3.3.4 Can't access telnet

[niceboygithub]

3.3.4 Can't access telnet

[STUkh]

Also I was able to connect to Serial connection (with baud speed 38400). But unfortunately looks like it ignores serial commands, tried to execute script for M2 from HA integration repo documentation. Here's boot log:

uart ok
strap pin:0x412b8ae2
enable spi-nand
ROM ver:v1.1, sig:455cc27, time:2016.01.04-18:42+0800, CPU(400 MHz), DDR2(533 MHz)
load efuse ok
init IP ok
rom_progress: 0x0600006d
load_data_from_storage(260): 0xbfe01540, 0x00000000, 0xbfd16f44
load_data_from_spi_nand_flash(70): 0xbfe01540, 0x00000000, 0xbfe03e18
check_image_header(72): h(69,72,61,6d), s(69,72,61,6d)
img sig ok
rom_progress: 0x0c00006d
load_data_from_spi_nand_flash(81) 0x00000004 0x000024ba
load_data_from_spi_nand_flash(86): 0xbfe01d40, 0x00000001, 0xbfe03e18
load_data_from_spi_nand_flash(86): 0xbfe02540, 0x00000002, 0xbfe03e18
load_data_from_spi_nand_flash(86): 0xbfe02d40, 0x00000003, 0xbfe03e18
load_data_from_spi_nand_flash(86): 0xbfe03540, 0x00000004, 0xbfe03e18
load_data_from_spi_nand_flash(90) read done (size:9402)
chksum ok
rom_progress: 0x0e00006d
load img ok
rom_progress: 0x1000006d
jump 0xbfe01550

Booting...
SPI NAND clock not enable

SPI Nand ID=00efaa21
SPI Nand die chipsize=0x08000000 byte
SPI Nand dienum=1,
SPI Nand blocksize=0x00020000 byte,
SPI Nand pagesize=0x00000800 byte,
SPI Nand oobsize=0x00000040 byte,
[rtkn_scan_bbt, line 1812], RBA=51, this->RBA_PERCENT = 5,block_v2r_num=1024
[rtkn_scan_bbt, line 1822] block_v2r_num 00000400
[rtk_scan_v2r_bbt]:678,RBA=00000033,2=00000400,
[rtk_scan_v2r_bbt]:684,block_v2r_num=000003cd
INFO: Stored BBT in Die 0: block=8 , block_status_p1=0x000000bb
load bbt v2r table:0 page:512
[rtk_scan_v2r_bbt] have created v2r bbt table:0 on block 8, just loads it !!
check v2r bbt table:0 OK
[rtk_nand_scan_bbt, line 393] mem_page_num=1 bbt_page 704
INFO: Stored BBT in Die 0: block=11 , block_status_p1=0x000000bb
load bbt table:0 page:704
[rtk_nand_scan_bbt] have created bbt table:0 on block 11, just loads it !!
check bbt table:0 OK
[dump_BBT] Nand BBT Content
Congratulation!! No BBs in this Nand.
=>CPU Wake-up interrupt happen! GISR=89000084

