SUPPORT Request for Tuya RSH-GW-018 DM Zigbee Gateway ZS3L + WBRG1 Gateway

[luconedj]

Hello,
First of all i would like to say thank you for your commitment and effort on this!
I recently bought Tuya Smart Gateway model GW-018 (wifi + ble + zigbee) (https://a.aliexpress.com/_EjwjehJ)
My hope is to use it as "open" zigbee Gateway bridge detaching it from Tuya Cloud.
From PCB I see the well known ZS3L plus wifi+ble on separate WBRG1.

Do you have any suggestion? Do you think something feasible?
Thanks!
Luca

[MattWestb]

First your pictures is private so cant taking one closer look on them.
The WiFi/Ble module is the one that doing the "tuya things".
https://developer.tuya.com/en/docs/iot/wbrg1-module-datasheet?id=Ka015vo8tfztz
The 7 row pads (i think its marked P3) for the Zigbee module SWD / debut interface plus comport for the tuya things. (the last is only likely).
P1 looks being one comport for console but cant see and you must testing if you is getting some output then booting from it.

[luconedj]

Hi @MattWestb ,
Thank you for your fast reply.
Sorry but I didn't get what you mean with private picture..
If i understood well, you are suggesting to test if some UART Output is present on P1 pads since you suspect it is for console right?
Somehow it seems that the P2 one is directly connected to ZS3L🤔 ?
Anyway, ill try both and ill report here any useful Output.
Thanks!

[MattWestb]

The picture is now working so i can taking one close look later (i have seen the same some times before and its taking some times until being released).

Try find the Linux console then its booting and its very likely on one of the connections.
If finding it the next step is trying getting in bootloader mode of the WiFi module but first the local console.

PS: the P2 is the first going to the Zigbee module but the last 3 is going to both but can being used for sortieing interesting.

[luconedj]

Hi,
You where right, uart out is on P1 :)
Here is the log, but i was not able to interrupt boot process..
Tried esc, Enter and all usual key.
Thanks!
Tuya.log

[MattWestb]

Great you getting the boot log from the WiFi / Bt module !!
Bad news is not running one Linux like the old Eth box was doing.
[01-01 18:12:15 TUYA N][tuya_device.c:139] SDK INFO: < TUYA IOT SDK V:3.1.7 BS:40.00_PT:2.2_LAN:3.4_CAD:1.0.4_CD:1.0.0 >
Its tuya IOT SDK / System so need looking if tuya IOT is hackebal or one SDK from the chip that is doing one normal Linux.

[geduxas]

wbrg1, contains realtek RTL8721CSM wifi+bt with cortex cpu.. so it will be SOC, i think this project could help to write own system, and use it as you like..

https://github.com/ambiot/ambd_sdk

[mihsu81]

@geduxas Or https://docs.libretiny.eu/

[geduxas]

@geduxas Or https://docs.libretiny.eu/

It's say's rb8710, not sure is it compatible sdk with 8721 or not.. it could be different products

[luconedj]

Hi guys,
Thanks Your feedbacks!
@MattWestb honestly I was not expecting Linux, but somehow I was expecting a kind of bootloader on it which seems not accessible (maybe?) Via that UART.
@geduxas, regarding amebaD, I cannot fine any reference to tuya SoC, I belive this are only for the radio Chip correct? In this case, do you have any suggestion for a way forward on it?
@mihsu81 , this is another very interesting project but seems that wbrg1 is in the unsupported board list (even if I see 2 flag on both wifi and bt colums? Not clear:( )
Regardless the alternative compatible SDK, how to flash then? And also this is for WiFi chip, should I do a similar stuff (new firmware) for ZS3L right?
Really appreciate your interest guys, Thank you very much!
Luca

[geduxas]

@luconedj it's truly nothing to do with tuya, chip made bye realtek, and it contains cortex cpu, where all tuya software is running.

Tuya only packed components from shelf and made it's software. So if you wana untie this device from tuya, you need to find out other software, or write in your own.. so SDK (Software development kits) are tool bundle which you're required to build and compile your own software..

Take example other tuya products which runs on ESP chips, they are also wifi chips with cpu, and also as same as @mihsu81 mentioned..

[luconedj]

@geduxas thank you, got it.
At this point I can pick one of the 2, try to write an hello world and then figure out how to tunnel ZS3L through wifi right?

[MattWestb]

If can getting one ser2net working all shall being OK its the only thing that is needed.
If not putting in one ESP8266 / 32 and cutting the com lines to the Zigbee module and it shall working as we is doing with ESPHome (some problems with the serial server is still there) or somthing else on the ESP.
The Zigbee module is pity good (MG21 chip) and can running newer EZSP or RCP / Thread firmware without problems only little week antenna for my taste (compered with Silabs original that IKEA is using).

Hope we can getting one more tuya GW well hacked !!!!!

[luconedj]

If can getting one ser2net working all shall being OK its the only thing that is needed. If not putting in one ESP8266 / 32 and cutting the com lines to the Zigbee module and it shall working as we is doing with ESPHome (some problems with the serial server is still there) or somthing else on the ESP. The Zigbee module is pity good (MG21 chip) and can running newer EZSP or RCP / Thread firmware without problems only little week antenna for my taste (compered with Silabs original that IKEA is using).

Hope we can getting one more tuya GW well hacked !!!!!

Yes i hope the same!
About EZSP, SWD must be used correct? if so, let me order a Chinese ST-Link V2 from Amazon :)

[MattWestb]

For ESP only USB-TTL is needed but for the ZS3L if not the bootloader (it shall working) you need flashing new bootloader on the MG21 chip you need one SWD that supporting MG2X devices (not all do it then its have extra hardware security).

[luconedj]

Hi @MattWestb , thanks.
do you know if this will work? (https://www.amazon.it/gp/product/B0B5WYQ4FT/ref=ppx_yo_dt_b_asin_title_o00_s00?ie=UTF8&th=1) sorry page is in italian basically is the st-link v2 clone.
Thanks,
Luca

[MattWestb]

Its working 100% on MG1 chips like first and second gen IKEA devices but likely not on MG2X but some users have getting it working but i donnt knowing witch firmware and program they was using (I have one original Silabs WSDK do its one genuine Seeger device and its having extra things for Silabs chips in the firmware).

