How to update STM32WB55CE FUS and wireless stack ?

[DAlek]

Having issues with STM32WB55CE FUS and wireless stack update. FUS version:

Reading 32-bit memory content

Size : 4 Bytes

Address: : 0x20010010

0x20010010 : 01010100

FUS upgrade >STM32_Programmer_CLI.exe -c port=swd mode=UR -fwupgrade stm32wb5x_FUS_fw.bin 0x0807A000 firstinstall=0, getting:

Error: Could not execute fwupgrade command, Impossible to install FUS V1.0.1 on

256/512KB Flash Parts

Wireless stack update >STM32_Programmer_CLI.exe -c port=swd mode=UR -fwupgrade STM32WB55\stm32wb5x_BLE_Stack_full_fw.bin 0x08056000 firstinstall=0

-------------------------------------------------------------------

STM32CubeProgrammer v2.7.0

-------------------------------------------------------------------

ST-LINK SN : 52FF74067575555041500481

ST-LINK FW : V2J37S7

Board : --

Voltage : 3.26V

SWD freq : 4000 KHz

Connect mode: Under Reset

Reset mode : Hardware reset

Device ID : 0x495

Revision ID : Rev Y

Device name : STM32WB5x

Flash size : 512 KBytes

Device type : MCU

Device CPU : Cortex-M4

Old wireless stack delete ...

Warning: Option Byte: nSWboot0, value: 0x0, was not modified.

Warning: Option Byte: nboot0, value: 0x1, was not modified.

Warning: Option Byte: nboot1, value: 0x1, was not modified.

Warning: Option Bytes are unchanged, Data won't be downloaded

Succeeded to set nSWboot0=0 nboot1=1 nboot0=1

Memory Programming ...

Opening and parsing file: 0x495_FUS_Operator.bin

File : 0x495_FUS_Operator.bin

Size : 8 KBytes

Address : 0x08000000

Erasing memory corresponding to segment 0:

Erasing internal memory sectors [0 1]

Download in Progress:

██████████████████████████████████████████████████ 100%

File download complete

Time elapsed during download operation: 00:00:00.765

Application is running, Please Hold on...

Reconnecting...

Reconnected !

Warning: FUS_STATE_IMG_NOT_FOUND, Flash already empty !

Firmware delete Success

Download firmware image at address 0x8056000 ...

Memory Programming ...

Opening and parsing file: stm32wb5x_BLE_Stack_full_fw.bin

File : stm32wb5x_BLE_Stack_full_fw.bin

Size : 170604 Bytes

Address : 0x08056000

Erasing memory corresponding to segment 0:

Erasing internal memory sectors [86 127]

Download in Progress:

██████████████████████████████████████████████████ 100%

File download complete

Time elapsed during download operation: 00:00:04.664

Firmware Upgrade process started ...

Application is running, Please Hold on...

Reconnecting...

Reconnected !

Error: The FUS version you're trying to install is older/equal to the FUS versio

n already installed !

Error: fwupgrade Command Failure!

Firwmware upgrade failed! Deleting firmware and exiting...

Warning: Option Byte: nSWboot0, value: 0x0, was not modified.

Warning: Option Byte: nboot0, value: 0x1, was not modified.

Warning: Option Byte: nboot1, value: 0x1, was not modified.

Warning: Option Bytes are unchanged, Data won't be downloaded

Succeeded to set nSWboot0=0 nboot1=1 nboot0=1

Memory Programming ...

Opening and parsing file: 0x495_FUS_Operator.bin

File : 0x495_FUS_Operator.bin

Size : 8 KBytes

Address : 0x08000000

Erasing memory corresponding to segment 0:

Erasing internal memory sectors [0 1]

failed to erase memory

failed to erase memory

Failed to download FUS operator!

Could not start firmware upgrade service, old firmware delete failed

Any suggestions to fix this issue ?

[Remi QUINTIN]

Did you set up your board in USB DFU mode? Just use the "Read FUS State" button.

