Smart Gateway RSH-GW006 to OBK Conversion: Tools, Files, Setup, and Integration Guide

DeDaMrAz 7089 60

#61 21878508 06 Apr 2026 16:16

DeDaMrAz DeDaMrAz

Level 22

Topic author Helpful post? (0)

Post #61
21878508 06 Apr 2026 16:16

@insmod

Check this if you have time, RTL cleanup is when I removed the code before merge.

https://github.com/openshwprojects/OpenBK7231T_App/pull/2018

If you like my work, support me at: https://paypal.me/openshwprojects
ADVERTISEMENT
Create an account, log in here. You will receive points by participating in discussions.
Join this discussion.

Install Elektroda application

Topic summary

✨ The discussion focuses on converting the Smart Gateway model RSH-GW006 to run OpenBeken (OBK) firmware, aiming to centralize tools, files, setup instructions, and integration guidance. The device teardown reveals four hidden screws and detailed board pinouts and schematics. Firmware for the WBRG1 module is based on OpenRTL8720D, with stable operation reported. The ZS3L module firmware is built with hardware flow offload and can be updated via TCP, though flashing can be sporadic and sometimes requires bootloader mode activation by pulling specific pins high. Universal-silabs-flasher is the primary tool used for flashing ZS3L firmware, supporting both UART and socket connections. Various firmware versions (8.0.2.0, 8.1.1.0, 8.2.0.0, and stock Tuya 6.5.5.0) were tested, with 8.2.0.0 and a specific build for MGM210L022JNF silicon identified as stable and fully functional for the ZS3L on the Tuya MOES NH-THP01-ZB gateway. Challenges include bootloader detection issues, secure boot possibly blocking custom firmware, and hardware differences in ZS3L variants. J-Link and ST-LINK V2 probes with custom OpenOCD were used for chip unlocking, backup, and flashing, as standard Segger tools are limited to STM32 devices. ESP32-S3 and C3 modules were tested for Bluetooth proxy functionality, with temperature and frequency tuning discussed. Bluetooth support in OBK is limited, with ongoing efforts to add BTHome support. The thread includes detailed logs, flashing commands, and troubleshooting steps to aid in successful firmware conversion and integration with Zigbee2MQTT (Z2M) and Home Assistant (HA).
Generated by the language model.

FAQ

TL;DR: Convert the Smart Gateway RSH-GW006 to OBK on the WBRG1 and bridge its ZS3L Zigbee over TCP. 1 month uptime reported; "Stable, I've got a month uptime." Flash with Ameba Image Tool, integrate ZHA at tcp://:8888, and update ZS3L via universal‑silabs‑flasher. [Elektroda, insmod, post #21588192] Why it matters: You reclaim a Tuya gateway for local control with Home Assistant or Zigbee2MQTT, no cloud required.

Quick Facts

Platform: WBRG1 (Realtek RTL8720D/AmebaD) runs OBK; ZS3L is the Zigbee NCP exposed over TCP. [Elektroda, DeDaMrAz, post #21588187]
Bootloader entry: ENABLE to GND, LogTX to GND via 2.2–4.7 kΩ, then release ENABLE and remove the resistor. [Elektroda, DeDaMrAz, post #21588187]
Full backup: rtltool.py reads flash to ff.bin; expected size is 8Mb after completion. [Elektroda, DeDaMrAz, post #21588187]
HA ZHA setup: Add integration using tcp://:8888; enable Hardware flow control only with latest ZS3L FW. [Elektroda, DeDaMrAz, post #21588187]
Zigbee2MQTT: ZS3L 8.2.0.0 needs latest-dev (EZSP v17); 8.1.1.0 works on stable. [Elektroda, insmod, #21589890

What hardware is inside the RSH-GW006, and where does OBK run?

The gateway houses a WBRG1 (Realtek RTL8720D/AmebaD) Wi‑Fi SoC and a Silicon Labs ZS3L Zigbee NCP. OBK (OpenRTL8720D) runs on the WBRG1, while the ZS3L stays as the Zigbee radio exposed over a TCP‑to‑UART bridge. [Elektroda, DeDaMrAz, post #21588187]

How do I open the RSH-GW006 case without damage?

Flip the unit and peel the four rubber feet. Remove the four small screws hidden beneath them. Lift the lid carefully to avoid stressing internal cables. This exposes the WBRG1 and ZS3L modules for UART and J‑Link access. [Elektroda, DeDaMrAz, post #21588187]

How do I put the WBRG1 into bootloader (download) mode?

Follow this 3‑step sequence:

Connect UART (GND, 3V3, RX, TX) to P1 and pull ENABLE to GND.
Pull LogTX to GND via a 2.2–4.7 kΩ resistor.
Release ENABLE, then remove the resistor from LogTX; the module is in bootloader mode. [Elektroda, DeDaMrAz, post #21588187]

How can I back up the original WBRG1 firmware safely?

