logo elektroda
logo elektroda
X
logo elektroda
Advanced Search
logo elektroda

Tuya WXU XR806 from TRV Heater Device flashing, SDK, firmware change research

MrGenius 6276 124
Best answers

How can I make a Tuya WXU/TRV device work with XR806 firmware?

OpenBeken/OpenXR806 does boot on XR806, and by April the thread confirms a custom HTTP page was running on the WXU/XR806 for the first time; the main remaining problems were Wi‑Fi stability and getting settings to persist [#21524637] [#21524126] The first bootable path came from building against the XR806 SDK (the shared repo was published at `github.com/divadiow/xr806_sdk`), using the SDK’s `make menuconfig`/build flow and enabling the right Wi‑Fi options; once built, the firmware printed normal XR806 boot logs and the device could be flashed successfully [#21429402] [#21430649] [#21430654] [#21430812] Flash/download mode on this board appears to need only `PB02` pulled low, not the XR809-style `PB02+PB03` combination [#21530921] Config storage was later fixed by moving `sysinfo` to `0x1FC000`, which let OBK save its config; that still left about 12 KB free at the end of the 2 MB flash [#21525228] [#21533999] Even after that, the thread still reported unstable Wi‑Fi/HTTP behavior and no fully finished TRV port yet [#21524434] [#21524467] [#21524739]
Generated by the language model.
ADVERTISEMENT
Treść została przetłumaczona polish » english Zobacz oryginalną wersję tematu
Report a violation of the law
Reply | New topic
  • #91 21524467
    divadiow
    Level 38  
    Posts: 4833
    Help: 420
    Rate: 851
    p.kaczmarek2 wrote:
    So you can open connection to port 80 but it sends nothing?

    this seems to be the case. port is open...
  • ADVERTISEMENT
  • #92 21524469
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14389
    Help: 650
    Rate: 12308
    EDIT: you confirmed, it creates HTTP thread.
    Code: text Expand Select all Copy to clipboard
    
Error:HTTP:Created HTTP SV thread with (stack=2048)

    A code snippet in C/C++ showing a function to start an HTTP server, with a highlighted log info line.

    Added after 3 [minutes]:

    I will push this:
    Screenshot of a C source code file diff with colored highlighting for added (green) and removed (red) code lines.
    If it builds, can you check whether you get this connection prints, and if so, do you get them once and then it locks forever, or do you get with each connection to HTTP attempt?
    Helpful post? Buy me a coffee.
  • #94 21524527
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14389
    Help: 650
    Rate: 12308
    and what does it print when you try to connect to http page? And if you try to connect again?

    Added after 48 [seconds]:

    Do you get that message with each page refresh?
    A snippet of C/C++ source code with two highlighted lines related to handling single-threaded and multi-threaded HTTP connections.
    Helpful post? Buy me a coffee.
  • #95 21524530
    divadiow
    Level 38  
    Posts: 4833
    Help: 420
    Rate: 851
    nothing printed, just usual MAIN
    Code: Text
    Log in, to see the code


    Added after 2 [minutes]:

    nmap fingering does this when running OS discovery scripts on port 80

    Code: Text
    Log in, to see the code
  • #96 21524533
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14389
    Help: 650
    Rate: 12308
    Wait, it may be my fault. The message is only in debug mode, and without HTTP panel, you have no way to enable it... let's recompile with error mode.

    I also added:
    Code: text Expand Select all Copy to clipboard
    
	ADDLOG_ERROR(LOG_FEATURE_HTTP,  "TCP will process packet of len %i\n", request.receivedLen );


    Added after 2 [minutes]:

    Your message comes from here:
    Screenshot of Visual Studio showing C code with an error handling block highlighted in red.
    It suggests that recv did not receive anything after the TCP connection was accepted.
    Helpful post? Buy me a coffee.
  • #97 21524540
    divadiow
    Level 38  
    Posts: 4833
    Help: 420
    Rate: 851
    Code: Text
    Log in, to see the code



    Code: Text
    Log in, to see the code
  • #98 21524548
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14389
    Help: 650
    Rate: 12308
    Extra questions - do you know how to use at_demo or wlan_demo of XR806 SDK?
    Terminal screen showing XR806 system image build and configuration, including code sections and flash layout.
    Attachments:
    • at_demo.zip (814.55 KB) You must be logged in to download this attachment.
    • wlan_demo.zip (631.3 KB) You must be logged in to download this attachment.
    Helpful post? Buy me a coffee.
  • #99 21524551
    divadiow
    Level 38  
    Posts: 4833
    Help: 420
    Rate: 851
    not tried either, or much AT, but what are you thinking?
  • ADVERTISEMENT
  • #100 21524554
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14389
    Help: 650
    Rate: 12308
    Wait, so it actually receives packets? Then why no reply?
    Code: text Expand Select all Copy to clipboard
    
