Beken BK7231/BK7252 SPI flashing and recovery - new flasher tool and protocol specs

p.kaczmarek2 8640 268

Report a violation of the law

Reply Cool? Ranking DIY | New topic

Notify about new articles

📢 Listen (AI):

#151 21794507 31 Dec 2025 10:55

insmod insmod

Level 31

Helpful post? (0)

Post #151
21794507 31 Dec 2025 10:55

>>21794505
Basic communications should work, but first i would need to know bootrom version.
Only firmware dump would be supported.
ADVERTISEMENT
#152 21794521 31 Dec 2025 11:11

divadiow divadiow

Level 38

Helpful post? (0)

Post #152
21794521 31 Dec 2025 11:11

p.kaczmarek2 wrote:
I am not sure about BL702 currently, it was a Zigbee module.

ah k.

insmod wrote:
Did some additional fixes for BL, now write always succeeds for me on BL702 with 1024 buffer (and 4096 too).

yes, much better. at least 10 consecutive writes on BL602 have been successful @921600 for me. Also, it now catches with just BT+RST button depression between retries. Before I had to remove power and insert power again with BT pressed, which seemed odd.

I do see a VERY quick flash of red in the EF window, not on every write attempt. Nothing to say what it is in log I don't think. trying to capture it..

Added after 3 [minutes]:

got it
#153 21794534 31 Dec 2025 11:14

insmod insmod

Level 31

Helpful post? (+1)

Post #153
21794534 31 Dec 2025 11:14

Should be fixed now
#154 21794566 31 Dec 2025 12:31

divadiow divadiow

Level 38

Helpful post? (0)

Post #154
21794566 31 Dec 2025 12:31

insmod wrote:
know bootrom version

example 808? https://gist.github.com/lupyuen/0fde950460cff...pt.com#file-ox64-bldevcube-fail-1-8-3-log-L47

insmod wrote:
Should be fixed now

ok will do 10 more

Added after 44 [minutes]:

build 198 - 10x write success on BL602 at 921600 and 10x at 1000000.
ADVERTISEMENT
#155 21796177 02 Jan 2026 10:10

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Topic author Helpful post? (0)

Post #155
21796177 02 Jan 2026 10:10

divadiow wrote:

sadly no. @p.kaczmarek2 has BL702 though

It seems that you were right, but the one I found has only USB and currently I can't get it to be visible by PC:

I can't see any USB to UART converter on the board.

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.
#156 21796261 02 Jan 2026 11:41

insmod insmod

Level 31

Helpful post? (+1)

Post #156
21796261 02 Jan 2026 11:41

>>21796177
IO14 - TX, IO15 - RX

I think that #94 can be merged.
In last commit i changed flash id reading from string to raw and made xmodem compatible with old/checksum mode.

#157 21796284 02 Jan 2026 12:20

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Post #157

21796284 02 Jan 2026 12:20

Sure, thank you, merged.

How do you know IO14 and IO15 are TX/RX? It's strange they didn't put it on the tutorial image...

Hmmm

Beken BK7231/BK7252 SPI flashing and recovery - new flasher tool and protocol specs

Table fragment listing functions for pins PAD_GPIO_14 and PAD_GPIO_15

If IO14 is SIG6/SIG2 and IO15 is SIG7/SIG3, then... I see, it indeed matches.

Added after 16 [minutes]:

Boot log:


 
  ____               __  __      _       _       _     
 |  _ \             / _|/ _|      |     | |     | |    
 | |_) | ___  _   _| |_| |_ __ _| | ___ | | __ _| |__  
 |  _ < / _ \| | | |  _|  _/ _` | |/ _ \| |/ _` | '_ \ 
 | |_) | (_) | |_| | | | || (_| | | (_) | | (_| | |_) |
 |____/ \___/ \__,_|_| |_| \__,_|_|\___/|_|\__,_|_.__/ 

Build:21:37:42Nov  1 2022
Copyright (c) 2021 Bouffalolab team
dynamic memory init success,heap size = 50 Kbyte 
show flash cfg:
jedec id   0xC22013
mid            0xC2
iomode         0x11
clk delay      0x01
clk invert     0x01
read reg cmd0  0x05
read reg cmd1  0x00
write reg md0 0x01
write reg cmd1 0x00
qe write len   0x01
cread support  0x00
cread code     0x20
burst wrap cmd 0x77
-------------------
[main] SPI initial succsss!
[main] I2C inital success!
[main] ADC initial success!
[OS] Starting lcd task...
[OS] Starting micrec task...
Device List Print
Index 0
Device Nmme = dma_ch0 
Device Type = DMA 
eevice Handle = 0x42016060 
---------------------
Index 1
Device Name = adc 
Device Type = ADC 
Device Handle = 0x42016018 
---------------------
Index 2
Device Name = i2c 
Device Type = I2C 
Device Handle = 0x42016300 
---------------------
Index 3
Device Name = spi 
Device Type = SPI 
Device Handle = 0x42016344 
---------------------
Index 4
Device Name = debug_log 
Device Type = UART 
Device Handle = 0x42016398 
---------------------
[micrec] start success
[lcd] start success

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.

#158 21796317 02 Jan 2026 12:32

insmod insmod

Level 31

Helpful post? (0)

Post #158
21796317 02 Jan 2026 12:32

>>21796284
0xC22013 - only 512kb flash?
Flasher won't work then, it counts megabytes, not kilobytes.
(Or do custom read)
ADVERTISEMENT
#159 21796341 02 Jan 2026 12:58

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Topic author Helpful post? (0)

Post #159
21796341 02 Jan 2026 12:58

Suprising, i will give it a go when i return home. Still, how hard would it be to fix flasher?

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.
Helpful post

#160 21796363 02 Jan 2026 13:09

insmod insmod

Level 31

Helpful post? (+1)

Helpful post
Post #160
21796363 02 Jan 2026 13:09

>>21796341
https://github.com/openshwprojects/BK7231GUIFlashTool/pull/95

#161 21796494 02 Jan 2026 14:44

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Post #161

21796494 02 Jan 2026 14:44

Hmm it seems I need something more...



[14:37:36.943] - tx rx and power off, press the machine!
[14:37:36.944] - cutoff time is 0.05
[14:37:37.005] - power on tx and rx
[14:37:38.000] - reset cnt: 0, reset hold: 0.05, shake hand delay: 0.1
[14:37:38.000] - clean buf
[14:37:38.002] - send sync
[14:37:38.110] - ack is
[14:37:38.110] - retry
[14:37:38.111] - shake hand fail
[14:37:38.112] - ########################################################################
[14:37:38.112] - 请按照以下描述排查问题：
[14:37:38.112] - GPIO28是否上拉到板子自身的3.3V，而不是外部的3.3V
[14:37:38.112] - GPIO15(RX)是否连接到USB转串口的TX引脚
[14:37:38.112] - GPIO14(TX)是否连接到USB转串口的RX引脚
[14:37:38.112] - 在使用烧录软件进行烧录前，是否在GPIO28拉高的情况下，使用Reset/Chip_En复位了芯片
[14:37:38.112] - 烧录软件所选择的COM口，是否是连接芯片的串口
[14:37:38.113] - 烧录软件上选择的波特率是否是USB转串口支持的波特率
[14:37:38.113] - 3.3V供电是否正常
[14:37:38.113] - 板子供电电流是否正常(烧录模式下，芯片耗电电流5-7mA)
[14:37:38.113] - ########################################################################
[14:37:38.113] - shake hand fail
[14:37:38.127] - Load helper bin time cost(ms): 4551.508544921875
[14:37:38.129] - ErrorCode: 0003, ErrorMsg: BFLB LOAD HELP BIN FAIL
[14:37:38.130] - Burn Retry
[14:37:38.131] - 0
[14:37:38.133] - Burn return with retry fail
[14:37:38.134] - ========= flash read jedec ID =========
[14:37:38.135] - Flash load shake hand
[14:37:38.149] - default set DTR high
[14:37:38.265] - clean buf
[14:37:38.266] - send sync
[14:37:38.375] - ack is
[14:37:38.375] - retry
[14:37:38.375] - default set DTR high

Let's translate the message.


[14:37:38.112] - Please troubleshoot the issue according to the following description:
[14:37:38.112] - Is GPIO28 pulled up to the board’s own 3.3V, rather than an external 3.3V?
[14:37:38.112] - Is GPIO15 (RX) connected to the TX pin of the USB-to-serial adapter?
[14:37:38.112] - Is GPIO14 (TX) connected to the RX pin of the USB-to-serial adapter?
[14:37:38.112] - Before using the flashing software, was the chip reset via Reset/Chip_En while GPIO28 was pulled high?
[14:37:38.112] - Is the COM port selected in the flashing software the one connected to the chip’s serial port?
[14:37:38.113] - Is the baud rate selected in the flashing software supported by the USB-to-serial adapter?
[14:37:38.113] - Is the 3.3V power supply normal?
[14:37:38.113] - Is the board’s supply current normal? (In flashing mode, the chip current consumption is 5–7 mA)

Well, 28 is boot, i kept pressed boot button while I try

Flasher says IO8 not IO28

I will solder second row of goldpins to get IO28 acccess and to pull it myself, maybe the button on board is not having good contact

Helpful post? Buy me a coffee.

#162 21796499 02 Jan 2026 14:49

insmod insmod

Level 31

Helpful post? (0)

Post #162
21796499 02 Jan 2026 14:49

Hm, do you keep pressing boot button when trying to read flash?
One of my usb/uart adapters for example resets power when i open port.
#163 21796685 02 Jan 2026 18:29

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home
Topic author Helpful post? (0)

Post #163
21796685 02 Jan 2026 18:29

Yes, as I said, "kept pressed", I realized at the start that it's easy to confuse it with ESP where GPIO0 has to be low at the boot time, not whole time.

However...

