Xiaomi Book Pro 14 (2026) has an hardware backdoor?

a deep analysis

The Claim: Xiaomi's official product page for the Book Pro 14 (2026) states:

"关机状态，也能远程唤醒操控电脑" — Even when powered off, you can remotely wake and control the computer.

"内置小米网络模组，关机状态下，也能远程唤醒，出门在外没带笔记本，也能从容应对突发状况。" — Built-in Xiaomi network module, can remotely wake even when powered off.

The feature is called 远程控制 (Remote Control) and is part of the HyperOS Connect (澎湃智联) ecosystem. According to Xiaomi's PC Manager help page, it supports:

• Remote power on (远程开机)
• Remote wake (唤醒)
• Remote shutdown (关机)
• Remote status monitoring (查看笔记本状态)

Footnote 18 from the product page specifies:

"远程控制（含远程开机、唤醒、关机、查看笔记本状态），电脑与平板需登录同一个小米账号。电脑端，远程控制软件需要更新至5.5.0.1及以上版本，当前支持 Xiaomi Book Pro 14。"

Third-Party Verification

The claim is not just marketing — it's been confirmed by teardowns. The XimiTime review states:

"Hardware teardowns reveal a dedicated, physical IoT chip soldered directly onto the motherboard. Because of this dedicated hardware, even if the laptop is completely powered off or asleep in your bag, you can remotely wake it via the Mijia App."

The review lists it as a pro: "Independent IoT Chip: Hardware-level remote wake and seamless Xiaomi HyperConnect integration."

How It's Supposed to Work

The architecture involves three components:

┌──────────────────────────────────────────────────────────┐
│                    LAPTOP "OFF" (S5)                      │
│                                                           │
│  ┌─────────────┐      ┌──────────────────────────────┐  │
│  │  Main CPU   │      │  Xiaomi IoT Module            │  │
│  │  (Intel X7) │      │  (dedicated MCU + Wi-Fi)      │  │
│  │             │      │                                │  │
│  │  FULLY OFF  │      │  • Own CPU (ARM Cortex-M)     │  │
│  │  No power   │      │  • Own Wi-Fi radio             │  │
│  │             │      │  • Own firmware (RTOS)         │  │
│  │             │      │  • TLS to Xiaomi cloud         │  │
│  │             │      │  • Wi-Fi creds in its flash    │  │
│  └─────────────┘      └──────────────┬─────────────────┘  │
│                                       │                    │
│                          ┌────────────▼────────────┐      │
│                          │  Power Management IC    │      │
│                          │  Triggers full boot     │      │
│                          └─────────────────────────┘      │
└──────────────────────────────────────────────────────────┘

Wake sequence:

1. Mi Home app sends "Power On" command
2. Command routes: App → Xiaomi Cloud → IoT Module (persistent TLS connection)
3. IoT module receives command, signals PMIC
4. PMIC triggers full system boot (BIOS POST → OS)
5. Windows/Linux boots normally

The Wi-Fi Password Problem

If the IoT module has its own Wi-Fi radio, how does it get the Wi-Fi credentials when the laptop is off?

The answer: the credentials are stored in the IoT module's own flash memory, not read from the OS at runtime. They're provisioned during:

1. Mi Home app binding — when you first pair the laptop, the app sends Wi-Fi credentials to the IoT module over Bluetooth or a temporary direct connection
2. Xiaomi PC Manager sync — the Windows service periodically syncs Wi-Fi credentials to the IoT module

If you change your Wi-Fi password, you'd need to re-provision the IoT module through Mi Home or PC Manager.

The Two-IP Test

Here's where the official narrative gets suspicious. If the IoT module truly has its own separate Wi-Fi radio, it should appear as a second device in your router's DHCP client list — with its own MAC address and IP address.

You should see 2 IPs when the laptop is shut down:

• One for the Intel BE201 Wi-Fi card (which should be OFF in S5)
• One for the IoT module's Wi-Fi radio (which should be ON)

If you only see 1 IP, the "separate IoT chip" theory is wrong, and we need to reconsider the architecture.

How to Test

# While laptop is ON, note all network devices
ip link show
# Note the MAC address of wlp0s20f3 (Intel BE201)

# Full shutdown (not sleep!)
sudo shutdown now

# From another device on the same network:
# Option 1: Check router's DHCP client list (web UI)
# Option 2: ARP scan
sudo arp-scan --localnet
# or
nmap -sn 192.168.1.0/24

# Look for any NEW MAC address that wasn't there when laptop was on

Revised Theory: It's NOT a Separate Radio

Intel's official documentation clarifies a critical limitation. From the Intel Community:

"Not all devices support Wireless Wake-on-LAN. Devices that do support Wireless Wake-on-LAN only support wake from system sleep states S3 or S4."

And from Intel's vPro documentation:

"S5 depend on the hardware BIOS. (Not all devices support Wireless Wake-on-LAN. Devices that do support Wireless Wake-on-LAN only support wake from system sleep states S3 or S4.)"

