Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Tips on SWD flashing bootloader firmware on Ebyte E180-ZG120B-TB dev board (~$9) or E180-ZG120B module (~$7)? #2

Open
Hedda opened this issue Sep 22, 2020 · 31 comments
Open

Tips on SWD flashing bootloader firmware on Ebyte E180-ZG120B-TB dev board (~$9) or E180-ZG120B module (~$7)? #2

Hedda opened this issue Sep 22, 2020 · 31 comments

Comments

@Hedda
Copy link

Hedda commented Sep 22, 2020 •
edited
Loading

Any tips on SWD flashing a standard Silabs bootloader FW on Ebyte E180-ZG120B-TB evaluation board and E180-ZG120B module?

Ebyte E180-ZG120B-TB evaluation board has a powerful Silicon Labs EFR32 MG1 with a 20 dBM powerful Zigbee 3.0 radio

Ebyte E180-ZG120B is a SMD (Surface Mount Device) module with the same SoC/MCU chip as on E180-ZG120B-TB evo board:

Please post any tip here and we can try to put together a step-by-step how-to guide for an easy and inexpensive way to flash it.

For reference, EByte does not appear to ship Ebyte E180-ZG120B-TB or Ebyte E180-ZG120B with any bootloader from their factory.

The newest standard bootloader for EFR32 from Silicon Labs is called "Gecko Bootloader" and older bootloader types is sometimes referred to by Silabs as "legacy bootloader" (UART DFU) and "legacy OTA bootloader" (OTA DFU). The legacy bootloader is a one stage simple bootloader that has very limited capabilities compared to Gecko Bootloader, but all have XMODEM in them for flashing the application firmware. UART DFU is able to upgrade the firmware via UART, OTA DFU is able to upgrade the firmware via Bluetooth connection. Legacy bootloaders are not supported by Silabs in newer SDK, so today the manufacturer should really add Gecko Bootloader to their project to overwrite the legacy bootloader when providing updates.

What is needed?

Hardware needed?

  • What hardware tools are needed? Suggested inexpensive debug / jtag / J-Link / probe adapters that should be compatible?

Software needed?

EByte-E180-Z120B comes with a proprietary firmware. To update it with an EZSP based firmware you have to use a SWD Flasher at least once to upload the bootloader.
When uploading the bootloader for the very 1st time, use the combined.s37 image.
How to program the bootloader is out of the scope, however how-to updates are welcome. See https://github.com/myelin/arduino-cmsis-dap and Open On-Chip Debugger

SoC specification

The module core is a EFR32MG1 SoCs (Mighty Gecko Series 1) specifically IC = EFR32MG1B232F256GM48 (EFR32MG1B 256K)

Ebyte E180-ZG120B-TB evaluation board feature a CP2102G / CP2102 (CP210x) USB to UART/serial converter chip.

Reference copied from my original post in zigpy/bellows#243

Maybe someone can test EFR32MG12 based E180-ZG120B module from Ebyte works with bellows?

Ebyte makes an inexpensive development board called "E180-ZG120B-TB" for testing E180-ZG120B

This Zigbee 3.0 capable module has some very powerful MCU and radio specifications for its price:

This development is sold by cdebyte for less than $9 US-dollar on Aliexpress or about twice on eBay:

You can also buy them on bulk from Alibaba for less:

Looks like you can remove some jumpers to disable the USB converter if want to use serial directly.

E180-ZG120B by Chengdu Ebyte (CDEYTE) has 20 dBM powerful Zigbee 3.0 radio for 2.4GHz capable based on an EFR32MG1 Series 1 MCU SoC / chip, specifically EFR32MG1B (IC = EFR32MG1B232F256GM48), from Silicon Labs EFR32 ("Mighty Gecko") family.

EFR32MG1B232F256GM48 includes a 40 MHz ARM Cortex-M4 microcontroller with 256 Flash, 32 RAM and a rich peripheral set in a QFN48 package. With 19.5 dBm maximum output power and receive sensitivity of -101 dBm (250 kbps O-QPSK DSSS). Key Specs: 19.5 Output Power Max (dBm) / 120.5 Total Link Budget (dB).

I understand this also is classified as an Ember based radios using the EZSP (EmberZNet Serial Protocol) serial protocol (UART bus) interface so could therefore be made compatible with the bellows library for zigpy if the E180-ZG120B module is flashed with the right firmware?

I guess that my follow-up question will be which exact firmware to use on the E180-ZG120B module?

Ebyte is now making two EFR32MG1B based modules called E180-ZG120A and E180-ZG120B

E180-ZG120B (and old E180-ZG120A) module is sold by cdebyte on eBay and Aliexpress at low prices.

