STM32WBxx FUS seems to be deleted

[cyancali]

Hi,

I am currently working with the STM32WB Nucleo Boards. I wanted to flash a new FW on the Dongle. Therefore I enabled USB DFU Mode. I used the following command to write the new FW:

$ ./STM32_Programmer.sh -c port=usb1 -w ~/Tools/STM32CubeWB/Projects/P-NUCLEO-WB55.Nucleo/Applications/BLE/BLE_Ota/SW4STM32/Production/Debug/Production.elf

Output:

Memory Programming ...
Opening and parsing file: Production.elf
  File          : Production.elf
  Size          : 20512 Bytes
  Address       : 0x08000000 
 
 
Erasing memory corresponding to segment 0:
Erasing internal memory sectors [0 4]
erasing sector 0000 @: 0x08000000 failed
erasing sector 0001 @: 0x08001000 failed
erasing sector 0002 @: 0x08002000 failed
erasing sector 0003 @: 0x08003000 failed
erasing sector 0004 @: 0x08004000 failed
Erasing memory corresponding to segment 1:
Not flash Memory : No erase done
Download in Progress:
[==================================================] 100% 
 
File download complete
Time elapsed during download operation: 00:00:00.069

After that I could no longer reach FUS. I wanted to check the version but it returned only 0s:

Reading 32-bit memory content
  Size          : 4 Bytes
  Address:      : 0x20030030
 
0x20030030 : 00000000

I tried to use -fwdelete but it only returned errors:

FUS state is FUS_ERROR
 
FUS status is FUS_NOT_RUNNING
Error: Could not start service since FUS is not in IDLE state

I can't do anything at all anymore with this device! What happened?

According to the help/docu this shouldn't lead to bricked device!?

Does anyone know a solution to that issue?

Until now i could not find any help.

Best Regards

Alex

[Remi QUINTIN]

>According to the help/docu this shouldn't lead to bricked device!?

Not for sure.

Can you download the Option bytes?

The failures when trying to erase sectors are strange. Are these sectors protected? What is the RDP level.

Regarding the FUS_ERROR message, this is showing the fact that the FUS is not in the idle state but in an intermediate state, not running properly.

Please issue the sequence of commands listed below

1. Send the FUS_GET_STATE command and ensure FUS is running. => Check the version number
2. The  send FUS_FW_DELETE

[cyancali]

I can no longer reach the board via the USB DFU. As there is on the Nucleo Dev Board an ST-LINK I tried to connect via SWD.

OPTION BYTES BANK: 0
 
   Read Out Protection:
 
     RDP          : 0xAA (Level 0, no protection) 
 
   BOR Level:
 
     BOR_LEV      : 0x0 (BOR Level 0 reset level threshold is around 1.7 V) 
 
   User Configuration:
 
     nBOOT0       : 0x1 (nBOOT0=1) 
     nBOOT1       : 0x1 (Boot from code area if BOOT0=0 otherwise system Flash) 
     nSWBOOT0     : 0x0 (BOOT0 taken from the option bit nBOOT0) 
     SRAM2RST     : 0x1 (SRAM2 is not erased when a system reset occurs) 
     SRAM2PE      : 0x1 (SRAM2 parity check disable) 
     nRST_STOP    : 0x1 (No reset generated when entering the Stop mode) 
     nRST_STDBY   : 0x1 (No reset generated when entering the Standby mode) 
     nRSTSHDW     : 0x1 (No reset generated when entering the Shutdown mode) 
     WWDGSW       : 0x1 (Software window watchdog) 
     IWGDSTDBY    : 0x1 (Independent watchdog counter running in Standby mode) 
     IWDGSTOP     : 0x1 (Independent watchdog counter running in Stop mode) 
     IWDGSW       : 0x1 (Software independent watchdog) 
     IPCCDBA      : 0x0  (0x0) 
 
   Security Configuration Option bytes:
 
     ESE          : 0x1 (Security enabled) 
     SFSA         : 0xCB  (0xCB) 
     FSD          : 0x0 (System and Flash secure) 
     DDS          : 0x1 (CPU2 debug access disabled) 
     C2OPT        : 0x1 (SBRV will address Flash) 
     NBRSD        : 0x0 (SRAM2b is secure) 
     SNBRSA       : 0xF  (0xF) 
     BRSD         : 0x0 (SRAM2a is secure) 
     SBRSA        : 0xA  (0xA) 
     SBRV         : 0x3D000  (0x3D000) 
 
   PCROP Protection:
 
     PCROP1A_STRT : 0x1FF  (0x8000FF8) 
     PCROP1A_END  : 0x0  (0x8000008) 
     PCROP_RDP    : 0x0 (PCROP zone is kept when RDP is decreased) 
     PCROP1B_STRT : 0x1FF  (0x8000FF8) 
     PCROP1B_END  : 0x0  (0x8000008) 
 
   Write Protection:
 
     WRP1A_STRT   : 0xFF  (0x807F800) 
     WRP1A_END    : 0x0  (0x8000000) 
     WRP1B_STRT   : 0xFF  (0x807F800) 
     WRP1B_END    : 0x0  (0x8000000)

The option bytes seem normal to me. If I run the -fwdelete via the SWD it stops with FUS_STATE_ERR_UNKNOWN.

