Downgrading Firmware of Xiaomi Mijia Smart Multi-Mode Gateway (ZNDMWG03LM)

tomdu85 · November 13, 2020, 2:41pm

My first log was :

uart ok
strap pin:0x412b8ae2
enable spi-nand
ROM ver:v1.1, sig:455cc27, time:2016.01.04-18:42+0800, CPU(400 MHz), DDR2(533 MH                                                                                                                                                             z)
load efuse ok
init IP ok
rom_progress: 0x0600006d
load_data_from_storage(260): 0xbfe01540, 0x00000000, 0xbfd16f44
load_data_from_spi_nand_flash(70): 0xbfe01540, 0x00000000, 0xbfe03e18
check_image_header(72): h(69,72,61,6d), s(69,72,61,6d)
img sig ok
rom_progress: 0x0c00006d
load_data_from_spi_nand_flash(81) 0x00000004 0x000024ba
load_data_from_spi_nand_flash(86): 0xbfe01d40, 0x00000001, 0xbfe03e18
load_data_from_spi_nand_flash(86): 0xbfe02540, 0x00000002, 0xbfe03e18
load_data_from_spi_nand_flash(86): 0xbfe02d40, 0x00000003, 0xbfe03e18
load_data_from_spi_nand_flash(86): 0xbfe03540, 0x00000004, 0xbfe03e18
load_data_from_spi_nand_flash(90) read done (size:9402)
chksum ok
rom_progress: 0x0e00006d
load img ok
rom_progress: 0x1000006d
jump 0xbfe01550

Booting...
SPI NAND clock not enable

SPI Nand ID=00efaa21
SPI Nand die chipsize=0x08000000 byte
SPI Nand dienum=1,
SPI Nand blocksize=0x00020000 byte,
SPI Nand pagesize=0x00000800 byte,
SPI Nand oobsize=0x00000040 byte,
[rtkn_scan_bbt, line 1812], RBA=51, this->RBA_PERCENT = 5,block_v2r_num=1024
[rtkn_scan_bbt, line 1822] block_v2r_num 00000400
[rtk_scan_v2r_bbt]:678,RBA=00000033,2=00000400,
[rtk_scan_v2r_bbt]:684,block_v2r_num=000003cd
INFO: Stored BBT in Die 0: block=8 , block_status_p1=0x000000bb
load bbt v2r table:0 page:512
[rtk_scan_v2r_bbt] have created v2r bbt table:0 on block 8, just loads it !!
check v2r bbt table:0 OK
[rtk_nand_scan_bbt, line 393] mem_page_num=1 bbt_page 704
INFO: Stored BBT in Die 0: block=11 , block_status_p1=0x000000bb
load bbt table:0 page:704
[rtk_nand_scan_bbt] have created bbt table:0 on block 11, just loads it !!
check bbt table:0 OK
[dump_BBT] Nand BBT Content
[0] (00000000, 00000014, 00000000, 000003ff)
[1] (00000000, 000000f7, 00000000, 000003fe)
[2] (00000000, 000000fd, 00000000, 000003fd)
[3] (00000000, 00000019, 00000000, 000003fc)
[4] (00000000, 0000001b, 00000000, 000003fb)
=>CPU Wake-up interrupt happen! GISR=89000084

Realtek RTL8197F boot code at 2019.11.25-17:17+0800 v3.4T-pre2.1 (993MHz)
-- version: 1.0.2.005 --
Info: Load boot_info success!
=== bootloader for mijia_gw ===
boot_info: ver:0
kernel: newest:1, curr:1
rootfs: newest:1, curr:1
kernel[0]: sum:0xc8cf, size:2157572, fail:3
      [1]: sum:0xcb43, size:2157572, fail:3
rootfs[0]: sum:0x62c6, size:8552452, fail:0
      [1]: sum:0x742c, size:10108932, fail:0
root_sum_check: off
watchdog_time: 0
boot_version: 1.0.2.005
priv mode
Info: kernel 1 is invalid
Info: kernel 0 is invalid
Warn: all kernels are invalid !

<RealTek>NANDR 0x500000 0xa0a00000 96
Read NAND Flash from 0x00500000 to 0xA0A00000 with 0x00000096 bytes ?
(Y)es , (N)o ? --> y
Read NAND Flash Successed!
<RealTek>db 0xa0a00000 96
 [Addr]   .0 .1 .2 .3 .4 .5 .6 .7 .8 .9 .A .B .C .D .E .F
A0A00000: 68 73 71 73 37 0a 00 00 00 82 7d 82 00 00 02 00     hsqs7.....}.....
A0A00010: 35 00 00 00 04 00 11 00 e0 00 01 00 04 00 00 00     5...............
A0A00020: b8 04 f6 51 00 00 00 00 9a 7e 82 00 00 00 00 00     ...Q.....~......
A0A00030: 92 7e 82 00 00 00 00 00 ff ff ff ff ff ff ff ff     .~..............
A0A00040: 30 b4 81 00 00 00 00 00 04 08 82 00 00 00 00 00     0...............
A0A00050: ea 68 82 00 00 00 00 00 74 7e 82 00 00 00 00 00     .h......t~......
<RealTek>NANDR 0x2100000 0xa0a00000 96
Unknown command !
<RealTek>NANDR 0x2100000 0xa0a00000 96
Read NAND Flash from 0x02100000 to 0xA0A00000 with 0x00000096 bytes ?
(Y)es , (N)o ? --> y
Read NAND Flash Successed!
<RealTek>db 0xa0a00000 96
 [Addr]   .0 .1 .2 .3 .4 .5 .6 .7 .8 .9 .A .B .C .D .E .F
A0A00000: 68 73 71 73 42 0a 00 00 00 9a 3d 82 00 00 02 00     hsqsB.....=.....
A0A00010: 37 00 00 00 04 00 11 00 e0 00 01 00 04 00 00 00     7...............
A0A00020: 79 07 8e 52 00 00 00 00 3e 35 9a 00 00 00 00 00     y..R....>5......
A0A00030: 36 35 9a 00 00 00 00 00 ff ff ff ff ff ff ff ff     65..............
A0A00040: 5c 69 99 00 00 00 00 00 6c be 99 00 00 00 00 00     \i......l.......
A0A00050: 56 1f 9a 00 00 00 00 00 18 35 9a 00 00 00 00 00     V........5......
<RealTek>

rezmus · November 13, 2020, 2:51pm

this will fix boot_info

eb 0xa0a00000 7c 91 00 00 78 59 00 00 00 00 00 20 ec 04 c8 cf
eb 0xa0a00010 00 00 20 ec 04 cb 43 00 00 82 80 04 62 c6 00 00
eb 0xa0a00020 9a 40 04 74 2c 00 00 00 01 31 2e 30 2e 32 2e 30
eb 0xa0a00030 30 35 00 00 00 00 00
NANDW 0xa0000 0xa0a00000 55

however if both kernels got corrupted it won’t boot anyway. wait a few days, there will be some manual how to flash custom firmware using uart.

