SSW logo Blog - Michael's Musings

Wed, 03 Feb 2016

How to Flash OpenWSN to OpenMote with SEGGER JLink

I have an OpenMote device. One I bought prior to July 2014, so it's got a bootloader that won't let you install via serial UART, so it has to be JTAG'ed in, and in any case, you might toast yourself and have to start over, or you might want GDB.

First, my setup. It's not a windows laptop with a USB cable. That would be... cramped and really inefficient to work with.

I have a desktop, it's called obiwan. It does Linux desktop things like run multiple monitors, play music and keep browsers going. And does it without fan noise, and I like that a lot.

I have a build server, it's called herring. It has lots of cross-compilers installed, three-way RAID mirror (because: consumer grade disks suck), and it's in the other room where it can make as much noise as it wants, and it does NFS to the other machines.

I have a table/desk full of stuff, with a small form factor (fanless) PIII running

Devone, with two USB hubs connected. It's called "lando". (Stupid muse/pybloxsom has no idea how to set width= on images)

SOHO IoT/6tisch/ROLL lab
SOHO IoT/6tisch/ROLL lab

The old 10/100 8-port switch screwed up in the picture was the original idea, but dammit, I ran out of ports, and so the old Dell 24-port 10/100 is there too, with a fan making noise and pissing me off.

It turns out the RPI model Bs have PHYs that just don't do the MII dance correctly with more modern PHYs when driven by uBoot, so the RPI are still plugged into the 15 year old 10/100 switch.

I installed the SEGGER software on lando, as it's got the USB cable to the JLink. I extracted the 6tisch Golden image, which can be found from the page:

https://github.com/openwsn-berkeley/openwsn-fw/releases/tag/GD_REL-1.2.0

as the Download links marked "source code" at the bottom of the page:

https://github.com/openwsn-berkeley/openwsn-fw/archive/GD_REL-1.2.0.tar.gz

I extracted this on my build server, because that's where my arm GDB is installed:

herring-[projects/pandora/openmote/images-GD_REL-1.2.0] mcr 1003 %ls -lta
total 1556
drwxr-xr-x 4 mcr mcr   4096 Feb  3 12:22 ../
drwxr-xr-x 2 mcr mcr   4096 Jan 28 11:21 ./
-rw-r--r-- 1 mcr mcr 524256 Jan 28 11:21 GD_ROOT.bin
-rw-r--r-- 1 mcr mcr 524256 Jan 28 11:21 GD_ROOT_SEC.bin
-rw-r--r-- 1 mcr mcr 524256 Jan 28 11:21 GD_SNIFFER.bin

On lando I started JLinkGDBServer:

lando-[~] mcr 10001 %sudo /opt/SEGGER/JLink/JLinkGDBServer -device CC2538SF53
[sudo] password for mcr:
SEGGER J-Link GDB Server V5.10j Command Line Version

JLinkARM.dll V5.10j (DLL compiled Feb  2 2016 19:31:34)

-----GDB Server start settings-----
GDBInit file:                  none
GDB Server Listening port:     2331
SWO raw output listening port: 2332
Terminal I/O port:             2333
Accept remote connection:      yes
Generate logfile:              off
Verify download:               off
Init regs on start:            off
Silent mode:                   off
Single run mode:               off
Target connection timeout:     0 ms
------J-Link related settings------
J-Link Host interface:         USB
J-Link script:                 none
J-Link settings file:          none
------Target related settings------
Target device:                 CC2538SF53
Target interface:              JTAG
Target interface speed:        1000kHz
Target endian:                 little

Connecting to J-Link...
J-Link is connected.
Firmware: J-Link V9 compiled Feb  2 2016 18:43:46
Hardware: V9.30
S/N: 269305618
OEM: SEGGER-EDU
Feature(s): FlashBP, GDB
Checking target voltage...
Target voltage: 3.31 V
Listening on TCP/IP port 2331
Connecting to target...
J-Link found 2 JTAG devices, Total IRLen = 10
JTAG ID: 0x4BA00477 (Cortex-M3)
Connected to target
Waiting for GDB connection...

Then on herring I started the GDB, as explained at:

http://www.openmote.com/blog/getting-started-with-contiki-and-openmote.html

I thought to load the GD_ROOT.bin directly using:

(gdb) restore GD_ROOT.bin binary 0x200000
Restoring binary file GD_ROOT.bin into memory (0x200000 to 0x27ffe0)

but this didn't work, so I followed the instructions to create hello-world. my copy of which is at:

http://www.sandelman.ca/SSW/contiki/openmote/hello-world-3.0-20160203.elf

(gdb) target remote lando:2331
Remote debugging using lando:2331
warning: Architecture rejected target-supplied description
0x00216752 in ?? ()
(gdb) monitor interface jtag
Select JTAG as target interface
(gdb) monitor speed 5000
Target interface speed set to 5000 kHz
(gdb) monitor endian little
Target endianess set to "little endian"
(gdb) monitor flash download = 1
Flash download enabled
(gdb) monitor flash breakpoints = 1
Flash breakpoints enabled
(gdb) monitor reset
Resetting target
(gdb) load /corp/projects/contiki/contiki-3.0/examples/hello-world/hello-world.elf
Loading section .text, size 0xab53 lma 0x200000
Loading section .data, size 0x1be lma 0x20ab54
Loading section .ARM.exidx, size 0x10 lma 0x20ad14
Loading section .flashcca, size 0x2c lma 0x27ffd4
Start address 0x200000, load size 44365
Transfer rate: 1883 KB/sec, 7394 bytes/write.

This is what my J-Link said:

Firmware: J-Link V9 compiled Feb  2 2016 18:43:46
Hardware: V9.30
S/N: 269305618
OEM: SEGGER-EDU
Feature(s): FlashBP, GDB
Checking target voltage...
Target voltage: 3.31 V
Listening on TCP/IP port 2331
Connecting to target...
J-Link found 2 JTAG devices, Total IRLen = 10
JTAG ID: 0x4BA00477 (Cortex-M3)
Connected to target
Waiting for GDB connection...Connected to 172.30.2.231
Reading all registers
Read 4 bytes @ address 0x00216752 (Data = 0xBF204770)
Select JTAG as target interface
Target interface speed set to 5000 kHz
Target endianess set to "little endian"
Flash download enabled
Flash breakpoints enabled
Resetting target
Downloading 16112 bytes @ address 0x00200000
Downloading 16048 bytes @ address 0x00203EF0
Downloading 11699 bytes @ address 0x00207DA0
Downloading 446 bytes @ address 0x0020AB54
Downloading 16 bytes @ address 0x0020AD14
Downloading 44 bytes @ address 0x0027FFD4
Writing register (PC = 0x00200000)
Reading register (XPSR = 0x01000000)

The reset button on my unit seems broken, but you can do the same with the JTAG interface with "monitor reset", and I get:

Contiki-2.6-2325-g7df05ce
TI SmartRF06 + cc2538EM
Net: sicslowpan
MAC: CSMA
RDC: Contiki MAC
Rime configured with address 00:12:4b:00:03:a5:70:05
Hello, world

using minicom on the ttyUSB3 (my situation) at 115200 baud on my lando machine. With the JTAG attached I can probably work on the device entirely remotely.