Adding OpenWrt support for Xiaomi MI Smart Speaker Model: L09G

For Developers
1

Hi,
I am interested to "deGoogle" this Speaker.
and use it with OpenWRT as Bluetooth / Airplay / WiFI Speaker...

Found in the Web that some people use OpenWRT for Smart Speaker.

Found a disassemble VIDEO https://www.youtube.com/watch?v=XPogLyJAank
there I can see a Conector: RX GND TX. See at 00:01:30 in the VIDEO

Can see in a CHIP: Toshiba JX5839 but did not find somthing about this CHIP

So I will try to solder PINs there an Connect a USB to RS232 Adapter...
but this will happen in a few days.

If I can get DATA from the Hardware / Software.... how to start a Port from OpenWRT for this Device ?

Thank you

2

Using Adapter: TTL UART PL-2303HX (Chip Rev A)

white/weis --> TX
black/schwarz --> GND
red/rot --> RX

sudo minicom -b 115200 -D /dev/ttyUSB0

or

sudo picocom -b 115200 /dev/ttyUSB0

Boot LOG:


AXG:BL1:d1dbf2:a4926f;FEAT:F0DC31BC:2000;POC:F;EMMC:800;NAND:0;READ:0;0.0;0.0;CHK:0;
sdio debug board detected 
TE: 140571

BL2 Built : 11:48:35, Mar 10 2020. axg gf91bf0a - jenkins@walle02-sh

set vcck to 1050 mv
set vddee to 950 mv
Board ID = 3
CPU clk: 1200MHz
DDR low power enabled
DDR3 chl: Rank0 16bit @ 912MHz
bist_test rank: 0 18 00 30 22 0a 3b 17 00 2f 24 0d 3c 00 00 00 00 00 00 00 00 00 00 00 00 772   - PASS
Rank0: 512MB(auto)-2T-13
AddrBus test pass!
NAND init
Load FIP HDR from NAND, src: 0x0000c000, des: 0x01700000, size: 0x00004000, part: 0
Load BL3x from NAND, src: 0x00010000, des: 0x01704000, size: 0x000afc00, part: 0
NOTICE:  BL31: v1.3(release):d5a9e97
NOTICE:  BL31: Built : 17:38:06, Mar 12 2020
NOTICE:  BL31: AXG secure boot!
NOTICE:  BL31: BL33 decompress pass
OPS=0x43
[Image: axg_v1.1.3489-8f09446 2020-03-12 13:58:51 jenkins@walle02-sh]
25 0c 43 00 ed b9 e3 7f 15 2a e1 53 b8 33 72 33 
bl30:axg ver: 9 mode: 0
bl30:axg thermal0
[0.015888 Inits done]
secure task start!
high task start!
low task start!
ERROR:   Error initializing runtime service opteed_fast


U-Boot 2015.01-gfe79c6daed-dirty (Aug 27 2020 - 14:13:41)

DRAM:  512 MiB
Relocation Offset is: 1eec3000
mmu cfg end: 0x20000000
mmu cfg end: 0x20000000
register usb cfg[0][1] = 000000001ff74ad0
aml_i2c_init_port init regs for 0
NAND:  get_sys_clk_rate_mtd() 292, clock setting 200!
bus cycle0: 6,timing: 7
NAND device id: 98 da 90 15 76 16 
NAND device: Manufacturer ID: 0x98, Chip ID: 0x98 (Toshiba A revision NAND 2Gib TC58NVG1S3HBAI4 )
get_sys_clk_rate_mtd() 292, clock setting 200!
m3_nand_adjust_timing() sys_clk_rate 200, bus_c 6, bus_t 7
oob_fill_cnt =32 oob_size =64, bch_bytes =14
ecc mode:6 ecc_page_num=2 eep_need_oobsize=16
plane_num=1 writesize=0x800 ecc.size=0x200 bch_mode=1
oob avail size 6
Creating 1 MTD partitions on "A revision NAND 2Gib TC58NVG1S3HBAI4 ":
0x000000000000-0x000000200000 : "bootloader"
A revision NAND 2Gib TC58NVG1S3HBAI4  initialized ok
get_sys_clk_rate_mtd() 292, clock setting 200!
bus cycle0: 6,timing: 7
NAND device id: 98 da 90 15 76 16 
NAND device: Manufacturer ID: 0x98, Chip ID: 0x98 (Toshiba A revision NAND 2Gib TC58NVG1S3HBAI4 )
get_sys_clk_rate_mtd() 292, clock setting 200!
m3_nand_adjust_timing() sys_clk_rate 200, bus_c 6, bus_t 7
oob_fill_cnt =32 oob_size =64, bch_bytes =14
ecc mode:6 ecc_page_num=2 eep_need_oobsize=16
PLANE change!
plane_num=1 writesize=0x800 ecc.size=0x200 bch_mode=1
aml_nand_init :oobmul=1,oobfree.length=8,oob_size=64
oob avail size 8
nbbt=20
nenv=24
nkey=32
ndtb=40
nddr=44
bbt_start=20 env_start=24 key_start=32 dtb_start=40 ddr_start=44 
nbbt: info size=0x800 max_scan_blk=24, start_blk=20
nbbt : phy_blk_addr=20, ec=0, phy_page_addr=0, timestamp=1
nbbt free list: 
blockN=21, ec=-1, dirty_flag=0
blockN=22, ec=-1, dirty_flag=0
blockN=23, ec=-1, dirty_flag=0
aml_nand_scan_rsv_info 1132: page_num=1
aml_nand_scan_rsv_info 1135
nbbt valid addr: 280000
aml_nand_bbt_check 1256 bbt is valid, reading.
aml_nand_read_rsv_info:444,read nbbt info to 280000
nenv: info size=0x10000 max_scan_blk=32, start_blk=24
nenv : phy_blk_addr=25, ec=3, phy_page_addr=0, timestamp=9
nenv free list: 
blockN=24, ec=3, dirty_flag=1
blockN=26, ec=0, dirty_flag=1
blockN=27, ec=-1, dirty_flag=0
blockN=28, ec=-1, dirty_flag=0
blockN=29, ec=-1, dirty_flag=0
blockN=30, ec=-1, dirty_flag=0
blockN=31, ec=-1, dirty_flag=0
aml_nand_scan_rsv_info 1132: page_num=32
aml_nand_scan_rsv_info 1135
nenv valid addr: 330000
nkey: info size=0x8000 max_scan_blk=40, start_blk=32
nkey : phy_blk_addr=33, ec=0, phy_page_addr=0, timestamp=2
nkey free list: 
blockN=32, ec=0, dirty_flag=1
blockN=34, ec=-1, dirty_flag=0
blockN=35, ec=-1, dirty_flag=0
blockN=36, ec=-1, dirty_flag=0
blockN=37, ec=-1, dirty_flag=0
blockN=38, ec=-1, dirty_flag=0
blockN=39, ec=-1, dirty_flag=0
aml_nand_scan_rsv_info 1132: page_num=16
aml_nand_scan_rsv_info 1135
nkey valid addr: 420000
ndtb: info size=0x20000 max_scan_blk=44, start_blk=40
ndtb : phy_blk_addr=40, ec=0, phy_page_addr=0, timestamp=1
ndtb free list: 
blockN=41, ec=-1, dirty_flag=0
blockN=42, ec=-1, dirty_flag=0
blockN=43, ec=-1, dirty_flag=0
aml_nand_scan_rsv_info 1132: page_num=64
aml_nand_scan_rsv_info 1135
ndtb valid addr: 500000
nddr: info size=0x800 max_scan_blk=46, start_blk=44
nddr : phy_blk_addr=-1, ec=0, phy_page_addr=0, timestamp=0
nddr free list: 
blockN=44, ec=-1, dirty_flag=0
blockN=45, ec=-1, dirty_flag=0
aml_nand_scan_rsv_info 1132: page_num=1
nddr valid addr: fffffffffffe0000
aml_nand_rsv_info_check_except_bbt 1226 NO nddr exist
tpl: off 8388608, size 8388608
 NAND bbt detect factory Bad block at c000000 
 NAND bbt detect factory Bad block at c020000 
Creating 7 MTD partitions on "A revision NAND 2Gib TC58NVG1S3HBAI4 ":
0x000000800000-0x000001000000 : "tpl"
0x000001000000-0x000001a00000 : "recovery"
0x000001a00000-0x000002600000 : "boot"
0x000002600000-0x000003600000 : "system"
0x000003600000-0x000007a00000 : "chrome"
0x000007a00000-0x000007e00000 : "factory"
0x000007e00000-0x000010000000 : "data"
 NAND bbt detect factory Bad block at c000000 
 NAND bbt detect factory Bad block at c020000 
A revision NAND 2Gib TC58NVG1S3HBAI4  initialized ok
MMC:   aml_priv->desc_buf = 0x000000001dec1760
aml_priv->desc_buf = 0x000000001dec3aa0
SDIO Port B: 0, SDIO Port C: 1
uboot env amlnf_env_read : ####
aml_nand_read_rsv_info:444,read nenv info to 330000
In:    serial
Out:   serial
Err:   serial
aml log : internal sys error!
reboot_mode=cold_boot
Start read misc partition datas!
[burnup]Rd:Up sz 0x440 to align 0x1000
[store]Err:mtd_find_phy_off_by_lgc_off,L116:device(misc) is err
[store]Err:do_store_read,L1775:Fail in find phy addr by logic off (0x0),ret(1)
[burnup]Err:store_read_ops,L101:cmd failed, ret=1, [store  read misc 0x1deb1a78  0x0  0x1000]
failed to store read misc.
get_valid_slot - get_valid_slot

