RICM4 2017 2018 - Nucleo

Project presentation

The goal of this project is to be able to re-program the NUCLEO STM32F446RE from a remote place, using wifi.

An user must be able to send a binary program to the Wifi Chipset ESP8266EX plugged on the NUCLEO STM32F446RE. That last one receives the binary, flashes it, and execute its new program.

Then and if we have time, we can look forward on the security issues of this system and try to fix them.

Equipment

• OLIMEXINO-328
• NUCLEO STM32F446RE
• Wifi Chipset ESP8266EX
• Two computers with the sofware Arduino and Mbed.

Team

Members :

• CHANET Zoran
• CHARLOT Servan

Supervisor :

• Olivier RICHARD

Progress

Week 1 (15/01/18)

This subject was assigned to us.

Received the cards. (But one of them was broken)

Discovering the cards and the documentation.

Week 2 (22/01/18)

Testing codes samples on the cards to get familiar with the language.

Week 3 (29/01/18)

Experimenting the input/outputs capacities of the cards, by redirecting power on some chosen pin to trigger a LED, or sending data on the serial port.

Week 4 (05/02/18)

Linking the two cards together to simulate a serial connection between them.

Then, sending data to one card (via the serial port of a computer) and see if we are able to receive it on the other one (by printing it on the serial port, connected to another computer).

Week 5 (12/02/18)

Creating UML diagrams and this page.

Studying the ESP8266EX documentation and finding a way to to connect it to the Nucleo.

Week 6 (26,27/02/18)

Configuration of the ESP8266.

Hardwiring : (according to jeelabs ESP-link documentation, esp-01 device)

• URXD: connect to TX of microcontroller
• UTXD: connect to RX of microcontroller
• GPIO0: connect to RESET of microcontroller
• GPIO2: optionally connect green LED to 3.3V (indicates wifi status)
• GND: connect to GND of microcontroller
• VCC+CH-PD: connect to 3v3 output of microcontroller

Trying to flash esp-link-v3.0.14 onto the esp8266ex (512KB flash size, 40m frequency), using esptool.py (if strangely installed, esptool.py is to be found in ~/.local/lib/python2.7/site-packages), following those steps :

• flash boot_v1.X.bin from the official SDK or from the release tgz to 0x00000
• flash user1.bin to 0x01000
• flash esp_init_data_default.bin from the official SDK or from the tgz to 0x7C000
• flash blank.bin from the official SDK or from the tgz to 0x7E000

esptool.py --port /dev/ttyUSB0 --baud 460800 write_flash -fs 512KB -ff 40m \
  0x00000 boot_v1.6.bin 0x1000 user1.bin \
  0x7C000 esp_init_data_default.bin 0x7E000 blank.bin

/!\ Error "A fatal error occurred: Failed to connect to Espressif device: Timed out waiting for packet header" /!\→ changing the baud rate doesn't seem to solve the issue

New attempt based on these connections :

• URXD: connect to TX of microcontroller
• UTXD: connect to RX of microcontroller
• GPIO0: connect to GND of microcontroller
• GND: connect to GND of microcontroller
• VCC+CH-PD: connect to 3v3 output of microcontroller

Exact same error.

According to jeelabs ESP-link documentation again, on both hardwiring models an attempt of putting GPIO2 to high in order to flash the ESP8266 was unsuccessfully made.

-Ideas for next weeks-

• Adapt the avrflash to flash the stm32 card
• Ask the issue 205 man if he did it already
• Stm32 bootloader serial port forwarding ?
• See this from issue 250

Hello :)
I wrote a patch for stm32flash that allow use it with esp-link.
Currently its in dirty stage so no automatic baudrate/mode setting, but will try to add it in few days.
So here are my steps to flash stm32f030:
    Clone and build my version of stm32flash from: https://bitbucket.org/hetii/stm32flash
    Pull boot0 high.
    Reset stm32 by low pulse on NRST.
    Run stm32 to flash your software.
    Change back boot0 to low and reset uC.