tomdu85 · November 13, 2020, 4:05pm

That’s a little bit better

Realtek RTL8197F boot code at 2019.11.25-17:17+0800 v3.4T-pre2.1 (993MHz)
-- version: 1.0.2.005 --
Info: Load boot_info success!
=== bootloader for mijia_gw ===
boot_info: ver:0
kernel: newest:0, curr:0
rootfs: newest:0, curr:0
kernel[0]: sum:0xc8cf, size:2157572, fail:1
      [1]: sum:0xcb43, size:2157572, fail:1
rootfs[0]: sum:0x62c6, size:8552452, fail:0
      [1]: sum:0x742c, size:10108932, fail:0
root_sum_check: off
watchdog_time: 0
boot_version: 1.0.2.005
priv mode
Info: loading kernel 0 ...  Done
Info: checking kernel 0 ... Fail
Info: loading kernel 1 ...  Done
Info: checking kernel 1 ... Fail
Warn: all kernels are invalid !
Info: save boot_info

---Ethernet init Okay!
<RealTek>j 80a00000
---Jump to address=80A00000

reboot.......
decompressing kernel:
Uncompressing Linux...LZMA: Decoding error = 1
done decompressing kernel.
start address: 0x8050ca80

After it freezing

I think I’m waiting for your custom firmware.

Thanks for thats !

MRJC · November 15, 2020, 5:11am

@rezmus Hello, I’m very lucky to meet you. I have the same problem。I’ve tried all of the above code, but still can’t start the gateway。I have been following you and hope you can share the solutions。

The first is the normal start-up

uart ok
strap pin:0x412b8ae2
enable spi-nand
ROM ver:v1.1, sig:455cc27, time:2016.01.04-18:42+0800, CPU(400 MHz), DDR2(533 MHz)
load efuse ok
init IP ok
rom_progress: 0x0600006d
load_data_from_storage(260): 0xbfe01540, 0x00000000, 0xbfd16f44 
load_data_from_spi_nand_flash(70): 0xbfe01540, 0x00000000, 0xbfe03e18 
check_image_header(72): h(69,72,61,6d), s(69,72,61,6d) 
img sig ok
rom_progress: 0x0c00006d
load_data_from_spi_nand_flash(81) 0x00000004 0x000024ba 
load_data_from_spi_nand_flash(86): 0xbfe01d40, 0x00000001, 0xbfe03e18 
load_data_from_spi_nand_flash(86): 0xbfe02540, 0x00000002, 0xbfe03e18 
load_data_from_spi_nand_flash(86): 0xbfe02d40, 0x00000003, 0xbfe03e18 
load_data_from_spi_nand_flash(86): 0xbfe03540, 0x00000004, 0xbfe03e18 
load_data_from_spi_nand_flash(90) read done (size:9402) 
chksum ok
rom_progress: 0x0e00006d
load img ok
rom_progress: 0x1000006d
jump 0xbfe01550

Booting...
SPI NAND clock not enable

SPI Nand ID=00efaa21
SPI Nand die chipsize=0x08000000 byte
SPI Nand dienum=1,
SPI Nand blocksize=0x00020000 byte,
SPI Nand pagesize=0x00000800 byte,
SPI Nand oobsize=0x00000040 byte,
[rtkn_scan_bbt, line 1812], RBA=51, this->RBA_PERCENT = 5,block_v2r_num=1024
[rtkn_scan_bbt, line 1822] block_v2r_num 00000400

[rtk_scan_v2r_bbt]:678,RBA=00000033,2=00000400,
[rtk_scan_v2r_bbt]:684,block_v2r_num=000003cd
INFO: Stored BBT in Die 0: block=8 , block_status_p1=0x000000bb
load bbt v2r table:0 page:512

[rtk_scan_v2r_bbt] have created v2r bbt table:0 on block 8, just loads it !!

check v2r bbt table:0 OK

[rtk_nand_scan_bbt, line 393] mem_page_num=1 bbt_page 704
INFO: Stored BBT in Die 0: block=11 , block_status_p1=0x000000bb
load bbt table:0 page:704

[rtk_nand_scan_bbt] have created bbt table:0 on block 11, just loads it !!

check bbt table:0 OK

[dump_BBT] Nand BBT Content
Congratulation!! No BBs in this Nand.
=>CPU Wake-up interrupt happen! GISR=89000084 
 