[luconedj]

mmm ok, i'll try, 7 euro is affordable and honestly it's long time that i need one to start playing with STM32 haah
Thanks!

[luconedj]

Hello guys!
Got ST-Link v2 clone and made some progress here.
Using opeocd and arm-none-eabi-gdb with the attached configs, i managed to connect to Z3SL and dump memory (I think hahah):

Here is the log:
[luconedj@archlinux ~]$ cat st.cfg
set CPUTAPID 0x6BA02477
adapter driver hla
hla_layout stlink
hla_device_desc "ST-LINK"
hla_vid_pid 0x0483 0x3744 0x0483 0x3748 0x0483 0x374b 0x0483 0x374d 0x0483 0x374e 0x0483 0x374f 0x0483 0x3752 0x0483 0x3753 0x0483 0x3754 0x0483 0x3755 0x0483 0x3757
transport select hla_swd
adapter speed 50
[luconedj@archlinux ~]$ openocd -f st.cfg -f target/efm32.cfg -c "gdb_memory_map disable"
Open On-Chip Debugger 0.12.0
Licensed under GNU GPL v2
For bug reports, read
http://openocd.org/doc/doxygen/bugs.html
adapter speed: 50 kHz

Info : The selected transport took over low-level target control. The results might differ compared to plain JTAG/SWD
Info : Listening on port 6666 for tcl connections
Info : Listening on port 4444 for telnet connections
Info : clock speed 1000 kHz
Info : STLINK V2J39S7 (API v2) VID:PID 0483:3748
Info : Target voltage: 3.246684
Info : [efm32.cpu] Cortex-M33 r0p3 processor detected
Info : [efm32.cpu] target has 8 breakpoints, 4 watchpoints
Info : starting gdb server for efm32.cpu on 3333
Info : Listening on port 3333 for gdb connections
Info : accepting 'gdb' connection on tcp/3333
[efm32.cpu] halted due to debug-request, current mode: Thread
xPSR: 0x69000000 pc: 0x0000e6a0 msp: 0x2000b4f8
Info : dropped 'gdb' connection

On the other Terminal with GDB:

[luconedj@archlinux ~]$ cat gdb.cfg
target extended-remote 127.0.0.1:3333
set confirm off
monitor halt
info mem
dump memory dump.bin 0x00000000 0x00080000
quit
[luconedj@archlinux ~]$ arm-none-eabi-gdb -x gdb.cfg
GNU gdb (GDB) 14.1
Copyright (C) 2023 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later http://gnu.org/licenses/gpl.html
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
Type "show copying" and "show warranty" for details.
This GDB was configured as "--host=x86_64-pc-linux-gnu --target=arm-none-eabi".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
https://www.gnu.org/software/gdb/bugs/.
Find the GDB manual and other documentation resources online at:
http://www.gnu.org/software/gdb/documentation/.

For help, type "help".
Type "apropos word" to search for commands related to "word".
warning: No executable has been specified and target does not support
determining executable automatically. Try using the "file" command.
0x0000e6a0 in ?? ()
Using memory regions provided by the target.
There are no memory regions defined.
[Inferior 1 (Remote target) detached]
[luconedj@archlinux ~]$

Attached also dump.bin. Analyzing it with an hex editor, seems quite valid. I found also some tring related to Gecko bootloader and ember.
dump.bin.zip
Any feedback really appreciated 👏!!
THanks guys,
Luca

[MattWestb]

Great work done @luconedj !!!
The first 0x0 - 0x3FFFF is the bootloder and then the "APP" is resident 0x4000 as long its need and after that is one random block of for the NVM file higher in the flash memory.
If all is being OK dumped it shall being possible restoring the module also after one chip erase.
The main flash is good but some chip information is stored in the aria "user data" that can being needed / interesting if tuya have using it and putting some device specific there we can need it in the future.

[luconedj]

Hi @MattWestb thank you very much for the feedback ❤️.
Do you know How to extract user data?
Meanwhile I'm still stuck on WBRG1, I'm not able to find a way to interact with it. If you look at the boot log, you will find this output:
[01-01 18:12:15 TUYA N][af-main-host.c:659] >>>Normal UART bootup with FLOWCTRL<<<
And exactly at that point, there is some kind of fixed pause in the output (like waiting for some interrupt character/pin) and then it continues..
My thought is that due to some Hw flow control, it is ignoring my button pressed, what do you think, any suggestion on the WiFi bastard?
Thanks!

[MattWestb]

https://www.silabs.com/documents/public/data-sheets/efr32mg21-datasheet.pdf
Figure 3.2. EFR32MG21 Memory Map — Core Peripherals and Code Space
You shall have it all.
If i remember shall GDB detecting it and you can listing it (at least with MG1P chips) with the information command.
Do one normal dump with start and end dress / range or the name of the memory bank shall working OK like you was doing with the main flash.

[luconedj]

Ok cool!
To let it works i used this on GDB:
-c "gdb_memory_map disable"
And in openocd conf:
dump memory dump.bin 0x00000000 0x00080000

So i think i don't have all.. i'll try to repeat process according to memory map you shared. Ill let u know thanks!
Luca

[luconedj]

ok i used this:
dump memory flash.bin 0x00000000 0x00100000
dump memory flash_user.bin 0x0fe00000 0x0fe00400
dump memory flash_dev_info.bin 0x0fe08000 0x0fe08400
dump memory flash_chip_config.bin 0x0fe0e000 0x0fe0e400
dump memory flash_reserved_partial.bin 0x0ff00000 0x0ff00400

nothing in user data...
This is binwalk out on flash.bin:

DECIMAL HEXADECIMAL DESCRIPTION

19276 0x4B4C Boot section Start 0x57424257 End 0x42703857

What about WBRG1 ? any idea on this?
Thank you so much!
Luca

[geduxas]

Use same st-link for wbrg1 :)

[MattWestb]

Only the first two is interesting then device info is burned in the factory and we dont have any user of the info stored in the RAM then the processor is running in debug mode.
One IKEA 3trd gen controller with Silabs commander:

[luconedj]

Use same st-link for wbrg1 :)

Yes.. but how? haah

[luconedj]

Only the first two is interesting then device info is burned in the factory and we dont have any user of the info stored in the RAM then the processor is running in debug mode. One IKEA 3trd gen controller with Silabs commander:

Ok Perfect, it make sense.
Thanks!

