Skip to main content
August 16, 2020
Question

STM342WB55 after load last BLE stack (1.8.0) I can`t erase fw with STM32CubeProgrammer

  • August 16, 2020
  • 35 replies
  • 10125 views

Hi.

Using STM32CubeProgrammer I load last stm32wb5x_BLE_Stack_light_fw.bin, but when after that I try to run command -fwdelete, I get an error : "FUS_NOT_RUNNING".

I attach log file becose Idont understand whot is this.

But me application work fine and I see that stack is a last version.

Please help whot may bee .

I send call:

STM32_Programmer_CLI.exe -c port=usb1 -fwdelete -vb 3

This topic has been closed for replies.

35 replies

August 20, 2020

Hey, employees !!!

How about answer for this situation?

And, my chip will not update anymore ???

Amel NASRI
Technical Moderator
August 26, 2020

Hi @Vyacheslav​ ,

Unfortunately your question was missed, simply because it doesn't contain relevant topics (or tags).

I add the topics "STM32WB" and STM32CubeProgrammer here and I let our expert @Remi QUINTIN​  take care of your request.

-Amel

To give better visibility on the answered topics, please click on Accept as Solution on the reply which solved your issue or answered your question.
August 24, 2020

I remind you that because of this, it is now impossible to fill a stack at all.

Remi QUINTIN
Technical Moderator
August 26, 2020

There are 2 way to update the STM32WB: CLI and GUI mode => Which one are you using?

What is version of the CubeWB FW package? the lastest one is V1.8.0

Which port do you use? USB or SWD?

What is the sequence of commands used to program the chip?

Do you have a log of the commands + error messages?

Can you provide a dump of al option bytes?

August 26, 2020

1. I use STM32_Programmer_CLI.exe (I write that in my question).

2. Yes, 1.8.0

3. USB ( I was show command in question: "STM32_Programmer_CLI.exe -c port=usb1 -fwdelete -vb 3")

4.

  • STM32_Programmer_CLI.exe -c port=usb1 -fwdelete
  • STM32_Programmer_CLI.exe -c port=usb1 -vb 3 -r32 0x20030030 1
  • STM32_Programmer_CLI.exe -c port=usb1 -fwupgrade stm32wb5x_BLE_Stack_light_fw_180.bin 0x080D6000 firstinstall=1

After call "-fwupgrade" the CLI stay looped on screen with repeatition sume text. After 1 or 2 minutes wait, I stop CLI by Ctrl+C. And I think what a stack dont loaded, but when I start my application I see what strack is upgraded.

But on next time I call

STM32_Programmer_CLI.exe -c port=usb1 -fwdelete

I get an error : "FUS_NOT_RUNNING".

I call again with verbose 3 like this:

STM32_Programmer_CLI.exe -c port=usb1 -fwdelete -vb 3

and result can be seen from the attached file.

And also now when call

STM32_Programmer_CLI.exe -c port=usb1 -vb 3 -r32 0x20030030 1

I get a strange value.

Remi QUINTIN
Technical Moderator
August 26, 2020

​What is the value read at 0x20030030?

I am not able to read you attachement.

Remi QUINTIN
Technical Moderator
August 26, 2020

​Could you dump the option bytes?

August 26, 2020

This is a dump of STM32_Programmer_CLI.exe -c port=usb1 -fwdelete

Remi QUINTIN
Technical Moderator
August 26, 2020

​ouch!!  quite weird value!!

In fact, the ESE option byte is not checked so this device is not secure. No FUS is loaded on your chip.

So you won't be able to use it to install new FUS or any RF encrypted RF stack.

It may be a very old device (very early version).

Where did you get it?

August 26, 2020

Sorry, Remi, but before download a new stack (1.8.0) everything worked fine and last stack was 1.7.0. and FUS is 1.1.0.

And now chip continue working fine and stack now 1.8.0.0.5 and FUS 1.1.0

This info I get in me application fw by "SHCI_GetWirelessFwInfo".

But now I cant delete or reload any stack - this is a problem.