• Improve arduino software to directly upload the binary file to the card

Week 7 (5,6/03/18)

Trying to :

1. Flash ESP-link on the ESP8266
2. Flash STM32F446 via serial converter to USB

1. Version 3.0.14 successfully flashed to new card (WeMos - ESP8266-12 ; connecting via microUSB). Access to [192.168.4.1] granted. Successfully added a web page to the ESP home.

2. Trying to use stm32flash to flash the Nucleo card. Hardwiring according to this.

   BOOT0 pin set to HIGH (connected to 3v3 out). 
   PB2 pin set to LOW (connected to GND). 
   STM32F4 supports many UART combination. 
       →TX: PA9; RX: PA10 (according to USART1 bootloader)
       TX: PB10; RX: PB11 (according to USART3 bootloader)
       TX: PC10; RX: PC11 (according to USART3 bootloader)

Bootloader mode seems confirmed as application does not load.

Also, using the serial to USB converter :

   RX of the converter to TX of the microcontroller 
   TX of the converter to RX of the microcontroller 
   GND to GND of the microcontroller 
   3v3 out to 3v3 in of the microcontroller

/!\ Error "Failed to init device." /!\ → changing the baud rate doesn't solve the problem ; removing ST-Link neither

Week 8 (12,13/03/18)

Preparing the oral, and presenting it.

Not to stay stuck on flashing the STM32 Nucleo card, trying to flash the Olimexino-328 card via Serial (then ESP-link).

Hardwiring using USB to Serial adapter :

• GND pin of the adapter to GND pin of the microcontroller
• 3v3 out pin of the adapter to 3v3 in pin of the microcontroller
• RX pin of the adapter to RX pin of the microcontroller
• TX pin of the adapter to TX pin of the microcontroller
• RST pin of the adapter to RST pin of the microcontroller

Success on first attempt

Now the same using avrdude instead of arduino's software :

avrdude -b 57600 -p m328p -c arduino -P /dev/ttyUSB0 -U flash:w:Blink/Blink.cpp.hex 

Now trying to flash the same Olimexino-328 card via ESP-link.

Hardwiring using WeMos :

 ./avrflash -v 192.168.4.1:23 Blink/Blink.ino 
Resetting AVR with http://192.168.4.1:23/pgm/sync
*   Trying 192.168.4.1...
* Connected to 192.168.4.1 (192.168.4.1) port 23 (#0)
> POST /pgm/sync HTTP/1.1
> Host: 192.168.4.1:23
> User-Agent: curl/7.47.0
> Accept: */*
> 
* Operation timed out after 10001 milliseconds with 0 bytes received
* Closing connection 0
Error resetting AVR

Week 9 (19/03/18)

Successful flash of the Olimexino-328 card via ESP-link. The problem came from a wiring mistake, because it is not the same wiring with the ESP-01 and the ESP-12.

Wiring using ESP-12 :

• GND pin of the adapter to GND pin of the microcontroller
• 3v3 out pin of the adapter to 3v3 in pin of the microcontroller
• URXD: connect to TX of microcontroller
• UTXD: connect to RX of microcontroller
• GPIO12: connect to RESET of microcontroller
• GPIO13: connect to ISP of LPC/ARM microcontroller (not used with Arduino/AVR)

The flashing doesn't work with avrflash so we did it with avrdude, using the following command :

avrdude -b 57600 -p m328p -c arduino -P net:192.168.4.1:23 -U flash:w:Blink.cpp.hex

Output :

ioctl("TIOCMGET"): Inappropriate ioctl for device
ioctl("TIOCMGET"): Inappropriate ioctl for device

avrdude: AVR device initialized and ready to accept instructions 

Reading | ################################################## | 100% 0.01s

avrdude: Device signature = 0x1e950f (probably m328p)
avrdude: NOTE: "flash" memory has been specified, an erase cycle will be performed 
        To disable this feature, specify the -D option.
avrdude: erasing chip
avrdude: reading input file "blinkLent.cpp.hex"
avrdude: input file blinkLent.cpp.hex auto detected as Intel Hex
avrdude: writing flash (1054 bytes):

Writing | ################################################## | 100% 0.38s

avrdude: 1054 bytes of flash written
avrdude: verifying flash memory against blinkLent.cpp.hex:
avrdude: load data flash data from input file blinkLent.cpp.hex:
avrdude: input file blinkLent.cpp.hex auto detected as Intel Hex
avrdude: input file blinkLent.cpp.hex contains 1054 bytes
avrdude: reading on-chip flash data:

Reading | ################################################## | 100% 0.58s

avrdude: verifying ...
avrdude: 1054 bytes of flash verified

avrdude: safemode: Fuses OK (E:00, H:00, L:00)
ioctl("TIOCMGET"): Inappropriate ioctl for device

avrdude done.  Thank you.

