OTA update of Wireless stack and FUS - where to download the image?

[burn_]

Good day,

As an extension of this discussion, I'm having trouble updating the BLE stack using the BLE_Ota code.

From the linked discussion, I should be downloading my new stack to 0x0809D000 (I'm also going from an older, smaller stack at 0x080CB000 to 1.13.X).

However, I'm having the following issue:

1. The STM BLE Sensor app does not allow me to enter 0x0809D000 as a valid address (see image), so I can't test if the address is the issue. In the context of the app, it would be 0x9D000.
2. Using another address (say 0x08060000 or 0x08080000) does not work - SHCI_C2_FUS_GetState return with error code FUS_STATE_ERROR_IMG_NOT_FOUND.

To my understanding the FUS should find the firmware automatically by looking for some magic word. If this were true, then there is no reason why it should not find the image at 0x08060000 or 0x08080000.

Any thoughts as to what is going wrong i.e. why is the image not found?

More information:

• I've verified that the image does get programmed to flash memory (using STM32CubeProgrammer).
• The OTA bootloader works just fine for uploading application firmware.
• I'm using the STM32WB55MMG and the STM32WB55RGV, which both have 1 MB of flash.
• See screenshot of FUS version as read by STM32CubeProgrammer.

Thanks in advance.

[burn_]

I've done more testing, but to no avail.

Here's what I've tested:

• The data does get uploaded correctly - see the screenshot of a comparison between the memory on the device and the BLE stack binary
• Using a custom app, I uploaded the binary to 0x0809D000, but I still got the same error response of FUS_STATE_ERROR_IMG_NOT_FOUND.

[burn_]

Okay, so it turns out it could not find the image because, well, it wasn't there after all.... I moved around the Delete_Sectors() functions and in so doing it erased the flash memory when it rebooted onto the FUS. Moving Delete_Sectors back to where it was means I no longer get FUS_STATE_ERROR_IMG_NOT_FOUND.

However, I now get FUS_STATE_ERROR_IMG_NOT_AUTHENTIC. I've tried changing the read out protection bytes from AA to BB and back to AA, but the issue remains. I am able to update the stack through STM32CubeProgrammer, so I suppose that means my options bytes are correct.

Any thoughts on what I can try next?

[Remy ISSALYS]

Hello,

First, I see in your screenshot that you have a board with the FUS version v1.1.1.0, I recommend you to update the FUS with v.1.2.0, you can look this wiki page which describe how to update the FUS.

Once it's done, in order to update the BLE Stack using OTA, you should used an address between the end of application address and the secure part (see SFSA option byte) minus the image size. On ST BLE Sensor application, an offset is used (start from 0x08000000), so if you want to download your stack is 0x0800A000 for example, you should enter 0xA000 on the application. Image start address must be aligned to sector start address (this is a multiple of 4-kbytes). This address is the download address, not the install address.

For more information about OTA  firmware update on STM32WB, you can look the application note AN5247 (see part 3.1.5 Wireless firmware update).

Best Regards

[burn_]

Hi @Remy ISSALYS​ , thank you for your response and for the clarity on where the BLE Stack may be located.

I'm still not having any luck, unfortunately.

This is what I've tried:

• I updated the FUS to the latest v1.2.0, but also tested on a board with FUS v1.1.0 (since units already in the field have version v1.1.0)
• I started a new BLE_Ota project with the latest V1.14.0 STM32WB firmware. The only mods I made were to

1. turn on debugging (-g3) in the assembly and compiler settings
2. add a basic printToSwv function so that I can get output through the SWV in STM32CubeProgrammer
3. to add a few printToSwv function calls to app_entry.c so that I can read back the return and error codes for the SHCI_C2_FUS_XXXX calls.

• I tried uploading stm32wb5x_BLE_Stack_full_fw.bin to 0x08010000. I tried using stack versions v1.13.1, v1.13.3 and v1.14.0. I also tried stm32wb5x_FUS_fw.bin at some point.

This is what I get:

• SHCI_C2_FUS_GetState(error) returns error = 0x2 while the function returns a value of 0x10. This happens after the SHCI_C2_FUS_FwUpgrade(0,0) call.
• For my own modified version of the BLE_Ota project, based on firmware version 1.13.1, SHCI_C2_FUS_GetState(error) returns error = 0x3 while the function returns a value of 0x10.
• Error codes are as follows (from shci.h, line 240):

FUS_STATE_ERROR_IMG_CORRUPT = 0x02,

FUS_STATE_ERROR_IMG_NOT_AUTHENTIC = 0x03,

and the return value of

0x10 = FUS_STATE_VALUE_FW_UPGRD_ONGOING.

This is what I used:

• I'm using the latest STM BLE Sensor app on iOS
• I tested on STM32WB55MMG and STM32WB55RGV (custom boards, but the second MCU is the same as the Nucleo board)
• I can successfully update the wireless stack and the FUS through STM32CubeProgrammer, so the boards are working correctly.

Either I'm missing something, or there appears to be a bug in the BLE_Ota project that prevents the firmware stack update from working. This is problematic since it means that units in the field cannot receive FUS or Stack updates. I'm concerned that at some point the latest STM32WB firmware will no longer be compatible with the old BLE stack on field devices, and so they will not benefit from added features and security fixes introduced in the latest versions of STM32WB firmware.

Can anyone at ST (or anyone out there on the internet) reproduce the issue?

Any suggestions?

Is it possible to file a bug report somewhere for the STM32WB firmware?

printToSvw function:

void printToSwv (char *text, uint16_t len)
{
  uint16_t count = 0;
 
  while ((count < len) && (text[count] != '\0'))
  {
    ITM_SendChar(text[count]);
    count++;
  }
}

[Remy ISSALYS]

Hello,

Be careful to the size of BLE_Ota project if your perform some modification inside it. This size should not exceed 28 KB (7 sectors of 4 KB).

Can you retry the following steps on P-NUCLEO-WB55.Nucleo ?

• With STM32CubeProgrammer load BLE_Ota firmware from v1.13.0 and the BLE Full Stack from v1.13.3
• Connect to your board with ST BLE Sensor
• Enter 0xA000 for address
• Select Wireless Binary
• Select file corresponding to the BLE Full Stack v1.14.1
• Click on download button
• Wait the end of the download
• Wait the end of the new BLE Stack installation (Blue led off)
• Your stack is updated

Best Regards