As for the chip, this is a chip from the first lots of P-NUCLEO-WB55 when they first went on sale.

Remi QUINTIN
Technical Moderator
August 26, 2020

​Really? So you manage to upgrade your device with FUS 1.1.0 and then the BLE light RF stack from V1.8?

This is amazing as this can only happen on a secure chip => ESE = 1.

Now the ESE = 0 but normally no one (except CPU2) can reset it to 0.... I am quite puzzled by this situation.

Could you to perform a fwdelete again and read the FUS version?

Can you try then to set ESE back to 1 and retry to read the FUS version?

August 26, 2020

Yes!

"Could you to perform a fwdelete again and read the FUS version?" - problem in my topic :) afyer loading last stak (1.8.0) I can`t delete.

Log on the zip - it is a dump of "fwdelete" command.

Ok, I try again and send you log.

Remi QUINTIN
Technical Moderator
August 26, 2020

>This info I get in me application fw by "SHCI_GetWirelessFwInfo".

OK so we can consider the FUS is V1.1.0. In last resort we could try a trick that would revert the chip to its manufactory state. But this would erase any data in flash memory except the FUS.

First let's wait for your trial.

August 26, 2020

I answer on your previous comment.

This is an extended result of try to set ESE:

19:02:09:760 : Option byte command : -ob ESE=1 

19:02:09:762 : PROGRAMMING OPTION BYTES AREA ...

19:02:09:763 : Warning: Option Byte: ESE, is not programmable

19:02:09:786 : Warning: Option Byte: ESE, does not exist

19:02:09:808 : Warning: Option Bytes are unchanged, Data won't be downloaded

19:02:09:839 : DFU status = 0

19:02:09:839 : DFU State = 9

19:02:09:839 : Status: 0, State: 9

19:02:09:840 : sending an abort request

19:02:09:840 : DFU status = 0

19:02:09:840 : DFU State = 2

19:02:09:840 : setting the address pointer to address: 0x08000000

19:02:09:840 : DFU status = 0

19:02:09:840 : DFU State = 4

19:02:09:841 : DFU status = 0

19:02:09:841 : DFU State = 5

19:02:09:841 : data: 2100000008

19:02:09:841 : UPLOADING OPTION BYTES DATA ...

19:02:09:841 : Bank : 0x00

19:02:09:841 : Address : 0x1fff8000

19:02:09:841 : Size : 128 Bytes

19:02:09:841 : DFU status = 0

19:02:09:842 : DFU State = 5

19:02:09:842 : Status: 0, State: 5

19:02:09:842 : setting the address pointer to address: 0x1fff8000

19:02:09:842 : DFU status = 0

19:02:09:842 : DFU State = 4

19:02:09:842 : DFU status = 0

19:02:09:842 : DFU State = 5

19:02:09:842 : data: 210080ff1f

19:02:09:842 : receiving packet nbr: 0

19:02:09:842 : DFU status = 0

19:02:09:842 : DFU State = 5

19:02:09:842 : sending an abort request

19:02:09:842 : DFU status = 0

19:02:09:842 : DFU State = 2

19:02:09:843 : UpLoading data

19:02:09:843 : DFU status = 0

19:02:09:843 : DFU State = 9

19:02:09:843 : data: aaf0ff3f550f00c0ff01000000feffff00000000ffffffffff00000000ffffffff00000000ffffffff01000000feffff00000000ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff00c0ffffff3f0000d610000029efffff00582b9effa7d461

August 26, 2020

and  FUS version is FCD91B10. :)

Remi QUINTIN
Technical Moderator
August 27, 2020

As you can see, it is not possible to modify the ESE bit. This is why I am quite puzzle by the fact you were able to load a new fus and run an application.

This can only be done with ESE = 1 and once set to 1 there is no way to revert it to 0.

I would say that this chip is too old from an early not secured version on which you can only run application but without any RF stack.

Are you really able to advertise and be detected by a mobile application like the STBLE sensor android application?

if calling SHCI_GetWirelessFwInfo function still gives you FUS v1.1.0, then you could try to revert to the manufactory state (no guarantee it would work with your case).

