Error trying to flash firmware

[malcreatuire]

After successfull upgrading my gateway to 3.10.0 i tried to reflash the radio firmware. This fails with:

hacking-lidl-silvercrest-gateway]$ ./flash_efr32.sh  -g 10.42.0.64 otrcp 

Firmware: ot-rcp-460800.gbl
Image:    /home/frithjof/Sync/src/hacking-lidl-silvercrest-gateway/2-Zigbee-Radio-Silabs-EFR32/26-OT-RCP/firmware/ot-rcp-460800.gbl
Gateway:  10.42.0.64:8888

universal-silabs-flasher: venv (/home/frithjof/Sync/src/hacking-lidl-silvercrest-gateway/silabs-flasher)

Connecting to 10.42.0.64 — detecting configuration...
root@10.42.0.64's password: 
Detected: otbr @ 460800 baud (bridge armed)
Switching bridge to flash mode (flow_control=1, OTBR path)...
Pulsing EFR32 nRST for clean pre-probe state...
Bridge ready at 460800 baud, flow_control=1 (OTBR path).

Flash ot-rcp-460800.gbl to 10.42.0.64? [y/N] y

Flashing...
Pre-check: is chip already in Gecko Bootloader?
  Chip is running an app — probing at 460800 baud.
2026-07-14 18:33:11.962 HannahArendt universal_silabs_flasher.flash INFO Failed to read firmware metadata: KeyError('No tag with id <GBLTagId.METADATA: 4127721718> exists')
2026-07-14 18:33:11.962 HannahArendt universal_silabs_flasher.flasher INFO Probing ApplicationType.EZSP at 460800 baud
2026-07-14 18:33:25.484 HannahArendt universal_silabs_flasher.flasher INFO Probing ApplicationType.CPC at 460800 baud
2026-07-14 18:33:29.816 HannahArendt universal_silabs_flasher.flasher INFO Probing ApplicationType.SPINEL at 460800 baud
2026-07-14 18:33:38.050 HannahArendt universal_silabs_flasher.flasher INFO Probing ApplicationType.GECKO_BOOTLOADER at 460800 baud
Error: Failed to probe running application type

Standard probe failed — sweeping fallback bauds: 115200 230400 460800 691200 892857

Trying fallback baud 115200...
2026-07-14 18:33:40.871 HannahArendt universal_silabs_flasher.flash INFO Failed to read firmware metadata: KeyError('No tag with id <GBLTagId.METADATA: 4127721718> exists')
2026-07-14 18:33:40.871 HannahArendt universal_silabs_flasher.flasher INFO Probing ApplicationType.EZSP at 115200 baud
2026-07-14 18:33:54.391 HannahArendt universal_silabs_flasher.flasher INFO Probing ApplicationType.CPC at 115200 baud
2026-07-14 18:33:58.800 HannahArendt universal_silabs_flasher.flasher INFO Probing ApplicationType.SPINEL at 115200 baud
2026-07-14 18:33:58.882 HannahArendt universal_silabs_flasher.flasher INFO Detected ApplicationType.SPINEL, version 'SL-OPENTHREAD/2.4.7.0_GitHub-fb0446f53' (2.4.7.0) at 115200 baudrate (bootloader baudrate None)
Traceback (most recent call last):
  File "/home/frithjof/Sync/src/hacking-lidl-silvercrest-gateway/silabs-flasher/bin/universal-silabs-flasher", line 8, in <module>
    sys.exit(main())
             ~~~~^^
  File "/home/frithjof/Sync/src/hacking-lidl-silvercrest-gateway/silabs-flasher/lib/python3.13/site-packages/universal_silabs_flasher/__main__.py", line 8, in main
    asyncio.run(async_main())
    ~~~~~~~~~~~^^^^^^^^^^^^^^
  File "/usr/lib/python3.13/asyncio/runners.py", line 195, in run
    return runner.run(main)
           ~~~~~~~~~~^^^^^^
  File "/usr/lib/python3.13/asyncio/runners.py", line 118, in run
    return self._loop.run_until_complete(task)
           ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^
  File "/usr/lib/python3.13/asyncio/base_events.py", line 725, in run_until_complete
    return future.result()
           ~~~~~~~~~~~~~^^
  File "/home/frithjof/Sync/src/hacking-lidl-silvercrest-gateway/silabs-flasher/lib/python3.13/site-packages/universal_silabs_flasher/flash.py", line 234, in main
    await _cmd_flash(args, flasher, getattr(args, "verbose", 0))
  File "/home/frithjof/Sync/src/hacking-lidl-silvercrest-gateway/silabs-flasher/lib/python3.13/site-packages/universal_silabs_flasher/flash.py", line 322, in _cmd_flash
    await flasher.enter_bootloader()
  File "/home/frithjof/Sync/src/hacking-lidl-silvercrest-gateway/silabs-flasher/lib/python3.13/site-packages/universal_silabs_flasher/flasher.py", line 429, in enter_bootloader
    raise FailedToEnterBootloaderError()
universal_silabs_flasher.flasher.FailedToEnterBootloaderError

