.290000] 0x000000200000-0x000000500000 : "linux_1"
[    2.300000] 0x000000500000-0x000001500000 : "rootfs_1"
[    2.320000] 0x000001500000-0x000001800000 : "linux_2"
[    2.330000] 0x000001800000-0x000002800000 : "rootfs_2"
[    2.350000] 0x000002800000-0x000007320000 : "data"
[    2.370000] Realtek WLAN driver - version 1.7 (2015-10-30)(SVN:Unversioned directory)
[    2.390000] Adaptivity function - version 9.3.4
[    2.410000] Device Name = RTKWiFi0 
[    2.420000] VIF_NUM=9
[    2.420000] MACHAL_version_init
[    2.430000] RFE TYPE =0
[    2.440000] ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
[    2.460000] rtl819x-ehci rtl819x-ehci: Realtek rtl819x On-Chip EHCI Host Controller
[    2.490000] rtl819x-ehci rtl819x-ehci: new USB bus registered, assigned bus number 1
[    2.540000] rtl819x-ehci rtl819x-ehci: irq 21, io mem 0x18021000
[    2.570000] rtl819x-ehci rtl819x-ehci: USB 2.0 started, EHCI 1.00
[    2.580000] hub 1-0:1.0: USB hub found
[    2.600000] hub 1-0:1.0: 2 ports detected
[    2.610000] usbcore: registered new interface driver usb-storage
[    2.630000] lumi_btn_probe reset btn=7
[    2.640000] input: lumi_key as /devices/virtual/input/input0
[    2.660000] i2c /dev entries driver
[    2.670000] usbcore: registered new interface driver usbhid
[    2.690000] usbhid: USB HID core driver
[    2.700000] soc-audio soc-audio: ASoC: machine rtl819xd_rt5680 should use snd_soc_register_card()
[    2.730000] soc-audio soc-audio:  snd-soc-dummy-dai <-> rtl819x-iis mapping ok
[    2.750000] TCP: cubic registered
[    2.760000] NET: Registered protocol family 10
[    2.780000] sit: IPv6 over IPv4 tunneling driver
[    2.790000] NET: Registered protocol family 17
[    2.800000] Key type dns_resolver registered
[    2.820000] 
[    2.820000] Probing RTL819X NIC-kenel stack size order[0]...
[    3.510000] eth0 added. vid=9 Member port 0x110...
[    3.530000] eth1 added. vid=8 Member port 0x0...
[    3.550000] ALSA device list:
[    3.560000]   #0: rtl819xd_rt5680
[    3.570000] VFS: Mounted root (squashfs filesystem) readonly on device 31:5.
[    3.600000] Freeing unused kernel memory: 240K (80624000 - 80660000)
init started: BusyBox v1.22.1 (2021-12-27 20:52:29 CST)
Try attaching UBI(0,0) on MTD8 and mounting in [/data].
[    4.530000] UBI: attaching mtd8 to ubi0
[    6.420000] UBI: scanning is finished
[    6.470000] UBI warning: print_rsvd_warning: cannot reserve enough PEBs for bad PEB handling, reserved 18, need 20
[    6.500000] UBI: attached mtd8 (name "data", size 75 MiB) to ubi0
[    6.520000] UBI: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
[    6.540000] UBI: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
[    6.560000] UBI: VID header offset: 2048 (aligned 2048), data offset: 4096
[    6.580000] UBI: good PEBs: 601, bad PEBs: 0, corrupted PEBs: 0
[    6.600000] UBI: user volume: 1, internal volumes: 1, max. volumes count: 128
[    6.620000] UBI: max/mean erase counter: 2/0, WL threshold: 4096, image sequence number: 1076184391
[    6.650000] UBI: available PEBs: 0, total reserved PEBs: 601, PEBs reserved for bad PEB handling: 18
[    6.670000] UBI: background thread "ubi_bgt0d" started, PID 883
UBI device number 0, total 601 LEBs (76312576 bytes, 72.8 MiB), available 0 LEBs (0 bytes), LEB size 126976 bytes (124.0 KiB)
[    6.930000] UBIFS: parse sync
[    7.040000] UBIFS: background thread "ubifs_bgt0_0" started, PID 891
[    7.160000] UBIFS: recovery needed
[    7.900000] UBIFS: recovery completed
[    7.910000] UBIFS: mounted UBI device 0, volume 0, name "app"
[    7.930000] UBIFS: LEB size: 126976 bytes (124 KiB), min./max. I/O unit sizes: 2048 bytes/2048 bytes
[    7.960000] UBIFS: FS size: 69709824 bytes (66 MiB, 549 LEBs), journal size 9023488 bytes (8 MiB, 72 LEBs)
[    7.980000] UBIFS: reserved for root: 0 bytes (0 KiB)
[    8.000000] UBIFS: media format: w4/r0 (latest is w4/r0), UUID A510BA86-E6F6-4E60-A1BD-138B6708C376, small LPT model
Mount UBIFS successfully!
[    8.170000] WlanSupportAbility = 0x3
[    8.180000] [ODM_software_init] 
[    8.180000] [97F] Bonding Type 97FS, PKG1
[    8.180000] [97F] RFE type 0 PHY paratemters: DEFAULT
[    8.180000] clock 40MHz
[    8.180000] load efuse ok
[    8.180000] rom_progress: 0x200006f
[    8.180000] rom_progress: 0x400006f
[    8.250000] [GetHwReg88XX][PHY_REG_PG_8197Fmp_Type0] size
[    8.270000] [GetHwReg88XX][PHY_REG_PG_8197Fmp_Type0]
[    8.490000] [GetHwReg88XX][rtl8197Ffw]
[    8.500000] [GetHwReg88XX][rtl8197Ffw size]
[    8.940000] [97F] Default BB Swing=30
fw_manager.sh revision: 2
pre-revision: 2