---Realtek RTL8197F boot code at 2020.07.08-18:00+0800 v3.4T-pre2.1 (993MHz)
Info: Load boot_info success!
== RTL8197 Aqara Gateway bootloader ==
boot_info: ver:0
kernel: newest:1, curr:1
rootfs: newest:1, curr:1
kernel[0]: sum:0x81dc, size:2233348, fail:0
      [1]: sum:0x807d, size:2232324, fail:0
rootfs[0]: sum:0x0e37, size:9162756, fail:0
      [1]: sum:0xd6e1, size:9482244, fail:0
root_sum_check: off
watchdog_time: 0
boot_version: 1.0.0_0001
boot_magic: 0000917c
priv mode
Info: loading kernel 1 ...  Done
Info: checking kernel 1 ... Success
Info: select rootfs 1
cmdline:root=/dev/mtdblock7 console=ttyS0,38400
Info: booting...
Jump to image start=0x80a00000...
decompressing kernel:
Uncompressing Linux... done, booting the kernel.
done decompressing kernel.
start address: 0x804e4f10
[    0.000000] Linux version 3.10.90 (liaozhaobao@compilex64-ipg) (gcc version 4.9.4 20151028 (prerelease) (Realtek MSDK-4.9.4p1 Build 2648) ) #74 Fri Nov 5 17:36:17 CST 2021
[    0.000000] bootconsole [early0] enabled
[    0.000000] CPU revision is: 00019385 (MIPS 24Kc)
[    0.000000] Determined physical RAM map:
[    0.000000]  memory: 04000000 @ 00000000 (usable)
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x00000000-0x03ffffff]
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x00000000-0x03ffffff]
[    0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
[    0.000000] Built 1 zonelists in Zone order, mobility grouping off.  Total pages: 4088
[    0.000000] Kernel command line: root=/dev/mtdblock7 console=ttyS0,38400
[    0.000000] PID hash table entries: 256 (order: -4, 1024 bytes)
[    0.000000] Dentry cache hash table entries: 8192 (order: 1, 32768 bytes)
[    0.000000] Inode-cache hash table entries: 4096 (order: 0, 16384 bytes)
[    0.000000] Writing ErrCtl register=00057886
[    0.000000] Readback ErrCtl register=00057886
[    0.000000] Memory: 57488k/65536k available (5043k kernel code, 8048k reserved, 1243k data, 240k init, 0k highmem)
[    0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[    0.000000] NR_IRQS:192
[    0.000000] Realtek GPIO IRQ init
[    0.000000] Calibrating delay loop... 660.68 BogoMIPS (lpj=3303424)
[    0.070000] pid_max: default: 32768 minimum: 301
[    0.080000] Mount-cache hash table entries: 2048
[    0.090000] NET: Registered protocol family 16
[    0.100000] <<<<<Register PCI Controller>>>>>
[    0.120000] Do MDIO_RESET
[    0.150000] 40MHz
[    0.510000] PCIE ->  Cannot LinkUP
[    0.520000] INFO: initializing USB devices ...
[    0.570000] enable port 0 two port enable
[    0.730000] patch new usb phy para for 40M OSC
[    1.270000] Realtek GPIO controller driver init
[    1.280000] INFO: initializing i2c devices ...
[    1.290000] INFO: registering sheipa spi device
[    1.310000] bio: create slab <bio-0> at 0
[    1.320000] SCSI subsystem initialized
[    1.330000] INFO: sheipa spi driver register
[    1.340000] INFO: sheipa spi probe
[    1.350000] usbcore: registered new interface driver usbfs
[    1.360000] usbcore: registered new interface driver hub
[    1.370000] usbcore: registered new device driver usb
[    1.380000] Advanced Linux Sound Architecture Driver Initialized.
[    1.390000] cfg80211: Calling CRDA to update world regulatory domain
[    1.400000] Switching to clocksource MIPS
[    1.410000] NET: Registered protocol family 2
[    1.420000] TCP established hash table entries: 2048 (order: 0, 16384 bytes)
[    1.440000] TCP bind hash table entries: 2048 (order: -1, 8192 bytes)
[    1.460000] TCP: Hash tables configured (established 2048 bind 2048)
[    1.480000] TCP: reno registered
[    1.490000] UDP hash table entries: 1024 (order: 0, 16384 bytes)
[    1.510000] UDP-Lite hash table entries: 1024 (order: 0, 16384 bytes)
[    1.530000] NET: Registered protocol family 1
[    1.550000] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    1.570000] exFAT: Version 1.2.9
[    1.580000] NTFS driver 2.1.30 [Flags: R/O].
[    1.590000] msgmni has been set to 112
[    1.610000] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 254)
[    1.630000] io scheduler noop registered (default)
[    1.640000] pwm_probe
[    1.770000] Serial: 8250/16550 driver, 3 ports, IRQ sharing disabled
[    1.790000] serial8250: ttyS0 at MMIO 0x18147000 (irq = 17) is a 16550A
[    1.810000] console [ttyS0] enabled, bootconsole disabled
[    1.810000] console [ttyS0] enabled, bootconsole disabled
[    1.840000] serial8250: ttyS1 at MMIO 0x18147400 (irq = 5) is a 16550A
[    1.860000] serial8250: ttyS2 at MMIO 0x18147800 (irq = 47) is a 16550A
[    1.880000] Realtek GPIO Driver for Flash Reload Default
[    1.900000] id_chain value=efaa219f
[    1.910000] id_chain value=efaa219f
[    1.920000] NAND device: Manufacturer ID: 0xef, Chip ID: 0xaa (Unknown W25M01GV 1G SPI NAND), 128MiB, page size: 2048, OOB size: 64
[    1.950000] [rtkn_scan_bbt, line 1812], RBA=51, this->RBA_PERCENT = 5,block_v2r_num=1024
[    1.980000] [rtkn_scan_bbt, line 1822] block_v2r_num 400
[rtk_scan_v2r_bbt]:678,RBA=33,2=400,
[    2.000000] [rtk_scan_v2r_bbt]:684,block_v2r_num=3cd
[    2.020000] INFO: Stored BBT in Die 0: block=8 , block_status_p1=0xbb
[    2.040000] load bbt v2r table:0 page:512
[rtk_scan_v2r_bbt] have created v2r bbt table:0 on block 8, just loads it !!
check v2r bbt table:0 OK
[rtk_nand_scan_bbt, line 393] mem_page_num=1 bbt_page 704
[    2.110000] INFO: Stored BBT in Die 0: block=11 , block_status_p1=0xbb
[    2.130000] load bbt table:0 page:704
[rtk_nand_scan_bbt] have created bbt table:0 on block 11, just loads it !!
check bbt table:0 OK
[dump_BBT] Nand BBT Content
[    2.170000] Congratulation!! No BBs in this Nand.
[    2.190000] 9 rtkxxpart partitions found on MTD device rtk_nand
[    2.210000] Creating 9 MTD partitions on "rtk_nand":
[    2.220000] 0x000000000000-0x0000000a0000 : "bootloader"
[    2.240000] 0x0000000a0000-0x0000000e0000 : "boot_info"
[    2.250000] 0x0000000e0000-0x000000120000 : "factory"
[    2.270000] 0x000000120000-0x000000200000 : "bbt"
[    2.290000] 0x000000200000-0x000000500000 : "linux_1"
[    2.300000] 0x000000500000-0x000001500000 : "rootfs_1"
[    2.320000] 0x000001500000-0x000001800000 : "linux_2"
[    2.340000] 0x000001800000-0x000002800000 : "rootfs_2"
[    2.350000] 0x000002800000-0x000007320000 : "data"
[    2.370000] Realtek WLAN driver - version 1.7 (2015-10-30)(SVN:Unversioned directory)
[    2.390000] Adaptivity function - version 9.3.4
[    2.410000] Device Name = RTKWiFi0
[    2.420000] VIF_NUM=9
[    2.430000] MACHAL_version_init
[    2.440000] RFE TYPE =0
[    2.440000] ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
[    2.460000] rtl819x-ehci rtl819x-ehci: Realtek rtl819x On-Chip EHCI Host Controller
[    2.490000] rtl819x-ehci rtl819x-ehci: new USB bus registered, assigned bus number 1
[    2.540000] rtl819x-ehci rtl819x-ehci: irq 21, io mem 0x18021000
[    2.570000] rtl819x-ehci rtl819x-ehci: USB 2.0 started, EHCI 1.00
[    2.580000] hub 1-0:1.0: USB hub found
[    2.600000] hub 1-0:1.0: 2 ports detected
[    2.610000] usbcore: registered new interface driver usb-storage
[    2.630000] lumi_btn_probe reset btn=7
[    2.640000] input: lumi_key as /devices/virtual/input/input0
[    2.660000] i2c /dev entries driver
[    2.670000] usbcore: registered new interface driver usbhid
[    2.690000] usbhid: USB HID core driver
[    2.700000] soc-audio soc-audio: ASoC: machine rtl819xd_rt5680 should use snd_soc_register_card()
[    2.730000] soc-audio soc-audio:  snd-soc-dummy-dai <-> rtl819x-iis mapping ok
[    2.750000] TCP: cubic registered
[    2.760000] NET: Registered protocol family 10
[    2.780000] sit: IPv6 over IPv4 tunneling driver
[    2.790000] NET: Registered protocol family 17
[    2.800000] Key type dns_resolver registered
[    2.820000]
[    2.820000] Probing RTL819X NIC-kenel stack size order[0]...
[    3.510000] eth0 added. vid=9 Member port 0x110...
[    3.530000] eth1 added. vid=8 Member port 0x0...
[    3.550000] ALSA device list:
[    3.560000]   #0: rtl819xd_rt5680
[    3.580000] VFS: Mounted root (squashfs filesystem) readonly on device 31:7.
[    3.600000] Freeing unused kernel memory: 240K (80624000 - 80660000)
init started: BusyBox v1.22.1 (2021-05-07 11:59:46 CST)
Try attaching UBI(0,0) on MTD8 and mounting in [/data].
[    4.540000] UBI: attaching mtd8 to ubi0
[    6.440000] UBI: scanning is finished
[    6.480000] UBI warning: print_rsvd_warning: cannot reserve enough PEBs for bad PEB handling, reserved 18, need 20
[    6.510000] UBI: attached mtd8 (name "data", size 75 MiB) to ubi0
[    6.530000] UBI: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
[    6.550000] UBI: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
[    6.570000] UBI: VID header offset: 2048 (aligned 2048), data offset: 4096
[    6.590000] UBI: good PEBs: 601, bad PEBs: 0, corrupted PEBs: 0
[    6.610000] UBI: user volume: 1, internal volumes: 1, max. volumes count: 128
[    6.630000] UBI: max/mean erase counter: 3/1, WL threshold: 4096, image sequence number: 1182574826
[    6.660000] UBI: available PEBs: 0, total reserved PEBs: 601, PEBs reserved for bad PEB handling: 18
[    6.690000] UBI: background thread "ubi_bgt0d" started, PID 883
UBI device number 0, total 601 LEBs (76312576 bytes, 72.8 MiB), available 0 LEBs (0 bytes), LEB size 126976 bytes (124.0 KiB)
[    6.940000] UBIFS: parse sync
[    7.050000] UBIFS: background thread "ubifs_bgt0_0" started, PID 891
[    7.160000] UBIFS: recovery needed
[    7.770000] UBIFS: recovery completed
[    7.780000] UBIFS: mounted UBI device 0, volume 0, name "app"
[    7.800000] UBIFS: LEB size: 126976 bytes (124 KiB), min./max. I/O unit sizes: 2048 bytes/2048 bytes
[    7.830000] UBIFS: FS size: 69709824 bytes (66 MiB, 549 LEBs), journal size 9023488 bytes (8 MiB, 72 LEBs)
[    7.860000] UBIFS: reserved for root: 0 bytes (0 KiB)
[    7.870000] UBIFS: media format: w4/r0 (latest is w4/r0), UUID 9DDC05BB-4E14-4C76-83D8-BC8E7B44F8F1, small LPT model
Mount UBIFS successfully!
[    8.050000] WlanSupportAbility = 0x3
[    8.060000] [ODM_software_init]
[    8.060000] [97F] Bonding Type 97FS, PKG1
[    8.060000] [97F] RFE type 0 PHY paratemters: DEFAULT
[    8.060000] clock 40MHz
[    8.060000] load efuse ok
[    8.060000] rom_progress: 0x200006f
[    8.060000] rom_progress: 0x400006f
[    8.130000] [GetHwReg88XX][PHY_REG_PG_8197Fmp_Type0] size
[    8.150000] [GetHwReg88XX][PHY_REG_PG_8197Fmp_Type0]
[    8.370000] [GetHwReg88XX][rtl8197Ffw]
[    8.380000] [GetHwReg88XX][rtl8197Ffw size]
[    8.810000] [97F] Default BB Swing=30
fw_manager.sh revision: 2
pre-revision: 2