Usage:
get_valid_slot 
This command will choose valid slot to boot up which saved in misc
partition by mark to decide whether execute command!
So you can execute command: get_valid_slot
active_slot is normal
cmd: imgread dtb boot ${dtb_mem_addr}
[imgread]szTimeStamp[2021111222571348]
[imgread]MTD pageShift 11, writesz 0x800
aml log : R-2048 check pass!
aml log : R2048 check pass!
[imgread]Enc dtb sz 0xc000
      Amlogic Multi-DTB tool
      Single DTB detected
Start read misc partition datas!
[burnup]Rd:Up sz 0x440 to align 0x1000
[store]Err:mtd_find_phy_off_by_lgc_off,L116:device(misc) is err
[store]Err:do_store_read,L1775:Fail in find phy addr by logic off (0x0),ret(1)
[burnup]Err:store_read_ops,L101:cmd failed, ret=1, [store  read misc 0x1deb1888  0x0  0x1000]
failed to store read misc.
get_valid_slot - get_valid_slot

Usage:
get_valid_slot 
This command will choose valid slot to boot up which saved in misc
partition by mark to decide whether execute command!
So you can execute command: get_valid_slot
wipe_data=successful
wipe_cache=successful
recovery_status=
upgrade_step=2
s_version: U-Boot 2015.01-gfe79c6daed-dirty
amlkey_init() enter!
amlnf_key_read: ####
amlnf_key_read key data len too much
aml_nand_read_rsv_info:444,read nkey info to 420000
[EFUSE_MSG]keynum is 4
[KM]Error:f[key_manage_query_size]L515:key[mac] not programed yet
[KM]Error:f[key_manage_query_size]L515:key[lang] not programed yet
[KM]Error:f[key_manage_query_size]L515:key[locale_lang] not programed yet
[KM]Error:f[key_manage_query_size]L515:key[locale_region] not programed yet
enable adb debug prop
InUsbBurn
noSof
Hit Enter or space or Ctrl+C key to stop autoboot -- :  0 
[imgread]szTimeStamp[2021111222571348]
[imgread]secureKernelImgSz=0x9d9000
aml log : R-2048 check pass!
aml log : R2048 check pass!
aml log : R2048 check pass!
aml log : R2048 check pass!
avb2: 0
save_power_post ...
avb2: 0
## Booting Android Image at 0x01080000 ...
reloc_addr =1dedc2e0
copy done
Kernel command line: rootfstype=ramfs init=/init console=ttyS0,115200 no_console_suspend earlycon=aml_uart,0xff803000
[store]Is good fdt check header, no need decrypt!
load dtb from 0x1000000 ......
      Amlogic Multi-DTB tool
      Single DTB detected
   Uncompressing Kernel Image ... OK
   kernel loaded at 0x01080000, end = 0x02251200
   Loading Ramdisk to 1db83000, end 1deb0800 ... OK
   Loading Device Tree to 000000001db74000, end 000000001db8239e ... OK
fdt_fixup_memory_banks, reg:0000000000000000

Starting kernel ...