Realtek RTL8197F boot code at 2019.11.25-17:17+0800 v3.4T-pre2.1 (993MHz)
-- version: 1.0.2.005 --
Info: Load boot_info success!
=== bootloader for mijia_gw ===
boot_info: ver:0
kernel: newest:1, curr:1
rootfs: newest:1, curr:1
kernel[0]: sum:0xc8cf, size:2157572, fail:0
      [1]: sum:0xcb43, size:2157572, fail:0
rootfs[0]: sum:0x62c6, size:8552452, fail:0
      [1]: sum:0x742c, size:10108932, fail:0
root_sum_check: off
watchdog_time: 0
boot_version: 1.0.2.005
priv mode
Info: loading kernel 1 ...  
Done
Info: checking kernel 1 ... Success
Info: select rootfs 1
Info: booting...
Jump to image start=0x80a00000...
decompressing kernel:
Uncompressing Linux...
 done, booting the kernel.
done decompressing kernel.
start address: 0x8050ca80
[    0.000000] Linux version 3.10.90 (luobo@compilex64-ipg) (gcc version 4.9.4 20151028 (prerelease) (Realtek MSDK-4.9.4p1 Build 2648) ) #192 Wed Oct 21 12:02:24 CST 2020
[    0.000000] bootconsole [early0] enabled
[    0.000000] CPU revision is: 00019385 (MIPS 24Kc)
[    0.000000] Determined physical RAM map:
[    0.000000]  memory: 04000000 @ 00000000 (usable)
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x00000000-0x03ffffff]
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x00000000-0x03ffffff]
[    0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
[    0.000000] Built 1 zonelists in Zone order, mobility grouping off.  Total pages: 4088
[    0.000000] Kernel command line: root=/dev/mtdblock8 console=ttyS0,38400
[    0.000000] PID hash table entries: 256 (order: -4, 1024 bytes)
[    0.000000] Dentry cache hash table entries: 8192 (order: 1, 32768 bytes)
[    0.000000] Inode-cache hash table entries: 4096 (order: 0, 16384 bytes)
[    0.000000] Writing ErrCtl register=0005e995
[    0.000000] Readback ErrCtl register=0005e995
[    0.000000] Memory: 58208k/65536k available (5203k kernel code, 7328k reserved, 1003k data, 192k init, 0k highmem)
[    0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[    0.000000] NR_IRQS:192
[    0.000000] Realtek GPIO IRQ init
[    0.000000] Calibrating delay loop... 660.68 BogoMIPS (lpj=3303424)
[    0.070000] pid_max: default: 32768 minimum: 301
[    0.080000] Mount-cache hash table entries: 2048
[    0.090000] [rtl819x_gpio_pin_enable][277]: mask=0xf00 mux=0x0 mux_reg=0xb8000844 val=0x100, 			CNR_REG=0xffffffbf MUX_REG=0x100
[    0.100000] [rtl819x_gpio_direction_output][150]: set pin38 as output pin, default value=0, DIR_REG=0x40 DAT_REG=0x3000000
[    0.110000] [rtl819x_gpio_pin_enable][277]: mask=0xf0 mux=0x100 mux_reg=0xb8000844 val=0x10, 			CNR_REG=0xffffff3f MUX_REG=0x110
[    0.120000] [rtl819x_gpio_direction_output][150]: set pin39 as output pin, default value=0, DIR_REG=0xc0 DAT_REG=0x3000000
[    0.130000] [rtl819x_gpio_pin_enable][277]: mask=0xf000000 mux=0x0 mux_reg=0xb8000848 val=0x4000000, 			CNR_REG=0xfffffb3f MUX_REG=0x4000000
[    0.140000] [rtl819x_gpio_direction_output][150]: set pin42 as output pin, default value=0, DIR_REG=0x4c0 DAT_REG=0x3000000
[    0.150000] [rtl819x_gpio_pin_enable][277]: mask=0xf00000 mux=0x4000000 mux_reg=0xb8000848 val=0x400000, 			CNR_REG=0xfffff33f MUX_REG=0x4400000
[    0.160000] [rtl819x_gpio_direction_output][150]: set pin43 as output pin, default value=1, DIR_REG=0xcc0 DAT_REG=0x3000800
[    0.170000] [rtl819x_gpio_pin_enable][277]: mask=0xf0000 mux=0x4400000 mux_reg=0xb8000848 val=0x60000, 			CNR_REG=0xffffe33f MUX_REG=0x4460000
[    0.180000] [rtl819x_gpio_direction_output][150]: set pin44 as output pin, default value=1, DIR_REG=0x1cc0 DAT_REG=0x3001800
[    0.190000] [rtl819x_gpio_pin_enable][277]: mask=0xf000 mux=0x4460000 mux_reg=0xb8000848 val=0x6000, 			CNR_REG=0xffffc33f MUX_REG=0x4466000
[    0.200000] [rtl819x_gpio_direction_output][150]: set pin45 as output pin, default value=1, DIR_REG=0x3cc0 DAT_REG=0x3003800
[    0.210000] [rtl819x_gpio_pin_enable][277]: mask=0xf000000 mux=0x11111000 mux_reg=0xb8000820 val=0x6000000, 			CNR_REG=0xffff833f MUX_REG=0x16111000
[    0.220000] [rtl819x_gpio_direction_output][150]: set pin46 as output pin, default value=1, DIR_REG=0x7cc0 DAT_REG=0x3007800
[    0.230000] [rtl819x_gpio_pin_enable][277]: mask=0xf0000000 mux=0x16111000 mux_reg=0xb8000820 val=0x60000000, 			CNR_REG=0xffff033f MUX_REG=0x66111000
[    0.240000] [rtl819x_gpio_direction_output][150]: set pin47 as output pin, default value=0, DIR_REG=0xfcc0 DAT_REG=0x3007800
[    0.250000] [rtl819x_gpio_pin_enable][277]: mask=0xf00000 mux=0x66111000 mux_reg=0xb8000820 val=0x600000, 			CNR_REG=0xfffe033f MUX_REG=0x66611000
[    0.260000] [rtl819x_gpio_direction_output][150]: set pin48 as output pin, default value=1, DIR_REG=0x1fcc0 DAT_REG=0x3017800
[    0.270000] [rtl819x_gpio_pin_enable][277]: mask=0xf0000 mux=0x66611000 mux_reg=0xb8000820 val=0x70000, 			CNR_REG=0xfffc033f MUX_REG=0x66671000
[    0.280000] [rtl819x_gpio_direction_output][150]: set pin49 as output pin, default value=1, DIR_REG=0x3fcc0 DAT_REG=0x3037800
[    0.290000] [rtl819x_gpio_pin_enable][277]: mask=0xf000 mux=0x66671000 mux_reg=0xb8000820 val=0x7000, 			CNR_REG=0xfff8033f MUX_REG=0x66677000
[    0.300000] [rtl819x_gpio_direction_output][150]: set pin50 as output pin, default value=0, DIR_REG=0x7fcc0 DAT_REG=0x3037800
[    0.310000] [rtl819x_gpio_pin_enable][277]: mask=0xf0000000 mux=0x100000 mux_reg=0xb8000824 val=0x20000000, 			CNR_REG=0xfff0033f MUX_REG=0x20100000
[    0.320000] [rtl819x_gpio_direction_output][150]: set pin51 as output pin, default value=1, DIR_REG=0xffcc0 DAT_REG=0x30b7800
[    0.330000] [rtl819x_gpio_pin_enable][277]: mask=0xf000000 mux=0x20100000 mux_reg=0xb8000824 val=0x1000000, 			CNR_REG=0xffe0033f MUX_REG=0x21100000
[    0.340000] [rtl819x_gpio_direction_output][150]: set pin52 as output pin, default value=0, DIR_REG=0x1ffcc0 DAT_REG=0x30b7800
[    0.350000] [rtl819x_gpio_pin_enable][277]: mask=0xf00000 mux=0x21100000 mux_reg=0xb8000824 val=0x0, 			CNR_REG=0xffc0033f MUX_REG=0x21000000
[    0.360000] [rtl819x_gpio_direction_output][150]: set pin53 as output pin, default value=0, DIR_REG=0x3ffcc0 DAT_REG=0x30b7800
[    0.370000] [rtl819x_gpio_pin_enable][277]: mask=0xf000000 mux=0x33320000 mux_reg=0xb8000834 val=0x3000000, 			CNR_REG=0xff40033f MUX_REG=0x33320000
[    0.380000] [rtl819x_gpio_direction_output][150]: set pin55 as output pin, default value=0, DIR_REG=0xbffcc0 DAT_REG=0x30b7800
