wjd.nu

2023-08-24 - mch2022 badge / arduino ide / part 3 / leds and more

The colored LCD display on my living room HUD has reached its end-of-life. Time to replace it with an MCH2022 badge?

In the first two parts, we looked at interfacing with the serial output, reading the input button state and using the TFT display on the MCH2022 badge. In this post, we'll look at interfacing with the RP2040 where other components are hooked up to.

Interfacing with the RP2040

As seen with the buttons already, not everything on the badge is controlled by the ESP32 directly. The display is connected to an SPI bus. A Raspberry PI2040 (RP2040) is connected to an I²C bus. On that RP2040 various functions are implemented.

We we look at esp32-component-mch2022-rp2040/include/rp2040.h (or the implementation at mch2022-firmware-rp2040/i2c_peripheral.h) we can see that there are lots of other registers we can read from and write to. For instance, there is RP2040_REG_LCD_BACKLIGHT (the 0x04 element in the enum).

Step one is configuring the I²C bus:

#include <Wire.h>

#define GPIO_I2C_SDA 22
#define GPIO_I2C_SCL 21

Wire.begin(GPIO_I2C_SDA, GPIO_I2C_SCL);

And then, we can...

Set LCD backlight brightness

We can set the LCD backlight brightness:

#define RP2040_REG_LCD_BACKLIGHT 0x04

/**
 * Backlight brightness can be set from 0 (off) to 255.
 */
void set_backlight(uint8_t brightness) {
    Wire.beginTransmission(RP2040_ADDR);
    Wire.write(RP2040_REG_LCD_BACKLIGHT);
    Wire.write(brightness);
    Wire.endTransmission();
}

Read button presses

Check the button state — we did this already:

#define RP2040_REG_INPUT1 0x06

uint32_t read_inputs() {
  Wire.beginTransmission(RP2040_ADDR);
  Wire.write(RP2040_REG_INPUT1);
  Wire.endTransmission();
  Wire.requestFrom(RP2040_ADDR, 4);
  uint8_t values[4];
  values[0] = Wire.read(); // RP2040_REG_INPUT1 / I2C_REGISTER_INPUT1
  values[1] = Wire.read(); // RP2040_REG_INPUT2 / I2C_REGISTER_INPUT2
  values[2] = Wire.read(); // RP2040_REG_INTERRUPT1 / I2C_REGISTER_INTERRUPT1
  values[3] = Wire.read(); // RP2040_REG_INTERRUPT2 / I2C_REGISTER_INTERRUPT2
  // ...
}

Send infrared (transmitter on the back)

On the back of the badge there is an IR-transmitter. We can have the RP2040 send remote control signals and use the badge as a remote for the TV.

#define RP2040_REG_IR_ADDRESS_LO 0x60

/**
 * Supports extended NEC (NECext/NECX) remote control codes. See:
 * https://en.wikipedia.org/wiki/Consumer_IR
 * https://github.com/flipperdevices/flipperzero-firmware/blob/
 *   52b59662627254ae5ccde6201b5c4921573fc769/documentation/file_formats/InfraredFileFormats.md
 */
void send_ir_nec(uint16_t address, uint16_t command) {
  Wire.beginTransmission(RP2040_ADDR);
  Wire.write(RP2040_REG_IR_ADDRESS_LO);
  Wire.write(address & 0xFF);
  Wire.write(address >> 8);
  Wire.write(command);
  Wire.write(0x01); /* trigger */
  Wire.endTransmission();
}

We can map the joystick keys to useful functions:

void loop() {
  if (!digitalRead(GPIO_INT_RP2040)) {
    uint32_t input = read_inputs();
    if (BUTTON_RELEASED(input, BTN_HOME)) {
      return_to_launcher();
    /**
     * See these LG codes:
     * https://github.com/Lucaslhm/Flipper-IRDB/blob/48f26b13715547d579a4f17a3fc0983a11d36776/TVs/LG/LG.ir
     * > name: Power
     * > type: parsed
     * > protocol: NEC
     * > address: 04 00 00 00
     * > command: 08 00 00 00
     */
    } else if (BUTTON_PRESSED(input, BTN_START)) {
      send_ir_nec(0x04, 0x08); // LG and others: power (on/off)
    } else if (BUTTON_PRESSED(input, BTN_LEFT)) {
      send_ir_nec(0x04, 0x01); // LG and others: chan-down
    } else if (BUTTON_PRESSED(input, BTN_RIGHT)) {
      send_ir_nec(0x04, 0x00); // LG and others: chan-up
    } else if (BUTTON_PRESSED(input, BTN_UP)) {
      send_ir_nec(0x04, 0x02); // LG and others: vol-up
    } else if (BUTTON_PRESSED(input, BTN_DOWN)) {
      send_ir_nec(0x04, 0x03); // LG and others: vol-down
    } else if (BUTTON_PRESSED(input, BTN_JOY)) {
      send_ir_nec(0x04, 0x09); // LG and others: mute (on/off)
    } else {
      Serial.printf("input: 0x%08x // 0x<button><state>\r\n", input);
    }
  }
  // ...
}

Unfortunately it is currently limited to sending (extended) NEC codes. If we want to send different protocols, like the Philips RC-5 protocol, we'll need to add such functionality to the RP2040 firmware.

