logo elektroda
logo elektroda
X
logo elektroda
Advanced Search
logo elektroda

[Solved] Backup Flash on Zigbee XT-ZB2 BL702 Series Module Without Exposed GPIO8

XJ_ 3363 15
ADVERTISEMENT
| New topic
  • #1 21103904
    XJ_
    Level 11  
    I bought the XT-ZB2 BL702 Series module. It is based on the BL702 SoC and works with Zigbee2mqtt without modifications as I bought it. I use SLZB-06 + HA.

    I want to backup the flash module for testing purposes - "Way back" to the original state.
    I tried BLDevCube.exe but no luck. No GPIO8 is exposed.

    Does anyone have any experience with this module please?

    XT-ZB2 module pin layout with PCB antenna XT-ZB2 module with Zigbee and model markings on the metal cover XT-ZB2 Zigbee and BLE module with visible chip and connectors. Diagram of the XT-ZB2 module with pins and dimensions

    BootLog:

    Code: text Expand Select all Copy to clipboard
    Starting bl702 now....
Booting BL702 Chip...


------------------------------------------------------------
RISC-V Core Feature:RV32-ACFIMX
Build Version: release_bl_iot_sdk_1.6.30-dirty
Std BSP Driver Version: cfe99fb-dirty
Std BSP Common Version: 8cf52ec-dirty
RF Version: 1504071-dirty
Build Date: Nov 22 2021
Build Time: 19:00:17
------------------------------------------------------------
Heap 45320@0x4201cef8, 23552@0x42028400

blog init set power on level 2, 2, 2.
[IRQ] Clearing and Disable all the pending IRQ...
[ 0][INFO : hal_boot2.c: 283] [HAL] [BOOT2] Active Partition[0] consumed 200 Bytes
======= PtTable_Config @0x420164f4=======
magicCode 0x54504642; version 0x0000; entryCnt 5; age 0; crc32 0x5F173B2D
idx type device activeIndex name Address[0] Address[1] Length[0] Length[1] age
[00] 00 0 0 FW 0x00003000 0x00093000 0x00090000 0x00066000 0
[01] 01 0 0 mfg 0x00093000 0x00000000 0x00066000 0x00000000 0
[02] 02 0 0 PSM 0x000f9000 0x00000000 0x00002000 0x00000000 0
[03] 03 0 0 media 0x000fb000 0x00000000 0x00004000 0x00000000 0
[04] 04 0 0 factory 0x000ff000 0x00000000 0x00001000 0x00000000 0
[ 0][INFO : bl_flash.c: 138] ======= FlashCfg magiccode @0x42016748, code 0x47464346 =======
[ 0][INFO : bl_flash.c: 142] mid 0xC2
[ 0][INFO : bl_flash.c: 143] clkDelay 0x1
[ 0][INFO : bl_flash.c: 144] clkInvert 0x1
[ 0][INFO : bl_flash.c: 145] sector size 4KBytes
[ 0][INFO : bl_flash.c: 146] page size 256Bytes
[ 0][INFO : bl_flash.c: 147] ---------------------------------------------------------------
[ 0][INFO : hal_board.c: 408] [MAIN] [BOARD] [FLASH] media addr from partition is 000fb000, ret is 0
[ 0][INFO : hal_board.c: 418] [MAIN] [BOARD] [FLASH] addr from partition is 000ff000, ret is 0
[ 0][INFO : hal_board.c: 426] [MAIN] [BOARD] [XIP] addr from partition is 230fb000, ret is 0
MAC address mode length 3
MAC address mode is MBF
[ 0][INFO : hal_board.c: 169] Set MAC addrress 00:00:33:91:61:4C:B9:7C
[ 0][INFO : hal_board.c: 306] xtal_mode length 2
[ 0][INFO : hal_board.c: 310] xtal_mode is MF
[ 0][INFO : hal_board.c: 227] xtal dtb in DEC :36 36 0 60 60
[ 0][INFO : hal_board.c: 378] set pwr = 14 in dts
[ 0][INFO : hal_board.c: 335] en_tcal = 0, en_tsen_trim = 1, tcal disabled
[OS] Starting aos_loop_proc task...
[OS] Starting OS Scheduler...
[ 1][INFO : vfs_uart.c: 517] uart[0] buf_size NULL, will use default.
[ 2][INFO : vfs_uart.c: 534] uart[0] rx_buf_size 512, tx_buf_size 512
[ 3][INFO : vfs_uart.c: 549] uart[0] cts status = disable lentmp = 7
[ 3][INFO : vfs_uart.c: 549] uart[0] rts status = disable lentmp = 7
[ <0>šêmm[32mINFO : vfs_uart.c: 566] id = 0, tx = 14, rx = 15, cts = 255, rts = 255 baudrate = 2000000.
[ 4][INFO : vfs_uart.c: 481] uart[1] status = disable