hostname: Aqara-Hub-M2-003B
type: lumi.gateway.agl001, model: AH_M2_BLE
Jan  1 00:00:09 mDNSResponder: mDNSResponder (Engineering Build) (Dec 27 2021 20:54:47) starting
Jan  1 00:00:09 mDNSResponder: Unable to parse DNS server list. Unicast DNS-SD unavailable
Jan  1 00:00:09 mDNSResponder: mDNSPlatformSourceAddrForDest: connect 1.1.1.1 failed errno 128 (Network is unreachable)
Jan  1 00:00:09 mDNSResponder: WARNING: mdnsd continuing as root because user "nobody" does not exist
[    9.850000] store_tty0_enable buf=disable
[    9.850000] , count=8
[   15.270000] genirq: Flags mismatch irq 79. 00000083 (gpiolib) vs. 00000082 (wps btn)
[   21.910000] WlanSupportAbility = 0x3
[   21.930000] [ODM_software_init] 
[   21.930000] [97F] Bonding Type 97FS, PKG1
[   21.930000] [97F] RFE type 0 PHY paratemters: DEFAULT
[   21.930000] clock 40MHz
[   21.930000] load efuse ok
[   21.930000] rom_progress: 0x200006f
[   21.930000] rom_progress: 0x400006f
[   22.000000] [GetHwReg88XX][PHY_REG_PG_8197Fmp_Type0] size
[   22.020000] [GetHwReg88XX][PHY_REG_PG_8197Fmp_Type0]
[   22.230000] [GetHwReg88XX][rtl8197Ffw]
[   22.240000] [GetHwReg88XX][rtl8197Ffw size]
[   22.690000] [97F] Default BB Swing=30
[   23.500000] WlanSupportAbility = 0x3
[   23.510000] [ODM_software_init] 
[   23.510000] [97F] Bonding Type 97FS, PKG1
[   23.510000] [97F] RFE type 0 PHY paratemters: DEFAULT
[   23.510000] clock 40MHz
[   23.510000] load efuse ok
[   23.510000] rom_progress: 0x200006f
[   23.510000] rom_progress: 0x400006f
[   23.580000] [GetHwReg88XX][PHY_REG_PG_8197Fmp_Type0] size
[   23.600000] [GetHwReg88XX][PHY_REG_PG_8197Fmp_Type0]
[   23.820000] [GetHwReg88XX][rtl8197Ffw]
[   23.830000] [GetHwReg88XX][rtl8197Ffw size]
[   24.030000] Virtual device wlan0 asks to queue packet!
[   24.290000] [97F] Default BB Swing=30

In the log you can see it states:

fw_manager.sh revision: 2
pre-revision: 2

hostname: Aqara-Hub-M2-003B
type: lumi.gateway.agl001, model: AH_M2_BLE

I am going to flash it and see what happens, i just barely got my hands on it and gained UART..