Get battery state

#define RP2040_REG_ADC_VALUE_VBAT_LO 0x0d
#define RP2040_REG_CHARGING_STATE 0x15

/**
 * Get charging state.
 */
void get_battery_state(bool& charging, float& voltage) {
  const float conversion_factor = 3.3f / (1 << 12); /* 12-bit ADC with 3.3v vref */
  uint16_t raw_voltage;
  Wire.beginTransmission(RP2040_ADDR);
  Wire.write(RP2040_REG_ADC_VALUE_VBAT_LO);
  Wire.endTransmission();
  Wire.requestFrom(RP2040_ADDR, 2);
  raw_voltage = (Wire.read() | (Wire.read() << 8));
  voltage = raw_voltage * conversion_factor * 2; /* Connected through 100k/100k divider */

  Wire.beginTransmission(RP2040_ADDR);
  Wire.write(RP2040_REG_CHARGING_STATE);
  Wire.endTransmission();
  Wire.requestFrom(RP2040_ADDR, 2);
  charging = (bool)Wire.read();
  raw_voltage = (Wire.read() | (Wire.read() << 8));
}

Showing this on the screen:

void update_display() {
  // ...
  canvas->setCursor(0, 0);
  canvas->setTextColor(ILI9341_WHITE);
  canvas->setTextSize(1);
  canvas->print(voltage);
  canvas->print(" (V)");
  if (charging) {
    canvas->print(" charging");
  }
  // ...
}

Control the kite LEDs

There are 5 LEDs in a kite layout on the top left of the badge. The Badge.team documentation luckily already mentioned that it has to be activated after initializing the display — hence init_leds_after_display(). But we'll need to actually get them to update their state. This is done by calling FastLED.show().

Here are the parts you need:

#include <FastLED.h> /* library to interface with SK9822 (and other) leds */

#define GPIO_LED_DATA 5
#define GPIO_SD_PWR 19
#define GPIO_LED_ENABLE GPIO_SD_PWR /* enables power to both SD and LEDs */
#define NUM_LEDS 5

/* LED configuration of the kite on the top left:
 *   _2_                       _0_
 *  / | \                     / | \
 * 0--1--3  == reordered =>  1--2--3
 *  \ | /                     \ | /
 *   \|/                       \|/
 *    4                         4 */
CHSV led_color[NUM_LEDS];
CRGB leds[NUM_LEDS];
const int led_reorder[NUM_LEDS] = {2, 0, 1, 3, 4}; /* left-to-right */

void setup() {
  // ...
  init_leds_after_display();

  /* Initialize the 5 LED colors at a slight offset, so we get a wave. */
  for (int i = 0; i < NUM_LEDS; ++i) {
    led_color[led_reorder[NUM_LEDS - i - 1]].hue = ((i * 8) % 256);
    led_color[i].saturation = 255;
    led_color[i].value = 255;
  }
}

void loop() {
  // ...
  change_leds();
}

void init_leds_after_display() {
  FastLED.addLeds<SK6812, GPIO_LED_DATA, GRB>(leds, NUM_LEDS).setCorrection(TypicalLEDStrip);
  FastLED.setBrightness(96);

  /* This has to be placed after SPI (LCD) has been initialized. The
   * Arduino library wants to use this pin as SPI MISO... */
  pinMode(GPIO_LED_ENABLE, OUTPUT);
  digitalWrite(GPIO_LED_ENABLE, HIGH);
}

/**
 * Update the kite LEDs. Loop over the colors of the rainbow.
 */
void change_leds() {
  /* This would set the first LED to white. */
  //leds[0] = CRGB::White;

  /* This merely sets all of the LEDs local storage (leds[]) to the new value. */
  for (int i = 0; i < NUM_LEDS; ++i) {
    led_color[led_reorder[i]].hue = ((led_color[led_reorder[i]].hue + 1) % 256);
    hsv2rgb_rainbow(led_color[i], leds[i]);
  }

  /* This uses the leds[] values and notifies the SK6812 of the new colors. */
  FastLED.show();
}

Compiling with FastLED.h will show a warning:

No hardware SPI pins defined.  All SPI access will default to bitbanged output

That is a fact, and it is no problem. It just means that changing LED colors will take more than a few microseconds (but not milliseconds). Luckily there are only a few of them.

