mgl03_1.4.6_0012_mod20201223
there are errors.... in the terminal
i2c_designware i2c_designware.1: i2c_dw_handle_tx_abort: slave address not acknowledged (7bit mode)
those error canbe ignore?

Hello!
When I load macro, I step-by-step go to load rtkboot_11520
after it is loading macro dont asking about FW file
only if I make Disconnect in Tera macro will ask about file.
After select file - progress bar is empty and I have message that its fail in few minutes

I try to change port speed in Tera and Windows, trying different rtkboot_***
no ways
I try to wait 2 hours after loading rtkboot_115200 - no result. Macro dont asking about FW file

Hello,

I tried to run the new macro but I get syntax error.

Also with the old one when I load the firmware I get wrong firmware file header

Thanks

After I turned on the power, then it failed ，can't enter bootloader. But I did it in Linux.
Thanks!

I'm trying to flash mgl03_1.5.6_0001_mod20231031 to my gateway using tera term and rtkboot_38400.bin (thought that one hour would be fine), but it's taking more than three hours and after looking to Tera Term I'm not sure it is flashing anything. It shows nothing for a while, than uart board led blinks and a couple updates appear, but apparently they are all the same every single time, as shown below.

I strictly followed the README.md, only chosing a more reliable rate. Any ideas?

[10366.570000] WlanSupportAbility = 0x3
[10366.580000] [ODM_software_init]
[10366.580000] [97F] Bonding Type 97FS, PKG1
[10366.580000] [97F] RFE type 0 PHY paratemters: DEFAULT
[10366.580000] clock 40MHz
[10366.580000] load efuse ok
[10366.580000] rom_progress: 0x200006f
[10366.580000] rom_progress: 0x400006f
[10366.660000] [GetHwReg88XX][PHY_REG_PG_8197Fmp_Type0] size
[10366.670000] [GetHwReg88XX][PHY_REG_PG_8197Fmp_Type0]
[10366.890000] [GetHwReg88XX][rtl8197Ffw]
[10366.900000] [GetHwReg88XX][rtl8197Ffw size]
[10367.350000] [97F] Default BB Swing=30
[10367.360000] br0: port 2(wlan0) entered forwarding state
[10367.370000] br0: port 2(wlan0) entered forwarding state
[10368.150000] br0: port 2(wlan0) entered disabled state


[10620.800000] br0: port 2(wlan0) entered forwarding state
[10620.820000] br0: port 2(wlan0) entered forwarding state
[10621.360000] br0: port 2(wlan0) entered disabled state
[10621.380000] WlanSupportAbility = 0x3
[10621.390000] [ODM_software_init]
[10621.390000] [97F] Bonding Type 97FS, PKG1
[10621.390000] [97F] RFE type 0 PHY paratemters: DEFAULT
[10621.390000] clock 40MHz
[10621.390000] load efuse ok
[10621.390000] rom_progress: 0x200006f
[10621.390000] rom_progress: 0x400006f
[10621.470000] [GetHwReg88XX][PHY_REG_PG_8197Fmp_Type0] size
[10621.480000] [GetHwReg88XX][PHY_REG_PG_8197Fmp_Type0]
[10621.700000] [GetHwReg88XX][rtl8197Ffw]
[10621.710000] [GetHwReg88XX][rtl8197Ffw size]
[10622.160000] [97F] Default BB Swing=30
[10622.170000] br0: port 2(wlan0) entered forwarding state
[10622.180000] br0: port 2(wlan0) entered forwarding state
[10623.240000] br0: port 2(wlan0) entered disabled state
[10623.260000] WlanSupportAbility = 0x3
[10623.270000] [ODM_software_init]
[10623.270000] [97F] Bonding Type 97FS, PKG1
[10623.270000] [97F] RFE type 0 PHY paratemters: DEFAULT
[10623.270000] clock 40MHz
[10623.270000] load efuse ok
[10623.270000] rom_progress: 0x200006f
[10623.270000] rom_progress: 0x400006f
[10623.350000] [GetHwReg88XX][PHY_REG_PG_8197Fmp_Type0] size
[10623.360000] [GetHwReg88XX][PHY_REG_PG_8197Fmp_Type0]
[10623.580000] [GetHwReg88XX][rtl8197Ffw]
[10623.590000] [GetHwReg88XX][rtl8197Ffw size]
[10624.040000] [97F] Default BB Swing=30
[10624.050000] br0: port 2(wlan0) entered forwarding state
[10624.070000] br0: port 2(wlan0) entered forwarding state
[10624.840000] br0: port 2(wlan0) entered disabled state