Came running: 3.3.5_0014.0616 no update for 3.4.7 just only 3.4.6_0007.0618

[BarakaAka1Only]

Flashed rootfs_3.3.5_0012.0611_modified.bin just to keep the "version" the same

And it worked

uart ok
strap pin:0x412b8ae2
enable spi-nand
ROM ver:v1.1, sig:455cc27, time:2016.01.04-18:42+0800, CPU(400 MHz), DDR2(533 MHz)
load efuse ok
init IP ok
img sig ok
chksum ok
load img ok
jump 0xbfe01550

Booting...
SPI NAND clock not enable

SPI Nand ID=00efaa21
SPI Nand die chipsize=0x08000000 byte
SPI Nand dienum=1,
SPI Nand blocksize=0x00020000 byte,
SPI Nand pagesize=0x00000800 byte,
SPI Nand oobsize=0x00000040 byte,
[rtkn_scan_bbt, line 1812], RBA=51, this->RBA_PERCENT = 5,block_v2r_num=1024
[rtkn_scan_bbt, line 1822] block_v2r_num 00000400
[rtk_scan_v2r_bbt]:678,RBA=00000033,2=00000400,
[rtk_scan_v2r_bbt]:684,block_v2r_num=000003cd
INFO: Stored BBT in Die 0: block=8 , block_status_p1=0x000000bb
load bbt v2r table:0 page:512
[rtk_scan_v2r_bbt] have created v2r bbt table:0 on block 8, just loads it !!
check v2r bbt table:0 OK
[rtk_nand_scan_bbt, line 393] mem_page_num=1 bbt_page 704
INFO: Stored BBT in Die 0: block=11 , block_status_p1=0x000000bb
load bbt table:0 page:704
[rtk_nand_scan_bbt] have created bbt table:0 on block 11, just loads it !!
check bbt table:0 OK
[dump_BBT] Nand BBT Content
Congratulation!! No BBs in this Nand.
=>CPU Wake-up interrupt happen! GISR=09000084 

