Tuya WXU XR806 from TRV Heater Device flashing, SDK, firmware change research

Question

Anybody was able to make it work with the XR806? Just came across a TRV heater device, which is using the Tuya WXU chip. My research is pointing to XR806.

divadiow · Answer

The normal XR806 definitely doesn't have wifi, but this T103C-HL on the WXU module clearly states it does. Maybe some Tuya-specific variation. It already has different SRAM to normal XR806 Code: TextLog in, to see the code Here's the boot log from a WXU from a posting on Discord: Code: TextLog in, to see the code You could always try dumping existing firmware and trying OpenXR809 I guess

p.kaczmarek2 · Answer

I may have such device from @MrGenius , but I didn't do teardown yet.

MrGenius · Answer

I found some hits when searching for the XR806, mentioning this: Allwinnertech XR806 Wi-Fi+BLE5.0
The documentation i found for that, is listing the same amount of SRAM, Flash and existing Wifi + BLE!? At least on the paper, the same specs as WXU.

p.kaczmarek2 · Answer

@MrGenius I remember you saying that you know how to open this device, can you share info?

MrGenius · Answer

It was actually very easy to open:

- You pull off the plastic turning wheel with some careful force. Just pull it off.
- then you can pull off the whole round cover, which is covering the batteries.
- Next, you clip out with a small a screwdriver the display
- then you can open the 3 small screws on top to pull out the board.

If i get home, i might be able to get you more pictures. But I am sure you will manage that

p.kaczmarek2 · Answer

Bootlog:


main_task_start : 62
[bl] start
[bl] iímain_task_start : 62
[bl] start
[bl] img seq 0, state 1
[bl] no trustzone feature !
[bl] bl_load_bin_by_id(), id 0xa5fe5a01
[bl] bl_load_bin_by_id() cost 11 ms
[bl] goto 0x201101
__read_manage_block: mag->blockid=255, id=0, mag->state=255.
__read_manage_block: mag->magic=0xffffffff, rescrc=0x00000000, mag->crc32=0xffffffff.
__read_manage_block: mag->blockid=255, id=1, mag->state=255.
__read_manage_block: mag->magic=0xffffffff, rescrc=0x00000000, mag->crc32=0xffffffff.
_judge_ota_info checkerr0:1, checkerr1:1
main_task_start : 62
PMA: aux_pm_inituse default flash chip mJedec 0x0
[FD I]: mode: 0x10, freq: 96000000Hz, drv: 0
[FD I]: jedec: 0x0, suspend_support: 1
[FD I] blk protect init ok
**********wlan_mode:0
[XR-80211] channel switching report, use N/BG rates --20231212v3
[XR-80211]:FIX SCAN RSSI, sample count: 5, marker: 255
Driver:delay scan complete, change link loss count, CMD_timeout send HANG, add filter function and bss lost thold,not DTIM count if disable mcast recv, assoc listen intval 50, rx stay awake perf, cmd force trydz tmo, rx wakelock 25ms --20240312v27

wlan information ===================================================
firmware:
    version : R0-XR_C07.08.52.67_ULP__02.138TY-SetNoise-SyncFilt-FltIGMP Dec  5 2023 15:27:52-Y02.138TY-SetNoise-SyncFilt-FltIGMP 
    buffer  : 8
driver:
    version : XR_V02.05
mac address:
    in use        : 38:a5:c9:3f:46:49
    in use        : 38:a5:c9:3f:46:4a
====================================================================

[wpa] add wpas_terminal flag--20230508v1

platform information ===============================================
XR806 SDK v1.2.1  Jul 30 2024 14:29:27 63401410

heap space [0x21e64c, 0x24bc00), size 185780

cpu  clock 160000000 Hz
HF   clock  40000000 Hz

sdk option:
    XIP           : enable
    INT LF OSC    : enable
    INT LDO       : select
    ILDO/EPWR     : enable
    SIP flash     : enable

mac address:
    efuse         : 80:74:84:69:04:75
    in use        : 38:a5:c9:3f:46:49
====================================================================