To the right of the display, there is actually also a sixth LED. It's a 5050 RGB. It's not controlled by the ESP32 or the RP2040, but it's connected to the ICE40 FPGA through separate R, G and B pins.

I don't have the know-how to explain what an FPGA even is, nor do I know how to interface with it yet. Getting that sixth LED to work will be for a future post, if ever.

Putting it all together

Here's a downloadable version of the hello-display-plus.ino sketch that contains all of the above code. If you've read parts 1 and 2 of this blog series, you should now know how to get it to work.

2023-08-23 - mch2022 badge / arduino ide / part 2 / display

The colored LCD display on my living room HUD has reached its end-of-life. Time to replace it with an MCH2022 badge?

In the previous blog post, we explored how to upload and start a simple "hello world" sketch programmed in the Arduino IDE to the MCH2022 badge. In this one, we look at writing to the 320x240 display.

As mentioned in the previous post, the documentation for building MCH2022 badge apps with the Arduino IDE is incomplete. Notably the mentioned LCD_FREQ is undefined, and more importantly the steps to select video output through GPIO_LCD_MODE is missing.

Here are the changes in relation to the hello-serial sketch from the previous post. I also added a screen buffer (canvas), which you'll likely want to employ.

--- hello-serial/hello-serial.ino
+++ hello-display/hello-display.ino
@@ -6,6 +6,9 @@
 /* Needed for *_inputs() */
 #include <Wire.h>
 
+/* Needed for *_display() */
+#include <Adafruit_ILI9341.h> /* Adafruit ILI9341 library */
+
 /* Workaround to skip esp_ota_get_running_partition() */
 extern "C" bool verifyRollbackLater() {
   return true;
@@ -18,9 +21,14 @@ extern "C" bool verifyRollbackLater() {
 #define GPIO_I2C_SCL 21
 #define GPIO_INT_RP2040 34 /* active LOW */
 
+#define GPIO_SPI_CS_LCD 32
+#define GPIO_SPI_DC_LCD 33
+#define GPIO_LCD_RESET 25
+#define GPIO_LCD_MODE 26
+
 /* I2C addresses */
 #define RP2040_ADDR 0x17 /* RP2040 co-processor */
 
 /* See RP register addresses here:
  *   https://github.com/badgeteam/esp32-component-mch2022-rp2040/
  *     blob/45fce00c790a2918bf506dd8af0c0b68db05d031/include/rp2040.h
@@ -53,13 +61,19 @@ extern "C" bool verifyRollbackLater() {
 
 void init_inputs();
 uint32_t read_inputs();
+void init_display();
+void update_display();
 void return_to_launcher();
 
+Adafruit_ILI9341 tft = Adafruit_ILI9341(GPIO_SPI_CS_LCD, GPIO_SPI_DC_LCD, GPIO_LCD_RESET);
+GFXcanvas16* canvas; /* uses malloc(); cannot be initialized statically */
+
 void setup() {
   Serial.begin(115200);
   Serial.println("hello MCH2022");
 
   init_inputs();
+  init_display();
 }
 
 void loop() {
@@ -71,6 +85,10 @@ void loop() {
       Serial.printf("input: 0x%08x // 0x<button><state>\r\n", input);
     }
   }
+
+  //unsigned long t0 = millis();
+  update_display(); // takes about 60ms (= 17Hz)
+  //Serial.printf("updating display took %lu ms\r\n", millis() - t0);
 }
 
 void init_inputs() {

Aside from that diff, the definitions of init_display and update_display:

void init_display() {
  pinMode(GPIO_LCD_MODE, OUTPUT);
  digitalWrite(GPIO_LCD_MODE, LOW); /* set "ESP32" output instead of "FPGA" */

  tft.begin();
  tft.fillScreen(ILI9341_BLACK);
  tft.setRotation(1);

  /* Using a buffer is slightly slower than writing directly. But it's
   * significantly easier to avoid flicker. */
  canvas = new GFXcanvas16(ILI9341_TFTHEIGHT, ILI9341_TFTWIDTH); /* 16-bit, 320x240 */
  canvas->setRotation(0);
}

void update_display() {
  static int x = 0;
  static int y = 0;

  canvas->fillScreen(ILI9341_PURPLE);
  canvas->setCursor(x, y);
  canvas->setTextColor(ILI9341_YELLOW);
  canvas->setTextSize(3);
  canvas->print("MCH2022");

  /* Move the text for the next round */
  x += 16;
  if (x >= ILI9341_TFTHEIGHT) {
    y += 24;
    x = 0;
    if (y >= ILI9341_TFTWIDTH) {
      y = 0;
    }
  }

  tft.drawRGBBitmap(0, 0, canvas->getBuffer(), canvas->width(), canvas->height());
}

For a long while, I only got a white-ish blank screen. Getting that pinMode(GPIO_LCD_MODE, OUTPUT); and digitalWrite(GPIO_LCD_MODE, LOW); in there was critical to get the display to behave.

