Error upgrading wireless coprocessor firmware on Nucleo-68

[anddam]

I am experiencing an error while trying to upgrade a Nucleo-68 board from P-NUCLEO-WB55 wireless coprocessor to latest v1.7.0 firmware provided by STMicroelectronics/STM32CubeWB github repo.

I already reported the issue on the githb repo here is a copy of the issue:

**Describe the set-up**

Host OS: Linux glibc system

Board: P-NUCLEO-WB55 STM32WB55RG (Nucleo-68)

Tools:

 - STM32CubeProgrammer v2.4.0

 - SMT32CubeWB firmware images

**Describe the bug**

Trying to update the wireless coprocessor to latest v1.7.0 results in an error:

```

Error: failed to download Segment[0]

Error: failed to download the File

Error: Failed to download image!

```

**How To Reproduce**

1. clone `https://github.com/STMicroelectronics/STM32CubeWB`

2. enter the repository

3. checkout tag `v1.7.0`

4. cd `Projects/STM32WB_Copro_Wireless_Binaries/STM32WB5x/`

5. follow instructions at `How to flash the Wireless Coprocessor Binary via USB (Command Line Interface)` in file `Release_Notes.html` using STM32CubeProgrammer v2.4.0

**Additional context**

The *Update History* section of `Release_Notes.html` shows 1.6.0 changes as latest entry even on tag `v.1.7.0`. However checking out the repo at `v1.6.0` yields the same error result as `v1.7.0`.

The full log provided in the issue is attached here as well.

[Remi QUINTIN]

The fisrt delete command is OK. The FUS version is the most recent one: V1.1.0 and the erasure of all sectors required to be clean for the RF stack is OK.

Then I must admit I am quite puzzled by this unexpected error "fwupgrade Command Failure!"

Could you download the secure option bytes?

One trick I use from time to time to recover from such unexpected situation is to set the RDP level to 0xBB (level 1) end then back to 0xAA (level 0) to clean the user part of the flash (from 0x08000000 up to SFSA). Then upgrade the RF stack.

[anddam]

@Remi QUINTIN​ thanks for the hint, here are the option bytes:

OPTION BYTES BANK: 0
  Read Out Protection:
   RDP     : 0xAA (Level 0, no protection)
 
  […]
 
  Security Configuration Option bytes:
   ESE     : 0x1 (Security enabled)
   SFSA     : 0xF4 (0xF4)
   FSD     : 0x0 (System and Flash secure)
   DDS     : 0x1 (CPU2 debug access disabled)
   C2OPT    : 0x1 (SBRV will address Flash)
   NBRSD    : 0x0 (SRAM2b is secure)
   SNBRSA    : 0x10 (0x10)
   BRSD     : 0x1 (SRAM2a is non-secure)
   SBRSA    : 0x0 (0x0)
   SBRV     : 0x3D000 (0x3D000)

My issue is that once I sed RDP to 0xBB I am not able to set it back to 0xAA,

~ $ sudo stm32programmer -c port=usb1 -ob RDP=0xBB
      -------------------------------------------------------------------
                        STM32CubeProgrammer v2.4.0                  
      -------------------------------------------------------------------
USB speed   : Full Speed (12MBit/s)
Manuf. ID   : STMicroelectronics
Product ID  : DFU in FS Mode
SN          : 2074388B3036
FW version  : 0x011a
Device ID   : 0x0495
Device name : STM32WB55xx
Flash size  : 1 MBytes
Device type : MCU
Device CPU  : Cortex-M0+/M4
 
UPLOADING OPTION BYTES DATA ...
 
  Bank          : 0x00
  Address       : 0x1fff8000
  Size          : 128 Bytes
 
[==================================================] 100% 
 
 
PROGRAMMING OPTION BYTES AREA ...
 
