FRDM-KW41Z (Flash resident bootloader): Thread Reset (in 3 min)

[sensenthuran]

I am having one issue with “Thread version 1.1.1.15 - thread_host_controlled_device_freertos”. When I loaded to FRDM KW41Z (has Flash resident bootloader), It resets after 3mins. 

I did the memory map as below

C:\MCUXpressoIDE_10.0.0_344\workspace\frdmkw41z_wireless_examples_thread_host_controlled_device_freertos\source\MKW41Z512xxx4_connectivity.ld

__region_ROM_start__   =  (0x00004000); //  default: 0x00000000

m_flash_config_start = (0x4400); //  default: 0x400

m_flash_config_end   = (0x4410); //  default: 0x410

Do you think, the “flash resident” bootloader is still valid for Thread version 1.1.1.15 ?

With the SDK_2.2_FRDM-KW41Z, I can see only
1) OTAP Bootloader and
2) FSCI Bootloader
But not “flash resident” bootloader jcpacheco‌

Thanks 

[jc_pacheco]

Additional details:

These instructions can also be performed during PIT initialization in the Application project. (In case you don't want to modify the Bootloader project). 
See "void TMR_PITInit(void){" function... you could run these right after the PIT's clock is enabled:
"CLOCK_EnableClock(pitClocks[gTmrPitInstance_c]);"

.
.
.
if( !gPITInitFlag )    
{        
    mPIT_TimestampHigh = (uint32_t)-1;                
    CLOCK_EnableClock(pitClocks[gTmrPitInstance_c]);               

/////////
      baseAddr->MCR &= ~PIT_MCR_MDIS_MASK;
      PIT->CHANNEL[1].TCTRL = 0x0; // disable timer 1  
      PIT->CHANNEL[0].TCTRL = 0x0; // disable timer 0  
      PIT->CHANNEL[0].LDVAL = 0x0;
////////

   baseAddr->MCR |= PIT_MCR_MDIS_MASK;
   pitFreq = CLOCK_GetBusClkFreq();
.
.
.‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

Rote, 

You can also use the RTC for timestamping with no issues.

Hope this helps,
JC

[rotechen]

Thanks, JC, It is very helpful.

[jc_pacheco · Accepted solution]

Hello Sen, 

It was a problem with the PIT deinitialization in the Kinetis Bootloader project. 

void microseconds_shutdown(void)
{
 PIT->CHANNEL[1].TCTRL = 0x0; // disable timer 1
 PIT->CHANNEL[0].TCTRL = 0x0; // disable timer 0
 PIT->CHANNEL[0].LDVAL = 0x0;
 // Turn off PIT: MDIS = 1, FRZ = 0
 PIT->MCR |= PIT_MCR_MDIS_MASK;
}‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

Hope this helps,

JC

[rotechen]

HiJuan Carlos Pacheco,

Thanks for you to provide this solution.
I found it will read the timestamp that getting from PIT(Periodic interrupt timer) to decision the sw reset time in in this application "rdmkw41z_wireless_examples_thread_host_controlled_device_freertos".

I try to read the value of timestamp form RTC (it is meaning the variable "gTMR_PIT_Timestamp_Enabled_d" is setting to "0"), it is workable.

Is it have any side-effect if i am using it?

Thanks!!!

[sensenthuran]

Thanks lot JC, I tested with EVB and that fixed the issue . 

[sensenthuran]

Any comment jasonchiang‌ ...

[jc_pacheco]

Hello Sen, 

Need some additional details: What target did you use for the Kinetis Bootloader 2.0.0?

As previously commented, I tried to reproduce this issue using the Connectivity Bootloader (FSCI) and the Linker file used by the OTA_Client device, I just modified it to start at 0x4000 address and it worked ok with Test Tool, the reset took place immediately.

Can you please try this approach and use low_power_end_device_ota_client/source/MKW41Z512xxx4_connectivity.ld as starting point which also specify all the memory areas.