---Realtek RTL8197F boot code at 2021.12.06-21:28+0800 v3.4T-pre2.1 (993MHz)
Info: Load boot_info success!
== RTL8197 Aqara Gateway bootloader ==
boot_info: ver:0
kernel: newest:0, curr:0
rootfs: newest:0, curr:0
kernel[0]: sum:0x81cb, size:2233348, fail:0
      [1]: sum:0x81cb, size:2233348, fail:0
rootfs[0]: sum:0xa7a4, size:9537540, fail:0
      [1]: sum:0xa7a4, size:9537540, fail:0
root_sum_check: off
watchdog_time: 0
boot_version: 1.0.0_0001
boot_magic: 0000917c
priv mode
Info: loading kernel 0 ...  Done
Info: checking kernel 0 ... Success
Info: select rootfs 0
cmdline:root=/dev/mtdblock5 console=ttyS0,38400
Info: booting...
Jump to image start=0x80a00000...
decompressing kernel:
Uncompressing Linux... done, booting the kernel.
done decompressing kernel.
start address: 0x804e4f10
[    0.000000] Linux version 3.10.90 (huangpingjie-e0051@compilex64-ipg) (gcc version 4.9.4 20151028 (prerelease) (Realtek MSDK-4.9.4p1 Build 2648) ) #18 Tue Dec 28 14:46:15 CST 2021
[    0.000000] bootconsole [early0] enabled
[    0.000000] CPU revision is: 00019385 (MIPS 24Kc)
[    0.000000] Determined physical RAM map:
[    0.000000]  memory: 08000000 @ 00000000 (usable)
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x00000000-0x07ffffff]
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x00000000-0x07ffffff]
[    0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 8176
[    0.000000] Kernel command line: root=/dev/mtdblock5 console=ttyS0,38400
[    0.000000] PID hash table entries: 512 (order: -3, 2048 bytes)
[    0.000000] Dentry cache hash table entries: 16384 (order: 2, 65536 bytes)
[    0.000000] Inode-cache hash table entries: 8192 (order: 1, 32768 bytes)
[    0.000000] Writing ErrCtl register=00020631
[    0.000000] Readback ErrCtl register=00020631
[    0.000000] Memory: 122848k/131072k available (5043k kernel code, 8224k reserved, 1243k data, 240k init, 0k highmem)
[    0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[    0.000000] NR_IRQS:192
[    0.000000] Realtek GPIO IRQ init
[    0.000000] Calibrating delay loop... 660.68 BogoMIPS (lpj=3303424)
[    0.070000] pid_max: default: 32768 minimum: 301
[    0.080000] Mount-cache hash table entries: 2048
[    0.090000] NET: Registered protocol family 16
[    0.100000] <<<<<Register PCI Controller>>>>>
[    0.120000] Do MDIO_RESET
[    0.150000] 40MHz
[    0.510000] PCIE ->  Cannot LinkUP
[    0.520000] INFO: initializing USB devices ...
[    0.570000] enable port 0 two port enable
[    0.730000] patch new usb phy para for 40M OSC
[    1.270000] Realtek GPIO controller driver init
[    1.280000] INFO: initializing i2c devices ...
[    1.290000] INFO: registering sheipa spi device
[    1.310000] bio: create slab <bio-0> at 0
[    1.320000] SCSI subsystem initialized
[    1.330000] INFO: sheipa spi driver register
[    1.340000] INFO: sheipa spi probe
[    1.350000] usbcore: registered new interface driver usbfs
[    1.360000] usbcore: registered new interface driver hub
[    1.370000] usbcore: registered new device driver usb
[    1.380000] Advanced Linux Sound Architecture Driver Initialized.
[    1.390000] cfg80211: Calling CRDA to update world regulatory domain
[    1.400000] Switching to clocksource MIPS
[    1.410000] NET: Registered protocol family 2
[    1.420000] TCP established hash table entries: 2048 (order: 0, 16384 bytes)
[    1.440000] TCP bind hash table entries: 2048 (order: -1, 8192 bytes)
[    1.460000] TCP: Hash tables configured (established 2048 bind 2048)
[    1.480000] TCP: reno registered
[    1.490000] UDP hash table entries: 1024 (order: 0, 16384 bytes)
[    1.510000] UDP-Lite hash table entries: 1024 (order: 0, 16384 bytes)
[    1.530000] NET: Registered protocol family 1
[    1.550000] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    1.570000] exFAT: Version 1.2.9
[    1.580000] NTFS driver 2.1.30 [Flags: R/O].
[    1.590000] msgmni has been set to 239
[    1.610000] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 254)
[    1.630000] io scheduler noop registered (default)
[    1.640000] pwm_probe
[    1.770000] Serial: 8250/16550 driver, 3 ports, IRQ sharing disabled
[    1.780000] serial8250: ttyS0 at MMIO 0x18147000 (irq = 17) is a 16550A
[    1.800000] console [ttyS0] enabled, bootconsole disabled
[    1.800000] console [ttyS0] enabled, bootconsole disabled
[    1.840000] serial8250: ttyS1 at MMIO 0x18147400 (irq = 5) is a 16550A
[    1.860000] serial8250: ttyS2 at MMIO 0x18147800 (irq = 47) is a 16550A
[    1.880000] Realtek GPIO Driver for Flash Reload Default
[    1.900000] id_chain value=efaa21ff
[    1.910000] id_chain value=efaa21ff
[    1.920000] NAND device: Manufacturer ID: 0xef, Chip ID: 0xaa (Unknown W25M01GV 1G SPI NAND), 128MiB, page size: 2048, OOB size: 64
[    1.950000] [rtkn_scan_bbt, line 1812], RBA=51, this->RBA_PERCENT = 5,block_v2r_num=1024
[    1.980000] [rtkn_scan_bbt, line 1822] block_v2r_num 400
[rtk_scan_v2r_bbt]:678,RBA=33,2=400,
[    2.000000] [rtk_scan_v2r_bbt]:684,block_v2r_num=3cd
[    2.020000] INFO: Stored BBT in Die 0: block=8 , block_status_p1=0xbb
[    2.040000] load bbt v2r table:0 page:512
[rtk_scan_v2r_bbt] have created v2r bbt table:0 on block 8, just loads it !!
check v2r bbt table:0 OK
[rtk_nand_scan_bbt, line 393] mem_page_num=1 bbt_page 704