  Bank          : 0x00
  Address       : 0x1fff8000
  Size          : 128 Bytes
 
[==================================================] 100% 
Verifying Read Out Protection...
Read Out Protection has been set successfully.
Device will be disconnected
 
~ $ sudo stm32programmer -c port=usb1 -rdu -ob displ
      -------------------------------------------------------------------
                        STM32CubeProgrammer v2.4.0                  
      -------------------------------------------------------------------
 
 
 
USB speed   : Full Speed (12MBit/s)
Manuf. ID   : STMicroelectronics
Product ID  : DFU in FS Mode
SN          : 2074388B3036
FW version  : 0x011a
Device ID   : 0x0495
Warning: Device is under Read Out Protection
 
Disabling memory Read Protection...
 
Error: Disabling memory Read Protection failed
Error: RDP level is set to 1 (0xBB), try using Read UnProtect (-rdu) command in order to remove the Read Out Protection.
 
~ $ sudo stm32programmer -c port=usb1 -ob RDP=0xAA
      -------------------------------------------------------------------
                        STM32CubeProgrammer v2.4.0                  
      -------------------------------------------------------------------
 
 
 
USB speed   : Full Speed (12MBit/s)
Manuf. ID   : STMicroelectronics
Product ID  : DFU in FS Mode
SN          : 2074388B3036
FW version  : 0x011a
Device ID   : 0x0495
Warning: Device is under Read Out Protection
Error: RDP level is set to 1 (0xBB), try using Read UnProtect (-rdu) command in order to remove the Read Out Protection.
 
~ $ sudo stm32programmer -c port=usb1 -ob RDP=0xAA -rdu
      -------------------------------------------------------------------
                        STM32CubeProgrammer v2.4.0                  
      -------------------------------------------------------------------
 
 
 
USB speed   : Full Speed (12MBit/s)
Manuf. ID   : STMicroelectronics
Product ID  : DFU in FS Mode
SN          : 2074388B3036
FW version  : 0x011a
Device ID   : 0x0495
Warning: Device is under Read Out Protection
Error: RDP level is set to 1 (0xBB), try using Read UnProtect (-rdu) command in order to remove the Read Out Protection.
 
 
Disabling memory Read Protection...
 
Error: Disabling memory Read Protection failed
~ $ sudo stm32programmer -c port=usb1 -rdu 
      -------------------------------------------------------------------
                        STM32CubeProgrammer v2.4.0                  
      -------------------------------------------------------------------
 
 
 
USB speed   : Full Speed (12MBit/s)
Manuf. ID   : STMicroelectronics
Product ID  : DFU in FS Mode
SN          : 2074388B3036
FW version  : 0x011a
Device ID   : 0x0495
Warning: Device is under Read Out Protection
 
Disabling memory Read Protection...
 
Error: Disabling memory Read Protection failed

Ho do I reset R

[Remi QUINTIN]

you should use either -rdu or 0xAA or you may unexpected result.

repeat this command if it fails.

then download the RF stack.

Check the option bytes regularly

[anddam]

> you should use either -rdu or 0xAA or you may unexpected result.

That is what I tried, right after the same command with 0xBB succesfully set read out protection.

See line 56 of my second code block, I tried

stm32programmer -c port=usb1 -ob RDP=0xAA

then following the programmer's output suggesting to use -rdu, I tried adding -rdu option and then just -rdu.

Today, apparently with nothing changed, a

 stm32programmer -c port=usb1 -rdu

yielded

 Disabling memory Read Protection...
 Memory Read Protection disabled successfully

and a following

  stm32programmer -c port=usb1 -rdu

 resulted in

PROGRAMMING OPTION BYTES AREA ...
Warning: Option Byte: rdp, value: 0xAA, was not modified.
Warning: Option Bytes are unchanged, Data won't be downloaded

As far as I can tell the -rdu alone was enough to set RDP back to level 0 (value 0xAA), without no need for an actual 0xAA set operation, like I understood in first place.

I figure what did the trick there was the disconnecting/reconnecting the device on USB bus.

Thanks for the replies.