uboot time: 3095971 us
[    0.000000@0]d       07400000 - 07500000,     1024 KB, ramoops@0x07400000
[    0.000000@0]d       05000000 - 05400000,     4096 KB, linux,secmon
domain-0 init dvfs: 1
[    0.239544@0]- clkmsr ffd18004.meson_clk_msr: failed to get msr ring reg0
[    0.286855@0]- dmi: Firmware registration failed.
[    1.460812@0]- Initramfs unpacking failed: junk in compressed archive
[    1.466733@0]- meson-mmc: >>>>>>>>hostbase ffffff80081f8000, dmode 
[    1.639401@2]- mtdoops: mtd device (mtddev=name/number) must be supplied
[    1.659066@2]- ff803000.serial: clock gate not found
[    1.666599@2]- amlogic-new-usb3 ffe09080.usb3phy: This phy has no usb port
[    1.677866@2]- cyttsp 1-0010: Failed to read block!
[    1.677949@2]- cyttsp 1-0010: Failed to read block!
[    1.681998@2]- cyttsp 1-0010: Failed get Cyttsp Touch FW ID!
[    1.696725@2]- page_trace_module_init, create sysfs failed
[    2.435634@0]- asoc-aml-card auge_sound: control 2:0:0:I2SIn CLK:0 is already present
[    2.437823@0]- snd_tdm ff642000.audiobus:tdmb: ASoC: Failed to add I2SIn CLK: -16
[    2.445275@0]- aml_dai_tdm_probe, failed add snd tdm controls
[    2.450957@0]- asoc-aml-card auge_sound: control 2:0:0:I2SIn CLK:0 is already present
[    2.458709@0]- snd_tdm ff642000.audiobus:tdmc: ASoC: Failed to add I2SIn CLK: -16
[    2.466128@0]- aml_dai_tdm_probe, failed add snd tdm controls
[    2.503417@0]- hub 2-0:1.0: config failed, hub doesn't have any ports! (err -19)
[    2.505273@0]- usb usb2: Unsupported the hub
[    2.625533@0]- thermal thermal_zone0: binding zone soc_thermal with cdev thermal-cpufreq-0 failed:-22
[    2.635mount normal partition
UBI device number 6, total 32 LEBs (4063232 bytes, 3.9 MiB), available 0 LEBs (0 bytes), LEB size 126976 bytes (124.0 KiB)
UBI device number 7, total 1038 LEBs (131801088 bytes, 125.7 MiB), available 0 LEBs (0 bytes), LEB size 126976 bytes (124.0 KiB)
[    3.314831@2]- initializing block_map for system
[    3.316845@2]- initializing block_map for chrome
/dev/ubi7_0 /cache ubifs rw,relatime 0 0
/cache is already mounted
ctrl_interface=/data/wifi
Unable to chown /sys/devices/platform/bt-dev/rfkill/*/type: No such file or directory
Unable to chmod /sys/devices/platform/bt-dev/rfkill/*/type: No such file or directory
Unable to chown /sys/devices/platform/bt-dev/rfkill/*/state: No such file or directory
Unable to chmod /sys/devices/platform/bt-dev/rfkill/*/state: No such file or directory
/data/misc/bluedroid/bt_config.conf
[    3.803835@3]- unifykey: name: mac_bt, size 17
and wifi mac changes,seting new wifi MAC addr.
set system prompt languge to xx-WW
[0101/010007.173693:WARNING:client_auth_manager.cc(87)] Pref service not available. This should only happen in tests.
Playing WAVE '/usr/share/empty.wav' : Signed 16 bit Little Endian, Rate 44100 Hz, Stereo
Serial Number: A0SF24639
Initializing random number generator...
[    5.032416@1]- unifykey:  key_unify_init.part.2() already inited!
[    5.044055@0]- unifykey: name: deviceid, size 15
link failed File exists
link failed No such file or directory
[    5.204787@2]- mico_proc_l09g: loading out-of-tree module taints kernel.
[    5.219759@3]- Miso kernel module inited
[    5.235449@0]- meson-mmc: [sdio_notify] finish
[    5.642084@0]- meson-mmc: [sdio_notify] finish
[    5.643533@0]h meson-mmc: sdio: resp_timeout,vstat:0xa1ff2800,virqc:3fff
[    5.647548@0]h meson-mmc: sdio: err: wait for irq service, bus_fsm:0x8
[    5.654059@1]- meson-mmc: meson_mmc_irq_thread_v3 661 sdio: cmd:52
[    5.661216@0]h meson-mmc: sdio: resp_timeout,vstat:0xa1ff2800,virqc:3fff
[    5.666782@0]h meson-mmc: sdio: err: wait for irq service, bus_fsm:0x8
[    5.673344@1]- meson-mmc: meson_mmc_irq_thread_v3 661 sdio: cmd:52
[    5.684011@0]h meson-mmc: sdio: resp_timeout,vstat:0xa1ff2800,virqc:3fff
[    5.686015@0]h meson-mmc: sdio: err: wait for irq service, bus_fsm:0x8
[    5.692569@1]- meson-mmc: meson_mmc_irq_thread_v3 661 sdio: cmd:8
[    5.699170@0]- meson-aml-mmc ffe05000.sdio: card claims to support voltages below defined range
[    5.730094@0]- meson-mmc: actual_clock :400000, HHI_nand: 0x0
[    5.730236@0]- meson-mmc: [meson_mmc_set_ios_v3] after clock: 0x1000033c
[    5.741718@0]- uhs = 1000000
[    5.757686@0]- meson-aml-mmc ffe05000.sdio: divider requested rate 100000000 != actual rate 99999903: ret=0
[    5.761785@0]- meson-mmc: actual_clock :99999903, HHI_nand: 0x0
[    5.767664@0]- meson-mmc: [meson_mmc_set_ios_v3] after clock: 0x1000034a
[    5.774296@0]- meson-mmc: Data 1 aligned delay is 0
[    5.779117@0]- meson-mmc: sdio: clk 99999903 tuning start
[    5.794546@0]- meson-mmc: sdio: adj_win: < 0 1 2 3 4 5 7 8 >
[    5.794583@0]- meson-mmc: sdio: best_win_start =0, best_win_size =6
[    5.800800@0]- meson-mmc: sdio: sd_emmc_regs->gclock=0x1000034a,sd_emmc_regs->gadjust=0x32000
[    5.809251@0]- meson-mmc: delay1:0x0, delay2:0x0
[    5.815446@0]- sdio: new ultra high speed SDR50 SDIO card at address 0001
[    5.820558@0]- sdio: clock 99999903, 4-bit-bus-width
 [    5.826137@2]- meson-mmc: [sdio_reinit] finish
sdio wifi file not exist :/sys/bus/mmc/devices/sdio:0000/sdio:0000:1/device 
found the match wifi is: rtl8821cs
start insmod 8821cs.ko
[sdio_wifi_load_driver:764]module_path(/lib/kernel/modules/8821cs.ko)
[sdio_wifi_load_driver:766]module_arg(ifname=wlan0 if2name=uap0)
[insmod:614]filename(/lib/kernel/modules/8821cs.ko) options(ifname=wlan0 if2name=uap0)
[    5.983186@2]- RTW: module init start
[    5.983227@2]- RTW: rtl8821cs v5.8.1.2_35313.20191016_COEX20191014-4141
[    5.987836@2]- RTW: build time: Mar  3 2021 14:44:00
[    5.992729@2]- RTW: rtl8821cs BT-Coex version = COEX20191014-4141
[    5.998761@2]- ######platform_wifi_power_on:
[    6.003036@2]- aml_wifi wifi: [extern_wifi_set_enable] WIFI  Disable! 474
[    6.530102@2]- aml_wifi wifi: [extern_wifi_set_enable] WIFI  Enable! 474
[    7.042079@2]- sdio_reset_comm():
[    7.042159@0]h meson-mmc: sdio: resp_timeout,vstat:0xa1ff2800,virqc:3fff
[    7.046420@0]h meson-mmc: sdio: err: wait for irq service, bus_fsm:0x8
[    7.052929@1]- meson-mmc: meson_mmc_irq_thread_v3 661 sdio: cmd:52
[    7.059098@0]h meson-mmc: sdio: resp_timeout,vstat:0xa1ff2800,virqc:3fff
[    7.065653@0]h meson-mmc: sdio: err: wait for irq service, bus_fsm:0x8
[    7.072152@1]- meson-mmc: meson_mmc_irq_thread_v3 661 sdio: cmd:52
[    7.078366@1]- meson-mmc: actual_clock :400000, HHI_nand: 0x0
[    7.083981@1]- meson-mmc: [meson_mmc_set_ios_v3] after clock: 0x1000033c
[    7.094923@1]- meson-aml-mmc ffe05000.sdio: card claims to support voltages below defined range
[    7.118193@1]- meson-mmc: actual_clock :400000, HHI_nand: 0x0
[    7.118332@1]- meson-mmc: [meson_mmc_set_ios_v3] after clock: 0x1000033c
[    7.129827@1]- uhs = 1000000
[    7.145803@1]- meson-aml-mmc ffe05000.sdio: divider requested rate 100000000 != actual rate 99999903: ret=0
[    7.149921@1]- meson-mmc: actual_clock :99999903, HHI_nand: 0x0
[    7.155779@1]- meson-mmc: [meson_mmc_set_ios_v3] after clock: 0x1000034a
[    7.162414@1]- meson-mmc: Data 1 aligned delay is 0
[    7.167238@1]- meson-mmc: sdio: clk 99999903 tuning start
[    7.182196@1]- meson-mmc: sdio: adj_win: < 0 1 2 3 4 5 7 8 >
[    7.182231@1]- meson-mmc: sdio: best_win_start =0, best_win_size =6
[    7.188450@1]- meson-mmc: sdio: sd_emmc_regs->gclock=0x1000034a,sd_emmc_regs->gadjust=0x32000
[    7.196917@1]- meson-mmc: delay1:0x0, delay2:0x0
[    7.201492@1]- meson-mmc: [sdio_reinit] finish
[    7.206341@1]- RTW: == SDIO Card Info ==
[    7.209739@1]- RTW:   card: ffffffc0198aa000
[    7.213986@1]- RTW:   clock: 100000000 Hz