///////
m_bootloader_start = (__region_ROM_start__);
/*m_bootloader_end = (((__region_ROM_end__ + 1) / 32) - 1);*/
m_bootloader_end = 0x3FFF;
m_interrupts_start = (m_bootloader_end + 1);
m_interrupts_end = (m_interrupts_start + __vector_table_size__ - 1);
m_bootFlags_start = (m_interrupts_end + 1);
m_bootFlags_end = (m_bootFlags_start + 7);
__BootFlags_Start__ = m_bootFlags_start;
/////////‍‍‍‍‍‍‍‍‍‍

////////
 Bootloader_region (RW) : ORIGIN = m_bootloader_start, LENGTH = (m_bootloader_end - m_bootloader_start)
 TEXT_region1      (RX) : ORIGIN = m_text_start, LENGTH = (m_bootFlags_start - m_text_start)
 BootFlags_region  (RX) : ORIGIN = m_bootFlags_start, LENGTH = (m_bootFlags_end - m_bootFlags_start)
 TEXT_region2      (RX) : ORIGIN = m_bootFlags_end + 1, LENGTH = (m_text_end - m_bootFlags_end - 1)
///////‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

-JC

[sensenthuran]

Hi jcpacheco,

I tried that linker file too, same issue. 

I coped the linker file and the bootloader  and sharing it to you as personal message . Please load the compiled bootloader using IAR for target KW41Z. This was provided by OEM (May be received from their NXP FAE). I had trouble with compiling but I could load the bootloader with IAR. This bootloader works fine except Factory reset now. 

Thanks

Sen

[sensenthuran]

Hi jcpacheco‌,

Please find the details so that you can reproduce..

HW:

I got two kw41z Rigado boards (Board A & B).

SW:

SDK_2.2_FRDM-KW41Z  ( with MCUXpressoIDE)

TestTool from windows.

1) Board A:(works as expected)

No change in SDK

Just loaded frdmkw41z_wireless_examples_thread_host_controlled_device_freertos.bin 

2) Board B:(issue with factory reset, other Thread functionalities looks OK)

Loaded NXP_Kinetis_Bootloader_2_0_0 (flash resident boot loader). 

Then loaded frdmkw41z_wireless_examples_thread_host_controlled_device_freertos with 0x4000 offset. 

SDK linker file change (3 lines)

C:\MCUXpressoIDE_10.0.0_344\workspace1\frdmkw41z_wireless_examples_thread_host_controlled_device_freertos\source\MKW41Z512xxx4_connectivity.ld

/*-Memory Limits-*/
__region_ROM_start__ = (0x00004000); // Default 0x000000
__region_ROM_end__ = (0x0007FFFF);

m_interrupts_start = (__region_ROM_start__);
m_interrupts_end = (m_interrupts_start + __vector_table_size__ - 1);
m_flash_config_start = (0x4400);   // Default 0x400
m_flash_config_end = (0x4410);   // Default 0x410

TestTool Logs

Both Boards A & B works similar way (in Thread network operation) except Factory Reset.

Log: Issue after change the memory map

1B) Board B (with 0x4000 offset), No Reset to factory default, Only ResetCpuSuccess after 3 mins delay.

[12:59:18.0467] TX: THR_FactoryReset.Request 02 CE 1F 00 00 D1
Sync [1 byte] = 02
OpGroup [1 byte] = CE
OpCode [1 byte] = 1F
Length [2 bytes] = 00 00
CRC [1 byte] = D1
[12:59:18.0477] RX: THR_FactoryReset.Confirm 02 CF 1F 01 00 00 D1
Sync [1 byte] = 02
OpGroup [1 byte] = CF
OpCode [1 byte] = 1F
Length [2 bytes] = 00 01
Status [1 byte] = 00 (Success)
CRC [1 byte] = D1
[12:59:18.0477] RX: THR_CpuReset.Indication 02 CF 22 05 00 01 F4 01 00 00 1C
Sync [1 byte] = 02
OpGroup [1 byte] = CF
OpCode [1 byte] = 22
Length [2 bytes] = 00 05
Status [1 byte] = 01 (ResetCpuPending)
TimeoutMs [4 bytes] = 00 00 01 F4
CRC [1 byte] = 1C

