DFU operations on the BlackIce II
The STM32 has 2 different boot modes: normal mode and DFU mode.
- In normal mode, the controller behavior is completely determined by the user programmable firmware that's stored in its internal flash.
- In DFU, the STM32 boots from a fixed internal boot ROM. This mode can only be used to manage the contents of the programmable flash.
When you recieve a new BlackIce-II board, it will be preprogrammed with the so-called "iceboot" firmware, and operate in normal mode.
If we want to set the BlackIce-II board in DFU mode, we need to remove the jump that is located between pins 14 and 16 of the 26-pins connector that's located on the same side as the USB ports.
The jumper is marked in yellow in the picture below:
dfu-util is utility that can be installed as part of a standard Linux distribution. However, there seems to be some issue with the STM32 micro controller that makes it incompatible.
This is why you need to used a patched version of dfu-util, which can be found in the following Github repo.
I've installed it as follows:
sudo apt-get install libusb-1.0.0 libusb-1.0.0-dev
git clone https://github.com/mystorm-org/dfu-util.git
cd dfu-util
./autogen.sh
./configure --prefix=/usr/local
make
sudo make install
Let's first check if there's a DFU attached to the computer:
sudo dfu-util -l
You should see something like this:
ubuntu@ubuntu-xenial:~/projects/BlackIce-II$ sudo dfu-util -l
dfu-util 0.9
Copyright 2005-2009 Weston Schmidt, Harald Welte and OpenMoko Inc.
Copyright 2010-2016 Tormod Volden and Stefan Schmidt
This program is Free Software and has ABSOLUTELY NO WARRANTY
Please report bugs to http://sourceforge.net/p/dfu-util/tickets/
Found DFU: [0483:df11] ver=2200, devnum=14, cfg=1, intf=0, path="1-1", alt=3, name="@Device Feature/0xFFFF0000/01*004 e", serial="207D32833141"
Found DFU: [0483:df11] ver=2200, devnum=14, cfg=1, intf=0, path="1-1", alt=2, name="@OTP Memory /0x1FFF7000/01*0001Ke", serial="207D32833141"
Found DFU: [0483:df11] ver=2200, devnum=14, cfg=1, intf=0, path="1-1", alt=1, name="@Option Bytes /0x1FFF7800/01*040 e", serial="207D32833141"
Found DFU: [0483:df11] ver=2200, devnum=14, cfg=1, intf=0, path="1-1", alt=0, name="@Internal Flash /0x08000000/0128*0002Kg", serial="207D32833141"
The STM32 provides 4 different DFU services. We are currently only interested in the one at the bottom, the internal flash.
We can see that the flash is located at address 0x08000000, and that it has 128 pages that are 2K bytes each (which corresponds to an expected 256KB of internal flash.)
Before reprogramming the flash content of a device, it's always a good idea to first make a backup.
dfu-util can be used to do exactly that with the following command:
sudo dfu-util -d 0483:df11 --alt 0 --dfuse-address 0x08000000 -U original_flash_contents.bin
This is the output on my system:
ubuntu@ubuntu-xenial:~/projects/BlackIce-II$ sudo dfu-util -d 0483:df11 --alt 0 --dfuse-address 0x08000000 -U original_flash_contents.bin
dfu-util 0.9
Copyright 2005-2009 Weston Schmidt, Harald Welte and OpenMoko Inc.
Copyright 2010-2016 Tormod Volden and Stefan Schmidt
This program is Free Software and has ABSOLUTELY NO WARRANTY
Please report bugs to http://sourceforge.net/p/dfu-util/tickets/
Opening DFU capable USB device...
ID 0483:df11
Run-time device DFU version 011a
Claiming USB DFU Interface...
Setting Alternate Setting #0 ...
Determining device status: state = dfuIDLE, status = 0
dfuIDLE, continuing
DFU mode device DFU version 011a
Device returned transfer size 2048
DfuSe interface name: "Internal Flash "
Limiting upload to end of memory segment, 262144 bytes
Upload [=========================] 100% 262144 bytes
Upload done.
Programming a new firmware is just as easy as reading it.
This is the command:
sudo dfu-util -d 0483:df11 --alt 0 --dfuse-address 0x08000000 -D ./firmware/iceboot/iceboot.raw
In the example above, I reprogram the iceboot.raw firmware that can be found in the BlackIce-II github repo.
You should see the following output:
ubuntu@ubuntu-xenial:~/projects/BlackIce-II$ sudo dfu-util -d 0483:df11 --alt 0 --dfuse-address 0x08000000 -D ./firmware/iceboot/iceboot.raw
dfu-util 0.9
Copyright 2005-2009 Weston Schmidt, Harald Welte and OpenMoko Inc.
Copyright 2010-2016 Tormod Volden and Stefan Schmidt
This program is Free Software and has ABSOLUTELY NO WARRANTY
Please report bugs to http://sourceforge.net/p/dfu-util/tickets/
dfu-util: Invalid DFU suffix signature
dfu-util: A valid DFU suffix will be required in a future dfu-util release!!!
Opening DFU capable USB device...
ID 0483:df11
Run-time device DFU version 011a
Claiming USB DFU Interface...
Setting Alternate Setting #0 ...
Determining device status: state = dfuIDLE, status = 0
dfuIDLE, continuing
DFU mode device DFU version 011a
Device returned transfer size 2048
DfuSe interface name: "Internal Flash "
Downloading to address = 0x08000000, size = 39320
Download [=========================] 100% 39320 bytes
Download done.
File downloaded successfully
To test the new firmware, unplug the USB cable, put the jumper back in place, replug the USB cable, and everything should be fine.