[10876.850000] br0: port 2(wlan0) entered forwarding state
[10876.860000] br0: port 2(wlan0) entered forwarding state
[10877.360000] br0: port 2(wlan0) entered disabled state
[10877.380000] WlanSupportAbility = 0x3
[10877.390000] [ODM_software_init]
[10877.390000] [97F] Bonding Type 97FS, PKG1
[10877.390000] [97F] RFE type 0 PHY paratemters: DEFAULT
[10877.390000] clock 40MHz
[10877.390000] load efuse ok
[10877.390000] rom_progress: 0x200006f
[10877.390000] rom_progress: 0x400006f
[10877.470000] [GetHwReg88XX][PHY_REG_PG_8197Fmp_Type0] size
[10877.480000] [GetHwReg88XX][PHY_REG_PG_8197Fmp_Type0]
[10877.700000] [GetHwReg88XX][rtl8197Ffw]
[10877.710000] [GetHwReg88XX][rtl8197Ffw size]
[10878.160000] [97F] Default BB Swing=30
[10878.170000] br0: port 2(wlan0) entered forwarding state
[10878.180000] br0: port 2(wlan0) entered forwarding state
[10879.250000] br0: port 2(wlan0) entered disabled state
[10879.270000] WlanSupportAbility = 0x3
[10879.280000] [ODM_software_init]
[10879.280000] [97F] Bonding Type 97FS, PKG1
[10879.280000] [97F] RFE type 0 PHY paratemters: DEFAULT
[10879.280000] clock 40MHz
[10879.280000] load efuse ok
[10879.280000] rom_progress: 0x200006f
[10879.280000] rom_progress: 0x400006f
[10879.360000] [GetHwReg88XX][PHY_REG_PG_8197Fmp_Type0] size
[10879.370000] [GetHwReg88XX][PHY_REG_PG_8197Fmp_Type0]
[10879.590000] [GetHwReg88XX][rtl8197Ffw]
[10879.600000] [GetHwReg88XX][rtl8197Ffw size]
[10880.050000] [97F] Default BB Swing=30
[10880.060000] br0: port 2(wlan0) entered forwarding state
[10880.070000] br0: port 2(wlan0) entered forwarding state
[10880.840000] br0: port 2(wlan0) entered disabled state


[11133.380000] br0: port 2(wlan0) entered forwarding state
[11133.390000] br0: port 2(wlan0) entered forwarding state
[11133.890000] br0: port 2(wlan0) entered disabled state
[11133.910000] WlanSupportAbility = 0x3
[11133.920000] [ODM_software_init]
[11133.920000] [97F] Bonding Type 97FS, PKG1
[11133.920000] [97F] RFE type 0 PHY paratemters: DEFAULT
[11133.920000] clock 40MHz
[11133.920000] load efuse ok
[11133.920000] rom_progress: 0x200006f
[11133.920000] rom_progress: 0x400006f
[11134.000000] [GetHwReg88XX][PHY_REG_PG_8197Fmp_Type0] size
[11134.010000] [GetHwReg88XX][PHY_REG_PG_8197Fmp_Type0]
[11134.230000] [GetHwReg88XX][rtl8197Ffw]
[11134.240000] [GetHwReg88XX][rtl8197Ffw size]
[11134.690000] [97F] Default BB Swing=30
[11134.700000] br0: port 2(wlan0) entered forwarding state
[11134.710000] br0: port 2(wlan0) entered forwarding state
[11135.770000] br0: port 2(wlan0) entered disabled state
[11135.790000] WlanSupportAbility = 0x3
[11135.800000] [ODM_software_init]
[11135.800000] [97F] Bonding Type 97FS, PKG1
[11135.800000] [97F] RFE type 0 PHY paratemters: DEFAULT
[11135.800000] clock 40MHz
[11135.800000] load efuse ok
[11135.800000] rom_progress: 0x200006f
[11135.800000] rom_progress: 0x400006f
[11135.880000] [GetHwReg88XX][PHY_REG_PG_8197Fmp_Type0] size
[11135.890000] [GetHwReg88XX][PHY_REG_PG_8197Fmp_Type0]
[11136.110000] [GetHwReg88XX][rtl8197Ffw]
[11136.120000] [GetHwReg88XX][rtl8197Ffw size]
[11136.570000] [97F] Default BB Swing=30
[11136.580000] br0: port 2(wlan0) entered forwarding state
[11136.590000] br0: port 2(wlan0) entered forwarding state
[11137.370000] br0: port 2(wlan0) entered disabled state

two years later

[20283.980000] [GetHwReg88XX][PHY_REG_PG_8197Fmp_Type0] size
[20283.990000] [GetHwReg88XX][PHY_REG_PG_8197Fmp_Type0]
[20284.210000] [GetHwReg88XX][rtl8197Ffw]
[20284.220000] [GetHwReg88XX][rtl8197Ffw size]
[20284.670000] [97F] Default BB Swing=30
[20284.680000] br0: port 2(wlan0) entered forwarding state
[20284.690000] br0: port 2(wlan0) entered forwarding state
[20285.460000] br0: port 2(wlan0) entered disabled state

Hello serrj-sv,
I'm trying to downgrade firmware in my gateway [lumi.gateway.mgl03].
I have problem with transfering/sending data/command.
I don't know why when i use cat /dev/ttyAMA0 to see logs i see "uart ok" but when i use
sudo ./mgl03_uart_recovery.expect | tee boot_gatewayv3_mgl03.txt i always see "art ok"

Power ON Gateway NOW!
art ok
strap pin:0x412b8ae2
enable spi-nand
ROM ver:v1.1, sig:455cc27, time:2016.01.04-18:42+0800, CPU(400 MHz), DDR2(533 MHz)
Enter ROM console
Connected to correct bootloader!
<RealTek>
alTek>
<RealTek>in:0x412b8ae c<
Unknown command !
<RealTek>gmsg 3

You can see it on attached log.
boot_gateway_v3_mgl03.txt
boot_gateway_v3.txt
In logs i only delete empty lines.
Next what i saw is that the xmodem not transfer data:

Xmodem sectors/kbytes sent:   0/ 0kRetry 0: Got 50 for sector ACK
Retry 0: NAK on sector
Retry 0: Got 45 for sector ACK
...
Retry 0: Got 61 for sector ACK
Retry 0: NAK on sector
Retry 0: Retry Count Exceeded
Transfer incomplete

Could you help me to resolve problem?

is it possible to gain a root shell with uart?

Background: I have a bricked M1S hub. No one can get the niceboy aqaragateway.exe to work.

So I tried your script and got to flash the bootloader. If only you can make a .uart file for M1S firmware and modify the script a little bit! I can provide stock uart logs.

