-
Notifications
You must be signed in to change notification settings - Fork 8
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
SUPPORT Request for Tuya RSH-GW-018 DM Zigbee Gateway ZS3L + WBRG1 Gateway #6
Comments
First your pictures is private so cant taking one closer look on them. |
Hi @MattWestb , |
The picture is now working so i can taking one close look later (i have seen the same some times before and its taking some times until being released). Try find the Linux console then its booting and its very likely on one of the connections. PS: the P2 is the first going to the Zigbee module but the last 3 is going to both but can being used for sortieing interesting. |
Hi, |
Great you getting the boot log from the WiFi / Bt module !! |
wbrg1, contains realtek RTL8721CSM wifi+bt with cortex cpu.. so it will be SOC, i think this project could help to write own system, and use it as you like.. |
It's say's rb8710, not sure is it compatible sdk with 8721 or not.. it could be different products |
Hi guys, |
@luconedj it's truly nothing to do with tuya, chip made bye realtek, and it contains cortex cpu, where all tuya software is running. Tuya only packed components from shelf and made it's software. So if you wana untie this device from tuya, you need to find out other software, or write in your own.. so SDK (Software development kits) are tool bundle which you're required to build and compile your own software.. Take example other tuya products which runs on ESP chips, they are also wifi chips with cpu, and also as same as @mihsu81 mentioned.. |
@geduxas thank you, got it. |
If can getting one ser2net working all shall being OK its the only thing that is needed. Hope we can getting one more tuya GW well hacked !!!!! |
Yes i hope the same! |
For ESP only USB-TTL is needed but for the ZS3L if not the bootloader (it shall working) you need flashing new bootloader on the MG21 chip you need one SWD that supporting MG2X devices (not all do it then its have extra hardware security). |
Hi @MattWestb , thanks. |
Its working 100% on MG1 chips like first and second gen IKEA devices but likely not on MG2X but some users have getting it working but i donnt knowing witch firmware and program they was using (I have one original Silabs WSDK do its one genuine Seeger device and its having extra things for Silabs chips in the firmware). |
mmm ok, i'll try, 7 euro is affordable and honestly it's long time that i need one to start playing with STM32 haah |
Hello guys! Here is the log: Info : The selected transport took over low-level target control. The results might differ compared to plain JTAG/SWD On the other Terminal with GDB: [luconedj@archlinux ~]$ cat gdb.cfg For help, type "help". Attached also dump.bin. Analyzing it with an hex editor, seems quite valid. I found also some tring related to Gecko bootloader and ember. |
Great work done @luconedj !!! |
Hi @MattWestb thank you very much for the feedback ❤️. |
https://www.silabs.com/documents/public/data-sheets/efr32mg21-datasheet.pdf |
Ok cool! So i think i don't have all.. i'll try to repeat process according to memory map you shared. Ill let u know thanks! |
ok i used this: nothing in user data... DECIMAL HEXADECIMAL DESCRIPTION19276 0x4B4C Boot section Start 0x57424257 End 0x42703857 What about WBRG1 ? any idea on this? |
Use same st-link for wbrg1 :) |
Yes.. but how? haah |
From https://www.silabs.com/documents/public/user-guides/ug103-06-fundamentals-bootloading.pdf On EFR32xG21, the main bootloader resides in main flash: And they is using 2 different bootloaders one for coordinator / CLI apps with X-Modem and one other for devices for OTA updates. And one good thing putting in the userdata if running EZSP: |
As told earlier it's just realtek chip inside.. so need to find out which pins are exposed in tuya board.. i almos sure you should find those easy. Here is realtek manual i found |
Yes i saw that application note, but i belive is not so useful because related to evaluation board. |
At least it's possible to open metal cap and solder wires directly to pins :) interesting how it's done in factory.. don't think they have flashed directly to chip and after that it was soldered to board.. |
Or, forget about wbrg1.. don't think it's worth investigating.. solder it out, pick some well known esp chip, find out required pins and use esp-link .. ZigBee just needs serial bridge :) |
Guys, I'm finally in! I've also managed to disconnect serial from Z3SL switching (desoldering) two of the jumper near P3. Now UART0 is directly exposed on P3 pads :). Still lot of work needed but I'm happy, this is definitely a good start.