----> 3 mins delay
[13:02:10.0538] RX: THR_CpuReset.Indication 02 CF 22 33 00 00 0B 46 52 44 4D 2D 4B 57 34 31 5A 00 FF FF FF FF 17 00 00 00 05 40 1A 00 44 4D 95 15 00 60 37 00 F1 11 0F 4E 58 50 20 54 48 52 31 2E 31 2E 31 2E 31 35 EC
Sync [1 byte] = 02
OpGroup [1 byte] = CF
OpCode [1 byte] = 22
Length [2 bytes] = 00 33
Status [1 byte] = 00 (ResetCpuSuccess)
BoardNameLen [1 byte] = 0B
BoardName [11 bytes] = 46 52 44 4D 2D 4B 57 34 31 5A 00 (FRDM-KW41Z

Log: Working default setup

1A) Board A (default SDK, No issue)

[13:10:28.0731] TX: THR_FactoryReset.Request 02 CE 1F 00 00 D1 

Sync [1 byte] = 02
OpGroup [1 byte] = CE
OpCode [1 byte] = 1F
Length [2 bytes] = 00 00
CRC [1 byte] = D1
[13:10:28.0740] RX: THR_FactoryReset.Confirm 02 CF 1F 01 00 00 D1
Sync [1 byte] = 02
OpGroup [1 byte] = CF
OpCode [1 byte] = 1F
Length [2 bytes] = 00 01
Status [1 byte] = 00 (Success)
CRC [1 byte] = D1
[13:10:28.0740] RX: THR_CpuReset.Indication 02 CF 22 05 00 01 F3 01 00 00 1B
Sync [1 byte] = 02
OpGroup [1 byte] = CF
OpCode [1 byte] = 22
Length [2 bytes] = 00 05
Status [1 byte] = 01 (ResetCpuPending)
TimeoutMs [4 bytes] = 00 00 01 F3
CRC [1 byte] = 1B
[13:10:29.0575] RX: THR_EventGeneral.Confirm 02 CF 54 05 00 00 03 00 00 00 9D
Sync [1 byte] = 02
OpGroup [1 byte] = CF
OpCode [1 byte] = 54
Length [2 bytes] = 00 05
InstanceId [1 byte] = 00
EventStatus [2 bytes] = 00 03 (Reset to factory default)
DataSize [2 bytes] = 00 00
CRC [1 byte] = 9D
[13:10:29.0575] RX: THR_CpuReset.Indication 02 CF 22 33 00 00 0B 46 52 44 4D 2D 4B 57 34 31 5A 00 FF FF FF FF 15 00 00 00 0C 40 0A 00 45 4E 22 40 00 60 37 00 F1 11 0F 4E 58 50 20 54 48 52 31 2E 31 2E 31 2E 31 35 17
Sync [1 byte] = 02
OpGroup [1 byte] = CF
OpCode [1 byte] = 22
Length [2 bytes] = 00 33
Status [1 byte] = 00 (ResetCpuSuccess)
BoardNameLen [1 byte] = 0B
BoardName [11 bytes] = 46 52 44 4D 2D 4B 57 34 31 5A 00 (FRDM-KW41Z

Thanks

Sen

[jc_pacheco]

Hello Sen, 

This is strange. So, the factory reset command (02  CE 1F 00 00 D1) leads you to those issues at any time or just if used during initialization?

What IDE are you using?

By MAC address, you mean Random Extended Address or the IEEE Extended Address?  I guess the Random Extended Address, which changes on each factoryreset.

Is there a way for you to send the Multicast Listener Report using ML64 or ULA addressing?  I'll check if there's a way to "force" an specific LL-IPv6 to reply to the multicast. 

Are the Work/Non Work logs from the same network setup with the exact same IPv6 addresses on the KW41? 

-JC

[sensenthuran]

Hi jcpacheco‌

Factory reset command is actually not working with the binary that has memory offset. If i do it during the initialization, after 3 mins it resets. If i don't do that, it works. If i need to reset, there is no way to do that now. After power cycle, as expected, it goes to the border gateway mode again (two blue LEDs are not blinking even after reset).  I have all the IDEs (KSD, MCUExpresso and evaluation IAR).

I guess, the IEEE Extended Address. It uses the default (00:60:37:00:fa:5c) all the time. 

The setup was same but after reboot. It has same MAC address, but IPv6 address changes. If the link local is based on MAC address, then kw41z replies for neighbor solicitation else not. You can see it in the log.