Error:HTTP:TCP will process packet of len 479

    Let me enable this:
    Code: text Expand Select all Copy to clipboard
    
ADDLOG_ERROR(LOG_FEATURE_HTTP, "TCP sending reply len %i\n", lenret);


    Added after 1 [minutes]:

    I changed my mind currently. We don't need to try AT demo. We need to check if it tries to send back any data with:
    Code: text Expand Select all Copy to clipboard
    
ADDLOG_ERROR(LOG_FEATURE_HTTP, "TCP sending reply len %i\n", lenret);
    Helpful post? Buy me a coffee.
  • #101 21524564
    divadiow
    Level 38  
    Posts: 4833
    Help: 420
    Rate: 851
    Code: Text
    Log in, to see the code
  • #102 21524589
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14389
    Help: 650
    Rate: 12308
    If that's the case, then last option is here:
    Code: C / C++
    Log in, to see the code

    Screenshot of a version control diff showing changes in new_http.c, with added debugging log lines using ADDLOG_ERROR.
    Btw, you didn't specify what exactly the browser says... it says empty reply? Or timed out? When opening device page...
    Helpful post? Buy me a coffee.
  • #103 21524592
    divadiow
    Level 38  
    Posts: 4833
    Help: 420
    Rate: 851
    edge
    Code: Text
    Log in, to see the code

    chrome
    Code: Text
    Log in, to see the code
  • #104 21524594
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14389
    Help: 650
    Rate: 12308
    Btw what if you try to open:
    Code: text Expand Select all Copy to clipboard
    
http://192.168.0.163/testmsg

    Insert your IP. It's a message without HTTP header. Just few bytes.
    Browser window at 192.168.0.163/testmsg displaying the text: This is just a test msg.

    Screenshot of the Network tab in Chrome DevTools with selected testmsg response.
    It's present in all builds.
    Helpful post? Buy me a coffee.
  • #106 21524601
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14389
    Help: 650
    Rate: 12308
    So the next step is to see whether we get anything in postany. If we do, then send function of LWIP is somehow not working with us...
    Helpful post? Buy me a coffee.
  • #107 21524602
    divadiow
    Level 38  
    Posts: 4833
    Help: 420
    Rate: 851
    build 5911
    Code: Text
    Log in, to see the code
  • ADVERTISEMENT
  • #108 21524613
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14389
    Help: 650
    Rate: 12308
    WHAT? Omg.
    So auth code is blocking HTTP on XR806 and only on XR806?
    I am not even the author of auth code. The main problem is solved, but HOW?
    I would never suspect that!

    Added after 3 [minutes]:

    How is it possible that AUTH is enabled on XR806 by default... and webPassword is set?
    Code: C / C++
    Log in, to see the code


    Added after 1 [minutes]:

    It looks like config has some garbage it, but it should not be possible, with CRC check...
    Helpful post? Buy me a coffee.
  • #109 21524634
    divadiow
    Level 38  
    Posts: 4833
    Help: 420
    Rate: 851
    :D
    OpenXR806 device control panel with configuration buttons and system status information.

    Code: Text
    Log in, to see the code
  • ADVERTISEMENT
  • Helpful post
    #110 21524637
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14389
    Help: 650
    Rate: 12308
    And now, what kind of password do you have in in Web Password setting? And how did it even got there...

    Added after 31 [seconds]:

    So you are the first person in the world to run custom http page (custom firmware) on XR806. Call @MrGenius
    Helpful post? Buy me a coffee.
  • #111 21524641
    divadiow
    Level 38  
    Posts: 4833
    Help: 420
    Rate: 851
    empty
    Web authentication setup panel with admin password field and blue Submit button.

    Added after 39 [seconds]:

    p.kaczmarek2 wrote:
    So you are the first person in the world to run custom http page (custom firmware) on XR806. Call @MrGenius

    woop woop!!

    good work
  • #112 21524664
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14389
    Help: 650
    Rate: 12308
    Ah, I see... there was a stub for this function. I can give better fix now.