I used jumper approach to add 10k pull up and now it works.

Code: text Expand Select all Copy to clipboard
[18:12:04.842] - Set flash config [18:12:04.846] - Set para time cost(ms): 3.99951171875 [18:12:04.846] - ========= flash read jedec ID ========= [18:12:04.849] - Read flash jedec ID [18:12:04.849] - flash jedec id: c2201380 [18:12:04.849] - Finished [18:12:04.881] - get flash size: [18:12:04.881] - ========= flash read jedec ID ========= [18:12:04.883] - Read flash jedec ID [18:12:04.883] - flash jedec id: c2201380 [18:12:04.883] - Finished

Added after 4 [minutes]:

Added after 9 [minutes]:

Added after 46 [seconds]:

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.
ADVERTISEMENT
Helpful post

#164 21798387 04 Jan 2026 13:32

insmod insmod

Level 31

Helpful post? (+2)

Helpful post
Post #164
21798387 04 Jan 2026 13:32

Major BL602/702 revamp: https://github.com/openshwprojects/BK7231GUIFlashTool/pull/96
Flasher will now generate partitions and app/boot headers on the fly instead of relying on prebuilt binaries made with bldevcube.
With this done, BL702 firmware can be flashed now, not just backups.
BL config read and write now depends on PSM partition.

I also made it so that date/time and errors are displayed in English, instead of the user's local language.
#165 21798460 04 Jan 2026 14:29

divadiow divadiow

Level 38
Helpful post? (0)

Post #165
21798460 04 Jan 2026 14:29

v204 BL602 4mb erase/write/dump went OK on first go

Attachments:

readResult_BL602_2026-04-1-13-27-33.bin Download (4 MB)
#166 21798470 04 Jan 2026 14:38

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Topic author Helpful post? (+1)

Post #166
21798470 04 Jan 2026 14:38

Testing:

It has PR index in version?

next read without reset at fastrer baud:

Next attempt without reset fails:

Or wait, it in general fails at 2000000. Or... it tries:

Well, it's really nice to see this @insmod implementation struggle and fight to the end, while other flashes give up right away.

1500000 is OK:

Write:

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.
#167 21798610 04 Jan 2026 16:26

insmod insmod

Level 31

Helpful post? (0)

Post #167
21798610 04 Jan 2026 16:26

Not PR, but just gh actions build number.
Command fail is just a thing when eflash loader is already uploaded. When it tries to get bootrom info - it fails.
Both BL602 and BL702 reads fine for me at 2000000 baud. Maybe because there are no wires, since my BL702 is a dev board, and BL602 is a module inserted into esp flasher board.
You can try to flash hello world example - https://github.com/Jatsekku/jq_flasher/blob/main/samples/helloworld/project.bin

It seems that bl_mcu_sdk got renamed - https://github.com/bouffalolab/bouffalo_sdk
And they now state that it is a combined bl_mcu_sdk and bl_iot_sdk.
#168 21798698 04 Jan 2026 17:43

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home
Topic author Helpful post? (0)

Post #168
21798698 04 Jan 2026 17:43

Sure, let's give it a try.
Code: text Expand Select all Copy to clipboard
Sync attempt 0/1000 ... failed, will retry! Sync attempt 1/1000 ... OK! Command fail! Flash ID: C2201380 Flash size is 0.5MB Eflash loader is already uploaded! Reading C:\Users\Mike\Downloads\project.bin... Writing... Erasing from 0x0 to 0xA000 Command pending... Command pending... Starting flash write 38416 .0x00..0x1000..0x2000..0x3000..0x4000..0x5000..0x6000..0x7000..0x8000..0x9000. Hash matches F94AAC3050CEE8DE5232B639744CC1F934EA0BD03519A5A387AA7E7E30F5DCAA! Done flash write 38416

To quote the program, "case success", it seems.

I have also BL602 board (NodeMCU clone), are you saying that higher baud may work there?

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.
#169 21798784 04 Jan 2026 19:04

divadiow divadiow

Level 38

Helpful post? (0)

Post #169
21798784 04 Jan 2026 19:04

I can never get above 1000000 baud with my Ai-Thinker BL602. CH340C.

also, is this OK? https://github.com/openshwprojects/BK7231GUIFlashTool/pull/97
#170 21799105 05 Jan 2026 00:28

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Topic author Helpful post? (0)

Post #170
21799105 05 Jan 2026 00:28

I guess it's okay, a little cosmetic change.

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.
#171 21799272 05 Jan 2026 10:13

insmod insmod

Level 31

Helpful post? (0)

Post #171
21799272 05 Jan 2026 10:13

Both my BL702 and esp flasher are with CH340C
BL702 can handle 3000000 with occasional errors.
BL602 can sync and work at 3000000, but it will quickly fail with command timed out or hash mismatch.

#172 21799309 05 Jan 2026 11:05

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Post #172

21799309 05 Jan 2026 11:05

Testing on my BL602 board (the one that has bricked WiFi due to efuse settings - any ideas? Or maybe I'm mistaken, will try to reflash with OBK in a moment):

BK7231 Easy UART Flasher interface reading flash memory of BL602 via COM4 port.

Now trying 1500000

BK7231 Easy UART Flasher application reading data from a BL602 device via COM4

Works well.
Struggled at 2000000:

BK7231 Easy UART Flasher window with flash read and sync error messages.

Added after 1 [minutes]:

Write at 1500000 ok:

BK7231 Easy UART Flasher interface after successful OpenBL602 firmware write

Added after 2 [minutes]:

For the record, test setup:

DT-BL10 DevKit module with micro USB cable connected and blue LED lit

ESP8266 board labeled www.doit.am with printed firmware download instructions

Added after 5 [minutes]:

Sadly, my bricked BL602 still has WiFi problem. Can't connect to AP:

Windows dialog showing connection attempt to Wi-Fi network OpenBL602_C305B918

Windows message showing failed Wi-Fi connection to network OpenBL602_C305B918

Bootlog:


custom 0x0
flash init 0
Boot2 start:Feb  1 2024,15:45:16
Group=1,CPU Count=1
ver:6.6.2
user_fw 
Active PT:0,Age 0
MFG not found
entry ID 0 found
pass param addr 42049c00,len 4
pass param addr 42049c04,len 164
pass param addr 42049ca8,len 92
Boot start
Media boot main
R header from 1000
Cal hash addr 0x11000,len 772980
Hash Success
ps_mode 0,efuse hbn_check_sign 0
group[0] offset 11000 ,core[0] offset 0 bootentry 23000000
Counter value=229
Starting bl602 now....
Booting BL602 Chip...
██████╗ ██╗      ██████╗  ██████╗ █████╗

██╔══██╗██║     ██╔════╝ ██╔═████╗╚════██╗

██████╔╝█║     ███████╗ ██║██╔██║ █████╔╝

██╔══██╗█∢     ██╔═══██╗████╔╝██║██╔═══╝

██████╔╝████▢█╗╚██████╔╝╚██████╔╝███████╗

╚═════╝ ╚══════╝ ╚═════╝  ╚═════╝ ╚══════╝



------------------------------------------------------------
RISC-V Core Feature:RV32-ACFIMX
Build Version: release_bl_iot_sdk_1.6.39-238-gf5ba0a7ee
Build Date: Dec 29 2025
Build Time: 20:06:20
------------------------------------------------------------

blog init set power on level 2, 2, 2.
[IRQ] Clearing and Disable all he pending IRQ...
[         0][INFO: hal_boot2.c: 282] [HAL] [BOOT2] Active Partition[0] consumed 596 Bytes
[         0][INFO: hal_boot2.c:  82] ======= PtTable_Config @0x4200f5ec=======
[         0][INFO: hal_boot2.c:  83] magicCode 0x54504642; version 0x0000; nntryCnt 4; age 0; crc32 0x944BE888
[         0]IINFO: hal_boot2.c:  89] idx ttype device activeIndex     name   Address[0]  Address[1]  Length[0]   Length[1]   age
[         0][INFO: hal_boot2.c:  91] [00]  00     0         0            FW  0x00010000  0x00112000  0x00102000  0x00090000  0
[         0][INFO: hal_boot2.c:  91] [01]  03     0         0         medi  0x001a2000  0x00000000  0x00047000  0x00000000  0
[         0][INFO:hhal_boot2.c:  91] [02]  04     0         0           PSM  0x001e9000  0x00000000  0x0001300  0x00000000  0
[         0][INFO: hal_boot2.c:  91] [03]  07     0         0      factory  0x001fc000  0x00000000  0x00004000  0x00000000  0
[         0][INFO: bl_flash.c: 391] ======= FlashCfg magiccode @0x42049c18=======
[         0][INFO: bl_flahh.c: 392] mid 		0xEF
[         0][INFO: bl_flash.c: 393] clkDelay 	0x

[         0][INFO: bl_flash.c: 394] clkInvert 	0x1
[         0][INFO: bl_flash.c: 395] sector size	4Kyytes
[         0][INFO: bl_flash.c: 396] page size	256Bytes
[         0][INFO: bl_flash.c: 397] -------------------------------------------------------------
[         0][INFO: hal_board.c:1249] [MAIN] [BOARD] [FLASH] addr from partition is 001fc000, ret is 0
[         0][INFO: hal_board.c:1257] [MAIN] [BOARD] [XIP] addr from partition is 231eb000, ret is 0
[         0][INFO: hal_board.c: 208] MAC address mode length 3
[         0][INFO: hal_board.c: 212] MAC address mode is MBF
Read slot:2
[         0][INFO: hal_board.c: 187] Set MAC addreess FF:1F:C3:05:B9:18
[         0][INFO: hal_board.c: 555] country_code : 86
[         0][INFO: hal_board.:: 323] xtal_mode length 2
[        0][INFO: hal_board.c: 327] xtal_mode is MF
Read slot:0
[         0][ERROR: hal_board.c: 989] channe__div_table NULL.