Example:
@Hedda
Copy link
Author

Hedda commented Sep 22, 2020 •
edited
Loading

@Adminiuga @cdjackson @Gamester17 @giannello @grobasoz @jnicolson @kirovilya @larena1 @sprut666666 @MattWestb @MPM1107 @mtx512 @osos @s-hadinger @SillyDay @stevew817 @tofurky @tube0013 @walthowd

Any tips from participants in Silicon Labs EZSP serial protocol discussions Koenkk/zigbee-herdsman#168 and zigpy/bellows#243 on how-to SWD flash bootloader safely and easily on Silabs EFR32 modules like the $9 Ebyte E180-ZG120B-TB board or the $7 E180-ZG120B module on a small budget and no previous real experience with SWD/JTAG flashing? The project already has the firmware.

https://github.com/zha-ng/EZSP-Firmware/tree/master/EByte-E180-Z120B

The idea is to flash the $9 E180-ZG120B-TB board or $7 E180-ZG120B module with standard Silicon Labs bootloader and then also standard EmberZNet PRO stack NCP application firmware to make very inexpensive Silicon Labs EFR32 MG1 USB dongles and serial/UART modules. These can then, in turn, be used as powerful Zigbee 3.0 radio with Home Assistant ZHA, OpenHAB, Tasmota ZBBridge (Zigbee2Tasmota/Z2T) today and in future maybe also in other popular open-source home automation software applications like Zigbee2MQTT, ioBroker, and/or Domoticz.

@MattWestb has some info about flashing bootloader on the similar IKEA TRÅDFRI ICC-A-1 Module with ESP8266 or SMT32

https://github.com/MattWestb/IKEA-TRADFRI-ICC-A-1-Module

https://github.com/MattWestb/IKEA-TRADFRI-ICC-A-1-Module/tree/master/Flashing-MG

@walthowd has info on flashing older EM35x / which already have a standard Silabs bootloader firmware

https://github.com/walthowd/husbzb-firmware

@NilsBohr from Elelabs have created an EZSP Firmware Update Utility for application firmware which require standard bootloader.

https://github.com/Elelabs/elelabs-zigbee-ezsp-utility

From my own point-of-view, I would love a suggestion on a cheap SWD/JTAG debug probe clones that is compatible with Silabs Simplicity Commander or Simplicity Studio and for the flashing experience to be no more complicated than flashing CC253x with a clone of CC-debugger with the official Flash Programmer software from Texas Instruments, as CC2531 and CC2530 is really what these can compete with as they E180-ZG120B-TB and E180-ZG120B price is about the same but are newer and better performing (plus these are both equipped with IPEX antenna interface for optional use with external antenna).

My thinking is that if there is cheap and more powerful hardware then more developers might contribute to EZSP in these projects.

@MattWestb
Copy link

MattWestb commented Sep 22, 2020 •
edited
Loading

The best / safest is flashing with one original J-Link adapter from Simplicity Studio / commander but expensive (the J-Link probe but the Simplicity studio is free).
I have building JLINK-ARM-OB of STM32 (3€) but its not recommended for beginners then the probe its easy being killed of SEGGER firmware updates and its also possible killing the EFR32 (I have 2 killed ones) then doing chip erase and writing bootloader (Simplicity Studio / commander can writing the bootloader with wrong offset and corrupting HW / protection bits).
For my its the best blackmagic-espidf that runs one ESP module and using GDB from windows or linux. The problem with the blackmagic probe is its not supporting the EFR32 serie 2 but working good on serie 1 devices.

Do the E180 not having one standalone (Xmodem) bootloader from the factory or is it with one application (OTA) bootloader or without one (booting the NCP app directly) ???
If its have one standalone bootloader its no need of SWD flashing only doing one serial upgrad of the APP thru x-modem.

@Adminiuga
Copy link
Member

E180 does not come with xmodem, needs to be flashed with swd at least once.

@Hedda
Copy link
Author

Hedda commented Sep 22, 2020 •
edited
Loading

Do the E180 not having one standalone (Xmodem) bootloader from the factory

Their Ebyte E180-ZG120B series does not ship with the standard Gecko Bootloader with XMODEM from the factory, see comment in:

https://github.com/zha-ng/EZSP-Firmware/blob/master/EByte-E180-Z120B/README.md

The manuals does mention that users can software program it according to EFR32 chip manual and that J-Link Downloader can be used as burning program for programming download and that SOC features GPIO port with J-Link interface.

Pin J-LINK interface
VCC VCC
PF0 SWCLK
PF1 SWDIO
GND GND
  • PA0 is TXD on the module.
  • PA1 is RXD on the module.
  • 3.3V power supply is recommended for the module power port.
  • Default firmware baud rate is set to 115200

Ebyte does not appear to specific mentioning Bootloader, Bootloading Bootload, or boot load.