    Added after 46 [minutes]:

    Ok, I merged this fix. What do we enable for XR806 next?
    Helpful post? Buy me a coffee.
  • #113 21524739
    divadiow
    Level 38  
    Posts: 4833
    Help: 420
    Rate: 851
    Well the original TRV is TuyaMCU. Having said that, I recall the factory fw not playing 100% with the TuyaMCU simulator, so I hope it's not some weird variation of the standard MCU communications.

    the most glaring issues right now are the mac address and also no settings are saved so it won't go into STA mode

    Added after 1 [minutes]:

    latest boot
    Code: Text
    Log in, to see the code
  • #114 21525208
    MrGenius
    Level 7  
    Posts: 9
    Help: 3
    Rate: 6
    >>21524637
    Opening thr Champagne on your behalf 😉
    Next challenge will be to get the TRV running correctly with it's main functions.
  • #115 21525228
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14389
    Help: 650
    Rate: 12308
    @divadiow I think the flash write/read (config) can be fixed just by choosing a free flash offset here:
    https://github.com/openshwprojects/FlashDumps/commit/b52dbd6579eec97b94533ce9b0094b130fa082be
    Code: text Expand Select all Copy to clipboard
    
#define OUR_CUSTOM_SYSINFO_ADR PRJCONF_SYSINFO_ADDR

    you can change it globally for now in PR, but then make sure your change is in #if PLATFORM_XR806 so we dont break other XRs, there are now 3 of them (XR809, XR806, XR872)
    Helpful post? Buy me a coffee.
  • #117 21529856
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14389
    Help: 650
    Rate: 12308
    Yes, sorry.

    Check what I did for XR872 to fix flash config save:
    https://github.com/openshwprojects/OpenXR872/commit/ecb41f9d122983acb1743715d32f389eee15e07d
    Maybe the same could be done for XR806, but one would have to check. To speed up testing, you can try adding offsets directly in hal_flashConfig_xr809.c
    Helpful post? Buy me a coffee.
  • #119 21540512
    p.kaczmarek2
    Moderator Smart Home  
    Posts: 14389
    Help: 650
    Rate: 12308
    Good job, please open a PR if it wasn't opened and merged yet.

    So next step for XR806 is to check if OpenXR806 supports "upgrade" command from PhoenixMC, so we can flash without pins manipulation? Like we discussed in XF16 topic?
    Helpful post? Buy me a coffee.
  • #120 21540575
    divadiow
    Level 38  
    Posts: 4833
    Help: 420
    Rate: 851
    p.kaczmarek2 wrote:
    please open a PR if it wasn't opened and merged yet.

    I did not open PR, only set fixed address for testing, so XR809 will be affected too at the moment.

    p.kaczmarek2 wrote:
    but then make sure your change is in #if PLATFORM_XR806 so we dont break other XRs, there are now 3 of them (XR809, XR806, XR872)

    I guess a PR would be this
Reply | New topic
Report a violation of the law

Topic summary

✨ The discussion centers on the Tuya WXU module, specifically the XR806 SoC used in TRV heater devices, exploring firmware flashing, SDK usage, and custom firmware development. The XR806 differs from the XR809 notably by including WiFi and BLE capabilities and having 320 KB SRAM versus 288 KB in XR806 specs. Participants shared boot logs, teardown procedures, and hardware photos, confirming the XR806's WiFi presence and SDK version 1.2.2. Efforts to flash custom firmware such as OpenBK7231T_App and OpenXR806 were documented, with challenges including UART synchronization errors, thread creation failures, and unstable WiFi connections. The XR806 SDK was used for compiling demos like hello_demo and wlan_demo, with configuration via make menuconfig to enable WiFi features and FreeRTOS. Issues with missing headers, build environment setup (WSL, GCC toolchain), and SDK path configurations were addressed. A key breakthrough was identifying HTTP basic authentication enabled by default on XR806, blocking HTTP server responses, which was resolved by disabling or clearing the web password. Flash memory configuration was adjusted to a free offset (0x1FC000) to enable saving settings. Despite progress, WiFi stability and full TRV functionality remain under development. Community members sourced XR806 modules from various suppliers and shared open-source projects like TinyMaix-XR806 for reference. The discussion also touched on porting HAL code from XR809 to XR806 due to high similarity, and ongoing efforts to integrate XR806 support into OpenBK7231T_App with online builds. The overall progress marks the first successful custom firmware boot and HTTP server operation on XR806-based WXU modules, paving the way for further development and device control.
Generated by the language model.
Today's popular

FAQ

TL;DR: With 320 KB SRAM and a quoted breakthrough — "XR auth disabled" — this FAQ shows XR806/WXU thermostat modders how to open Tuya TRVs, dump firmware, build XR806 SDK demos, and understand why OpenBeken now boots and serves a web UI, while Wi‑Fi stability and TuyaMCU work still need fixes. [#21524634]

Why it matters: This thread turns a vague "WXU might be XR806" hunch into a repeatable path for teardown, flashing, SDK builds, and first-boot OpenBeken testing on real Tuya thermostats.