[    0.390000] NET: Registered protocol family 16
[    0.400000] <<<<<Register PCI Controller>>>>>
[    0.420000] Do MDIO_RESET
[    0.450000] 40MHz
[    0.810000] PCIE ->  Cannot LinkUP
[    0.820000] Realtek GPIO controller driver init
[    0.830000] INFO: initializing i2c devices ...
[    0.840000] INFO: registering sheipa spi device
[    0.860000] bio: create slab <bio-0> at 0
[    0.870000] SCSI subsystem initialized
[    0.880000] INFO: sheipa spi driver register
[    0.890000] INFO: sheipa spi probe
[    0.900000] cfg80211: Calling CRDA to update world regulatory domain
[    0.910000] Switching to clocksource MIPS
[    0.920000] NET: Registered protocol family 2
[    0.930000] TCP established hash table entries: 2048 (order: 0, 16384 bytes)
[    0.950000] TCP bind hash table entries: 2048 (order: -1, 8192 bytes)
[    0.970000] TCP: Hash tables configured (established 2048 bind 2048)
[    0.990000] TCP: reno registered
[    1.000000] UDP hash table entries: 1024 (order: 0, 16384 bytes)
[    1.020000] UDP-Lite hash table entries: 1024 (order: 0, 16384 bytes)
[    1.040000] NET: Registered protocol family 1
[    1.050000] RPC: Registered named UNIX socket transport module.
[    1.070000] RPC: Registered udp transport module.
[    1.080000] RPC: Registered tcp transport module.
[    1.100000] RPC: Registered tcp NFSv4.1 backchannel transport module.
[    1.130000] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    1.150000] NFS: Registering the id_resolver key type
[    1.160000] Key type id_resolver registered
[    1.180000] Key type id_legacy registered
[    1.190000] NTFS driver 2.1.30 [Flags: R/W DEBUG].
[    1.200000] msgmni has been set to 113
[    1.220000] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 254)
[    1.240000] io scheduler noop registered (default)
[    1.250000] pwm_probe
[    1.260000] add buzzer dev!!!!!!!!!!!!!!!!
[    1.380000] Serial: 8250/16550 driver, 3 ports, IRQ sharing disabled
[    1.400000] serial8250: ttyS0 at MMIO 0x18147000 (irq = 17) is a 16550A
[    1.420000] console [ttyS0] enabled, bootconsole disabled
[    1.420000] console [ttyS0] enabled, bootconsole disabled
[    1.460000] serial8250: ttyS1 at MMIO 0x18147400 (irq = 46) is a 16550A
[    1.480000] serial8250: ttyS2 at MMIO 0x18147800 (irq = 47) is a 16550A
[    1.500000] Realtek GPIO Driver for Flash Reload Default
[    1.510000] Load Kernel firmware information Driver
[    1.530000] id_chain value=efaa219f
[    1.540000] id_chain value=efaa219f
[    1.550000] NAND device: Manufacturer ID: 0xef, Chip ID: 0xaa (Unknown W25M01GV 1G SPI NAND), 128MiB, page size: 2048, OOB size: 64
[    1.590000] [rtkn_scan_bbt, line 1812], RBA=51, this->RBA_PERCENT = 5,block_v2r_num=1024
[    1.610000] [rtkn_scan_bbt, line 1822] block_v2r_num 400
[rtk_scan_v2r_bbt]:678,RBA=33,2=400,
[    1.640000] [rtk_scan_v2r_bbt]:684,block_v2r_num=3cd
[    1.660000] INFO: Stored BBT in Die 0: block=8 , block_status_p1=0xbb
[    1.680000] load bbt v2r table:0 page:512
[rtk_scan_v2r_bbt] have created v2r bbt table:0 on block 8, just loads it !!
check v2r bbt table:0 OK
[rtk_nand_scan_bbt, line 393] mem_page_num=1 bbt_page 704
[    1.740000] INFO: Stored BBT in Die 0: block=11 , block_status_p1=0xbb
[    1.760000] load bbt table:0 page:704
[rtk_nand_scan_bbt] have created bbt table:0 on block 11, just loads it !!
check bbt table:0 OK
[dump_BBT] Nand BBT Content
[    1.810000] Congratulation!! No BBs in this Nand.
[    1.820000] 11 rtkxxpart partitions found on MTD device rtk_nand
[    1.840000] Creating 11 MTD partitions on "rtk_nand":
[    1.870000] Realtek WLAN driver - version 1.7 (2015-10-30)(SVN:Unversioned directory)
[    1.890000] Adaptivity function - version 9.3.4
[    1.910000] Device Name = RTKWiFi0 
[    1.920000] VIF_NUM=9
[    1.920000] MACHAL_version_init
[    1.930000] RFE TYPE =0
[    1.940000] RFE TYPE =0
[    1.950000] RFE TYPE =0
[    1.960000] RFE TYPE =0
[    1.970000] RFE TYPE =0
[    1.980000] RFE TYPE =0
[    1.990000] RFE TYPE =0
[    2.000000] RFE TYPE =0
[    2.010000] RFE TYPE =0
[    2.010000] RFE TYPE =0
[    2.020000] RFE TYPE =0
[    2.030000] lumi_btn_probe reset btn=7
[    2.040000] [rtl819x_gpio_request][42]: pin7
[    2.050000] [rtl819x_gpio_pin_enable][277]: mask=0xf00000 mux=0x13000000 mux_reg=0xb8000800 val=0x600000, 			CNR_REG=0xffffff7f MUX_REG=0x13600000
[    2.090000] [rtl819x_gpio_direction_input][120]: set pin7 as input pin, DIR_REG=0xff000000
[    2.120000] rtl819x_gpio: GPIO7 requests IRQ79
[    2.130000] input: lumi_key as /devices/virtual/input/input0
[    2.150000] i2c /dev entries driver
[    2.160000] [rtl819x_gpio_request][42]: pin57
[    2.170000] [rtl819x_gpio_pin_enable][277]: mask=0xf0000 mux=0x33320000 mux_reg=0xb8000834 val=0x20000, 			CNR_REG=0xfd40033f MUX_REG=0x33320000
[    2.210000] [rtl819x_gpio_direction_output][150]: set pin57 as output pin, default value=1, DIR_REG=0x2bffcc0 DAT_REG=0x30b7800
[    2.250000] rtl819x_gpio: GPIO57 requests IRQ129
[    2.260000] [rtl819x_gpio_request][42]: pin56
[    2.270000] [rtl819x_gpio_pin_enable][277]: mask=0xf00000 mux=0x33320000 mux_reg=0xb8000834 val=0x300000, 			CNR_REG=0xfc40033f MUX_REG=0x33320000
[    2.310000] [rtl819x_gpio_direction_output][150]: set pin56 as output pin, default value=1, DIR_REG=0x3bffcc0 DAT_REG=0x30b7800
[    2.350000] rtl819x_gpio: GPIO56 requests IRQ128
[    2.360000] [rtl819x_gpio_request][42]: pin54
[    2.380000] [rtl819x_gpio_pin_enable][277]: mask=0xf0000000 mux=0x33320000 mux_reg=0xb8000834 val=0x30000000, 			CNR_REG=0xfc00033f MUX_REG=0x33320000
[    2.420000] [rtl819x_gpio_direction_output][150]: set pin54 as output pin, default value=0, DIR_REG=0x3fffcc0 DAT_REG=0x30b7800
[    2.450000] rtl819x_gpio: GPIO54 requests IRQ126
[    2.470000] TCP: cubic registered
[    2.480000] NET: Registered protocol family 10
[    2.490000] sit: IPv6 over IPv4 tunneling driver
[    2.510000] NET: Registered protocol family 17
[    2.520000] Key type dns_resolver registered
[    2.530000] 
[    2.530000] Probing RTL819X NIC-kenel stack size order[0]...
[    3.230000] eth0 added. vid=9 Member port 0x110...
[    3.250000] eth1 added. vid=8 Member port 0x0...
[    3.260000] Key type encrypted registered
[    3.290000] VFS: Mounted root (squashfs filesystem) readonly on device 31:8.
[    3.310000] Freeing unused kernel memory: 192K (80610000 - 80640000)