A nice Makefile helps too, for quick building/uploading:

PROJECT := $(notdir $(CURDIR))
FQBN := esp32.esp32.esp32wrover
BINARY := build/$(FQBN)/$(PROJECT).ino.bin

.PHONY: upload
upload: build
        ~/Arduino/projmch2022/mch2022-tools/app_push.py \
          --run $(BINARY) 'my_cool_app' main.bin 1

.PHONY: build
build: $(BINARY)

$(BINARY): $(PROJECT).ino
        arduino-cli compile -eb esp32:esp32:esp32wrover $(CURDIR)

(Don't forget to convert 8 spaces to tabs in any Makefile.)

2023-08-22 - mch2022 badge / arduino ide / part 1 / serial

The colored LCD display on my living room HUD has reached its end-of-life. Time to replace it with an MCH2022 badge?

The HUD I have in my living room is a breadboard with an ESP8266 development board, some sensors and a Grove 16x2 LCD I2C display. The background color of the display nicely visualizes current power production/usage, but the bottom row of text has now become defunct.

I could attempt to find a new LCD component at the closest electronics shop. But I also happen to have a bunch of MCH2022 badges laying around, after the company paid trip there last year. Maybe I could use one of those instead. It has a 320x240 full color display and various free pins. And an on-board ESP32. The existing ESP8266 code should run more than fine on that.

The Badge development documentation lists Arduino as a possible route. This would allow me to reuse most of my existing HUD code. Unfortunately the page says: “PLEASE BE AWARE THAT THE ARDUINO SDK IS NOT FULLY SUPPORTED!! YOU MAY RUN INTO SOME ISSUES”

They were not wrong...

Steps

The steps listed are:

• Install the Arduino IDE if you haven’t already — do use version 2.x and not 1.x (because it's old, unless you want to do a lot of serial monitoring, in which case you probably want sermon anyway (see below).
• Install ESP32 support using these instructions — from "esp32" select the "ESP32 Wrover Module" board.
• Download mch2022-tools — you'll be needing app_push.py and its prerequisites: the files next to it, and python3-usb.

You can write an Arduino sketch, and then instead of Upload you instead do an Export Compiled Binary (ctrl+alt+S). You upload the .bin to the MCH2022 appfs like this:

$ .../app_push.py --run <binfile> <name> <title> <version>

Hello world

We start off with this hello-serial project:

void setup() {
  Serial.begin(115200);
  Serial.println("hello MCH2022");
}

void loop() {
  Serial.println(millis());
  delay(1000);
}

Building and exporting with ctrl+alt+S gives us this output:

...
Compiling sketch...
~/.arduino15/packages/esp32/tools/xtensa-esp32-elf-gcc/esp-2021r2-patch5-8.4.0/bin/xtensa-esp32-elf-g++ ... -o /tmp/arduino/sketches/2EA640295D81B35604C751A774B1A1FE/sketch/hello-serial.ino.cpp.o
Compiling libraries...
Compiling core...
bash -c "echo -DARDUINO_CORE_BUILD >; /tmp/arduino/sketches/2EA640295D81B35604C751A774B1A1FE/file_opts"
Using precompiled core: /tmp/arduino/cores/cb14c27b7a099bfbee683e2ff88af527/core.a
bash -c ": > /tmp/arduino/sketches/2EA640295D81B35604C751A774B1A1FE/file_opts"
Linking everything together...
~/.arduino15/packages/esp32/tools/xtensa-esp32-elf-gcc/esp-2021r2-patch5-8.4.0/bin/xtensa-esp32-elf-g++ -Wl,--Map=/tmp/arduino/sketches/...
python3 ~/.arduino15/packages/esp32/tools/esptool_py/4.5.1/esptool.py --chip esp32 elf2image --flash_mode dio --flash_freq 80m --flash_size 4MB --elf-sha256-offset 0xb0 -o /tmp/arduino/sketches/2EA640295D81B35604C751A774B1A1FE/hello-serial.ino.bin /tmp/arduino/sketches/2EA640295D81B35604C751A774B1A1FE/hello-serial.ino.elf
esptool.py v4.5.1
Creating esp32 image...
Merged 2 ELF sections
Successfully created esp32 image.
python3 ~/.arduino15/packages/esp32/hardware/esp32/2.0.11/tools/gen_esp32part.py -q /tmp/arduino/sketches/2EA640295D81B35604C751A774B1A1FE/partitions.csv /tmp/arduino/sketches/2EA640295D81B35604C751A774B1A1FE/hello-serial.ino.partitions.bin
bash -c "[ ! -d \"/tmp/arduino/sketches/2EA640295D81B35604C751A774B1A1FE\"/libraries/Insights ] || python3 \"~/.arduino15/packages/esp32/hardware/esp32/2.0.11\"/tools/gen_insights_package.py /tmp/arduino/sketches/2EA640295D81B35604C751A774B1A1FE hello-serial.ino \"~/Arduino/projmch2022/hello-serial\""
bash -c "[ 0 -eq 0 ] || cp -f \"~/.arduino15/packages/esp32/tools/openocd-esp32/v0.11.0-esp32-20221026/share/openocd/scripts/\"board/esp32-wrover-kit-3.3v.cfg \"~/Arduino/projmch2022/hello-serial\"/debug.cfg"
bash -c "[ 0 -eq 0 ] || cp -f \"~/.arduino15/packages/esp32/hardware/esp32/2.0.11\"/tools/ide-debug/esp32.json \"~/Arduino/projmch2022/hello-serial\"/debug_custom.json"
bash -c "[ 0 -eq 0 ] || cp -f \"~/.arduino15/packages/esp32/hardware/esp32/2.0.11\"/tools/ide-debug/svd/esp32.svd \"~/Arduino/projmch2022/hello-serial\"/debug.svd"