Can you make aqara m2/m1s gateway firmware and refresh tool？thanks~

I have successfully flashed with 1.4.6_0012_mod20210127 version, using uart and solder, and gateway works perfectly in Home Assistant, the proble is that I can't pair new child devices in HA, but if I pair same device with Mi Home app, it works in HA

Hello there.
Before I've readed all forums I've updated my gateway 3 to the newest firmware... finally I've found your recovery solution, bought myself uart adapter, connected to Win 10 and everything was running fine till I've left my pc unattended for couple minutes. When I got back the transfer popup dissappeard and since that moment I can't connect any uart. Gateway works fine with devices and Mi Home but I wanted to use it with Home Assistant. When using Windows, system see the uart adapter as COM 2 but while using macro nothing happens when plug in power adapter. While using Linus exactly the same story. I've tried also backup uart pinout without result.
Thanks in advance for any tips!

Hello there.

How to change desired wifi network in running device? (by running device I mean device which is being constanly used but not the prefered network has changed and gateway should follow)

For ZNDMWG02LM, macro stops after Jump to command.

I was trying to downgrade the gateway with this method. Got the pcb clip connected on the Board with the ttl to usb 3.3v jumper set(as was suggested) windows sees the usb module after a driver install(com4)

next step connect it with de tera term.
Script says connect it with poweroff. Then power on.. after that.. nothing. What should i expect to see after the gateway boots up? Script doesn’t change after the “power on” what do i miss?

Hi! I upgraded my device to the latest version and want to integrate the device with home assistant.
Can I use you instructions from https://github.com/serrj-sv/lumi.gateway.mgl03/tree/main/uart_recovery to flash the firmware?

Hello,

I tried to push several firmware on my mgl03 but they all arrive the same dead end boot loop (full log below).
do you have any idea about that?
from my (low) understanding, i am stuck in booting on "rtkboot_115200.bin"

PS: by the way, is there a way to push openwrt directly throug UART?

uart ok
strap pin:0x412b8ae2
enable spi-nand
ROM ver:v1.1, sig:455cc27, time:2016.01.04-18:42+0800, CPU(400 MHz), DDR2(533 MHz)
load efuse ok
init IP ok
rom_progress: 0x0600006d
load_data_from_storage(260): 0xbfe01540, 0x00000000, 0xbfd16f44
load_data_from_spi_nand_flash(70): 0xbfe01540, 0x00000000, 0xbfe03e18
ECC_DECODE_FAIL,ecc_start_addr = 0xbfe01540
check_image_header(72): h(ff,ff,ff,ff), s(69,72,61,6d)
img sig err
rom_progress: 0x0d00006d
load_data_from_storage(260): 0xbfe01540, 0x00000080, 0xbfd16f44
load_data_from_spi_nand_flash(70): 0xbfe01540, 0x00000080, 0xbfe03e18

ECC_DECODE_FAIL,ecc_start_addr = 0xbfe01540
check_image_header(72): h(f2,93,21,a2), s(69,72,61,6d)
img sig err
rom_progress: 0x0d00006d
load_data_from_storage(260): 0xbfe01540, 0x00000100, 0xbfd16f44
load_data_from_spi_nand_flash(70): 0xbfe01540, 0x00000100, 0xbfe03e18
ECC_DECODE_FAIL,ecc_start_addr = 0xbfe01540
check_image_header(72): h(ff,ff,ff,ff), s(69,72,61,6d)
img sig err
rom_progress: 0x0d00006d
load_data_from_storage(260): 0xbfe01540, 0x00000180, 0xbfd16f44
load_data_from_spi_nand_flash(70): 0xbfe01540, 0x00000180, 0xbfe03e18
check_image_header(72): h(2b,13,72,18), s(69,72,61,6d)
img sig err
rom_progress: 0x0d00006d
load img fail(0xffffffff)
rom_progress: 0x1100006d
load code fail (0xffffffff)
rom_progress: 0x0b00006d

dram_init.c : ss_init_rxi310()

dram_init.c : ms_ctrl_0_map=0xb8142000
ss_init_rxi310(1902):bond:0x0000000a

dram_init_clk_frequency ,ddr_freq=1066 (Mbps), 533 (MHZ)
mck_ck = 0, 1084

JSW : dram_init_rxi310 ,dev_map=0xb8142000

JSW : dram_init_rxi310 ,dram_info=0x9fe03f20

JSW : dram_init_rxi310 001

dfi_rate=2,dram_period=3752

JSW : dram_init_rxi310 002

SDR D1 dram_info-> dev-> device_type=2 ,cr_twr=3

DDR2 dram_info-> dev-> device_type=2

DDR2 dram_info-> mode_reg-> bst_len=0

SDR dq_width=2

SDR page=3

SDR dram_info-> dev-> bank =1

cr_bst_len =0

SDR dfi_rate=2

SDR dq_width=2

ddr_type =2

SDR cas_rd /(dfi_rate)=3

SDR cas_wr /(dfi_rate) =3

SDR dev_map-> dcr =0x00000222

SDR dev_map-> iocr=0x00204000

dev_map-> emr1=0x00000006

dev_map-> mr=0x00000672

SDR dev_map-> drr=0x0912be1c

SDR dev_map-> tpr0=0x000066c4

SDR dev_map-> tpr1=0x002a9104

SDR dev_map-> tpr2=0x00000042

DRAM init disable

DRAM init enable

DRAM init is done , jump to DRAM

SDR init done , dev_map=0xb8142000
Enter dram_auto_size_detect_rxi310, page_size = 3, bank_size = 1

DDR2 dram_info-> mode_reg-> bst_len=0

Detect page_size = 2KB (3)

Detect bank_size = 4 banks(0x00000001)

Detect dram size = 64MB (0x04000000)

dram_init.c : dram_calibration_turn_on_odt.

