SSH Stamp: Secure Remote UART Access with W6300-EVB-Pico2

SSH Stamp turns W6300-EVB-Pico2 into a secure UART bridge and improves MACRAW reliability for Embassy.

COMPONENTS Hardware components

WIZnet - W6300-EVB-Pico2

x 1

PROJECT DESCRIPTION

SSH Stamp on W6300-EVB-Pico2: A Secure UART Bridge over RP2350 Wired Ethernet

Summary

SSH Stamp is an open-source project that extends a conventional USB-to-UART debug adapter into an SSH-based remote-access tool. Its W6300-EVB-Pico2 port combines an RP2350 and a W6300 to provide secure remote UART access over wired Ethernet.

This is more than a board port. The current design uses the W6300 as a MACRAW Ethernet interface while the Embassy network stack handles DHCP, ARP, TCP, and network timers. It also identifies two MACRAW reliability cases that can be separated into small, reusable improvements for embassy-net-wiznet.

Project Architecture

Remote developer or automation host
        │
        │ SSH over wired Ethernet
        ▼
W6300 Ethernet controller
        │  MACRAW frames over PIO SPI
        ▼
RP2350 on W6300-EVB-Pico2
        │
        │ UART bridge
        ▼
Target MCU, serial console, or embedded equipment

In the W6300-EVB-Pico2 board configuration, the UART uses GPIO0 for TX and GPIO1 for RX. The W6300 interface is defined with INT=GPIO15, CS=GPIO16, SCK=GPIO17, IO0=GPIO18, IO1=GPIO19, and RESET=GPIO22.

The current port uses RP2350 PIO-driven SPI because of the hardware-SPI pin mapping constraints, operating at 8 MHz. Although the board also connects W6300 IO2 and IO3, the current SSH Stamp implementation does not use quad-SPI.

Why This Is Useful

UART consoles are important for initial setup, firmware validation, and troubleshooting. Both conventional serial-to-Ethernet devices and SSH Stamp can provide remote UART access.

Conventional Serial-to-Ethernet
PC ── TCP/UDP ── S2E Device ── UART ── Target MCU

SSH Stamp
PC ── SSH (authentication + encryption) ── SSH Stamp ── UART ── Target MCU

The main difference is not remote-access capability. SSH Stamp adds an SSH security layer before the UART connection.

When SSH Stamp Is Useful	Why It Helps
Remote debugging	Developers can use a standard SSH client to access the UART console.
Access control	SSH public-key authentication can limit access to authorized users.
Protected UART traffic	UART commands and logs are encrypted while crossing the network.
Test automation	Standard SSH tools and scripts can be used for remote console tasks.

UART consoles may expose boot logs, configuration commands, and debug functions. A conventional S2E device can forward this data over TCP or UDP, while SSH Stamp places authentication and encryption in front of the same UART path.

Using wired Ethernet rather than Wi-Fi can also simplify deployment in fixed installations, because it reduces dependence on RF conditions and access-point configuration.

W6300’s Role in the Current Implementation

This project does not directly use the W6300 hardware TCP/IP socket engine. Instead, the W6300 runs in MACRAW mode to send and receive Ethernet frames, while the Embassy software stack on the RP2350 handles higher-layer networking.

Layer	Component	Role
Application	SSH Stamp	Provides the SSH session and UART bridge
TCP/IP, DHCP, ARP	`embassy-net`	Handles IP configuration, ARP, TCP, and timers
Ethernet frame I/O	`embassy-net-wiznet` + W6300	Sends and receives MACRAW Ethernet frames
Hardware interface	RP2350 PIO SPI	Accesses W6300 registers and frame buffers
Physical network	W6300 PHY + RJ45	Provides the wired Ethernet link

In this port, the W6300 operates in MACRAW mode and transports Ethernet frames, while Embassy on the RP2350 handles DHCP, ARP, TCP, and network timers.

Network Startup and Fallback

SSH Stamp prepares its Ethernet connection in the following sequence:

It verifies that the W6300 version register contains the expected value, 0x11.
It checks PHY link status and waits up to 20 seconds for link-up.
It requests an address through DHCP and waits up to 45 seconds.
If DHCP fails, it falls back to the static address 192.168.4.1/24.
Once networking is ready, it connects the SSH session to the UART stream.

This fallback path is valuable in isolated test networks or field environments without a DHCP server.

What the Project Wants to Upstream

The W6300 driver and the basic W6300-EVB-Pico2 single-SPI example are already present in Embassy’s embassy-net-wiznet. The main contribution proposed by SSH Stamp is two MACRAW reliability improvements.

Area	Current upstream behavior	SSH Stamp local improvement
TX buffer wait	Can wait indefinitely for sufficient TX buffer space	Adds a one-second limit and task yielding, preventing a networking task from remaining blocked for too long
Corrupted RX length	A damaged length header can move the RX read pointer incorrectly	Detects lengths larger than the reported RX backlog and resynchronizes the RX buffer

The first change favors dropping one frame after a bounded wait rather than letting the entire networking task stall indefinitely.

The second matters when a corrupted MACRAW header reports an invalid frame length. Advancing the read pointer by that untrusted length can misalign all subsequent frames. The SSH Stamp patch compares the reported length with the current RX backlog, then clears and resynchronizes the affected RX region when the value is invalid.

These are not board-specific features; they can improve resilience for other W6300 projects using embassy-net-wiznet.

QSPI Is a Separate Next Step

The W6300-EVB-Pico2 exposes IO0 through IO3, leaving room for quad-SPI. However, SSH Stamp currently uses 8 MHz PIO single-SPI. Quad-SPI is separate upstream work, represented by the draft W6300 QSPI support pull request.

Already upstream
  └─ W6300 driver and W6300-EVB-Pico2 single-SPI support

SSH Stamp local changes
  ├─ Bounded wait and yield for MACRAW TX buffer pressure
  └─ RX-buffer resynchronization for corrupted frame lengths

Separate upstream work
  └─ W6300 quad-SPI support using IO2 and IO3

SSH Stamp therefore does not claim quad-SPI performance. Its value is in turning issues found during real board validation into small, reusable upstream reliability improvements.

Verified Scope and Limitations

The implementation is currently validated on hardware for wired link operation, DHCP, SSH sessions, and UART bridging. The following boundaries should remain clear:

The data path is W6300 MACRAW plus Embassy software TCP/IP.
It does not use the W6300 hardware TCP/IP socket engine.
The current interface is 8 MHz PIO single-SPI.
Quad-SPI using IO2 and IO3 is not part of the current operating path.
The MACRAW reliability changes are local vendor modifications; upstream acceptance remains subject to review.

Stating these limits clearly keeps the project focused on its real contribution: practical board validation and network-driver robustness rather than unsupported performance claims.

Conclusion

The SSH Stamp W6300-EVB-Pico2 port is not just an Ethernet UART bridge. It combines RP2350, W6300, Embassy networking, and SSH-based UART access into a practical path for remote debugging and embedded-device operations.

More importantly, it uses real MACRAW deployment experience to identify a bounded TX-buffer wait and recovery from corrupted RX frame lengths. By keeping these changes small and upstream-oriented, the project turns board-level validation into potential reliability improvements for the broader Embassy and WIZnet ecosystem.

Related WIZnet Maker Projects

References

Documents

Comments Write