init started: BusyBox v1.22.1 (2020-06-22 16:58:24 CST)
[    4.390000] WlanSupportAbility = 0x3
[    4.400000] [ODM_software_init] 
[    4.400000] [97F] Bonding Type 97FS, PKG1
[    4.400000] [97F] RFE type 0 PHY paratemters: DEFAULT
[    4.400000] clock 40MHz
[    4.400000] load efuse ok
[    4.400000] rom_progress: 0x200006f
[    4.400000] rom_progress: 0x400006f
[    4.470000] [GetHwReg88XX][PHY_REG_PG_8197Fmp_Type0] size
[    4.490000] [GetHwReg88XX][PHY_REG_PG_8197Fmp_Type0]
[    4.710000] [GetHwReg88XX][rtl8197Ffw]
[    4.720000] [GetHwReg88XX][rtl8197Ffw size]
[    5.160000] [97F] Default BB Swing=30
[    5.310000] device eth0 entered promiscuous mode
[    5.340000] device wlan0 entered promiscuous mode
[    5.350000] br0: port 2(wlan0) entered forwarding state
[    5.370000] br0: port 2(wlan0) entered forwarding state
=== Linux Firmware ===
version=1.4.7_0065
branch=release-1.4.7_0060
*try mount ubi0!!!
test for jacky![    5.450000] UBI: attaching mtd10 to ubi0