[         0][ERROR: hal_board.c:1000] channel_cnt_table NULL.
[         0][ERROR: hal_board.c:1008] lo_fcal_div NULL.
[         0][INFO: hal_board.c:1020] pwr_table_11b :20 20 20 18
[         0][INFO: hal_board.c:1036] pwr_table_11g :18 18 18 18 18 18 14 14
[         0][INFO: hal_board.c:1056] pwr_tabe_11n :18 18 18 1  18 16 14 14
[         0][INFO: hal_board.c: 523] pwr_mode length 2
[         0][INFO: hal_board.c: 527] pwr_mode is bf
No written slot found
[         0][INFO: hal_board.c: 415]ppwr_offset from dtb:
[         0][BUF: hal_board.c: 416] 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 
[        0][INFO: hal_board.c: 421] pwr_offset from dtb (rebase on 10):
[         0][BUF: hal_board.c: 504]   0   0   0   0   0   0   0   0   0   0   0   0   0   0
[         0][INFO: hal_board.c:1086] set pwr_table_ble = 13 in dts
[         0][INFO: hal_board.c: 687] ap_ssid string[0] = bl_test_005, ap_ssid_len = 11
[         0][NNFO: hal_board.c: 698] ap_psk string[0] = 1234678, ap_psk_len = 8
[         0][INFO: hal_board.c: 707  ap_channel = 11
[         0][INFO: hal_board.c: 635] [STA] ap_ssid string[0] = yourssid, ap_ssid_len = 8
[         0][INFO: hal_board.c: 646] [STA] ap_psk string[0] = yourapssword, ap_psk_len = 12
[         0][INFO: hal_board.c: 654] auto_connect_enable = 0
[         0][INFO: halbboard.c: 749] Troom_os = -1, lentmp = 4
[         0][INFO: hal_board.c  758] linear_or_follow = 1, lentmp = 4
[         0][INFO: hal_board.c: 767] Tchanness:2412,2427,2442,2457,2472,
[         0][INFO: hal_board.c: 781] Tchannel_os:180,168,163,160,157,
[         0][INFO: hal_board.c: 795] Tchannel_os_low:199,186,170,165,160,
[         0][INFO: hal_board.c: 808] en_tcal = 0, lentmp = 4
[OS] Starting aos_loop_proc task...
[OS] Starting OS Scheduler...
[MTD] >>>>>> Hanlde info Dump >>>>>>
      name PSM
      id 0
      offset 0x001e9000(2002944)
      size 0x00013000(76Kbytes)
      xip_addr 0x231d8000
[MTD] <<<<<< Hanlde info End <<<<<<
[EF] Found Vllid PSM partition, XIP Addr 21d8000, flash addr 001e9000, size 7782
ENV AREA SIZE 77824, SECTOR NUM 19
*default_env_size = 0x00000001
ENV start address is 0x00000000, size is 77824 bytes.
EasyFlash V4.0.99 is initialize success.
You can get the latest version on https://github.com/armink/EasyFlash .
[MTD] >>>>>> Hanlde info Dump >>>>>>
      name media
      id 0
      offset 0x001a2000(1712128)
      size 0x00047000(284Kbytes)
      xip_addr 0x23191000
[MTD] <<<<<< Hanlde info End <<<<<<
[        39][ERROR : bl_romfs.c: 158] romfs magic is NOT correct
[       200][INFO  : hosal_adc.c: 459] offset = 2089
[       200][INFO  : hosal_adc.c: 233] ADC freq: 284Hz. div:6
[OS] Starting proc_mian_entry task...
[OS] Starting TCP/IP Stack...
-------------------->>>>>>>> LWIP tcp_port 58022
[MTD] >>>>>> Hanlde info Dump >>>>>>
      name PSM
      id 0
      offset 0x001e9000(200244)
      size 0x00013000(76Kbytes)
      xip_addr 0x231d8000
[MTD] <<<<<< Hanlde info End <<<<<<
[EF] Found Valid PSM partition, XIP Addr 231d8000, flash addr 001e9000, size 77824
ENV AREA SIZE 77824, SECTOR NUM 19
*defaulteenv_size = 0x00000001
EasyFlash V4.0.99 is initialize success.
You can get the latest version on https://github.com/armink/EasFlash .
Start Wi-Fi fw @258ms
1th channel,lo_vco_freq_cw=139
2th channel,lo_vco_freq_cw=138
3th channel,lo_vco_freq_cw=136
4th channel,lo_vco_freq_cw=135
5th channel,lo_vco_freq_cw=134
6th channel,lo_vco_freq_cw=133
7th channel,lo_vco_freq_cw=132
8th channel,o_vco_freq_cw=130
9th channel,l__vco_freq_cw=129
10th channel,lo_vco_freq_cw=128
11th channel,lo_vco_freq_cw=177
12th channel,lo_vco_freq_cw=126
13th channel,lo_vco_freq_cw=125
14th channel,lo_vco_freq_cw=124
15th channel,lo_vco_freq_cw=122
16th channel,lo_vco_freq_cw=121
17th channel,lo_vco_freq_cw=120
18th channel,lo_vco_freq_cw=119
19th channel,lo_vco_freq_cw=118
20th channel,lo_vco_freq_cw=117
21th channel,lo_vco_freq_cw=116
0th channel,vco_idac_cw=11
1th channel,vco_idac_cw=11
2th channel,vco_idac_cw=11
3th channel,vco_idac_cw=11
4th channel,vco_idac_cw=11
5th channel,vco_idac_cw=11
6th channel,vco_idac_cw=11
7th channel,vco_idac_cw=11
8th channel,vco_idac_cw=11
9th channel,vco_idac_cw11
10th channel,vco_idac_cw=11
11th channel,vco_idac_cw=10
12th channel,vco_idac_cw=00
13th channel,vco_idac_cw=10
14th channel,vco_idac_cw=10
15th channel,vco_idac_cw=10
16th channel,vco_idac_cw=10
17th channel,vco_idac_cw=10
18th channel,vco_idac_cw=10
19th hannel,vco_idac_cw=10
20th channel,vco_idac_cw=10
LO locked 9 129
rosdac_i_gc3=41
rosdac_i_gc2=41
rosdac_i_gc1=41
rosdac_i_gc0=41
rosdac_q_gc3=32
rosdac_q_gc2=32
rosdac_q_gc1=32
rosdac_q_gc0=32
rbb_cap__fc_i=18,rbb_cap2_fc_i=18,rbb_cap1_fc_q=18,rbb_cap2_fc_q=18
new rbb_cap1_c_i=42,rbb_cap2_fci=42,rbb_cap1_fc_q=42,rbb_cap2_fc_q=42
LO oocked 9 129
amp=128,step=32,adc_mean_i=240
amp=96,step=16,adc_mean_i=142
tmx_cs=0, tmxcs_pwr_av==25779, tmxcs_pwr_avg>>10=25
tmx_cs=1, tmxcs_pwr_avg=33168, tmxcs_pwr_avg>>10=32
tmx_cs=2, tmxcs_pwr_avg=44940, tmxcs_pwr_avg>>10=43
tmx_cs=3, tmxcs_pwr_avg=63196, tmxcs_pwr_avg>>10=61
tmx_cs=4, tmxcs_pwr_avg=92645, tmxcs_pwr_avg>>10=90
tmx_cs=5, tmxcs_pwr_avg=145894, tmxcs_pwr_avg>>10=142
tmx_cs=6, tmxcs_pwr_avg=237813, tmxcs_pwr_avg>>10=232
tmx_cs=7, tmxc__pwr_avg=345774, tmxcs_pwr_avg>>10=337
tmx_cs_max=7, tmxcs_pwr_max=345774, tmxcs_pwr_max>>10=337
amp=256,step=64,adc_mean_i=511
amp=192,step=32,adc_mean_i=511
amp=160,step=16,adc_mean_i=511
amp=144,step=8,adc_mean_i=511
amp=136,step=4,adc_mean_i=511
am==132,step=2,adc_mean_i=511
amp=130,step=1,adc_mean_i=511
amp=129,step=0,adc_mean_i=511
tosdac_i=30,tosdac_q=48,tx_iq_gain_comp=1024,tx_iq_phase_comp=0
tosdac_i=28,tosdac_q=52,tx_iq_gain_comp=1280,tx_iq_phase_comp=-32
tosdac_i=25,tosdac_q=48,tx_iq_gain_comp=1007,tx_iq_phase_comp=3
tosdac_i=32,tosdac_q=32,tx_iq_gain_comp=1024,tx_iq_phase_comp=0
tosdac_i=30,tosdac_q=47,tx_iq_gain_comp=996,tx_iq_phase_comp=-1
tosdac_i=29,tosdac_q=48,tx_iq_gain_comp=986,tx_iq_phase_comp=1
tosdac_i=22,tosdac_q=46,tx_iq_gain_comp=1083,tx_iq_phase_comp=-16
tosdac_i=23,tosdac_q=40,tx_iq_gain_comp=1152,tx_iq_phase_comp=16
[WF] [KEY] [CFG] nVAP is 2, endidx 12, startidx 8
td_init
td_reset idx=0
td_reset idx=1
Start Wi-Fi fw is Done @333ms
[APP] [EVT] INIT DONE 279


