Downgrade firmware instruction #87
Comments
|
Thanks for testing 😝 |
|
buy new hub till they have factory firmware 1.4.5/1.4.6 (expect 1.4.7 soon) OR solder uart, boot to bootloader and fix boot_info partition so it boots using older firmware slot. |
|
@rezmus
|
|
device has 2 slots for kernel/rootfs. this method works if you did update to firmware 1.4.7 only once, so you still have firmware 1.4.4-1.4.6 in 2nd slot. if you did update to 1.4.7 twice or more (for example 1.4.7_0063 and then 1.4.7_0065) this method can't be used. you will have to solder ethernet and recover via tftp. once you boot to bootloader you have to modify boot_info to make device boot from the other slot (firmware 1.4.4-1.4.6). note: use all bootloader commands in the same (lower/upper)case they are bellow. example output XX XX is boot_info checksum and YY YY YY YY is slot setup. slot setup will be 00 00 00 00 which means 1st slot is used or 01 01 01 01 which means 2nd slot is used. your goal is to change it to opposite and fix boot_info checksum. if you change 00 00 00 00 to 01 01 01 01 you have to subtract 2 (-2) from each checksum byte. if you change 01 01 01 01 to 00 00 00 00 you have to add 2 (+2) to each checksum byte. for example we had XX XX YY YY YY YY = 7a 25 00 00 00 00. we need to make it 78 23 01 01 01 01. where XX XX YY YY YY YY is value we want to have (that we calculated in previous step). now we can display boot_info again and check if it looks like we want. if everything is OK we can save it to nand. after reboot it should boot from the other slot (older firmware). note: ALWAYS keep all uart logs and/or backups! if your boot_info partition looks like this A0A00000: 7c 91 00 00 XX XX YY YY YY YY 00 00 00 00 00 00 it got wiped during boot (can happen if you short tp16/tp13 in wrong moment). you need to recreate it based on info from logs/backups or headers of rootfs partitions. in case of such problem tag me in this thread. |
|
Works only if the previous firmware was with an open Telnet. |
AlexxIT
changed the title
|
for global hub ZNDMWG02LM with firmware 1.4.6_0043 we should be able to open telnet using similar method (uart + boot to bootloader). if somebody wants to try tag me in this thread. |
|
Hi rezmus: With your method, I successfully downgrade to the old firmware. So it is important to keep the logs to know the sum and size of kernel and rootfs. |
|
there is no mistake there, but indeed boot_info can be wiped if you short tp16/gnd in wrong moment, because it's being read/write during boot (to mark failed attempts). i entered bootloader several times without wipe, but saw similar cases before. if you have boot logs or backup you can recreate boot_info. you can also restore it by reading kernel/rootfs header of both slots. i have checksum/size of each firmware. |
|
I mean that it is very easy to get the wrong boot_info if short tp16/gnd in the wrong moment. |
|
some ppl with wiped boot_info had also broken rootfs/kernel partitions. some had no backups or uart logs so it's more tricky to restore it. you have to read partition header to check which fw version is there. at this point i think it's best to just write here in case of any problems with downgrade. |
|
After several days' study. Here is some information I can share. I can transmit kerenl and rootfs to DDR RAM by xmodem and write kernel or rootfs in DDR to SPI NAND After flash kernel and rootfs in slot 0, slot 1, I rewrite the boot_info and flash to MTD1. What is next? |
|
By the way, if you are hardware engineer or magic GOD and have ethernet board for xaiomi gateway 3, you can use Ethernet and tftp to transmit firmwares. Unfortunately most users like poor me don’t have it. The Xmodem is only way to transmit firmwares. |
|
@tsunglung please describe xmodem method. some users cut utp cable and solder to board for tftp (probably way faster than xmodem), but i never did that so can't give you much details. some info about custom squashfs |
|
@rezmus I saw your info about custom squashfs. It helps a lot. Thanks. I tried to create a small rootfs yesterday but failed. I still try to find out why. |
here you go, young Sherlock ) https://pasteboard.co/JyVxUOI.jpg |
Great. |
|
@tsunglung Ethernet also works in stock firmware if you solder it :) |
<RealTek>xmrx 80000000 (start address of RAM) |
|
xmodem is slow. Not good to transmit firmware. |
enough to recover bootloader and boot_info partitions |
|
agree. |
|
boot up logs.
use telnet to login.
