Skip to content

RTL8196E Gateway — Open Linux Firmware

📢 Renamed project: formerly hacking-lidl-silvercrest-gateway — the same project, now covering the Sengled G4 and other RTL8196E gateways. Old GitHub links redirect automatically; the documentation now lives at the project documentation site.

⭐ Is this project useful to you? Please consider giving it a GitHub star. It helps others discover the project and motivates continued development.

💬 Questions and setup help: Discussions · Reproducible bug: open an Issue

Replace the cloud firmware on a supported smart-home gateway with a small, fully local Linux system. The gateway can then serve as a Zigbee coordinator, a Thread Border Router, or a standalone Zigbee router.

Supported boards include the Lidl Silvercrest / Tuya gateway and the Sengled Smart Hub G4 (E39-G8C). Pre-built images are included; rebuilding from source is optional.

First installation requires hardware access. A stock Lidl/Tuya gateway must be opened and connected to a 3.3 V USB-to-UART adapter. The serial connection is normally needed only once. Later upgrades use Ethernet and SSH.

Start here

Choose the path that describes your gateway now:

Your situation Read this
Stock Lidl/Silvercrest gateway with Tuya firmware First installation
Stock Sengled Smart Hub G4 Sengled hardware notes, then first installation
Gateway already running this project Upgrade guide
Unsure which Zigbee or Thread firmware to use Choose a radio mode
Something is not working Troubleshooting
Want to modify or rebuild the firmware Developer path

If this is your first embedded-Linux project, follow the first-installation guide in order. It explains the physical connection, backup, serial terminal, network setup, flashing, and post-install checks. Experienced users can use the short checklist at the top of that page.

What the project provides

  • Local Zigbee coordinator for Zigbee2MQTT or ZHA, with no vendor cloud
  • Thread Border Router with otbr-agent running on the gateway
  • Modern host-side Zigbee stack using RCP, cpcd, and zigbeed
  • Standalone Zigbee router to extend an existing mesh
  • SSH access to BusyBox Linux with persistent configuration
  • Network updates for both the Linux system and the EFR32 radio
  • Pre-built firmware plus reproducible build recipes

For most people who want to use Zigbee2MQTT or ZHA, the recommended setup is the NCP firmware. It exposes the radio at:

tcp://<gateway-ip>:8888

See Choose a radio mode before selecting RCP, OpenThread, or router firmware.

What the first installation involves

A gateway contains two independent processors:

Home Assistant / Zigbee2MQTT
             |
          Ethernet
             |
  RTL8196E running Linux
             |
           UART1
             |
  EFR32 Zigbee/Thread radio

The installation therefore has two firmware stages:

  1. Prepare the host, network choice, SSH key, hostname, and timezone.
  2. Back up the original 16 MiB flash.
  3. Open the gateway and connect the RTL8196E serial console.
  4. Flash the Linux system through the Realtek bootloader and TFTP; only its network mode is selected at this stage.
  5. Boot Linux, change the default password, install the SSH key and settings.
  6. Flash the EFR32 radio over the network for your chosen use case; flash_efr32.sh generates the matching radio configuration automatically.

The first-installation guide includes the existing PCB photo, the J1 pinout, safe UART wiring, and the complete command sequence.

Supported hardware

Board BOARD value Default kernel Notes
Lidl Silvercrest / Tuya reference board lidl Linux 6.18 Default; do not set BOARD
Sengled Smart Hub G4 (E39-G8C) sengled-e39-g8c Linux 6.18 Board-specific bootloader, kernel, and radio images

Linux 7.1 is also available as an alternate kernel line. New users should keep the production default, Linux 6.18. Board and kernel choices are explained in the install and upgrade reference.

Other RTL8196E gateways can be ported through devicetree and per-board build data. Start with the board-porting documentation and the component-specific developer guides.

After installation

The normal administration surface is SSH on port 22. The fresh image uses root / root; change that password immediately:

ssh root@<gateway-ip>
passwd

Then continue with Using and maintaining the gateway for SSH keys, network settings, backups, LEDs, radio state, and recovery.

The Zigbee bridge on TCP port 8888 has no application-level authentication. Keep it on a trusted LAN or bind it to loopback and use an SSH tunnel; see the UART bridge security guide.

Documentation map

User guides

Hardware and firmware reference

For developers

Normal installation uses pre-built files and needs only a few host packages. Do not install the complete toolchain unless you intend to rebuild firmware.

Credits and license

This project builds on the initial research by Paul Banks.

What followed came from people who reported, tested and wrote code — several of them running unreleased builds on gateways they depend on, which is the only reason some of these bugs were ever found. Roughly in order of how much each of them shaped the firmware:

  • @olivluca — opened #99, the ten-week investigation into gateways that stopped talking to their radio, and stayed with it to the close: instrumented kernels on a gateway in daily use, and serial-console captures that a reset would otherwise have destroyed. Also contributed DHCP-driven resolv.conf, an S15hostname fix, and the toolchain patches needed for the build to complete.
  • @hlyi — ported the firmware to the Sengled Smart Hub G4: device tree, bootloader board.h, blmode pin timing and the board documentation. This project supports a second board because of that work. Also reported the G4 bootloader flashing gap (#148), the flickering status LED (#120) and the missing xxd dependency (#147).
  • @MaxRower — opened #109, the crash that turned out to be a TLB flush bug of ours, and followed the whole release-candidate series from the field, including the flashing failures reported in #115.
  • @sipe — drove the EmberZNet 8.2 / RCP line from the first request for an SDK 8 build (#22) through to #112, the zigbeed crash on Zigbee2MQTT reconnect that was root-caused and fixed.
  • @frtz13 — ran the release candidates on their own gateway and posted panic record after panic record: 23 reports on #99 alone, the raw material the fix was built from.
  • @skinkie — reported six failures along the install and flashing path, from the L2-segment check (#88) and the EFR32 flashing script (#90, #92) to radio.conf not being written (#93), plus the early Zigbee2MQTT timeouts in #28.
  • @stream2me — the cpcd / zigbeed build chain: package set, static linking, and two robustness fixes (the symlink destroyed when the Zigbee2MQTT service stops, and the unbound variable on a first rcp-stack run).
  • @Thelvaen — reported the Docker-case path bug in flash_install_rtl8196e.sh (#103) and raised mDNS IPv6 announcement (#77).
  • @ish00t — the uptime statistics that told us when a build was actually holding: the negative evidence that is easy to forget to ask for and impossible to do without.
  • @malcreatuire — reported the flashing failure behind #149.

Released under the MIT License.