STM8: SWIM not working at all - Page 1
Forum section: electronics / general

author: Arisotura
author_rank: Newbie
timestamp: November 08, 2024, 04:03:37 pm
content: Hello there!I might not be posting this in the right place -- if so, sorry about it.I am working on a personal project that involves the Wii U gamepad -- basically, making custom firmware and homebrew for it.The Wii U gamepad employs a microcontroller called UIC, which is a STM8. According to the information I have gathered about it, it would be a STM8L151R8 -- 64KB of FLASH, 4KB of RAM, 2KB of EEPROM, LQFP64 package. The UIC chip on the gamepad motherboard has custom markings ("UIC-WUP") but the pinout matches that of a 'stock' STM8L151R8.Anyway, I have a gamepad motherboard where the UIC was accidentally bricked.The UIC has a small bootloader at 0x8000, and the actual firmware (which handles input, power management, and other misc. stuff) is installed at 0x9000. The bootloader simply checks a couple bytes in EEPROM for specific values: if these are set, it jumps to the firmware entry point, otherwise it enters firmware upload mode and waits for a firmware binary to be uploaded. The firmware also has a command that triggers firmware upload mode, to allow for updates.That's the skinny. What happened to me is that corrupted firmware code was uploaded to the UIC, making it impossible to upload new code the normal way. Thus, the UIC is bricked.This is where I had the idea of using the SWIM interface to unbrick the UIC. In theory, I would just have to clear the 'firmware installed' marker bytes in EEPROM so I could upload new firmware code. Or maybe I would have to reflash the entire thing, but I have dumps of all the data.Thing is, I can't get the SWIM interface to respond at all.From the understanding I have gathered, the memories inside the chip might be locked, but the SWIM interface should atleast respond to activation.But not even.My last attempt involved programming a FPGA to send the SWIM entry pulses, and seeing what I get on the scope. In theory, after I send the entry pulses, I should receive a sync pulse after a given amount of time, but I don't receive anything. The STM8 is just not responding at all.I tried with a pull-up resistor on the SWIM pin, but that made no difference.I ordered a proper STLink so we'll see if that works, but I don't have a lot of faith there.So, this has me wondering: can the STM8 (in particular the STM8L151R8) have SWIM completely disabled, to the point it doesn't respond at all? From my understanding of the documentation, that isn't the case, but at this point, I'm doubting... what else could the problem be?

author: Postal2
author_rank: Frequent Contributor
timestamp: November 08, 2024, 04:17:45 pm
content: Quote from: Arisotura on November 08, 2024, 04:03:37 pmYes.Quote from: Arisotura on November 08, 2024, 04:03:37 pmThis is described in the documentation, I am currently reading it. I can clarify and give an exact quote if necessary.

author: Arisotura
author_rank: Newbie
timestamp: November 08, 2024, 04:32:16 pm
content: From my understanding, SWIM is disabled by writing to a specific register -- and by pulling NRST low, you can enter SWIM before such a register write happens.Maybe I'm missing something? I'd like a clarification.

author: Postal2
author_rank: Frequent Contributor
timestamp: November 08, 2024, 04:50:15 pm
content: Quote from: Arisotura on November 08, 2024, 04:32:16 pmQuotehttps://www.st.com/resource/en/reference_manual/cd00190271-stm8s-series-and-stm8af-series-8bit-microcontrollers-stmicroelectronics.pdf

author: Arisotura
author_rank: Newbie
timestamp: November 08, 2024, 05:25:38 pm
content: That's the thing though, my device does have a NRST pin.NRST can be disabled, but that's done from STM8 code afaik -- and I'm not seeing any code for that here...

author: mikerj
author_rank: Super Contributor
timestamp: November 08, 2024, 05:48:06 pm
content: It is possible the (corrupted) firmware is switching the NRST pin to an output immediately after it starts running? Could you try holding NRST low as you power it up?

author: Postal2
author_rank: Frequent Contributor
timestamp: November 08, 2024, 05:57:33 pm
content: Quote from: Arisotura on November 08, 2024, 05:25:38 pmYes, I see. But the wrong instruction opcode causes reset. It can be the first one after reset.It turns out that you just need to short reset to ground and SWIM should still connect.QuoteThe SWIM protocol description says that you can connect without releasing reset, but then you will have to release reset to load option bytes. However, you can check "SWIM sends a synchronization frame to the host" with an oscilloscope at the SWIM activation stage. Did you do this?Quote from: Arisotura on November 08, 2024, 04:03:37 pmI see you did. Then it is a custom version of STM8, in which the manufacturer has disabled SWIM, because the customer asked for it.

author: Arisotura
author_rank: Newbie
timestamp: November 08, 2024, 07:31:15 pm
content: Quote from: Postal2 on November 08, 2024, 05:57:33 pmI did, and the STM8 isn't sending anything. Unless it somehow takes way longer than the oscilloscope can display.In my attempts I've had an extra output to drive NRST low. I haven't tried having it forced low when applying power, though. I guess I could give that a try.