[MattWestb]

nothing in user data...
This is binwalk out on flash.bin:

DECIMAL HEXADECIMAL DESCRIPTION
19276 0x4B4C Boot section Start 0x57424257 End 0x42703857

From https://www.silabs.com/documents/public/user-guides/ug103-06-fundamentals-bootloading.pdf

On EFR32xG21, the main bootloader resides in main flash:
• Main bootloader @ 0x0
• Application @ 0x4000

And they is using 2 different bootloaders one for coordinator / CLI apps with X-Modem and one other for devices for OTA updates.

And one good thing putting in the userdata if running EZSP:
https://github.com/MattWestb/EFR32-FW/tree/main/Branding_EFR32

[geduxas]

Use same st-link for wbrg1 :)

Yes.. but how? haah

As told earlier it's just realtek chip inside.. so need to find out which pins are exposed in tuya board.. i almos sure you should find those easy.

Here is realtek manual i found
AN0400 Ameba-D Application Note_v3_watermark.pdf

[luconedj]

Use same st-link for wbrg1 :)

Yes.. but how? haah

As told earlier it's just realtek chip inside.. so need to find out which pins are exposed in tuya board.. i almos sure you should find those easy.

Here is realtek manual i found AN0400 Ameba-D Application Note_v3_watermark.pdf

Yes i saw that application note, but i belive is not so useful because related to evaluation board.
This should be the pinout of the chip:

Pin 33 and 43.
I tried all the probable Combination on WRGB1 but i think SWD is not exposed because im not able to see anything. Morover I'm not able to find anything related to SWD for 8721.
Thanks!
Luca

[frescof]

Thanks a lot @gpaesano, sono Italiano pure io.
I flashed your binaries with the linux version of the AmebaD image tool and all went fine.
When flashed I was using your version 7.4.3 EmberZNet and I was still seeing crashes or z2m freezing. I then tried unsuccessfully to flash the 8.0.2. Couldn't find the way to flash the board, even using the double click that I see in the code.
Here the logs: logs.txt

Went on and attempted to build your source and flash with the Arduino IDE.
I probably did something wrong, surely my fault, and now it hang when booting:
#[MODULE_BOOT-LEVEL_ERROR]:IMG2 SIGN Invalid
Is there a hardware way to force uart download?
Did I brick it ?

[TheNitek]

Thanks for all the effort!
I am trying to recreate the Arduino setup, but unfortunately the build fails:

Zigbee_Gateway_WebAP.ino:289:26: error: 'struct in_addr' has no member named 's_addr'; did you mean 'in_addr'?
     server_addr.sin_addr.s_addr = INADDR_ANY;

Also I haven't fully understand how to get the firmware onto the device. Do I need to use a ST-Link to flash it or is a UART adapter enough?

[gpaesano]

@frescof No there is no way to brick it. You can always reflash it.
So just to clarify:

• 3 clicks on power up to go in OTA update for the WBRG1 module via Arduino (a port should appear under tools-port menu);
• 2 click on power up to allow updating the zigbee module ZS3L via network - wifi using the silabs flasher
• long press goes in AP wifi mode to configure username and password from a wifi connected web browser.
  First step is to assure that the firmware on the WBRG1 module is running, otherwise nothing of the above will work.
  Please check that the module in your gateway is a WBRG1.
  It can be programmed via serial interface @115200 baud 8 n 1. To enter program mode you need to pull down to GND the LOG UART TX pin with a 1000 ohm resistor while PON or reset the module. If you have a serial monitor on the LOG UART active you will see a message that confirm the flash mode.
  To flash it you can use the https://github.com/ambiot/ambd_sdk/blob/dev/tools/AmebaD/Image_Tool/ImageTool.exe or the Arduino ide.
  To use the Arduino IDE you need to install the AmebaD library in the Arduino environment, please see the Realtek site and set the board as SparkFun AzureWave Thing Plus - AW-CU488 (RTL8721DM).
  Today I am flashing only via OTA or Arduino, in case you have trouble let me know I will try back with the AmebaD tool.
  @TheNitek: it seems that some library is missing, s_addr does exist, I will see where it is declared and be back.
  @frescof: yes, there was a small bug for silabs flasher to work, as I changed something in the UART to allow the gateway to work as router zigbee as well. Sorry for that I did not re-test. Anyway if you are getting red-blue alternate flashing after the double click it means that the module WBRG1 is running well and will put the ZS3L in bootload mode. This is my output of the silabs flasher (got with the attached firmware of WBRG1):
  flash and zigbee log.txt
  Use the last zigbee firmware for the Z3SL
  Zigbee_Gateway_WebAP.zip
  Hope will help.

[gpaesano]

@frescof please do an "erase only" before flashing for a clean flash (I think the message you're reporting happened to me as well).

[TheNitek]

I manged to compile with Arduino and upload (the _IN_ADDR_T_DECLARED is somehow ignored and I had to mess around in the framework a bit, but then it compiled).
now the ZS3L flashing fails. When connection directly to the socket, the output is scrambled:

Gecko Bootloader v1.9.2
3 eb nob
       L>
B  lif b 19.

so I guess there is something wrong with the UART connection with the initial ZS3L-Firmware?

[TheNitek]

I figured it out, I had to remove this line:
Serial.print(txrx_buffer[bytes_read],HEX);

[gpaesano]

@TheNitek , Please use the last source in the .zip version attached above. It will set up the uart at the very beginning avoiding this error.