SystemStartupState=0
chip=48086	A=13
argv_int[0]:8
argv_int[1]:52
argv_int[2]:70
argv_int[3]:66
argv_int[4]:62
argv_int[5]:12
argv_int[6]:11
argv_int[7]:8
power_b:369098752 power_gn:1074003968 power_mcs7:-1878455536
 init_rf_param succ
[01-01 00:00:00 ty I][tal_thread.c:184] thread_create name:sys_timer,stackDepth:4096,totalstackDepth:4096,priority:3
[01-01 00:00:00 ty I][tal_thread.c:184] thread_create name:wq_system,stackDepth:5120,totalstackDepth:9216,priority:2
[01-01 00:00:00 ty I][tal_thread.c:184] thread_create name:wq_highpri,stackDepth:4096,totalstackDepth:13312,priority:3
tkl_thread_create:59 thread name:tuya_app_main
set force ps:1 100000 success
$ tkl_watchdog_init interval_ms(16000)!
WatchDog ResetMode Started, set timeout: 16
[01-01 00:00:00 ty I][tal_thread.c:184] thread_create name:health_monitor,stackDepth:3072,totalstackDepth:16384,priority:3
[01-01 00:00:00 ty I][mqc_app.c:429] mqc app init ...
[01-01 00:00:00 ty E][log_seq.c:867] logseq empty
[01-01 00:00:00 ty I][lpmgr.c:743] time:2000, g_cpu_sleep:2000
[wifi_adapter]: wifi_set_pm_dtim:20, immediate:1 beacon_cnt:5
$ -----wifi_set_pm_dtim:899 find_id:-1
$ [01-01 00:00:00 ty N][tbl_common_user_main.c:594] < TuyaOS V:3.6.3 BS:40.00_PT:2.3_LAN:3.5_CAD:1.0.5_CD:1.0.0 >
< BUILD AT:2024_07_18_19_55_22 BY ci_manage FOR tuyaos-lite-sdk AT xr806 >
IOT DEFS < WIFI_GW:1 DEBUG:0 KV_FILE:0 LITTLE_END:1 SL:0 OPERATING_SYSTEM:98 RELIABLE_TRANSFER:0 >

