CC2538DK
The TI CC2538DK with a CC2538SF53 (Cortex-M3, 32 MHz max, 2.4-GHz
IEEE 802.15.4 radio): 512 KiB of flash at 0x0020_0000 (the boot ROM, not
flash, sits at 0x0), 32 KiB of SRAM at 0x2000_0000, four active-high LEDs
on the SmartRF06 EB (PC0–PC3), five active-low keys (PA3, PC4–PC7)
and the console on UART0 PA0/PA1 through the I/O controller.
This is the UART+LED L1 slice plus a stock Contiki-NG boot. Boot, the
SYS_CTRL reset clock, the UART0 console and the address-masked GPIO LED path
(with GPIO_DATA read-back) are proven by a committed smoke fixture and an
io-smoke.yaml. Unmodified upstream Contiki-NG v4.9 examples/hello-world
(full RPL Lite / 6LoWPAN / CSMA netstack, the binary Renode's
cc2538_single-node.robot runs) boots through an in-tree clean-room boot ROM,
brings up the radio and prints Hello, world every 10 s
(contiki-hello.yaml). The flash controller erases and programs flash
through the ROM's PageErase/ProgramFlash: unmodified Contiki-NG
examples/storage/cfs-coffee (contiki-test-cfs.yaml, contiki-coffee.yaml)
and the steps of Renode's cc2538_flash_controller.robot
(flash-controller.yaml) pass. The AES/SHA-256 cryptoprocessor runs the
unmodified Contiki-NG cc2538-common/crypto suite with every vector OK
(crypto-{ecb,cbc,ctr,cbc-mac,gcm,ccm,sha256}.yaml); its CBC, CBC-MAC, CTR
and CCM runs are a superset of Renode's cc2538_cryptoprocessor.robot.
Three nodes on a shared 802.15.4 air run the unmodified Contiki-NG
examples/rpl-udp (an RPL root udp-server and two udp-clients), the
topology of Renode's cc2538_rpl-udp.robot: both clients join the DODAG
and get all three requests echoed (cc2538_rpl_udp), through the RF core's
RX FIFO, frame filtering, hardware AUTOACK and FIFOP interrupt and the µDMA.
Not claimed yet
The 802.15.4 air is lossless: no path loss, range or collisions, and
every node hears every other. The RF error interrupt, the CSP, the MAC
timer count and source matching are not modelled; a single node (no air)
receives nothing. The µDMA moves only on software requests. The ROM is LabWired's
own (not a TI dump): no serial boot loader. Flash operations do not
stall a CPU executing from flash, and there is no flash DMA trigger or
flash interrupt. SYS_CTRL clock gating has no effect on other blocks, the
IOC pin mux and pad overrides are a stub, GPIO interrupts are not raised
and the watchdog never bites. The cryptoprocessor's slave-interface
(non-DMA) data path, KEY2/KEY3 and pulse interrupts are not modelled.
PKA, SSI, I²C,
GPTimers, USB and SoC ADC are declared stubs. There is no silicon
capture: SIM-DERIVED.
Live status
The tables below are a maintained snapshot. Authoritative automation:
- Chip conformance scoreboard — level · modelled peripherals · register-match
Status at a glance
| Aspect | Status |
|---|---|
| Chip descriptor | configs/chips/cc2538sf53.yaml |
| Example system | configs/systems/cc2538dk.yaml |
| Reference firmware | crates/firmware-cc2538dk-smoke/; stock Contiki-NG via crates/firmware-cc2538dk-contiki/ |
| Example | examples/cc2538dk/ |
| Committed artifacts | tests/fixtures/cc2538dk-smoke.elf (CC2538DK SMOKE), tests/fixtures/cc2538dk-contiki-hello.elf (Hello, world), cc2538dk-contiki-test-cfs.elf / cc2538dk-contiki-coffee.elf (Contiki-NG CFS/Coffee), cc2538dk-contiki-flash-test.elf (FLASH TEST DONE), cc2538dk-contiki-crypto-*.elf (Contiki-NG crypto suite) |
| Build target | thumbv7m-none-eabi; Contiki-NG with arm-none-eabi-gcc |
| Tier (snapshot) | L1 — smoke (CPU + memory + SYS_CTRL + UART0 + GPIO) plus a stock Contiki-NG boot (ROM, RF core, sleep timer) and flash erase/program (flash controller, Contiki-NG CFS/Coffee), the AES/SHA-256 engine and a three-node Contiki-NG RPL-UDP network on a shared 802.15.4 air; SIM-DERIVED |
Memory map and board wiring
| Region / signal | Base / pin | State |
|---|---|---|
| ROM | 0x0000_0000, 128 KiB |
in-tree clean-room ROM (crates/core/roms/cc2538/cc2538_rom.S, not a TI dump): SWRU333A §2.2 CCA boot and the §3.2 utility API table at 0x48 |
