logo elektroda
logo elektroda
X
logo elektroda

LN882H UART flashing protocol documentation - Windows LN882H flasher with fast flash read

p.kaczmarek2 507 19
ADVERTISEMENT
📢 Listen (AI):
  • Screenshot of the SharpLN882HTool used to flash the LN882H microcontroller, showing a text-based interface with messages related to flash memory read and write over UART.
    LN882H is a WiFi & BT Wireless ARM Cortex-M4F SOC found in some IoT devices. LN882H features a simple UART flashing protocol that can be used to read and write flash memory contents, usually as part of the firmware change process or for development purposes.
    LN882H flashing protocol is mostly based on simple, plain-text ASCII commands, however, the flash data transfer is done via YModem.

    LN882H flashing protocol details
    First LN882H must be put in bootloader mode, this requires grounding a specific pin, as we've shown in previous guide. Once reboot is done (either via power off/on or RESET), LN882H will print a default identity string at 115200 baud:
    Code: C#
    Log in, to see the code

    This can be used to establish initial configuration and determine firmware version. Then it can be used to upload a compiled binary blob that will be stored in RAM and act like a temporary bootloader for our further operations:
    Code: C#
    Log in, to see the code

    Bootloader is sent via YModem protocol, which will not be covered here.
    In this case, the uploaded file is LN882H_RAM_BIN.bin from LN882H flashing tools. We can see the source code of similar loader in the SDK as well:
    https://github.com/openshwprojects/OpenLN882H/tree/master/project/bootcode/ramcode_dl
    The ramcode_ln882h.uvprojx can be used to compile RAM code in Keil.
    The main commands supported by RAM code can be seen in cmd_mode.c:
    Code: C / C++
    Log in, to see the code

    Those are the commands we can send over the UART once RAM code is running.
    So, let's consider some simple process, like full flash erase:
    Code: C#
    Log in, to see the code

    First the connection is established and RAM code is loaded. Then flash_erase_all is called, which will internally do just as simple ASCII command:
    Code: C#
    Log in, to see the code

    It just sends a command and consumes the output (command echo and results).
    So, if we want to see the ferase_all implementation, we should head to aforementioned table instead:
    Code: C / C++
    Log in, to see the code

    which, in this case is:
    Code: C / C++
    Log in, to see the code

    Code: C / C++
    Log in, to see the code

    Code: C / C++
    Log in, to see the code

    The same logic applies to other operations, like MAC address or GPIOs access:
    Code: C#
    Log in, to see the code

    Now, let's focus on more interesting things. First, flash write. That's how OpenLN882H can be flashed:
    Code: C#
    Log in, to see the code

    The procedure just changes the baud and sends the upload data via aforementioned RAM code, and then just sends the file through the same YModem protocol which was used to upload RAM code itself.
    The receival is done in file_mode.c:
    https://github.com/openshwprojects/OpenLN882H.../project/bootcode/ramcode_dl/main/file_mode.c
    Now, flash read is more interesting.
    Flash dump was originally done in a slow, round-about manner:
    Code: C / C++
    Log in, to see the code

    Flash was dumped as ASCII text (3 characters per byte - two hex digits and space):
    Code: C / C++
    Log in, to see the code

    This is very slow, but luckily, our contributor @insmod has recently changed the dump logic to use, among others, raw binary format:
    https://github.com/NonPIayerCharacter/OpenLN8...mmit/fc62bd2392bcd022b57b5ead14b04084a2456bfe
    Screenshot of the LN882H flashing tool showing a terminal with UART flash memory management commands.
    The following code uses 16-bit CRC for error checking, which was already implemented in the SDK.
    Here is the matching flash read code on C# side:
    Code: C#
    Log in, to see the code

    As you can see, there is no more ASCII string processing and everything is done at raw bytes data. Futhermore, CRC check is also done to make sure that received data is correct.
    By the way, it's also interesting to see how baud rate set is implemented - rather than doing it via UART command, the RAM code itself is modified:
    Code: C#
    Log in, to see the code

    The offsets where baud settings are stored were figured by comparing multiple builds with the different baud settings.