Finally, my bricked gateway3 becomes alive after re-burn the firmware via stupid and slow xmodem. |
|
Hope there could be easyway to flash the firmware, i was not able to buy new gatway with old firmware. |
|
Just received the new ZNDMWG03LM with factory firmware v1.4.6_0043 ( |
|
does this open a way to support 1.4.7_0065 firmware? |
@rezmus |
|
@rezmus |
|
use @AlexxIT integration or miio command to start telnet service, then login with password you decoded. |
|
@rezmus, hello, can you help me, please? I've saved 2 'good' reboots: 1 good UART log2 good UART logBoot process is failing now: bad UART logI have no idea how to repair boot_info |
|
Hello, @rezmus Is the "ZNDMWG02LM with firmware 1.4.6_0043" contains telnet? I am not able to connect to the Gateway. No promt only a message box with a "connection refused" error message. Is the telnet disabled by default? |
|
Telnet disabled by default. Setup my component, it will enable telnet |
|
@thx AlexxIT |
|
Do you get telnet password? |
Hi @rezmus, |
|
No. I succesfully dumped the boot info. But I got an error when I pasted into the "Factory extractor" is says: "You need to enter correct data! (lines)" I pasted this: |
|
@OrgoneBlaster you need to dump factory partition (not boot_info), then use it to decode password. https://github.com/AlexxIT/XiaomiGateway3/wiki/Decode-Telnet-Password hold "u" during power on, then |
Thanks it worked. I mixed the partitons. |
|
Is it possible to read out the token from the ZNDMWG02LM version? |
|
I am having some issues with getting into the bootloader. I've soldered tx and rx (not sure if) and I am able to see the booting process from the board (however some characters are messed up, not sure if that means that my connection is not good enough). But I never reach the stage where I can see any input Realtek prompt. Any suggestions? |
Clean board with alcohol at soldering points |
|
Hello! Can you help me?) Power ON Gateway NOW! Booting... SPI Nand ID=00efaa21 Realtek RTL8197F boot code at 2019.11.25-17:17+0800 v3.4T-pre2.1 (993MHz) ---Ethernet init Okay! Transfer incomplete
At stage I am using Raspberry 3b+ with rasbian 10 and manual https://github.com/AlexxIT/XiaomiGateway3/wiki/Downgrade-Firmware can my gateway still be reanimated or is it a victim?) |
|
I found a solution! |
Hello.! I have an cp2102 module, but Idk how the module can be "3.3V mode"..! Do I need something to do to make it? If you can help me by just writing a few sentences, it would be very helpful.! |
|
@Hyoengju-Johannes-Lee usually there is a switch. You can always verify the voltage by using the voltmeter (uploading an image of your module might help as well) |
This product is what I have.! It seems that there is no switch and I have no voltmeter... 😞 |
I didn't used the power from the module. just used the rxd, txd and ground. I used the usb as power just like the guide. |
|
|
Okay.! Thank you so much.! For the people who would use CP2102, I make a comment on what I found too.! The RXD, TXD output is 3.3V, so you can just follow without "changing the mode." |
