Table of Contents
Wio-E5
This board has a package containing a STM32WLE5JC cortex-m4 microcontroller at 48 MHz.
The MCU does not contain a FPU, only the mandatory DSP for m4 cores, but it does have an embedded radio, it appears to be an SX1262.
STM32WLE5JC
RAM is in two 32K banks, which may be addressed separately or contiguously. The second bank has extended features when used separately.
256K FLASH 64K RAM AES 256 LoRa
There is a warning in the reference manual on page 185 of RM0461 Rev 5:
“The SMPS needs a clock to be functional. If for any reason this clock stops, the device may be destroyed.”
I probably would not have bothered with this board had I read the above warning beforehand. Who designs a MCU that can self destruct if a bit doesn't get set in error?
Test
The factory default firmware uses the serial link to issue `AT' commands to control the LoRa radio. These can be used to test the device and view its unique ID.
If you type anything other than AT then the device will hang and you must restart the connection. If you do type AT (either case) you then have a tiny amount of time to continue before it rejects the command. For testing you should copy and paste commands.
The firmware was designed to emulate the Hayes AT instruction set yet was clearly implemented by someone who never used a Hayes modem or RTFM.
picocom -b 9600 --echo --omap "crcrlf" /dev/ttyUSB1 AT+VER +VER: 4.0.11 AT+CH +CH: 3; 0,868100000,DR0,DR5; 1,868300000,DR0,DR5; 2,868500000,DR0,DR5; AT+POWER +POWER: 14 AT+POWER=TABLE +POWER: 16 14 12 10 8 6 4 2 AT+RXWIN2 +RXWIN2: 869525000,DR0 AT+RXWIN1 +RXWIN1: 3; 0,868100000; 1,868300000; 2,868500000; AT+ID +ID: DevAddr, XX:XX:XX:XX +ID: DevEui, 2C:F7:F1:20:XX:XX:XX:XX +ID: AppEui, 80:00:00:00:00:00:00:06
Once testing is complete we will erase the firwmare but if you do so there is no going back since it's not available in any format.
Programming
To program the board connect with a J-Link EDU Mini. This will require an adapter of some sort.
Warning: This process will erase the write protected firmware and this is non-recoverable.
NB when removing protection, the device will need to be power cycled afterwards.
/opt/JLink/JLinkExe SEGGER J-Link Commander V7.84 (Compiled Dec 14 2022 16:05:25) DLL version V7.84, compiled Dec 14 2022 16:04:57 Connecting to J-Link via USB...O.K. Firmware: J-Link EDU Mini V1 compiled Dec 7 2022 12:50:10 Hardware version: V1.00 J-Link uptime (since boot): 0d 00h 00m 12s S/N: 801011752 License(s): FlashBP, GDB USB speed mode: Full speed (12 MBit/s) VTref=3.278V Type "connect" to establish a target connection, '?' for help J-Link>connect Please specify device / core. <Default>: STM32F411RE Type '?' for selection dialog Device>STM32WLE5JC Please specify target interface: J) JTAG (Default) S) SWD T) cJTAG TIF>s Specify target interface speed [kHz]. <Default>: 4000 kHz Speed> Device "STM32WLE5JC" selected. Connecting to target via SWD ConfigTargetSettings() start J-Link script: ConfigTargetSettings() ConfigTargetSettings() end InitTarget() start Active read protection detected. Device will be unsecured now. Device unlocked successfully. InitTarget() end Found SW-DP with ID 0x6BA02477 DPIDR: 0x6BA02477 CoreSight SoC-400 or earlier AP map detection skipped. Manually configured AP map found. AP[0]: AHB-AP (IDR: Not set) AP[1]: AHB-AP (IDR: Not set) AP[0]: Core found AP[0]: AHB-AP ROM base: 0xE00FF000 CPUID register: 0x410FC241. Implementer code: 0x41 (ARM) Found Cortex-M4 r0p1, Little endian. FPUnit: 6 code (BP) slots and 2 literal slots CoreSight components: ROMTbl[0] @ E00FF000 [0][0]: E000E000 CID B105E00D PID 000BB000 SCS [0][1]: E0001000 CID B105E00D PID 003BB002 DWT [0][2]: E0002000 CID B105E00D PID 002BB003 FPB [0][3]: E0000000 CID B105E00D PID 003BB001 ITM [0][4]: E0040000 CID B105900D PID 000BB9A1 TPIU [0][6]: E0043000 CID B105900D PID 005BB906 CTI Memory zones: Zone: Default Description: Default access mode Cortex-M4 identified. J-Link>mem32 0x8000000 0x20 08000000 = FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF 08000010 = FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF 08000020 = FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF 08000030 = FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF 08000040 = FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF 08000050 = FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF 08000060 = FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF 08000070 = FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF
Erase
Connecting to the board using JLinkExe will remove protection and erase the firmware but this can also be done using a standalone tool.
NB when removing protection, the device will need to be power cycled afterwards.
/opt/JLink/JLinkSTM32Exe
SEGGER J-Link Unlock tool for STM32 devices
Compiled Dec 14 2022 16:07:39
(c) 2009-2015 SEGGER Microcontroller GmbH, www.segger.com
Solutions for real time microcontroller applications
This program is designed to reset the option bytes of a STM32 device to their factory settings. If read protection of the device is enabled, reset the option bytes will cause a mass erase.
Options:
[0] Exit
[1] STM32F0xxxx
[2] STM32F1xxxx
[3] STM32F2xxxx
[4] STM32F3xxxx
[5] STM32F4xxxx
[6] STM32F72xxx, STM32F73xxx
[7] STM32F74xxx, STM32F75xxx
[8] STM32F76xxx, STM32F77xxx
[9] STM32G0x0xx
[10] STM32G0x1xx
[11] STM32G4xxxx
[12] STM32H743_53_50
[13] STM32H745_47_55_57
[14] STM32L0xxxx
[15] STM32L1xxxx
[16] STM32L4xxxx
[17] STM32L5xxxx
[18] STM32U5xxxx
[19] STM32WBxxxx
[20] STM32WLxxxx
Please select the correct device family:
Clock
On reset the MCU uses the MSI clock at 4 MHz.
HSE
32MHz TCXO
PB0 TCXO VCC
LSE
32.768KHz
Antenna
Receiver
PA4 1 PA5 0
Transmitter with RFO_HP
PA4 0 PA5 1
SMPS mode.
Transmitter with RFO_LP
Not supported.
