The STM32WB55 is a heterogeneous dual-core MCU with a Cortex-M4 for the end-user application and a Corte-M0 for the BLE stack.
RSS / FUS
Root Security Service(RSS) and the Firmware Upgrade Service(FUS) are responsible for secure wireless stack updates and encryption key management. This firmware is executed by the secure core(Cortex-M0)and is not accessible by the end user or a debug probe. This firmware is factory installed in the STM32WB55 flash memory and is marked as secured. Therefore the end-user needs to take into consideration when choosing this device, as part of the memory will be already reserved for the RSS(around 5%). The RSS uses between 10 sectors(v0.5.3) and 12 sectors(v1.1.0) and is written in the flash memory end sectors. For example, for a 1MB device, this will be stored starting at the address 0x080F4000 for v1.1.0 and 0x080F6000 for v0.5.3.
How to update the Wireless Stack
Uploading a wireless stack to the STM32WB55 can be done with- J-Link Commander(J-Link.exe). To do so you first have to connect to the MCU by executing the following command in J-Link
C:\Program Files (x86)\SEGGER\JLink_V647d $ JLink.exe -autoconnect 1 -device "STM32WB55xx - FUS" -if swd -speed 4000
The above command output should be as following:
After successfully connect to the MCU execute the loadbin command with the binary file location and location for the Wireless stack.
J-Link> loadbin C:\Users\Pedro\Desktop\STM32WB_Copro_Wireless_Binaries\stm32wb5x_BLE_Stack_fw.bin, 0x080CC000
The output should be as follow.
The wireless stack binaries can be downloaded from https://www.st.com/en/embedded-software/stm32cubewb.html. Once you have the package just unpack it and navigate to ..\STM32Cube_FW_WB_V1.1.0\Projects\STM32WB_Copro_Wireless_Binaries\. Inside that folder, you may find the Release_Notes.html, which will tell you where each stack starts and should be programmed, and the corresponding binary files. Bellow in Available Stacks from ST you may find the current available stacks and assigned addresses.
How to delete the Wireless Stack
Follow the same process for connecting with the STM32WB55 as above described followed by a simple erase command.
Note: Don't let your self be alarmed by the errors and warnings that the J-Link might output. This happens because the erase command in the J-Link Commander is used to perform a full flash erase. Therefore when it tries to delete a RSS(which is secured) is going to return an error. A successful erase operation should output "RSS: Wireless stack successfully deleted.".
How to update the RSS
Same process as a wireless Stack. Simply loadbin over J-Link Commander to the memory specified by ST and wait for the process to finish.
Warning: Once the FUS is updated from the v0.5.3 to v1.0.1 is not possible to reverse RSS or install WS from previous versions. The RSS/FUS can only upload wireless stacks within the same release version.
How does it work
The process for uploading a Wireless stack to STM32WB55 with J-Link works by uploading the binary to the flash memory and then by requesting a Wireless stack upgrade to the FUS(Firmware Upgrade Service), by means of communication with IPPC and shared tables.
The upgrade process
- Before the upgrade is started the J-Link will request the FUS/RSS to delete any current wireless stack that might be installed.
- The uploaded stack to the flash will be checked by J-Link if it contains a valid image signature.
- A WS_UPGRADE request is made to the FUS. During this process, the MCU will reset several times. Until the Cortex-M0 becomes responsive the J-Link will try every second to establish a connection with the FSU.
Note: This process takes around 20 to 30 seconds depending on the Wireless stack size.
Available Stacks from ST
For STM32CUBEWS vs 1.1.0 the following stacks should be installed in the below addresses.
|Wireless Stack||Installation address|
So how does J-Link communicates with the FUS and performs the Wireless stack upgrade/delete requests? The communication between the J-Link and the RSS/FUS is performed by use of the IPPC(Inter-Processor Communication Channel) and shared tables that are pre-defined by Cortex-M0.
Does this mean that the Cortex-M0 is always running the RSS firmware? No, the RSS firmware is only running when a wireless stack is not installed or a request is made through the IPCC and shared tables.
Can I delete the RSS firmware? No, this is marked as secure and is not possible to delete.
Can I make my own Wireless stack and upload it? Currently, ST only allows uploading STs encrypted wireless stacks.