For step 2 3 and 4 I really need your help 😀 |
Is the reset from the Z3SL exposed on PCB pads (on the module it is) ? Great work done !!! |
Thank you! |
You could try import esp-link project to that sdk.. both written in C++ so maybe it will require adopt some libraries, and will run |
The reset and the 2 first SWD pad is hardware locked and cant being changed before the app have booted but the SWD can ding disabled and / or remapped in the APP but very likely its not so the reset i think its active low but you can reading that in the datasheet of the EFR32MG21. ESPHome is also working OK i using it with my IKEA "Billy" and "Markus" modules !!! |
I confirm hw FC is in place, but if we burn Z3SL, can we just not use it right? |
Then one very brave user have dumping the the main flash we can always going back to factory firmware with the right bootloader then tuya have not protecting it so its good for playing with. |
For the same module made of one LIDL LED RGBWW light strips controller: |
Hello guys! Wifi driver is working well, UART driver is working too After some patch on PIN definition (this sdk is intended to be used with some EV board which remap the PA/PB PIN in some Arduino fashion style). |
Great work done @luconedj !!The problem with WH Flowcontroll shall normally not being any problems as long you not flooding the comport and / or the SOC cant processing the commands it getting and i have some test system running firmware and host without and its working OK but best have the same at both ends. |
Hi @MattWestb , |
Hello gents! [01-01 18:12:15 TUYA N][tuya_bt_sdk.c:141] ty bt sdk init success finish zigbee_boot_pin(TY_GPIOB4) init output high. So i've further modified it in order to pull GPIO_PB4 High at boot... and....
So original EZSP is:EmberZNet version: 6.5.5.0 build 432 And this, boot log from Zigbee2MQTT in HA:
So finally i have a working gateway (needs to be checked stability and everything ).tion What i would like to add is:
I'll try to upload procedures, dumps and code in a separate repo in short time ( maybe next week) |
Great work done !!!Is the "boot pin" connected to the Zigbee modules reset pin / pad ? |
Thank you very much @MattWestb ! Which seems strange 🤔 |
Then tuya have putting some extra code in the NCP firmware for muting the com to and from the Zigbee module but i think its little strange using the ADC pin then some normal GPIO is free (Silab have also logic for hardware coexistence with WiFi chip that supporting it and is using normal GPIOs) but its not in the standard firmware. |
Hello,
![20240226_135744](https://private-user-images.githubusercontent.com/40316776/308520784-eafcfb10-cd88-4887-b68b-824f39229f76.jpg?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MTg5NTAyMjIsIm5iZiI6MTcxODk0OTkyMiwicGF0aCI6Ii80MDMxNjc3Ni8zMDg1MjA3ODQtZWFmY2ZiMTAtY2Q4OC00ODg3LWI2OGItODI0ZjM5MjI5Zjc2LmpwZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA2MjElMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwNjIxVDA2MDUyMlomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPTEyZGQxZGExZTczYTc0OTVmMzY3NjdjODA0NTIxOGYxNmZkOTkxZDRlZWI4NGRiODQzYTAyODQ5YjA1M2Q5ZjcmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.c8Kz7B4A8w75ovtzuQpPrAU-ZSJ6j9JEqbo9QHfrFvg)
First of all i would like to say thank you for your commitment and effort on this!
I recently bought Tuya Smart Gateway model GW-018 (wifi + ble + zigbee) (https://a.aliexpress.com/_EjwjehJ)
My hope is to use it as "open" zigbee Gateway bridge detaching it from Tuya Cloud.
From PCB I see the well known ZS3L plus wifi+ble on separate WBRG1.
Do you have any suggestion? Do you think something feasible?
Thanks!
Luca
The text was updated successfully, but these errors were encountered: