(Continued from previous post)

Time to make some changes to the bulb. ESPHome is what I normally use, so I’m going with that.

6 pins in total need to be connected:

• two power rails (3.3V),
• the RX and TX pins,
• gpio8 pulled to VCC (for flashing)
• gpio9 to GND (for flashing)

I have a little harness board to organize the wires.

Because the flash size is tiny (2MB vs normal 4MB), I had to disable some ESPHome features. There is no fallback portal now, so using the bulb elsewhere on another wifi is going to be tricky.

It took some trial and error to get the config right because I didn’t bother tracing the tracks. The BP5936 accepts one PWM channel for brightness, and a second one for color temperature.

final config

esphome:
  name: smartmesh-cct-9w
  friendly_name: smartmesh-cct-9w

esp32:
  board: esp32-c3-devkitm-1
  flash_size: 2MB
  framework:
    type: esp-idf

# Enable logging
logger:
  level: WARN
  
# Enable Home Assistant API
api:
#  encryption:
#    key: "secretkey"

ota:
  - platform: esphome
    password: "secretpassword"

wifi:
  ssid: !secret wifi_ssid
  password: !secret wifi_password

  # Disable fallback hotspot (captive portal) 
  #ap:
  #  ssid: "Smartmesh-Cct-9W"
  #  password: "emergencypassword"

#captive_portal:
    

# Light config

output:
  - platform: ledc
    pin: GPIO3
    id: out_brightness

  - platform: ledc
    pin: GPIO6
    id: out_temp
    inverted: true

light:
  - platform: color_temperature
    name: "Light"
    color_temperature: out_temp
    brightness: out_brightness
    cold_white_color_temperature: 6500 K
    warm_white_color_temperature: 2700 K

My Home Assistant VM (ESPHome as addon) ran out of space installing the RISC V toolchain, so I had to increase the disk’s size to 24GB from 16GB.

Downsides of taking the bulb apart includes the heat sinking no longer glued in properly, so I don’t want to run it at full brightness unless I fix that.

Cheap CCT tunable wifi smart bulb. Bought in Apr 2026 for ₹280 off Amazon.in, although it was manufactured in Oct 2023.

• ESP8685-WROOM-04
• 32-bit RISC V, 160MHz
• 2MB flash (normal modules have 4MB)
• BP5936 dual channel LED driver
• BP2306, seems to be for the power supply

First time tinkering with a device that has a RISC-V processor.

As usual, my aim is to make it work fully locally with Home Assistant, no servers in China involved.

I opened it up, took out the board, soldered wires to the wifi module, and powered it with a 3.3V supply.

Stock firmware serial output

ESP-ROM:esp32c3-api1-20210207
ESP-ROM:esp32c3-api1-20210207
ESP-ROM:esp32c3-api1-20210207
Build:Feb  7 2021
rst:0xf (BROWNOUT_RST),boot:0x9 (SPI_FAST_FLASH_BOOT)
SPIWP:0xee
mode:DIO, clock div:1
load:0x3fcd6100,len:0xc84
load:0x403ce000,len:0x714
load:0x403d0000,len:0x275c
entry 0x403ce000
ESP-ROM:esp32c3-api1-20210207
Build:Feb  7 2021
rst:0xf (BROWNOUT_RST),boot:0x9 (SPI_FAST_FLASH_BOOT)
SPIWP:0xee
mode:DIO, clock div:1
load:0x3fcd6100,len:0xc84
load:0x403ce000,len:0x714
load:0x403d0000,len:0x275c
entry 0x403ce000
ESP-ROM:esp32c3-api1-20210207
Build:Feb  7 2021
rst:0xf (BROWNOUT_RST),boot:0x9 (SPI_FAST_FLASH_BOOT)
SPIWP:0xee
mode:DIO, clock div:1
load:0x3fcd6100,len:0xc84
load:0x403ce000,len:0x714
load:0x403d0000,len:0x275c
entry 0x403ce000
I (38) cpu_start: Pro cpu up.
I (50) cpu_start: Pro cpu start user code
I (50) cpu_start: cpu freq: 160000000
I (50) cpu_start: Application information:
I (50) cpu_start: Project name:     smartbulb
I (54) cpu_start: App version:      eef5c8b-dirty
I (58) cpu_start: Compile time:     Jan 26 2023 11:46:49
I (63) cpu_start: ELF file SHA256:  94d0c934ef33a9a1...
I (68) cpu_start: ESP-IDF:          v4.3
I (72) heap_init: Initializing. RAM available for dynamic allocation:
I (78) heap_init: At 3FC96700 len 00029900 (166 KiB): DRAM
I (83) heap_init: At 3FCC0000 len 0001F060 (124 KiB): STACK/DRAM
I (89) heap_init: At 50000010 len 00001FE0 (7 KiB): RTCRAM
I (95) spi_flash: detected chip: generic
I (98) spi_flash: flash io: dio
I (101) sleep: Configure to isolate all GPIO pins in sleep state
I (107) sleep: Enable automatic switching of GPIO sleep configuration
I (113) cpu_start: Starting scheduler.

Stock firmware esptool output

esptool.js
Serial port WebSerial VendorID 0x1a86 ProductID 0x7523
Connecting...
Detecting chip type... ESP32-C3
Chip Revision: 3
Chip is ESP8685 (QFN28) (revision v0.3)
Features: Wi-Fi,BLE,Embedded Flash 2MB (TT)
Crystal is 40MHz
MAC: 58:cf:79:74:3d:58
Uploading stub...
Running stub...
Stub running...
Flash ID: 1560eb

(continued in part 2)

Warning: You will no longer have DSL! You might end up with a brick!! There is no wifi yet!!!

The good news is that the modem has a recovery mode which should help recover from most issues. Turn off the modem. Use a pen to hold down the reset button and turn it back on. The power LED should now turn red. You are now in recovery mode.

