Difference between revisions of "ST STM32WB"
(→Sending FUS commands manually) |
(→How to update the Wireless Stack) |
||
Line 40: | Line 40: | ||
# Load wireless stack to target using J-Link Commander. |
# Load wireless stack to target using J-Link Commander. |
||
{{Note|FUS & Stack upgrades are currently '''not''' supported via [[J-Flash]].}} |
{{Note|FUS & Stack upgrades are currently '''not''' supported via [[J-Flash]].}} |
||
− | |||
==== Acquire Wireless Stack binaries ==== |
==== Acquire Wireless Stack binaries ==== |
Revision as of 09:24, 27 July 2022
The ST STM32WB series devices are heterogeneous dual-core MCUs with a Cortex-M4 for the end-user application and a Corte-M0 for the BLE stack. The STM32WB series currently consists of 3 sub-families:
- STM32WBx0
- STM32WBx5
- STM32WBxM
Contents
Internal flash
The STM32WB device series comes with varying sizes of internal flash up to 1 MB, which is generally supported by J-Link.
Device name | Range / Size |
---|---|
STM32WBxxxC | 0x0800_0000 - 0x0804_0000 (256 KB) |
STM32WBxxxE | 0x0800_0000 - 0x0808_0000 (512 KB) |
STM32WBxxxY | 0x0800_0000 - 0x080A_0000 (640 KB) |
STM32WBxxxG | 0x0800_0000 - 0x0810_0000 (1 MB)[1] |
- ↑ Partially used for wireless stack.
RSS / FUS
Root Security Service (RSS) and the Firmware Upgrade Service (FUS) are responsible for secure wireless stack updates and encryption key management. This firmware is executed by the secure core (Cortex-M0) and is not accessible by the end user or a debug probe. This firmware is factory installed in the STM32WB flash memory and is marked as secured. Therefore the end-user needs to take into consideration when choosing this device, as part of the memory will be already reserved for the RSS (around 5%). The RSS uses between 10 sectors (v0.5.3) and 12 sectors (v1.1.0) and is written in the flash memory end sectors. For example, for a 1MB device, this will be stored starting at the address 0x080F4000 for v1.1.0 and 0x080F6000 for v0.5.3.
How to update the Wireless Stack
Uploading a wireless stack to the STM32WBxx can be done with J-Link Commander. This section describes how this is done via the following steps:
- Acquire Wireless Stack binaries and determine the correct flash address.
- Start the device in boot loader mode.
- Connect to the MCU using J-Link Commander.
- Load wireless stack to target using J-Link Commander.
FUS & Stack upgrades are currently not supported via J-Flash.
Acquire Wireless Stack binaries
The wireless stack binaries can be downloaded from https://www.st.com/en/embedded-software/stm32cubewb.html.
After downloading:
- Unpack the package
- Navigate to STM32Cube_FW_WB_V<Version>\Projects\STM32WB_Copro_Wireless_Binaries\.
- Open Release_Notes.html, which contains information about:
- Where each stack starts.
- The corresponding binary files and where they should be programmed to.
Bellow in Available Stacks from ST you may find the current available stacks and assigned addresses.
Start Device in system boot loader mode
It is important that the device starts in system boot mode. The update procedure relies on the system boot loader to be executed, as the system bootloader sets up the shared tables, which are required for the Wireless Stack and FUS upgrade.
This can be done with the following configurations:
nBOOT1 FLASH_OPTR[23] |
nBOOT0 FLASH_OPTR[27] |
BOOT0 pin PH3 |
nSWBOOT0 FLASH_OPTR[26] |
Main Flash empty |
---|---|---|---|---|
--- | --- | |||
--- | --- | |||
--- | --- |
== Set / HIGH
== Not set / LOW
--- == Don't care
For information on how to program the option bytes, please refer to this example
Connect to the Device with J-Link Commander
Before connecting to the Device, please make sure you are using the latest version of the J-Link Software Pack. Open the J-Link commander (%JLinkInstallDir%\JLink.exe) using the following command line:
Windows: JLink.exe -autoconnect 1 -device "STM32WB55xx - FUS" -if swd -speed 4000 Linux/MacOS: JLinkExe -autoconnect 1 -device "STM32WB55xx - FUS" -if swd -speed 4000
The above command output should be as following:
Downloading the wireless stack
After connecting to the MCU successfully, download the Update using the Reset and LoadFile commands. Even though resetting the device is not mandatory, it is highly recommended.
r loadfile <PathToBinary>\stm32wb5x_BLE_Stack_fw.bin, <Address>
- <PathToBinary> is the path to the unpacked package location (see Acquire Wireless Stack binaries).
