STM342WB55 after load last BLE stack (1.8.0) I can`t erase fw with STM32CubeProgrammer

Hi.

Using STM32CubeProgrammer I load last stm32wb5x_BLE_Stack_light_fw.bin, but when after that I try to run command -fwdelete, I get an error : "FUS_NOT_RUNNING".

I attach log file becose Idont understand whot is this.

But me application work fine and I see that stack is a last version.

Please help whot may bee .

I send call:

STM32_Programmer_CLI.exe -c port=usb1 -fwdelete -vb 3

I think the problem is in the BLE_stack_lignt of version 1.8.0.

For some reason he does not allow FUS to start.

And may be a starnge diffence of size between versions of stack:

- stm32wb5x_BLE_Stack_light_fw 1.5.0 have size 107696

- stm32wb5x_BLE_Stack_light_fw 1.6.0 have size 107096

- stm32wb5x_BLE_Stack_light_fw 1.7.0 have size 107096

- stm32wb5x_BLE_Stack_light_fw 1.8.0 have size 122596

Its a strange that the size of 1.8.0 is more than 15500 bytes.

[Remi QUINTIN]

I used my Nucleo board and load the stm32wb5x_BLE_Stack_light_fw.bin (from V1.8.0 package) at 0x080D6000 and then the BLE_p2pServeur application and I was able to detect the board advertising using the android ST BLE sensor application on my mobile.

Then I delete the RF FW using the CubeProgrammer tool in GUI mode and manage to program the stm32wb5x_BLE_Stack_full_fw.bin binary (from V1.8.0 package) at 0x080CB000 without any issue. I still detect the board on my mobile.

Regarding the increase of the light stack size, I will check that point.

[Remi QUINTIN]

​The size increase results from the added support of the secure connections.

The problem is not that the stack is working. 1.8.0 works for me too.

The problem is that after loading 1.8.0 the stack, I can no longer erase or load nothing.

[Remi QUINTIN]

​You have to use the CubeProgrammer V2.5 and click on the "Firmware delete" button.

As I wrote I managed to erase the light RF stack and load a full new one from the same V1.8.0 package on my Nucleo board (1MB Flash memory).

I use that - not help for me.

It is a strange that 4 chips have same problem.

[Remi QUINTIN]

Indeed!

Can you download all the option bytes?

Are you able to read the FUS either in CLI or GUI mode (possible only via the USB port).

In last resort we could activate the safe boot which will reset the chip in its manufactory state.

But I would like first to get the option bytes to better understand the possible cause of this blocking situation.

Can you download all the option bytes? - to chip or from chip?

Are you able to read the FUS either in CLI or GUI mode (possible only via the USB port) - how to read FUS ?

[Remi QUINTIN]

​From the chip. Use the CubeProgrammer tool in GUI mode . You can also use the CLI mode.

On the last picture I attached to this thread, you can see a button "read FUS state". It works well when the USB port is used.

Reading FUS state:

and tis is a log for reading state:

19:48:02:586 : DFU status = 0

19:48:02:586 : DFU State = 9

19:48:02:587 : Status: 0, State: 9

19:48:02:587 : sending an abort request

19:48:02:588 : DFU status = 0

19:48:02:588 : DFU State = 2

19:48:02:588 : DFU status = 0

19:48:02:588 : DFU State = 2

19:48:02:588 : Status: 0, State: 2

19:48:02:589 : setting the address pointer to address: 0xffff0054

19:48:02:589 : DFU status = 0

19:48:02:589 : DFU State = 4

19:48:02:589 : DFU status = 0

19:48:02:589 : DFU State = 5

19:48:02:589 : data: 215400ffff

19:48:02:590 : DFU status = 0

19:48:02:590 : DFU State = 5

19:48:02:590 : sending an abort request

19:48:02:590 : DFU status = 0

19:48:02:590 : DFU State = 2

19:48:06:385 : FUS state is FUS_ERROR

19:48:06:386 : FUS status is FUS_NOT_RUNNING

19:48:06:386 : Reconnecting...

19:48:06:386 : Reconnecting...

19:48:06:416 : Reconnected

19:48:06:417 : Reconnected !

19:48:06:417 : Read FUS state command execution finished

[Remi QUINTIN]

​cli.exe -c port=usb1 -ob displ ... is the command to extract all options bytes

   -------------------------------------------------------------------

            STM32CubeProgrammer v2.5.0          

   -------------------------------------------------------------------

USB speed  : Full Speed (12MBit/s)

Manuf. ID  : STMicroelectronics

Product ID : DFU in FS Mode

SN     : 2058387A3036

FW version : 0x011a

Device ID  : 0x0495

Device name : STM32WBxx

Flash size : 1 MBytes

Device type : MCU

Device CPU : Cortex-M0+/M4

UPLOADING OPTION BYTES DATA ...