Option Result in thread Main limitation
Stock Tuya WXU firmware on original device Boots, exposes TuyaOS logs, Wi‑Fi + BLE seen Closed firmware, no alternative control path proven
Dumped WXU image flashed onto XR809 Did not boot XR806/XR809 firmware mismatch
XR806 SDK demos hello_demo and Wi‑Fi demos built and ran menuconfig options needed
OpenBeken on XR806/WXU Boots and later serves web UI Wi‑Fi, config, MAC, and TuyaMCU issues remained during testing

Key insight: The project stopped being blocked by flashing and basic booting. The real breakthroughs were proving that WXU is XR806-class hardware in practice, and then finding that the missing XR806 web GUI was caused by HTTP auth behavior, not a dead HTTP server.

Quick Facts

  • Tuya WXU was discussed as XR806-class hardware because logs showed XR806 SDK v1.2.1/v1.2.2, 160 MHz CPU, 40 MHz HF clock, Wi‑Fi, and BLE on real thermostat hardware. [#21429243]
  • The thread compared memory claims directly: Tuya WXU listed 320 KB SRAM, while one XR806 spec mentioned 288 KB SRAM, which caused early confusion about whether WXU was a Tuya-specific variant. [#21429143]
  • A real TuyaOS boot log on WXU showed TuyaOS V3.6.3 built on 2024-07-18, with xr806_lowpower_common_ty 1.1.4 and a product AP named SmartLife-4649. [#21429243]
  • XR806 flashing and logging used different serial paths in practice: successful tests showed firmware output on the flashing UART, while boot logs from stock firmware were often captured on a different UART. [#21430698]
  • OpenBeken config saving started working after moving XR806 sysinfo to 0x1FC000, leaving about 12 KB free before the end of a 2 MB flash. [#21533999]

How do I open a Tuya TRV heater device with the WXU/XR806 module without damaging the display or board?

Open it in four careful steps. 1. Pull off the plastic turning wheel with steady force. 2. Remove the round battery cover underneath it. 3. Unclip the display with a small screwdriver. 4. Remove the 3 top screws and lift out the board. This sequence was reported as "very easy to open" and was used successfully before board removal and flashing work. [#21429214]

What is the Tuya WXU module, and how is it related to the XR806 chip used in thermostats and TRVs?

The Tuya WXU module is an embedded Wi‑Fi and BLE module that appears XR806-based in these thermostats. "WXU is an embedded wireless module that provides Wi‑Fi and Bluetooth Low Energy connectivity, and in this thread its boot logs matched XR806 SDK builds, clocks, and radio firmware." The strongest evidence was real boot output showing XR806 SDK, 160 MHz CPU, 40 MHz HF clock, and TuyaOS on a WXU-equipped TRV. [#21429243]

What is TuyaMCU, and why does it matter when replacing firmware on a WXU/XR806-based thermostat?

TuyaMCU is the separate device-side controller that exchanges commands with the Wi‑Fi module over UART. "TuyaMCU is a microcontroller-side protocol layer that handles thermostat logic and sensors while the Wi‑Fi module exposes cloud or custom firmware features, usually over serial links such as 115200 baud." It matters because the original TRV used TuyaMCU, so OpenBeken must match that serial behavior before core heating functions work correctly. [#21429324]

Why does flashing a dumped WXU firmware image onto an XR809 boot fail even though OpenBeken itself boots on XR809?

It fails because the dumped firmware targets XR806-class hardware, not XR809. A direct test flashed the WXU backup to XR809 successfully, but the board showed no life, no current draw, and no output on RX0 or RX1. In contrast, flashing OBK back onto XR809 restored a normal boot log on RXD0. That result strongly points to platform mismatch rather than a bad dump or bad flashing process. [#21429353]

XR806 vs XR809: what are the practical differences for SDK compatibility, flashing pins, and OpenBeken porting?

They are similar enough for HAL reuse, but different enough to break direct firmware swaps. The thread found XR809 HAL code was about 99.9% reusable, and GPIO examples looked very similar between SDKs. The important practical differences were boot-pin behavior, build-system details, flash layout, and at least one efuse field difference such as EFPG_FIELD_MAC. That is why OpenBeken could be ported, yet still needed XR806-specific fixes. [#21435819]

How do I put an XR806 or Tuya WXU module into download mode, and which boot pins actually need to be grounded?