[anddam]

After setting RDP to 0xBB and back to 0xAA I am still getting a an error, I can see the initial header with the board info

$ sudo stm32programmer -c port=usb1 -fwupgrade stm32wb5x_BLE_Stack_full_fw.bin 0x080CB000 firstinstall=1
      -------------------------------------------------------------------
                        STM32CubeProgrammer v2.4.0                  
      -------------------------------------------------------------------
 
 
 
USB speed   : Full Speed (12MBit/s)
Manuf. ID   : STMicroelectronics
Product ID  : DFU in FS Mode
SN          : 2074388B3036
FW version  : 0x011a
Device ID   : 0x0495
Device name : STM32WB55xx
Flash size  : 1 MBytes
Device type : MCU
Device CPU  : Cortex-M0+/M4

and this first upgrade error, notice how all blocks erase operations are succesful, yet it misteriously ends with "Error: fwupgrade Command Failure!"

Download firmware image at address 0x80cb000 ...
 
 
Memory Programming ...
Opening and parsing file: stm32wb5x_BLE_Stack_full_fw.bin
  File          : stm32wb5x_BLE_Stack_full_fw.bin
  Size          : 164816 Bytes
  Address       : 0x080CB000 
 
 
Erasing memory corresponding to segment 0:
Erasing internal memory sectors [203 243]
erasing sector 0203 @: 0x080cb000 done
erasing sector 0204 @: 0x080cc000 done
erasing sector 0205 @: 0x080cd000 done
erasing sector 0206 @: 0x080ce000 done
erasing sector 0207 @: 0x080cf000 done
erasing sector 0208 @: 0x080d0000 done
erasing sector 0209 @: 0x080d1000 done
erasing sector 0210 @: 0x080d2000 done
erasing sector 0211 @: 0x080d3000 done
erasing sector 0212 @: 0x080d4000 done
erasing sector 0213 @: 0x080d5000 done
erasing sector 0214 @: 0x080d6000 done
erasing sector 0215 @: 0x080d7000 done
erasing sector 0216 @: 0x080d8000 done
erasing sector 0217 @: 0x080d9000 done
erasing sector 0218 @: 0x080da000 done
erasing sector 0219 @: 0x080db000 done
erasing sector 0220 @: 0x080dc000 done
erasing sector 0221 @: 0x080dd000 done
erasing sector 0222 @: 0x080de000 done
erasing sector 0223 @: 0x080df000 done
erasing sector 0224 @: 0x080e0000 done
erasing sector 0225 @: 0x080e1000 done
erasing sector 0226 @: 0x080e2000 done
erasing sector 0227 @: 0x080e3000 done
erasing sector 0228 @: 0x080e4000 done
erasing sector 0229 @: 0x080e5000 done
erasing sector 0230 @: 0x080e6000 done
erasing sector 0231 @: 0x080e7000 done
erasing sector 0232 @: 0x080e8000 done
erasing sector 0233 @: 0x080e9000 done
erasing sector 0234 @: 0x080ea000 done
erasing sector 0235 @: 0x080eb000 done
erasing sector 0236 @: 0x080ec000 done
erasing sector 0237 @: 0x080ed000 done
erasing sector 0238 @: 0x080ee000 done
erasing sector 0239 @: 0x080ef000 done
erasing sector 0240 @: 0x080f0000 done
erasing sector 0241 @: 0x080f1000 done
erasing sector 0242 @: 0x080f2000 done
erasing sector 0243 @: 0x080f3000 done
Download in Progress:
[==================================================] 100% 
 
File download complete
Time elapsed during download operation: 00:00:06.395
 
FUS state is FUS_SERVICE_ONGOING
 
FUS status is FUS_IMAGE_NOT_FOUND
 
FUS state is FUS_IDLE
 
FUS status is FUS_NO_ERROR
 
Firmware Upgrade process started ...
 
Updating firmware ...
Error: fwupgrade Command Failure!

