WB55 - Error changing firmware of wireless coprocessor

SBebi.1 · ‎2021-10-03

Hi,

I have a "STM32WB55 Nucleo Pack" kit which includes a STM32WB55 nucleo board (MB1355C) and a USB DONGLE STM32WB55 (MB1293C).

Today, I uploaded the "BLE_p2pServer" demo to the nucleo board and problem, nothing happens, LED2 stays green instead of blinking. I uploaded the "BLE_p2pClient" demo, same thing LED2 remains green and press SW1, blue LED1 does not light up.

So I thought it was a problem with the wireless coprocessor firmware of the nucleo board, so I followed the guide "Release_Notes.html" in order to update the FUS and the wireless coprocessor firmware. FUS from 0.5.6 to 1.2.0 at address 0x080EC000, it worked and I get the correct version of FUS. Then, I updated the wireless coprocessor firmware "stm32wb5x_BLE_Stack_full_fw.bin" to address 0x080CA000, but there problem, "Error: The FUS version you're trying to install is older / equal to the FUS version already installed!". It is impossible to start the stack, I get the error "Error: FUS_STATE_IMG_NOT_FOUND".

So, when I uploaded a demo, I find exactly the same problem, LED2 lights up green and nothing more. I do not understand the error message because I am not modifying the FUS !!! I tried to modify the FUS and the wireless coprocessor firmware on the USB dongle and it worked ?!

I have tried with CLI commands and the GUI, DFU and SWD, try to modify the FUS version (now impossible as it is the last version), clear memory, etc. still the same result. The options bytes are correct, except the SFSA which remains at 0xf4 even after adding the wireless coprocessor firmware.

Despite all the actions I was able to perform, nothing could solve the problem. Unfortunately, I haven't found anyone with the same problem as me. Does someone have an idea ?

Thank you so much,

Steven

Remi QUINTIN · ‎2021-10-05

Strange!!

I assume you are using WB package v1.12?

Using CubeProgrammer, you really see the FUS version being v1.2?

You may try to erase all sectors of the Flash memory till sector 0xF4. And the try to reload the FW.

SBebi.1 · ‎2021-10-05

Hi, I am using the WB v1.12.0 package. With CubeProgrammer, I can see the FUS with "No error" "Idle" and the version "v1.2.0". I have already erased all flash memory and tried to reload the firmware of the wireless coprocessor without success, there is always the same error.

Remi QUINTIN · ‎2021-10-06

We had such issue with the 256K variant but it was solved with the last version of CubeProgrammer tool v2.8.

So I would propose you try again with this last version.

SBebi.1 · ‎2021-10-06

Hi, my version of CubeProgrammer was 2.7, I updated it to 2.8 but it didn't change anything, still the same problem. :\

Remi QUINTIN · ‎2021-10-07

I would need some more info/confirmation

FUS version = v1.2
CubeProgrammer version = v2.8
FW version = v1.12
Secure OB screenshot => Could you download all the option bytes?
Did you activate the Anti-rollback mechanism? (Normally you should not)

SBebi.1 · ‎2021-10-07

Hi, I may have activated the anti-rollback in all of my tests, I can't remember. Here is all the information requested and more.

FUS version (v1.2):

CubeProgrammer (v2.8):

FW version (v1.12) and error:

All the Option Bytes :

Target Information:

When starting Wireless Stack:Log of the connection, the update of the wireless FW and then starting the stack (there are many errors and warnings):