rst_reason=0
[01-01 00:00:00 ty N][tbl_common_user_main.c:595] reset_reason:0
[01-01 00:00:00 ty N][tbl_common_user_main.c:596] xr806_lowpower_common_ty:1.1.4
[01-01 00:00:00 ty N][simple_flash.c:446] key_addr: 0x1f5000   block_sz 4096
[01-01 00:00:00 ty N][simple_flash.c:532] get key:
[01-01 00:00:00 ty N][tuya_tls.c:852] uni_random_init...
[01-01 00:00:00 ty N][tuya_tls.c:279] tuya_tls_rand_init ok!
[01-01 00:00:00 ty N][tuya_wifi_connect.c:329] mf is open need stop fastconnect
tkl_system_malloc big memory, size(4200)!
tkl_wifi_set_work_mode:697 mode:1
tkl_system_malloc big memory, size(4168)!
[01-01 00:00:00 ty N][tbl_common_tuya_main.c:385] mf_init succ
[01-01 00:00:00 ty N][tdl_send_data_queue.c:355] uart queue sever queue num is :20
[01-01 00:00:00 ty N][tbl_common_basic_service.c:1782] addr:2273816 13
[01-01 00:00:00 ty N][tbl_common_basic_service.c:528] set sleep mode 1
[01-01 00:00:00 ty N][tbl_common_basic_service.c:541] set wk pin:20
tkl_cpu_sleep_mode_set: en = 1, mode = 0
pmu_release_wakelock(PMU_OS)
tkl_cpu_sleep_mode_set: en = 1, mode = 0
tkl_cpu_sleep_mode_set: en = 0, mode = 0
[wifi_adapter]: wifi_set_pm_dtim:10, immediate:1 beacon_cnt:3
$ -----wifi_set_pm_dtim:899 find_id:-1
$ [01-01 00:00:00 ty N][tbl_lp_manage.c:529] wake pin 20  level 0
[01-01 00:00:00 ty N][tbl_lp_manage.c:530] wake pin 28  level 0
[01-01 00:00:00 ty N][tbl_common_public_iot.c:933] MCU ver:1.1.0
[01-01 00:00:00 ty N][tuya_wifi_link.c:87] start wifi link params validate, nc_tp:10 md:0
[01-01 00:00:00 ty N][tuya_wifi_link.c:109] gw_wsm.nc_tp:10
[01-01 00:00:00 ty N][tuya_wifi_link.c:110] gw_wsm.md:0
[01-01 00:00:00 ty E][tuya_wifi_reset.c:638] read wf start mode err:-6
[01-01 00:00:00 ty N][tuya_svc_devos.c:509] Last reset reason: 0
[01-01 00:00:00 ty N][tuya_svc_devos.c:306] gw_cntl->gw_wsm.stat:0
[01-01 00:00:00 ty N][tuya_svc_devos.c:358] gw_cntl->gw_if.abi:0 input:0
[01-01 00:00:00 ty N][tuya_svc_devos.c:359] gw_cntl->gw_if.product_key:ihedujbuli6hsx9b, input:ihedujbuli6hsx9b
[01-01 00:00:00 ty N][tuya_svc_devos.c:360] gw_cntl->gw_if.tp:0, input:0
[01-01 00:00:00 ty N][tuya_svc_devos.c:363] gw_cntl->gw_if.firmware_key:key5nkpphq7huej7, input:key5nkpphq7huej7
[01-01 00:00:01 ty N][tuya_svc_devos.c:538] enter success_proc
[01-01 00:00:01 ty N][tuya_svc_devos.c:541] serial_no:38a5c93f4649
[01-01 00:00:01 ty N][tbl_common_basic_service.c:633] get_dev_info ok memrory left:85635
PMA: pm freeze task no exist
[01-01 00:00:01 ty E][tuya_wifi_reset.c:638] read wf start mode err:-6
tkl_wifi_set_work_mode:697 mode:3
[wifi_adapter]: wifi_on old mode 0,new mode 1
en1: CTRL-EVENT-TERMINATING 
WAR join_status:0
interface name: en1
setmlme_common lock
setmlme_common unlock
setmlme_common lock
setmlme_common unlock
Using interface en1 with hwaddr 38:a5:c9:3f:46:49 and ssid "AP-XRADIO"
en1: interface state UNINITIALIZED->ENABLED
en1: AP-ENABLED 
[net INF] msg <wlan connected>
[net INF] netif is link up
[net INF] netif is already down
[net INF] bring up netif
[user ERR] Error cmd:63
[wifi_adapter]: exec failed
[wifi_adapter]: wifi on exit
[net INF] netif (IPv4) is up
[net INF] address: 192.168.176.1
[net INF] gateway: 192.168.176.1
[net INF] netmask: 255.255.255.0
wlp_net_ctrl_msg_proc:0
not sta, mode:1
[net INF] msg <network up>
[net INF] dhcp addr start: 192.168.176.2
[net INF] dhcp addr end: 192.168.176.6
wlp_net_ctrl_msg_proc:10
not sta, mode:1
vif0, AP/GO mode THROTTLE=38
[wifi_adapter]: ap start : ip  0x1b0a8c0
[wifi_adapter]: ap start : mask  0xffffff
[wifi_adapter]: ap start : gateway  0x1b0a8c0
[net INF] no need to switch wlan mode 1
[wlan T] wlan_ap_disable()425
en1: AP-DISABLED 
setmlme_common lock
setmlme_common unlock
setmlme_common lock
setmlme_common unlock
en1: interface state ENABLED->DISABLED
[net INF] msg <wlan disconnected>
[net INF] netif is link down
wlp_net_ctrl_msg_proc:1
not sta, mode:1
[wifi_adapter]: max_conn: 1
[wifi_adapter]: chan: 6
[wifi_adapter]: [dxh] set ap beacon int 100ms
[wlan T] wlan_ap_enable()414
setmlme_common lock
setmlme_common unlock
setmlme_common lock
setmlme_common unlock
Using interface en1 with hwaddr 38:a5:c9:3f:46:49 and ssid "SmartLife-4649"
en1: interface state DISABLED->ENABLED
en1: AP-ENABLED 
[net INF] msg <wlan connected>
[net INF] netif is link up
[net INF] bring down netif
[net INF] netif (IPv4) is down
[net INF] bring up netif
[net INF] netif (IPv4) is up
[net INF] address: 192.168.176.1
[net INF] gateway: 192.168.176.1
[net INF] netmask: 255.255.255.0
wlp_net_ctrl_msg_proc:0
not sta, mode:1
WAR [WSM] Drop frame (0x0008).
WAR [WSM] Drop frame (0x0008).
[net INF] msg <network down>
wlp_net_ctrl_msg_proc:11
not sta, mode:1
[net INF] msg <network up>
vif0, AP/GO mode THROTTLE=38
[01-01 00:00:02 ty N][tuya_wifi_status.c:171] cur stat:13  0x2030e9 -->>
[01-01 00:00:02 ty N][tuya_wifi_status.c:174] wifi netstat changed to:13  -->>
[01-01 00:00:02 ty N][tuya_wifi_status.c:182] report wifi netstat[13] to callback  -->>
[01-01 00:00:02 ty N][tbl_common_basic_service.c:920] wifi status is :13
[net INF] dhcp addr start: 192.168.176.2
[net INF] dhcp addr end: 192.168.176.6
wlp_net_ctrl_msg_proc:10
not sta, mode:1
[01-01 00:00:02 ty N][tuya_wifi_reset.c:404] timer stated, short timer:0x0, long timer:0x4d8a39
[01-01 00:00:02 ty N][tuya_bt_link.c:61] bt startup attr:1
[01-01 00:00:02 ty N][tuya_ble_svc.c:976] upd product_id type:0 ihedujbuli6hsx9b


ble controller open
version    : 9.1.21
build sha1 : v9.1.21-5-gd8b2bd2
build date : Feb 15 2023
build time : 14:18:16
platform   : xr806