[cyancali]

I don't understand why I can't reach the USB DFU bootloader anmyore... shouldn't it be in ROM and not deleteable? Or is it on the STM32WB connected to the FW on the Cortex M0?

[Remi QUINTIN]

​You can't reach the USB DFU bootloader because you are not in Firmware Update mode as I can see from the options bytes.

This results from the fact that the previous values of the option bytes were configured via the SWD port with the command line.

In this configuration, nSWBOOT0 = 0 => the value of B00T0 is taken from the option byte nBOOT0 and in this case it is 1 which means 0 for BOOT0.

But BOOT0 = 0 means normal boot mode from the main Flash memory.

If you want to be in an update mode, you have to revert to the SWD mode and set the nBOOT value to 0 to have BOOT0 set to 1. Hence you will be able to use the USB port in DFU mode.

[Remi QUINTIN]

​All these remarks above result from the fact that nSWBOOT0 is set to 0 selecting the value of BOOT0 from the option Byte nB00T0.

If you want to connect BOOT0 pin to 1, please set nSWBOOT0  to 1.

[cyancali]

Thank you! This enabled USB DFU again!

Reading -fusgetstate returns:

FUS state is FUS_ERROR
 
FUS status is FUS_NOT_RUNNING
getFUSstate command execution finished

Running -fwdelete returns:

FUS state is FUS_IDLE
 
FUS status is FUS_NO_ERROR
Deleting firmware ...
terminate called after throwing an instance of 'std::invalid_argument'
  what():  stoull
./STM32_Programmer.sh: line 4: 16158 Aborted                 (core dumped) ${MYROOTDIR}/STM32_Programmer_CLI "$@"

Now rerunning -fusgetstate returns FUS_IDLE

Reading the version returns: 0x20030030 : 01000200

So the FUS seems to be the right version.

I tried to reflash the BLE Stack. I first did a -fwdelete which was sucessful. Afterwards i tried -fwupgrade:

$ ./STM32_Programmer.sh -c port=usb1 -fwupgrade ~/Tools/STM32CubeWB/Projects/STM32WB_Copro_Wireless_Binaries/stm32wb5x_BLE_Stack_fw.bin 0x080CB000 firstinstall=1
      -------------------------------------------------------------------
                        STM32CubeProgrammer v2.2.0                  
      -------------------------------------------------------------------
 
 
 
USB speed   : Full Speed (12MBit/s)
Manuf. ID   : STMicroelectronics
Product ID  : DFU in FS Mode
SN          : 20663176554D
FW version  : 0x011a
Device ID   : 0x0495
Device name : STM32WBxx
Flash size  : 1 MBytes
Device type : MCU
Device CPU  : Cortex-M0+/M4
 
Download firmware image at address 0x80cb000 ...
 
 
Memory Programming ...
Opening and parsing file: stm32wb5x_BLE_Stack_fw.bin
  File          : stm32wb5x_BLE_Stack_fw.bin
  Size          : 165144 Bytes
  Address       : 0x080CB000 
 