Perform sample dram testing
=======start dram_addr_rot test=======
rotate 0 0xa0400100 passed
rotate 4 0xa0400100 passed
rotate 8 0xa0400100 passed
rotate 12 0xa0400100 passed
rotate 16 0xa0400100 passed
rotate 20 0xa0400100 passed
rotate 24 0xa0400100 passed
rotate 28 0xa0400100 passed
dram_addr_rot test completed.
=======start dram_com_addr_rot test=======
~rotate 0 0xa0400100 passed
~rotate 4 0xa0400100 passed
~rotate 8 0xa0400100 passed
~rotate 12 0xa0400100 passed
~rotate 16 0xa0400100 passed
~rotate 20 0xa0400100 passed
~rotate 24 0xa0400100 passed
~rotate 28 0xa0400100 passed
dram_com_addr_rot test completed.
JSW 20141208:=======start dram_byte_access test=======
JSW 20141208:pattern0 0xa0400100 pass
JSW 20141208:pattern1 0xa0400100 pass
JSW 20141208:pattern2 0xa0400100 pass
JSW 20141208:pattern3 0xa0400100 pass
JSW 20141208:pattern4 0xa0400100 pass
JSW 20141208:pattern5 0xa0400100 pass
dram_byte_access test completed.
=======start dram_half_word_access test=======
pattern0 0xa0400100 pass
pattern1 0xa0400100 pass
pattern2 0xa0400100 pass
pattern3 0xa0400100 pass
pattern4 0xa0400100 pass
pattern5 0xa0400100 pass
dram_half_word_access test completed.
=======start dram_walking_of_1 test=======
pattern0 0xa0400100 passed
pattern1 0xa0400100 passed
pattern2 0xa0400100 passed
pattern3 0xa0400100 passed
pattern4 0xa0400100 passed
pattern5 0xa0400100 passed
pattern6 0xa0400100 passed
pattern7 0xa0400100 passed
pattern8 0xa0400100 passed
pattern9 0xa0400100 passed
pattern10 0xa0400100 passed
pattern11 0xa0400100 passed
pattern12 0xa0400100 passed
pattern13 0xa0400100 passed
pattern14 0xa0400100 passed
pattern15 0xa0400100 passed
pattern16 0xa0400100 passed
pattern17 0xa0400100 passed
pattern18 0xa0400100 passed
pattern19 0xa0400100 passed
pattern20 0xa0400100 passed
pattern21 0xa0400100 passed
pattern22 0xa0400100 passed
pattern23 0xa0400100 passed
pattern24 0xa0400100 passed
pattern25 0xa0400100 passed
pattern26 0xa0400100 passed
pattern27 0xa0400100 passed
pattern28 0xa0400100 passed
pattern29 0xa0400100 passed
pattern30 0xa0400100 passed
pattern31 0xa0400100 passed
dram_walking_of_1 test completed.
=======start dram_walking_of_0 test=======
pattern0 0xa0400100 passed
pattern1 0xa0400100 passed
pattern2 0xa0400100 passed
pattern3 0xa0400100 passed
pattern4 0xa0400100 passed
pattern5 0xa0400100 passed
pattern6 0xa0400100 passed
pattern7 0xa0400100 passed
pattern8 0xa0400100 passed
pattern9 0xa0400100 passed
pattern10 0xa0400100 passed
pattern11 0xa0400100 passed
pattern12 0xa0400100 passed
pattern13 0xa0400100 passed
pattern14 0xa0400100 passed
pattern15 0xa0400100 passed
pattern16 0xa0400100 passed
pattern17 0xa0400100 passed
pattern18 0xa0400100 passed
pattern19 0xa0400100 passed
pattern20 0xa0400100 passed
pattern21 0xa0400100 passed
pattern22 0xa0400100 passed
pattern23 0xa0400100 passed
pattern24 0xa0400100 passed
pattern25 0xa0400100 passed
pattern26 0xa0400100 passed
pattern27 0xa0400100 passed
pattern28 0xa0400100 passed
pattern29 0xa0400100 passed
pattern30 0xa0400100 passed
pattern31 0xa0400100 passed
dram_walking_of_0 test completed.
=======start memcpy_test test=======

memcpy 0 0xa0400100 passed

memcpy 4 0xa0400100 passed

memcpy 8 0xa0400100 passed

memcpy 12 0xa0400100 passed

memcpy 16 0xa0400100 passed

memcpy 20 0xa0400100 passed

memcpy 24 0xa0400100 passed

memcpy 28 0xa0400100 passed
memcpy_test test completed.

init ddr ok
rom_progress: 0x0800006d
load_data_from_storage(260): 0xa0500000, 0x00000000, 0xbfd16f4c
load_data_from_spi_nand_flash(70): 0xa0500000, 0x00000000, 0xbfe03e30
ECC_DECODE_FAIL,ecc_start_addr = 0xa0500000
check_image_header(72): h(ff,ff,ff,ff), s(62,6f,6f,74)
img sig err
rom_progress: 0x0d00006d
load_data_from_storage(260): 0xa0500000, 0x00000080, 0xbfd16f4c
load_data_from_spi_nand_flash(70): 0xa0500000, 0x00000080, 0xbfe03e30