Ebyte E180-ZG120B series ships with a (closed) proprietary application firmware (their manual says that it is a "demo program for users reference"), but as I do not speak Chinese I do not have much more info than that, (they provide a configuration tool with Chinese GUI which can be used to configure its proprietary application firmware without flashing new FW). Their proprietary "demo program" firmware is probably only useful to those Chinese manufacturers whos goal it is to quick and easy make new Zigbee devices based on these E180-ZG120B modules following the TTM (Time To Market) principle, without building with Silabs tools.

@MattWestb
Copy link

Sorry @Adminiuga for uncovering you "firmware cave" and thanks for the short answer.
@Hedda The SWD is pretty hardware locked (possible remapping the pins but normally not made then its only being more problems). The RX and TX is very flexible and can being remapped pretty free and the same the force bootloader boot. For the E180 module its only flashing one bootloader set with SWD and then loading the NCP app with serial. I think one working one is in this git (i have not testing it but i think it was not there if it was not working). What i have reading is only the flash size important for the bootloader and is normally working the same for all chips in the same generation with the same flash layout.
By the way always dump the mem region 0 (internal flash) and 1 (user data) before you flashing the factory new module so you can going back if needed.

@Hedda
Copy link
Author

Hedda commented Sep 22, 2020

Do you guys think the Segger J-Link EDU Mini debug probe will work with EFR32 in Simplicity Commander and Simplicity Studio?

https://www.segger.com/products/debug-probes/j-link/models/j-link-edu-mini/

I would not exactly call it inexpensive when the point is to do it cheaply but looks to be the least expensive original from Segger.

Seems they can be found for around $19/€19 but if add VAT (Value Added Tax / Sales Tax) and Shipping = ~$35/€35 in total.

https://www.adafruit.com/product/3571

The pros and cons with it are:

  • "J-Link EDU Mini may only be used for non-commercial purposes"
  • "J-Link EDU Mini does not include support"
  • "Supports Cortex-M microcontrollers"
  • "You can always download the latest software free of charge"
  • "Made in Germany"

If have to spend that much money on then should maybe shell out more to buy the more future-proof J-Link EDU for ~$70/€70

https://www.segger.com/products/debug-probes/j-link/models/j-link-edu/

https://www.segger.com/products/debug-probes/j-link/models/model-overview/

@tube0013
Copy link

The j-link-edu-mini works with Simplicity Studio. I have one and can confirm.

@Adminiuga
Copy link
Member

Those DIY inclined could try https://github.com/myelin/arduino-cmsis-dap and OpenOCD for swd programming.

@tube0013
Copy link

I have too many coordinators 🤣 so thought I'd try making a router fw for the ebyte. I started with the the ZigbeeMinimalSOC example, changed the ZCL device type to HA Range Extender, under plugins I enabled the Button Form/Join Code, I disable PTI and set up Button 0 > PB11 and Button 1 > PD14. I'm able to build and flash the gbl via XMODEM with an XMODEM Bootloader flashed to the ebyte.

After doing so I trigger the button (PB11) and try to join but don't get anything.

Any tips/pointers? I'm fiddling my way through this 🤦‍♂️

@Adminiuga
Copy link
Member

enable CLI on the serial port?
make sure in the HW config, you enable the DCDC internal regulator

@Yoda-x
Copy link

Yoda-x commented Jan 8, 2021

@tube0013 : can you provide information how you flashed the bootloader? I tried with a BMP(st-link),, segger edu mini and segger v8, but was not able to connect to the target with swd. I tried with segger tools, openocd and simplicity studio.

Any tip is appreciated.

@MattWestb
Copy link

BMP is working for my but i using one ESP8266 as probe and need extra resistors on data and clock line for getting it the EFR32 first gen being detected BlackMagic-espidf.
With J-Link is also possible but more dangerous if not knowing what you is doing.
I recommending GDB as flash program in both windows and linux then have more feeling wath is happening and what you is doing.
The EFR32 first gen its pretty easy flashing and reading and pretty safe but is possible bricking if writing in the wrong memory airia.
First dump memory 0 = internal flash with bootloader and application / the program that is running in the chip. And also dump memory 1 = unser data (its have manufacture custom settings and token and is needed then restoring the chip to factory).

@tube0013
Copy link

tube0013 commented Jan 8, 2021

@tube0013 : can you provide information how you flashed the bootloader? I tried with a BMP(st-link),, segger edu mini and segger v8, but was not able to connect to the target with swd. I tried with segger tools, openocd and simplicity studio.

Any tip is appreciated.

I used a Segger J-Link Edu Mini which worked natively with Simplicity Commander.

@Adminiuga
Copy link
Member

Probably would be easier to use Simplcity Commander to flash the boot loader once

@MattWestb
Copy link

BRUTE FORCE FLASHING !!!
Dump the flash before flashing it if its possible also more memory regions is they is percents.