~/.arduino15/packages/esp32/tools/xtensa-esp32-elf-gcc/esp-2021r2-patch5-8.4.0/bin/xtensa-esp32-elf-size -A /tmp/arduino/sketches/2EA640295D81B35604C751A774B1A1FE/hello-serial.ino.elf
Sketch uses 281621 bytes (21%) of program storage space. Maximum is 1310720 bytes.
Global variables use 21480 bytes (6%) of dynamic memory, leaving 306200 bytes for local variables. Maximum is 327680 bytes.

We now have these files:

$ ls -og hello-serial/build/esp32.esp32.esp32wrover/
total 4589
-rw-rw-r-- 1  281984 aug 21 23:44 hello-serial.ino.bin
-rw-rw-r-- 1   18992 aug 21 23:44 hello-serial.ino.bootloader.bin
-rwxrwxr-x 1 6050184 aug 21 23:44 hello-serial.ino.elf
-rw-rw-r-- 1 9089963 aug 21 23:44 hello-serial.ino.map
-rw-rw-r-- 1    3072 aug 21 23:44 hello-serial.ino.partitions.bin

Uploading:

$ .../app_push.py --run \
    hello-serial/build/esp32.esp32.esp32wrover/hello-serial.ino.bin \
    my_cool_app main.bin 1

The results:

Failed to start app.
Check console for more details.
App: my_cool_app

So, the app does get uploaded. But it fails to start for some reason or the other.

A crashing app

Luckily the badge is robust: it handles that the app fails, reports the failure and gets back into a working start by pressing A. Our "my_cool_app" app can be found under "Apps" where we can retry starting it, but not before hooking up a serial console (see sermon below):

$ sermon -t /dev/ttyACM0 115200
sermon [-t] DEV BAUD; now listening on /dev/ttyACM0 with 115200 baud
00:08:08.085638: E (127) esp_core_dump_flash: No core dump partition found!
00:08:08.219348: E (128) esp_core_dump_flash: No core dump partition found!
00:08:08.224508:
00:08:08.224691: abort() was called at PC 0x400d6309 on core 0
00:08:08.228778:
00:08:08.228933:
00:08:08.229113: Backtrace: 0x40083495:0x3ffbc160 0x400893d5:0x3ffbc180 0x4008e1b1:0x3ffbc1a0 0x400d6309:0x3ffbc220 0x400d2088:0x3ffbc240 0x400d2d1e:0x3ffbc270 0x400f2fd4:0x3ffbc2a0
00:08:08.243526:
00:08:08.243700:
00:08:08.243879:
00:08:08.244054:
00:08:08.244211: ELF file SHA256: e104f0bd5a9e7c1a
00:08:08.247249:
00:08:08.247409: E (150) esp_core_dump_flash: Core dump flash config is corrupted! CRC=0x7bd5c66f instead of 0x0
00:08:08.255852: Rebooting...
00:08:08.731141: I (473) psram: This chip is ESP32-D0WD
...

Starting the app again yielded the above messages in the serial monitor. It looks like abort() is called because of something, after which the device is reboooted. The I line marks the first log of the Launcher (Home) application.