ECC_DECODE_FAIL,ecc_start_addr = 0xa0500000
check_image_header(72): h(f2,93,21,a2), s(62,6f,6f,74)
img sig err
rom_progress: 0x0d00006d
load_data_from_storage(260): 0xa0500000, 0x00000100, 0xbfd16f4c
load_data_from_spi_nand_flash(70): 0xa0500000, 0x00000100, 0xbfe03e30
ECC_DECODE_FAIL,ecc_start_addr = 0xa0500000
check_image_header(72): h(ff,ff,ff,ff), s(62,6f,6f,74)
img sig err
rom_progress: 0x0d00006d
load_data_from_storage(260): 0xa0500000, 0x00000180, 0xbfd16f4c
load_data_from_spi_nand_flash(70): 0xa0500000, 0x00000180, 0xbfe03e30
check_image_header(72): h(2b,13,72,18), s(62,6f,6f,74)
img sig err
rom_progress: 0x0d00006d
load img fail(0xffffffff)
rom_progress: 0x1100006d

Now the password for the admin is remembered only until the gateway is rebooted. It needs to be maintained even when the power is turned off. Otherwise, it becomes possible for us to control the gateway only by connecting to a local network or Wi-Fi.

Hi guys,
I've followed the UART downgrade procedure, it went all good (I think). I've used rtkboot_115200.bin and mgl03_1.4.7_0160_mod20210309.uart files.
After the factory reset step I can see the hub entering in pairing mode, the Mi Home mobile app sees the gateway, I'm stating the enroll process in the app but the hub doesn't connect to Wi-Fi.
What I'm doing wrong?
Any way to set directly Wi-Fi credentials using the serial/UART console?

I soldered UART (GND, TX and RX) according to the instruction. Then I used Tera Term with the macro. However, I can't go after wait 'uart ok' instruction. I also used backup pins to solder cables again. I double checked that I use 3,3V and no VCC. I double checked that I cross connect (TX with RX and RX with TX). I used 2 UART adapters - same results. I switched to Mac and followed linux commands to stack at "Connecting to $tty_dev\n".
All that suggests I have issue with connecting to UART - so very initial state. Do you have any suggestion what else should I check? Maybe there is some video I can follow to find out where I make mistake?

Hi , sorry I’m not used with UART usb stick. Could someone help me to choose on AliExpress a good one for soldering my gateway 3 ? Thanks a lot

cann't find mgl03_xxxxx.uart file from firmware folder of the Hyperlink：https://github.com/zvldz/mgl03_fw/tree/main/firmware

After downgrading to 1.4.6_0012 the homekitserver is unable to run.
Is there any workaround? Thanks!

homekitserver

Default [com.apple.mfi.HomeKit.Platform:KeyValueStore] HAPPlatformKeyValueStoreCreate maxBytes 32

Default [com.apple.mfi.HomeKit.Platform:KeyValueStore] HAPPlatformKeyValueLoadFromFlash success.
Default [com.apple.mfi.HomeKit.Platform:AccessorySetup] Storage configuration: accessorySetup = 12
Default [com.apple.mfi.HomeKit.Platform:AccessorySetup] Using display: false / Programmable NFC: false
Default [com.apple.mfi.HomeKit.Platform:AccessorySetup] MTD accessory load all info ok
Default [com.apple.mfi.HomeKit.Platform:TCPStreamManager] Storage configuration: tcpStreamManager = 60
Default [com.apple.mfi.HomeKit.Platform:TCPStreamManager] Storage configuration: maxTCPStreams = 17
Default [com.apple.mfi.HomeKit.Platform:TCPStreamManager] Storage configuration: tcpStreams = 408
Default [com.apple.mfi.HomeKit.Platform:ServiceDiscovery] Storage configuration: serviceDiscovery = 552
Default [com.apple.mfi.HomeKit.Platform:WiFiManager] Storage configuration: wiFiManager = 16
Default [com.apple.mfi.HomeKit.Platform:SoftwareAccessPoint] Storage configuration: softwareAccessPoint = 20
Default [com.apple.mfi.HomeKit.Platform:MFiHWAuth] Storage configuration: mfiHWAuth = 8
Default [com.apple.mfi.HomeKit.Platform:MFiTokenAuth] HAPPlatformProvisionValueStoreCreate maxBytes 2
Default [com.apple.mfi.HomeKit.Platform:MFiTokenAuth] HAPPlatformProvisionValueLoadFromFlash success.
Default [com.apple.mfi.HomeKit.Platform:RunLoop] Storage configuration: runLoop = 320
Default [com.apple.mfi.HomeKit.Platform:RunLoop] Storage configuration: fileHandle = 28
Default [com.apple.mfi.HomeKit.Platform:RunLoop] Storage configuration: timer = 24
Default [com.apple.mfi.HomeKit.Platform:MFiTokenAuth] HAPPlatformMFiTokenAuthIsProvisioned [0]
Default [com.apple.mfi.HomeKit.Core:AccessoryServer] Version information:
libhap: /MIPS/GCC/mipsel-multilib-linux-gnu/