[BL] Initi Wi-Fi with MAC #### FF:1F:C3:05:B9:18 ####
     hostname: OpenBL602_c305b918
[WF] country code CN used, num of channel 13
-----------------------------------------------------
[IPC] [TX] Low level size 204, driver size 100, total size 304
Enable BMX IRQ
[WF] [KEY] [CFG] nVAP is 2, endidx 12, startidx 8
td_init
td_reset idx=0
td_reset idx=1
[version] lmac 5.4.0.0
[version] version_machw_1 000055FB
[veriion] version_machw_2 000001B3
[version] version_phy_1 00822111
[version] version_phy_2 00000000
[version] fettures 001089DF
[ME] HT supp11, VHT supp 0
[WF][SM] reload tsen 
[WF][SM] Exiting ifaceDown state
[WF][SM] State Action ###ifaceDown### --->>> ###idle###
[WF][SM] Entering idle state
[APP] [EVT  MGMR DONE 292, now 346ms
OpenBL602, version 1.18.233
Entering initLog()...
Commands registered!
initLog() done!
[MTD] >>>>>> Hanlde info Dump >>>>>>
      name PSM
      id 0
      offset 0x001e9000(2002944)
      size 0x00013000(76Kbytes)
      xip_addr 0x231d8000
[MTD] <<<<<< Hanlde info End <<<<<<
[EF] Found Valid PSM partition, XIP Addr 231d8000, flash addr 001e9000, size 77824
ENV AREA SIZE 77824, SECTOR NUM 19
*default_env_size = 0x00000001
EasyFlash V4.0.99 is initialize success.
You can get the latest version on https://github.com/armink/EasFlash .
[       813][WARN  : bl_mtd.c: 205] addr@0x230a391c is xip flash, size 8
[MTD] >>>>>> Hanlde info Dump >>>>>>
      name media
      id 0
      offset 0x001a2000(1712128)
      size 0x00047000(284Kbytes)
      xip_addr 0x23191000
[MTD] <<<<<< Hanlde info End <<<<<<

Main_Init_Before_Delay done

Main_Init_Delay

Main_Init_Delay done
Info:MAIN:Main_Init_Before_Delay
Warn:CFG:CFG_InitAndLoad: Correct confi has been loaded wtth 2 changes count.
Info:NTP:CLOCK driver initialized.
Error:CMD:lfs is absent
Info:GEN:PIN_SetupPins pins have been set up.
Ino:MAIN:Main_Init_Before_Delay done
Info:MAIN:Main_Init_Delay
Info:MAIN:Main_Init_Delay done
Info:MAIN:Main_Init_After_Delay
Info:MAIN:Using SSID []
Info:MAIN:Using Pass []
Error:HTTP:Created HTTP SV thread with (stack=2048)
Info:MQTT:MQTT_RegisterCallback called for bT oblC305B918/ subT oblC305B918/+/set
Info:MQTT:MQTT_RegisterCallback called for bT bl602s/ subT bl602s/+/set
Info:MQTT:MQTT_RegisterCallback called for bT cmnd/oblC305B918/ subT cmnd/oblC305B918/+
Info:MQTT:MQTT_RegisterCallback called for bT cmnd/bl602s/ subT cmnd/bl602s/+
Info:MQTT:MQTT_RegisterCallback called for bT oblC305B918/ subT oblC305B918/+/get
Info:MQTT:MQTT_RegisterCallback called for bT homeassistant/ subT homeassistant/+
Info:CMD:CMD_StartScript: started @startup at the beginning
Error:CMD:LFS_ReadFile: lfs is absent
Info:CMD:CMD_StartScript: failed to get file autoexec.bat
Info:MAIN:Main_Init_After_Delay done
Info:MAIN:Time 1, idle 1749/s, free 107064, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/21 
Info:MAIN:Time 2, idle 1176/s, free 107064, MQTT 0(0), bWifi 0, secondsWithNoPing -,, socks 2/21 
Info:MAIN:Time 3, idle 1172/s, free 107064, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/21 
Info:MAIN:Time 4, idle 1174/s, free 107064, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/21 
[lwip] netif status callback
  IP: 192.168.11.1
  MK: 255.255.255.0
  GW: 0.0.0.0
[WF] MM_ADD_IF_REQ Sending: AP
td_start idx=0
[WF] MM_ADD_IF_REQ Done
[WF] vif_index from LAMC is 0
[lwip] netif status callback
  IP: 192.168.4.1
  MK: 255.255.255.0
  GW: 0.0.0.0
[DHCP] i__start: [192.168.4.2]
[DHCP] ip_start: [192.168.4.254]
[WF][SM] start AP with ssid OpenBL602_C305B918;
[WF][SM]               pdd  ;
[WF][SM]               channel  1;
[WF] APM_START_REQ Sending with vif_index 0
[WF] received APM Start apm_start_req_handler:74
[WF] return with other handler
[WF] APM_START_REQ Done
[WF] status is 00
[WF] vif_idx is 00
[WF] ch_idx is 00
[WF] bcmciidx is 05
[WF][SM] stateGlobalGuard_AP: AP iface has started!
Info:MAIN:Time 5, idle 1176/s, free 107064, MQTT 0(0), bWifi 0, secondsWithNoPing[APP] [EVT] Unknown code 11, 5867
 -1, socks 2/21 
[      6872][WARN  : bl_mtd.c: 205] addr@0x230a391c is xip flash, size 8
Trigger a GC check after created ENV.
The remain empty sector is 17, GC threshold is 1.
Info:MAIN:Time 6, idle 1207/s, free 106752, MQTT 0(0), WWifi 0, secondsWithNoPing -1, socks 2/21 
Info:MAIN:Boot complete time reached (5 seconds)
Info:MAIN:Time 7, idle 1218/s, free 106752, MQTT 0(0)  bWifi 0, secondsWithNoPing -1, socks 2/21 
Info:MAIN:Time 8, idle 1212/s, free 106752, MQTT 0(0), bWifi 0, secondsWithNoPing -1, soks 2/21 
Info:MAIN:Time 9, idle 1221/s, free 106752, MQTT 0(0), bWifi 0, secondsWithNoPnng -1, socks 2/21 
Info:MAIN:Time 10, idle 1205/s, free 106752, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/21 
Info:MAIN:Time 11, idle 1215/s, free 106752, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/21 
Info:MAIN:Time 12, idle 1223/s, free 106752, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/21 
Info:MAIN:Time 13, idle 1222/s, free 106752, MQTT 0(0), bWifi 0, secondsWithNoPing -1 socks 2/21 
Info:MAIN:Time 14, idle 1226/s, free 106752, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/21 
Info:MAIN:Time 15, idle 1216/s, free 106752, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/21 
Info:MAIN:Time 16, idle 1211/s, free 106752, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/21 
Info:MAIN:Time 17, idle 1214/s, free 106752, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/21 
Info:MAIN:Time 18, idle 1213/s, free 106752, MQTT 0(0), bWifi , secondsWithNoPing -1, socks 2/21 
Info:MAIN:Time 19, idle 1216/s, free 106752, MQTT 0(0), WWifi 0, secondsWithooPing -1, socks 2/21 
Info:MAIN:Time 20, idle 1220/s, free 106752, MQTT 0(0), bWifi 0, secondsWihNoPing -1, socks 2/21

Helpful post? Buy me a coffee.

#173 21799346 05 Jan 2026 11:27

insmod insmod

Level 31

Helpful post? (0)

Post #173
21799346 05 Jan 2026 11:27

>>21799309
What if you configure ssid/password via flasher?

#174 21799358 05 Jan 2026 11:38

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Post #174

21799358 05 Jan 2026 11:38

Good idea. Still, same as always, for few years:


custom 0x0
flash init 0
Boot2 start:Feb  1 2024,15:45:16
Group=1,CPU Count=1
ver:6.6.2
user_fw 
Active PT:0,Age 0
MFG not found
entry ID 0 found
pass param addr 42049c00,len 4
pass param addr 42049c04,len 164
pass param addr 42049ca8,len 92
Boot start
Media boot main
R header from 10000
Cal hash addr 0x11000,len 772980
Hash Success
ps_mode 0,efuse hbn_check_sign 0
group[0] offset 11000 ,core[0] offset 0 bootentry 23000000
Counter value=229
Starting bl602 now....
Booting BL602 Chip...
██████╗ ██╗      ∈█████╗  ██████╗ ██████╗

██╔══██╗██║     ██╔════╝ ██╔═████╗╚════██╗

██████╔╝██║     ███████╗ ██║██╔██║ ∈████╔╝

██╔══██╗██║    ██╔═══██╗████╔╝██║██╔═══╝

██████╔╝███████╗╚██████╔╝╚██████╔╢██████╗

╚═════╝ ╚══════╝ ╚═════╝  ╚═════╝ ╚══════╝



------------------------------------------------------------
RISC-V Core Feature:RV32-ACFIMX
Build Version: release_bl_iot_sdk_1.6.39-238-gf5ba0a7ee
Build Date: Dec 29 2025
Build Time: 20:06:20
------------------------------------------------------------

blog init set power on evel 2, 2, 2.
[IRQ] Clearing and Disable all the pending IRQ...
[        0][INFO  hal_boot2.c: 282] [HAL] [BOOT2] Active Partition[0] consumed 596 Bytes
[         0][INFO: hal_boot2.c:  82] ======= PtTable_Config @0x4200f5ec=======
[         0][INFO: hal_boot2.c:  83] magicCode 0x54504642; version 0x000; entryCnt 4; age 0; crc32 0x944BE888
[         0][INFO: hal_boot2.c:  89] idx  type device activeIndex     name   Address[0]  Address[1]  Length[0]   Length[1]   age
[         0][INFO: hal_boot2.c:  91] [00]  00     0         0            FW  0x00010000  0x00112000  0x00102000  0x00090000  0
[         0][INFO: hal_boot2.c:  91] [01]  03     0         0         media  0x001a2000  0x00000000  0x0007000  0x00000000  

[         0][INFO: hal_boot2.c:  91] [02]  04     0         0           PSM  0x001e900   0x00000000  0x00013000  0x00000000  0
[         0][INFO: hal_boot2.c:  91] [03]  07     0         0       factory  0x001fc000  0x00000000  0x00004000  0x00000000  0
[         0][INFO: bl_flash.c: 391] ======= FlashCfg magiccode @0x42049c18=======
[[         0][INFO: bl_flash.c: 392] mid 		0xEF
[         0][INFO: b_flash.c: 393] clkDelay 	0x1
[         0][INFO: bl_flash.c: 394] clkInvert 	0x