If ever the ESP8266 ain't working anymore, try

esptool.py erase_flash

then flash it again (see week 6)

Week 10 (26/03/18)

/!\This week the action to flash the Olimexino with ESP is not working anymore. Even when we try to erase its memory with esptool.py erase_flash and flashing it again with an untouched version of esp-link. The wifi network is still working and we are able to connect to it, but the command using avrdude is not working anymore (and avrflash keeps on not working). Whe have the following error message :

avrdude: stk500_recv(): programmer is not responding

So we decided to let this part of the project on the side temporarly to focus on the STM32. Our goal here is first to flash the STM32 with the serial port, and then trying to understand how stm32flash works to implant it into esp-link or avrdude. Bu stm32flash doesn't work either, displaying the following error :

./stm32flash -w ../Nucleo/try_Code_STM32/STM32_Blink_lent.bin /dev/ttyUSB0 

stm32flash 0.5

http://stm32flash.sourceforge.net/

Using Parser : Raw BINARY
Interface serial_posix: 57600 8E1

Failed to init device.

Week 11 (06/04/18)

This week we tried flashing the Olimexino card with an older version of the esp-link (2.2.3) flashed on the WeMos :

esptool.py --port /dev/ttyUSB0 --baud 460800 write_flash -fs 32m -ff 80m \
   0x00000 boot_v1.5.bin 0x1000 user1.bin 0x3FE000 blank.bin

Yet, we are confronted to the same error over and over again, regardless of the pin configuration.

---

We tried and succeeded to flash the STM32, this time using the Olimexino as USB to TTL instead of the offical USB to TTL convertor (which doesn't seem to work with the STM32, only with the Arduino).

Here is the output showed when it works.

stm32flash 0.5

http://stm32flash.sourceforge.net/

Using Parser : Raw BINARY
Interface serial_posix: 57600 8E1
Version      : 0x31
Option 1     : 0x00
Option 2     : 0x00
Device ID    : 0x0421 (STM32F446xx)
- RAM        : Up to 128KiB  (12288b reserved by bootloader)
- Flash      : Up to 512KiB (size first sector: 1x16384)
- Option RAM : 16b
- System RAM : 30KiB
Write to memory
Erasing memory
Wrote address 0x08006fe0 (100.00%) Done. 

Here are the steps to do so :

• Connect RST of Olimexino to GND of Olimexino.
• Connect 3.3v of Olimexino to 3.3v of STM32.
• Connect GND of Olimexino to GND of STM32.
• Connect RX (D0) of Olimexino to RX (PA10/D2) of STM32.
• Connect TX (D1) of Olimexino to TX (PA9/D8) of STM32.
• Make sure that on the STM32 you have the two jumpers on the ST-LINK.
• Make sure that on the STM32 you have a jumper between E5V and PWR (because when you try to flash it via USB this jumper must be between PWR and U5V for the STM32 to execute its program).

At this point if you power the Olimexino with the USB connection to your computer, the STM32 will behave normally (executing its program).

Now you want to enter STM32's bootloader mode :

• Connect the BOOT0 of the STM32 to the VCC of the STM32 (set BOOT0 to high).
• Press the reset button of the STM32 and wait a little bit
• Then you can flash your STM32 with a binary file using stm32flash (http://stm32flash.sourceforge.net/) by using the following command :

sudo ./stm32flash -w ../Nucleo/try_Code_STM32/STM32_Blink.bin /dev/ttyUSB0

• Set BOOT0 to low (disconnect BOOT0 of the STM32 from VCC).
• Press the reset button one more time. The STM32 now behave normally and executes the flashed program.

---

Links

• Projects list
• SRS
• UML
• Documentation