____ _ _ __
/ ___|___ _____ _| | (_)/ _| ___
| | / _ \_ / | | | | | | |_ / _ \
| |__| (_) / /| |_| | |___| | _| __/
\____\___/___|\__, |_____|_|_| \___|
|___/
cozylife_app_info
CozyLife SDK Version: 0.2.0
CozyLife SDK Build Nov 8 2021 10:08:40
cozylife_app_info
Product Id: c22w32
Firmware Version: 1.0.0
Firmware Build Nov 22 2021 19:00:12
0 [D] [ lib_main] dohome_kvs_init
[MTD] >>>>>> Hanlde info Dump >>>>>>
name PSM
id 0
offset 0x000f9000(1019904)
size 0x00002000(8Kbytes)
xip_addr 0x230f5000
[MTD] <<<<<< Hanlde info End <<<<<<
[EF] Found Valid PSM partition, XIP Addr 230f5000, flash addr 000f9000
*default_env_size = 0x00000001
ENV start address is 0x00000000, size is 8192 bytes.
EasyFlash V4.0.99 is initialize success.
You can get the latest version on https://github.com/armink/EasyFlash .
0 [D] [ lib_main] dohome_time_init
1609473600 [D] [ lib_main] dohome_dev_main
1609473600 [I] [ lib_ble_dev] MAC: b4e842000974
1609473600 [I] [dohome_hal_ble] dohome_hal_bt_port_init
[BL] [SEC] TRNG Handler
1609473600 [I] [ lib_ble] ble mac: 7c:b9:4c:61:91:33
1609473600 [I] [ lib_ble] bt_event_bleenabled
1609473600 [I] [ lib_ble] bt_event_adv_ready
1609473600 [D] [dohome_hal_ble] dohome_hal_bt_start_adv end
[ 166][INFO : hal_hwtimer.c: 148] get mux success
1609473600 [W] [ lib_ble] key not found
1609473600 [I] [ dohome_main] dev is not config --> start dev ble adv
1609473600 [I] [ lib_ble_dev] save dev_bind: bind_fail
[ 235][WARN : bl_mtd.c: 201] addr@0x2308410c is xip flash, size 7
1609473600 [I] [doit_product] IS ZB BIND?
1609473600 [D] [ hal_zigbee] ZIGBEE BINDE STATUS:1
1609473600 [I] [ hal_zigbee] BL Zbstack Init Success
[BL] [SEC] TRNG Handler
1609473601 [W] [ hal_zigbee] zigbee status start connect
1609473601 [D] [ hal_zigbee] ZIGBEE BINDE STATUS:1
1609473601 [D] [ hal_zigbee] [zigbee_raw][start] success as as ZR short_addr: 0x2766 channle: 0xb
1609473601 [W] [ hal_zigbee] zigbee status connecting
1609473601 [D] [ hal_zigbee] zigbee connected!
1609473601 [D] [ hal_zigbee] [zigbee_update][onoff] on
1609473601 [W] [ hal_zigbee] zigbee status connected



    Added after 29 [minutes]:

    New discovered - it is necessary to connect D28 to high - see the translated info from BlDevCube for BL702
    Code: text Expand Select all Copy to clipboard
    
[09:45:40.602] - When the pin is pulled high, use Reset/Chip_En to reset the chip
[09:45:40.602] - Is the COM port selected by the burning software the serial port connected to the chip?
[09:45:40.602] - Is the baud rate selected on the burning software the baud rate supported by the USB to serial port?
[09:45:40.603] - Is the 3.3V power supply normal?
[09:45:40.603] - Is the board power supply current normal (in burning mode, the chip consumes 5-7mA)
[09:45:40.604] - ## ...

    XT-ZB2 module schematic with download mode highlighted.

