Differences

This shows you the differences between two versions of the page.

--- project:chipwhisperer:start [2019/11/23 19:57] – [Glitching STM32 external board through UFO-board interface] abyssal
+++ project:chipwhisperer:start [2025/03/13 14:20] (current) – fix templatere plugin invocation root
@@ Line 1: / Line 1: @@
 ====== Chipwhisperer ======
-{{template>infobox|
+{{template>~infobox|
 name=Chipwhisperer|
 image=chipwhisperer-project-logo.png?200|
@@ Line 99: / Line 99: @@
 Unfortunately the [[https://wiki.newae.com/CW308T-STM32F | board templates for STM32 for UFO boards are too small for this chip]], which is not made in the smallest TQFP-64 package.
 {{:project:chipwhisperer:chipwhisperer_ufo_stm32f429.jpg?1200|}}
+It'd might work better if SDRAM and display was desoldered as well. By comparing various STM32F4 (415, 427, 429) in STM32CubeMx it reveals that the clock circuits are very different.
+FYI: just keep all the relevants part of pinout connected (GPIO4-trigger, RX/TX). Use 7.37 MHz clock instead of 8 MHz clock provided by the crystal oscillator or MCO from STLink so that the UART doesn't break. For anyone wondering why 7.37 MHz instead of 8 MHz, is that 7.3728e6/38400 == 192 and 7.3728e6/115200 == 64 precisely which is why 7.37 MHz is used for "industrial" UART clock generators. The chip will of course let you reconfigure the clock network, but for the usage with Chipwhisperer, using 7.37 Mhz is much easier.
+====== STM32CubeMX ======
+When you look at the clock networks of various STM32, you will find that each chip has different clock network, STM32F427 cannot be easily replaced with STM32F429.
+====== UART bootROM protocol of STM32s via Chipwhisperer ======
+Chipwhisperer has [[https://github.com/newaetech/chipwhisperer/blob/develop/software/chipwhisperer/hardware/naeusb/programmer_stm32fserial.py | STM32 serial programmer]] which can do more stuff than just erase and flash new program (refer to AN 3155 and AN 2606 STM32 datasheet).
+To get into the bootROM you need to trigger the right pattern (depends on specific STM32, but generally needs BOOT0 pin high with some extra conditions).
+Once bootROM is running, you can issue commands like erase, write, protect/unprotect and others.
+Some commands can be stacked, e.g. (extended) erase with write, some like (un)protect commands cause system reset of STM32 and you need to reopen the programmer.
+An unfortunate side effect of pulling nRST (either from outside or from firmware) is that gdb connected to SWD as external target aborts.
+I would highly recommend using logic analyzer to check result since the STM32 programmer is PITA. Order of connection of SWD/JTAG and logic analyzer seems to matter. Once nRST is pulled, SWD/JTAG seems to lose ability to do proper system reset.
+{{:project:chipwhisperer:chipwhisperer_nano_stm32f0_bootrom.jpg?800|}}