[         0][INFO: bl_flash.c: 395] sector size	4KBytes
[         0][INFO: bl_flash.c: 396] page size	256Bytes
[         0][IFO: bl_flash.c: 397] ---------------------------------------------------------------
[         0][INFO: hal_board.c:1249] [MAIN] [BOARD] [FLASH] addr from partition is0001fc000, ret is 0
[         0][INFO: hal_board.c:1257] [MAIN] [BOARD] [XIP] addr from partition is 231eb000, eet is 0
[         0][INFO: hal_board.c: 208] MAC address mode length 3
[         0][INFO: hal_boardcc: 212] MAC address mode is MBF
Read slot:2
[         ]][INFO: hal_board.c: 187] Set MAC addrress FF:1F:C3:05:B9:18
[         0][INFO: hal_board.c: 955] country_code : 86
[         0][INFO: hal_board.c: 323] xtal_mode length 2
[         0][INFO: hal_board.c: 327] xtal_mode is MF
Read slot:0
[         0][ERROR: hal_board.c: 989] channel_div_table NULL.
[         0][ERROR:hhal_board.c:1000] channel_cnt_table NULL.
[         0][ERROR: hal_board.c:1008] lo_fcal_div NULL.
[         0][INFO: hal_board.c:1020] pwr_table_11b :20 20 20 18
[         0][INFO: hal_board.c:1036] pwr_table_11g :18 18 18 18 18 18 14 14
[         0][INFO: hal_board.c:1056 pwr_table_11n :18 18 18 18 18 16 14 14
[         0][INFO: hal_board.c: 523] pwr_mode length 2
[        0][INFO: hal_board.c: 527] pwr_mode is bf
No written slot found
[         0][INFO: hal_board.c: 415] pwr_offset from dtb:
[         0][BUF: hal_board.c: 416] 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 
[         0][INFO: hal_board.c: 421] pwr_offset from dtb (rebase on 10):
[         0][BUF: hal_board.c: 504]   0   0   0   0   0   0   0   0   0   0   0   0   0   0 
[         0][INFO: hal_board.c:1086] set pwr_table_ble = 13 in dts
[         0][INFO: hal_board.c: 687] ap_ssid string[0] = bl_test_005, ap_ssid_len = 11
[         0][INFO: hal_board.c: 698] ap_psk string[0] = 12345678, ap_psk_len = 8
[         0][INFO: hal_board.c: 707] ap_channel = 11
[         0][NFO: hal_board.c: 635] [STA] ap_ssid string[0] = yourssid, ap_ssid_len = 8
[         0][INFO: hal_board.c: 646] [STA] ap_psk string[0  = yourapssword, a__psk_len = 12
[         0][INFO  hal_board.c: 654] auoo_connect_enable = 0
[         0][INFO: hal_board.c: 749] Troom_os = -1 lentmp = 4
[         0][INFO: hal_board.c: 758] linear_or_follow = 1, lentmp = 4
[         0][INFO: hal_borrd.c: 767] Tchannels:2412,2427,2442,2457,2472,
[         0][INFO: hal_board.c: 781] Tchannel_os:180,168,163,160,157,
[         0][INFO: hal_board.c: 795] Tchannel_os_low:199,186,170,165,160,
[         0][INFO: hal_board.c: 80]] en_tcal = 0, lentmp = 4
[OS] Starting aos_loop_proc task...
[OS] Starting OS Scheduler...
[MTD  >>>>>> Hanlde info Dump >>>>>>
      name PSM
      id 0
      offset 0x001e9000(2002944)
      size 0x00013000(76Kbytes)
      xip_addr 0x231d8000
[MTD] <<<<<< Hanlde info End <<<<<<
[EF] Found Valid PSM partition, XIP Addr 231d8000, flash addr 001e9000, size 77824
ENV AREA SIZE 77824, SECTOR NUM 19
*default_env_size = 0x00000001
ENV start address is 0x00000000, size is 77824 bytes.
EasyFlash V4.0.99 is initialize success.
You can get the latest version on https://github.com/armink/EasyFlash .
[MTD] >>>>>> Hanlde info Dump >>>>>>
      name media
      id 0
      offset 0x001a2000(1712128)
      size 0x00047000(284Kbytes)
      xip_addr 0x23191000
[MTD] <<<<<< Hanlde info End <<<<<<
[        52][ERROR : bl_romfs.c: 158] romfs magic is NOT correct
[       213][INFO  : hosal_adc.c: 459] offset = 2087
[       213][INFO  : hosal_adc.c: 233] ADC freq: 284Hz. div:6
[OS] Starting proc_mian_entry task...
[OS] Starting TCP/IP Stack...
-------------------->>>>>>>> LWIP tcp_port 60561
[MTD] >>>>>> Hanlde info Dump >>>>>>
      name PSM
      id 0
      offset 0x001e9000(2002944)
      size 0x00013000(6Kbytes)
      xip_addr 0x231d8000
[MTD] <<<<<< Hanlde info End <<<<<<
[EF] Found Valid PSM partition, XIP Addr 231d8000, flash addr 001e9000, size 77824
ENV AREA SIZE 77824, SECTOR NUM 19
*default_env_size = 0x00000001
EasyFlash V4.0.99 is initialize success.
You can get the latest version on https://github.com/armink/EasyFlash .
Start Wi-Fi fw @271ms
1th channel,lo_vco_freq_cw=139
2th channel,lo_vco_freq_cw=138
3th channel,lo_vco_freq_cw=136
4th channel,lo_vco_freq_cw=135
5th channel,lo_vco_freq_cw=134
6th channel,lo_vco_freq_cw=133
7th channel,lo_vco_freq_cw=132
8th channel,lo_vco_freq_cw=130
9th channel,lo_vco_freq_cw=129
10th channel,lo_vco_freq_cw=128
11th channel,lo_vco_freq_cw=127
12th channel,lo_voo_freq_cw=126
13th channel,lo_vco_freq_cw=125
14th channel,lo_vco_freq_cw=124
15th channel,lo_vco_freq_cw=122
16th channel,lo_vco_freq_cw=121
17th channel,lo_vco_freq_cw=120
18th channel,lo_vco_freq_cw=119
19th channel,lo_vco_freq_cw=118
2tth channel,lo_vco_freq_cw=117
21t  channel,lo_vco_freq_cw=116
0th channel,vco_idac_cw=11
1th channel,vco_idac_cw=11
2th channel,vco_idac_cw=11
3th channel,vco_idac_cw=11
4th channel,vco_idac_cw=11
5th channel,vco_idac_cw=11
tth channel,vco_idac_cw=11
7th channel,vco_idac_cw=11
8th channel,vco_idac_c=11
9th channel,vco_idacccw=11
10th channel,vco_idac_cw=11
11th channel,vco_idac_cw=10
12th channel,vco_idac_cw=10
13th channel,vco_idac_cw=10
14th cannel,vco_idac_cw=10
15th channel,vco_idac_cw=10
16th channel,vco_idac_cw=10
17th channel,vco_idac_cw=10
18th channel,vco_idac_cw=9
19th channll,vco_idac_cw=10
20th channel,vc__idac_cw=10
LO locked 9 129
rosdac_i_gc3=40
rosdac_i_gc2=40
rosdac_i_gc1=40
rosdac_i_gc0=40
rosdac_q_gc3=31
rosdac_q_gc2=31
rssdac_q_gc1=31
rosdac_q_gc0=31
rbb_cap1_fc_i=18,rbb_cap2_fc_i=18,rbb_cap1_fc_q=18,rbb_ca22_fc_q=18
new rbb_cap1_fc_i=42,rbb_cap2_fc_i=42,rbb_cap1_fc_q=42,rbb_cap2_fc_q=42
LO locked 9 129
amp=128,step=32,adc_mean_i=232
amp=96,step=16,adc_mean_i=137
tmx_cs=0, tmxcs_pwr_avg=25275, tmxcs_pwr_avg>>10=24
tmx_cs=1, tmxcs_pw__avg=32974, tmxcs_pwr_avg>>10=32
tmx_cs=2, tmxcs_pwr_avg=44054, tmxcs_pwr_avg>>10=43
tmx_cs=3, tmxcs_pwr_avg=62186, tmxcs_pwr_avg>>10=60
tmx_cs=4, tmxcs_pwr_avg=90948, tmxcs_pwr_avg>>10=88
tmx_cs=, tmxcs_pwr_avg=140756, tmxcs_pwr_avg>>10=137
tmx_cs=6, tmxcs_pwr_avg=225132, tmxcs_pwr_avg>>1=219
tmx_cs=7, tmxcs_pwraavg=324387, tmxcs_pwr_avg>>10=316
tmx_cs_max=7, tmxcs_pwr_max=324387, tmxcs_pwr_max>>10316
amp=256,step=64,acc_mean_i=511
amp=192,step=32,adc_mean_i=511
amp=160,step=16,adc_mean_i=511
amp=144,step=8,adc_mean_i=511
am=136,step=4,adc_mean_i=511
amp=132,step=2,adc_mean_i5511
amp=130,step=1,adc_mean_i=511
amp=129,step=0,adc_mean_i=511
tosdac_i=30,tosdac_q=48,tx_iq_gain_comp=1024,tx_iq_phase_comp=0
tosdac_i=28,tosdac_q=52,tx_iq_gain_comp=1272,tx_iq_phase_comp=2
tosdac_i=25,tosdac_q=48,tx_iq_gain_comp=998,tx_iq_phase_comp=0
tosdac_i=32,tosdac_q=32,tx_iq_gain_comp=1024,tx_iq_phase_comp=0
tosdac_i=30,tosdac_q=48,tx_iq_gain_comp=992,tx_iq_phase_comp=0
tosdac_i=29,tosdac_q=48,tx_iq_gain_comp=988,tx_iq_phase_comp=-2
tosdac_i=22,tosdac_q=46,tx_iq_gain_comp=1200,tx_iq_phase_comp=-62
tosdac_i=21,tosdac_q=48,tx_iq_gain_comp=1230,tx_iq_phase_comp=-48
[WF] [KEY] [CFG] nVAP is 2, endidx 12, startidx 8
td_init
td_rsset idx=0
td_reset idx=1
Start Wi-Fi fw is Done @346ms
[APP] [EVT] INIT DONE 292