    (I didn't have to use Chip_En, it worked without it)

    Anyway, the chip seems to be locked or something like that FL0104(BFLB_CMD_SEQ_ERROR), FL0402(BFLB_EFUSE_WRITE_ADDR_ERROR) and FL0104(BFLB_CMD_SEQ_ERROR)

    Here the log of reading ID:
    Code: text Expand Select all Copy to clipboard
    
[09:55:02.792] - Version: eflash_loader_v2.5.0
[09:55:02.792] - Program Start
[09:55:02.792] - ========= eflash loader cmd arguments =========
[09:55:02.793] - Config file: D:\Bastlirna\_smarthack\_bl602tools\bldevcube\chips\bl702l\eflash_loader\eflash_loader_cfg.ini
[09:55:02.794] - serial port is COM3
[09:55:02.795] - cpu_reset=False
[09:55:02.795] - chiptype: bl702l
[09:55:02.795] - ========= Interface is uart =========
[09:55:02.795] - com speed: 2000000
[09:55:02.796] - Bootrom load
[09:55:02.796] - ========= get_boot_info =========
[09:55:02.797] - ========= image get bootinfo =========
[09:55:03.041] - Not ack OK
[09:55:03.041] - FL
[09:55:03.041] - result: FL
[09:55:03.328] - tx rx and power off, press the machine!
[09:55:03.328] - cutoff time is 0.05
[09:55:03.390] - power on tx and rx
[09:55:04.390] - reset cnt: 0, reset hold: 0.05, shake hand delay: 0.1
[09:55:04.390] - clean buf
[09:55:04.395] - send sync
[09:55:04.625] - ack is 4f4b
[09:55:04.671] - shake hand success
[09:55:05.188] - data read is b'0100020700000000931d04002900000800003391614cb97c'
[09:55:05.189] - ========= chipid: 00003391614cb97c =========
[09:55:05.189] - Get bootinfo time cost(ms): 2392.18505859375
[09:55:05.189] - clock para file: D:\Bastlirna\_smarthack\_bl602tools\bldevcube\chips/bl702l/efuse_bootheader/clock_para.bin
[09:55:05.189] - change bdrate: 2000000
[09:55:05.189] - Clock PLL set
[09:55:05.190] - clock para:
[09:55:05.190] - 50434647010400010000000054d2a760
[09:55:05.191] - FL0104(BFLB_CMD_SEQ_ERROR)
[09:55:05.192] - Retry
[09:55:05.193] - FL0402(BFLB_EFUSE_WRITE_ADDR_ERROR)
[09:55:05.194] - Retry
[09:55:05.194] - FL0104(BFLB_CMD_SEQ_ERROR)
[09:55:05.195] - Retry
[09:55:05.196] - FL0402(BFLB_EFUSE_WRITE_ADDR_ERROR)
[09:55:05.196] - ErrorCode: 000C, ErrorMsg: BFLB SET CLOCK PLL FAIL
[09:55:05.196] - pll set fail!!
[09:55:05.196] - Burn Retry
[09:55:05.196] - 0
[09:55:05.197] - Burn return with retry fail
[09:55:05.218] - ========= flash read jedec ID =========
[09:55:05.218] - Not ack OK
[09:55:05.218] - FL
[09:55:05.218] - Read flash jedec ID
[09:55:05.218] - ErrorCode: 0030, ErrorMsg: BFLB READ FLASH JEDEC ID FAIL
  • ADVERTISEMENT
  • #2 21103954
    p.kaczmarek2
    Moderator Smart Home  
    According to the documentation I've found, it seems that D28 is used for UART bootloader mode.
    XT-ZB2 module diagram with pin definitions.
    Table showing working modes of GPIO28.
    Pin function table for an electronic circuit, detailing pin number, name, type, and function.
    Please make first a full flash backup. @divadiow may know more about BL602/702? flashing.
    Helpful post? Buy me a coffee.
  • #3 21103973
    XJ_
    Level 11  
    >>21103954
    Yes, this doc I've found too, and with D28 it does something more, as I wrote before.

    XT-ZB2 module schematic with download mode highlighted.