That backtrace will give us sufficient clues to go on, but we'll need some means to figure out where those addresses are. If we had installed the Expressif tools, we would have a bunch of binaries in ~/.espressif/tools/xtensa-esp32-elf/.../bin/, like xtensa-esp32-elf-addr2line, xtensa-esp32-elf-gdb and xtensa-esp32-elf-objdump. Now I could only find objdump as ~/.arduino15/packages/esp32/tools/.../bin/objdump.

objdump is not addr2line, but we can use its output to find function locations with a helper script objdump-syms-addr2line:

#!/usr/bin/perl
# Replacement for addr2line that uses "objdump --syms" output
#
# Why: because you might have objdump but not addr2line
#
# Example:
#   $ objdump --syms bin.elf | objdump-syms-addr2line 0x400d2d1e 0x400f2fd4
#   0x400d2d1e app_main [0x400d2d0c+50]
#   0x400f2fd4 main_task [0x400f2f60+128]
#
# Alternative (if you have it):
#   $ addr2line -Cfe bin.elf 0x400d2d1e 0x400f2fd4 | sed -e '0~2s/^/  /'
#   app_main
#     ~/.arduino15/packages/esp32/hardware/esp32/2.0.11/cores/esp32/main.cpp:70
#   main_task
#     /Users/ficeto/Desktop/ESP32/ESP32S2/esp-idf-public/components/freertos...
#
use warnings;
my %l = ();
my %f = ();
for (<STDIN>) {
    # 400d63f4 l     F .flash.text    000000c2 esp_ota_current_ota_is_workable
    if (/^([0-9a-f]+)\s+(\S+\s+){3}([0-9a-f]+)\s+(\S+)/ and hex($1)) {
        $l{hex($1)} = hex($3);
        $f{hex($1)} = $4;
    }
}
foreach (@ARGV) {
    my ($i, $x) = (hex, undef);
    foreach my $s (keys %l) {
        if ($s <= $i and $i < ($s + $l{$s})) {
            $x = $s;
            last;
        }
    }
    if ($x) {
        printf("0x%08x %s [0x%x+%d]\n", $i, $f{$x}, $x, $l{$x});
    } else {
        print "0x".hex($i)."  <unknown>\n";
    }
}

(Next time I should probably check all of find ~/.arduino15/packages/esp32/tools/ -perm /0700 -type f -path '*/bin/*' for more tools.)

Using this script on the addresses from the backtrace, we get this:

$ ~/.arduino15/packages/esp32/tools/xtensa-esp32-elf-gcc/esp-2021r2-patch5-8.4.0/xtensa-esp32-elf/bin/objdump \
    --syms hello-serial/build/esp32.esp32.esp32wrover/hello-serial.ino.elf | \
  objdump-syms-addr2line \
    0x40083495 0x400893d5 0x4008e1b1 0x400d6309 0x400d2088 0x400d2d1e 0x400f2fd4
0x40083495 panic_abort [0x40083480+29]
0x400893d5 esp_system_abort [0x400893d0+8]
0x4008e1b1 abort [0x4008e128+140]
0x400d6309 esp_ota_get_running_partition [0x400d62a0+108]
0x400d2088 initArduino [0x400d2080+348]
0x400d2d1e app_main [0x400d2d0c+50]
0x400f2fd4 main_task [0x400f2f60+128]

Good. Finally some useful clues.

esp_ota_get_running_partition

I cannot find the esp_ota_get_running_partition definition in the .arduino15 dir, but I can find initArduino where that function is invoked — in esp32-hal-misc.c:

void initArduino()
{
#ifdef CONFIG_APP_ROLLBACK_ENABLE
    if(!verifyRollbackLater()){
        const esp_partition_t *running = esp_ota_get_running_partition();
        esp_ota_img_states_t ota_state;
        if (esp_ota_get_state_partition(running, &ota_state) == ESP_OK) {
            if (ota_state == ESP_OTA_IMG_PENDING_VERIFY) {
                if (verifyOta()) {
                    esp_ota_mark_app_valid_cancel_rollback();
                } else {
                    log_e("OTA verification failed! Start rollback to the previous version ...");
                    esp_ota_mark_app_invalid_rollback_and_reboot();
                }
            }
        }
    }
#endif
    //init proper ref tick value for PLL (uncomment if REF_TICK is different than 1MHz)
    //ESP_REG(APB_CTRL_PLL_TICK_CONF_REG) = APB_CLK_FREQ / REF_CLK_FREQ - 1;
#ifdef F_CPU
    setCpuFrequencyMhz(F_CPU/1000000);
...

So, it looks like it bails out right after starting: initArduino() is invoked, verifyRollbackLater() returns false and then esp_ota_get_running_partition() calls abort because of an unexpected situation.

For normal ESP32 applications, this panic is not triggered. But the badge does something special when chainloading the second app — the Launcher (Home) app being the first one.

I figure we don't need any rollback. The badge handles bad apps just fine — as we noticed already — so we'll need to figure out a way to skip this code.

Fixing through sdkconfig.h

Avoiding the call to esp_ota_get_running_partition() can be done by unsetting/removing the CONFIG_APP_ROLLBACK_ENABLE define.