Write 0x00008000 at address 0x5800040C and then reset your chip.

Let me know if it allows you to program it again.

August 27, 2020

Hi, Remi.

Yes, my custom application and bootloader uses BLE stack and no any problems.

Application and bootloader can advertise and connect, transfer any data by custom characteristics.

How ti correct write data to address ?

I use:

STM32_Programmer_CLI.exe -c port=usb1 -w32 0x5800040C 0x00008000

but get error:

0693W000002lVrSQAU.png

Remi QUINTIN
Technical Moderator
August 27, 2020

​Could you download all the sections of the options bytes or call the command STM32_Programmer_CLI.exe -c port=usb1 -ob displ and give me the log?

August 27, 2020

   -------------------------------------------------------------------

            STM32CubeProgrammer v2.5.0          

   -------------------------------------------------------------------

USB speed  : Full Speed (12MBit/s)

Manuf. ID  : STMicroelectronics

Product ID : DFU in FS Mode

SN     : 2058387A3036

FW version : 0x011a

Device ID  : 0x0495

Device name : STM32WBxx

Flash size : 1 MBytes

Device type : MCU

Device CPU : Cortex-M0+/M4

UPLOADING OPTION BYTES DATA ...

 Bank     : 0x00

 Address    : 0x1fff8000

 Size     : 128 Bytes

▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒ 0%

██████████████████████████████████████████████████ 100%

OPTION BYTES BANK: 0

  Read Out Protection:

   RDP     : 0xAA (Level 0, no protection) 

  BOR Level:

   BOR_LEV   : 0x0 (BOR Level 0 reset level threshold is around 1.7 V) 

  User Configuration:

   nBOOT0    : 0x1 (nBOOT0=1 Boot from main Flash) 

   nBOOT1    : 0x1 (Boot from Flash if nBoot0=0 otherwise system memory) 

   nSWBOOT0   : 0x1 (BOOT0 taken from PH3/BOOT0 pin) 

   SRAM2RST   : 0x1 (SRAM2 is not erased when a system reset occurs) 

   SRAM2PE   : 0x1 (SRAM2 parity check disable) 

   nRST_STOP  : 0x1 (No reset generated when entering the Stop mode) 

   nRST_STDBY  : 0x1 (No reset generated when entering the Standby mode) 

   nRSTSHDW   : 0x1 (No reset generated when entering the Shutdown mode) 

   WWDGSW    : 0x1 (Software window watchdog) 

   IWGDSTDBY  : 0x1 (Independent watchdog counter running in Standby mode) 

   IWDGSTOP   : 0x1 (Independent watchdog counter running in Stop mode) 

   IWDGSW    : 0x1 (Software independent watchdog) 

   IPCCDBA   : 0x0 (0x0) 

  Security Configuration Option bytes:

   ESE     : 0x0 (Security disabled) 

   SFSA     : 0xD6 (0xD6) 

   FSD     : 0x0 (System and Flash secure) 

   DDS     : 0x1 (CPU2 debug access disabled) 

   C2OPT    : 0x1 (SBRV will address Flash) 

   NBRSD    : 0x0 (SRAM2b is secure) 

   SNBRSA    : 0xF (0xF) 

   BRSD     : 0x0 (SRAM2a is secure) 

   SBRSA    : 0xA (0xA) 

   SBRV     : 0x35800 (0x35800) 

  PCROP Protection:

   PCROP1A_STRT : 0x1FF (0x80FF800) 

   PCROP1A_END : 0x0 (0x8000800) 

   PCROP_RDP  : 0x0 (PCROP zone is kept when RDP is decreased) 

   PCROP1B_STRT : 0x1FF (0x80FF800) 

   PCROP1B_END : 0x0 (0x8000800) 

  Write Protection:

   WRP1A_STRT  : 0xFF (0x80FF000) 

   WRP1A_END  : 0x0 (0x8000000) 

   WRP1B_STRT  : 0xFF (0x80FF000) 

   WRP1B_END  : 0x0 (0x8000000)