Ground PB02 to enter XR806 download mode. Early testing assumed PB02 and PB03 both had to be grounded, mirroring XR809 habits. Later notes in the same work said only PB02 needs to be pulled low on XR806, including successful flash reads from a WXU after grounding PB02. That makes XR806 easier to place in download mode than expected. [#21502313]

Why do I get a sync or 'synchron waiting' error when trying to read or flash an XR806, and how should TX/RX be wired?

Sync errors usually came from using the wrong UART pair or wiring TX/RX the wrong way. One tester fixed an XR-series sync issue after realizing the correct lines were UART0, not UART1. Another note added that for one XR case, RX had to go to RX and TX to TX for boot-log capture. If you see "synchron waiting," verify UART0 pins first and avoid assuming classic cross-over wiring. [#21429353]

Which UART on the XR806/WXU is used for flashing and which one outputs the boot log?

They are not always the same UART in practice. A key test showed an XR806 sample did work, but its output appeared on the flashing UART rather than the log UART the tester first monitored. Earlier stock-firmware work also captured boot text from RXD0. The safe rule is to probe both serial paths before assuming the board is dead. [#21430698]

How do I build XR806 SDK examples like hello_demo, wlan_demo, or at_demo with make menuconfig under WSL?

Build them from WSL with the SDK root as your working directory. 1. Install prerequisites such as build-essential and ncurses development packages. 2. Set the ARM GCC path in gcc.mk to the toolchain under sdk/tools. 3. Copy a demo defconfig, run make menuconfig, then make build or make image. This flow worked under WSL2 after GCC and ncurses were fixed. [#21432260]

What causes the lwip/netif.h missing error or OTA-related build failures in the XR806 SDK demos, and which menuconfig options fix them?

Those errors came from disabled network components in menuconfig, not from broken demo code alone. The lwip/netif.h failure appeared while building at_demo, and enabling lwIP, WLAN, AP/STA options, and OTA made the build progress. The thread also called out CONFIG_WLAN_AP, CONFIG_WLAN_STA, CONFIG_WLAN_MONITOR, and PRJCONF_NET_EN as required for full WLAN command support. [#21430812]

Why did OpenBeken on XR806 initially open port 80 but return no web GUI or empty HTTP responses?

The HTTP server thread was alive, but replies were blocked before a usable page reached the browser. Tests showed port 80 open on 192.168.51.1, accepted clients on fd 3, and received packets of about 453 to 479 bytes. Yet browsers reported ERR_CONNECTION_TIMED_OUT or ERR_EMPTY_RESPONSE. That proved the failure was in request handling or response generation, not in AP mode or TCP accept itself. [#21524592]

How was the XR806 HTTP issue tracked down to web authentication, and what changed to make the custom OpenBeken page finally load?

It was traced to HTTP auth logic, then fixed by disabling the XR806 auth block path. Debug builds showed packet receipt, then repeated HTTP packet with auth fail messages. After changing the XR806 auth behavior, logs switched to XR auth disabled and postany: send ..., and the custom OpenBeken page finally loaded. That was the first confirmed custom HTTP page running on XR806 in the thread. [#21524634]

Where should the sysinfo/config flash offset be placed on XR806 so OpenBeken settings are saved correctly without breaking XR809 or XR872?

Place XR806 sysinfo at 0x1FC000 and gate it with an XR806-specific platform check. Direct testing showed OpenBeken started saving config correctly at 0x1FC000, with about 12 KB left before the 2 MB flash end at 0x200000. The thread explicitly warned not to hardcode that address globally, because XR809 and XR872 use different layouts and need separate handling. [#21533999]

What is PhoenixMC, and how is it used with XR806 firmware images or upgrade commands during development?

PhoenixMC is the flashing utility used in this thread to parse, read, and write XR806 images. It successfully parsed SDK-built images, flashed stock and test binaries, and was later discussed as the possible path for an upgrade command that could avoid manual boot-pin grounding. In practice, it was the main tool for dumping firmware, restoring backups, and verifying whether new XR806 builds booted. [#21430654]

What are the remaining blockers for a fully working OpenBeken/OpenXR806 port on Tuya WXU devices, especially unstable Wi-Fi, MAC handling, config saving, and TuyaMCU support?

The main blockers were unstable Wi‑Fi behavior, wrong MAC handling, incomplete config persistence before the sysinfo fix, and unfinished TuyaMCU integration. One tester reported OpenBeken booted, exposed the web UI, but did not keep settings, did not enter STA mode, and still showed MAC inconsistencies. Another recurring issue was Wi‑Fi association without completing the full connection flow. By May 2025, XR806 builds existed, but the port was still a development target, not a finished daily-driver firmware. [#21524739]
Generated by the language model.
ADVERTISEMENT