- <Address> is the address the binary has to be flashed to (see Acquire Wireless Stack binaries).
The address the wireless stack has to be downloaded to differs depending on update version and device.
Example (STM32WB5xxG, version 1.1.0):
J-Link> loadfile "C:\Users\Fabian\Desktop\STM32Cube_FW_WB_V1.13.0\Projects\STM32WB_Copro_Wireless_Binaries\STM32WB5x\stm32wb5x_BLE_Stack_full_fw.bin" 0x080C7000
The output should look like the following:
How to delete the Wireless Stack
- Start the device in system boot loader mode as described here.
- Connect to the device as described here.
- (Optional/Recommended) Reset the device using the Reset command.
- Erase the the device using the Erase command.
Reset Erase 0xFFFFFFFF, 0xFFFFFFFF // Selecting this range will prevent anything but the wireless stack to be erased.
Not providing an erase range also works. However, J-Link will report a erase error, and a part of the flash will be deleted.
To prevent this, the above address range is provided.
How to update the RSS
Same process as a wireless Stack. Simply loadbin over J-Link Commander to the memory specified by ST and wait for the process to finish.
Warning:
Once the FUS is updated from the v0.5.3 to v1.0.1 is not possible to reverse RSS or install WS from previous versions.
The RSS/FUS can only upload wireless stacks within the same release version.
How does it work
The process for uploading a Wireless stack to STM32WBxx with J-Link works by uploading the binary to the flash memory and then by requesting a Wireless stack upgrade to the FUS(Firmware Upgrade Service), by means of communication with IPPC and shared tables.
The upgrade process
- Before the upgrade is started the J-Link will request the FUS/RSS to delete any current wireless stack that might be installed.
- The uploaded stack to the flash will be checked by J-Link if it contains a valid image signature.
- A WS_UPGRADE request is made to the FUS. During this process, the MCU will reset several times. Until the Cortex-M0 becomes responsive the J-Link will try every second to establish a connection with the FSU.
This process takes around 20 to 30 seconds depending on the Wireless stack size.
Available Stacks from ST
For the correct download address, please refer to:
STM32Cube_FW_WB_V<Version>\Projects\STM32WB_Copro_Wireless_Binaries\STM32WB5xRelease_Notes.html
Sending FUS commands manually
In case a command is not supported out of the box, it has to be sent manually. This can be done via the IPCC mailbox system used for FUS communication. To do so, a connection has to be established via the J-Link Commander. See: Connect to the Device with J-Link Commander.
- The mailbox buffer addresses depend on the device setup. In the following, the default system bootloader boot mode default locations are used.
- For a list of available commands and the corresponding responses, please refer to the ST documentation (AN5185).
Reset Mem32 0x58000C0C, 1 // Channel 2 (CH2bit == bit 1) busy? Wait for it to clear. Otherwise, prcoeed. Write4 0x20030064, 0 // Clear mailbox message header Write4 0x20030068, 0 // Clear mailbox message buffer Write4 0x2003006C, <Cmd> // Write command packet "<Cmd>" // Optional: Send payload here. Write4 0x58000C08, 0x20000 // Set CH2F via CH2S (channel 2 data transmit bit) Write4 0x58000C04, 0xFFFDFFFD // Unmask Channel 2 interrupt (CH2FM & CH2OM) Mem32 0x58000C0C, 1 // _IPCC_C1TOC2SR Still busy (bit 1 == 1)? => Repeat this until unoccupied (bit 1 == 0). Mem32 0x20030064, <8+n> // Read command response: 8 bytes (header + response message) + n bytes payload.