[gpaesano]

@TheNitek
Serial.print is used to print to the log UART, it should not create any issue.
To go in flashing mode for the ZS3L double click at power on, then red and blue led should blink alternatively. If so you can then try to flash the Z3SL with silabs flasher. Please use version 8 in the last G01-pro-ncp-uart-hw_4.zip.
Before flashing issue a probe to see if the module is answering:

universal-silabs-flasher --device socket://192.168.111.189:80 --ezsp-baudrate 115200 --probe-method ezsp probe

(replace the ip address above with your one) you should see something like:

2024-10-30 19:54:26.340 PC-CASA universal_silabs_flasher.flasher INFO Probing ApplicationType.EZSP at 115200 baud
2024-10-30 19:54:26.607 PC-CASA universal_silabs_flasher.flasher INFO Detected ApplicationType.EZSP, version '8.0.2.0 build 397' (8.0.2.0.397) at 115200 baudrate (bootloader baudrate None)
2024-10-30 19:54:26.607 PC-CASA universal_silabs_flasher.flash INFO Dumping EmberZNet Config
CONFIG_PACKET_BUFFER_COUNT=8192
CONFIG_NEIGHBOR_TABLE_SIZE=16
CONFIG_APS_UNICAST_MESSAGE_COUNT=10
CONFIG_BINDING_TABLE_SIZE=32
CONFIG_ADDRESS_TABLE_SIZE=8
.... LONG LIST OF PARAMETERS

[TheNitek]

I think the Serial.print messed with the timing of the UART reading. Removing it fixed it for me and flashing also worked, so my device is working now. Thanks a lot!

[gpaesano]

@TheNitek Once flashed with the new firmwares the protocol between the WBRG1 and the Z3SL is HW via RTS and CTS so there should not be any issue in the timing. You can see the messages between the host (Zigbee2MQTT) and the Z3SL on the log UART (half of them if you had to remove the line above).
Hope it works.

[mypaxa00]

Hey @gpaesano could you please help me?
I've flashed WBRG1 with you arduino sketch, had to try different libraries verions until compiled, because none of other flashing methods works for me. And now I want to flash the ZS3L through the "double click" mode, but have no luck probing the board, it blinked with blue light once and nothing.
Here is the logs I receive while probing. Maybe you have some ideas.

$ universal-silabs-flasher --device socket://192.168.0.107:80 --verbose --ezsp-baudrate 115200 --probe-method ezsp probe
2024-11-08 11:04:49.600 wsl-main asyncio DEBUG Using proactor: IocpProactor
2024-11-08 11:04:49.601 wsl-main universal_silabs_flasher.flasher INFO Probing ApplicationType.EZSP at 115200 baud
2024-11-08 11:04:49.601 wsl-main zigpy.serial DEBUG Opening a serial connection to 'socket://192.168.0.107:80' (baudrate=115200, xonxoff=True, rtscts=False)
2024-11-08 11:04:49.636 wsl-main zigpy.serial DEBUG Connection made: <bellows.ash.AshProtocol object at 0x000001A4EB5D5820>
2024-11-08 11:04:50.640 wsl-main bellows.ezsp DEBUG Resetting EZSP
2024-11-08 11:04:50.640 wsl-main bellows.uart DEBUG Resetting ASH
2024-11-08 11:04:50.640 wsl-main bellows.ash DEBUG Sending frame CANCEL + RstFrame() + FLAG
2024-11-08 11:04:50.640 wsl-main bellows.ash DEBUG Sending data  1ac038bc7e
2024-11-08 11:04:50.687 wsl-main bellows.ash DEBUG Received data 0d0a4765636b6f20426f6f746c6f616465626c69660d4220200d0a47636f426f6c6172762e2e320a2e75706c6120620d3220750d3320622069660d4220200d0a47656b20426f6c616520312e2e0d312e20706f64676c0a2e726e0a2e656c206e6f0a4c3e000d47656b206f6f6c61652031392e0d312e20706f64676c0a2e726e0a2e656c206e6f0a4c3e00
2024-11-08 11:04:55.646 wsl-main zigpy.serial DEBUG Waiting for serial port to close
2024-11-08 11:04:55.646 wsl-main zigpy.serial DEBUG Connection lost: None
2024-11-08 11:04:55.646 wsl-main bellows.uart DEBUG Connection lost: None
Error: Failed to probe running application type

[gpaesano]

See post above. if red and blu are not alternating then either the double click failed or the firmware compilation is wrong.
Remeber to use the Sparkfun AzureWave Board in the Arduino setting otherwise port mapping will fail.

To go in flashing mode for the ZS3L double click at power on, then red and blue led should blink alternatively. If so you can then try to flash the Z3SL with silabs flasher. Please use version 8 in the last G01-pro-ncp-uart-hw_4.zip.
Before flashing issue a probe to see if the module is answering:

universal-silabs-flasher --device socket://192.168.111.189:80 --ezsp-baudrate 115200 --probe-method ezsp probe

(replace the ip address above with your one) you should see something like:

2024-10-30 19:54:26.340 PC-CASA universal_silabs_flasher.flasher INFO Probing ApplicationType.EZSP at 115200 baud
2024-10-30 19:54:26.607 PC-CASA universal_silabs_flasher.flasher INFO Detected ApplicationType.EZSP, version '8.0.2.0 build 397' (8.0.2.0.397) at 115200 baudrate (bootloader baudrate None)
2024-10-30 19:54:26.607 PC-CASA universal_silabs_flasher.flash INFO Dumping EmberZNet Config

[mypaxa00]

Yes. That what I acually did. Had lights alternating several times, but...
Does it mean that ZS3L is not in the bootloader mode?

[mypaxa00]

Ok. So I manually shorted some pins to the GND and managed to get this result, but cant figura out why it is not processing further.

