GreenSun Smart Plug not creating Wifi AP

[TheNitek]

Describe the bug I got a set of new GreenSun smart plugs/meters (see picture bellow), having a CB2S as a controller. Since they are not tuya devices, but VeSync, I had to use UART flashing, which worked fine. Unfortunately the device doesn't open a Wifi hotspot. I tried 1.17.104 and 1.17.113 software version, but it did not change. I also tried "Restore RF part" and "Erase all" before flashing, but the AP never appeared. Any ideas on how to get this device to work?

Firmware:

• Version: 1.17.104 and 1.17.113
• Device: GreenSun Smart Plug
• Chip/model: BK7231N
• Device config: None, didn't have the chance to configure anything

Additional context

[openshwprojects]

What does the TX2 log say at 115200 baud?

gui flasher beta: https://github.com/openshwprojects/BK7231GUIFlashTool/releases can set SSID/PASS by the UART access, I wonder what would happen if you set your SSID there? Would it also fail to connect to AP, or is only the AP mode (not client) broken?

[TheNitek]

I can't get anything out of TX2.

I tried the beta, couldn't read the config, but write it (and then also read it from then on). Still does not work. On thing I noticed: Once powered the LED is always on, but at low brightness and after some time it switches to full brightness

[openshwprojects]

ARe you really sure about that TX2 (or 2TX, whatever they call it)?

The device, even with broken app code, just only with bootloader, should print chip name and some register on TX2 with each reboot.

[TheNitek]

Tried again and got nothing. I flashed the backup back on and TX2 started to work fine:

BK7231n_1.0.8
CPSR:0x000000D3
R0:0x00800000
R1:0x00000000
R2:0x005AA000
R3:0x00000006
R4:0x00400001
R13:0x00401C1C
R14(LR):0x000033AC
ST:0x00000000
[I/FAL] Fal(V0.4.0)success
                          [I/OTA] RT-Thread OTA package(V0.2.4) initialize succe                                                                             ss.

go os_addr(0x10000)..........
LC!▒▒!▒▒▒%▒▒ѵstart addr:0x40e258, size:138664
[Flash]id:0xeb6015
[Flash]init over
sctrl_sta_ps_init
SDK Rev: 3.0.46
[THD]app:[tcb]40f428 [stack]40e420-40f420:4096:5
[THD]extended_app:[tcb]40fc98 [stack]40f490-40fc90:2048:4
[THD]idle:[tcb]410108 [stack]40fd00-410100:1024:0
[THD]timer_thd:[tcb]410e90 [stack]410288-410e88:3072:2
OSK Rev: F-3.0.28
cset:0 0 0 0
[D/FAL] (fal_flash_init:42) Flash device |                bl7231n2m | addr: 0x00                                                                             [FlashDB][kv][usercfg] (fdb_kvdb_init:1638) KVDB size is 65536 bytes.
[FlashDB][kv][usercfg] (fdb_kvdb_init:1642) kv load result 0
[FlashDB]FlashDB V1.1.2 is initialize success.
[FlashDB]You can get the latest version on https://github.com/armink/FlashDB .[F                                                                             lashDB][kv][fac_data] (fdb_kvdb_init:1638) KVDB size is 16384 bytes.
[FlashDB][kv][fac_data] (fdb_kvdb_init:1642) kv load result 0
[FlashDB][kv][log] (fdb_kvdb_init:1638) KVDB size is 65536 bytes.
[FlashDB][kv][log] (fdb_kvdb_init:1642) kv load result 0
[THD]event_task:[tcb]413598 [stack]412990-413590:3072:6
[SDK E ota_fetch_reboot_flag:1021] read flash fail:1
[THD]init_task:[tcb]413f38 [stack]413730-413f30:2048:3
bandgap_calm_in_efuse=0x3e
[load]bandgap_calm=0x20->0x1e,vddig=4->5
[FUNC]rwnxl_init
chip id=7231c device id=20521028
IP Rev: W4-3.0.46-P0
txdesc flush
[FUNC]intc_init
[FUNC]calibration_main
get rfcali_mode:1
device_id=0x20521028
calibration_main over
NO TXPWR_TAB_TAB found in flash
Load default txpwr for b:0xe3330
Load default txpwr for g:0xe3366
fit n20 table with dist:4
Load default txpwr for n40:0xe3274
Load default txpwr for ble:0xe333e
uncali adc value:[00 00 00]
NO TXID_THERMAL found in flash, use def temp:330
temp in flash is:330
[THD]temp_detct:[tcb]414528 [stack]414120-414520:1024:3
NO TXID_LPFCAP found in flash, use def 124, 115
NO TXID_THERMAL found in flash, use def xtal:38
xtal in flash is:38
xtal_cali:38
--init_xtal = 38
[FUNC]ps_init
int watchdog enabled, period=10000
task watchdog enabled, period=60000
[FUNC]func_init_extended OVER!!!

