I'm posting as there seems to be a very limited amount of info on this device and chip being used, A Broadlink BL3335-P, (carrier PCB says BR3335, the actual module has no part number)
Anyway I was curious as to what the actual controller was so as you can see I peeled the can off. this presents the RDA 5981AM.
Unfortunately I'm not exactly sure where the bulb was from, I've had it for a while and only recently took a look inside. It's most likely one off AliExpress and I'm pretty sure they switched to another controller now as I've ordered twice from the same store a few years later. There is no branding on the side of the bulb.
If anyone wants to try and support this controller in OpenBeken or any others and would like to get anything off the device that would be useful in supporting you, feel free to message
Very interesting, I haven't seen that one yet. I could give it a go, but for now, I'm doing porting for XR806, so it would have to wait a bit in the queue.
Anyway, were you able to find a datasheet for this module or chip?
Did you attempt to take a boot log of this device? It could tell us which SDK was used.
If there is no documentation for used WiFi module, then maybe we can desolder it with hot air just to check the GPIO markings on the back.
Very interesting, I haven't seen that one yet. I could give it a go, but for now, I'm doing porting for XR806, so it would have to wait a bit in the queue.
No worries, in no rush myself, was trying to find info on what I had to start moving them away from their proprietary firmware. and noticed it seemed to be unknown to those who work on these open projects.
p.kaczmarek2 wrote:
Anyway, were you able to find a datasheet for this module or chip?
Yes, seems the blog post states they were unable to find documentation (however they supposedly had a Broadlink BL3336T-P) there does seem to be documentation for the Broadlink BL3335-P and RDA 5981AM it's using.
If someone is interested in trying to port, a module with this chip is available at aliexpress, (HLK-M50).
I don't see a point though, the sdks i've seen are very old, last version publicly available is at least 8 years old (RDA5981_SDK_MbedOS515_V1.3.5).
On csdn there are mentions of RDA5981_SDK_MbedOS515_V1.3.6 and RDA5981_SDK_MbedOS515_V2.0, but you cannot download them (china only site).
And not to mention there is no freertos in any of those sdk.
without modification RDA Dump tool loads with these addresses set by Hi-Flying. These addresses result in a 2044kb file dump, which clearly shows HLK-M50 flash content repeated.
Tool and dump will also land in FlashDumps and FlashTools GH
then _major.minor 0.0-3.9 and _major.minor.build for 0.0.0->3.99.99
then extensions .zip and .tar.gz upper and lowercase
the correct platform name is usually the bit seen at the end of this string after AT, so a boot log from Tuya device would help, but I haven't found one.
< TuyaOS V:3.8.31 BS:40.00_PT:2.3_LAN:3.5_CAD:1.0.5_CD:1.0.0 >
< BUILD AT:2024_12_26_11_42_43 BY ci_manage FOR tuyaos-iot AT T1 >
According to datasheet, flash address is 0x1400000, and rom address is 0x0 with 0x10000 length.
0x1800000 is i-cache, which i guess is flash but for xip?
SDK 2.0 and SDK 1.3.7 have the same functionality. (646/143)
1. Added the daemon_thread control flow.
2. By default, connect is blocking. To use a non-blocking method, enable the NO_BLOCK macro in rda59xx_daemon.c.
2017-02-11 V1.3.6(534)
1. Fixed a bug in pwm and added control functions for pwl0 and pwl1. See test case: pwm.
2. Fixed a bug in RSA encryption during GCC compilation.
3. Fixed buffer leaks and other issues that occurred during repeated disconnections.
4. Fixed a bug in the DHCP server and checked whether the request IP address is out of the set range.
5. Modified the start ap/connect/disconnect functions to blocking mode to ensure synchronization.
6. In AP mode, if the connection fails, the STA info will be cleared in time.
7. Added a print switch to reduce code size.
8. Added mbed_client support. See test case: mbed_client.
9. Resolved SPI hal exceptions in GCC.
10. Added PowerDown mode for low power consumption. See test case: uartwifi.
11. Optimized the read and write speed of usbdevice_msd.
12. Added feature: USBDEVICE_SERIAL and test case: usbdevice_serial to support serial ports in USB device mode.
13. Added feature: WPS20.
2017-12-23 V1.3.5(477)
1. Fixed network-related bugs in V1.3.4.
2017-12-14 V1.3.4(459)
1. Major version update. When compiling, there is no need to distinguish between versions such as U02 and U04. The target only needs to be specified as UNO_81A, UNO81AM, or UNO_81C.
2. Optimize smartconfig, airkiss, and esptouch.
3. Add an interface to set the maximum number of STAs that can be connected in AP mode. In wland_rda5991h.h,
rda5981_set_AP_link_num(unsigned char num); num is the maximum number of STAs that can be connected.
Added an interface for setting the AP whitelist in wland_rda5991h.h:
void rda5981_set_AP_white_list(unsigned char flag, unsigned char *mac)
When flag is 1, the MAC address is added to the list; when flag is 0, the MAC address is removed from the list.
4. Updated the file system. Users can configure features such as FEATURE_SDCARD_EXFAT encoding and whether to support EXFAT (or FAT32 if EXFAT support is not enabled). Refer to the description in ffconf.h.
5. Updated the I2S interface. When the input is mono, the left or right channel can be set. The default is the left channel.
uint8_t rda_i2s_set_rx_mono_channel(i2s_t *obj, uint8_t channel);
When channel is 0, the input is the left channel; when channel is 1, the input is the right channel.
2017-11-09 V1.3.3
1. Added the ESPTOUCH feature and corresponding case.
2. Added the heap_info case to view heap information.
3. Added stack trace printing when a system fault occurs. When using the CONSOLE feature, if the macro CONSOLE_DUMP_STACK_EN is enabled, entering "#*#" in the console will print the current stack trace information.