[    7.217947@1]- RTW:   timing spec: sd uhs SDR50
[    7.222411@1]- RTW:   sd3_bus_mode: TRUE
[    7.226307@1]- RTW:   func num: 1
[    7.229571@1]- RTW:   func1: ffffffc018e2d800 (*)
[    7.234261@1]- RTW: ================
[    7.237927@1]- RTW: [HALMAC]11692M
[    7.237927@1]- HALMAC_MAJOR_VER = 1
[    7.237927@1]- HALMAC_PROTOTYPE_VER = 6
[    7.237927@1]- HALMAC_MINOR_VER = 5
[    7.237927@1]- HALMAC_PATCH_VER = 5
[    7.359154@1]- RTW: HW EFUSE
[    7.359205@1]- RTW: 0x000: 29 81 00 BC  09 10 28 00  AA 04 AD 75  10 8E 30 0B  
[    7.363662@1]- RTW: 0x010: 20 21 21 22  22 22 26 26  26 27 27 12  FF FF FF FF  
[    7.370907@1]- RTW: 0x020: FF FF 27 25  25 25 24 24  24 25 25 26  26 27 27 27  
[    7.378165@1]- RTW: 0x030: 24 FF FF FF  FF FF 00 FF  FF FF 20 21  21 22 22 22  
[    7.385397@1]- RTW: 0x040: 26 26 26 27  27 12 FF FF  FF FF FF FF  FF FF FF FF  
[    7.392641@1]- RTW: 0x050: FF FF FF FF  FF FF FF FF  FF FF FF FF  FF FF FF FF  
[    7.399886@1]- RTW: 0x060: FF FF FF FF  FF FF FF FF  FF FF FF FF  FF FF FF FF  
[    7.407131@1]- RTW: 0x070: FF FF FF FF  FF FF FF FF  FF FF FF FF  FF FF FF FF  
[    7.414376@1]- RTW: 0x080: FF FF FF FF  FF FF FF FF  FF FF FF FF  FF FF FF FF  
[    7.421621@1]- RTW: 0x090: FF FF FF FF  FF FF FF FF  FF FF FF FF  FF FF FF FF  
[    7.428866@1]- RTW: 0x0A0: FF FF FF FF  FF FF FF FF  FF FF FF FF  FF FF FF FF  
[    7.436111@1]- RTW: 0x0B0: FF FF FF FF  FF FF FF FF  7F 36 23 00  FF FF FF FF  
[    7.443356@1]- RTW: 0x0C0: FF 21 00 00  00 00 00 00  00 FF 05 FF  FF FF FF FF  
[    7.450601@1]- RTW: 0x0D0: 7E D1 01 23  34 FF FF FF  20 04 4C 02  21 C8 21 02  
[    7.457846@1]- RTW: 0x0E0: 0C 00 22 04  00 08 00 32  FF 21 02 0C  00 22 2A 01  
[    7.465091@1]- RTW: 0x0F0: 01 00 00 00  00 00 00 00  00 00 00 00  02 00 FF FF  
[    7.472336@1]- RTW: 0x100: 00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00  
[    7.479582@1]- RTW: 0x110: 00 EB 00 6E  01 00 00 00  00 FF FF FF  FF FF FF FF  
[    7.486827@1]- RTW: 0x120: FF FF FF FF  FF FF FF FF  FF FF FF FF  FF FF FF FF  
[    7.494084@1]- RTW: 0x130: FF FF FF FF  FF FF FF FF  FF FF FF FF  FF FF FF FF  
[    7.501316@1]- RTW: 0x140: FF FF FF FF  FF FF FF FF  FF FF FF FF  FF FF FF FF  
[    7.508562@1]- RTW: 0x150: FF FF FF FF  FF FF FF FF  FF FF FF FF  FF FF FF FF  
[    7.515807@1]- RTW: 0x160: FF FF FF FF  FF FF FF FF  FF FF FF FF  FF FF FF FF  
[    7.523051@1]- RTW: 0x170: FF FF FF FF  FF FF FF FF  FF FF FF FF  FF FF FF FF  
[    7.530296@1]- RTW: 0x180: FF FF FF FF  FF FF FF FF  FF FF FF FF  FF FF FF FF  
[    7.537541@1]- RTW: 0x190: FF FF FF FF  FF FF FF FF  FF FF FF FF  FF FF FF FF  
[    7.544786@1]- RTW: 0x1A0: FF FF FF FF  FF FF FF FF  FF FF FF FF  FF FF FF FF  
[    7.552031@1]- RTW: 0x1B0: FF FF FF FF  FF FF FF FF  FF FF FF FF  FF FF FF FF  
[    7.559276@1]- RTW: 0x1C0: FF FF FF FF  FF FF FF FF  FF FF FF FF  FF FF FF FF  
[    7.566521@1]- RTW: 0x1D0: FF FF FF FF  FF FF FF FF  FF FF FF FF  FF FF FF FF  
[    7.573766@1]- RTW: 0x1E0: FF FF FF FF  FF FF FF FF  FF FF FF FF  FF FF FF FF  
[    7.581012@1]- RTW: 0x1F0: FF FF FF FF  FF FF FF FF  FF FF FF FF  FF FF FF FF  
[    7.588367@1]- RTW: wifi_mac file: /data/wifi/wifimac.txt
[    7.593816@1]- RTW: hal_com_config_channel_plan chplan:0x7F
[    7.645847@3]- RTW: c2h_mac_hidden_rpt_hdl: 0x0E
[    7.645890@3]- RTW: c2h_mac_hidden_rpt_hdl: 0x1F
[    7.649438@3]- RTW: c2h_mac_hidden_rpt_hdl: 0x99
[    7.654006@3]- RTW: c2h_mac_hidden_rpt_hdl: 0x05
[    7.658569@3]- RTW: c2h_mac_hidden_rpt_hdl: 0xF6
[    7.663150@3]- RTW: c2h_mac_hidden_rpt_hdl: 0xFF
[    7.667709@3]- RTW: c2h_mac_hidden_rpt_hdl: 0x37
[    7.672280@3]- RTW: c2h_mac_hidden_rpt_hdl: 0xFF
[    7.676851@3]- RTW: uuid x:0x0e y:0x1f z:0x19 crc:0x2c
[    7.681940@3]- RTW: hci_type:0x6
[    7.685130@3]- RTW: package_type:0x7
[    7.688667@3]- RTW: tr_switch:0x1
[    7.691944@3]- RTW: wl_func:0xf
[    7.695049@3]- RTW: hw_stype:0xf
[    7.698240@3]- RTW: bw:0x7
[    7.700899@3]- RTW: ant_num:0x1
[    7.704019@3]- RTW: protocol:0x3
[    7.707206@3]- RTW: nic:0x3
[    7.709959@3]- RTW: c2h_mac_hidden_rpt_2_hdl: 0xFF
[    7.714716@3]- RTW: c2h_mac_hidden_rpt_2_hdl: 0xFF
[    7.719459@3]- RTW: c2h_mac_hidden_rpt_2_hdl: 0xF8
[    7.724202@3]- RTW: c2h_mac_hidden_rpt_2_hdl: 0xFC
[    7.728946@3]- RTW: c2h_mac_hidden_rpt_2_hdl: 0xFF
[    7.742042@3]- RTW: [RF_PATH] IC's RF PATH:RF_1T1R, max_tx_cnt:1
[    7.742420@3]- RTW: [RF_PATH] PG's trx_path_bmp:0x00, max_tx_cnt:0
[    7.748556@3]- RTW: [RF_PATH] Registry's RF PATH:UNKNOWN
[    7.753820@3]- RTW: [RF_PATH] HALDATA's trx_path_bmp:0x11, max_tx_cnt:1
[    7.760370@3]- RTW: [RF_PATH] HALDATA's RF PATH:RF_1T1R
[    7.765542@3]- RTW: [RF_PATH] NumTotalRFPath:1
[    7.769942@3]- RTW: [TRX_Nss] HALSPEC - tx_nss :1, rx_nss:1
[    7.775461@3]- RTW: [TRX_Nss] Registry - tx_nss :0, rx_nss:0
[    7.781068@3]- RTW: [TRX_Nss] HALDATA - tx_nss :1, rx_nss:1
[    7.787600@3]- RTW: ADAPTIVITY_VERSION 9.7.07
[    7.790949@3]- RTW: RTW_ADAPTIVITY_EN_ENABLE
[    7.795111@3]- RTW: RTW_ADAPTIVITY_MODE_NORMAL
[    7.799578@3]- RTW: rtw_regsty_chk_target_tx_power_valid return _FALSE for band:0, path:0, rs:0, t:-1
[    7.810771@3]- RTW: rtw_ndev_init(wlan0) if1 mac_addr=9c:9d:7e:3a:9b:1c
[    7.817404@3]- RTW: rtw_ndev_init(uap0) if2 mac_addr=9e:9d:7e:3a:9b:1c
[    7.823822@3]- RTW: module init ret=0
link /system/lib/libbt-vendor_rtl.so -> /system/lib/libbt-vendor.so
link libbt_vendor.so fail  : File exists
[    7.846316@3]- init: '/bin/sh' exited with status 0
[    7.846456@3]- init: command 'exec' r=0
[    7.849425@3]- init: executing '/bin/sh'
[    8.140431@2]- init: '/bin/sh' exited with status 0
[    8.140569@2]- init: command 'exec' r=0
[    8.143956@2]- init: starting 'dhcpcd'
[    8.147969@2]- init: starting 'cast_auth_check'
[    8.152286@2]- init: command 'start' r=0
[    8.155989@2]- init: starting 'iot_audio'
[    8.160264@2]- init: command 'start' r=0
[    8.171927@0]- unifykey:  key_unify_init.part.2() already inited!
[    8.172601@0]- unifykey: name_store() 1302, name mac_wifi, 8
[    8.178122@0]- unifykey: name_store() 1311
[    8.199944@3]- unifykey: name: mac_wifi, size 17
[    8.217153@3]- capability: warning: `dhcpcd' uses 32-bit capabilities (legacy support in use)
wifi mac is exit.
[    8.226478@2]- unifykey: name_store() 1302, name country, 7
[    8.227902@2]- unifykey: name_store() 1311
[    8.243514@3]- unifykey: name: country, size 2
seting wifi country : WW
Invalid command : set_country
[    8.840364@0]- audio_ddr_mngr: toddrs[1] registered by device ff642000.audiobus:tdma
[    8.843765@0]- asoc-aml-card auge_sound: tdm prepare capture
[    9.411113@0]- RTW: txpath=0x1, rxpath=0x1
[    9.411155@0]- RTW: txpath_1ss:0x1, num:1
[    9.425801@0]- start_addr=(0x8000), end_addr=(0x10000), buffer_size=(0x8000), smp_number_max=(4096)
[    9.439259@0]- RTW: wlan0- hw port(0) mac_addr =9c:9d:7e:3a:9b:1c
[    9.439952@0]- RTW: uap0- hw port(1) mac_addr =9e:9d:7e:3a:9b:1c
[    9.463023@0]- IPv6: ADDRCONF(NETDEV_UP): wlan0: link is not ready
[   10.119416@1]- meson_uart ffd24000.serial: ttyS1 use xtal(8M) 24000000 change 0 to 9600
[   10.121917@1]- meson_uart ffd24000.serial: ttyS1 use xtal(8M) 24000000 change 9600 to 9600
[   10.130107@1]- meson_uart ffd24000.serial: ttyS1 use xtal(8M) 24000000 change 9600 to 115200
[   10.188553@1]- configfs-gadget ff400000.dwc2_a: failed to start amlogic: -19
[   10.196527@1]- meson_uart ffd24000.serial: ttyS1 use xtal(8M) 24000000 change 115200 to 2000000
[   10.199799@1]- meson_uart ffd24000.serial: ttyS1 use xtal(8M) 24000000 change 2000000 to 2000000