115200 fallback: app detected, EFR32 entered bootloader — retrying via bootloader:115200...
2026-07-14 18:34:04.717 HannahArendt universal_silabs_flasher.flash INFO Failed to read firmware metadata: KeyError('No tag with id <GBLTagId.METADATA: 4127721718> exists')
2026-07-14 18:34:04.717 HannahArendt universal_silabs_flasher.flasher INFO Probing ApplicationType.GECKO_BOOTLOADER at 115200 baud
Error: Failed to probe running application type

Trying fallback baud 230400...
^C

If I dont interrupt this, it will just repeat the detection cycle for a lot of different baudrates without detecting anything.

Between the INFO Detected ApplicationType.SPINEL and the Traceback (most recent call last):- line is ~ 5 second pause.

Any directions?

[jnilo1]

What your log says

Two things stand out. First, your gateway's config expects the radio at 460800 baud (Detected: otbr @ 460800), but the fallback sweep found a live Spinel RCP at 115200 — so your EFR32 is still running an OT-RCP image flashed with an early release of this project (v1.0/v1.1, February 2026), from before the OT-RCP default moved to 460800 (v3.0.0, April 2026). The 3.10.0 upgrade only replaces the RTL8196E side; the radio keeps whatever it had.

Second — and this is the actual blocker — after detecting the app, the flasher commands it to reboot into the Gecko bootloader (Spinel CMD_RESET(BOOTLOADER)), and the chip never gets there (FailedToEnterBootloaderError, then the bootloader probe at 115200 finds nothing). OT-RCP builds shipped before v1.2 (2026-03-01) had that handler compiled out (OPENTHREAD_CONFIG_PLATFORM_BOOTLOADER_MODE_ENABLE was missing): on receiving the bootloader-reset command they perform a plain application reset instead of entering the bootloader. It was fixed in v1.2, but a chip still running a pre-v1.2 build cannot be commanded into the bootloader over the UART at all — which is why the baud sweep just keeps cycling. This limitation is documented in 2-Zigbee-Radio-Silabs-EFR32/26-OT-RCP/MEMO-baudrate-460800.md (section 8), and unfortunately the Lidl board has no hardware bootloader-entry pin to fall back on.

Two things to confirm

1. When did you first flash OT-RCP onto the radio — was it with a v1.0/v1.1 release (roughly February 2026)?
2. If you let the sweep run a second full cycle: does the 115200 step detect SPINEL again each time? That would prove the app is still alive after each attempt, i.e. it really never entered the bootloader.

Meanwhile: get Thread working again without reflashing

Right now otbr-agent is talking 460800 to a 115200 radio, so your Thread side is down independently of the flash attempt. You can point it back at the radio's real baud (those old builds already use hardware flow control, so nothing else changes):

ssh root@10.42.0.64
# set (or add) FIRMWARE_BAUD in /userdata/etc/radio.conf
sed -i '/^FIRMWARE_BAUD=/d' /userdata/etc/radio.conf
echo 'FIRMWARE_BAUD=115200' >> /userdata/etc/radio.conf
/etc/init.d/S70otbr restart

Your Thread network will run fine at 115200 — 460800 is a performance improvement, not a requirement.