4. lwip-related stability updates.
5. Fixed an issue where occasional negative values were displayed during RX testing. Added RSSI display. As shown below, the average RSSI for all packets over the past second is -77.
UT: rx = 155, end_gd = 177, end_er = 007, fcs_er = 022, PER = 15.76%, PER_F = 08.37%, rssi = -77
2017-10-18 V1.3.2
1. Fixed an issue with SD card hot-swapping.
2. Added VBAT calibration. Refer to the vbat_cal case to obtain a more accurate VBAT voltage value.
3. Fixed other bugs.
2017-09-19 V1.3.1
1. Fixed an issue with UART CTS/RTS not working.
2. Added low voltage detection. Refer to the analog_in case and select ADC_PIN2.
3. Added TX power offset settings for G/N mode. Refer to the uarthut case.
4. Improved I2C functionality. Refer to the i2c case and the readme.txt file in its directory.
2017-09-01 V1.3.0
1. Added a test mode. Refer to the documentation in the "Test Mode SDK.7z" directory and the uarthut case.
2. Fixed the inaccurate PWM frequency issue.
2017-08-21 V1.2.9
1. Added a case for transmit power and crystal calibration. See the rf_config case for details, which provides methods for configuring the relevant registers, flash, and efuse.
2. Added the uarthut test case, which allows you to configure the registers, flash, and efuse related to transmit power and crystal calibration via AT. See the AT instructions under the case for details.
Currently, writing efuse and TX/RX tests is not available.
2017-08-16 V1.2.8
1. The console input and output can be selected from either of the system's two UARTs. See the feature FEATURE_CONSOLE_DUAL_UART and the case dual_console for details.
2017-08-09 V1.2.7
1. Added sleep mode. For details, see the AT+SLEEP command in the uartwifi test case.
2. Added MCLK configuration for I2S. For details, see the relevant i2s cases and the documentation in their directories.
2017-07-27 V1.2.6
1. Test case update: added tx_power_rf_cal (setting transmit power and RF calibration).
2. Feature update: improved PSRAM read and write efficiency.
2017-07-25 V1.2.5
1. lwip update: supports simultaneous STA and AP modes.
2. Test case update: added soft_reset (soft reset), tcp_upd_speed (TCP and UDP speed test), and tx_power (setting transmit power).
July 11, 2017 V1.2.4
1. Feature update: Added two USB features, FEATURE_USBHOST_MSD and FEATURE_USBDEVICE_MSD.
2. Test case update: Added two USB cases, usbhost_msd and usbdevice_msd.
June 26, 2017 V1.2.3
1. Bug fixes.
June 10, 2017 V1.2.2
1. I2S driver update.
2. Test case update: Added four I2S test cases, i2s_master_out, i2s_slave_in, i2s_master_out_slave_in, and i2s_master_in.
June 2, 2017 V1.2.1
1. Updated features, adding FEATURE_SDCARD_EXFAT, and updating FEATURE_CONSOLE and FEATURE_GPADCKEY.
2. Updated test cases, adding airkiss, uartwifi, and sdcard_sdmmc_exfat.
BL3335-P has been a bit of a disappointment so far:
-no log out on any UART at any standard or many interim bauds.
-IO27 outputs a load of odd characters in a boot-log kinda flow way, but nothing close to readable, ever
-P21 is not routed out anywhere - may have to remove RF cover to try it (would have expected silence though instead of unreadable output)
-No recognition of device by RDA Dump tool at any baud from either UART - BL3335-P is now fully de-soldered from plug in case of interference.
-note: module does boot and wifi AP does show - plug/LEDs pairing mode look as it should - I have not tried pairing
-yes I've searched for Tuya SDKs using variations of rda5991h
SWD is reported to be an option by users here https://esp8266.ru/forum/threads/rda5981.2944/ but I have had no success with HLK-M50 or BL3335-P in trying. I even sought to try another J-Link which led to me converting these found discarded STM32 Discovery boards (at local recycling centre months ago) to J-Link from ST-Link - that was a bonus side-adventure but the newer firmware made no difference (2019 vs 2012 in clone)
With config, sta and pins/pwm/uart
Possible that it's broken, if flash offset is not 0x{addr}, but 0x180{addr}
Attached both versions.
Another potential problem is that SDK reads/writes some wifi data without possibility of disabling it.
Do flash erase, flash AT binary, connect to wifi and take a backup.
OK. OpenBeken_offset.bin to 0x1000 will often not give output, apart from the BL bit, but when it does:
Code: Text
Log in, to see the code
insmod wrote:
Possible that it's broken, if flash offset is not 0x{addr}, but 0x180{addr}
not sure 100% I understand this bit. I've flashed both Openbeken.bin and Openbeken_offset.bin to 0x1000 and 0x18001000 in RDA Flashtest Tool but the above is the only signs of anything
insmod wrote:
Do flash erase, flash AT binary, connect to wifi and take a backup.
will do. Also, I haven't quite understood from datasheets if it's safe to erase from 0x0 yet - do you know? I don't want a BK-T scenario without a working J-Link recovery option.
The discussion revolves around the Broadlink BL3335-P smart bulb, which utilizes the RDA 5981AM chip. The original poster seeks information on the device and its components after peeling off the can to reveal the chip. They mention the bulb likely originated from AliExpress and express interest in moving away from proprietary firmware. Other participants inquire about the availability of a datasheet and suggest methods for obtaining a boot log, including using an Arduino for serial communication. They also note the existence of a similar module available on AliExpress (HLK-M50) and discuss the outdated nature of the available SDKs for the RDA5981AM chip. Summary generated by the language model.