DEBUG Opening a serial connection to 'socket://192.168.0.107:80' (baudrate=115200, xonxoff=True, rtscts=False)
DEBUG Connection made: <bellows.ash.AshProtocol object at 0x000001B6C41183A0>
DEBUG Received data 1ac102029b7b7e0d0a4765636b6f2042
DEBUG Received cancel byte, clearing buffer
DEBUG Received frame RStackFrame(version=2, reset_code=<NcpResetCode.RESET_POWER_ON: 2>)
DEBUG Resetting EZSP
DEBUG Resetting ASH
DEBUG Sending frame CANCEL + RstFrame() + FLAG
DEBUG Sending data  1ac038bc7e
DEBUG Received data 1ac1020b0a527e
DEBUG Received cancel byte, clearing buffer
DEBUG Received frame RStackFrame(version=2, reset_code=<NcpResetCode.RESET_SOFTWARE: 11>)
DEBUG Switching to EZSP protocol version 4
DEBUG Sending command  version: () {'desiredProtocolVersion': 4}
DEBUG Sending frame DataFrame(frm_num=0, re_tx=False, ack_num=0, ezsp_frame=b'\x00\x00\x00\x04') + FLAG
DEBUG Sending data  004221a850ed2c7e
DEBUG Received data 0142a1a8532845d7cf007e
DEBUG Received frame DataFrame(frm_num=0, re_tx=0, ack_num=1, ezsp_frame=b'\x00\x80\x00\x07\x02Pe')
DEBUG Sending frame AckFrame(res=0, ncp_ready=0, ack_num=1) + FLAG
DEBUG Sending data  8160597e
DEBUG Received command version: {'protocolVersion': 7, 'stackType': 2, 'stackVersion': 25936}
DEBUG Changing ACK timeout from 1.60 to 1.41
DEBUG Switching to EZSP protocol version 7
DEBUG Sending command  version: () {'desiredProtocolVersion': 7}
DEBUG Sending frame DataFrame(frm_num=1, re_tx=False, ack_num=1, ezsp_frame=b'\x00\x00\xff\x00\x00\x07') + FLAG
DEBUG Sending data  7d31422157542a1240277e
DEBUG Received data 1242a157542a12b009f175cb7e
DEBUG Received frame DataFrame(frm_num=1, re_tx=0, ack_num=2, ezsp_frame=b'\x00\x80\xff\x00\x00\x07\x02Pe')
DEBUG Sending frame AckFrame(res=0, ncp_ready=0, ack_num=2) + FLAG
DEBUG Sending data  82503a7e
DEBUG Received command version: {'protocolVersion': 7, 'stackType': 2, 'stackVersion': 25936}
DEBUG Changing ACK timeout from 1.41 to 1.23
DEBUG EZSP Stack Type: 2, Stack Version: 6550, Protocol version: 7
DEBUG Sending command  getMfgToken: () {'tokenId': <EzspMfgTokenId.MFG_STRING: 1>}
DEBUG Sending frame DataFrame(frm_num=2, re_tx=False, ack_num=2, ezsp_frame=b'\x01\x00\xff\x00\x0b\x01') + FLAG
DEBUG Sending data  2243215754211438b47e
DEBUG Received data 2343a1575421054da66bb5da55aa6db663b1d854123198d6777e
DEBUG Received frame DataFrame(frm_num=2, re_tx=0, ack_num=3, ezsp_frame=b'\x01\x80\xff\x00\x0b\x10\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff')
DEBUG Sending frame AckFrame(res=0, ncp_ready=0, ack_num=3) + FLAG
DEBUG Sending data  83401b7e
DEBUG Received command getMfgToken: {'tokenData': b'\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff'}
DEBUG Changing ACK timeout from 1.23 to 1.09
DEBUG Read MFG_STRING token: b'\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff'
DEBUG Sending command  getMfgToken: () {'tokenId': <EzspMfgTokenId.MFG_BOARD_NAME: 2>}
DEBUG Sending frame DataFrame(frm_num=3, re_tx=False, ack_num=3, ezsp_frame=b'\x02\x00\xff\x00\x0b\x02') + FLAG
DEBUG Sending data  33402157542117492d7e
DEBUG Received data 3440a1575421054da66bb5da55aa6db663b1d8541231987b797e
DEBUG Received frame DataFrame(frm_num=3, re_tx=0, ack_num=4, ezsp_frame=b'\x02\x80\xff\x00\x0b\x10\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff')
DEBUG Sending frame AckFrame(res=0, ncp_ready=0, ack_num=4) + FLAG
DEBUG Sending data  8430fc7e
DEBUG Received command getMfgToken: {'tokenData': b'\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff'}
DEBUG Changing ACK timeout from 1.09 to 0.96
DEBUG Read MFG_BOARD_NAME token: b'\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff'
DEBUG Sending command  getValue: () {'valueId': <EzspValueId.VALUE_VERSION_INFO: 17>}
DEBUG Sending frame DataFrame(frm_num=4, re_tx=False, ack_num=4, ezsp_frame=b'\x03\x00\xff\x00\xaa\x11') + FLAG
DEBUG Sending data  444121575480049db57e
DEBUG Received data 4541a157548015b5e9954c20af553889db7e
DEBUG Received frame DataFrame(frm_num=4, re_tx=0, ack_num=5, ezsp_frame=b'\x03\x80\xff\x00\xaa\x00\x07\xb0\x01\x06\x05\x05\x00\xaa')
DEBUG Sending frame AckFrame(res=0, ncp_ready=0, ack_num=5) + FLAG
DEBUG Sending data  8520dd7e
DEBUG Received command getValue: {'status': <EzspStatus.SUCCESS: 0>, 'value': b'\xb0\x01\x06\x05\x05\x00\xaa'}
DEBUG Changing ACK timeout from 0.96 to 0.85
DEBUG Waiting for serial port to close
DEBUG Connection lost: None
DEBUG Connection lost: None
**INFO Detected ApplicationType.EZSP, version '6.5.5.0 build 432' (6.5.5.0.432) at 115200 baudrate (bootloader baudrate None)**
DEBUG Opening a serial connection to 'socket://192.168.0.107:80' (baudrate=115200, xonxoff=True, rtscts=False)
DEBUG Connection made: <bellows.ash.AshProtocol object at 0x000001B6C4142070>
DEBUG Resetting EZSP
DEBUG Resetting ASH
DEBUG Sending frame CANCEL + RstFrame() + FLAG
DEBUG Sending data  1ac038bc7e
DEBUG Received data 1ac1020b0a527e
DEBUG Received cancel byte, clearing buffer
DEBUG Received frame RStackFrame(version=2, reset_code=<NcpResetCode.RESET_SOFTWARE: 11>)
DEBUG Switching to EZSP protocol version 4
DEBUG Sending command  version: () {'desiredProtocolVersion': 4}
DEBUG Sending frame DataFrame(frm_num=0, re_tx=False, ack_num=0, ezsp_frame=b'\x00\x00\x00\x04') + FLAG
DEBUG Sending data  004221a850ed2c7e
DEBUG Received data 0142a1a8532845d7cf007e
DEBUG Received frame DataFrame(frm_num=0, re_tx=0, ack_num=1, ezsp_frame=b'\x00\x80\x00\x07\x02Pe')
DEBUG Sending frame AckFrame(res=0, ncp_ready=0, ack_num=1) + FLAG
DEBUG Sending data  8160597e
DEBUG Received command version: {'protocolVersion': 7, 'stackType': 2, 'stackVersion': 25936}
DEBUG Changing ACK timeout from 1.60 to 1.41
DEBUG Switching to EZSP protocol version 7
DEBUG Sending command  version: () {'desiredProtocolVersion': 7}
DEBUG Sending frame DataFrame(frm_num=1, re_tx=False, ack_num=1, ezsp_frame=b'\x00\x00\xff\x00\x00\x07') + FLAG
DEBUG Sending data  7d31422157542a1240277e
DEBUG Received data 1242a157542a12b009f175cb7e
DEBUG Received frame DataFrame(frm_num=1, re_tx=0, ack_num=2, ezsp_frame=b'\x00\x80\xff\x00\x00\x07\x02Pe')
DEBUG Sending frame AckFrame(res=0, ncp_ready=0, ack_num=2) + FLAG
DEBUG Sending data  82503a7e
DEBUG Received command version: {'protocolVersion': 7, 'stackType': 2, 'stackVersion': 25936}
DEBUG Changing ACK timeout from 1.41 to 1.23
DEBUG EZSP Stack Type: 2, Stack Version: 6550, Protocol version: 7
DEBUG Sending command  launchStandaloneBootloader: () {'mode': 1}
DEBUG Sending frame DataFrame(frm_num=2, re_tx=False, ack_num=2, ezsp_frame=b'\x01\x00\xff\x00\x8f\x01') + FLAG
DEBUG Sending data  2243215754a514efe87e
DEBUG Received data 2343a15754a51565787e
DEBUG Received frame DataFrame(frm_num=2, re_tx=0, ack_num=3, ezsp_frame=b'\x01\x80\xff\x00\x8f\x00')
DEBUG Sending frame AckFrame(res=0, ncp_ready=0, ack_num=3) + FLAG
DEBUG Sending data  83401b7e
DEBUG Received command launchStandaloneBootloader: {'status': <EmberStatus.SUCCESS: 0>}
DEBUG Changing ACK timeout from 1.23 to 1.09
DEBUG Received data 0d0a4765636b6f20426f6f746c6f616465722076312e392e320d0a312e20756c6120620d3220750d33206562206e6f0a4c3e00
DEBUG Waiting for serial port to close
DEBUG Connection lost: None
DEBUG Connection lost: None
**INFO Probing ApplicationType.GECKO_BOOTLOADER at 115200 baud**
DEBUG Opening a serial connection to 'socket://192.168.0.107:80' (baudrate=115200, xonxoff=False, rtscts=False)
DEBUG Connection made: <_ProactorSocketTransport fd=1152>
DEBUG Sending data b'\n'
DEBUG Sending data GeckoBootloaderOption.EBL_INFO
DEBUG Parsing State.WAITING_FOR_MENU: bytearray(b'\r\nGecko Bootloader v1.9.2\r1 podgl\n.rn\n.elino\nL>\x00\rGek oolae 19.\r1. podgl\n.rn\n.el no\nL>\x00')
DEBUG Waiting for serial port to close
DEBUG Connection lost: None
**RuntimeError: Failed to probe running application type**