    Our simple LN882H flashing tool for Windows[/quote]
    Flasher is available for download here:
    https://github.com/openshwprojects/SharpLN882HTool
    It's already compiled for Windows.
    Package contains sample scripts/commands:
    - sample_dump_at_baud_460800.bat - sample firmware read (backup)
    - sample_erase.bat - sample flash erase (not really needed)
    - sample_write.bat - sample flash write (OpenLN882H binary, also included)
    - sample_terminal.bat - sample terminal mode
    Please open related .bat files for more details.
    Remember to put LN882H must be put in bootloader mode, as we've shown in previous guide.

    Summary
    This is how we managed to create improved C# tool for easy LN882H flashing with binaries automatically build by Github actions. You can download it here:
    https://github.com/openshwprojects/SharpLN882HTool
    Soon we'll take next step and integrate this features into our Easy Flasher, so stay tuned!

    Special thanks for @insmod for flash read optimization and @divadiow for testing!

    Cool? Ranking DIY
    Helpful post? Buy me a coffee.
    About Author
    p.kaczmarek2
    Moderator Smart Home
    Offline 
    p.kaczmarek2 wrote 12217 posts with rating 10156, helped 580 times. Been with us since 2014 year.
  • ADVERTISEMENT
  • #2 21613306
    divadiow
    Level 34  
    v37. yay!
    not tested anything yet. but..
    Screenshot of the “v37 yay” application interface with no tests or activity displayed.
  • #3 21613308
    p.kaczmarek2
    Moderator Smart Home
    It's just a placeholder, for now. Soon it will work, I'll post updates here.

    Added after 2 [hours] 45 [minutes]:

    @divadiow reading works I think
    LN882H UART flashing protocol documentation - Windows LN882H flasher with fast flash read
    Download: https://github.com/openshwprojects/BK7231GUIFlashTool
    Helpful post? Buy me a coffee.
  • #4 21613443
    divadiow
    Level 34  
    whaat. how. program closes at this point at any baud for me

    LN882H UART flashing protocol documentation - Windows LN882H flasher with fast flash read
  • ADVERTISEMENT
  • #6 21613459
    divadiow
    Level 34  
    report.wer from event viewer. no error in EF before quit

    Code: Text
    Log in, to see the code


    not seen this before with EF. let me try totally different machine to be sure. official flasher is still OK on same com port

    Added after 8 [minutes]:

    same on another machine. SharpTool v22 dumps OK as normal on both machines
  • ADVERTISEMENT
  • #7 21613515
    p.kaczmarek2
    Moderator Smart Home
    I will check in a moment


    LN882H UART flashing protocol documentation - Windows LN882H flasher with fast flash read

    Added after 14 [minutes]:

    pS: it looks like Problem Signature 09: System.IO.IOException
    for you
    Helpful post? Buy me a coffee.
  • #8 21613532
    divadiow
    Level 34  
    p.kaczmarek2 wrote:
    pS: it looks like Problem Signature 09: System.IO.IOException
    for you

    yes. researching.
  • #9 21613538
    p.kaczmarek2
    Moderator Smart Home
    Either it can't open file or can't open serial I guess... but RAMcode for flash read is embedded into binary by @insmod , I will do the same for flash later, for now i've added it as file.

    Maybe I should add realtime log dump to file
    Helpful post? Buy me a coffee.
  • #10 21613583
    divadiow
    Level 34  
    v41

    LN882H UART flashing protocol documentation - Windows LN882H flasher with fast flash read

    Computer screen showing “115200 read success” after 8 minutes.

    Added after 8 [minutes]:

    115200 read success

    Terminal window showing the message “115200 sukces odczytu” and a thread “Dodano po 8 minutach”.
  • #11 21613601
    p.kaczmarek2
    Moderator Smart Home
    I am removing those strange 5 second delays now. It seems to work without them well. Well, how could it not, considering that it still just waits for given reply in a loop... so, if there is no reply in given iteration, then it will just loop one more time

    Added after 1 [hours] 50 [minutes]:

    Strange, both flashers works at 115200, but at 230400 the window one fails ,while console one works, there must be one more problem to find for me
    LN882H UART flashing protocol documentation - Windows LN882H flasher with fast flash read
    Helpful post? Buy me a coffee.
  • ADVERTISEMENT
  • #12 21613720
    insmod
    Level 25  
    [postid:5beac62f1a][/postid:5beac62f1a]
    Perhaps this is .NET 3.5 problem? It can't handle $ string and {}?
  • #13 21613722
    p.kaczmarek2
    Moderator Smart Home
    That fragment was just me forgetting $ while adding more information to the string.
    Helpful post? Buy me a coffee.
  • #14 21613723
    insmod
    Level 25  
    Ah, ok. I just never had to work with .net version lower than 4.5
    And at work, we use the most recent one.
  • #15 21613745
    p.kaczmarek2
    Moderator Smart Home
    I am still investigating but my findings are very strange, I'm not even sure if it's not a fluke...

    Look.
    You know this fragment, right? That's where you RAM code sends the flash size, first 4 bytes.
    LN882H UART flashing protocol documentation - Windows LN882H flasher with fast flash read
    Now check out this. I copied Sharp Flasher code without changes again, right? To make sure I didn't break anything.

    Case 1: - called from UI Thread:
    LN882H UART flashing protocol documentation - Windows LN882H flasher with fast flash read
    Result:
    LN882H UART flashing protocol documentation - Windows LN882H flasher with fast flash read
    2MB - ok, correct.

    Case 2: - called from read thread:
    LN882H UART flashing protocol documentation - Windows LN882H flasher with fast flash read
    LN882H UART flashing protocol documentation - Windows LN882H flasher with fast flash read
    Garbage is read...

    Next attempts:
    LN882H UART flashing protocol documentation - Windows LN882H flasher with fast flash read
    LN882H UART flashing protocol documentation - Windows LN882H flasher with fast flash read
    It's reproductible.

    Futher comments:
    - baud 115200 works ok in all cases
    - the read issue starts after 115200 to faster baud switch, so YModem transfer to send ram code works
    - it does not seem that buffers are full when error happens, but maybe the baud switch to faster happens too late and first 4 bytes are lost?

    Added after 2 [minutes]:

    Didn't help:
    Code: C#
    Log in, to see the code
    Helpful post? Buy me a coffee.
  • #17 21613811
    p.kaczmarek2
    Moderator Smart Home
    I didn't check yet, I have to travel for a moment, I will check on another machine shortly. I carry LN882H with me.

    Currently I am fairly certain that read at bauds different than 115200 works only if called from UI thread, and not from read thread, and this is very suprising. It's like.... like baud change is too slow in case of new thread and it misses the first data send by RAM code. It would be interesting to see if it works with your ramcode with extra delay added before flash size send.
    Helpful post? Buy me a coffee.
  • #18 21613847
    insmod
    Level 25  
    >>21613811
    This ramcode is just like the one used for writing/erase, but with custom read algorithm.
    That is why i'm asking if it can write, because for me - it froze on baud change, while writing "baudrate x" manually worked.
  • #19 21613866
    p.kaczmarek2
    Moderator Smart Home
    I didn't manage to do that much reliable testing but my general subjective feeling was that both read and write works only at 115200 baud. I didn't look into it at first because I assumed it's due another machine/low quality wires connection, but now I am not sure... I will test again soon, on my main machine.

    Main changes are on the main branch. My testing mess (second copy of flasher just copy-pasted into project) is on testmess branch https://github.com/openshwprojects/BK7231GUIFlashTool/tree/testmess
    Helpful post? Buy me a coffee.
📢 Listen (AI):

Topic summary

The LN882H is a WiFi and Bluetooth wireless System on Chip (SoC) based on the ARM Cortex-M4F core, commonly used in IoT devices. It supports a UART-based flashing protocol for firmware updates and flash memory access. The protocol uses simple ASCII commands for control, while the actual flash data transfer employs the YModem protocol. To initiate flashing, the LN882H must be placed into bootloader mode by grounding a specific pin and rebooting the device. Upon entering bootloader mode, the LN882H outputs a default identity string at 115200 baud rate, which can be monitored to confirm readiness. This UART flashing method facilitates firmware development and modification by enabling read and write operations on the device's flash memory.
Summary generated by the language model.
ADVERTISEMENT