[RTL8720CM] Chamberlain LiftMaster Maxum - OpenBeken boots only when touching UART TX pin 37

I've been working on a fairly ambitious project lately to gain local control over a Chamberlain LiftMaster Commercial garage door opener. Their control board has a Realtek RTL8720CM Wi-Fi chip used for their MyQ cloud integration. This was previously supported as is by Home Assistant until Chamberlain decided they don't like an open API and effectively killed 3rd-party integrations: https://www.home-assistant.io/blog/2023/11/06/removal-of-myq-integration/

Most people can use the Ratgdo controller as a backup option that controls residential door operators over the Security2+ protocol. Unfortunately, that is not an option for people with the Maxum series commercial door operators unless you do it with simple relay inputs using the external pushbutton inputs, which seemed like a lazy option for me (no door state feedback, etc.).



Luckily for me (and Claude), there is an SWD header that got us a dump of the main microcontroller's firmware so we could reverse-engineer the protocol between the LPC and the stock RTL firmware. Both chips use external EEPROMs for storing the firmware. I had no luck trying to connect to the RTL chip over UART despite my best attempts at soldering on very tiny wires. This meant ordering a SPI programmer (CH341) and a very tiny 6 × 5 mm pogo pin fixture to dump the EEPROM directly. Most of this work was straightforward and, honestly, Claude did 95% of the software work using Ghidra.

The good news:
- Flashing OpenBeken on the RTL chip was simple with the SPI and pogo pin clip. OpenBeken runs just fine.
- Claude was able to write a driver for OBK that talks to the LPC microcontroller, reads the door state, and issues door move commands (open/close). I have not yet tested this with the actual door motor connected, just reading status bits.

The bad news I cannot figure out:
When powering the door opener control board, the RTL chip only boots OBK if I touch a wire to pin 37 (UART TX) of the RTL chip. Very odd, as the wire is not connected to anything else, just pressed against the via connected to that pin. I really can't diagnose why it doesn't boot because connecting a UART programmer is effectively connecting a wire to that pin and OBK boots. I would start pinging OBK's IP and power the board on. I only start getting ping responses when I hold the wire against the pin. This is a significant issue, but somehow the original firmware worked, so there must be a solution here.


Realtek chip (U5) with its EEPROM above (U24). J40 is the SWD header for the LPC microcontroller.


The main NXP microcontroller.


Soldering tiny wires onto the RTL chip to attempt to get to UART. The upper wire is pin 36 for UART2 RX, and the lower is pin 37 for UART2 TX. Pin 37 is the magical wire that causes the RTL chip to boot when something is connected to it.

LiftMaster driver in a fork of OBK here: https://github.com/iff7378/OpenBK7231T_App/tree/feat/liftmaster-driver

Left to do:
Get OBK booting reliably on the RTL chip without wire trickery.
Implement door stop (currently can only fully open or close, not stop mid-travel).
Test with the door motor connected.
Connect to Home Assistant.