[    6.780000] UBI: scanning is finished
[    6.830000] UBI: attached mtd10 (name "AppData", size 56 MiB) to ubi0
[    6.850000] UBI: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
[    6.870000] UBI: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
[    6.890000] UBI: VID header offset: 2048 (aligned 2048), data offset: 4096
[    6.910000] UBI: good PEBs: 449, bad PEBs: 0, corrupted PEBs: 0
[    6.930000] UBI: user volume: 1, internal volumes: 1, max. volumes count: 128
[    6.950000] UBI: max/mean erase counter: 584/127, WL threshold: 4096, image sequence number: 2172196561
[    6.980000] UBI: available PEBs: 0, total reserved PEBs: 449, PEBs reserved for bad PEB handling: 20
[    7.000000] UBI: background thread "ubi_bgt0d" started, PID 932
UBI device number 0, total 449 L[    7.050000] UBIFS: parse sync
EBs (57012224 bytes, 54.4 MiB), available 0 LEBs (0 bytes), LEB size 126976 bytes (124.0 KiB)
[    7.160000] UBIFS: background thread "ubifs_bgt0_0" started, PID 938
[    7.280000] UBIFS: recovery needed
[    8.880000] UBIFS: recovery completed
[    8.900000] UBIFS: mounted UBI device 0, volume 0, name "ubifs1"
[    8.910000] UBIFS: LEB size: 126976 bytes (124 KiB), min./max. I/O unit sizes: 2048 bytes/2048 bytes
[    8.940000] UBIFS: FS size: 52695040 bytes (50 MiB, 415 LEBs), journal size 2666496 bytes (2 MiB, 21 LEBs)
[    8.970000] UBIFS: reserved for root: 2488917 bytes (2430 KiB)
[    8.990000] UBIFS: media format: w4/r0 (latest is w4/r0), UUID BC8C4360-16B8-493B-9A73-49A0654F50D7, small LPT model
is old unecrypt [    9.120000] [rtl819x_gpio_request][42]: pin18
dir!
[    9.140000] [rtl819x_gpio_pin_enable][277]: mask=0xf00 mux=0x455000 mux_reg=0xb8000808 val=0x600, 			CNR_REG=0xfffbff7f MUX_REG=0x455600
[    9.180000] rtl819x_gpio: GPIO18 requests IRQ90
[    9.200000] [rtl819x_gpio_direction_output][150]: set pin18 as output pin, default value=0, DIR_REG=0xff040000 DAT_REG=0x40080
[    9.240000] [rtl819x_gpio_request][42]: pin9
[    9.250000] [rtl819x_gpio_pin_enable][277]: mask=0xf0000 mux=0x455600 mux_reg=0xb8000808 val=0xa0000, 			CNR_REG=0xfffbfd7f MUX_REG=0x4a5600
[    9.300000] rtl819x_gpio: GPIO9 requests IRQ81
[    9.310000] [rtl819x_gpio_direction_output][150]: set pin9 as output pin, default value=0, DIR_REG=0xff040200 DAT_REG=0x40080
MAC=64:90:C1:79:5C:C6
[    9.490000] [rtl819x_gpio_request][42]: pin31
[    9.500000] [rtl819x_gpio_pin_enable][277]: mask=0xf0 mux=0x22220077 mux_reg=0xb800083c val=0x70, 			CNR_REG=0x7ffbfd7f MUX_REG=0x22220077
[    9.670000] rtl819x_gpio: GPIO31 requests IRQ103
[    9.710000] [rtl819x_gpio_direction_output][150]: set pin31 as output pin, default value=0, DIR_REG=0xff040200 DAT_REG=0x40280
=== RootFS Firmware ===
product=aqara-rtl8197-mijia-gateway
branch=release-1.4.7_0060
VERSION=1.4.7_0065
version=1.4.7_0065
run /bin/pre_check.sh...
Check HK setup pass.
Will Start OT!!
device br0 already exists; can't create bridge with the same name
device wlan0 is already a member of a bridge; can't enslave it to bridge br0.
bridge name	bridge id		STP enabled	interfaces
br0		8000.6490c1795cc6	no		eth0
							wlan0
killall: miio_agent: no process killed
killall: miio_client: no process killed
killall: miio_client_helper_nomqtt.sh: no process killed
killall: basic_app: no process killed
killall: basic_gw: no process killed
killall: wpa_supplicant: no process killed
killall: udhcpd: no process killed
killall: udhcpc: no process killed
killall: hostapd: no process killed
killall: eth0_start.sh: no process killed
killall: wifi_start.sh: no process killed
[   11.150000] br0: port 2(wlan0) entered disabled state
[   11.170000] WlanSupportAbility = 0x3
[   11.180000] [ODM_software_init] 
[   11.180000] [97F] Bonding Type 97FS, PKG1
[   11.180000] [97F] RFE type 0 PHY paratemters: DEFAULT
[   11.180000] clock 40MHz
[   11.180000] load efuse ok
[   11.180000] rom_progress: 0x200006f
[   11.180000] rom_progress: 0x400006f
[   11.260000] [GetHwReg88XX][PHY_REG_PG_8197Fmp_Type0] size
[   11.270000] [GetHwReg88XX][PHY_REG_PG_8197Fmp_Type0]
[   11.490000] [GetHwReg88XX][rtl8197Ffw]
[   11.500000] [GetHwReg88XX][rtl8197Ffw size]
[   11.950000] [97F] Default BB Swing=30
[   11.960000] br0: port 2(wlan0) entered forwarding state
[   11.970000] br0: port 2(wlan0) entered forwarding state
969 connect
miio_agent --- dead ---reboot
miio_client --- dead ---reboot
device wlan0 is already a member of a bridge; can't enslave it to bridge br0.
[   13.010000] br0: port 2(wlan0) entered disabled state
[   13.030000] WlanSupportAbility = 0x3
[   13.040000] [ODM_software_init] 
[   13.040000] [97F] Bonding Type 97FS, PKG1
[   13.040000] [97F] RFE type 0 PHY paratemters: DEFAULT
[   13.040000] clock 40MHz
[   13.040000] load efuse ok
[   13.040000] rom_progress: 0x200006f
[   13.040000] rom_progress: 0x400006f
[   13.120000] [GetHwReg88XX][PHY_REG_PG_8197Fmp_Type0] size
[   13.130000] [GetHwReg88XX][PHY_REG_PG_8197Fmp_Type0]
[   13.350000] [GetHwReg88XX][rtl8197Ffw]
[   13.360000] [GetHwReg88XX][rtl8197Ffw size]
[   13.810000] [97F] Default BB Swing=30
[   13.820000] br0: port 2(wlan0) entered forwarding state
[   13.830000] br0: port 2(wlan0) entered forwarding state
restart wpa_supplicant...
killall: wpa_supplicant: no process killed
wpa_supplicant has been killed, then restart it...
2
[   15.250000] store_tty0_enable buf=disable
[   15.250000] , count=8
[   16.110000] br0: port 2(wlan0) entered disabled state
[   18.000000] br0: port 2(wlan0) entered forwarding state
[   18.010000] br0: port 2(wlan0) entered forwarding state
[   20.730000] [rtl819x_gpio_request][42]: pin36
[   20.740000] [rtl819x_gpio_pin_enable][277]: mask=0xf0000 mux=0x0 mux_reg=0xb8000844 val=0x10000, 			CNR_REG=0xfc00032f MUX_REG=0x10000
[   20.840000] rtl819x_gpio: GPIO36 requests IRQ108
[   21.060000] [rtl819x_gpio_direction_output][150]: set pin36 as output pin, default value=0, DIR_REG=0x3fffcd0 DAT_REG=0x3083800
[   21.570000] i2c_designware i2c_designware.1: i2c_dw_handle_tx_abort: slave address not acknowledged (7bit mode)
[   28.040000] br0: port 2(wlan0) entered forwarding state
[   83.740000] br0: port 2(wlan0) entered disabled state
[   83.750000] cfg80211: Calling CRDA to update world regulatory domain
[   83.790000] br0: port 2(wlan0) entered forwarding state
[   83.810000] br0: port 2(wlan0) entered forwarding state
[   84.340000] br0: port 2(wlan0) entered disabled state
[   84.360000] WlanSupportAbility = 0x3
[   84.370000] [ODM_software_init] 
[   84.370000] [97F] Bonding Type 97FS, PKG1
[   84.370000] [97F] RFE type 0 PHY paratemters: DEFAULT
[   84.370000] clock 40MHz
[   84.370000] load efuse ok
[   84.370000] rom_progress: 0x200006f
[   84.370000] rom_progress: 0x400006f
[   84.450000] [GetHwReg88XX][PHY_REG_PG_8197Fmp_Type0] size
[   84.460000] [GetHwReg88XX][PHY_REG_PG_8197Fmp_Type0]
[   84.680000] [GetHwReg88XX][rtl8197Ffw]
[   84.690000] [GetHwReg88XX][rtl8197Ffw size]
[   85.140000] [97F] Default BB Swing=30
[   85.150000] br0: port 2(wlan0) entered forwarding state
[   85.160000] br0: port 2(wlan0) entered forwarding state
[   86.230000] br0: port 2(wlan0) entered disabled state
[   86.240000] WlanSupportAbility = 0x3
[   86.250000] [ODM_software_init] 
[   86.250000] [97F] Bonding Type 97FS, PKG1
[   86.250000] [97F] RFE type 0 PHY paratemters: DEFAULT
[   86.250000] clock 40MHz
[   86.250000] load efuse ok
[   86.250000] rom_progress: 0x200006f
[   86.250000] rom_progress: 0x400006f
[   86.330000] [GetHwReg88XX][PHY_REG_PG_8197Fmp_Type0] size
[   86.340000] [GetHwReg88XX][PHY_REG_PG_8197Fmp_Type0]
[   86.560000] [GetHwReg88XX][rtl8197Ffw]
[   86.570000] [GetHwReg88XX][rtl8197Ffw size]
[   87.020000] [97F] Default BB Swing=30
[   87.030000] br0: port 2(wlan0) entered forwarding state
[   87.050000] br0: port 2(wlan0) entered forwarding state
[   87.810000] br0: port 2(wlan0) entered disabled state
[   89.270000] br0: port 2(wlan0) entered forwarding state
[   89.280000] br0: port 2(wlan0) entered forwarding state
[   99.300000] br0: port 2(wlan0) entered forwarding state