[    2.110000] INFO: Stored BBT in Die 0: block=11 , block_status_p1=0xbb
[    2.130000] load bbt table:0 page:704
[rtk_nand_scan_bbt] have created bbt table:0 on block 11, just loads it !!
check bbt table:0 OK
[dump_BBT] Nand BBT Content
[    2.170000] Congratulation!! No BBs in this Nand.
[    2.190000] 9 rtkxxpart partitions found on MTD device rtk_nand
[    2.200000] Creating 9 MTD partitions on "rtk_nand":
[    2.220000] 0x000000000000-0x0000000a0000 : "bootloader"
[    2.240000] 0x0000000a0000-0x0000000e0000 : "boot_info"
[    2.250000] 0x0000000e0000-0x000000120000 : "factory"
[    2.270000] 0x000000120000-0x000000200000 : "bbt"
[    2.280000] 0x000000200000-0x000000500000 : "linux_1"
[    2.300000] 0x000000500000-0x000001500000 : "rootfs_1"
[    2.320000] 0x000001500000-0x000001800000 : "linux_2"
[    2.330000] 0x000001800000-0x000002800000 : "rootfs_2"
[    2.350000] 0x000002800000-0x000007320000 : "data"
[    2.370000] Realtek WLAN driver - version 1.7 (2015-10-30)(SVN:Unversioned directory)
[    2.390000] Adaptivity function - version 9.3.4
[    2.400000] Device Name = RTKWiFi0 
[    2.420000] VIF_NUM=9
[    2.420000] MACHAL_version_init
[    2.430000] RFE TYPE =0
[    2.440000] ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
[    2.460000] rtl819x-ehci rtl819x-ehci: Realtek rtl819x On-Chip EHCI Host Controller
[    2.480000] rtl819x-ehci rtl819x-ehci: new USB bus registered, assigned bus number 1
[    2.540000] rtl819x-ehci rtl819x-ehci: irq 21, io mem 0x18021000
[    2.570000] rtl819x-ehci rtl819x-ehci: USB 2.0 started, EHCI 1.00
[    2.580000] hub 1-0:1.0: USB hub found
[    2.600000] hub 1-0:1.0: 2 ports detected
[    2.610000] usbcore: registered new interface driver usb-storage
[    2.630000] lumi_btn_probe reset btn=7
[    2.640000] input: lumi_key as /devices/virtual/input/input0
[    2.660000] i2c /dev entries driver
[    2.670000] usbcore: registered new interface driver usbhid
[    2.690000] usbhid: USB HID core driver
[    2.700000] soc-audio soc-audio: ASoC: machine rtl819xd_rt5680 should use snd_soc_register_card()
[    2.730000] soc-audio soc-audio:  snd-soc-dummy-dai <-> rtl819x-iis mapping ok
[    2.750000] TCP: cubic registered
[    2.760000] NET: Registered protocol family 10
[    2.780000] sit: IPv6 over IPv4 tunneling driver
[    2.790000] NET: Registered protocol family 17
[    2.800000] Key type dns_resolver registered
[    2.820000] 
[    2.820000] Probing RTL819X NIC-kenel stack size order[0]...
[    3.510000] eth0 added. vid=9 Member port 0x110...
[    3.530000] eth1 added. vid=8 Member port 0x0...
[    3.550000] ALSA device list:
[    3.560000]   #0: rtl819xd_rt5680
[    3.570000] VFS: Mounted root (squashfs filesystem) readonly on device 31:5.
[    3.600000] Freeing unused kernel memory: 240K (80624000 - 80660000)
init started: BusyBox v1.22.1 (2021-11-12 21:21:55 CST)
Try attaching UBI(0,0) on MTD8 and mounting in [/data].
[    4.540000] UBI: attaching mtd8 to ubi0
[    6.430000] UBI: scanning is finished
[    6.470000] UBI warning: print_rsvd_warning: cannot reserve enough PEBs for bad PEB handling, reserved 18, need 20
[    6.520000] UBI: attached mtd8 (name "data", size 75 MiB) to ubi0
[    6.540000] UBI: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
[    6.560000] UBI: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
[    6.580000] UBI: VID header offset: 2048 (aligned 2048), data offset: 4096
[    6.600000] UBI: good PEBs: 601, bad PEBs: 0, corrupted PEBs: 0
[    6.620000] UBI: user volume: 1, internal volumes: 1, max. volumes count: 128
[    6.640000] UBI: max/mean erase counter: 2/0, WL threshold: 4096, image sequence number: 1076184391
[    6.660000] UBI: available PEBs: 0, total reserved PEBs: 601, PEBs reserved for bad PEB handling: 18
[    6.690000] UBI: background thread "ubi_bgt0d" started, PID 885
UBI device number 0, total 601 LEBs (76312576 bytes, 72.8 MiB), available 0 LEBs (0 bytes), LEB size 126976 bytes (124.0 KiB)
[    6.930000] UBIFS: parse sync
[    7.040000] UBIFS: background thread "ubifs_bgt0_0" started, PID 891
[    7.160000] UBIFS: recovery needed
[    7.740000] UBIFS: recovery completed
[    7.760000] UBIFS: mounted UBI device 0, volume 0, name "app"
[    7.770000] UBIFS: LEB size: 126976 bytes (124 KiB), min./max. I/O unit sizes: 2048 bytes/2048 bytes
[    7.800000] UBIFS: FS size: 69709824 bytes (66 MiB, 549 LEBs), journal size 9023488 bytes (8 MiB, 72 LEBs)
[    7.830000] UBIFS: reserved for root: 0 bytes (0 KiB)
[    7.840000] UBIFS: media format: w4/r0 (latest is w4/r0), UUID A510BA86-E6F6-4E60-A1BD-138B6708C376, small LPT model
Mount UBIFS successfully!
[    8.010000] WlanSupportAbility = 0x3
[    8.020000] [ODM_software_init] 
[    8.020000] [97F] Bonding Type 97FS, PKG1
[    8.020000] [97F] RFE type 0 PHY paratemters: DEFAULT
[    8.020000] clock 40MHz
[    8.020000] load efuse ok
[    8.020000] rom_progress: 0x200006f
[    8.020000] rom_progress: 0x400006f
[    8.100000] [GetHwReg88XX][PHY_REG_PG_8197Fmp_Type0] size
[    8.110000] [GetHwReg88XX][PHY_REG_PG_8197Fmp_Type0]
[    8.330000] [GetHwReg88XX][rtl8197Ffw]
[    8.340000] [GetHwReg88XX][rtl8197Ffw size]
[    8.790000] [97F] Default BB Swing=30
fw_manager.sh revision: 2
pre-revision: 2