[gpaesano]

if it is flashing double click is ok and the module should go in bootloader mode without any need to GND any pin (cpu will do it).
please try to run it without verbose. Anyway it is better than before...

[frescof]

Hello all. I have been doing a bunch of testing. As I was saying I had continuous zigbee2mqtt crahes, with kinda random deelay.
I really have no idea what is causing this issue, a defective device or whatever could be. Couldn't isolate the originating issue.
But I had anyway an average of 10 crashes/day. Really annoying. Always same error:

[2024-11-09 00:20:03] warning: 	zh:ember:uart:ash: Frame(s) in progress cancelled in [6469b1a97d312a15b658904124ab159f499ce83ab38e5a77ebd67d1ac20203d20a7e]
[2024-11-09 00:20:03] error: 	zh:ember:uart:ash: Received ERROR from adapter, with code=RESET_WATCHDOG.
[2024-11-09 00:20:03] error: 	zh:ember:uart:ash: ASH disconnected | Adapter status: ASH_NCP_FATAL_ERROR
[2024-11-09 00:20:03] error: 	zh:ember:uart:ash: Error while parsing received frame, status=ASH_NCP_FATAL_ERROR.
[2024-11-09 00:20:03] error: 	zh:ember: Adapter fatal error: HOST_FATAL_ERROR
[2024-11-09 00:20:03] info: 	zh:ember:uart:ash: ASH COUNTERS since last clear:
[2024-11-09 00:20:03] info: 	zh:ember:uart:ash:   Total frames: RX=66, TX=111
[2024-11-09 00:20:03] info: 	zh:ember:uart:ash:   Cancelled   : RX=1, TX=0
[2024-11-09 00:20:03] info: 	zh:ember:uart:ash:   DATA frames : RX=62, TX=45
[2024-11-09 00:20:03] info: 	zh:ember:uart:ash:   DATA bytes  : RX=1066, TX=598
[2024-11-09 00:20:03] info: 	zh:ember:uart:ash:   Retry frames: RX=1, TX=1
[2024-11-09 00:20:03] info: 	zh:ember:uart:ash:   ACK frames  : RX=1, TX=64
[2024-11-09 00:20:03] info: 	zh:ember:uart:ash:   NAK frames  : RX=0, TX=0
[2024-11-09 00:20:03] info: 	zh:ember:uart:ash:   nRdy frames : RX=0, TX=0
[2024-11-09 00:20:03] info: 	zh:ember:uart:ash:   CRC errors      : RX=0
[2024-11-09 00:20:03] info: 	zh:ember:uart:ash:   Comm errors     : RX=0
[2024-11-09 00:20:03] info: 	zh:ember:uart:ash:   Length < minimum: RX=0
[2024-11-09 00:20:03] info: 	zh:ember:uart:ash:   Length > maximum: RX=0
[2024-11-09 00:20:03] info: 	zh:ember:uart:ash:   Bad controls    : RX=0
[2024-11-09 00:20:03] info: 	zh:ember:uart:ash:   Bad lengths     : RX=0
[2024-11-09 00:20:03] info: 	zh:ember:uart:ash:   Bad ACK numbers : RX=0
[2024-11-09 00:20:03] info: 	zh:ember:uart:ash:   Out of buffers  : RX=0
[2024-11-09 00:20:03] info: 	zh:ember:uart:ash:   Retry dupes     : RX=1
[2024-11-09 00:20:03] info: 	zh:ember:uart:ash:   Out of sequence : RX=0
[2024-11-09 00:20:03] info: 	zh:ember:uart:ash:   ACK timeouts    : RX=1
[2024-11-09 00:20:03] info: 	zh:ember:uart:ash: ======== ASH stopped ========
[2024-11-09 00:20:03] info: 	zh:ember:ezsp: ======== EZSP stopped ========
[2024-11-09 00:20:03] info: 	zh:ember: ======== Ember Adapter Stopped ========
[2024-11-09 00:20:03] error: 	z2m: Adapter disconnected, stopping

But I finally managed to find what was causing the crash and it's related to flow control.
After my changes, what was causing z2m to crash is now giving:

[2024-11-10 10:32:21] error: zh:ember:uart:ash: Received frame with CRC error

and no crashes. Haven't seen a crash for more that 24h now, a record!

I can confirm that I had exactly the same issue as TheNitek about the Serial.print line non allowing to flash the ZS3L module.
I then removed completely the zigbee packet logging on the serial (not very useful to me actually, just a bunch of numbers...)
With the changes done on the uart now the ota flashing of ZS3L doesn't hang at 100% anymore.

On top of what gpaesano did (thanks dude!), I added a "single" click on boot function that will cause the module to go in uartburn so that is possible to flash it via serial port.
This way it is possible to flash a firmware without Arduino IDE or to flash without wifi.

Here the source code and the binary that can be flashed directly with Image Tool (better do an erase flash as gpaesano advised)

Zigbee_Gateway_WebAP_01.zip

If somebody had similar crashes to mine and this solve their issue please let me know
Cheers

[mypaxa00]

Nice. I manged to flash ZS3L using your firmware for WBRG1.
Thanks @frescof.

[gpaesano]

Hey, you have to set your wifi ssid and password. You can easily do this at the very first run or by longpressing the button during poower on. The gataway will create a wifi "|GW_Network", use a mobile phone to connect to and then using a browers visit the page:| |http://192.168.1.1/L| | | |(please do not use https://) | |you will be able to insert your local wifi name and passwerd, which will e stored in eeprom.| |Then reset the gateway, which will connetct to your network.| |Hope it help.| |All the best| |gpaesano | Il 07/11/2024 10:14, Artem Murashko ha scritto:

…

Hey @gpaesano <https://github.com/gpaesano> Could you plese help me with your Arduino frimware. I've flashed it through the arduino IDE, but forget to update my wifi credentials. And now I have this. Is there a way to enter upload mode again. I'm trying the original method with shorting the LOG UART TX to GND through 1000 ohm, but it does not work anymore. And it looks like AP does not start. I even tried to create hotspot with default credentials for gateway to connect and enter ota mode, but have no success. Logs: |UART done Start FlashStoreAndRetrieve on Rtlduino RTL8720DN FlashStorage_RTL8720 v1.1.0 FlashStorage length: 4096 Get ssid = YourWifi Get pass = WifiPassword Request to configure ...IPv4 enabled WIFI is not running Initializing WIFI ... WIFI initialized Starting AP ... GW_Network started Error!!!upd_new error IP Address: 192.168.1.80 NetMask: 255.255.255.0 Gateway: 192.168.1.1 SSID: GW_Network BSSID: 18:DE:50:E0:F:87 Encryption Type:4 ERROR opening socket [ERROR] Socket conntect failed [ERROR] Accept connection failed [ERROR] Accept connection failed [ERROR] Accept connection failed | If I try to enter OTA then I have this: |UART done Start FlashStoreAndRetrieve on Rtlduino RTL8720DN FlashStorage_RTL8720 v1.1.0 FlashStorage length: 4096 Get ssid = YourWifi Get pass = WifiPassword Pressed...Released... Pressed...Released... Pressed...Released... 3 click(s) Request to OTA ...[MAIN] Attempting to connect to SSID: YourWifi interface 0 is initialized interface 1 is initialized Initializing WIFI ... WIFI initialized RTL8721D[Driver]: set ssid [YourWifi] dissconn reason code: 0 scan stage, scan timeout [MAIN] Attempting to connect to SSID: YourWifi RTL8721D[Driver]: set ssid [YourWifi] dissconn reason code: 0 scan stage, scan timeout | — Reply to this email directly, view it on GitHub <#6 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AXLCXXC25ZZGGRXBRABBGSDZ7MVOJAVCNFSM6AAAAABD5ZGDC2VHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDINRRGY4TSOJWHA>. You are receiving this because you were mentioned.Message ID: ***@***.***>

[gpaesano]

Happy to see that is working. Nice new one click function, but be aware that for the very first flash you need to activate it as explained before.

