Releases · lupyuen/lupyuen.github.io

Is it possible to flash BL706 with OpenOCD and JTAG... Without BLDevCube?

We don't have the source code for BLDevCube so we can't see the commands sent by BLDevCube to OpenOCD.

(BLDevCube runs on compiled Python, according to the strace log)

But let's peek inside BLDevCube by running strace on the Ubuntu version of BLDevCube.

We generate the strace log for BLDevCube Ubuntu by running this command on WSL...

strace -f -s 256 ./BLDevCube >strace4.log 2>&1

(strace4.log is in Assets below)

Here are the parameters for BLDevCube Ubuntu (in View → MCU)

(We use MobaXterm FVWM2 as the X11 Display Server on Windows)

strace4.log shows...

BLDevCube launches openocd.exe...

execve("/bin/sh", ["/bin/sh", "-c", "/home/user/utils/openocd/openocd.exe -f /home/user/utils/openocd/openocd-usb-sipeed.cfg"], 0x16d5400 /* 24 vars */ <unfinished ...>

Which is equivalent to this command...

utils/openocd/openocd.exe -f /home/user/utils/openocd/openocd-usb-sipeed.cfg

(openocd-usb-sipeed.cfg is located here)

Note that the flashing commands are not passed through the command line.

Where are the flashing commands? Read on to find out...

After launching openocd.exe, BLDevCube connects to OpenOCD at port 4444...
```
connect(7, {sa_family=AF_INET, sin_port=htons(4444), sin_addr=inet_addr("127.0.0.1")}, 16 <unfinished ...>
```
That's how BLDevCube sends the flashing commands to OpenOCD: Via OpenOCD port 4444!

To reveal the secret commands passed by BLDevCube to OpenOCD...

We create a stub script utils/openocd/openocd.exe

#!/bin/bash
echo $@ >> /tmp/openocd.log
echo $@
sleep 60

Remember to set execute permission...

chmod +x utils/openocd/openocd.exe

We start a local TCP Server at port 4444 to capture and display the OpenOCD commands received...

$ nc -k -l 4444
adapter_khz 1000
WaitCmd
halt
load_image openocd_load_data.bin 0x22010000
halt
reg pc 0x22010000
resume
WaitCmd
mwb 0x4202c000 0x0
mwb 0x4202bff0 0x48
mwb 0x4202bff1 0x52
mwb 0x4202bff2 0x44
mwb 0x4202bff3 0x59
mdb 0x4202bff0 0x4
WaitCmd
mdw 0x4202bff4 0x3
WaitCmd
shutdown

Aha! These are the flashing commands sent by BLDevCube to OpenOCD!

These OpenOCD commands will...

Transfer the Flash Loader openocd_load_data.bin to BL706 at address 0x22010000

(openocd_load_data.bin is in Assets below)
Execute the transferred Flash Loader at 0x22010000

(By setting the Program Counter)
Write to some BL706 Hardware Registers:

0x4202 c000, 0x4202 bff0, 0x4202 bff1, 0x4202 bff2, 0x4202 bff3
Read from these BL706 Hardware Registers:

0x4202 bff0, 0x4202 bff4
Shut down BL706

If we put these commands into an OpenOCD TCL Script, we might be able to flash BL706 from the command line.

But the OpenOCD commands might be incomplete! Here's the Flashing Log from BLDevCube...

