Restore STM32WB55 FUS firmware

[janis_sk]

I've deleted entire FLASH memory of STM32WB55 during testing. Is there a way to restore FUS and with that the wireless binaries?

As I understand they are encrypted so just writing them isn't working. Is there some tool to do that?

[RomainR.]

​See into STM32Cube\Repository\STM32Cube_FW_WB_V1.1.0\Projects\STM32WB_Copro_Wireless_Binaries\Release_Notes.html

You must use STM32Cube_Programmer_cli.exe

STEP 5:

STM32_Programmer_CLI.exe -c port=usb1 -fwupgrade stm32wb5x_FUS_fw.bin 0x080EC000 firstinstall=0

regards

rrom

[Adrian Eggenberger]

Hi

In my case the programming of the FUS with your proposed command line end in the following output:

RSS status is RSS_IMAGE_NOT_AUTHENTIC

Error: Firmware not authentic!

What is wrong?

Regards Adrian

[KGods]

I see the same problem. Full log below...

   -------------------------------------------------------------------

            STM32CubeProgrammer v2.1.0

   -------------------------------------------------------------------

USB speed  : Full Speed (12MBit/s)

Manuf. ID  : STMicroelectronics

Product ID : DFU in FS Mode

SN     : 208338983036

FW version : 0x011a

Device ID  : 0x0495

Device name : STM32WBxx

Flash size : 1 MBytes

Device type : MCU

Device CPU : Cortex-M0+/M4

RSS state is RSS_SERVICE_ONGOING

RSS status is RSS_IMAGE_NOT_FOUND

RSS state is RSS_IDLE

RSS status is RSS_NO_ERROR

Old Firmware delete ...

Deleting firmware ...

Firmware delete finished

RSS state is RSS_SERVICE_ONGOING

RSS status is RSS_IMAGE_NOT_FOUND

RSS state is RSS_IDLE

RSS status is RSS_NO_ERROR

Download firmware image at address 0x80ec000 ...

Memory Programming ...

Opening and parsing file: stm32wb5x_FUS_fw.bin

 File     : stm32wb5x_FUS_fw.bin

 Size     : 24492 Bytes

 Address    : 0x080EC000

Erasing memory corresponding to segment 0:

Erasing internal memory sectors [236 241]

Download in Progress:

File download complete

Time elapsed during download operation: 00:00:00.594

RSS state is RSS_IDLE

RSS status is RSS_NO_ERROR

Firmware Upgrade process started ...

Updating firmware ...

Waiting for firmware upgrade end

RSS state is WIRELESS_STACK_UPGRADE_ONGOING

RSS status is RSS_NO_ERROR

RSS state is WIRELESS_STACK_UPGRADE_ONGOING

RSS status is RSS_IMAGE_NOT_AUTHENTIC

Error: Firmware not authentic!

[Adrian Eggenberger]

Hi

I was able to fix my RSS_IMAGE_NOT_AUTHENTIC issue by erasing the chip:

1) Set read protection to 0xBB

2) Set read protection to 0xAA (will erase the chip)

Maybe this helps as well in your case.

Regards Adrian

[KGods]

Thanks!

But I newer succeeded in installing FUXv1.0.1 (-r32 0x20030030 1 -> 01000100 ), maybe the "stm32wb5x_FUS_fw.bin" in STM32Cube_FW_WB_V1.1.0 isn't this new one...

[janis_sk]

Sorry for long delay.

Yes I tried that step, but it doesn't work.

I've red release notes and in step 4 it says to read FUS version - I have 0x20030030 = 00000000 because I don't have FUS anymore, I've deleted it.

As I said I deleted entire memory - the whole 1MB. I removed ESE bit and mass erased. I don't have FUS in that part anymore.

I can update FUS and binaries on brand new devices, but they seem to come pre programmed from factory.

[Michael Bauer]

Adrian, could you please share how you managed to successfully erase the chip?

I think I have a similar issue. I uploaded the 1.1.1 FUS firmware to address 0x803E000 but I think it should have actually been 0x80EC000 for the Nucleo eval board since it is a 1MB flash device. I am using STM32_Programmer_CLI and the -fwdelete command does not seem to delete the FUS. If I try to upload the FUS firmware with the corrected address a second time it results in the message "Error: Firmware not authentic!" I'm hoping that erasing the entire chip might let me reload the FUS.

The FUS firmware seems happy at this address but my bluetooth app stops working so I want to try correcting this to see if it fixes the issue.

[janis_sk]

You don't want to erase the whole chip. As far as I know once FUS is erased you cannot restore it. The image provided by ST is encrypted and you need previous running FUS to upgrade.

But if you want to know you can erase protected part by removing security bit. This is done clearing it the same time you switch read protection to AA.

[Michael Bauer]

Thank you Janis for your response. Perhaps I don't need to wipe it clean to get it working. I was following this thread because of the behavior when I tried to reload the FUS at a different address.

I probably should have started by asking whether the fact that I loaded the FUS at the wrong location would cause any possible problems (0x803E000 instead of 0x80EC000 for the 1MB flash size on the board). Do you have any idea? Because it seems that this is probably causing some problems for us. We have a modified example (Cable Replacement) build which works with a standard unmodified Nucleo board (no change to the FUS/radio SW) but does NOT work on the board which I flashed these. There could always be something else about this board causing this but what I was trying to do here was relocate the FUS to the proper address to rule it out. The erroneous behavior is that the BLE stack does not seem to be communicating with the application.