Considering the error message, it seems that your FUS version is up to date.

Can you try to program a FW stack?

[DAlek]

> Did you set up your board in USB DFU mode?

Yes, Tried both in DFU and SWD mode.

> Just use the "Read FUS State" button.

FUS State: WIRELESS_STACK_UPGRA

FUS Status: FUS_FW_ROLLBACK_ERRO

FUS Version: v1.1.2.0

> Can you try to program a FW stack?

......

 19:20:46 : Download in Progress:

 19:20:53 : File download complete

 19:20:53 : Time elapsed during download operation: 00:00:12.786

 19:20:53 : FUS state is WIRELESS_STACK_UPGRADE_ONGOING

 19:20:53 : FUS status is FUS_IMAGE_NOT_FOUND

 19:20:56 : FUS state is FUS_IDLE

 19:20:56 : FUS status is FUS_NO_ERROR

 19:20:59 : Firmware Upgrade process started ...

 19:20:59 : Updating firmware ...

and it shows red line with 0%. When use "Read FUS State" button:

FUS State: WIRELESS_STACK_UPGRA

FUS Status: FUS_IMAGE_NOT_FOUND

FUS Version: v1.1.2.0

CubeProgrammer v2.7 (DFU mode), shows:

......

 19:28:33 : Updating firmware ...

 19:28:33 : Warning: Connection to device 0x495 is lost

 19:28:34 : Disconnected from device.

[DAlek]

I tried to erase completely the chip as well as change Option Bytes – User Configuration and the flash is not anymore programmable. Currently, address 0x58004020 has value of 0x000001AA. , When try to change any bit, for example, nBOOT0, errors appear:

...

08:20:22 : OPTION BYTE PROGRAMMING VERIFICATION:

08:20:22 : Error: Expected value for Option Byte "nBOOT0": 0x1, found: 0x0

08:20:23 : Error: Option Byte Programming failed

Read FUS info:

08:22:57 : Read FUS state Operation Failure! Please, try again

Firmware Upgrade:

08:26:17 : Failed to set nSWboot0=0 nboot1=1 nboot0=1

Erase & Programming:

08:31:24 : Memory Programming ...

08:31:24 : Opening and parsing file: firmware.hex

08:31:24 : File : firmware.hex

08:31:24 : Size : 395092 Bytes

08:31:24 : Address : 0x08000000

08:31:24 : Erasing memory corresponding to segment 0:

08:31:24 : Erasing internal memory sectors [0 96]

08:31:24 : Error: failed to erase memory

08:31:24 : Error: failed to erase memory

Any way to recover the flash programming and restore the initial settings ?

[Remi QUINTIN]

Just to confirm, all commands listed above were sent via CubeProgrammer v1.6 => Correct?

Your board is the Nucleo board => correct?

Could you download all the option bytes to get an exact view of the state of the board? I am afraid your board is blocked.

Revisit the logs, your device is a 512KB WB variant. So, using CubeProgrammer v1.7 should not be an issue.

All download address should be adapted accordingly vs the WB FW version. The address for the BLE full stack is not the same for WB FW v1.10 and V1.11. But I don’t see this as a cause for all those failures.

This error message is weird “Error: The FUS version you're trying to install is older/equal to the FUS version already installed !�? as you are trying to install the FW not the FUS!!!

Another one “FUS Status: FUS_FW_ROLLBACK_ERROR�? looks like the command is understood as a FUS update … strange!!!

I see you try to modify some option bytes via a direct access to the related registers. This should be ok though I always use the CubeProgrammer tool to modify them.

To read the FUS state, you have to send the command twice to ensure the FUS is really active and has updated its information.

In last resort you can try to write the value 0X00008000 at address 0x58000040C (if you can do it) and then reset the board. This action set the board back to its manufactory state (except for the FUS which remains unchanged vs the last update).

[Mike_ST]

"Just to confirm, all commands listed above were sent via CubeProgrammer v1.6 => Correct?"