[09:25:01.532] - {'xtal_type': 'XTAL_32M', 'pll_clk': '144M', 'encrypt_type': 'None', 'key_sel': '0', 'cache_way_disable': 'None', 'sign_type': 'None', 'crc_ignore': 'False', 'hash_ignore': 'False', 'encrypt_key': '', 'aes_iv': '', 'public_key_cfg': '', 'private_key_cfg': '', 'device_tree': '', 'page_type': 'mcu', 'flash_clk_type': '72M', 'boot_src': 'Flash', 'img_type': 'SingleCPU', 'img_addr': '0x2000', 'bootinfo_addr': '0x0', 'img_file': '/home/user/lvgl_main.bin', 'dl_device': 'Openocd', 'dl_comport': '', 'dl_comspeed': '2000000', 'dl_jlinkspeed': '1000', 'dl_chiperase': 'False', 'dl_xtal': '32M'}
[09:25:01.583] - Update flash cfg finished
[09:25:01.586] - EFUSE_CFG
[09:25:01.586] - BOOTHEADER_CFG
[09:25:01.594] - Create bootheader using /home/user/chips/bl702/img_create_mcu/bootheader_cfg.ini
[09:25:01.595] - Updating data according to </home/user/chips/bl702/img_create_mcu/bootheader_cfg.ini[BOOTHEADER_CFG]>
[09:25:01.597] - Created file len:176
[09:25:01.602] - Image create path: /home/user/chips/bl702/img_create_mcu
[09:25:01.602] - Config file: /home/user/chips/bl702/img_create_mcu/img_create_cfg.ini
[09:25:01.608] - Image hash is b'f36c51bed1a26566692bd0f57d2aec35bc1bd5d65e92ca6f5005219f07262ad2'
[09:25:01.608] - Header crc: b'c290eccb'
[09:25:01.609] - Write flash img
[09:25:01.612] - image create success
[09:25:01.621] - ========= eflash loader config =========
[09:25:01.662] - Version: bflb_eflash_loader_v2.1.1
[09:25:01.663] - Program Start
[09:25:01.663] - ========= eflash loader cmd arguments =========
[09:25:01.663] - Config file: /home/user/chips/bl702/eflash_loader/eflash_loader_cfg.ini
[09:25:01.665] - serial port is rv_dbg_plus
[09:25:01.666] - chiptype: bl702
[09:25:01.667] - ========= Interface is Openocd =========
[09:25:01.668] - Eflash load helper file: /home/user/chips/bl702/eflash_loader/eflash_loader_32m.bin
[09:25:01.669] - Eflash load helper file: /home/user/chips/bl702/eflash_loader/eflash_loader_32m.bin
[09:25:01.669] - ========= load eflash_loader.bin =========
[09:25:01.669] - Load eflash_loader.bin via openocd
[09:25:11.791] - ========= flash read jedec ID =========
[09:25:11.792] - Flash load shake hand
[09:25:41.824] - b'77616974696e6720726573706f6e73652074696d65206f7574'
[09:25:41.826] - {"ErrorCode": "0001","ErrorMsg":"BFLB EFLASH LOADER SHAKEHAND FAIL"}
[09:25:41.826] - {"ErrorCode": "0030","ErrorMsg":"BFLB READ FLASH JEDEC ID FAIL"}
[09:25:41.827] - Burn Retry
[09:25:41.827] - 0
[09:25:41.828] - Burn return with retry fail
[09:26:01.721] - b'-f /home/user/utils/openocd/openocd-usb-sipeed.cfg\n'

The OpenOCD handshake failed, so it's possible that we missed some OpenOCD commands after the handshake.

Note that the Flash Image (img.bin) containing the firmware binary isn't transmitted to BL706.

(Probably because the Read Hardware Register commands mdb and mdw didn't return the expected result)

UPDATE: Bouffalo Lab has provided the complete log of OpenOCD commands here

What files are used by BLDevCube?

Based on strace4.log, the following files were used during flashing...

lvgl_main.bin, the binary generated from the BL706 firmware build

These files bundled with BLDevCube Ubuntu...

chips/bl702/eflash_loader/eflash_loader_32m.bin
chips/bl702/efuse_bootheader/efuse_bootheader_cfg.conf
chips/bl702/img_create_mcu/img_create_cfg.conf
utils/flash-conf/bl702/GD25Q16E_c84015.conf

These intermediate files generated by BLDevCube from the above files...

chips/bl702/eflash_loader/eflash_loader_cfg.ini
chips/bl702/efuse_bootheader/flash_para.bin
chips/bl702/img_create_mcu/bootheader.bin
chips/bl702/img_create_mcu/bootheader_cfg.ini
chips/bl702/img_create_mcu/bootinfo.bin
chips/bl702/img_create_mcu/efusedata.bin
chips/bl702/img_create_mcu/efusedata_mask.bin
chips/bl702/img_create_mcu/img.bin
chips/bl702/img_create_mcu/img_create_cfg.ini
chips/bl702/img_create_mcu/whole_img.bin
chips/bl702/img_create_mcu/whole_img.pack

(See generated-files.zip in Assets below)

And one temporary intermediate file that has been deleted by BLDevCube...
```
chips/bl702/img_create_mcu/segheader_tmp.bin
```

When we compare the file sizes...

The Flash Loader openocd_load_data.bin is probably generated based on...
```
chips/bl702/eflash_loader/eflash_loader_32m.bin
```

The Flash Image that contains our firmware is probably one of these files...

chips/bl702/img_create_mcu/img.bin
chips/bl702/img_create_mcu/whole_img.bin
chips/bl702/img_create_mcu/whole_img.pack

We might be able to deduce the generation of the Flash Loader and Flash Image by reading these docs and source files...

See the discussion: https://twitter.com/strongwong_/status/1415228913580613636?s=19

Read the article: https://lupyuen.github.io/articles/bl706

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Releases: lupyuen/lupyuen.github.io

Apache NuttX RTOS for RISC-V QEMU (64-bit)

Archive Screenshots

Archive Images

Ox64 Files

Flashing BL706 with OpenOCD without BLDevCube

LoRa Handler Graphics

Archived Images

I2C Cartoons

To be deleted

RIOT-OS Video