[AronnePi]

Hi everyone, wonderful job, I read the whole discussion but I couldn't understand one thing. To be able to modify the gateway you simply need to flex it with Arduino IDE or you have to carry out some steps first. Forgive me but I'm new to these things but the world of home automation fascinates me a lot. Is there someone kind-hearted who can give a mini guide on how to do everything. Thank you all so much in advance for the fantastic work.

[madness3d]

Hi,

1. Does the ble still work after this flash?
2. Somewhat unsure if the resistor is still needed for the first flash with every method or not?

Thanks!

[frescof]

The resistor is needed only if you mess up completely and the WBR1 doesn't boot at all, like I did :)
@AronnePi @madness3d for the first flash, you should follow the guide here: https://github.com/jasperw1996/ambd_sdk_GW018-DM
You don't need to compile the firmware at step 3, skip to 4 and just use this binary Zigbee_Gateway_WebAP_01.zip
Once step 4 is done, the gatway will boot and create a wifi network "GW_Network". Connect to it and configure the credentials for your home wifi.
If you live the usb serial and minicom open you will see the IP that the gateway will get on the wifi.
At this point you should upgrade the ZS3L module with the firmware gpaesano provided: G01-pro-ncp-uart-hw_4.zip using the method indicated in the wiki above at step 7b.
Once done, in Home Assistant go and configure zigbee2mqtt like this:

serial:
  adapter: ember
  baudrate: 115200
  port: tcp://<your-gateway-ip>:80
  rtscts: false

Hope this helps

[iseeberg79]

@gpaesano @frescof works great - thanks. I had this device lying around and was able to use the process for an alternative use. I had trouble with the WIFI configuration as it doesn't accept (not too special) characters like $ and others. Those characters are stored and loaded in ascii hex format. Finally got it working because the console output was available. Since I was not able to successfully set up the development environment because some library errors occurred during compilation, I'd like to ask for improvements in this area. It would be very kind if you would consider this in a further version.

[frescof]

To be able to compile the sketchbook that gpaesano wrote, I had to modify the lwip library provided by AmebaD sdk.
Sure not the best way, but I looked into what could cause the compilation error and couldn't find how to properly solve this issue.
If anybody have a solution that does not involve modifying the libs please let me know!

Anyway, look in arduino ide folder (in linux ~/.arduino15/) for a file named inet.h, should be in a folder named lwip (lwip/inet.h or in windows lwip\inet.h).

At line 58, insert one line,to make it look like this:

/* If your port already typedef's in_addr_t, define IN_ADDR_T_DEFINED
   to prevent this code from redefining it. */
#if !defined(in_addr_t) && !defined(IN_ADDR_T_DEFINED)
typedef u32_t in_addr_t;
#endif
typedef __uint32_t in_addr_t; /* <<<---- ADD THIS LINE */

Cheers

[iseeberg79]

To be able to compile the sketchbook that gpaesano wrote, I had to modify the lwip library provided by AmebaD sdk.

Working, thank you. I've made some adaptions. Requires some testing now. I'll return with changes to contribute on completion.

[mypaxa00]

I will leave my experience here.
I had problems with uploading the firmware to the WBRG1. It was in flash mode but I had no luck uploading. Both win and linux flashers were unable to flash my board. But I managed to flash my board with Arduino IDE and this sketch Zigbee_Gateway_WebAP_01 (thx frescof). I used exact this one because all previous were failing while trying to flash ZS3L. Another issue I had before is that my ZS3L board does not enter uartburn through "double click" mode, but I dont care, I just shorted required pins to the ground, and flashed using silab's flasher.
Now I have it up and running, no issues so far.

[AronnePi]

hi, after a few attempts I managed to program the three files with imagetool but now I can't access the network that is created because it asks me for the password and I can't enter it, can you help me

[frescof]

@AronnePi look into the .ino file, you will see:

char ap_ssid[] = "GW_Network";    // Set the AP SSID
char ap_pass[] = "GW_Password";        // Set the AP password

[AronnePi]

Hi
I finally programmed everything and managed to connect it to my wifi but when I try to integrate it on the home assistant it gives me the error which I'll post below what am I doing wrong?
[2024-11-27 18:16:45] info: z2m: Logging to console, file (filename: log.log)
[2024-11-27 18:16:45] info: z2m: Starting Zigbee2MQTT version 1.41.0 (commit #unknown)
[2024-11-27 18:16:45] info: z2m: Starting zigbee-herdsman (2.1.7)
[2024-11-27 18:16:45] error: z2m: Error while starting zigbee-herdsman
[2024-11-27 18:16:45] error: z2m: Failed to start zigbee
[2024-11-27 18:16:45] error: z2m: Check https://www.zigbee2mqtt.io/guide/installation/20_zigbee2mqtt-fails-to-start.html for possible solutions
[2024-11-27 18:16:45] error: z2m: Exiting...
[2024-11-27 18:16:45] error: z2m: Error: No path provided and failed to auto detect path

[iseeberg79]

To be able to compile the sketchbook that gpaesano wrote, I had to modify the lwip library provided by AmebaD sdk.

Working, thank you. I've made some adaptions. Requires some testing now. I'll return with changes to contribute on completion.

I finally found the root-cause for my wifi connection problems. I've adapted the source code for the POST data to be url-decoded and added utf-8 charset to be safe. I'd like to contribute the changes here if somebody struggles about being not able to use special characters for SSID and/or password. The change is based on the version provided by @frescof - and yet roughly tested. There is no repository to make a pull request, right?

Zigbee_Gateway_WebAP_01a.zip