    Now I'm getting efuse error

    I didn't have to use Chip_En, it worked without it

    Anyway, the chip seems to be locked or something like that FL0104(BFLB_CMD_SEQ_ERROR), FL0402(BFLB_EFUSE_WRITE_ADDR_ERROR) and FL0104(BFLB_CMD_SEQ_ERROR)
    Attachments:
  • ADVERTISEMENT
  • #4 21104476
    XJ_
    Level 11  
    XT-ZB2 / XT-B-ZB2 - discovery of Zigbee module pinout function:

    Code: text Expand Select all Copy to clipboard
    
 - 1  - EN  - when connected to GND, the module is deactivated, after release, the module is restarted
 - 2  - D23 -
 - 3  - D25 - push button switch - short for toggle, long for pair
 - 4  - D26 - led in pair mode blinking, in normal mode - short flash after start, inverted output after start
 - 5  - D27 -

 - 6  - D28 - pulldown internally to GND, use 10k to VCC for flash mode
 - 7  - D0  - relay output - state on=0, state off=1
 - 8  - TX  - 2000000 baud
 - 9  - RX  - 2000000 baud
 - 10 - GND
 - 11 - 3V3
  • #6 21106288
    XJ_
    Level 11  
    >>21106215
    Yes, I'm using Boufallo Lab Dev Cube 1.8.9 - BL702L/704LK

    Screenshot of Bouffalo Lab Dev Cube 1.8.9 interface showing tabs.
  • ADVERTISEMENT
  • #7 21106291
    divadiow
    Level 34  
    hmm ok. any change with lower baud rates? I have flashed BL with 1500000, 1000000 im sure.
  • #8 21106341
    XJ_
    Level 11  
    >>21106291
    I have flashed the BL602 using this baud rate many times.
    BL702 responds but with an EFUSE error.

    I'll try a lower bitrate later and let you know, I can't right now.
  • #9 21109516
    divadiow
    Level 34  
    did you get any further?

    Added after 7 [minutes]:

    also, I'm wondering if the efuse setting is such that flash read out is disallowed, so that's why it's failing
  • ADVERTISEMENT
  • #10 21109578
    XJ_
    Level 11  

    >>21109516

    I think so too, BL702 flash via UART locked, maybe JTAG or some other option is possible. However, since it works with ZB, I have no reason to flash it.
    I'll leave the topic open, maybe in time someone will figure something out.
    Thanks..
  • #11 21109585
    p.kaczmarek2
    Moderator Smart Home  
    By the way, since it's a Zigbee module, what were you planning to do with it, once backed up?
    Helpful post? Buy me a coffee.
  • #12 21110063
    XJ_
    Level 11  

    >>21109585

    My plan is to try to find a way to find + modify + change the BL702 firmware/SDK for Zigbee - especially the pins used - so that I can use it as a replacement for WiFi modules in places where I have a weak WiFi signal. Right now I can only use them with the preset pins.

    In the meantime, I ordered the ESP32-H2, where the option is using Espressif's ESP-IDF. But this in turn is not yet directly supported by Zigbee2mqtt so it has to be added manually.

    In contrast, the BL702 is just supported as it is. Just the restriction to predefined pins.

    I'm at the beginning, I have little time but fortunately I'm not in a hurry.
  • #13 21110289
    p.kaczmarek2
    Moderator Smart Home  
    If you've bought this module, maybe there is a way to reach to seller for help? Or ask on BL forums?
    Helpful post? Buy me a coffee.
  • #14 21199924
    XJ_
    Level 11  
    Not solved, closing topic.
  • #15 21498994
    p.kaczmarek2
    Moderator Smart Home  
    I've recently tried flash read for some BL702 modules, just like in my guide: https://www.elektroda.com/rtvforum/topic4108535.html and it worked well.
    I even added some flash dumps from BZ2L etc to my repository: https://github.com/openshwprojects/FlashDumps/commit/6ef2de56b85aef380ecef70585bdd13ecba9b089
    Helpful post? Buy me a coffee.
| New topic
Report a violation of the law

Topic summary

The discussion revolves around backing up the flash memory of the XT-ZB2 BL702 Series module, which utilizes the BL702 SoC and is compatible with Zigbee2mqtt. The user encountered difficulties due to the lack of exposed GPIO8 and received various suggestions regarding the use of D28 for UART bootloader mode. Issues such as efuse errors and flash read failures were noted, with recommendations to use the latest version of BLDevCube and to experiment with different baud rates. The user expressed a desire to modify the firmware for better pin configuration and mentioned considering the ESP32-H2 as an alternative. The topic remains unresolved, with suggestions to seek assistance from the seller or relevant forums.
Summary generated by the language model.
Popular Topics
ADVERTISEMENT