hostname: Aqara-Hub-M2-5023
type: lumi.gateway.iragl5, model: AH_M2_BLE
Jan  1 00:00:09 mDNSResponder: mDNSResponder (Engineering Build) (May  7 2021 12:02:25) starting
Jan  1 00:00:09 mDNSResponder: Unable to parse DNS server list. Unicast DNS-SD unavailable
Jan  1 00:00:09 mDNSResponder: mDNSPlatformSourceAddrForDest: connect 1.1.1.1 failed errno 128 (Network is unreachable)
Jan  1 00:00:09 mDNSResponder: WARNING: mdnsd continuing as root becau[    9.690000] store_tty0_enable buf=disable
[    9.690000] , count=8
se user "nobody" does not exist
[   13.160000] i2c_designware i2c_designware.2: i2c_dw_handle_tx_abort: slave address not acknowledged (7bit mode)
[   13.220000] genirq: Flags mismatch irq 79. 00000083 (gpiolib) vs. 00000082 (wps btn)
[   16.100000] WlanSupportAbility = 0x3
[   16.110000] [ODM_software_init]
[   16.110000] [97F] Bonding Type 97FS, PKG1
[   16.110000] [97F] RFE type 0 PHY paratemters: DEFAULT
[   16.110000] clock 40MHz
[   16.110000] load efuse ok
[   16.110000] rom_progress: 0x200006f
[   16.110000] rom_progress: 0x400006f
[   16.190000] [GetHwReg88XX][PHY_REG_PG_8197Fmp_Type0] size
[   16.200000] [GetHwReg88XX][PHY_REG_PG_8197Fmp_Type0]
[   16.420000] [GetHwReg88XX][rtl8197Ffw]
[   16.430000] [GetHwReg88XX][rtl8197Ffw size]
[   16.870000] [97F] Default BB Swing=30

[niceboygithub]

Strange. Looks fw was flashed by AqaraGateway but it still run old fw.
Can you flash again?

[STUkh]

@niceboygithub thanks for response. Should I flash to rootfs_1 also? Flashing to same place not effective. And one more thing - it is ok that 7/10 flashing attempts I get transfer error for file? Soldering looks good (not best, but good enough) and wires are 30cm long. Port USB 2.0 directly connected to MB with no sibling devices

[STUkh]

@niceboygithub flash firmware to rootfs_1 helped in my case 🙏 . After flashing I get prompted to login in Serial session the same as with telnet. It would be great to add to the docs the way with serial connection config (especially part with speed 38400). Also I think we don't need to get curl in update.sh script, it can be simplified a bit with only wget usage with wget --no-proxy -O /tmp/m2_update.sh https://raw.githubusercontent.com/niceboygithub/AqaraM1SM2fw/main/modified/M2/m2_update.sh and remove pretty big amount part of script fetching command

[niceboygithub]

wget in buxybos is not supporting HTTPS