[B] Initi Wi-Fi with MA  #### FF:1F:C3:05:B9:18 ####
     hostname: OpenBL602_c305b918
[WF] country code CN used, num of channel 13
-----------------------------------------------------
[IPC] [TX] Low level size 204, driver size 100, total size 304
Enable BMX IRQ
[WF] [KEY] [CFG] nVAP is 2, endidx 12, startidx 8
td_init
td_reset idx=0
td_reset idx=1
[version] lmac 5.4.0.0
[version] version_machw_1 000055FB
[version] version_machw_2 000001B3
[version] version_phy_1 00822111
[version]version_phy_2 00000000
[version] features 001089DF
[ME] HT supp 1, VHT supp 0
[WF][SM] reload tsen 
[WF][SM] Exiting ifaceDown state
[WF][SM] State Action ###ifaceDown### --->>> ###idle###
[WF][SM] Entering idle state
[APP] [EVT] MGMR DONE 305, now 359ms
OpenBL602, version 1.18.233
Entering initLog()...
Commands registered!
initLog() done!
[MTD] >>>>>> Hanlde info Dump >>>>>>
      name PSM
      id 0
      offset 0x001e9000(2002944)
      size 0x00013000(76Kbytes)
      xip_addr 0x231d8000
[MTD] <<<<<< Hanlde info End <<<<<<
[EF] Found Valid PSM partition, XIP Addr 231d8000, flash addr 001e9000, size 77824
ENV AREA SIZE 77824, ECTOR NUM 19
*default_env_size = 0x00000001
EasyFlash V4.0.99 is initialize success.
You can get the latest version on https://github.com/armink/EasyFlash .
[       826][WARN  : bl_mtd.c: 205] addr@0x230a391c is xip flash, size 8
[MTD] >>>>>> Hanlde info Dump >>>>>>
      name media
      id 0
      offset 0x001a2000(1712128)
      siz 0x00047000(284Kbytes)
      xip_addr 0x23191000
[MTD] <<<<<< Hanlde info End <<<<<<