hostname: rlxlinux-003B
type: lumi.gateway.agl001, model: 
Jan  1 00:00:09 mDNSResponder: mDNSResponder (Engineering Build) (Nov 12 2021 21:24:00) starting
Jan  1 00:00:09 mDNSResponder: Unable to parse DNS server list. Unicast DNS-SD unavailable
Jan  1 00:00:09 mDNSResponder: mDNSPlatformSourceAddrForDest: connect 1.1.1.1 failed errno 128 (Network is unreachable)
Jan  1 00:00:09 mDNSResponder: WARNING: mdnsd continuing as root because user "nobody" does not exist
Platform: aiot
run aiot.
a:0, r:0
Jan  1 00:00:10 ha_agent[955]: Home Automation Agent(ver: 0.1.0) firing up, built at Nov 26 2021 11:40:59; Author: zhiqun.wu@aqara.com
Jan  1 00:00:10 ha_agent[955]: perform: listener is working with /tmp/miio_agent.socket (ha_task.cpp:91)
[   13.040000] i2c_designware i2c_designware.2: i2c_dw_handle_tx_abort: slave address not acknowledged (7bit mode)
[   13.180000] i2c_designware i2c_designware.2: i2c_dw_handle_tx_abort: slave address not acknowledged (7bit mode)
[   13.210000] genirq: Flags mismatch irq 79. 00000083 (gpiolib) vs. 00000082 (wps btn)
Jan  1 00:00:13 ha_agent[955]: accept: a new connection (5) was established with /tmp/miio_agent.socket (ha_task[   13.270000] i2c_designware i2c_designware.2: i2c_dw_handle_tx_abort: slave address not acknowledged (7bit mode)
.cpp:115)
Jan  1 00:00:13 ha_agent[955]: handle_bind: role(1) is associated (ha_msg.cpp:90)
Jan  1 00:00:13 ha_agent[955]: handle_register: method [basis.sy[   13.340000] i2c_designware i2c_designware.2: i2c_dw_handle_tx_abort: slave address not acknowledged (7bit mode)
stem] is registered for role(1) (ha_msg.cpp:115)
Jan  1 00:00:13 ha_agent[955]: handle_register: method [basis.network] is registered for role[   13.410000] i2c_designware i2c_designware.2: i2c_dw_handle_tx_abort: slave address not acknowledged (7bit mode)
(1) (ha_msg.cpp:115)
Jan  1 00:00:13 ha_agent[955]: handle_register: method [basis.device] is registered for role(1) (ha_msg.cpp:115)
Jan  1 00:00:13 ha_age[   13.480000] i2c_designware i2c_designware.2: i2c_dw_handle_tx_abort: slave address not acknowledged (7bit mode)
nt[955]: handle_register: method [basis.arming] is registered for role(1) (ha_msg.cpp:115)
Jan  1 00:00:13 ha_agent[955]: handle_register: met[   13.550000] i2c_designware i2c_designware.2: i2c_dw_handle_tx_abort: slave address not acknowledged (7bit mode)
hod [basis.guarder] is registered for role(1) (ha_msg.cpp:115)
Jan  1 00:00:13 ha_agent[955]: handle_register: method [basis.infrared] is registered for role([   13.620000] i2c_designware i2c_designware.2: i2c_dw_handle_tx_abort: slave address not acknowledged (7bit mode)
1) (ha_msg.cpp:115)
[   13.690000] i2c_designware i2c_designware.2: i2c_dw_handle_tx_abort: slave address not acknowledged (7bit mode)
[   13.760000] i2c_designware i2c_designware.2: i2c_dw_handle_tx_abort: slave address not acknowledged (7bit mode)
[   13.830000] i2c_designware i2c_designware.2: i2c_dw_handle_tx_abort: slave address not acknowledged (7bit mode)
[   13.900000] i2c_designware i2c_designware.2: i2c_dw_handle_tx_abort: slave address not acknowledged (7bit mode)
[   13.970000] i2c_designware i2c_designware.2: i2c_dw_handle_tx_abort: slave address not acknowledged (7bit mode)
[   14.040000] i2c_designware i2c_designware.2: i2c_dw_handle_tx_abort: slave address not acknowledged (7bit mode)
[   14.110000] i2c_designware i2c_designware.2: i2c_dw_handle_tx_abort: slave address not acknowledged (7bit mode)
[   14.180000] i2c_designware i2c_designware.2: i2c_dw_handle_tx_abort: slave address not acknowledged (7bit mode)
[   14.250000] i2c_designware i2c_designware.2: i2c_dw_handle_tx_abort: slave address not acknowledged (7bit mode)