In ~/.arduino15/packages/esp32/.. ../tools/sdk/esp32/sdkconfig the config is seen, but this is not the active config:

CONFIG_BOOTLOADER_APP_ROLLBACK_ENABLE=y
CONFIG_APP_ROLLBACK_ENABLE=y

We cannot undefine it from our compilation unit. We have to alter sdkconfig.h. There are a bunch of those. We're using ~/.arduino15/packages/esp32/.. ../tools/sdk/esp32/qio_qspi/include/sdkconfig.h at the moment (see Tools > Flash Mode menu option):

// ...
#define CONFIG_BOOTLOADER_APP_ROLLBACK_ENABLE 1
// ...
#define CONFIG_APP_ROLLBACK_ENABLE CONFIG_BOOTLOADER_APP_ROLLBACK_ENABLE
// ...

By removing/commenting both we can build a new binary without the code that calls esp_ota_get_running_partition():

// ...
//#define CONFIG_BOOTLOADER_APP_ROLLBACK_ENABLE 1
// ...
//#define CONFIG_APP_ROLLBACK_ENABLE CONFIG_BOOTLOADER_APP_ROLLBACK_ENABLE
// ...

Build, Upload, Run. Don't worry about the screen not updating (showing "Connected to PC"). Check with sermon:

$ sermon -t /dev/ttyACM0 115200
sermon [-t] DEV BAUD; now listening on /dev/ttyACM0 with 115200 baud
[   455][I][esp32-hal-psram.c:96] psramInit(): PSRAM enabled
10:03:41.117540: hello MCH2022
10:03:41.118636: 480
10:03:42.117090: 1479
10:03:43.117141: 2479
...

Yes, victory! The app starts and appears to run fine. (Don't worry about any garbage showing up in the serial output during upload.)

Fixing from the project

Editing that sdkconfig.h is cumbersome. There must be a better way. And luckily there is. (Start by undoing your edits to sdkconfig.h if you haven't already.)

We could try to override the esp_ota_get_running_partition function itself, and have it return NULL instead of aborting:

extern "C" const esp_partition_t* esp_ota_get_running_partition() { return NULL; }

Alas, the linking step fails:

Linking everything together...
~/.arduino15/packages/esp32/tools/xtensa-esp32-elf-gcc/esp-2021r2-patch5-8.4.0/bin/xtensa-esp32-elf-g++ ... -o /tmp/arduino/sketches/2EA640295D81B35604C751A774B1A1FE/hello-serial.ino.elf
~/.arduino15/packages/esp32/tools/xtensa-esp32-elf-gcc/esp-2021r2-patch5-8.4.0/bin/../lib/gcc/xtensa-esp32-elf/8.4.0/../../../../xtensa-esp32-elf/bin/ld: ~/.arduino15/packages/esp32/hardware/esp32/2.0.11/tools/sdk/esp32/lib/libapp_update.a(esp_ota_ops.c.obj): in function `esp_ota_get_running_partition':
/Users/ficeto/Desktop/ESP32/ESP32S2/esp-idf-public/components/app_update/esp_ota_ops.c:533: multiple definition of `esp_ota_get_running_partition'; /tmp/arduino/sketches/2EA640295D81B35604C751A774B1A1FE/sketch/hello-serial.ino.cpp.o:~/Arduino/projmch2022/hello-serial/hello-serial.ino:3: first defined here
collect2: error: ld returned 1 exit status

That was to be expected. We're not using shared libraries, so we cannot have multiple functions with the same name.

But the verifyRollbackLater() function we saw earlier can be overridden. In fact, it's specifically tailored to be, through __attribute__((weak)). If we create one and have it return true, we'll also skip the call to esp_ota_get_running_partition() and achieve our goal:

extern "C" bool verifyRollbackLater() { return true; }

Add the above line to our sketch. This builds, and uploads. All is well!

Ending the application

Now we need a way to exit the application and return to the Launcher.

The Badge.team guys already helpfully added the relevant code. Reproduced here with some extra functionality for future reference:

/* Needed for return_to_launcher() */
#include <esp_system.h>
#include <soc/rtc.h>
#include <soc/rtc_cntl_reg.h>

/* Needed for *_inputs() */
#include <Wire.h>

/* Workaround to skip esp_ota_get_running_partition() */
extern "C" bool verifyRollbackLater() {
  return true;
}

/* See ESP PIN numbers here:
 * https://github.com/badgeteam/esp32-component-mch2022-bsp/
 *   blob/2da8dbd50679512058820b40bfd6d7a5c529b28c/include/mch2022_badge.h */
#define GPIO_I2C_SDA 22
#define GPIO_I2C_SCL 21
#define GPIO_INT_RP2040 34 /* active LOW */