The next thing is that it can’t be started at present

strap pin:0x412b8ae2
enable spi-nand
ROM ver:v1.1, sig:455cc27, time:2016.01.04-18:42+0800, CPU(400 MHz), DDR2(533 MHz)
load efuse ok
init IP ok
rom_progress: 0x0600006d
load_data_from_storage(260): 0xbfe01540, 0x00000000, 0xbfd16f44
load_data_from_spi_nand_flash(70): 0xbfe01540, 0x00000000, 0xbfe03e18
check_image_header(72): h(69,72,61,6d), s(69,72,61,6d)
img sig ok
rom_progress: 0x0c00006d
load_data_from_spi_nand_flash(81) 0x00000004 0x000024ba
load_data_from_spi_nand_flash(86): 0xbfe01d40, 0x00000001, 0xbfe03e18
load_data_from_spi_nand_flash(86): 0xbfe02540, 0x00000002, 0xbfe03e18
load_data_from_spi_nand_flash(86): 0xbfe02d40, 0x00000003, 0xbfe03e18
load_data_from_spi_nand_flash(86): 0xbfe03540, 0x00000004, 0xbfe03e18
load_data_from_spi_nand_flash(90) read done (size:9402)
chksum ok
rom_progress: 0x0e00006d
load img ok
rom_progress: 0x1000006d
jump 0xbfe01550

Booting...
SPI NAND clock not enable

SPI Nand ID=00efaa21
SPI Nand die chipsize=0x08000000 byte
SPI Nand dienum=1,
SPI Nand blocksize=0x00020000 byte,
SPI Nand pagesize=0x00000800 byte,
SPI Nand oobsize=0x00000040 byte,
[rtkn_scan_bbt, line 1812], RBA=51, this->RBA_PERCENT = 5,block_v2r_num=1024
[rtkn_scan_bbt, line 1822] block_v2r_num 00000400
[rtk_scan_v2r_bbt]:678,RBA=00000033,2=00000400,
[rtk_scan_v2r_bbt]:684,block_v2r_num=000003cd
INFO: Stored BBT in Die 0: block=8 , block_status_p1=0x000000bb
load bbt v2r table:0 page:512
[rtk_scan_v2r_bbt] have created v2r bbt table:0 on block 8, just loads it !!
check v2r bbt table:0 OK
[rtk_nand_scan_bbt, line 393] mem_page_num=1 bbt_page 704
INFO: Stored BBT in Die 0: block=11 , block_status_p1=0x000000bb
load bbt table:0 page:704
[rtk_nand_scan_bbt] have created bbt table:0 on block 11, just loads it !!
check bbt table:0 OK
[dump_BBT] Nand BBT Content
[0] (00000000, 00000005, 00000000, 000003ff)
[1] (00000000, 000000f0, 00000000, 000003fe)
[2] (00000000, 000000f3, 00000000, 000003fd)
[3] (00000000, 000000f4, 00000000, 000003fc)
[4] (00000000, 000000f6, 00000000, 000003fb)
[5] (00000000, 000000f7, 00000000, 000003fa)
[6] (00000000, 000000f8, 00000000, 000003f9)
[7] (00000000, 000000fa, 00000000, 000003f8)
[8] (00000000, 00000013, 00000000, 000003f7)
[9] (00000000, 00000015, 00000000, 000003f6)
[10] (00000000, 000003ff, 00000000, 000003f5)
[11] (00000000, 0000001a, 00000000, 000003f4)
[12] (00000000, 0000001c, 00000000, 000003f3)
=>CPU Wake-up interrupt happen! GISR=09000084

Realtek RTL8197F boot code at 2019.11.25-17:17+0800 v3.4T-pre2.1 (993MHz)
-- version: 1.0.2.005 --
Info: Load boot_info success!
=== bootloader for mijia_gw ===
boot_info: ver:0
kernel: newest:0, curr:0
rootfs: newest:0, curr:0
kernel[0]: sum:0xc8cf, size:2157572, fail:2
      [1]: sum:0xcb43, size:2157572, fail:2
rootfs[0]: sum:0x62c6, size:8552452, fail:0
      [1]: sum:0x742c, size:10108932, fail:0
root_sum_check: off
watchdog_time: 0
boot_version: 1.0.2.005
priv mode
Info: loading kernel 0 ...  Done
Info: checking kernel 0 ... Fail
Info: loading kernel 1 ...  Done
Info: checking kernel 1 ... Fail
Warn: all kernels are invalid !
Info: save boot_info

---Ethernet init Okay!
<RealTek>

Thanks for your help！

luc1 · November 15, 2020, 6:53am

@tsunglung I tried and it does not work
Thanks for your help anyway.

@rezmus you wrote:

wait a few days, there will be some manual how to flash custom firmware using uart.