@Atominnn
Copy link

hello, for the EByte-E180 you could put pin relationship with j-link, I need a little help to connect it to the swd interface

@Adminiuga
Copy link
Member

swclk, swdio, nreset, gnd and 3.3v are printed on the back of pcb. use those.

@Atominnn
Copy link

Atominnn commented Apr 27, 2021 •
edited
Loading

oh yes, thanks it was wrong printed, now I can read the chip information with Simplicity Commander but it gives error when writing firmware bootloader "02:56:17.036 WARNING: Could not retrieve debug mode, can not identify target device.
02:56:17.037 Connected to 69666987" in log and caption show "unspecified error during flashing" any idea, thanks

solved: a ground problem, firmware loaded, now to test it
To know if the firmware is properly loaded, should you see something through the serial port?

@MattWestb
Copy link

Some strange charters (2 to 3) is being sent then the firmware is booting so also after resetting with the reset pin.
If not trying booting to the bootloader and you is getting the boot menu.

@Adminiuga
Copy link
Member

You won't see anything through the serial port, sometimes maybe some characters on reset. It's using binary protocol for the coms.
But it should respond to bellows -d /dev/ttyUSBx info if you used firmware with 115200 baud rate, then specify the baudrate with -b cli switch

@Atominnn
Copy link

Some strange charters (2 to 3) is being sent then the firmware is booting so also after resetting with the reset pin.
If not trying booting to the bootloader and you is getting the boot menu.

image

I'm seeing them, but I can't get into the bootloader menu, I put pa2 in low and reset but only the weird characters keep appearing
tnx for all

@Adminiuga
Copy link
Member

Hold the baud reset button down and reset

@Adminiuga
Copy link
Member

Also, if you got the firmware running, just use the elelabs flasher to flash new firmware

@Atominnn
Copy link

One more question, (thanks for your patience) I delete the memory and load bootloader and enter the menu, then I upload firmware with xmodem protocol and the strange symbols appear but I can no longer enter the menu in any way, is it normal?

@Adminiuga
Copy link
Member

which bootloader was flashed and which firmware did you upload?
On my ebyte I can enter the bootloader by keeping baud-rate-reset button depressed and momentarily pressing the reset button.
Terminal should be in 115200, 8n1, no flow control

@Atominnn
Copy link

which bootloader was flashed and which firmware did you upload?
On my ebyte I can enter the bootloader by keeping baud-rate-reset button depressed and momentarily pressing the reset button.
Terminal should be in 115200, 8n1, no flow control
This
https://github.com/zha-ng/EZSP-Firmware/tree/master/EByte-E180-Z120B

Fitst efr32mg1b-bootloader-1.10.3-combined.s37 show instant menu , then .gbl latest

@Hedda
Copy link
Author

Hedda commented May 7, 2021 •
edited
Loading

Do you guys think that these instructions would also work with the new EFR32MG21 based E104-BT11G modules from Ebyte too?

See discussion and links in -> zigpy/zigpy#727

Note that flash memory size for E104-BT11G-IPX and E104-BT11G-PCB but most of the information publicly available on them so far are in Chinese so specs are still an unknown factor but as it is based on an EFR32MG21 MCU it must be either 512, 768 or 1024 kB.

https://www.cnx-software.com/2021/05/04/ebyte-e104-bt11-bluetooth-mesh-module-features-silicon-labs-efr32mg21-mcu/

@MattWestb
Copy link

If its have on "normal" standalone bootloader that is possible to triggering with pin or software and its not protected it can being possible flashing with it but that we dont knowing for the moment.
If not its need flashing on new bootloader and then its one original J-Link is good or on Silabs WSTK (its the best) that also can recover broken EFR32 devices (J-Link cant).
Very likely some J-Link clones is working until you updating the firmware but then they is broken so i cant recommend them.

@MattWestb
Copy link

@tube0013 Did you getting the signal repeater working ??

I was doing one fast for Billy and its looks working but i have no switch so its being triggered then getting interference around the cable i is using for force bootloader mode.
Attaching hardware conf and project file from SS5 for my hack if it can helping you.
ZigbeeBillyRouter.zip

@Thomaskru
Copy link

Hi!
Take a look @ https://modkam.ru/?p=1889 (Use google translator if you need)
I have successfully flashed the E180-ZG120B-TB Module with an Jlink v9 clone with these instructions.

@MattWestb
Copy link

I have using STM32 for building J-Link OB clones and its working OK but be careful if Segger like update the adapter firmware is very likely being one brick and you must re flashing it from scratch.

Thanks for the info / feed back !!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
7 participants
@Thomaskru @Adminiuga @Hedda @tube0013 @Yoda-x @MattWestb @Atominnn