L09G
L09G1920×1440 217 KB

Chip: Toshiba LF1630

Chip: TC58NVG1S3HBAI4

But can not interrupt the boot process (did not know how) or can inupt somethind on the console/shell there is no prompt

any hint ?

3

Some vendors write protect u-boot, you have to change the uboot env params to be able to interrupt it.

Tried hitting enter a few times after the boot sequence ends ?

If there're any physical buttons on the unit, try holding them down while powering it on, and look for any changes in the console output.

4

@frollic

thanks

Tried hitting enter a few times after the boot sequence ends ?

yes but nothing happend

Some vendors write protect u-boot, you have to change the uboot env params to be able to interrupt it.

can you explain more please ?

5

What is says, you need to find a way to modify one of the env variables for uboot, to disable the write protection.

Assuming that's what it is, and not some kind of hw issue, with your serial port, or physically disabled read pin on the device.

6

how to be sure that the input is working

found in the boot log this line:

Hit Enter or space or Ctrl+C key to stop autoboot -- : 0

but Enter, space or Ctrl+C did not stop the boot...

and I found this line:

enable adb debug prop

how to access with adb to /dev/ttyUSB0 ???


nmap -sV 192.168.178.73
Starting Nmap 7.92 ( https://nmap.org ) at 2022-02-26 14:00 CET
Nmap scan report for Xiaomi.fritz.box (192.168.178.73)
Host is up (0.0077s latency).
Not shown: 995 closed tcp ports (conn-refused)
PORT      STATE SERVICE         VERSION
8008/tcp  open  http?
8009/tcp  open  ssl/ajp13?
8443/tcp  open  ssl/https-alt?
9000/tcp  open  ssl/cslistener?
10001/tcp open  ssl/scp-config?
7

Short the TX and RX pins of your serial cable, and type something in your terminal app, the typing should be echoed back to you.

That's on the computer side, there's no way of knowing what does and doesn't work on the unit side.

8

@frollic

thanks a lot!!! , I used the wrong cable.... red insted green....

RX green
GND black
TX white

now my input works!

can interrupt the boot..... but did not get a console after the boot process is done
with pressing enter a few times

9

Boot interrupt - got prompt

axg_s420_v1_gva#help
?       - alias for 'help'
aml_sysrecovery- Burning with amlogic format package from partition sysrecovery
amlmmc  - AMLMMC sub system
amlnf   - aml mtd nand sub-system
autoscr - run script from memory
avb     - avb
base    - print or set address offset
bcb     - bcb
boot_cooling- cpu temp-system
booti   - boot arm64 Linux Image image from memory
bootm   - boot application image from memory
chpart  - change active partition
clkmsr  - Amlogic measure clock
cmp     - memory compare
cp      - memory copy
crc32   - checksum calculation
dcache  - enable or disable data cache
defenv_reserv- reserve some specified envs after defaulting env
echo    - echo args to console
efuse   - efuse commands
efuse_user- efuse user space read write ops
emmc    - EMMC sub system
env     - environment handling commands
exit    - exit script
false   - do nothing, unsuccessfully
fastboot- use USB Fastboot protocol
fatinfo - print information about filesystem
fatload - load binary file from a dos filesystem
fatls   - list files in a directory (default /)
fatsize - determine a file's size
fdt     - flattened device tree utility commands
forceupdate- forceupdate
get_avb_mode- get_avb_mode
get_bootloaderversion- print bootloader version
get_rebootmode- get reboot mode
get_system_as_root_mode- get_system_as_root_mode
get_valid_slot- get_valid_slot
go      - start application at address 'addr'
gpio    - query and control gpio pins
help    - print command description/usage
i2c     - I2C sub-system
icache  - enable or disable instruction cache
imgread - Read the image from internal flash with actual size
itest   - return true/false on integer compare
jtagoff - disable jtag
jtagon  - enable jtag
keyman  - Unify key ops interfaces based dts cfg
keyunify- key unify sub-system
loop    - infinite loop on address range
md      - memory display
mm      - memory modify (auto-incrementing address)
mmc     - MMC sub system
mmcinfo - display MMC info
mtdparts- define flash/nand partitions
mw      - memory write (fill)
mwm     - mw mask function
nand    - NAND sub-system
nboot   - boot from NAND device
nm      - memory modify (constant address)
open_scp_log- print SCP messgage
printenv- print environment variables
query   - SoC query commands
readMetadata- readMetadata
read_temp- cpu temp-system
reboot  - set reboot mode and reboot system
reset   - Perform RESET of the CPU
ringmsr - Amlogic measure ring
rpmb_state- RPMB sub-system
rsvmem  - reserve memory
run     - run commands in an environment variable
saradc  - saradc sub-system
saradc_12bit- saradc sub-system
saveenv - save environment variables to persistent storage
sdc_burn- Burning with amlogic format package in sdmmc 
sdc_update- Burning a partition with image file in sdmmc card
set_active_slot- set_active_slot
set_trim_base- cpu temp-system
set_usb_boot- set usb boot mode
setenv  - set environment variables
showvar - print local hushshell variables
sleep   - delay execution for some time
store   - STORE sub-system
systemoff- system off 
tee_log_level- update tee log level
temp_triming- cpu temp-system
test    - minimal test like /bin/sh
true    - do nothing, successfully
ubi     - ubi commands
ubifsload- load file from an UBIFS filesystem
ubifsls - list files in a directory
ubifsmount- mount UBIFS volume
ubifsumount- unmount UBIFS volume
unpackimg- un pack logo image into pictures
update  - Enter v2 usbburning mode
usb     - USB sub-system
usb_burn- Burning with amlogic format package in usb 
usb_update- Burning a partition with image file in usb host
usbboot - boot from USB device
version - print monitor, compiler and linker version
vpp     - vpp sub-system
watchdog- enable or disable watchdog
write_trim- cpu temp-system
write_version- cpu temp-system
axg_s420_v1_gva#

