The ST STM32WB series devices are heterogeneous dual-core MCUs with a Cortex-M4 for the end-user application and a Cortex-M0 for the BLE stack. The STM32WB series currently consists of 3 sub-families:
- 1 Internal flash
- 2 Option bytes flash
- 3 RSS / FUS
- 3.1 How to update the Wireless Stack
- 3.2 How to delete the Wireless Stack
- 3.3 How to update FUS
- 3.4 How does it work
- 3.5 Sending FUS commands manually
- 3.6 FAQ
- 4 Evaluation boards
The STM32WB device series comes with varying sizes of internal flash up to 1 MB, which is generally supported by J-Link.
|Device name||Range / Size|
|STM32WBxxxC||0x0800_0000 - 0x0803_FFFF (256 KB)|
|STM32WB1xxC||0x0800_0000 - 0x0804_FFFF (320 KB)|
|STM32WBxxxE||0x0800_0000 - 0x0807_FFFF (512 KB)|
|STM32WBxxxY||0x0800_0000 - 0x0809_FFFF (640 KB)|
|STM32WBxxxG||0x0800_0000 - 0x080F_FFFF (1 MB)|
- The ST STM32WB1x devices are special compared to the other STM32WB devices e.g. the sector size is 2KB instead of 4KB.
- Partially used for BLE stack image. The section that is reserved for this purpose is read/write protected.
Option bytes flash
Option byte programming is directly supported by J-Link. Alternatively, option bytes can be programmed via the Flash registers as shown in the ST STM32 main article.
RSS / FUS
Root Security Service (RSS) and the Firmware Upgrade Service (FUS) are responsible for secure wireless stack updates and encryption key management. This firmware is executed by the secure core (Cortex-M0) and is not accessible by the end user or a debug probe. It is factory installed on any ST STM32WB devices flash memory and is marked as secured. On some STM32WB devices, the last sectors of the user flash are used for the RSS ande Wireless stack (WS), on others, flash outside of the user area is used for this purpose.
How to update the Wireless Stack
- Acquire Wireless Stack binaries and determine the correct flash address.
- Select the device <DeviceName> - FUS in the J-Link Commander or J-Flash.
- Download the data file to the correct position, specified by the ST documentation.
Acquire Wireless Stack binaries
The wireless stack binaries can be downloaded from https://www.st.com/en/embedded-software/stm32cubewb.html.
- Unpack the package
- Navigate to STM32Cube_FW_WB_V<Version>\Projects\STM32WB_Copro_Wireless_Binaries\
- Open Release_Notes.html, which contains information about:
- The available image options
- The corresponding binary files and where they should be programmed to
J-Link Commander - Upgrading the image
Open the J-Link commander (%JLinkInstallDir%\JLink.exe) using the following example command line (example for ST STM32WB55RG devices):
Windows: JLink.exe -autoconnect 1 -device "STM32WB55RG - FUS" -if swd -speed 4000 Linux/MacOS: JLinkExe -autoconnect 1 -device "STM32WB55RG - FUS" -if swd -speed 4000
loadfile <PathToBinary>\stm32wb5x_BLE_Stack_fw.bin, <Address> Exit
- <PathToBinary> is the path to the unpacked package location (see Acquire Wireless Stack binaries).
- <Address> is the address the binary has to be flashed to (see Acquire Wireless Stack binaries).
Example (STM32WB5xxG, version 1.1.0)
J-Link> loadfile "C:\Users\Fabian\Desktop\STM32Cube_FW_WB_V1.13.0\Projects\STM32WB_Copro_Wireless_Binaries\STM32WB5x\stm32wb5x_BLE_Stack_full_fw.bin" 0x080C7000 J-Link> Exit
J-Flash - Upgrading the image
- Create a project for the device you are using (<DeviceName> - FUS)
- Add the data file to the project (make sure to select the correct start location of the image, as binary files do not contain address information!)
- Important: Check: Options > Project Settings > Production > Actions performed by 'Production Programming' > Disconnect afterwards
- Download the image via Target > Production Programming (F7)
- Wait for the process to complete (Takes ~30 seconds)
Flasher stand-alone - Upgrading the image
The upgrade process is also supported via Flasher stand-alone programming (since V7.86g). In J-Flash:
- Create a J-Flash project as described here
- Download the data & config file to Flasher via File > Download config & data file to Flasher
- Execute the upgrade by pressing the program button on the Flasher (PROG)
Starting the wireless stack
The following table shows under which conditions the wireless stack will be (re)started and running on disconnect (e.g. closing J-Link Commander).
|WS State before connect||FUS/WS was updated
|Is WS started|
- Only applies if the WS is not manually started by the user during the session. If it was, the state would also be "running".