 Bank     : 0x00

 Address    : 0x1fff8000

 Size     : 128 Bytes

▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒ 0%

██████████████████████████████████████████████████ 100%

OPTION BYTES BANK: 0

  Read Out Protection:

   RDP     : 0xAA (Level 0, no protection) 

  BOR Level:

   BOR_LEV   : 0x0 (BOR Level 0 reset level threshold is around 1.7 V) 

  User Configuration:

   nBOOT0    : 0x1 (nBOOT0=1 Boot from main Flash) 

   nBOOT1    : 0x1 (Boot from Flash if nBoot0=0 otherwise system memory) 

   nSWBOOT0   : 0x1 (BOOT0 taken from PH3/BOOT0 pin) 

   SRAM2RST   : 0x1 (SRAM2 is not erased when a system reset occurs) 

   SRAM2PE   : 0x1 (SRAM2 parity check disable) 

   nRST_STOP  : 0x1 (No reset generated when entering the Stop mode) 

   nRST_STDBY  : 0x1 (No reset generated when entering the Standby mode) 

   nRSTSHDW   : 0x1 (No reset generated when entering the Shutdown mode) 

   WWDGSW    : 0x1 (Software window watchdog) 

   IWGDSTDBY  : 0x1 (Independent watchdog counter running in Standby mode) 

   IWDGSTOP   : 0x1 (Independent watchdog counter running in Stop mode) 

   IWDGSW    : 0x1 (Software independent watchdog) 

   IPCCDBA   : 0x0 (0x0) 

  Security Configuration Option bytes:

   ESE     : 0x0 (Security disabled) 

   SFSA     : 0xD6 (0xD6) 

   FSD     : 0x0 (System and Flash secure) 

   DDS     : 0x1 (CPU2 debug access disabled) 

   C2OPT    : 0x1 (SBRV will address Flash) 

   NBRSD    : 0x0 (SRAM2b is secure) 

   SNBRSA    : 0xF (0xF) 

   BRSD     : 0x0 (SRAM2a is secure) 

   SBRSA    : 0xA (0xA) 

   SBRV     : 0x35800 (0x35800) 

  PCROP Protection:

   PCROP1A_STRT : 0x1FF (0x80FF800) 

   PCROP1A_END : 0x0 (0x8000800) 

   PCROP_RDP  : 0x0 (PCROP zone is kept when RDP is decreased) 

   PCROP1B_STRT : 0x1FF (0x80FF800) 

   PCROP1B_END : 0x0 (0x8000800) 

  Write Protection:

   WRP1A_STRT  : 0xFF (0x80FF000) 

   WRP1A_END  : 0x0 (0x8000000) 

   WRP1B_STRT  : 0xFF (0x80FF000) 

   WRP1B_END  : 0x0 (0x8000000) 

[Remi QUINTIN]

Regarding the reading of the FUS state, the values are relevant when the FUS is active. One way to activate the FUS is to launch a command to the FUS, fwdelete for example. Th​en read the FUS state and version.

Regarding the option bytes, the RF stack seems to be correctly installed but the ESE = 0 means that the security is not enabled on this chip. I cannot clearly rely your issue to this configuration, but it is not a tested configuration at ST.

I would recommend getting rid of this chip and develop your application on a secure part (ESE = 1).

This is all good, but I'm tired of repeating that I cannot start FUS, the "fwdelete" command does not work, this can be seen from my many logs.

I earnestly ask you to perform the operations in steps as I described starting with the version of FUS 0.5.3.

Our steps:

1. Have a chip whith FUS 0.5.3

2. Ugrade FUS to 1.0.1 or 1.0.2

3. Upgrade FUS to 1.1.0

4. Immediately load last BLE stack light ver 1.8.0 - process was ok, but now command "fwdelete" not work and impossible load any FW (FUS or stack). But ESE bit checked.

I am sure that you will have the same after such steps.

[Remi QUINTIN]

​Ok I did the sequence on a dongle originally loaded with FUS v0.5.3, the upgraded to V1.0.2 and finally to V1.1.0.

I load the light BLE stack and the p2pserver application.

I was able to connect to the dongle.

Then I issue a fwdelete command and I got the right result. Everything worked well.

And how to do this: "In last resort we could activate the safe boot which will reset the chip in its manufactory state." ?

[Remi QUINTIN]

​As FUS version is V1.1.0, the revertion to the manufactory state can be achieved writing 0x00080000 at address 0x5800040C.

This is a PWR_CR4 ?

And write result is Error

Mey be need to write 0x00008000 (set C2BOOT) ? not 0x00080000.