Enter download mode, then run rtltool.py to read full flash, e.g., py -3.12 rtltool.py -p COMx -b1000000 rf 0 0x8000000 ff.bin. Adjust Python version with python -V and tweak baud (up to 1,500,000). Expect ff.bin ≈ 8Mb. Use COMx on Windows or /dev/tty* on Linux. [Elektroda, DeDaMrAz, post #21588187]

How do I flash OBK onto the WBRG1 with Ameba Image Tool?

Open Ameba-ImageTool v2.3.2, load the latest RTL8720D UART build into the first field, and do not change other options. Put WBRG1 into bootloader, click Download, then reboot. The device should broadcast an OBK AP; connect and configure at 192.168.4.1. [Elektroda, DeDaMrAz, post #21588187]

What OBK pin roles should I set for LEDs and the button?

Use these roles: pin 25 = LED;1, pin 54 = WifiLED;0, pin 55 = Btn_n;0. Apply via OBK’s pin configuration. This maps the status LED, Wi‑Fi LED, and the front button to expected behaviors. [Elektroda, DeDaMrAz, post #21588187]

How do I expose Zigbee over TCP and add it in Home Assistant (ZHA)?

In OBK autoexec.bat, start the TCP‑UART bridge: startdriver uarttcp 115200 512 1 1, label the channel, hide it, and set type OpenClosed_Inv. In Home Assistant, add ZHA and select tcp://:8888 as the port. Enable Hardware flow control only if you flashed the latest ZS3L FW. [Elektroda, DeDaMrAz, post #21588187]

How do I flash or update the ZS3L Zigbee firmware over TCP?

Use universal‑silabs‑flasher from your PC: universal-silabs-flasher --device socket://:8888 flash --firmware zs3l_zigbeencp_115200.gbl. It detects EZSP and Gecko bootloader, then writes the GBL image. You can downgrade with --allow-downgrades. Example upgrades to 8.2.0.0 and downgrades to 8.1.1.0 were successful. [Elektroda, insmod, post #21589890]

Which ZS3L firmware version should I use with Zigbee2MQTT today?

Use 8.1.1.0 with stable Zigbee2MQTT. Version 8.2.0.0 requires the latest‑dev container because it uses EZSP protocol v17. As one tester noted, “8.1.1.0 works.” You can switch with universal‑silabs‑flasher as needed. [Elektroda, insmod, post #21589890]

Zigbee2MQTT fails after upgrading to ZS3L 8.2.0.0—what’s the fix?

You may see: “Adapter EZSP protocol version (17) is not supported by Host [13‑16].” Run the latest‑dev Zigbee2MQTT (dev branch supports EZSP v17), or downgrade the NCP to 8.1.1.0 using universal‑silabs‑flasher with --allow-downgrades. This restores stable connectivity. [Elektroda, insmod, post #21589890]

Can I flash the ZS3L over UART directly?

Direct UART flashing proved unreliable here. The author tried multiple tool combinations without success. Recommended methods are J‑Link with Simplicity Commander or universal‑silabs‑flasher over the OBK TCP bridge on port 8888. [Elektroda, DeDaMrAz, post #21588187]

My USB‑UART struggles at 1,500,000 bps. What should I do?

Lower the baud rate and retry. Edit the script’s -b value and test alternatives like 921600 or 1000000. Confirm your Python version (python -V) and call the correct interpreter (e.g., py -3.12). Use quality cables and a reliable adapter. [Elektroda, DeDaMrAz, post #21588187]

Does Bluetooth work on this gateway under OBK?

Not currently. A UART‑to‑Linux BT attempt required kernel patches and still failed to function; bluetoothctl saw nothing. The developer mentioned exploring BTHome support in OBK later. “It didn’t work” summarizes current status. [Elektroda, insmod, post #21588894]

Can I update the ZS3L while the gateway still runs stock Tuya firmware?

Yes. universal‑silabs‑flasher can talk to the stock NCP. However, very old stock may not work with the ember driver in Zigbee2MQTT. Plan to update NCP firmware after migrating WBRG1 to OBK for best compatibility. [Elektroda, insmod, post #21588402]

What extra universal‑silabs‑flasher flags are useful but hidden from --help?

Useful flags include --allow-cross-flashing, --allow-downgrades, --ensure-exact-version, and --force. These control cross‑flashes, downgrades, strict versioning, or skipping safeguards. They are handy when aligning NCP firmware with your Zigbee stack or rolling back from an incompatible build. [Elektroda, DeDaMrAz, post #21590140]

Should I always flash the newest ZS3L firmware?

No. Match firmware to your Zigbee stack support level. As the maintainer noted, “Newer does not mean better.” Prefer 8.1.1.0 for broad compatibility now, or move to 8.2.0.0 if your Zigbee2MQTT build supports EZSP v17. [Elektroda, insmod, post #21588567]

Generated by the language model.