The Intel BE201 Wi-Fi card supports WoWLAN, but only from S3/S4 (sleep/hibernate), not from S5 (power off) on standard (non-vPro) platforms.

This means one of three things is happening:

Theory 1: Custom Firmware on Intel BE201 (Most Likely)

Xiaomi modified the Intel BE201's firmware or added a companion MCU that:

• Maintains a persistent TLS connection to Xiaomi cloud (not standard WoWLAN)
• Handles Xiaomi's proprietary protocol (not just magic packets)
• Stays powered in S5 via the +5VSB rail (similar to how desktop NICs stay powered)

From the router's perspective, this is 1 IP, 1 MAC — the Intel BE201's own address. The "IoT chip" is a firmware extension, not a separate radio.

Theory 2: Xiaomi Router Integration

The wake doesn't go through standard cloud infrastructure. Instead, it works through Xiaomi routers which maintain a direct connection to Xiaomi laptops on the LAN. When you send a wake command, the router itself broadcasts a wake signal.

This would explain:

• Why it's "built-in" (the router handles it)
• Why there's only 1 IP (the laptop's normal Wi-Fi connection)
• Why it requires Xiaomi ecosystem (phone + laptop + router)

Theory 3: The MCU Powers On Briefly

The IoT module doesn't maintain a permanent connection. It wakes every few minutes via RTC (Real-Time Clock), checks for pending commands, then goes back to sleep. This would explain very low power draw but introduce latency (could take minutes for a wake command to reach the device).

OS Compatibility

The wake itself is OS-agnostic — the IoT module sends a signal to the PMIC, which triggers a normal boot regardless of what OS is installed.

However, all post-wake ecosystem features require 小米电脑管家 (Xiaomi PC Manager), which is Windows-only. No Linux port exists, and the protocol is proprietary and undocumented.

On Linux, the IoT module is essentially a remote power button — it can turn the laptop on, but you'd need your own remote access solution (SSH, Tailscale, RustDesk) to interact with it.

Security Implications

1. Always-on network chip — An unaudited MCU with network access runs independently of your OS. You can't inspect its firmware, verify its encryption, or know what data it sends to Xiaomi's servers.
2. Wi-Fi credential storage — A copy of your Wi-Fi password lives on this chip's flash memory, outside your OS's control.
3. Cloud dependency — The wake feature only works through Xiaomi's cloud infrastructure. If Xiaomi's servers go down, or if the company decides to discontinue the feature, it stops working.
4. No security audit — Unlike Intel AMT (which has undergone extensive security research), the Xiaomi IoT module's firmware has not been publicly analyzed.
5. Ecosystem lock-in — Only works with Mi Home app, Xiaomi account, and (possibly) Xiaomi routers.

Comparison: Xiaomi vs. Intel AMT vs. Standard WoL

What You Can Actually Verify

1. Check your router's client list when the laptop is shut down — do you see 2 devices?
2. Check power draw — use a USB power meter or monitor battery drain over days while "off"
3. Test wake reliability — try waking after different durations (1 hour, 24 hours, 7 days)
4. Test without internet — disconnect the router from WAN, can you still wake locally?
5. Test with non-Xiaomi router — does it work, or does it require a Xiaomi router?

Conclusion

Xiaomi's remote wake feature is real — confirmed by hardware teardowns and official documentation. However, the exact implementation remains opaque. The "dedicated IoT chip" narrative doesn't fully hold up under scrutiny (the two-IP test is the simplest way to verify), and the most likely explanation is a custom firmware extension on the Intel BE201 Wi-Fi adapter combined with Xiaomi's cloud infrastructure.

The feature works, but comes with trade-offs: proprietary ecosystem dependency, unaudited always-on hardware, continuous battery drain, and a complete lack of transparency about the underlying implementation.

Sources

1. Xiaomi Book Pro 14 Official Product Page — Official claims and Footnote 18
2. Xiaomi PC Manager Help Page — Setup instructions for remote power on/off
3. HyperConnect Cross-Device Page — Ecosystem feature list
4. XimiTime Review: Xiaomi Book Pro 14 — IoT chip teardown confirmation
5. FoneArena: Redmi Book Pro 14/16 2026 — HyperOS Connect remote control features
6. Intel Community: WoWLAN Compatibility — Standard WoWLAN only supports S3/S4
7. Intel Community: Using Wireless to Wake Laptop — S5 wake requires vPro/AMT provisioning
8. Linux Wireless Documentation: WoWLAN — Technical details of WoWLAN implementation
9. Intel Wi-Fi 7 BE201 Support Page — BE201 specifications and driver support
10. Xiaomi HyperOS 4 Features — Remote file retrieval requires awake/powered state
11. Xiaomi IoT Privacy White Paper — Data collection practices for IoT devices
12. HITCON 2018: Reverse Engineering Xiaomi IoT — Technical analysis of Xiaomi IoT ecosystem