axg_s420_v1_gva#printenv
EnableSelinux=enforcing
active_slot=normal
adb_setting=if itest ${factory_mode} == 1; then run clr_adb_debuggable;else run set_adb_debuggable;fi;
baudrate=115200
bcb_cmd=get_valid_slot;
boot_part=boot
bootargs=rootfstype=ramfs init=/init ramoops.pstore_en=1 ramoops.record_size=0x8000 ramoops.console_size=0x4000 mtdblock.ro_fspart=system mtdblock.ro_fspart_2nd=chrome loglevel=0 quiet logo0
bootcmd=run storeboot
bootdelay=1
bootloader_version=U-Boot 2015.01-gfe79c6daed-dirty
clr_adb_debuggable=echo disable adb debug prop;setenv bootargs ${bootargs} android.debuggable=0 android.secure=1;setenv bootargs ${bootargs} console=ttyS9,115200 no_console_suspend;
cmdline_keys=if keyman init 0x1234; then if keyman read deviceid ${loadaddr} str; then setenv bootargs ${bootargs} androidboot.serialno=${deviceid};setenv serial ${deviceid};else setenv boo;
country=WW
deviceid=29432/A0SFxxxx
dtb_mem_addr=0x1000000
factory_mode=0
factory_reset_poweroff_protect=echo wipe_data=${wipe_data}; echo wipe_cache=${wipe_cache};if test ${wipe_data} = failed; then run storeargs;if mmcinfo; then run recovery_from_sdcard;fi;if u 
fdt_high=0x20000000
firstboot=1
identifyWaitTime=750
initargs=rootfstype=ramfs init=/init ramoops.pstore_en=1 ramoops.record_size=0x8000 ramoops.console_size=0x4000 mtdblock.ro_fspart="system" mtdblock.ro_fspart_2nd="chrome" loglevel=0 quiet
irremote_update=if irkey 2500000 0xe31cfb04 0xb748fb04; then echo read irkey ok!; if itest ${irkey_value} == 0xe31cfb04; then run update;else if itest ${irkey_value} == 0xb748fb04; then run\
fi;fi;fi;
jtag=disable
loadaddr=1080000
preboot=run bcb_cmd; run factory_reset_poweroff_protect;run upgrade_check;run storeargs;run adb_setting;run switch_bootmode;
reboot_mode=cold_boot
recovery_from_backup=setenv bootargs ${bootargs} console=ttyS0,115200 no_console_suspend earlycon=aml_uart,0xff803000;setenv bootargs ${bootargs} aml_dt=${aml_dt} recovery_part={recovery_pa 
recovery_from_flash=setenv bootargs ${bootargs} console=ttyS0,115200 no_console_suspend earlycon=aml_uart,0xff803000;setenv bootargs ${bootargs} aml_dt=${aml_dt} recovery_part={recovery_pari
recovery_from_sdcard=if fatload mmc 0 ${loadaddr} aml_autoscript; then autoscr ${loadaddr}; fi;if fatload mmc 0 ${loadaddr} recovery.img; then if fatload mmc 0 ${dtb_mem_addr} dtb.img; then;
recovery_from_udisk=if fatload usb 0 ${loadaddr} aml_autoscript; then autoscr ${loadaddr}; fi;if fatload usb 0 ${loadaddr} recovery.img; then if fatload usb 0 ${dtb_mem_addr} dtb.img; then ;
recovery_offset=0
recovery_part=recovery
rpmb_state=0
sdc_burning=sdc_burn ${sdcburncfg}
sdcburncfg=aml_sdc_burn.ini
serial=29432/A0SFxxxxx
set_adb_debuggable=echo enable adb debug prop;setenv bootargs ${bootargs} android.debuggable=1 android.secure=0;setenv bootargs ${bootargs} console=ttyS0,115200 no_console_suspend earlycon=;
stderr=serial
stdin=serial
stdout=serial
storeargs=get_bootloaderversion;setenv bootargs ${initargs} logo=${display_layer},loaded,androidboot.selinux=${EnableSelinux} androidboot.firstboot=${firstboot} jtag=${jtag}; setenv bootarg;
storeboot=if imgread kernel ${boot_part} ${loadaddr}; then bootm ${loadaddr}; fi;run update;
switch_bootmode=get_rebootmode;if test ${reboot_mode} = factory_reset; then run recovery_from_flash;else if test ${reboot_mode} = update; then run update;else if test ${reboot_mode} = cold_;
try_auto_burn=update 700 750;
update=run usb_burning; run sdc_burning; if mmcinfo; then run recovery_from_sdcard;fi;if usb start 0; then run recovery_from_udisk;fi;if itest ${upgrade_step} == 4; then run recovery_from_bi
upgrade_check=echo recovery_status=${recovery_status};if itest.s "${recovery_status}" == "in_progress"; then run storeargs; run recovery_from_flash;else fi;echo upgrade_step=${upgrade_step};
upgrade_key=if gpio input GPIOAO_3; then echo detect upgrade key; run update;fi;
upgrade_step=2
usb_burning=update 1000 3500
wipe_cache=successful
wipe_data=successful

Environment size: 6574/65532 bytes

U-Boot 2015.01-gfe79c6daed-dirty (Aug 27 2020 - 14:13:41)
aarch64-none-elf-gcc (crosstool-NG linaro-1.13.1-4.9-2014.09 - Linaro GCC 4.9-2014.09) 4.9.2 20140904 (prerelease)
GNU ld (crosstool-NG linaro-1.13.1-4.9-2014.09 - Linaro GCC 4.9-2014.09) 2.24.0.20140829 Linaro 2014.09

axg_s420_v1_gva#nand info

Device 0: A revision NAND 2Gib TC58NVG1S3HBAI4 , sector size 128 KiB
  Page size      2048 b
  OOB size         64 b
  Erase size   131072 b
  size        2097152 b
Device 1: A revision NAND 2Gib TC58NVG1S3HBAI4 , sector size 128 KiB
  Page size      2048 b
  OOB size         64 b
  Erase size   131072 b
  size       268435456 b
axg_s420_v1_gva#

axg_s420_v1_gva#mtdparts
0x000000000000-0x000000200000 : "bootloader"
0x000000800000-0x000001000000 : "tpl"
0x000001000000-0x000001a00000 : "recovery"
0x000001a00000-0x000002600000 : "boot"
0x000002600000-0x000003600000 : "system"
0x000003600000-0x000007a00000 : "chrome"
0x000007a00000-0x000007e00000 : "factory"
0x000007e00000-0x000010000000 : "data"
10

Front

L09G_FrontSide
L09G_FrontSide1920×2560 282 KB

Back

L09G_Backside
L09G_Backside1920×2560 439 KB

11

Tryed to find 5V at the USB1 connector

L09G_USB_Serial

But no success....