/* I2C addresses */
#define RP2040_ADDR 0x17 /* RP2040 co-processor */

/* See RP register addresses here:
 *   https://github.com/badgeteam/esp32-component-mch2022-rp2040/
 *     blob/45fce00c790a2918bf506dd8af0c0b68db05d031/include/rp2040.h
 * Feed through:
 *   sed -e '1,/RP2040_REG_FW_VER/d;/}/,$d;s/,//' | awk '{printf "#define %s 0x%02x\n",$1,NR}'
 */
#define RP2040_REG_INPUT1 0x06

/* Buttons, accessible through the RP2040 through wire I2C */
#define BTN_HOME 0x0001   /* home */
#define BTN_MENU 0x0002   /* menu */
#define BTN_START 0x0004  /* start */
#define BTN_A 0x0008      /* accept */
#define BTN_B 0x0010      /* back */
#define BTN_RES0 0x0020   /* (RP2040_INPUT_FPGA_CDONE) */
#define BTN_RES1 0x0040   /* (RP2040_INPUT_BATTERY_CHARGING) */
#define BTN_SELECT 0x0080 /* select */
#define BTN_LEFT 0x0100   /* joy left */
#define BTN_JOY 0x0200    /* joy press */
#define BTN_DOWN 0x0400   /* joy down */
#define BTN_UP 0x0800     /* joy up */
#define BTN_RIGHT 0x1000  /* joy right */

#define BTN2STATE(button) (button & 0xffff)
#define BTN2BTN(button) ((button >> 16) & 0xffff)
#define BUTTON_PRESSED(button, compare) \
  ((BTN2BTN(button) & compare) && (BTN2STATE(button) & compare) == compare)
#define BUTTON_RELEASED(button, compare) \
  ((BTN2BTN(button) & compare) && (BTN2STATE(button) & compare) == 0)

void init_inputs();
uint32_t read_inputs();
void return_to_launcher();

void setup() {
  Serial.begin(115200);
  Serial.println("hello MCH2022");

  init_inputs();
}

void loop() {
  if (!digitalRead(GPIO_INT_RP2040)) {
    uint32_t input = read_inputs();
    if (BUTTON_RELEASED(input, BTN_HOME)) {
      return_to_launcher();
    } else {
      Serial.printf("input: 0x%08x // 0x<button><state>\r\n", input);
    }
  }
}

void init_inputs() {
  Wire.begin(GPIO_I2C_SDA, GPIO_I2C_SCL);
  pinMode(GPIO_INT_RP2040, INPUT);
  read_inputs();
}

uint32_t read_inputs() {
  Wire.beginTransmission(RP2040_ADDR);
  Wire.write(RP2040_REG_INPUT1);
  Wire.endTransmission();
  Wire.requestFrom(RP2040_ADDR, 4);
  /* state  = 0x20 + sum of all pressed buttons */
  uint16_t state = Wire.read() | (Wire.read() << 8);
  /* which_button = 1, 2, 4, 8, ... */
  uint16_t which_button = Wire.read() | (Wire.read() << 8);
  /* NOTE: which_button may hold more than one if the presses/releases
   * are registered "simultaneously" */
  return (which_button << 16 | state);
}

void return_to_launcher() {
  REG_WRITE(RTC_CNTL_STORE0_REG, 0);
  esp_restart();
}

You can now see buttons get pressed/depressed:

10:40:24.257248: input: 0x00080028 // 0x<button><state>
10:40:24.497229: input: 0x00080020 // 0x<button><state>

Note that this sketch still lacks the code to interface with the screen. That will be for another day...

sermon (serial-monitor)

As promised above, this sermon snippet is better than the crippled built-in Serial Monitor in Arduino IDE 2:

#!/bin/sh
# sermon (serial-monitor) -- more convenient for serial logs than screen(1)
set -eu
test "${1:-}" = '-t' && { with_ts=true; shift; } || with_ts=false
dev=${1:-/dev/ttyACM0}
baud=${2:-115200}
stty -F "$dev" "$baud" raw -clocal -echo || {
    echo "Usage: ${0##*/} [-t] DEV BAUD" >&2; exit 1; }
echo "${0##*/} [-t] DEV BAUD; now listening on $dev with $baud baud" >&2
if $with_ts; then
    exec perl -e 'use strict;use warnings;
      use Time::HiRes qw(gettimeofday);use POSIX qw(strftime);
      my ($nl,$t,$ut)=1;while(sysread STDIN,$b,1){
      if($nl){($t,$ut)=gettimeofday;syswrite STDOUT,
      (strftime "%H:%M:%S",localtime $t).(sprintf ".%06d: ",$ut);$nl=0}
      $nl=1 if $b eq "\n";syswrite STDOUT,$b}' <"$dev"
else
    exec cat "$dev"
fi

Usage example: sermon -t /dev/ttyACM0 115200