This is log output once power on device. Possible to recover? uart ok dram_init.c : ss_init_rxi310() dram_init.c : ms_ctrl_0_map=0xb8142000 dram_init_clk_frequency ,ddr_freq=1066 (Mbps), 533 (MHZ) JSW : dram_init_rxi310 ,dev_map=0xb8142000 JSW : dram_init_rxi310 ,dram_info=0x9fe03f20 JSW : dram_init_rxi310 001 dfi_rate=2,dram_period=3752 JSW : dram_init_rxi310 002 SDR D1 dram_info-> dev-> device_type=2 ,cr_twr=3 DDR2 dram_info-> dev-> device_type=2 DDR2 dram_info-> mode_reg-> bst_len=0 SDR dq_width=2 SDR page=3 SDR dram_info-> dev-> bank =1 cr_bst_len =0 SDR dfi_rate=2 SDR dq_width=2 ddr_type =2 SDR cas_rd /(dfi_rate)=3 SDR cas_wr /(dfi_rate) =3 SDR dev_map-> dcr =0x00000222 SDR dev_map-> iocr=0x00204000 dev_map-> emr1=0x00000006 dev_map-> mr=0x00000672 SDR dev_map-> drr=0x0912be1c SDR dev_map-> tpr0=0x000066c4 SDR dev_map-> tpr1=0x002a9104 SDR dev_map-> tpr2=0x00000042 DRAM init disable DRAM init enable DRAM init is done , jump to DRAM SDR init done , dev_map=0xb8142000 DDR2 dram_info-> mode_reg-> bst_len=0 Detect page_size = 3, not detected Detect bank_size = 2 , not detected Detect dram size >= 256MB dram_init.c : dram_calibration_turn_on_odt. Perform sample dram testing |
|
No longer relevant today |
Hi. You can help me? boot_info my aqara hub M1S have big size. How can I resize boot_info db a0000000 1e0 . <div id="r
A00000D0: 65 70 6F 2D 63 6F 6E 74 65 6E 74 2D 70 6A 61 78 epo-content-pjax A00000E0: 2D 63 6F 6E 74 61 69 6E 65 72 22 20 63 6C 61 73 -container" clas A00000F0: 73 3D 22 72 65 70 6F 73 69 74 6F 72 79 2D 63 6F s="repository-co A0000100: 6E 74 65 6E 74 20 22 20 3E 0A 0A 20 20 20 20 0A ntent " >.. . A0000110: 0A 0A 20 20 20 20 0A 20 20 20 20 20 20 0A 20 20 .. . . A0000120: 0A 20 20 0A 3C 64 69 76 3E 0A 20 20 0A 0A 0A 0A . . . .... A0000130: 20 20 20 20 3C 61 20 63 6C 61 73 73 3D 22 64 2D <a class="d- A0000140: 6E 6F 6E 65 20 6A 73 2D 70 65 72 6D 61 6C 69 6E none js-permalin A0000150: 6B 2D 73 68 6F 72 74 63 75 74 22 20 64 61 74 61 k-shortcut" data A0000160: 2D 68 6F 74 6B 65 79 3D 22 79 22 20 68 72 65 66 -hotkey="y" href A0000170: 3D 22 2F 6E 69 63 65 62 6F 79 67 69 74 68 75 62 ="/niceboygithub A0000180: 2F 41 71 61 72 61 4D 31 53 4D 32 66 77 2F 62 6C /AqaraM1SM2fw/bl A0000190: 6F 62 2F 33 30 37 38 31 61 39 30 63 30 39 61 64 ob/30781a90c09ad A00001A0: 62 33 38 30 37 62 38 30 61 65 35 34 33 36 35 62 b3807b80ae54365b A00001B0: 35 37 32 63 32 35 38 32 64 65 63 2F 72 61 77 2F 572c2582dec/raw/ A00001C0: 62 6F 6F 74 6C 6F 61 64 65 72 5F 31 2E 30 2E 30 bootloader_1.0.0 A00001D0: 5F 30 30 30 31 2F 62 6F 6F 74 6C 6F 61 64 5F 31 _0001/bootload_1 Now the hub is not loading for me. I see loop this information when loading hub: |
|
I have read the wiki documentation on downgrading, but can someone please provide a simplified guide or even a video tutorial? Many people would appreciate it. |
and others
By mistake, i upgrade the firmware to 1.4.7_0065 and the gatwway won't work with this integration aymore. Hope any solution with this issue in the further.
The text was updated successfully, but these errors were encountered: