Repository files navigation

These instructions apply only to:

• The European version of the gateway mieu01 from Xiaomi, with a European plug
• A version of the gateway from Aqara ZHWG11LM, with a Chinese or European plug.

The instructions will not work for the Xiaomi gateway2 version, with theChinese plug DGNWG02LM. That version has other hardware components installed.

Table of Contents

• Before you begin
  • Make a backup
• Flash your device over the air
  • Error recovery: the Over-the-Air method did not work for you
• Upgrade to new versions
• How to use OpenWrt
  • Connect the gateway to your router
  • Working with ZigBee
  • Other software you might want to use
• Restore settings
  • Reset to the defaults
  • Return to stock firmware
• Reference of general-purpose input/output (GPIO)
• Links

• Get root
• Make a backup

These instructions assume that you already have ssh access to the gateway.If you do not,follow the instructions to get root.

Do make a back-up copy.

If you decide to return to the stock firmware, you will need thetar.gzbackup from your device, with an archive of your root filesystem.

You cannot use ageneric backup, because all firmware contains uniqueIDs and keys.

This command will send the content of the files with keys totermbin.com andprint you an URL in console. Open the link in a browser and save the content.It will help you to restore keys using generic backup.

cd /lumi/conf/forfnin*;doprintf"=== Start$fn ===\n"; cat"$fn";printf"=== End$fn ===\n";done|  nc termbin.com 9999

Links to download generic backups without keys to connect to Xiaomi Cloud (replace with keys from backup):

• Xiaomi
• Aqara

tar -cvpzf /tmp/lumi_stock.tar.gz -C /. --exclude='./tmp/*' --exclude='./proc/*' --exclude='./sys/*'

After the backup is done,download it to your local computer.

scp root@*GATEWAY_IP*:/tmp/lumi_stock.tar.gz.

You can also use WinScp inscp mode (dropbear on the gateway doesn't support sftpmode).

Even if you already have made a rootfs image with dd,make an archive anyway.

During the boot phase of the dd image, nand flash or ubifs errors usuallyoccur. Using thetar.gz option avoids these drawbacks, because itformats the flash before writing the files.

Flashing your device over the air (OTA) is the easiest and recommended way.The method does not require soldering, and you can do it with a serial consoleor via ssh.

Before flashing, make sure that the gateway is connected to the internet.You also need to double-check that you don't have any redundant archives in the/tmp directory. You'll need space to download the firmware binaries.

The following commands work only on stock firmware:

echo -e"GET /openlumi/owrt-installer/main/install.sh HTTP/1.0\nHost: raw.githubusercontent.com\n"| openssl s_client -quiet -connect raw.githubusercontent.com:443 -servername raw.githubusercontent.com2>/dev/null| sed'1,/^\r$/d'| bash

This command stops all the processes on the gateway. If you are updating via ssh,the connection will drop─this is normal. The flashing process takes a fewminutes. After it is done, the gateway will create an open Wi-Fi network withthe nameOpenWrt.

If the preceding method fails for some reason, you can bring the gateway backto life by soldering the usb and uart, and flashing it throughmfgtools.

See the instructions to flash over USB

Newer releases can be found in thereleasessection. To upgrade, you can use System -> Backup/Flash firmware section in UI and useappropriate sysupgrade image. Or run consolesysupgrade <image_file> command. SeeOpenWrt documentation.

Older versions (19.07 - 22.03) are moved to archive and can be found in thearchive

You can upgrade from 21 -> 22 -> 23 freely.

To upgrade from 19.07 to 21.02 you need to flash DTB partition according to your device and U-BOOT first.Or simply run the script:

For xiaomi, not suitable for aqara

wget https://gist.githubusercontent.com/devbis/1b71d1a18e6b0b41250154a35a17a614/raw/dgnwg05lm-19-to-21.sh -O -| sh

For aqara, not suitable for xiaomi

wget https://gist.githubusercontent.com/devbis/1b71d1a18e6b0b41250154a35a17a614/raw/zhwg11lm-19-to-21.sh -O -| sh

You need to flash DTB partition to enable support for in-kernel NAND driver.

For xiaomi:

wget https://openlumi.github.io/releases/24.10.0/targets/imx/cortexa7/openlumi-24.10.0-imx-cortexa7-imx6ull-xiaomi-dgnwg05lm.dtb -O /tmp/openlumi-imx-cortexa7-imx6ull-xiaomi-dgnwg05lm.dtb[-f /tmp/openlumi-imx-cortexa7-imx6ull-xiaomi-dgnwg05lm.dtb ]&& flash_erase /dev/mtd2 0 0&& nandwrite -p /dev/mtd2 -p /tmp/openlumi-imx-cortexa7-imx6ull-xiaomi-dgnwg05lm.dtb

For aqara:

wget https://openlumi.github.io/releases/24.10.0/targets/imx/cortexa7/openlumi-24.10.0-imx-cortexa7-imx6ull-aqara-zhwg11lm.dtb -O /tmp/openlumi-imx-cortexa7-imx6ull-aqara-zhwg11lm.dtb[-f /tmp/openlumi-imx-cortexa7-imx6ull-aqara-zhwg11lm.dtb ]&& flash_erase /dev/mtd2 0 0&& nandwrite -p /dev/mtd2 -p /tmp/openlumi-imx-cortexa7-imx6ull-aqara-zhwg11lm.dtb

After flashing, the gateway creates an open Wi-Fi network with thename OpenWrt.

1. To connect the gateway to your router, connect to the network and go tohttp://192.168.1.1/ .

   The default credentials for the gateway are:

   • login 'root': without a password.

2. Go to the sectionNetwork > Wireless

   

3. Press theScan button against the first interfaceradio0. After a few seconds, you will see a list of networks. Find your network and pressJoin Network

   

4. In the pop-up window, set the "Replace wireless configuration" checkbox. Enter the passphrase from your Wi-Fi network below

   

5. Confirm the settings on the next window, press theSave.

   

6. To apply the changes correctly, disable Access Poing by pressingDisable for the connection for the second interface.

   

   The gateway will disconnect you from AP and apply the changes.After the firmware, the mac address of the gateway changes, because the IP addressalso most likely changes. Check it in the router or in the gateway itself.

The gateway is pre-installed:

• OpenWrt LuCi GUI on port 80 http
• command utility for flashing zigbee module jn5169
• Web plugin for LuCi to flash a firmware

Do not enable Wi-Fi AP + Station modes on the gateway at the same time.The driver that is used in the system cannot work in two modesat the same time.

If you changed the LuCi settings and the gateway stopped connecting to the network,press the button on the gateway for 10 seconds. It will blink yellow 3 timesand with start the initial network configuration mode with the create Wi-FiAccess Point.

The Zigbee chip can work only with a single system. You have to choose whichprogram you'd like to use. At the same time, you can use zigbee2mqtt to workwith Zigbee and domoticz for other automation.

1. Installing Zigbee2mqtt
2. Installing Home Assistant with ZHA component
3. Installing Domoticz and configuring Zigate plugin

1. https://github.com/openlumi/lumimqtt/ - a service that lets you manage gateway devices over the MQTT
2. https://flows.nodered.org/node/node-red-contrib-xiaomi-gateway - a package for node red

If you want to go back some steps, these instructions can help you.

Be careful with resetting, all programs and settings will be erased.Use it in case of emergency, when resetting Wi-Fi credentials does not help.

To go back to the initial set up (like you just flashed the gateway), there aretwo ways to erase the data on the OpenWRT:

• Hold the button.

  You must hold the gateway button for 20 seconds.The gateway will blink red 3 times and reset to the initial set up forcreating a Wi-Fi Access

• UART

  Connect the gateway with the UART 2 USB adapter (like in the stepget root) and wait for the system to load.

  Enter the following commands.

  firstboot -y && reboot now

• pressf multiple times while booting in progress for enter tofailsafe mode.
• Runubirmvol /dev/ubi0 -Nrootfs_data && ubimkvol /dev/ubi0 -Nrootfs_data -m.
• This step sometimes fails. In that case, revert back to stock firmware and repeat the process of flashing OpenWrt

To return to the stock firmware, you need to flash the original kernel, DTB,and rootfs from your backup. The Kernel and DTB are the same for all gateways.To keep the Mi Home working, you'll need your tar.gz backup.

mfgtools to return to the stock firmware

Name your backuplumi_stock.tar.gz. Put it in the directoryProfiles/Linux/OS Firmware/files. This overwrites the empty filelumi_stock.tar.gz

Then put the gateway intoUSB boot mode (>bmode usb in bootloader shell (press any key during boot) via USB (you have to solder USB A cable to the USB interface next to UART. ID pin is not required) and usemfgtools toflash the original firmware. If you get -29 error in mfgtools, check whether you're not running two instances of mfgtools.

To flash zigbee firmware back, you should log in to the gateway with stockfirmware and run the command

touch /home/root/need_update_coordinator.tag

Then reboot. Once restarted, the gateway will automatically restore Zigbeefirmware.

To allow zigbee chip accepting devices you have to clear internal memory PDM:

stty -F"/dev/ttymxc1" raw 115200printf'\x01\x02\x10\x12\x02\x10\x02\x10\x12\x03'> /dev/ttymxc1

Kudos to @Clear_Highway and @lmahmutov for these.

Install the kernel modules:

opkg updateopkg install gpioctl-sysfsopkg install kmod-spi-gpioopkg install kmod-spi-devopkg install kmod-spi-gpio-custom

Control─working with GPIO pins:

echo"69"> /sys/class/gpio/exportecho"70"> /sys/class/gpio/exportecho"out"> /sys/class/gpio/gpio69/directionecho"out"> /sys/class/gpio/gpio70/directionecho"1"> /sys/class/gpio/gpio70/valueecho"0"> /sys/class/gpio/gpio70/value

GPIO numbers. Contact numbers start from the lowest and go up.DOWN and UP represents the type of pulling. Down to GND, UP - 3.3v

1. An article that details the changes and technical modifications:[Xiaomi Gateway (eu version - Lumi.gateway.mieu01) Hacked] (https://habr.com/ru/post/494296/)
2. Collection of information on hardware and software modding of Xiaomi Gatewayhttps://github.com/T-REX-XP/XiaomiGatewayHack
3. Telegram channel with discussion of modificationshttps://t.me/xiaomi_gw_hack