author: Postal2
author_rank: Frequent Contributor
timestamp: November 08, 2024, 07:36:10 pm
content: Quote from: Arisotura on November 08, 2024, 07:31:15 pmTry it, but I think SWIM is disabled at the request of the customer of a large batch. I have examples of such behavior.

author: Arisotura
author_rank: Newbie
timestamp: November 08, 2024, 08:08:28 pm
content: That's another possibility of course, but they do have to flash the UIC with the bootloader. Unless they can have it made pre-flashed.Also, the board has a test point for pin 1 of the UIC (the SWIM pin), and that pin isn't connected to anything else. There's another test pad for pin 2 (NRST), and that pin seems to just be connected to a capacitor-based reset circuit -- it is possible to pull it low externally. This implies that there's the ability to use SWIM atleast from factory. No idea if I'm being clear here...

author: Postal2
author_rank: Frequent Contributor
timestamp: November 08, 2024, 08:38:19 pm
content: Quote from: Arisotura on November 08, 2024, 08:08:28 pmMost likely so, but it doesn't matter. We'll never know. The manufacturer has the ability to configure the chip. And record the serial number of the chip.Quote from: Arisotura on November 08, 2024, 08:08:28 pmI get your point. No, the manufacturer won't change the SWIM entry sequence, it's extra work, they'll just disable it.

author: Arisotura
author_rank: Newbie
timestamp: November 08, 2024, 10:07:15 pm
content: I gave it a quick try with NRST permanently pulled low. Still no response whatsoever.I think it's clear at this point...I ordered some blank STM8's, so I can replace the UIC as a last ditch attempt -- provided I can solder that sort of chip properly.

author: Postal2
author_rank: Frequent Contributor
timestamp: November 08, 2024, 10:29:17 pm
content: Quote from: Arisotura on November 08, 2024, 10:07:15 pmYes.Quote from: Arisotura on November 08, 2024, 10:07:15 pmThis is good for an experiment, but if the manufacturer did one nasty thing, he will do the second one. These chips have unique numbers, something may be connected with this. However, I am currently studying STM8, I need to write a couple of simple programs for it in assembler. So, perhaps, if you reverse everything well, it will be possible to make your own firmware for your device. It is at the level of ATmega8 in complexity.

author: rhodges
author_rank: Frequent Contributor
timestamp: November 08, 2024, 11:48:08 pm
content: Quote from: Postal2 on November 08, 2024, 10:29:17 pmI have STM8 library and test code on github. You might find something helpful.https://github.com/unfrozen

author: Postal2
author_rank: Frequent Contributor
timestamp: November 09, 2024, 12:43:24 am
content: Quote from: rhodges on November 08, 2024, 11:48:08 pmThank you very much. I wouldn't have been able to find it myself, because I was looking for examples in assembler. Your assembler inserts are great.

author: rhodges
author_rank: Frequent Contributor
timestamp: November 09, 2024, 01:58:44 am
content: Please know that the assembler convention changed between SDCC 4.1 and 4.2I have made changes to help correct this, but if you have any trouble using 4.2, I will be glad to help.

author: Postal2
author_rank: Frequent Contributor
timestamp: November 09, 2024, 07:09:14 am
content: I somehow missed SDCC, and I didn't like COSMIC because of licensing. I installed "ST Visual Develop" and chose assembler. Most likely I will copy-paste your code, but I will definitely post the result.

author: Arisotura
author_rank: Newbie
timestamp: November 09, 2024, 08:46:44 pm
content: Quote from: Postal2 on November 08, 2024, 10:29:17 pmAs far as I've seen in all my reverse-engineering, nothing seems tied to a specific UIC chip.However, what I'm concerned about would be the UIC having subtle differences from a stock chip, possibly requiring a patched firmware. But this is still something I want to try out. Science!

author: Postal2
author_rank: Frequent Contributor
timestamp: November 09, 2024, 09:27:04 pm
content: By "reverse" I mean copying a part of the circuit that is relevant to the matter. The picture shows the HC-12 module, I don't like its firmware, so I'll write my own.

author: Arisotura
author_rank: Newbie
timestamp: November 12, 2024, 04:49:15 pm
content: Quote from: Arisotura on November 09, 2024, 08:46:44 pmTo confirm this: I removed the bricked UIC from my board, and transplanted an UIC from another board (that was damaged, but did have a good UIC). It works. All I would need to do would be transferring the correct EEPROM settings for stuff like calibration data, etc.

author: Postal2
author_rank: Frequent Contributor
timestamp: November 12, 2024, 05:04:55 pm
content: I meant something else. Let's say you can imitate the original bootloader and you can update it normally with your chip. And although the chip will be exactly the same, some hidden feature may be checked, and the firmware will not work.