How to delete the Wireless Stack
The WS is deleted during the "Reset"-step. Thus, triggering a reset will delete the WS. This can be done in different ways.
- Connect to the device.
- Issue the Reset command.
- Disconnect to make sure that the boot mode is restored.
- Create a project for the device (- FUS!).
- Connect to the device. This will implicitly trigger a reset.
- Disconnect to make sure that the boot mode is restored.
How to update FUS
Follow the same steps as explained in How to update the Wireless Stack, but with a FUS image instead of a WS image.
How does it work
The process for upgrading the WS/FUS on the ST STM32WBxx with J-Link works by uploading the binary to the flash memory and then by sending an upgrade request to the FUS. This is done using the Inter-Processor Communication Channel (IPCC) via shared tables. The process is described step-by-step below.
- The device is forced to boot in system bootmode via option bytes.
- FUS is started through IPCC.
- Reset: The wireless stack is deleted by issuing the corresponding IPCC command.
- Flash program:
- The upgrade image is programmed to the device flash
- The upgrade procedure is triggered by issuing the corresponding IPCC command.
- The wireless stack is started after a successful upgrade.
- If no Reset/Download was executed, the WS state will be restored (running/not running).
- The option bytes are restored to their original values before connect.
Sending FUS commands manually
In case a command is not supported out of the box, it has to be sent manually. This can be done via the IPCC mailbox system used for FUS communication. To do so, a connection has to be established via the J-Link Commander.
Reset Mem32 0x58000C0C, 1 // Channel 2 (CH2F bit == bit 1) busy? Wait for it to clear. Otherwise, prcoeed. Write4 0x20030064, 0 // Clear mailbox message header Write4 0x20030068, 0 // Clear mailbox message buffer Write4 0x2003006C, <Cmd> // Write command packet "<Cmd>" // Optional: Send payload here. Write4 0x58000C08, 0x20000 // Set CH2F via CH2S (channel 2 data transmit bit) Write4 0x58000C04, 0xFFFDFFFD // Unmask Channel 2 interrupt (CH2FM & CH2OM) Mem32 0x58000C0C, 1 // _IPCC_C1TOC2SR Still busy (bit 1 == 1)? => Repeat this until unoccupied (bit 1 == 0). Mem32 0x20030064, <8+n> // Read command response: 8 bytes (header + response message) + n bytes payload.
In case a Payload is required for the command, it has to be added after "Send command <Cmd>". The payload contains 0 - 255 bytes:
Write4 0x20030070, <Payload0-3> ... Write4 0x20030168, <Payload248-251> Write1 0x2003016C, <Payload252> Write1 0x2003016D, <Payload253> Write1 0x2003016E, <Payload254>
Example - Get FUS state
Reset Mem32 0x58000C0C, 1 // Channel 2 (CH2F bit == bit 1) busy? Wait for it to clear. Otherwise, prcoeed. Write4 0x20030064, 0 // Clear mailbox message header Write4 0x20030068, 0 // Clear mailbox message buffer Write4 0x2003006C, 0x00FC5210 // Write command packet <Type(Command packet) | Command (FUS_GET_STATE) | payload length == 0>. Write4 0x58000C08, 0x20000 // Set CH2F via CH2S (channel 2 data transmit bit) Write4 0x58000C04, 0xFFFDFFFD // Unmask Channel 2 interrupt (CH2FM & CH2OM) Sleep 500 // Make sure command had enough time. Alternatively wait for C1TOC2SR bit 1 to turn 0. Mem32 0x20030064, 2 // Read command response: 8 bytes (header + FUS state).
How does J-Link communicate with the FUS? and performs the Wireless stack upgrade/delete requests?
For the communication with the RSS/FUS, the Inter-Processor Communication Channel (IPCC) is used via shared tables, specified by ST.
Does this mean that the Cortex-M0 is always running the FUS firmware?
No, the FUS firmware is only running when
- No wireless stack is installed
- A FUS start request is sent via the IPCC and accepted by FUS.
Can I delete the FUS firmware?
No, the FUS firmware can not be fully deleted. It can only be upgraded.