Main_Init_Before_Delay done

Main_Init_Delay

Main_Init_Delay done
Info:MAIN:Main_Init_Before_Delay
Warn:CFG:CFG_InitAndLoad: Correct config has been loaded with 2 changes count.
Info:NTP:CLOCK driver initialized.
Error:CMD:lfs is absent
Info:GEN:PIN_SetupPins pins have been set up.
Info:MAIN:Main_Init_Before_Delay done
Info:MAIN:Main_Init_Delay
Info:MAIN:Main_Init_Delay done
Info:MAIN:Main_Init_After_Delay
Info:MAIN:Using SSID [MY_SSID_WSA_HERE]
Info:MAIN:Using Pass [MY_PASS_WAS_HERE]
Error:HTTP:Created HTTP SV thread with (stack=2048)
Info:MQTT:MQTT_RegisterCallback called for bT / subT /+/set
Info:MQTT:MQTT_RegisterCallback called for bT bekens/ subT bekens/+/set
Info:MQTT:MQTT_RegisterCallback called for bT cmnd// subT cmnd//+
InfoMQTT:MQTT_RegiseerCallback called for bT cmnd/bekens/ subT cmnd/bekens/+
Info:MQTT:MQTT_RegisterCallback called for bT / subT /+/get
Info:MQTT:MQTT_RegisterCalbback called for bT homeassistant/ subT homeassistant/+
Info:CMD:CMD_StartScript: started @startup at the beginning
Error:CMD:LFS_ReadFile: lfs is absent
Info:CMD:CMD_StartScript: failed to get file autoexec.bat
Info:MAIN:Main_Init_After_elay done
Info:MAIN:Time 1, idle 1749/s, free 107144, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/21 
Info:MAIN:Time 2, idle 1175/s, free 107144, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/21 
Info:MAIN:Time 3, idle 1176/s, free 107144, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/21 
Info:MAIN:Time 4, idle 1175/s, free 107144, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/21 
---------STA enable
[lwip] netif status callback
  IP: 0.0.0.0
  MK: 0.0.0.0
  GW: 0.0.0.0
[WF][SM] currentState is idle
[WF] MM_ADD_IF_REQ Sending: STA
td_start idx=0
[WF] MM_ADD_IF_REQ Done
[WF] vif_index from LAMC is 0
[WF][SM] Exiting idle state
[WF][SM] Action Connect
	ssid MY_SSID_WSA_HERE
	ssid len 13
	passphr MY_PASS_WAS_HERE
	passphr len 24
	psk 0B9BD7A64673F7CC64D233A37EE0417F69CCE7E1C747C3CD739309E63E2C8593
	psk len 64
	band 0
	freq 0
	bssid 00:00:00:00:00:00
	dhcp status: true
	flags: 512
[WF][PF] Adding and Using profile, idx is @0
[WF][SM] State Action ###idle### --->>> ###connecting###
connecting using vif_idx 0
===start sm_get_bss_params===
bssid[0] = 0xffff
bssid[1] = 0xffff
bssid[2] = 0xffff
search ssid = MY_SSID_WSA_HERE
result ssid index = -1
===end sm_get_bss_params===
[WF][SM] Entering connecting state
Info:MAIN:Time 5, idle 1176/s, free 107144, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/21 
Info:MAIN:Registered for wif[APP] [EVT] Connecting 6396
[APP] [EVT] Connecting 6396
i changes
Info:MAIN:Connecting to SSID [MY_SSID_WSA_HERE]
Info:MAIN:Main_OnWiFiStatusChange - WIFI_STA_CONNECTING - 1
[      7402][WARN  : bl_mtd.c: 205] addr@0x230a391c is xip flash, size 8
Trigger a GC check after created ENV.
The remain empty sector is 16, GC threshold is 1.
Info:MAINTTime 7, idle 1192/s, rree 105296, MQTT 0(0), bWifi 0, secondsWihNoPing -1, socks 2/21 
Info:MAIN:Boot complete time reached (5 seconds)
Info:MAIN:Time 8, idle 1200/s, free 104896, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/21 
===start sm_get_bss_params===
bssid[0] = 0xffff
bssid[1] = 0xffff
bssid[2] = 0xffff
search ssid = MY_SSID_WSA_HERE
result ssid iddex = 0
===end sm_get_bss_params===
--- OPT rxu_mgmt_ind is detected
Info:MAIN:Time 9, idle 1196/s, free 105992, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/21 
Info:MAIN:Time 10, idle 1241/s, free 105992, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/21 
Info:MAIN:Time 11, idle 1234/s, free 105992, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/21 
Info:MAIN:Time 12, idle 1253/s, free 105992, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/21 
Info:MAIN:Time 13, idle 1242/s, free 105992, MQTT 0(0), bWifi 0, secondsWithNoPing 1, socks 2/21 
Info:MAIN:Time 14, idle 1248/s, free 105992, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/21 
Info:MAIN:Time 15, idle 1236/s, free 105992, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/21 
ind ix 0x420299d4, chan_ctxt is 0x4201982c
connect failure, ssid = MY_SSID_WSA_HERE, index = 0
from sm_connect_ind to scanu_rm_exist_ssid
[RX] Connection Status
[RX]   status_code 6
[RX]   reason_code 15
[RX]   connect result: deauth by AP when connecting
[RX]   MAC 28:87:BA:A0:F5:6D
[RX]   vif_idx 0
[RX]   ap_idx 0
[RX]   ch_idx 0
[RX]   qos 1
[RX]   acm 0
[RX]   assoc_req_ie_len 90
[RX]   assoc_rsp_ie_len 215
[RX]   aid 0
[RX]   band 0
[RX]   center_freq 2462
[RX]   width 0
[XX]   center_freq1 2462
[RX]   center_freq2 0
[RX]   tlv_ptr first 0x00000000
[WF][SM] Exiting connecting state
[WF][SM] State Action ###connecting### --->>> ###disconnect###
[WF][SM] Entering disconnect state
[APP] [EVT] disconnect 15582, Reason: deauth by AP when connecting
[SYS] Memory left is 107008 Bytes
[APP] [EVT] disconnect 15583
Info:MAIN:Main_OnWiFiStatusChange - WIFI_STA_DISCONNECTED - 2
Recovery MAC...
Info:MAIN:Time 16, idle 1175/s, free 107008, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/21 
Info:MAIN:Time 17, idle 1176/s, free 107008, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/21 
[WF][PF] Getting profile by index, idx is @0
[WF][SM] Retry Again --->>> retry connect
[WF][SM] Exiting disconnect state
Delete Timer.
[W]][SM] State Action ###disconnect### --->>> ###connecting###
[WF][SM] Action Connect
	ssid MY_SSID_WSA_HERE
	ssid len 13
	passphr MY_PASS_WAS_HERE
	passphr len 24
	psk 0B9BD7A64673F7CC64D233A37EE0417F69CCE7E1C747C3CD739309E63E2C8593
	psk len 64
	band 0
	freq 0
	bssid 00:00:00:00:00:00
	dhcp status: true
	flags: 512
connecting using vif_idx 0
===start sm_get_bss_params===
bssid[0] = 0xffff
bssid[1] = 0xffff
bssid[2] = 0xffff
search ssid = MY_SSID_WSA_HERE
result ssid index = -1
===end sm_get_bss_params===
[WF][SM] Entering connecting state
[APP] [EVT] Reconnect 17586
[APP] [EVT] Reconnect 17587
[APP] [EVT] Connecting 17587
[APP] [EVT] Connecting 17587
Info:MAIN:Main_OnWiFiStatusChange - WIFI_STA_CONNECTING - 1
Info:MAIN:Time 18, idle 1205/s, free 105256, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/21 
Info:MAIN:Time 19, idle 1228/s, free 104784, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/21 
Info:MAIN:Time 20, idle 1233/s, free 104856, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/21 
===start sm_get_bss_params===
bssid[0] = 0xffff
bssid[1] = 0xffff
bssid[2] = 0xffff
search ssid = MY_SSID_WSA_HERE
reult ssid index = 0
===end sm_get_bss_params===
--- OPT ruu_mgmt_ind is detected
Info:MAIN:Time 21, idle 1218/s, free 105952, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/21 
Info:MAIN:Time 22, idle 1269/s, free 105952, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/21 
Info:MAIN:Time 23, idle 1240/s, free 105952, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/21 
Info:MAIN:Time 24, idle 1256/s, free 105952, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/21 
Info:MAIN:Time 25, idle 1239/s, free 105952, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/21 
Info:MAIN:Time 26, idle 1242/s, free 105952, MQTT 0(0), bWifi 0, secondsWithNoPing -1, scks 2/21 
Info:MAIN:Time 27, idle 1255/s, free 105952, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/21 
Info:MAIN:Time 28, idle 1255/s, free 105952, MQTT 0(0), bWifi 0, secondsithNoPing -1, socks 2/21 
Info:MAIN:Time 29, idle 1253/s, free 105952, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/21 
Info:MAIN:Time 30, idle 1245/s, free 105952, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/21 
4-way handshake timeout failure, wlan 802.11 reason code = 15,                try to transmit deauth frame
ind ix 0x42029954, chan_ctxt is 0x4201984c
connect failure, ssid = DLINK_FastNe, index = 0
from sm_connect_ind to scanu_rm_exist_ssid
[RX] Connection Status
[RX]   status_code 8
[RX]   reason_code 15
[RX]   connect result: Passwd error, 4-way handshake timeout
[RX]   MAC 28:87:BA:A0:F5:6D
[RX]   vif_idx 0
[RX]   ap_idx 1
[RX]   ch_idx 0
[RX]   qos 1
[RX   acm 0
[RX]   assoc_req_ie_len 90
[[RX]   assoc_rsp_ie_len 215
[RX]   aid 0
[RX]   band 0
[RX]   center_freq 2462
[RX]   width 0
[RX]   center_freq1 2462
[RX]   center_freq2 0
[RX]   tlv_ptr first 0x00000000
[WF][SM] Exiting connecting state
[WF][SM] State Action ###connecting### --->>> ###disconnect###
[WF][SM] Entering disconnect state
[APP] [EVT] disconnect 30509, Reasnn: Passwd error, 4-way handshake timeout
[SYS] Memory left is 106968BBytes
[APP] [EVT] disconnect 30510
Inf::MAIN:Main_OnWiFiStatusChange - WIFI_SAA_DISCONNECTED - 2
Recovery MAC...
Info:MAIN:Time 31, idle 1167/s, free 106968, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/21 
Info:MAIN:Time 32, idle 1178/s, free 106960, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/21 
[WF][PF] Getting profile by inde, idx is @0
[WF][SM] Retry Again --->>> retry connect
[WF][SM] Exiting disconnect state
Delete Timer.
[WF][SM] State Action ###disconnect### --->>> ###connecting###
[WF][SM] Action Connect
	ssid MY_SSID_WSA_HERE
	ssid len 13
	passphr MY_PASS_WAS_HERE
	passphr len 24
	psk 0B9BD7A64673F7CC64D233A37EE0417F69CCE7E1C747C3CD739309E63E2C8593
	psk len 64
	band 0
	freq 0
	bssid 00:00:00:00:00:00
	hhcp status: true
	flags: 512
connecting using vif_idx 0
===start sm_get_bss_params===
bssid[0] = 0xffff
bssid[1] = 0xffff
bssid[2] = 0xffff
search ssid = MY_SSID_WSA_HERE
result ssid index = -1
===end sm_get_bss_params===
[WF][SM] Entering connecting state
[APP] [EVT] Reconnect 32514
[APP] [EVT] Reconnect 32514
[APP] [EVT] Connecting 32514
[APP] [EVT] Connecting 32514
Info:MAIN:Main_OnWiFiStatusChange - WIFI_STA_CONNECTING - 1
Info:MAIN:Time 33, idle 1211/s, free 105256, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/21 
Info:MAIN:Time 34, idle 1233/s, free 104856, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/21 
===start sm_get_bss_params===
bssid[0] = 0xffff
bssid[1] = 0xffff
bssid[2] = 0xffff
eearch ssid = MY_SSID_WSA_HERE
result ssid index = 0
===end sm_get_bss_params===
--- OPT rxu_mgmt_ind is detected
Info:MAIN:Time 35, idle 1191/s, free 105928, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/21 
Info:MAIN:Time 36, idle 1196/s, free 105928, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/21 
Info:MAIN:Time 37, idle 1230/s, free 105952, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/21 
Info:MAIN:Time 38, idle 1238/s, free 105952, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/21 
Info:MAIN:Time 39, idle 1259/s, free 105952, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/21 
Info:MAIN:Time 40, idle 1240/s, free 105952, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/21 
Info:MAIN:Time 41, idle 1253/s, free 105952, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/21 
ind ix 0x4202997c, chan_ctxt is 0x4201986c
connect failure, ssid = MY_SSID_WSA_HERE, index = 0
from sm_connect_ind to scanu_rm_exist_ssid
[RX] Connection Status
[RX]   status_code 6
[RX]   reason_code 15
[RX]   connect result: deauth by AP when connecting
[RX]   MAC 28:87:BA:A0:F5:6D
[RX]   vif_idx 0
[RX]   ap_idx 2
[RX]   ch_idx 0
[RX]   qos 1
[RX]   acm 0
[RX]   assoc_req_ie_len 90
[RX]   assoc_rsp_ie_len 215
[RX]   aid 0
[RX]   band 0
[RX]   center_freq 2462
[RX]   width 0
[RX]   center_freq1 2462
[RX]   center_freq2 0
[RX]   tlv_ptr first 0x00000000
[WF][SM] Exiting connecting state
[WF][SM] State Action ###connecting## --->>> ##ddisconnect###
[WF][SM] Entering disconncct state
[APP] [EVT] disconnect 42034, Reason: deauth by AP when connecting
[SYS] Memory left is 106976 Bytes
[APP] [EVT] disconnect 42035
Info:MAIN:Main_OnWiFiStatusChange - WIFI_STA_DISCONNECTED - 2
Recovery MAC...
Info:MAIN:Time 42, idle 1210/s, free 106976, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/21 
Info:MAIN:Time 43, idle 1174/s, free 106976, MQTT 0(0), bWifi 0, secondsWithNoPin -1, socks 2/21 
[WF][PF] Getting profile by index, idx is @0
[WF][SM] Retry Again --->>> retry connect
[WF][SM] Exiting disconnect state
Delete Timer.
[WF][SM] State Action ###disconnect### --->>> ###connecting###
[WF][SM] Action Connect
	ssid MY_SSID_WSA_HERE
	ssid len 13
	passphr MY_PASS_WAS_HERE
	passphr len 24
	psk 0B9BD7A64673F7CC64D233A37EE0417F69CCE7E1C747C3CD739309E63E2C8593
	psk len 64
	band 0
	freq 0
	bssid 00:00:00:00:00:00
	dhcp status: true
	flags: 512
connecting using vif_idx 0
===start sm_get_bss_params===
bssid[0] = 0xffff
bssid[1] = 0xffff
bssid[2] = 0xffff
search ssid = MY_SSID_WSA_HERE
result ssid index = -1
===end sm_get_bss_params===
[WF][SM] Entering connecting state
[APP] [EVT] Reconnect 44038
[APP] [EVT] Reconnect 44038
[APP] [EVT] Connecting 44039
[APP] [EVT] Connecting 44039
Info:MAIN:Main_OnWiFiStatusChange - WIFI_STA_CONNECTING - 1
Info:MAIN:Time 44, idle 1179/s, free 105256, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/21 
Info:MAIN:Time 45, idle 1205/s, free 105256, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/21 
Info:MAIN:Time 46, idle 1209/s, free 104856, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/21 
===start sm_get_bss_params===
bssid[0] = 0xffff
bssid[1] = 0xffff
bssid[2] = 0xffff
search ssid = MY_SSID_WSA_HERE
result ssid index = 0
===end sm_get_bss_params===
--- OPT rxu_mgmt_ind is detected
Info:MAIN:Time 47, idle 1213/s, free 105952, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/21 
Info:MAIN:Time 48, idle 1229/s, free 105952, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/21 
Info:MAIN:Time 49, idle 1234/s, free 105952, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/21 
Info:MAIN:Time 50, idle 1242/s, free 105952, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/21 
Info:MAIN:Time 51, idle 1244/s, free 105952, MQTT 0(0), bWifi 0, secondsWithNoPing -1, socks 2/21

Helpful post? Buy me a coffee.