btcoex_bt_force_req
[01-01 00:00:02 ty N][tbl_lp_manage.c:464] gpio wake up
[01-01 00:00:02 ty N][tfm_data_frame_recv.c:192] offset is :7
btcoex_force_stop
ble rf_init done!
BLE INIT ALL DONE!
BT Coex. Init. OK.
tkl_hci_init:136
<E>    Adv status is already disabled
[01-01 00:00:02 ty N][tuya_ble_svc.c:1037] ty bt sdk init success finish
[01-01 00:00:02 ty N][ble_gap.c:2510] Start Adv
[01-01 00:00:02 ty N][tuya_svc_devos.c:219] __devos_init_evt success
[01-01 00:00:02 ty N][ble_gap.c:2510] Start Adv
[01-01 00:00:02 ty N][tuya_ble_svc.c:1115] ble adv updated
tkl_system_malloc big memory, size(10516)!
tkl_net_socket_create type(1), fd(2)!
tkl_net_socket_create type(0), fd(3)!
tkl_net_socket_create type(1), fd(4)!
[01-01 00:00:02 ty E][wifi_netcfg_frame_transporter.c:316] timer is not run,wait
[01-01 00:00:03 ty N][tbl_lp_manage.c:210] wait connect wifi

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.

divadiow · Answer

nice. i'm excited to look through the backup

p.kaczmarek2 · Answer

I've desoldered module, but I am getting synchron error so far.

divadiow · Answer

went crazy once with sync error on XR3 until I realised I should have been using RX0/TX0 not TX1/RX1

p.kaczmarek2 · Answer

I think I am using TX0/RX0, but maybe you can spot the error?

divadiow · Answer

seems OK I think PB02/PB03 grounded✅✅ UART0-RX/TX ✅✅ hang on. Maybe on XR3 it was RX->RX and TX->TX Added after 3 [minutes]: was for log anyway

p.kaczmarek2 · Answer

wait a sec, one has to reset while doing synchron waiting?

divadiow · Answer

I've not had to do that on XR3. just power up with all connected

p.kaczmarek2 · Answer

Anything more I need to read?

divadiow · Answer

not that I am aware of...

p.kaczmarek2 · Answer

So now, if you flash this binary to your XR809, will you get it to boot?

divadiow · Answer

already on it TuyaMCU at 115200 too.

p.kaczmarek2 · Answer

How do you know TuyaMCU baud?

divadiow · Answer

yes, it is. flashed OK but no signs of life. PSU not showing any draw and nothing out on RX0 or RX1 will do again to be sure

p.kaczmarek2 · Answer

and if you flash OBK, then it boots and outputs debug log?

divadiow · Answer

humble apologies. I'm getting mixed up with the Winner Micro W806 - ignore. Added after 1 [minutes]: indeed it does. normal boot log on RXD0 Added after 5 [minutes]:it seems I had a poke around for the SDK last year

p.kaczmarek2 · Answer

So we need to compile with XR806 SDK... how much different from XR809 is that?

divadiow · Answer

Added after 42 : though I think I'm in the process of getting the latest, if it's even different Added after 15 [minutes]:are you considering another port?

p.kaczmarek2 · Answer

Can you try to compile some of the examples? Then maybe I could try flashing them to my module.

divadiow · Answer

yes, maybe soon, just doing my WBR3 dev thingy Added after 3 [minutes]:you'd be quicker and better at it though...? Added after 55 :maybe @insmod could be tempted away from Android adventure

p.kaczmarek2 · Answer

Maybe porting from XR809 to XR806 is not that hard? This is XR809 HAL: It uses stuff like GPIO_InitParam structure. But is the same API available for XR806? I can't yet check, it's not yet indexed. Added after 2 [minutes]:Looks the same? So maybe everything just boils down to getting compilation process running and maybe changing config structure offset?

insmod · Answer

>>21429438 I don't have either xr806 or xr809, so count me out. And, i'm unfamiliar with xr809 sdk anyway.
I'll soon finish with android, i managed to build working aosp for my device with 2 main problems fixed - camera and udfps. Now to build lineageos...

p.kaczmarek2 · Answer

I think that one can be very easy, the only thing I don't know well is Github Actions vs makefile flow (I've learned most of the coding in C++/C Visual Studio), so if you @insmod want to help with setting up Github builds for XR806 sometime soon, please do. First we can just try it with @divadiow .

divadiow · Answer

there's this firmware for XR806 supplied here but it obviously doesn't prove anything about the SDK we have in its current state

Tuya WXU XR806 from TRV Heater Device flashing, SDK, firmware change research

Post #1

Post #2

Post #3

Post #4

Post #5

Post #6

Post #7

Post #8

Post #9

Post #10

Post #11

Post #12

Post #13

Post #14

Post #15

Post #16

Post #17

Post #18

Post #19

Post #20

Post #21

Post #22

Post #23

Post #24

Post #25

Post #26

Post #27

Post #28

Post #29

Post #30

Topic summary