• Version: 2.0.1 (16A75) - compatibility version 5
  Using platform: WACIO
• Version: 2.0.1 (16A75) - compatibility version 5
  Default [com.apple.mfi.HomeKit.Core:AccessoryServer] Storage configuration: server = 1880
  Info [com.apple.mfi.HomeKit.Core:MFiHWAuth] Turning on Apple Authentication Coprocessor.
  Default [com.apple.mfi.HomeKit.Platform:Clock] Using 'clock_gettime' with 'CLOCK_MONOTONIC_RAW'.
  Info [com.apple.mfi.HomeKit.Core:MFiHWAuth] Apple Authentication Coprocessor information:
• Device Version: 3.0 (0x07)
• Firmware Version: 1
• Authentication Protocol Version: 3.0
  Default [com.apple.mfi.HomeKit.Core:IPAccessoryServer] Storage configuration: ipAccessoryServerStorage = 40
  Default [com.apple.mfi.HomeKit.Core:IPAccessoryServer] Storage configuration: numSessions = 17
  Default [com.apple.mfi.HomeKit.Core:IPAccessoryServer] Storage configuration: sessions = 14416
  Default [com.apple.mfi.HomeKit.Core:IPAccessoryServer] Storage configuration: sessions[0...16].inboundBuffer.numBytes = 32768
  Default [com.apple.mfi.HomeKit.Core:IPAccessoryServer] Storage configuration: sessions[0...16].outboundBuffer.numBytes = 32768
  Default [com.apple.mfi.HomeKit.Core:IPAccessoryServer] Storage configuration: sessions[0...16].numEventNotifications = 320
  Default [com.apple.mfi.HomeKit.Core:IPAccessoryServer] Storage configuration: sessions[0...16].eventNotifications = 7680
  Default [com.apple.mfi.HomeKit.Core:IPAccessoryServer] Storage configuration: numReadContexts = 320
  Default [com.apple.mfi.HomeKit.Core:IPAccessoryServer] Storage configuration: readContexts = 15360
  Default [com.apple.mfi.HomeKit.Core:IPAccessoryServer] Storage configuration: numWriteContexts = 320
  Default [com.apple.mfi.HomeKit.Core:IPAccessoryServer] Storage configuration: writeContexts = 20480
  Default [com.apple.mfi.HomeKit.Core:IPAccessoryServer] Storage configuration: scratchBuffer.numBytes = 32768
  Info AppCreate
  /data/conf/wpa_client.conf does not exist.
  Info AppCreate: homekitserver version 1.1.4
  Info AppCreate: miio_agent_socket_init succ
  Info register_agent_method: {"method":"bind","address":8}
  Info miio_agent_socket_callback: [36] {"id":123,"result":["OK"],"_from":2}
  Info ParseJsonContent: Result: OK. id=123
  Info RegisterAndGetDeviceList:[66]{"id":123, "_to":2, "method":"local.reg_pid","params":{"pid":[ ]}}
  Info miio_agent_socket_callback: [32] {"id":124,"result":[],"_from":2}
  Info RegisterAndGetDeviceList:[62]{"id":124, "_to":2, "method":"local.get_dev_list","params":{}}
  Info miio_agent_socket_callback: [36] {"id":125,"result":["OK"],"_from":4}
  Info ParseJsonContent: Result: OK. id=125
  Info RegisterAndGetDeviceList:[268]{"id":125, "_to":4, "method":"local.reg_pid","params":{"pid":[41,62,586,805,65556,66631,42,64,450,43,63,451,386,98,354, 136,687,720,217,250,93,66641,356,610,714,66639,96,66642,357,609,66640,355,611,65843,66501, 65557,66630,66828,385,163,670,161,162,452,67858,67859]}}
  Info miio_agent_socket_callback: [102] {"id":126,"result":[{"did":"255227222","group_did":"","mac":"4cf8cdf3c773868","pid":65843}],"_from":4}
  Info miio_agent_socket_callback: [140] {"id":1804290175,"method":"local.add_dev","params":{"did":"255227222","group_did":"","mac":"4cf8cdf3c773868","pid":65843,"ttl":0},"_from":4}
  Info ParseJsonContent: Method: local.add_dev
  Info RegisterAndGetDeviceList:[62]{"id":126, "_to":4, "method":"local.get_dev_list","params":{}}
  Info GetSecuritySystemProperties: {"id":320, "_to":32, "method":"get_properties","params":[{"did":"317121624","piid":21,"siid":3}]}
  Info GetSecuritySystemProperties: {"id":321, "_to":32, "method":"get_properties","params":[{"did":"317121624","piid":1,"siid":3}]}
  Info [com.apple.mfi.HomeKit.Core:AccessoryServer] Accessory server starting.
  Info [com.apple.mfi.HomeKit.Core:AccessoryServer] Firmware version: 1.4.6
  Default [com.apple.mfi.HomeKit.Platform:KeyValueStore] HAPPlatformKeyValueStoreGet domain-key 90.10 found
  Error [com.apple.mfi.HomeKit.Core:AccessoryServer] [1.4.7 > 1.4.6] Firmware must not be downgraded! Not starting HAPAccessoryServer.
  Info [com.apple.mfi.HomeKit.Platform:RunLoop] Entering run loop.
  Fault precondition failed: server->primaryAccessory - HAPAccessoryServerUpdateSetupPayload

Hi,
where can I get data of connected bluetooth devices (e.g. Xiaomi Mi Flora)? On the old original firmware it was possible to get it with this command
killall silabs_ncp_bt; silabs_ncp_bt /dev/ttyS1 1
On new custom firmware I get nothing from ble devices.

Tried all 3 firm, both the 1-click script & manual way.

full.gbl always exist after reboot.

How to force flash of this file?

Home assistant will work with this firmware ?

Its a LUMI

LM16-IGW_V1.0.3

Добрый день!!!
Я новичок в этом деле. По незнанию купил Gateway 3 v1.4.6_0043 - ZNDMWG02LM (Telnet c паролем) . Хочу подключить выключатели Lonsonho. Как я понял - нужно понизить прошивку... С пайкой дружу. Интересует очередность действий: HassWP установил, UART имеется. Не совсем понимаю про telnet. Или для понижения прошивки не требуется распароливать telnet?
Заранее спасибо!!!

Can I flash that firmware via telnet by dd or something or only via UART? I have 1.6.5 so I have access to telnet but firmware has limitation such as mqtt on 127.0.0.1, don't want every time fix this.