The definitive fix

If the diagnosis is confirmed, the only way to replace a pre-v1.2 OT-RCP is over SWD (J1 header). The good news: with an SWD probe and Simplicity Commander you can flash the ot-rcp-460800.gbl already shipped in the repo directly — no special image needed:

commander flash 2-Zigbee-Radio-Silabs-EFR32/26-OT-RCP/firmware/ot-rcp-460800.gbl --device EFR32MG1B232F256GM48

After that, all future updates work in-band again (that build enters the bootloader on command). If you have (or can borrow) a probe and want help with the J1 wiring, say so. If not, the 115200 workaround above keeps you fully functional in the meantime.

[jnilo1]

Reproduced on the bench — diagnosis confirmed

I reproduced your exact failure on a bench gateway: I SWD-flashed the February 2026 OT-RCP build (the one shipped with v1.0/v1.1, 115200 baud) onto a Lidl gateway running 3.10.0, then ran the same flash_efr32.sh otrcp — the log matches yours line for line: SPINEL detected at 115200, FailedToEnterBootloaderError after ~5 s, bootloader probe finds nothing, and the baud sweep runs dry. After the whole run the app is still alive at 115200, confirming that build performs a plain application reset instead of entering the bootloader.

Both remedies are now bench-validated end-to-end:

• Workaround (no reflash): with FIRMWARE_BAUD=115200 in /userdata/etc/radio.conf, otbr-agent attaches and the Thread network comes up. You stay fully functional this way — the SWD operation below is only needed to get back to 460800.
• Definitive fix (SWD): commander flash 2-Zigbee-Radio-Silabs-EFR32/26-OT-RCP/firmware/ot-rcp-460800.gbl --device EFR32MG1B232F256GM48 with a J-Link on the J1 header — after which in-band flashing works again (verified with flash_efr32.sh right after).

No J-Link? A Raspberry Pi, a Pico, or an ESP32 works too

The J1 header already exposes everything you need — pin 1: 3.3V, pin 2: GND, pin 5: SWDIO, pin 6: SWCLK (see 0-Hardware/) — so any of these can act as the probe, with OpenOCD instead of Commander:

• Raspberry Pi (any model): OpenOCD drives SWD directly from the GPIO header, no extra hardware. Guide: Programming Microcontrollers using OpenOCD on a Raspberry Pi (Adafruit).
• Raspberry Pi Pico / Pico 2 (~5 €): flash the official debugprobe firmware onto it and it becomes a standard CMSIS-DAP probe.
• ESP8266 / ESP32 / ESP32-C3 / ESP32-S3: wireless-esp8266-dap turns it into a (wireless) CMSIS-DAP probe.

With any of these, OpenOCD's efm32 target handles the EFR32MG1 (Series 1), along the lines of:

openocd -f interface/cmsis-dap.cfg -c "transport select swd" -f target/efm32.cfg -c "program ot-rcp.s37 verify reset exit"

(adjust the interface/ cfg to your probe — e.g. the Adafruit guide's Pi config for GPIO bitbang). I verified this route end-to-end on a bench gateway with OpenOCD 0.12.0: it detects the EFR32MG1B, programs and verifies the .s37 correctly. One practical note: after program ... reset exit, reboot the gateway (ssh root@<gw> reboot) — the reboot pulses the radio's reset line and the freshly flashed firmware comes up cleanly. One caveat: OpenOCD does not read .gbl containers, it wants an .s37/.hex/.bin. The repo ships .gbl only, but the build generates the .s37 right next to it: cd 2-Zigbee-Radio-Silabs-EFR32 && ./build_efr32.sh ot-rcp (build environment incl. Docker image: 1-Build-Environment/), then pick up 26-OT-RCP/firmware/*.s37.

A quicker check than my earlier question

Once the 115200 workaround is applied, run this on the gateway:

ot-ctl rcp version

If it prints SL-OPENTHREAD/2.4.7.0_GitHub-fb0446f53; EFR32; Feb 12 2026 14:41:53, your radio is running the pre-v1.2 build and everything above applies. Later builds print Mar/Apr 2026 dates and are not affected.