[   14.320000] i2c_designware i2c_designware.2: i2c_dw_handle_tx_abort: slave address not acknowledged (7bit mode)
[   14.390000] i2c_designware i2c_designware.2: i2c_dw_handle_tx_abort: slave address not acknowledged (7bit mode)
[   14.460000] i2c_designware i2c_designware.2: i2c_dw_handle_tx_abort: slave address not acknowledged (7bit mode)
[   14.530000] i2c_designware i2c_designware.2: i2c_dw_handle_tx_abort: slave address not acknowledged (7bit mode)
[   14.600000] i2c_designware i2c_designware.2: i2c_dw_handle_tx_abort: slave address not acknowledged (7bit mode)
[   14.670000] i2c_designware i2c_designware.2: i2c_dw_handle_tx_abort: slave address not acknowledged (7bit mode)
[   14.740000] i2c_designware i2c_designware.2: i2c_dw_handle_tx_abort: slave address not acknowledged (7bit mode)
[   14.810000] i2c_designware i2c_designware.2: i2c_dw_handle_tx_abort: slave address not acknowledged (7bit mode)
[   14.880000] i2c_designware i2c_designware.2: i2c_dw_handle_tx_abort: slave address not acknowledged (7bit mode)
[   14.950000] i2c_designware i2c_designware.2: i2c_dw_handle_tx_abort: slave address not acknowledged (7bit mode)
[   15.020000] i2c_designware i2c_designware.2: i2c_dw_handle_tx_abort: slave address not acknowledged (7bit mode)
[   15.090000] i2c_designware i2c_designware.2: i2c_dw_handle_tx_abort: slave address not acknowledged (7bit mode)
[   15.160000] i2c_designware i2c_designware.2: i2c_dw_handle_tx_abort: slave address not acknowledged (7bit mode)
Failed to read serial number
rlxlinux-003B login: Can't map this device model!
Jan  1 00:00:16 ha_agent[955]: accept: a new connection (6) was established with /tmp/miio_agent.socket (ha_task.cpp:115)
Jan  1 00:00:16 ha_agent[955]: handle_bind: role(256) is associated (ha_msg.cpp:90)
Jan  1 00:00:16 ha_agent[955]: handle_register: method [auto.ifttt] is registered for role(256) (ha_msg.cpp:115)
Jan  1 00:00:16 ha_agent[955]: handle_register: method [auto.report] is registered for role(256) (ha_msg.cpp:115)
Jan  1 00:00:17 ha_agent[955]: accept: a new connection (7) was established with /tmp/miio_agent.socket (ha_task.cpp:115)
Jan  1 00:00:17 ha_agent[955]: handle_bind: role(4) is associated (ha_msg.cpp:90)
Jan  1 00:00:17 ha_agent[955]: handle_register: method [basis.system] is registered for role(4) (ha_msg.cpp:115)
Jan  1 00:00:17 ha_agent[955]: handle_register: method [basis.button] is registered for role(4) (ha_msg.cpp:115)
Jan  1 00:00:17 ha_agent[955]: handle_register: method [basis.network] is registered for role(4) (ha_msg.cpp:115)
Jan  1 00:00:17 ha_agent[955]: handle_register: method [basis.argb] is registered for role(4) (ha_msg.cpp:115)
Jan  1 00:00:17 ha_agent[955]: handle_register: method [basis.state] is registered for role(4) (ha_msg.cpp:115)
Jan  1 00:00:17 ha_agent[955]: handle_register: method [auto.action] is registered for role(4) (ha_msg.cpp:115)
Jan  1 00:00:17 ha_agent[955]: handle_register: method [auto.control] is registered for role(4) (ha_msg.cpp:115)
[   18.160000] WlanSupportAbility = 0x3
[   18.170000] [ODM_software_init] 
[   18.170000] [97F] Bonding Type 97FS, PKG1
[   18.170000] [97F] RFE type 0 PHY paratemters: DEFAULT
[   18.170000] clock 40MHz
[   18.170000] load efuse ok
[   18.170000] rom_progress: 0x200006f
[   18.170000] rom_progress: 0x400006f
[   18.240000] [GetHwReg88XX][PHY_REG_PG_8197Fmp_Type0] size
[   18.260000] [GetHwReg88XX][PHY_REG_PG_8197Fmp_Type0]
[   18.470000] [GetHwReg88XX][rtl8197Ffw]
[   18.490000] [GetHwReg88XX][rtl8197Ffw size]
[   18.930000] [97F] Default BB Swing=30