So these are the steps (roughly) by which I managed to install openwrt on DLink DSL-2730U C1.

1. Figure out the platform and wifi

Version being C1, SoC is BCM6328 and wifi is BCM4313. ROM is 8MB and RAM 32MB. There is no official OpenWRT support for our model. Too bad.

2. Get the ROM

Go to the OpenWRT site, downloads, then look for the generic brcm6328 image. The link below is only a suggestion, perhaps a newer version will work as well.

https://downloads.openwrt.org/releases/17.01.4/targets/brcm63xx/generic/

You need the 8MB generic image, it should be named something like:

96328avng-generic-squashfs-cfe-8M.bin

3. Flash the ROM

Enter recovery mode (hold reset down when you turn it on).

Connect to the computer with an ethernet cable and go to the recovery address at 192.168.1.1.

A simple page loads. Follow instructions to select and flash the previously downloaded rom. This will take a minute. Modem will eventually reboot and you can log into OpenWRT at 192.168.1.1.

4. Set up routing

a. I set up ethernet port 1 as the wan port. Add a new VLAN in Network>Switch. Turn off port 1 in the existing VLAN and set it to ‘untagged’ in the new one. Set the cpu to tagged in both.

b. Add a new interface in Network>Interfaces. Select the VLAN you just created and select the WAN firewall zone for it. Set up the WAN using the info your ISP gave you, in my case a static ip address.

Now you can connect the device to your regular modem as a router.

Now for the bonus section.

5. Try installing WiFi drivers (but probably a waste of time)

To refresh package list and install the brcmsmac wifi driver:

opkg update
opkg install kmod-brcmsmac
rmmod brcmsmac
modprobe brcmsmac
Now to refresh the configuration files:
rm -f /etc/config/wireless
wifi config
cat /etc/config/wireless

Hopefully you just saw a wireless interface listed. Now you might want to install WPA security:

opkg install wpad-mini

For me the wifi module (BCM4313) is detected and configurable but fails to start up due to some issue with suspend. YMMV.

The receiver chip is likely a custom Logitech chip which uses a single wire interface to communicate with a custom controller. In my case the controller IC is CP5928AM, for either of which a datasheet is nowhere to be found. They be proprietary.

Fortunately, I found a reference to a relevant Logitech patent (US6552716) on Hackaday forums, and while it only explains general operation and doesn’t offer exact timings, (and I don’t own an oscilloscope), a little trial and error has produced working code.

Based on the patent, I found that data can be read as follows:

1. You’ll need two free I/O pins on your MCU. Connect one each to the IRLED (I’ll call it LED) and the data pin of the receiver (I’ll call it data pin). Use existing wiring to figure out the pins. Start with LED off, and data pin set to INPUT on the MCU.
2. Pulse the LED on and then off. This produces a light pulse which changes the state of a couple of SR latches in the receiver to produce an output which you will now read off a parallel-to-serial shifter.
3. Change the data pin to OUTPUT and drive the data pin high and then low. Then change it back to INPUT. Now read the data pin. You have your first directional bit.
4. Again, change the data pin to OUTPUT and drive the data pin high and then low. Then change it back to INPUT. Now read the data pin. You have your second directional bit.
5. Each bit indicates rotation in one direction. If both are 0, there is no movement. If both are 1, then you are not reading data fast enough.
6. Repeat steps 2 to 5.

Here’s the code I wrote to test it with my Arduino:

/*************************************/
/*  Logitech Quadrature Encoder      */
/*  Single wire interface            */
/*  Code based on patent US6552716.  */
/*************************************/

// data, IRLED pins
#define QEDATAPIN 7
#define QELEDPIN 6

int qeOld1, qeOld2, turns=0, overflows=0;

void setup() {
  Serial.begin(115200);
  pinMode(QEDATAPIN, INPUT);
  //turn irled off -- high is OFF
  pinMode(QELEDPIN, OUTPUT);
  digitalWrite(QELEDPIN, HIGH);
  qeOld1=qeOld2=0;
}

//in microseconds, increase if they don't work
#define QE_SENSOR_PULSEWIDTH 2
#define QE_IRLED_PULSEWIDTH 2

inline void qeLEDlightPulse(){
  digitalWrite(QELEDPIN, LOW);
  delayMicroseconds(QE_IRLED_PULSEWIDTH);
  digitalWrite(QELEDPIN, HIGH);
}

inline byte getQEDataBit(){
  //switch to output mode and
  //pulse data line high and then low
  delayMicroseconds(QE_SENSOR_PULSEWIDTH/2);
  pinMode(QEDATAPIN, OUTPUT);
  digitalWrite(QEDATAPIN, HIGH);
  delayMicroseconds(QE_SENSOR_PULSEWIDTH);
  digitalWrite(QEDATAPIN, LOW);
  delayMicroseconds(QE_SENSOR_PULSEWIDTH);
  //switch back to input mode and
  //read data bit
  pinMode(QEDATAPIN, INPUT);
  delayMicroseconds(QE_SENSOR_PULSEWIDTH);
  return digitalRead(QEDATAPIN);
}

void loop() {
  qeLEDlightPulse();
  byte qe1 = getQEDataBit();
  byte qe2 = getQEDataBit();
  
  if(qeOld1!=qe1 || qeOld2!=qe2){
    if(qe1!=0)
      turns++;
    if(qe2!=0)
      turns--;
    if(qe1==qe2 && qe1==1)
      overflows++;
    Serial.print(turns);
    Serial.print("\t-- ");
    Serial.print(overflows);
    Serial.print("\t-- ");
    Serial.print(qe1);
    Serial.println(qe2);
  }
  qeOld1=qe1;
  qeOld2=qe2;
}