Could you help me how can i reset the thread network? am i missing anything in linker file?

Thanks

Sen 

[jc_pacheco]

Hello Sen, 

Thanks for the details. Now that you mention that it works with the Router project... Can you please help us with some questions?

- Does the reset appear after you run the Thread_KW_Tun demo or even if you don't start it?

- If this is after the tunnel started by the HSDK application, what else was performed on the network? 

- Are there any joiners in the network?

- Can you try debugging the app and verify the last reached function?

- Have you tried increasing the memory pools (AppPoolsDetails_c and ThreadPoolsDetails_c)?

- Can you try putting a "while(1);" after the Host Controlled Device application started? So that we know if it's related to the application or the bootloader.

-JC

[sensenthuran]

Hi JC,

It looks like, Reset option gives the issue for the image with 0x4000 offset.

Thread_KW_Tun /dev/ttyACM0 fslthr0 1

rst[6] = {0x02, TX_OG, FACTRY_RST, 0x00, 0x00, 0xD1};

If I don't reset, it works without resetting the Thread network after 3 mins. 

Thread_KW_Tun /dev/ttyACM0 fslthr0 0

Now the issues are:

1) Not sure how to do the factory_reset on a Thread network (as above command does not work)

2) Getting multiple link local address

 Border gateway(kw41z) has the MAC address 00:60:37:00:fa:5c

   Case 1

         If BorderGateway picks the link local as fe80::260:37ff:fe00:fa5c, then it works fine

   Case 2 (main problem)

          If BorderGateway picks different link-local address(ex: fe80::dc9f:6cd7:c487:9fe7), then it send the solicit XID message to DHCPv6 server with that link-local address, then DHCPv6 server responding with Neighbor Solicitation, then kw41z does not reply. Hence not getting the global address. Interesting observation is, i should be able to ping fe80::260:37ff:fe00:fa5c  from local network, while NXP sends the solicitation with different link-local address to that I cant ping.

Thanks

Sen

[jc_pacheco]

Hello Sen, 

There's a known issue with MCUXpresso IDE where the linker file is not loaded by the preprocessor, so the defining of gUseBootloaderLink_d at preprocessor level would not work. The current workaround is to compare the linker file from an bootloader-enabled project like the "thread_end_device_ota_client", please take a look into that linker file for reference on how to modify the linker file in your project to enable the bootloader sections and make use the FSCI or OTA bootloader projects.

Hope this helps.

Regards,

JC

[sensenthuran]

Thanks jcpacheco‌

If i use the same linker file (MKW41Z512xxx4_connectivity.ld with 0x4000 offset) to frdmkw41z_wireless_examples_thread_router_eligible_device_freertos, that WORKS fine.

Also thread_host_controlled_device, works for 3 mins then resets. Do you still think it is a linker file issue?

I am not successful with using "thread_end_device_ota_client" example. I tried several combination, Even I tried with that same linker file, same result.  thread_host_controlled_device works for only 3 mins. How can i debug further?

For your information, I tried with IAR. It also works for 3 mins, if i set the offset 0x4000.

Thanks

Sen

[jc_pacheco]

Hello Sen, 

I configured the Thread Host Controlled Device to use the end_device_ota_client's linker file and the FSCI bootloader with no issues. What do you mean "it works for 3 minutes" I mean... what tasks are being performed on the HCD? Does it reset even if the application is doing nothing?

I'm not familiar with the "flash resident bootloader", so I'll have to check around and get back to you.

-JC

[sensenthuran]

Hi JC,

We are using this boot-loader. After loading the bootloader to kw41z eval borad, writing the .bin file to flash with the following command,

Bootloader: NXP_Kinetis_Bootloader_2_0_0\targets\MKW41Z

Writing the binary

./blhost -p /dev/ttyACM0 -- write-memory 0x4000 frdmkw41z_wireless_examples_thread_host_control.bin

Version check:

./blhost -p /dev/ttyACM0 -- get-property 1

Ping responded in 1 attempt(s)

Inject command 'get-property'

Response status = 0 (0x0) Success.

Response word 1 = 1258422272 (0x4b020000)

Current Version = K2.0.0

This the application running in the Thread node:

/hsdk/demo/bin/Thread_KW_Tun

Thanks

Sen