Shell Access:

So i can confirm Units with Production Date: 2022/05 are unsigned @niceboygithub

[BarakaAka1Only]

Updated using m2_update.sh script which i did have to modify for it to work

curl is required

mkdir /data/bin
wget -O /data/bin/curl "http://master.dl.sourceforge.net/project/mgl03/bin/curl?viasf=1"; chmod +x /data/bin/curl
cp /data/bin/curl /tmp/curl

then use the modified script here

and make sure to run chmod +x m2_update.sh

[rezmus]

also when sku starts with AG035 is new agl001 version.

[artoodetoo3301]

Sorry, I desperately need help on the steps as it is quite unclear.

I downloaded the Aqara Gateway Utils, using uart tiny board flashing the M2 hub. I chose rootfs_1, xmodem, rootfs_3.4.6_0007.0618_modified.bin, following the steps until Programming C:\~~~~\rootfs_3.4.6_0007.0618_modified.bin_raw Done!

After this do I need to do anything else?

Then I tried disconnect the flashing tiny board, unplug and plugin the M2 Hub again, the LED started as Red, then it is yellow forever, no blinking, no flashing, stay always on. Did I brick my device? The Aqara app cannot search the Hub anymore.

Did I miss something, how could I fix it?

Thanks.

[m32w]

Hello I am planing to flash UE version (without UE\UK mark), can you let me know which PINs did you used ?

[Nismonx]

@m32w I don't think you have the right hub.