Just for accuracy, v2.6 is requested not v1.6.

[Remi QUINTIN]

Correct. I wanted to write v2.6.

[DAlek]

> Just to confirm, all commands listed above were sent via CubeProgrammer v1.6 => Correct?

Not all, only after you requested to switch to v.2.6. But I do not think the issue comes from CubeProgrammer. V2.7 and v2.6 seems to behave similarly. 

> Your board is the Nucleo board => correct?

No, custom board with STM32WB55CEU6.

> Could you download all the option bytes to get an exact view of the state of the board? I am afraid your board is blocked.

I was able to restore the OB – User Configuration by writing to 0x58004020 – 7ffff1aa.

> Revisit the logs, your device is a 512KB WB variant.

Device: STM32WBxx, DeviceID: 0x495, RevisionID: Rev Y, Flash Size: 512 KB

> This error message is weird “Error: The FUS version you're trying to install is older/equal to the FUS version already installed !�? as you are trying to install the FW not the FUS!!!

The message continue to appear.

CubeProgrammer v2.6 programming stm32wb5x_FUS_fw.bin (STM32CubeWB v1.11.0:(

11:45:16 : Error: The FUS version you're trying to install is older/equal to the FUS version already installed !

CubeProgrammer v2.7 programming stm32wb5x_FUS_fw.bin (STM32CubeWB v1.11.0):

 12:00:16 : Firmware Upgrade Success

CubeProgrammer v2.6 programming stm32wb5x_BLE_Stack_full_fw.bin @ 0x08056000 (STM32CubeWB v1.11.0):

 12:11:40 : Error: FUS_STATE_IMG_NOT_FOUND

CubeProgrammer v2.7 programming stm32wb5x_BLE_Stack_full_fw.bin @ 0x08056000 (STM32CubeWB v1.11.0):

 12:05:02 : Error: The FUS version you're trying to install is older/equal to the FUS version already installed !

Someone recommended in STM32WB55 Nucleo - FUS_STATE_IMG_NOT_FOUND error to write stm32wb5x_FUS_fw_1_0_2.bin, but getting:

 12:22:25 : Error: The FUS version you're trying to install is older/equal to the FUS version already installed !

Any working FUS file for STM32WB55CE ?

[Remi QUINTIN]

Never try to upgrade the FUS with a previous version.

Considering your FUS version v1.1.2, the only upgrade you could do is FUS v1.2 available the WB FW V1.11.1 package

The FUS is not device dependant except for its loading address.

What are the value of SFSA and SBRV option bytes?

[DAlek]

> Considering your FUS version v1.1.2, the only upgrade you could do is FUS v1.2 available the WB FW V1.11.1 package

Unable to upgrade the FUS from WB FW V1.11.1 package:

 13:11:07 : Error: Could not execute firmware upgrade command, Impossible to install FUS V1.0.1 on 256/512KB Flash Parts

> What are the value of SFSA and SBRV option bytes?

  Security Configuration Option bytes - 2:

   SFSA    : 0xF4 (0x80F4000)

   FSD     : 0x0 (System and Flash secure)

   DDS     : 0x1 (CPU2 debug access disabled)

   C2OPT    : 0x1 (SBRV will address Flash)

   NBRSD    : 0x0 (SRAM2b is secure)

   SNBRSA   : 0x10 (0x2003C000)

   BRSD    : 0x1 (SRAM2a is non-secure)

   SBRSA    : 0x0 (0x20030000)

   SBRV    : 0x3D000 (0x20000000)

[Remi QUINTIN]

The 2 options bytes are OK.

The error message is completely dumb "Error: Could not execute firmware upgrade command, Impossible to install FUS V1.0.1 on 256/512KB Flash Parts"

This would mean the FUS is not able to recognize the version of a new FUS!!!

I am running out of ideas ...

I will log an internal ticket for the tool team and security team to clarify this issue.