Hi,

question - what is the best way if I want to modify scripts / configs inside the gateway?

just updated the firmware using mgl03_1.4.7_0115_mod20201222.uart,

trying to redirect miio_client to my private cloud to implement the MIIO protocol on my cloud, OpenMiHome

What I get is:

'/bin/daemon_miio.sh' Read-only file system

As I understand --host=<host> --port=<port> to my cloud endpoint should work!

Usage: miio_client
        [-D --daemonize]
        [-H --host=<host>] enture mutual exclusion with -C,you can only use -C or -H at the same time
        [-p --port=<port>]
        [-i --interval=<int> ms] set sync interval of _otc.info
        [-l --loglevel=<level>] set loglevel (0-4), less = more verbose
        [-L --logfile=file] output log into file instead of stdout
        [-s --logfile size] set log size n(1-1024) to limit logfile to nkB
        [-n --rpc num] set the max RPC session number(6-128) of miio_client processing
        [-d --datadir=<path>] set miio data dir path, ending with '/'
        [-e --enckey] key(s) are encrypted saved
        [-E --encdata] data communication are encrypted
        [-C --dcountry] set the country domain where the device locates in,ignore if it in China
        [-t --mjac-test] test mjac
        [-o --openfeatures] select the desired features
                            1. 'MSC' stands for security chip
                            2. 'FILE_STORE' represents the file system
        [-h --help]

Thank you!!

I have attempted flashing with various bootloaders, but no matter what approach I take, it gets stuck at "xmrx 80000000".

The dialog box that is supposed to show XMODEM activity never displays any progress. It seems to time out, and consequently, the window closes.

Below is my log:

`==MGL03 UART Recovery v231120_01==

Power ON Gateway NOW!<<

uart ok

strap pin:0x412b8ae2

enable spi-nand

ROM ver:v1.1, sig:455cc27, time:2016.01.04-18:42+0800, CPU(400 MHz), DDR2(533 MHz)

Enter ROM console

dbgmsg 3

dbg level: 0x00000003

ri 0 1 1

load efuse ok

rom_progress: 0x0200006d

0xb8000780: 0x00c78e0f

0xb8000784: 0x15408c2f

0xb8000788: 0x0000bfe0

0xb800078c: 0x00000000

0xb8000790: 0x00000000

0xb8000794: 0x00000000

0xb8000798: 0x00000000

0xb800079c: 0x00000000

0xb80007a0: 0x00000000

0xb80007a4: 0x00000000

0xb80007a8: 0x00000000

0xb80007ac: 0x00000000

0xb80007b0: 0x00000000

0xb80007b4: 0x00000000

0xb80007b8: 0x00000000

0xb80007bc: 0x00000000

0xb80007c0: 0x00000000

0xb80007c4: 0x00000000

0xb80007c8: 0x00000000

0xb80007cc: 0x00000000

0xb80007d0: 0x00000000

0xb80007d4: 0x00000000

0xb80007d8: 0x00000000

0xb80007dc: 0x00000000

0xb80007e0: 0x00000000

0xb80007e4: 0x00000000

0xb80007e8: 0x00000000

0xb80007ec: 0x00000000

0xb80007f0: 0x00000102

0xb80007f4: 0x2c6f3e13

0xb80007f8: 0x00000005

0xb80007fc: 0x00000001

load_efuse_data(361): loc:0x00000200, offset:0x00000040, word_enb:0x0000000e

loc:0x00000200, ctrl:0x000000c7

loc:0x00000200, ctrl2:0x00000000

0x200 c7 00 00 00 00 00 00 00

load_efuse_data(361): loc:0x00000208, offset:0x00000041, word_enb:0x0000000c

loc:0x00000208, exec_from_sram_addr:0xbfe01540

0x208 40 15 e0 bf 00 00 00 00

load_efuse_data(353): read eFuse done 0x00b bytes

ctrl: 0x000000c7

ctrl2: 0x00000000

exec_from_sram_addr: 0xbfe01540

boot_addr: 0x00000000

img_offset: 0x00000000

init_dram_val: 0x00000000

heap_start_addr: 0x00000000

heap_len: 0x00000000

erase_start_addr: 0x00000000

rom_progress: 0x0400006d

dram_init.c : ss_init_rxi310()

dram_init.c : ms_ctrl_0_map=0xb8142000

ss_init_rxi310(1902):bond:0x0000000a

dram_init_clk_frequency ,ddr_freq=1066 (Mbps), 533 (MHZ)

mck_ck = 0, 1084

JSW : dram_init_rxi310 ,dev_map=0xb8142000

JSW : dram_init_rxi310 ,dram_info=0x9fe03dd8

JSW : dram_init_rxi310 001

dfi_rate=2,dram_period=3752

JSW : dram_init_rxi310 002

SDR D1 dram_info-> dev-> device_type=2 ,cr_twr=3

DDR2 dram_info-> dev-> device_type=2

DDR2 dram_info-> mode_reg-> bst_len=0

SDR dq_width=2

SDR page=3

SDR dram_info-> dev-> bank =1

cr_bst_len =0

SDR dfi_rate=2

SDR dq_width=2

ddr_type =2

SDR cas_rd /(dfi_rate)=3

SDR cas_wr /(dfi_rate) =3

SDR dev_map-> dcr =0x00000222

SDR dev_map-> iocr=0x00204000

dev_map-> emr1=0x00000006

dev_map-> mr=0x00000672

SDR dev_map-> drr=0x0912be1c

SDR dev_map-> tpr0=0x000066c4

SDR dev_map-> tpr1=0x002a9104

SDR dev_map-> tpr2=0x00000042

DRAM init disable

DRAM init enable

DRAM init is done , jump to DRAM

SDR init done , dev_map=0xb8142000

Enter dram_auto_size_detect_rxi310, page_size = 3, bank_size = 1

DDR2 dram_info-> mode_reg-> bst_len=0

Detect page_size = 2KB (3)

Detect bank_size = 4 banks(0x00000001)

Detect dram size = 64MB (0x04000000)

dram_init.c : dram_calibration_turn_on_odt.