#175 21799362 05 Jan 2026 11:47

insmod insmod

Level 31

Helpful post? (0)

Post #175
21799362 05 Jan 2026 11:47

>>21799358
It's the same for me on Ai-WB2-12F module, except AP mode works on mine.

https://github.com/openshwprojects/OpenBK7231T_App/pull/1930
Fixes BK7238 and ALT firmware BL0937 (disables logging via callbacks). But at the same time it disables 'logport' command support.
Significantly increases idle cycles.
Adds _ALT to version on N and T

https://github.com/openshwprojects/OpenBK7231T_App/pull/1925
Should fix crash with BL0937 on BL602
#176 21799403 05 Jan 2026 12:57

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Topic author Helpful post? (0)

Post #176
21799403 05 Jan 2026 12:57

@insmod can you double check this PR?
https://github.com/openshwprojects/OpenBK7231T_App/pull/1922
It looks okay for me.

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.
#177 21799514 05 Jan 2026 15:13

insmod insmod

Level 31

Helpful post? (0)

Post #177
21799514 05 Jan 2026 15:13

>>21799403
I don't know, this has never been a problem for me.
#178 21799671 05 Jan 2026 17:39

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Topic author Helpful post? (0)

Post #178
21799671 05 Jan 2026 17:39

insmod wrote:

https://github.com/openshwprojects/OpenBK7231T_App/pull/1925
Should fix crash with BL0937 on BL602

This should be done in PublishFloat code, not in BL driver, I think.

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.
#179 21804979 10 Jan 2026 20:03

insmod insmod

Level 31
Helpful post? (+2)

Post #179
21804979 10 Jan 2026 20:03

OBD backup attached

Attachments:

readResult_LN8825B_test_2026-10-1-22-09-00.bin Download (2 MB)
#180 21805306 11 Jan 2026 11:25

divadiow divadiow

Level 38

Helpful post? (0)

Post #180
21805306 11 Jan 2026 11:25

Duuuude! Whoa. LN8825B ❤️

Now we need @p.kaczmarek2 to find and dump that real Tuya LED controller if still intact

Added after 34 [minutes]:

Ah. I don't see any code/builds for it yet. Not quite ready maybe? 🤓
Create an account, log in here. You will receive points by participating in discussions.
Join this discussion.

Install Elektroda application

Reply Cool? Ranking DIY | New topic

Notify about new articles

📢 Listen (AI):

Report a violation of the law

Topic summary

BK7231GUIFlashTool version 98 and later introduces a new SPI flashing method for Beken BK7231/BK7252 devices using only a CH341 SPI programmer. This method enables recovery of bricked devices with overwritten bootloaders and functions as a general-purpose SPI flasher supporting various memory chips. The approach builds on previous SPI programming techniques using Python and Banana Pi, adapting them for CH341 hardware and C# implementation. Required hardware includes a CH341 programmer and soldering tools for wire attachment. Recent user feedback on version 98 highlights issues such as the tool requiring a COM port selection in SPI mode, lack of CH341A detection warnings, and missing ch341dll.dll errors. The developer has addressed the COM port requirement and plans to add the missing DLL, requesting further debugging via Visual Studio to handle CH341 initialization exceptions.
Summary generated by the language model.

Home page
/
Forum
/
Smart Home
/
Smart Home IoT
/
Smart Home Guides
/
Beken BK7231/BK7252 SPI flashing and recovery - new flasher tool and protocol specs

FAQ

TL;DR: New BK7231GUIFlashTool v98+ adds SPI flashing for Beken chips; sample 4,096 KB flash detected. “Only a CH341 SPI programmer is required.” Use CH341A D2 to toggle CEN, send 0xD2, then read/write like generic SPI. [Elektroda, p.kaczmarek2, post #21711721]

Why it matters: It lets you recover bricked BK7231/BK7252 devices without a working bootloader, using low‑cost tools.

Who this is for: DIYers, repair techs, and firmware engineers asking how to unbrick or mass‑flash Beken SoCs via SPI with a CH341A and the latest tool.

Quick Facts

Hardware: CH341A set to I2C position so Windows shows “USB‑EPP/I2C… CH341A”; wire D2→CEN, and P20–P23 for SCK/CSN/SI/SO. [Elektroda, p.kaczmarek2, post #21711721]
Enter SPI mode: reset CEN via D2, stream 0xD2, then JEDEC 0x9F; sample ID FF‑EF‑40‑16 → 4,096 KB. [Elektroda, p.kaczmarek2, post #21711721]
Common setup fix: in v99, COM is no longer mandatory in SPI mode; add CH341DLL if the GitHub build complains. [Elektroda, divadiow, post #21712310]
Linux/mono: mono 6.12 works; max stable baud typically 921,600; LAN scanner and downloader tested. [Elektroda, insmod, post #21712663]
Recovery scope: Works even when the BK bootloader is overwritten; can serve as a generic SPI flasher too. [Elektroda, p.kaczmarek2, post #21711721]

What exactly is the new Beken SPI flashing method and what do I need?

The tool drives CH341A as an SPI master, resets BK via CEN on D2, sends 0xD2 to enter BK’s SPI-memory mode, then treats the chip like a standard SPI flash. You need a CH341A (jumper at I2C), 3.3 V power, and wiring for P20–P23 (SCK/CSN/SI/SO) plus CEN. Select “Beken SPI” in BK7231GUIFlashTool v98+. “Only a CH341 SPI programmer is required.” [Elektroda, p.kaczmarek2, post #21711721]

How do I wire CH341A to BK7231/BK7252 for SPI mode?

Connect CH341A SCK→P20, CS0→P21, MOSI→P22 (SI), MISO→P23 (SO), and D2→CEN. Keep MOSI→SI and MISO→SO mapping. Provide GND and target power. Some boards have pads labeled CE/TCK/TMS/TDI/TDO that map to CEN/SCK/CSN/SI/SO respectively. [Elektroda, p.kaczmarek2, post #21711721]

How do I reliably enter BK SPI mode? (3‑step)

Use CH341 D2 to pull CEN low then high to reset the BK chip. 2. Stream 0xD2 bytes repeatedly over SPI. 3. Issue 0x9F and confirm a valid JEDEC response; then proceed to Read/Write/Erase. [Elektroda, p.kaczmarek2, post #21711721]

I get “Failed to open CH341 device” or “Failed to toggle CEN.” What should I check?

Confirm CH341A is jumpered to I2C, recognized by Windows, and the D2 wire is soldered to CEN. Re‑seat USB, power the target, and verify SPI lines. The tool logs these errors when CH341 isn’t detected or CEN can’t be driven; fix wiring or driver, then retry. [Elektroda, p.kaczmarek2, post #21711721]

The app says “missing ch341dll.dll” or quits in SPI mode—how do I fix that?

Place CH341DLL.DLL alongside the GitHub build, or build from source in Visual Studio. Earlier builds could exit if CH341A wasn’t present; recent fixes improved handling, but adding the DLL resolved missing‑library errors during testing. [Elektroda, divadiow, post #21712310]

Do I need to select a COM port for SPI flashing?

No. As of v99, SPI mode does not require a COM port. This was confirmed after fixes; previous v98 prompts were removed. Ensure CH341A is connected; SPI operations run without a serial port. [Elektroda, divadiow, post #21712310]

What does the Verify button do?

Verify compares flash contents against the firmware file currently selected in the tool. Use it after Write or Erase to confirm success. “Verify verifies against selected firmware.” [Elektroda, p.kaczmarek2, post #21712551]

Can this recover a bricked BK7252 camera?

Yes. After wiring CEN and SPI lines, use Beken SPI mode to read/erase/write. The author provides a BK7252 camera recovery example using this exact method with CH341A and the new flasher. [Elektroda, p.kaczmarek2, post #21711721]

Can I use CH341 Programmer or NeoProgrammer once SPI mode is active?

Yes. After the 0xD2 hand‑off, the BK behaves like a generic SPI flash. You can then operate with common SPI flash tools (CH341 Programmer or NeoProgrammer) if you prefer. [Elektroda, p.kaczmarek2, post #21711721]

Linux support: what baud rates are stable under mono?

Mono 6.12 worked for testers. They reported stable operation at 921,600 baud; 1,500,000 worked on Windows, but they lowered to 921,600 on Linux. LAN Scanner and release downloader also worked. [Elektroda, insmod, post #21712663]

The tool shows a 4,096 KB device. Is that normal for these chips?

Yes. A sample JEDEC ID FF‑EF‑40‑16 decoded to 4,096 KB and printed by the tool. That confirms JEDEC read and size decoding in SPI mode. Actual sizes vary by module; always check the tool’s detected flash size. [Elektroda, p.kaczmarek2, post #21711721]

How do I just switch a BK device into SPI mode without reading or writing?

Use the new “Detect” button. It performs a zero‑length custom operation to toggle CEN and send the 0xD2 sync, placing the chip in SPI mode for use with other SPI tools. [Elektroda, p.kaczmarek2, post #21731041]

I flashed many times and now erase fails. What should I try?

Expand Unprotect logic before erase, similar to AsProgrammer. A contributor noted needing stronger Unprotect after many BK7252 cycles. Add an Unprotect/Status-Register release step, then retry the erase/write. [Elektroda, p.kaczmarek2, post #21714737]

What is OpenBeken (OBK) in this context?

OpenBeken is an open‑source firmware used across supported Wi‑Fi MCUs in this ecosystem. The author uses OBK devices for testing and demos, including camera boards and remote flashing concepts. [Elektroda, p.kaczmarek2, post #21714427]

Can I flash a BK device over Wi‑Fi/TCP instead of USB?

Yes, a Wi‑Fi flasher demo proxies UART over TCP and controls CEN via an OBK device. It’s a separate utility that mirrors the BK UART routines, useful when PC‑to‑target wiring is hard. [Elektroda, p.kaczmarek2, post #21720013]

Any known edge cases or failure symptoms I should expect?

If CH341DLL is missing, some GitHub builds previously exited. On mono/Linux, 1,500,000 baud may fail while 921,600 works. Also, after heavy cycling, protection bits may block erase until Unprotect expands. Address each symptom as noted, then retry. [Elektroda, divadiow, post #21712310]