start_type:0
[THD]kmsgbk:[tcb]4155f0 [stack]4145e8-4155e8:4096:6
[THD]init_thread:[tcb]415e30 [stack]415658-415e28:2000:5
Initializing TCP/IP stack
tcp_port:62312
[THD]tcp/ip:[tcb]416880 [stack]416078-416878:2048:7
[THD]wpas_thread:[tcb]417d48 [stack]416d40-417d40:4096:4
bk_wlan_app_init finished
[THD]core_thread:[tcb]418ca8 [stack]4184a0-418ca0:2048:7
[THD]rf_arbitrate:[tcb]419610 [stack]418e08-419608:2048:8
rf_thread_init ok
[THD]ble:[tcb]41a728 [stack]419720-41a720:4096:5
ble mac:fc-58-4a-a1-d3-c3
xvr_reg_init
h4tl_init-1 ok
hci_init ok
!!!!!!init_type=0
rwble_hl_init ok
BLE Rev: B5-3.0.46-P0
rwble_init ok
rwip_driver_init ok
enter normal mode
EM_BLE_END:0x26ec
!!!!!!init_type=1
llm_init:312
[gapm_cmp_evt_handler] conidx:0,operation:0x1,status:0x0
cmd->addr.addr[5] :0
!!!!!!init_type=2
[gapm_cmp_evt_handler] conidx:0,operation:0x3,status:0x0
gapm_cmp_evt:GAPM_SET_DEV_CONFIG
gapm_cmp_evt:wait GAPM_GEN_RAND_NB
[gapm_cmp_evt_handler] conidx:0,operation:0x1a,status:0x0
gapm_cmp_evt:GAPM_GEN_RAND_NB
[gapm_cmp_evt_handler] conidx:0,operation:0x1a,status:0x0
gapm_cmp_evt:GAPM_GEN_RAND_NB
[gapm_cmp_evt_handler] conidx:0,operation:0x28,status:0x0
gapm_cmp_evt:BLE_STACK_OK
[THD]cli:[tcb]41b688 [stack]41b280-41b680:1024:3
[THD]scanner_task:[tcb]41bfd0 [stack]41b7c8-41bfc8:2048:6
ble create new db
ble_env->start_hdl = 0x10
[gapm_profile_added_ind_handler] prf_task_id:0x78,prf_task_nb:9,start_hdl:16,sta                                                                             te:0x1
conidx:0x0,role:0x0,dest_id:0x3,src_id:0x7,param->status:0x0
[gapm_cmp_evt_handler] conidx:0,operation:0x1b,status:0x0
ble create new db
ble_env->start_hdl = 0x16
[gapm_profile_added_ind_handler] prf_task_id:0x79,prf_task_nb:10,start_hdl:22,st                                                                             ate:0x1
conidx:0x0,role:0x0,dest_id:0x3,src_id:0x7,param->status:0x0
[gapm_cmp_evt_handler] conidx:0,operation:0x1b,status:0x0
[gapm_cmp_evt_handler] conidx:0,operation:0xa0,status:0x0
[gapm_cmp_evt_handler] conidx:0,operation:0xaa,status:0x0
[gapm_cmp_evt_handler] conidx:0,operation:0xa9,status:0x0
[THD]vesync_ble_task:[tcb]40f590 [stack]40e588-40f588:4096:5
[gapm_cmp_evt_handler] conidx:0,operation:0xa4,status:0x0

code: EP
channel: 1 - 13
mode: MANUAL
[THD]mqtt_task:[tcb]415b30 [stack]41c220-41d220:4096:5
[SDK W vesync_net_config_read_from_flash:98] read flash error
[SDK W vesync_device_print_info:273]
---------------Device Info---------------
  Device MAC: fc:58:4a:a1:d3:c2
  Device CID: vsot88c70134903935ca186887b400f8
  Device type: outlet
  Device model: WHOGPLUG
  Device alias model: WHOGPLUG
  Firmware type: release
  Hardware version: 1.0
  Vesync SDK version: v1.2.1
  Firmware version: 1.0.01
  Country code: EU
----------------------------------------
[SDK W tb_default_rd_cfg_cb:120] read flash fail[1]
[SDK W vesync_timebase_init:660] config no found: -5

[openshwprojects]

This looks totally different than all the sockets I've seen. It might even have a different bootloader. It's not Tuya. Can you share 2MB backup?

[TheNitek]

As mentioned it's a VeSync device, not a Tuya one, so I guess a different bootloader is quite possible readResult_BK7231N_QIO_2023-14-5--07-51-51.zip