 
Erasing memory corresponding to segment 0:
Erasing internal memory sectors [203 243]
erasing sector 0203 @: 0x080cb000 failed
erasing sector 0204 @: 0x080cc000 failed
erasing sector 0205 @: 0x080cd000 failed
erasing sector 0206 @: 0x080ce000 failed
erasing sector 0207 @: 0x080cf000 failed
erasing sector 0208 @: 0x080d0000 failed
erasing sector 0209 @: 0x080d1000 failed
erasing sector 0210 @: 0x080d2000 failed
erasing sector 0211 @: 0x080d3000 failed
erasing sector 0212 @: 0x080d4000 failed
erasing sector 0213 @: 0x080d5000 failed
erasing sector 0214 @: 0x080d6000 failed
erasing sector 0215 @: 0x080d7000 failed
erasing sector 0216 @: 0x080d8000 failed
erasing sector 0217 @: 0x080d9000 failed
erasing sector 0218 @: 0x080da000 failed
erasing sector 0219 @: 0x080db000 failed
erasing sector 0220 @: 0x080dc000 failed
erasing sector 0221 @: 0x080dd000 failed
erasing sector 0222 @: 0x080de000 failed
erasing sector 0223 @: 0x080df000 failed
erasing sector 0224 @: 0x080e0000 failed
erasing sector 0225 @: 0x080e1000 failed
erasing sector 0226 @: 0x080e2000 failed
erasing sector 0227 @: 0x080e3000 failed
erasing sector 0228 @: 0x080e4000 failed
erasing sector 0229 @: 0x080e5000 failed
erasing sector 0230 @: 0x080e6000 failed
erasing sector 0231 @: 0x080e7000 failed
erasing sector 0232 @: 0x080e8000 failed
erasing sector 0233 @: 0x080e9000 failed
erasing sector 0234 @: 0x080ea000 failed
erasing sector 0235 @: 0x080eb000 failed
erasing sector 0236 @: 0x080ec000 failed
erasing sector 0237 @: 0x080ed000 failed
erasing sector 0238 @: 0x080ee000 failed
erasing sector 0239 @: 0x080ef000 failed
erasing sector 0240 @: 0x080f0000 failed
erasing sector 0241 @: 0x080f1000 failed
erasing sector 0242 @: 0x080f2000 failed
erasing sector 0243 @: 0x080f3000 failed
Download in Progress:
[==================================================] 100% 
 
File download complete
Time elapsed during download operation: 00:00:00.455
 
FUS state is FUS_SERVICE_ONGOING
 
FUS status is FUS_IMAGE_NOT_FOUND
 
FUS state is FUS_IDLE
 
FUS status is FUS_NO_ERROR
 
Firmware Upgrade process started ...
 
Updating firmware ...
Waiting for firmware upgrade end
 
FUS state is WIRELESS_STACK_UPGRADE_ONGOING
 
FUS status is FUS_NO_ERROR
 
FUS state is WIRELESS_STACK_UPGRADE_ONGOING
 
FUS status is FUS_IMAGE_NOT_AUTHENTIC
Error: Firmware not authentic!

Erasing sectors seems not to be working.

[cyancali]

Current -ob displ:

OPTION BYTES BANK: 0
 
   Read Out Protection:
 
     RDP          : 0xAA (Level 0, no protection) 
 
   BOR Level:
 
     BOR_LEV      : 0x0 (BOR Level 0 reset level threshold is around 1.7 V) 
 
   User Configuration:
 
     nBOOT0       : 0x0 (nBOOT0=0) 
     nBOOT1       : 0x1 (Boot from code area if BOOT0=0 otherwise embedded SRAM) 
     nSWBOOT0     : 0x1 (BOOT0 taken from PH3/BOOT0 pin) 
     SRAM2RST     : 0x1 (SRAM2 is not erased when a system reset occurs) 
     SRAM2PE      : 0x1 (SRAM2 parity check disable) 
     nRST_STOP    : 0x1 (No reset generated when entering the Stop mode) 
     nRST_STDBY   : 0x1 (No reset generated when entering the Standby mode) 
     nRSTSHDW     : 0x1 (No reset generated when entering the Shutdown mode) 
     WWDGSW       : 0x1 (Software window watchdog) 
     IWGDSTDBY    : 0x1 (Independent watchdog counter running in Standby mode) 
     IWDGSTOP     : 0x1 (Independent watchdog counter running in Stop mode) 
     IWDGSW       : 0x1 (Software independent watchdog) 
     IPCCDBA      : 0x0  (0x0) 
 
   Security Configuration Option bytes:
 
     ESE          : 0x1 (Security enabled) 
     SFSA         : 0xF4  (0xF4) 
     FSD          : 0x0 (System and Flash secure) 
     DDS          : 0x1 (CPU2 debug access disabled) 
     C2OPT        : 0x1 (SBRV will address Flash) 
     NBRSD        : 0x0 (SRAM2b is secure) 
     SNBRSA       : 0x10  (0x10) 
     BRSD         : 0x1 (SRAM2a is non-secure) 
     SBRSA        : 0x0  (0x0) 
     SBRV         : 0x3D000  (0x3D000) 
 
   PCROP Protection:
 
     PCROP1A_STRT : 0x1FF  (0x8000FF8) 
     PCROP1A_END  : 0x0  (0x8000008) 
     PCROP_RDP    : 0x0 (PCROP zone is kept when RDP is decreased) 
     PCROP1B_STRT : 0x1FF  (0x8000FF8) 
     PCROP1B_END  : 0x0  (0x8000008) 
 
   Write Protection:
 
     WRP1A_STRT   : 0xFF  (0x807F800) 
     WRP1A_END    : 0x0  (0x8000000) 
     WRP1B_STRT   : 0xFF  (0x807F800) 
     WRP1B_END    : 0x0  (0x8000000) 

[Remi QUINTIN]

​Hard to say why it failed.