Any hint ?

12

Why would you need it?

13

This is an amlogic SOC, likely an s805 based on the boot messages, commonly used in media devices. I’m not aware of any openwrt devices / images for that type of device.

If it’s a later device s9xxx perhaps odroid images will boot.

However, Linux can run on amlogic devices fairly easily as some of the cpus have mainline support.

Interesting project, but you have a lot of work ahead of you.

There’s an unofficial list of images for media devices here

But nothing for S8xxx socs - if that is what your device has.

14

More Info thanks to lemmi from freifunk-franken

looks like the CPU is: " arm cortex-a53 "

printenv ---> search for dtb_mem_addr
fdt addr 0x1000000
fdt print

snip from fdt print

		cpu@0 {
			device_type = "cpu";
			compatible = "arm,cortex-a53", "arm,armv8";
			reg = <0x00000000 0x00000000>;
			enable-method = "psci";
			clocks = <0x00000006 0x00000000>;
			clock-names = "cpu-cluster.0";
			cpu-idle-states = <0x00000007>;
			phandle = <0x00000002>;
		};
		cpu@1 {
			device_type = "cpu";
			compatible = "arm,cortex-a53", "arm,armv8";
			reg = <0x00000000 0x00000001>;
			enable-method = "psci";
			clocks = <0x00000006 0x00000000>;
			clock-names = "cpu-cluster.0";
			cpu-idle-states = <0x00000007>;
			phandle = <0x00000003>;
		};
		cpu@2 {
			device_type = "cpu";
			compatible = "arm,cortex-a53", "arm,armv8";
			reg = <0x00000000 0x00000002>;
			enable-method = "psci";
			clocks = <0x00000006 0x00000000>;
			clock-names = "cpu-cluster.0";
			cpu-idle-states = <0x00000007>;
			phandle = <0x00000004>;
		};
		cpu@3 {
			device_type = "cpu";
			compatible = "arm,cortex-a53", "arm,armv8";
			reg = <0x00000000 0x00000003>;
			enable-method = "psci";
			clocks = <0x00000006 0x00000000>;
			clock-names = "cpu-cluster.0";
			cpu-idle-states = <0x00000007>;
			phandle = <0x00000005>;
		};

the hole output you can see here:

https://pastebin.com/6EBAQi7L

15

@jdwl1o1: thank you!

16

A53 would indicate it is an s905 series SOC, which will be easier to find support for. Best of luck.

17

@jdwl1o1

thank you!
any hint how to find more about the CPU!

the Dump of the Firmware takes many hours...
the first run was unsuccesfull 395MB file

minicom -b 115200 -D /dev/ttyUSB0 (more baudrate will not work)
CTRL+A L (set filename: MiSpeakerL09G.cap)

md.b 0x000000000000 0x000010000000

file MiSpeakerL09G.cap
MiSpeakerL09G.cap: ASCII text

ls -lathr MiSpeakerL09G.cap
-rw-r--r-- 1 user1 user1 395M Mar  3 22:21 MiSpeakerL09G.cap

because the convert to .BIN did not work...

python3 uboot_mdb_to_image.py < MiSpeakerL09G.cap > MiSpeakerL09G_FW.bin


Traceback (most recent call last):
  File "/home/ds/uboot_mdb_to_image.py", line 34, in <module>
    data, ascii_data = line.split("    ", maxsplit = 1)
ValueError: not enough values to unpack (expected 2, got 1)

$ ls -lathr MiSpeakerL09G_FW.bin
-rw-r--r-- 1 user1 user1 81M Mar 4 07:21 MiSpeakerL09G_FW.bin

python3 uboot_mdb_to_image.py < MiSpeakerL09G.cap | hexdump -C

050fffd0  34 d2 79 a0 69 82 28 48  88 11 5d 70 7d 20 05 be  |4.y.i.(H..]p} ..|
050fffe0  33 ea 8b d3 bc 2b 19 b7  ff 86 67 f6 f8 c2 e8 f1  |3....+....g.....|
050ffff0  e7 f3 a5 5b 1c 97 92 ca  26 2a a7 ea b9 07 d4 da  |...[....&*......|
05100000

binwalk MiSpeakerL09G_FW.bin


DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
16777216      0x1000000       Flattened device tree, size: 45983 bytes, version: 17
16800443      0x1005ABB       eCos RTOS string reference: "ecos"
16800494      0x1005AEE       eCos RTOS string reference: "ecos_memory"
16816476      0x100995C       eCos RTOS string reference: "ecos"
16822820      0x100B224       eCos RTOS string reference: "ecos_reserved"
17360416      0x108E620       CRC32 polynomial table, little endian
17361440      0x108EA20       CRC32 polynomial table, little endian
17372280      0x1091478       LZO compressed data
17372296      0x1091488       LZO compressed data
17377728      0x10929C0       SHA256 hash constants, little endian
17396542      0x109733E       Unix path: /dev/block/misc partiton is saved some contents:
17431226      0x109FABA       Android bootimg, kernel size: 1920091392 bytes, kernel addr: 0x203A726F, ramdisk size: 1819042157 bytes, ramdisk addr: 0x6920636F, product name: "ve failed!"
17439432      0x10A1AC8       eCos RTOS string reference: "ecos status okay;"
17439531      0x10A1B2B       eCos RTOS string reference: "ecos reg <0x%x 0x%x>;"
17439585      0x10A1B61       eCos RTOS string reference: "ecos reg <0x0 0x%x 0x0 0x%x>;"
17440802      0x10A2022       Unix path: /dev/block/vbmeta
17496934      0x10AFB66       Unix path: /lib/libavb/avb_chain_partition_descriptor.c
17497217      0x10AFC81       Unix path: /lib/libavb/avb_cmdline.c
17497871      0x10AFF0F       Unix path: /lib/libavb/avb_descriptor.c
17498362      0x10B00FA       Unix path: /lib/libavb/avb_footer.c
17498452      0x10B0154       Unix path: /lib/libavb/avb_hash_descriptor.c
17498522      0x10B019A       Unix path: /lib/libavb/avb_hashtree_descriptor.c
17498603      0x10B01EB       Unix path: /lib/libavb/avb_kernel_cmdline_descriptor.c
17498693      0x10B0245       Unix path: /lib/libavb/avb_property_descriptor.c
17498824      0x10B02C8       Unix path: /lib/libavb/avb_rsa.c
17499160      0x10B0418       Unix path: /lib/libavb/avb_slot_verify.c
17502458      0x10B10FA       Unix path: /lib/libavb/avb_util.c
17502791      0x10B1247       Unix path: /lib/libavb/avb_vbmeta_image.c
24363673      0x173C299       Android bootimg, kernel size: 1280131328 bytes, kernel addr: 0x55434553, ramdisk size: 1094713377 bytes, ramdisk addr: 0x61004C4D, product name: ""
24368288      0x173D4A0       SHA256 hash constants, little endian
24768166      0x179EEA6       SHA256 hash constants, little endian
27056128      0x19CD800       Flattened device tree, size: 45983 bytes, version: 17
27079355      0x19D32BB       eCos RTOS string reference: "ecos"
27079406      0x19D32EE       eCos RTOS string reference: "ecos_memory"
27095388      0x19D715C       eCos RTOS string reference: "ecos"
27101732      0x19D8A24       eCos RTOS string reference: "ecos_reserved"
33996694      0x206BF96       SHA256 hash constants, little endian
70516873      0x4340089       MySQL ISAM compressed data file Version 2
77025034      0x4974F0A       COBALT boot rom data (Flat boot rom or file system)

binwalk -e MiSpeakerL09G_FW.bin

~/tmp/_MiSpeakerL09G_FW.bin.extracted$ ls -lathr

total 129M
drwxr-xr-x 2 user1 user1 4.0K Mar  4 07:42 .
drwxr-xr-x 3 user1 user1 4.0K Mar  4 07:42 ..
-rw-r--r-- 1 user1 user1  65M Mar  4 07:42 1091478.lzo
-rw-r--r-- 1 user1 user1  65M Mar  4 07:42 1091488.lzo

file 1091478.lzo
1091478.lzo: lzop compressed data - version 0.000, os: MS-DOS
file 1091488.lzo
1091488.lzo: lzop compressed data - version 0.000, os: MS-DOS

lzop -l 1091488.lzo
lzop: 1091488.lzo: header corrupted
lzop -l 1091478.lzo 
lzop: 1091478.lzo: header corrupted

binwalk --dd='.*' MiSpeakerL09G_FW.bin

~/tmp/_MiSpeakerL09G_FW.bin.extracted$ ls -lathr
total 2.3G
drwxr-xr-x 2 user1 user1 4.0K Mar  4 08:04 .
drwxr-xr-x 4 user1 user1 4.0K Mar  4 08:03 ..
-rw-r--r-- 1 user1 user1  65M Mar  4 08:03 1000000
-rw-r--r-- 1 user1 user1  65M Mar  4 08:03 1005ABB
-rw-r--r-- 1 user1 user1  65M Mar  4 08:03 1005AEE
-rw-r--r-- 1 user1 user1  65M Mar  4 08:03 100995C
-rw-r--r-- 1 user1 user1  65M Mar  4 08:03 100B224
-rw-r--r-- 1 user1 user1  65M Mar  4 08:03 108E620
-rw-r--r-- 1 user1 user1  65M Mar  4 08:03 108EA20
-rw-r--r-- 1 user1 user1  65M Mar  4 08:03 1091478
-rw-r--r-- 1 user1 user1  65M Mar  4 08:03 1091488
-rw-r--r-- 1 user1 user1  65M Mar  4 08:03 10929C0
-rw-r--r-- 1 user1 user1  65M Mar  4 08:03 109733E
-rw-r--r-- 1 user1 user1  65M Mar  4 08:03 109FABA
-rw-r--r-- 1 user1 user1  65M Mar  4 08:03 10A1AC8
-rw-r--r-- 1 user1 user1  65M Mar  4 08:03 10A1B2B
-rw-r--r-- 1 user1 user1  65M Mar  4 08:03 10A1B61
-rw-r--r-- 1 user1 user1  65M Mar  4 08:03 10A2022
-rw-r--r-- 1 user1 user1  65M Mar  4 08:03 10AFB66
-rw-r--r-- 1 user1 user1  65M Mar  4 08:03 10AFC81
-rw-r--r-- 1 user1 user1  65M Mar  4 08:03 10AFF0F
-rw-r--r-- 1 user1 user1  65M Mar  4 08:03 10B00FA
-rw-r--r-- 1 user1 user1  65M Mar  4 08:03 10B0154
-rw-r--r-- 1 user1 user1  65M Mar  4 08:03 10B019A
-rw-r--r-- 1 user1 user1  65M Mar  4 08:03 10B01EB
-rw-r--r-- 1 user1 user1  65M Mar  4 08:03 10B0245
-rw-r--r-- 1 user1 user1  65M Mar  4 08:03 10B02C8
-rw-r--r-- 1 user1 user1  65M Mar  4 08:03 10B0418
-rw-r--r-- 1 user1 user1  65M Mar  4 08:03 10B10FA
-rw-r--r-- 1 user1 user1  65M Mar  4 08:03 10B1247
-rw-r--r-- 1 user1 user1  58M Mar  4 08:04 173C299
-rw-r--r-- 1 user1 user1  58M Mar  4 08:04 173D4A0
-rw-r--r-- 1 user1 user1  58M Mar  4 08:04 179EEA6
-rw-r--r-- 1 user1 user1  56M Mar  4 08:04 19CD800
-rw-r--r-- 1 user1 user1  56M Mar  4 08:04 19D32BB
-rw-r--r-- 1 user1 user1  56M Mar  4 08:04 19D32EE
-rw-r--r-- 1 user1 user1  56M Mar  4 08:04 19D715C
-rw-r--r-- 1 user1 user1  56M Mar  4 08:04 19D8A24
-rw-r--r-- 1 user1 user1  49M Mar  4 08:04 206BF96
-rw-r--r-- 1 user1 user1  14M Mar  4 08:04 4340089
-rw-r--r-- 1 user1 user1 7.6M Mar  4 08:04 4974F0A

$ file 109FABA
109FABA: Android bootimg, kernel (0x203a726f), ramdisk (0x6920636f), second stage (0x6f72646e), page size: 1701273965, name: ge_need_move failed!\012, cmdline (c_addr =%lx\012

file 173C299
173C299: Android bootimg, kernel (0x55434553), ramdisk (0x61004c4d), second stage (0x203a676f), page size: 1713404261

$ abootimg -i 173C299
173C299: sizes mismatches in boot image
173C299: not a valid Android Boot Image.

$ abootimg -i 109FABA
109FABA: sizes mismatches in boot image
109FABA: not a valid Android Boot Image.

Using the: 32bit Programm: https://storage.googleapis.com/google-code-archive-downloads/v2/code.google.com/android-serialport-api/android_bootimg_tools.tar.gz

$ ~/unpackbootimg -i 173C299

BOARD_KERNEL_CMDLINE  check pass!

BOARD_KERNEL_BASE 5542c553
BOARD_PAGE_SIZE 1713404261

$ ~/unpackbootimg -i 109FABA

BOARD_KERNEL_CMDLINE c_addr =%lx

BOARD_KERNEL_BASE 2039f26f
BOARD_PAGE_SIZE 1701273965

Got this files

-rw-r--r-- 1 user1 user1 11 Mar 4 08:35 173C299-pagesize
-rw-r--r-- 1 user1 user1 14 Mar 4 08:35 173C299-cmdline
-rw-r--r-- 1 user1 user1 9 Mar 4 08:35 173C299-base
-rw-r--r-- 1 user1 user1 1.2G Mar 4 08:35 173C299-zImage
-rw-r--r-- 1 user1 user1 1.1G Mar 4 08:35 173C299-ramdisk.gz
-rw-r--r-- 1 user1 user1 11 Mar 4 08:36 109FABA-pagesize
-rw-r--r-- 1 user1 user1 13 Mar 4 08:36 109FABA-cmdline
-rw-r--r-- 1 user1 user1 9 Mar 4 08:36 109FABA-base
-rw-r--r-- 1 user1 user1 1.8G Mar 4 08:36 109FABA-zImage
-rw-r--r-- 1 user1 user1 1.7G Mar 4 08:36 109FABA-ramdisk.gz

18

Do you have console access? You can get cpu details from /proc/cpuinfo

19

@jdwl1o1

Do you have console access?

Unfortunately, no

20

Did a 2nd DUMP it is 395 MB too ( filename: minicomnew.cap )

last Lines:

050ffff0: e7 f3 a5 5b 1c 97 92 ca 26 2a a7 ea b9 07 d4 da ...[....&*......
05100000:"Synchronous Abort" handler, esr 0x96000010

Then the Device is start booting

python3 uboot_mdb_to_image.py < minicomnew.cap > minicomnew.bin

this time no error

ls -lathr minicomnew.bin 
-rw-r--r-- 1 user1 user1 81M Mar  5 07:16 minicomnew.bin

binwalk --dd='.*' ../minicomnew.bin

here the log:

The export is 28 GB

du -h _minicomnew.bin.extracted/
28G	_minicomnew.bin.extracted/