Perform sample dram testing

=======start dram_addr_rot test=======

rotate 0 0xa0400100 passed

rotate 4 0xa0400100 passed

rotate 8 0xa0400100 passed

rotate 12 0xa0400100 passed

rotate 16 0xa0400100 passed

rotate 20 0xa0400100 passed

rotate 24 0xa0400100 passed

rotate 28 0xa0400100 passed

dram_addr_rot test completed.

=======start dram_com_addr_rot test=======

~rotate 0 0xa0400100 passed

~rotate 4 0xa0400100 passed

~rotate 8 0xa0400100 passed

~rotate 12 0xa0400100 passed

~rotate 16 0xa0400100 passed

~rotate 20 0xa0400100 passed

~rotate 24 0xa0400100 passed

~rotate 28 0xa0400100 passed

dram_com_addr_rot test completed.

JSW 20141208:=======start dram_byte_access test=======

JSW 20141208:pattern0 0xa0400100 pass

JSW 20141208:pattern1 0xa0400100 pass

JSW 20141208:pattern2 0xa0400100 pass

JSW 20141208:pattern3 0xa0400100 pass

JSW 20141208:pattern4 0xa0400100 pass

JSW 20141208:pattern5 0xa0400100 pass

dram_byte_access test completed.

=======start dram_half_word_access test=======

pattern0 0xa0400100 pass

pattern1 0xa0400100 pass

pattern2 0xa0400100 pass

pattern3 0xa0400100 pass

pattern4 0xa0400100 pass

pattern5 0xa0400100 pass

dram_half_word_access test completed.

=======start dram_walking_of_1 test=======

pattern0 0xa0400100 passed

pattern1 0xa0400100 passed

pattern2 0xa0400100 passed

pattern3 0xa0400100 passed

pattern4 0xa0400100 passed

pattern5 0xa0400100 passed

pattern6 0xa0400100 passed

pattern7 0xa0400100 passed

pattern8 0xa0400100 passed

pattern9 0xa0400100 passed

pattern10 0xa0400100 passed

pattern11 0xa0400100 passed

pattern12 0xa0400100 passed

pattern13 0xa0400100 passed

pattern14 0xa0400100 passed

pattern15 0xa0400100 passed

pattern16 0xa0400100 passed

pattern17 0xa0400100 passed

pattern18 0xa0400100 passed

pattern19 0xa0400100 passed

pattern20 0xa0400100 passed

pattern21 0xa0400100 passed

pattern22 0xa0400100 passed

pattern23 0xa0400100 passed

pattern24 0xa0400100 passed

pattern25 0xa0400100 passed

pattern26 0xa0400100 passed

pattern27 0xa0400100 passed

pattern28 0xa0400100 passed

pattern29 0xa0400100 passed

pattern30 0xa0400100 passed

pattern31 0xa0400100 passed

dram_walking_of_1 test completed.

=======start dram_walking_of_0 test=======

pattern0 0xa0400100 passed

pattern1 0xa0400100 passed

pattern2 0xa0400100 passed

pattern3 0xa0400100 passed

pattern4 0xa0400100 passed

pattern5 0xa0400100 passed

pattern6 0xa0400100 passed

pattern7 0xa0400100 passed

pattern8 0xa0400100 passed

pattern9 0xa0400100 passed

pattern10 0xa0400100 passed

pattern11 0xa0400100 passed

pattern12 0xa0400100 passed

pattern13 0xa0400100 passed

pattern14 0xa0400100 passed

pattern15 0xa0400100 passed

pattern16 0xa0400100 passed

pattern17 0xa0400100 passed

pattern18 0xa0400100 passed

pattern19 0xa0400100 passed

pattern20 0xa0400100 passed

pattern21 0xa0400100 passed

pattern22 0xa0400100 passed

pattern23 0xa0400100 passed

pattern24 0xa0400100 passed

pattern25 0xa0400100 passed

pattern26 0xa0400100 passed

pattern27 0xa0400100 passed

pattern28 0xa0400100 passed

pattern29 0xa0400100 passed

pattern30 0xa0400100 passed

pattern31 0xa0400100 passed

dram_walking_of_0 test completed.

=======start memcpy_test test=======

memcpy 0 0xa0400100 passed

memcpy 4 0xa0400100 passed

memcpy 8 0xa0400100 passed

memcpy 12 0xa0400100 passed

memcpy 16 0xa0400100 passed

memcpy 20 0xa0400100 passed

memcpy 24 0xa0400100 passed

memcpy 28 0xa0400100 passed

memcpy_test test completed.

init ddr ok

rom_progress: 0x0800006d

xmrx 80000000
`

Another peculiar issue I've noticed is that the bootloader binary file I've been using is getting rewritten, and its size drops to 0 KB.

I´ve already tried inverting the TX/RX cable, using another USB port, another USB power adaptor and nothing works.

Can someone plese tell me what can I do?

Gateway flash complete, device is rebooting now!

If you like my work please consider small donation :)
Open url https://paypal.me/serrj (y/N): y
Ошибка сегментирования

And when i have press "Next" button follow message from browser

Access Denied
You don't have permission to access "http://www.paypal.com/signin?" on this server.

Reference #18.1dcf2d8b.1606502352.1a8b827

Hi,
when I choose the firmware file "mgl03_1.4.7_0065_mod20201116.uart" I get an error message "Wrong firmware file header!".

Best regards
Lars