18:32:34 : STM32CubeProgrammer API v2.8.0
18:32:34 : ST-LINK error (DEV_CONNECT_ERR)
18:32:37 : ST-LINK SN  : 066DFF485651836687032049
18:32:37 : ST-LINK FW  : V2J37M27
18:32:37 : Board       : P-NUCLEO-WB55
18:32:37 : Voltage     : 3.25V
18:32:37 : SWD freq    : 4000 KHz
18:32:37 : Connect mode: Hot Plug
18:32:37 : Reset mode  : Software reset
18:32:37 : Device ID   : 0x495
18:32:37 : Revision ID : Rev Y
18:32:37 : Debug in Low Power mode enabled.
18:32:38 : UPLOADING OPTION BYTES DATA ...
18:32:38 :   Bank          : 0x00
18:32:38 :   Address       : 0x58004020
18:32:38 :   Size          : 96 Bytes
18:32:38 :   Bank          : 0x01
18:32:38 :   Address       : 0x58004080
18:32:38 :   Size          : 8 Bytes
18:32:38 : UPLOADING ...
18:32:38 :   Size          : 1024 Bytes
18:32:38 :   Address       : 0x8000000
18:32:38 : Read progress:
18:32:38 : Data read successfully
18:32:38 : Time elapsed during the read operation is: 00:00:00.007
18:32:54 : Old Firmware delete ...
18:32:54 : Warning: Option Byte: nSWboot0, value: 0x0, was not modified.
18:32:54 : Warning: Option Byte: nboot0, value: 0x1, was not modified.
18:32:54 : Warning: Option Byte: nboot1, value: 0x1, was not modified.
18:32:54 : Warning: Option Bytes are unchanged, Data won't be downloaded
18:32:54 : Succeeded to set nSWboot0=0 nboot1=1 nboot0=1 
18:32:54 : Memory Programming ...
18:32:54 : Opening and parsing file: 0x495_FUS_Operator.bin
18:32:54 :   File          : 0x495_FUS_Operator.bin
18:32:54 :   Size          : 8 KBytes
18:32:54 :   Address       : 0x08000000 
18:32:54 : Erasing memory corresponding to segment 0:
18:32:54 : Erasing internal memory sectors [0 1]
18:32:54 : Download in Progress:
18:32:54 : File download complete
18:32:54 : Time elapsed during download operation: 00:00:00.262
18:32:54 : Application is running, Please Hold on...
18:33:01 : Reconnecting...
18:33:01 : Reconnected !
18:33:01 : Warning: FUS_STATE_IMG_NOT_FOUND, Flash already empty !
18:33:02 : Firmware delete Success
18:33:02 : Download Stack/FUS image at address 0x80ca000 ...
18:33:02 : Memory Programming ...
18:33:02 : Opening and parsing file: stm32wb5x_BLE_Stack_full_fw.bin
18:33:02 :   File          : stm32wb5x_BLE_Stack_full_fw.bin
18:33:02 :   Size          : 170604 Bytes
18:33:02 :   Address       : 0x080CA000 
18:33:02 : Erasing memory corresponding to segment 0:
18:33:02 : Erasing internal memory sectors [202 243]
18:33:03 : Download in Progress:
18:33:06 : File download complete
18:33:06 : Time elapsed during download operation: 00:00:03.948
18:33:06 : Firmware Upgrade process started ...
18:33:06 : Application is running, Please Hold on...
18:33:18 : Reconnecting...
18:33:18 : Reconnected !
18:33:18 : Error: The FUS version you're trying to install is older/equal to the FUS version already installed !
18:33:58 : Warning: Option Byte: nSWboot0, value: 0x0, was not modified.
18:33:58 : Warning: Option Byte: nboot0, value: 0x1, was not modified.
18:33:58 : Warning: Option Byte: nboot1, value: 0x1, was not modified.
18:33:58 : Warning: Option Bytes are unchanged, Data won't be downloaded
18:33:58 : Succeeded to set nSWboot0=0 nboot1=1 nboot0=1 
18:33:58 : Memory Programming ...
18:33:58 : Opening and parsing file: 0x495_FUS_Operator.bin
18:33:58 :   File          : 0x495_FUS_Operator.bin
18:33:58 :   Size          : 8 KBytes
18:33:58 :   Address       : 0x08000000 
18:33:58 : Erasing memory corresponding to segment 0:
18:33:58 : Erasing internal memory sectors [0 1]
18:33:58 : Download in Progress:
18:33:58 : File download complete
18:33:58 : Time elapsed during download operation: 00:00:00.299
18:33:58 : Application is running, Please Hold on...
18:33:59 : Reconnecting...
18:33:59 : Reconnected !
18:33:59 : Error: FUS_STATE_IMG_NOT_FOUND
18:33:59 : Start Wirless Stack failed
18:33:59 : Warning: Option Byte: nSWboot0, value: 0x0, was not modified.
18:33:59 : Warning: Option Byte: nboot0, value: 0x1, was not modified.
18:33:59 : Warning: Option Byte: nboot1, value: 0x1, was not modified.
18:33:59 : Warning: Option Bytes are unchanged, Data won't be downloaded
18:33:59 : Succeeded to set nSWboot0=0 nboot1=1 nboot0=1 
18:33:59 : Memory Programming ...
18:33:59 : Opening and parsing file: 0x495_FUS_Operator.bin
18:33:59 :   File          : 0x495_FUS_Operator.bin
18:33:59 :   Size          : 8 KBytes
18:33:59 :   Address       : 0x08000000 
18:33:59 : Erasing memory corresponding to segment 0:
18:33:59 : Erasing internal memory sectors [0 1]
18:33:59 : Download in Progress:
18:33:59 : File download complete
18:33:59 : Time elapsed during download operation: 00:00:00.275
18:33:59 : Application is running, Please Hold on...
18:34:00 : Reconnecting...
18:34:00 : Reconnected !
18:34:00 : Error: FUS_STATE_IMG_NOT_FOUND
18:34:00 : Error: Start Wireless Stack Operation Failure! Please, try again

SBebi.1 · ‎2021-10-07

I had worked on this card a few months ago, it wouldn't surprise me that I had activated the anti-rollbacks.

"Known Limitations

If Anti-Rollback needs to be activated, please make sure to activate it only after installing the latest FUS version (>= V1.2.0) and after successfully installing a wireless stack (without deleting it). Otherwise, further wireless stack installation will be blocked."

So, is there no way to fix it ? Do I have to throw my Nucleo board in the trash ?

Remi QUINTIN · ‎2021-10-08

I forwarded your info to the security team to help on your issue.

No there should be a special sequence to get your board back in the manufacturing state = Flash memory is erased, only FUS 1.2 would remain.

Remi QUINTIN · ‎2021-10-08

The security team managed to reproduce the same case as you described..

The only happens when the Anti-Rollback is activated before installing any wireless stack or after installing a WS and deleting it.

So, we can confirm that you may have activated the Anti-Rollback .

Unfortunately, this option is irreversible ! so you wont be able to install any new FW.

The only action I can propose is to revert your board in its original manufacturing state.

To achieve this, you have to write 0x00008000 @ 0x5800040C. This should trigger the erasure of the Flash memory.

I assume activation the anti-rollback still allows this mechanism.