Can I flash a new custom firmware on my ZNDMWG03LM?
Do you have infos? github repo?
Thanks!

rezmus · November 15, 2020, 5:06pm

@luc1 @MRJC @tomdu85 use this repository/script to flash firmware

luc1 · November 19, 2020, 4:21pm

Hi @rezmus, thank you! you saved my gateway with your link

I successfully re-flashed my gateway with your modified firmware using your “expect” script on Linux.
Some notes:

Flashing in a nutshell

wget https://github.com/serrj-sv/lumi.gateway.mgl03/raw/main/uart_recovery/bootloader/rtkboot_115200.bin
wget https://github.com/serrj-sv/lumi.gateway.mgl03/raw/main/uart_recovery/mgl03_1.4.7_0065_mod20201116/mgl03_1.4.7_0065_mod20201116.bin
wget https://github.com/serrj-sv/lumi.gateway.mgl03/blob/baba1e45358ef8b36b9b4b7c4e866fbe534c5334/uart_recovery/mgl03_uart_recovery.expect
chmod +x mgl03_uart_recovery.expect
./mgl03_uart_recovery.expect

once flashed, the telnet credentials are: admin / no password
I did not succeed to retrieve the token using various commands through telnet
but it worked using https://github.com/AlexxIT/XiaomiGateway3 with my MI credentials and then get the gateway’s token

Thanks!

rezmus · November 19, 2020, 5:02pm

cat /data/miio/device.token

MRJC · November 21, 2020, 7:37am

Hi! @rezmus ,thanks you very much! my gateway comeback with your link.
First I use window to flash firmware,but it always fail.
A few days ago， I saw @luc1 flashed his gateway in Linux，I installed Ubuntu and try it. It worked.
Thanks @rezmus!,Thanks @luc1!

haxvn · December 11, 2020, 11:07am

pls help me since i got the same issue.

last boot info

=== Linux Firmware ===
version=1.4.4_0003
branch=aqara-rtl8197-gateway
try mount ubi0!!!

boot log
Realtek RTL8197F boot code at 2019.11.15-19:29+0800 v3.4T-pre2.1 (993MHz)
– version: 1.0.2.005 –
Info: Load boot_info success!
=== bootloader for mijia_gw ===
boot_info: ver:0
kernel: newest:0, curr:0
rootfs: newest:0, curr:0
kernel[0]: sum:0xe6b8, size:2126852, fail:0
[1]: sum:0xe6b8, size:2126852, fail:0
rootfs[0]: sum:0x0e23, size:10215428, fail:0
[1]: sum:0x0e23, size:10215428, fail:0
root_sum_check: off
watchdog_time: 0
boot_version: 1.0.2.005
priv mode
Info: loading kernel 0 … Done
Info: checking kernel 0 …

rezmus · December 11, 2020, 11:22am

haxvn · December 15, 2020, 8:17am

thanks for your support.

suresh1 · August 9, 2021, 9:31am

Hi,
We are facing issue in bringing up of Realtek RTL8197FB board from NAND flash (W25G01GVZEIG).Below is our Log details. Please help us in rectifying the ECC Decode error & Image sig Err.

uart ok
strap pin:0x812b8ac2
enable spi-nand
ROM ver:v1.1, sig:455cc27, time:2016.01.04-18:42+0800, CPU(400 MHz), DDR2(400 MHz)
load efuse ok
init IP ok
rom_progress: 0x0600006d
load_data_from_storage(260): 0xbfe01540, 0x00000000, 0xbfd16f44
load_data_from_spi_nand_flash(70): 0xbfe01540, 0x00000000, 0xbfe03e18

ECC_DECODE_FAIL,ecc_start_addr = 0xbfe01540
check_image_header(72): h(69,72,61,6d), s(69,72,61,6d)
img sig ok
rom_progress: 0x0c00006d
load_data_from_spi_nand_flash(81) 0x00000004 0x0000277a
load_data_from_spi_nand_flash(86): 0xbfe01d40, 0x00000001, 0xbfe03e18

ECC_DECODE_FAIL,ecc_start_addr = 0xbfe01d40
load_data_from_spi_nand_flash(86): 0xbfe02540, 0x00000002, 0xbfe03e18

ECC_DECODE_FAIL,ecc_start_addr = 0xbfe02540
load_data_from_spi_nand_flash(86): 0xbfe02d40, 0x00000003, 0xbfe03e18

ECC_DECODE_FAIL,ecc_start_addr = 0xbfe02d40
load_data_from_spi_nand_flash(86): 0xbfe03540, 0x00000004, 0xbfe03e18

ECC_DECODE_FAIL,ecc_start_addr = 0xbfe03540
load_data_from_spi_nand_flash(90) read done (size:10106)
load_data_from_storage(260): 0xbfe01540, 0x00000080, 0xbfd16f44
load_data_from_spi_nand_flash(70): 0xbfe01540, 0x00000080, 0xbfe03e18
ECC_DECODE_FAIL,ecc_start_addr = 0xbfe01540
check_image_header(72): h(ff,ff,ff,ff), s(69,72,61,6d)
img sig err
rom_progress: 0x0d00006d
load_data_from_storage(260): 0xbfe01540, 0x00000100, 0xbfd16f44
load_data_from_spi_nand_flash(70): 0xbfe01540, 0x00000100, 0xbfe03e18
ECC_DECODE_FAIL,ecc_start_addr = 0xbfe01540
check_image_header(72): h(ff,ff,ff,ff), s(69,72,61,6d)
img sig err
rom_progress: 0x0d00006d
load_data_from_storage(260): 0xbfe01540, 0x00000180, 0xbfd16f44
load_data_from_spi_nand_flash(70): 0xbfe01540, 0x00000180, 0xbfe03e18
ECC_DECODE_FAIL,ecc_start_addr = 0xbfe01540
check_image_header(72): h(ff,ff,ff,ff), s(69,72,61,6d)
img sig err
rom_progress: 0x0d00006d
load img fail(0xffffffff)
rom_progress: 0x1100006d
load code fail (0xffffffff)
rom_progress: 0x0b00006d

dram_init.c : ss_init_rxi310()

dram_init.c : ms_ctrl_0_map=0xb8142000
ss_init_rxi310(1902):bond:0x00000000

dram_init_clk_frequency ,ddr_freq=800 (Mbps), 400 (MHZ)
mck_ck = 11, 1084

JSW : dram_init_rxi310 ,dev_map=0xb8142000