And then six times the following block, leading to same final error message but this time with block erasing errors and a final FUS_IMAGE_NOT_AUTHENTIC

Download firmware image at address 0x80cb000 ...
 
 
Memory Programming ...
Opening and parsing file: stm32wb5x_BLE_Stack_full_fw.bin
  File          : stm32wb5x_BLE_Stack_full_fw.bin
  Size          : 164816 Bytes
  Address       : 0x080CB000 
 
 
Erasing memory corresponding to segment 0:
Erasing internal memory sectors [203 243]
erasing sector 0203 @: 0x080cb000 failed
rasing sector 0204 @: 0x080cc000 failed
erasing sector 0205 @: 0x080cd000 failed
erasing sector 0206 @: 0x080ce000 failed
erasing sector 0207 @: 0x080cf000 failed
erasing sector 0208 @: 0x080d0000 failed
;49mrasing sector 0209 @: 0x080d1000 failed
erasing sector 0210 @: 0x080d2000 failed
erasing sector 0211 @: 0x080d3000 failed
erasing sector 0212 @: 0x080d4000 failed
erasing sector 0213 @: 0x080d5000 failed
;49mrasing sector 0214 @: 0x080d6000 failed
erasing sector 0215 @: 0x080d7000 failed
erasing sector 0216 @: 0x080d8000 failed
erasing sector 0217 @: 0x080d9000 failed
;49mrasing sector 0218 @: 0x080da000 failed
erasing sector 0219 @: 0x080db000 failed
erasing sector 0220 @: 0x080dc000 failed
erasing sector 0221 @: 0x080dd000 failed
erasing sector 0222 @: 0x080de000 failed
;49mrasing sector 0223 @: 0x080df000 failed
erasing sector 0224 @: 0x080e0000 failed
erasing sector 0225 @: 0x080e1000 done
erasing sector 0226 @: 0x080e2000 done
erasing sector 0227 @: 0x080e3000 done
erasing sector 0228 @: 0x080e4000 done
erasing sector 0229 @: 0x080e5000 done
erasing sector 0230 @: 0x080e6000 done
;49mrasing sector 0231 @: 0x080e7000 done
erasing sector 0232 @: 0x080e8000 done
erasing sector 0233 @: 0x080e9000 done
erasing sector 0234 @: 0x080ea000 done
erasing sector 0235 @: 0x080eb000 done
erasing sector 0236 @: 0x080ec000 done
erasing sector 0237 @: 0x080ed000 done
erasing sector 0238 @: 0x080ee000 done
erasing sector 0239 @: 0x080ef000 done
;49mrasing sector 0240 @: 0x080f0000 done
erasing sector 0241 @: 0x080f1000 done
erasing sector 0242 @: 0x080f2000 done
erasing sector 0243 @: 0x080f3000 done
Download in Progress:
[==================================================] 100%  2% 
 
File download complete
Time elapsed during download operation: 00:00:03.919
 
FUS state is WIRELESS_STACK_UPGRADE_ONGOING
 
FUS status is FUS_IMAGE_NOT_AUTHENTIC
 
FUS state is FUS_IDLE
 
FUS status is FUS_NO_ERROR
 
Firmware Upgrade process started ...
 
Updating firmware ...
Error: fwupgrade Command Failure!

Question: can anyone reading this confirm he has been able to actually update a Nucleo_68 using v1.7.0?

[anddam]

Further update, I tried a second board from another P-NUCLEO-WB55 kit, same results so I figure it's not depending on the board.

Any hint highly appreciated.

[Remi QUINTIN]

Calling twice the same command when the first was successful is not needed.

Now did you manage to upload the RF stack?

[Remi QUINTIN]

Could you download all the option bytes?

I woud like to check the value of the PCROP.RDP option byte. It should be set to 1 to have an effective erase of the user part of the memory.

[anddam]

> Could you download all the option bytes?

Sure, is a full `-ob displ` output enough?