In case a Payload is required for the command, it has to be added after "Send command <Cmd>". The payload contains 0 - 255 bytes:
Write4 0x20030070, <Payload0-3> ... Write4 0x20030168, <Payload248-251> Write1 0x2003016C, <Payload252> Write1 0x2003016D, <Payload253> Write1 0x2003016E, <Payload254>
Example - Get FUS state
Reset Mem32 0x58000C0C, 1 // Channel 2 (CH2bit == bit 1) busy? Wait for it to clear. Otherwise, prcoeed. Write4 0x20030064, 0 // Clear mailbox message header Write4 0x20030068, 0 // Clear mailbox message buffer Write4 0x2003006C, 0x00FC5210 // Write command packet <Type(Command packet) | Command (FUS_GET_STATE) | payload length == 0>. Write4 0x58000C08, 0x20000 // Set CH2F via CH2S (channel 2 data transmit bit) Write4 0x58000C04, 0xFFFDFFFD // Unmask Channel 2 interrupt (CH2FM & CH2OM) Sleep 500 // Make sure command had enough time. Alternatively wait for C1TOC2SR bit 1 to turn 0. Mem32 0x20030064, 2 // Read command response: 8 bytes (header + FUS state).
Instead of waiting for the channel to turn unoccupied, we simply wait 500ms in the example. Alternative, wait for C1TOC2SR Channel 2 bit (bit 1) to turn 0.
FAQ
How does J-Link communicates with the FUS and performs the Wireless stack upgrade/delete requests?
The communication between the J-Link and the RSS/FUS is performed by use of the IPPC(Inter-Processor Communication Channel) and shared tables that are pre-defined by Cortex-M0.
Does this mean that the Cortex-M0 is always running the RSS firmware?
No, the RSS firmware is only running when a wireless stack is not installed or a request is made through the IPCC and shared tables.
Can I delete the RSS firmware?
No, it is marked as secure so it is not possible to delete it.
Can I make my own Wireless stack and upload it?
Currently, ST only allows uploading STs encrypted wireless stacks.
Programming the option bytes
Option byte programming is directly supported by J-Link.
To use option byte programming, the "STM32WBxxxx (allow opt. bytes)" variant of the device has to be selected.
Example: "STM32WB55RG (allow opt. bytes)"
Alternatively, option bytes can be programmed via the flash registers as shown in the example below.
Example - Setting system boot mode
Connect to the device using the following command line:
"%JLinkInstDir%/JLink.exe" -device "STM32WB55CG" -if SWD -speed 4000 -autoconnect 1
Read the OPTR register, and check if the required boot options are already set.
Mem32 0x58004020, 1 // Read OPTR to determine boot option bits.
If not, you can modify them via the following sequence.
Reset Write4 0x58004008, 0x45670123 // Unlock FLASH_CR Write4 0x58004008, 0xCDEF89AB // Unlock FLASH_CR Write4 0x5800400C, 0x08192A3B // Unlock FLASH_OPTR Write4 0x5800400C, 0x4C5D6E7F // Unlock FLASH_OPTR Write4 0x58004020, 0x33FFF1AA // Clear nBOOT0 & nSWBOOT0, keep nSWBOOT0 set. Write4 0x58004014, 0x00020000 // Set OPTSTRT Sleep 200 // Give operation some time Write4 0x58004014, 0x08000000 // Set OBL_LAUNCH
- For this example FLASH_OPTR is assumed to have ST production value (0x3DFF_F1AA).
- Setting OBL_LAUNCH will trigger a reset. This means, the debug connection will be lost afterwards.
- The same method can be used to reset the option bytes after performing a stack upgrade.
- When selecting "STM32WB55CG (ALLOW OPT. BYTES)", the option bytes can be written directly (address: 0x1FFF_8000), however the option bytes will not have loaded afterwards. It is either required to set OBL_LAUNCH (see above) or power-cycle the device.
Evaluation boards
- TBD