Indeed the FUS is correctly installed  (SFSA = 0xF4 and the value 0x01000200 is the correct version)

Now could you try with firstintall = 0 as I assume you already program a RF stack on this chip.

In last resort, I would recommend to set the RDP option byte  to 0xBB (level 1) and then back to 0xAA (back to level 0). This sequence completely erases the Flash memory up to the SFSA pointer. Normally you should not have to do it but just in case it could help...

[cyancali · Accepted solution]

Thank you for your help! I tried to install a RF Stack (BLE Stack) and it returned success, but the logs seem not so promising. It seems not to erase any pages and in the end it says success but also FUS error...

FUS state is FUS_IDLE
 
FUS status is FUS_NO_ERROR
 
Old Firmware delete ...
 
Deleting firmware ...
Firmware delete finished
 
FUS state is FUS_SERVICE_ONGOING
 
FUS status is FUS_IMAGE_NOT_FOUND
 
FUS state is FUS_IDLE
 
FUS status is FUS_NO_ERROR
Download firmware image at address 0x80cb000 ...
 
 
Memory Programming ...
Opening and parsing file: stm32wb5x_BLE_Stack_fw.bin
  File          : stm32wb5x_BLE_Stack_fw.bin
  Size          : 165144 Bytes
  Address       : 0x080CB000 
 
 
Erasing memory corresponding to segment 0:
Erasing internal memory sectors [203 243]
erasing sector 0203 @: 0x080cb000 failed
erasing sector 0204 @: 0x080cc000 failed
erasing sector 0205 @: 0x080cd000 failed
erasing sector 0206 @: 0x080ce000 failed
erasing sector 0207 @: 0x080cf000 failed
erasing sector 0208 @: 0x080d0000 failed
erasing sector 0209 @: 0x080d1000 failed
erasing sector 0210 @: 0x080d2000 failed
erasing sector 0211 @: 0x080d3000 failed
erasing sector 0212 @: 0x080d4000 failed
erasing sector 0213 @: 0x080d5000 failed
erasing sector 0214 @: 0x080d6000 failed
erasing sector 0215 @: 0x080d7000 failed
erasing sector 0216 @: 0x080d8000 failed
erasing sector 0217 @: 0x080d9000 failed
erasing sector 0218 @: 0x080da000 failed
erasing sector 0219 @: 0x080db000 failed
erasing sector 0220 @: 0x080dc000 failed
erasing sector 0221 @: 0x080dd000 failed
erasing sector 0222 @: 0x080de000 failed
erasing sector 0223 @: 0x080df000 failed
erasing sector 0224 @: 0x080e0000 failed
erasing sector 0225 @: 0x080e1000 failed
erasing sector 0226 @: 0x080e2000 failed
erasing sector 0227 @: 0x080e3000 failed
erasing sector 0228 @: 0x080e4000 failed
erasing sector 0229 @: 0x080e5000 failed
erasing sector 0230 @: 0x080e6000 failed
erasing sector 0231 @: 0x080e7000 failed
erasing sector 0232 @: 0x080e8000 failed
erasing sector 0233 @: 0x080e9000 failed
erasing sector 0234 @: 0x080ea000 failed
erasing sector 0235 @: 0x080eb000 failed
erasing sector 0236 @: 0x080ec000 failed
erasing sector 0237 @: 0x080ed000 failed
erasing sector 0238 @: 0x080ee000 failed
erasing sector 0239 @: 0x080ef000 failed
erasing sector 0240 @: 0x080f0000 failed
erasing sector 0241 @: 0x080f1000 failed
erasing sector 0242 @: 0x080f2000 failed
erasing sector 0243 @: 0x080f3000 failed
Download in Progress:
[==================================================] 100% 
 
File download complete
Time elapsed during download operation: 00:00:02.445
 
FUS state is FUS_IDLE
 
FUS status is FUS_NO_ERROR
 
Firmware Upgrade process started ...
 
Updating firmware ...
Waiting for firmware upgrade end
 
FUS state is WIRELESS_STACK_UPGRADE_ONGOING
 
FUS status is FUS_NO_ERROR
 
FUS state is WIRELESS_STACK_UPGRADE_ONGOING
 
FUS status is FUS_NO_ERROR
 
FUS state is WIRELESS_STACK_UPGRADE_ONGOING
US state is WIRELESS_STACK_UPGRADE_ONGOING
FUS status is FUS_NO_ERROR
FUS status is FUS_NO_ERROR
 
FUS state is FUS_ERROR
 
FUS status is FUS_NOT_RUNNING
Firmware Upgrade Success

I tried to connect to it via my phone like before, but it does not get detected. It seems like the FUS itself is somehow damaged?