| Flash information page | 0x0028_0000, 2 KiB |
erased except a fixed primary IEEE address 00:12:4B:00:00:00:00:01 at +0x28 |
| Flash | 0x0020_0000, 512 KiB |
modelled — the smoke links and runs here; CCA at 0x0027_FFD4 |
| SRAM | 0x2000_0000, 32 KiB (upper 16 KiB retained in PM2/3) |
modelled — stack at the top |
| SYS_CTRL | 0x400D_2000 |
modelled (cc2538_sys_ctrl) — CLOCK_CTRL/CLOCK_STA, gate banks (storage only) |
| IOC | 0x400D_4000 |
type: stub — pin mux / pad overrides not modelled |
| UART0 (console) | 0x4000_C000 |
modelled — PL011-compatible, IRQ 5 |
| UART1 | 0x4000_D000 |
modelled — same layout, unexercised |
| GPIO A–D | 0x400D_9000 + 0x1000×n |
modelled (cc2538_pl061_gpio) — masked DATA, DIR, AFSEL |
| LEDs | LED1 PC0 (red, not driven — USB pull-up), LED2 PC1, LED3 PC2, LED4 PC3 | modelled GPIO — active high |
| Keys | SELECT PA3, LEFT PC4, RIGHT PC5, UP PC6, DOWN PC7 | modelled GPIO input — active low, reset pull-up |
| UART0 VCP | PA0 (RX) / PA1 (TX) | simulator captures the UART0 stream; the USB debugger bridge is not modelled |
| RF core | 0x4008_8000 |
modelled (cc2538_rfcore) — XREG reset values, immediate strobes, timed main FSM, RSSI/CCA, RFRND, MTCTRL; on a shared 802.15.4 air: TX, RX FIFO, frame filtering, AUTOACK, FIFO/FIFOP/SFD, RF TX/RX IRQ 141 |
| µDMA | 0x400F_F000 |
modelled (cc2538_udma) — software basic/auto transfers through the control table, CHIS + IRQ 46; no peripheral requests |
| Sleep timer / WDT | 0x400D_5000 |
modelled (cc2538_sleep_timer) — 32-kHz count with the ST0 latch, compare IRQ 145; watchdog is storage only |
| AES/SHA-256 | 0x4008_B000 |
modelled (cc2538_aes) — two-channel DMA, key store, AES ECB/CBC/CTR/CBC-MAC/CCM/GCM (128/192/256), SHA-256, level IRQ 143; no slave-interface data path |
| Flash controller | 0x400D_3000 |
modelled (cc2538_flash_ctrl) — page erase, word write sequence, CCA lock bits, DIECFG0-2 |
| PKA / SSI / I²C / GPTimers / USB / ADC | see descriptor | type: stub |
Boot path
Through the ROM, or fast boot. On reset the core fetches the ROM's own
vectors at 0x0. The clean-room ROM then does what SWRU333A §2.2 describes:
it checks the CCA in the top flash page (Image Valid = 0, Application
Entry Point in flash and 0x80-aligned), sets VTOR to that vector table, loads
SP and branches to its reset handler. With no valid image it parks in WFI
(the real ROM runs its serial boot loader). Contiki-NG links its table at
0x0020_2000 and boots this way; its reset_handler copies .data and
clears .bss through the ROM's memcpy/memset.
An image with a valid vector table at the flash base (the smoke, at
0x0020_0000) is still entered there directly by the loader. Its CCA points
at the same table, so the ROM would land in the same place.
Validation
# from the repository root
cargo build -p firmware-cc2538dk-smoke --release --target thumbv7m-none-eabi
./target/release/labwired test --script examples/cc2538dk/io-smoke.yaml --no-uart-stdout
./target/release/labwired test --script examples/cc2538dk/contiki-hello.yaml --no-uart-stdout
./target/release/labwired test --script examples/cc2538dk/flash-controller.yaml --no-uart-stdout
./target/release/labwired test --script examples/cc2538dk/contiki-test-cfs.yaml --no-uart-stdout
./target/release/labwired test --script examples/cc2538dk/contiki-coffee.yaml --no-uart-stdout
for t in ecb cbc ctr cbc-mac gcm ccm sha256; do
./target/release/labwired test --script examples/cc2538dk/crypto-$t.yaml --no-uart-stdout
done
See examples/cc2538dk/VALIDATION.md
for the claims, runtime evidence and explicit non-claims.
Sources
The CC2538 User's Guide SWRU319C (memory map, SYS_CTRL, GPIO, IOC, UART,
flash/CCA, sleep timer, RF core), the CC2538 ROM User's Guide SWRU333A (boot
sequence, utility API), the CC2538 datasheet SWRS096 (device sizes, DC
characteristics) and the Contiki-NG / RIOT cc2538dk board ports for the
LED/key/console wiring — detailed in
examples/cc2538dk/REQUIRED_DOCS.md.