Skip to main content
O
oga
Associate III
February 25, 2025
Question

FUS_STATE_ERROR_IMG_CORRUPT after calling SHCI_C2_FUS_FwUpgrade(0,0)

  • February 25, 2025
  • 0 replies
  • 346 views

hello

I'm working on a STM32WB55 P-NUCLEO

I'm trying to make a binary that will self update Wireless stack (WL FW

I took inspiration from https://github.com/stm32-hotspot/STM32WB-FUS-Command-Line-Interface.git

the objective is to embed new FW in a C byte array and to let the user binary to call FUS for :

delete current stack

calc the good adress for WL FW (@SFSA -

clean flash

copy the new WL FW C blob

call upgrade

all the rest is ignored right now to simplify explainations

here you can find my app_entry.c APPE_SysEvtReadyProcessing function (everything is here)

static void APPE_SysEvtReadyProcessing(void * pPayload)
{
 uint8_t fus_state_value;
 SHCI_CmdStatus_t res;
 TL_AsynchEvt_t *p_sys_event;
 SHCI_C2_Ready_Evt_t *p_sys_ready_event;
 SHCI_FUS_GetState_ErrorCode_t ec;

 p_sys_event = (TL_AsynchEvt_t*)(((tSHCI_UserEvtRxParam*)pPayload)->pckt->evtserial.evt.payload);
 p_sys_ready_event = (SHCI_C2_Ready_Evt_t*) p_sys_event->payload;
 /* Traces channel initialization */
 TL_TRACES_Init();
 	FLASH_OBProgramInitTypeDef ob;
 	HAL_FLASHEx_OBGetConfig(&ob);
	start_fw_address=ob.SecureFlashStartAddr-(((BIN_SIZE/FLASH_PAGE_SIZE)+1)*FLASH_PAGE_SIZE); // @of first flash page that fits the FW size
	uint8_t FUS_FW_RUN=!(p_sys_ready_event->sysevt_ready_rsp == WIRELESS_FW_RUNNING);
 if (!FUS_FW_RUN){
 APP_DBG_MSG("[-- WIRELESS FW IS RUNNING --]\r\n");
	printf("WIRELESS FW running reboot to FUS\r\n"); HAL_Delay(100);
	(void)SHCI_C2_FUS_GetState( NULL );
	(void)SHCI_C2_FUS_GetState( NULL );
	wait4reboot();// this is and infinite while with a refresh of IWDG
 }
 else
 {
	APP_DBG_MSG("[-- FUS IS RUNNING --]\r\n");
	printFusNWirlessInfos(); // display wireless firmware version / build / type
	printFWpointers(); // display differentes usefull adress (app / wl / sfsa etc.)

 fus_state_value = SHCI_C2_FUS_GetState( &ec );
 while(fus_state_value != FUS_STATE_VALUE_IDLE){
 	printf("FUS PROCESS on going ... ");
 	print_FUS_STATE_VALUE(fus_state_value,ec); // display FUS state and error status
 	fus_state_value = SHCI_C2_FUS_GetState( &ec );
 	HAL_Delay(500);
 }
 print_FUS_STATE_VALUE(fus_state_value,ec);

 	switch(CFG_REBOOT_VAL_MSG)
 {
 case CFG_IDLE:
 	printf("START UPDATE PROCEDURE\r\n");
 	CFG_REBOOT_VAL_MSG=CFG_FUS_FW_DELETE;
 	wait4reboot();
 break;
 case CFG_FUS_FW_DELETE:
 	printf("DELETE CURRENT FUS FIRMWARE\r\n");HAL_Delay(500);
 	 printf("call SHCI_C2_FUS_FwDelete()\r\n");HAL_Delay(500);
 res =SHCI_C2_FUS_FwDelete();
 if(res==SHCI_Success){
 	 CFG_REBOOT_VAL_MSG = CFG_FUS_FW_UPGRADE;
 print_SHCI_CmdStatus_t(res);HAL_Delay(100);
 wait4reboot();
 }
 else{
 	 CFG_REBOOT_VAL_MSG = CFG_IDLE; // back to begining
 print_SHCI_CmdStatus_t(res);HAL_Delay(100);
 wait4reboot();
 }
 break;

 case CFG_FUS_FW_UPGRADE:
 APP_DBG_MSG("UPGRADE WIRELESS FIRMWARE\r\n");
	 Delete_Sectors();
	 copyBin();
	 checkBin();
	 printf("call SHCI_C2_FUS_FwUpgrade(0,0)\r\n");
	 CFG_REBOOT_VAL_MSG = CFG_FUS_END;
 res =SHCI_C2_FUS_FwUpgrade(0,0);
 print_SHCI_CmdStatus_t(res);HAL_Delay(100);
	 do{
		printf("UPGRADE ongoing ... ");
 	fus_state_value = SHCI_C2_FUS_GetState( &ec );
 	print_FUS_STATE_VALUE(fus_state_value,ec);
		HAL_Delay(500);
	 }while(1);//while(fus_state_value != FUS_STATE_VALUE_IDLE);wait4reboot();
 break;
 case CFG_FUS_END:
 	APP_DBG_MSG("END OF PROCESS\r\n");
 	CFG_REBOOT_VAL_MSG = CFG_IDLE;
		wait4reboot();

 	break;
 default :
 	CFG_REBOOT_VAL_MSG = CFG_IDLE;
 	break;
 }
 }
 wait4reboot();
}

just here you can find the output durring all process over all reboots

[-- FUS IS RUNNING --]
Get Wireless Infos : SHCI_Success
Wireless Firmware version 0.0.0 // no WL stack installed yet 
Wireless Firmware build 0
FUS version 1.2.0
Wireless Firmware Type : Unknown
StartOfAppAddr : 0x08000000 // this user app
EndOfAppAddr : 0x0803E800 
SecureFlashStartAddr : 0x080F4000 // SFSA addr
StartOfFwPageAddr : 0x080D0000 // calc addr of newly installed WL stack ( based on SFSA)looks coherent with readme of STM32CubeWB release 
SizeOfFW : 0x00023F80 // size of new WL stack
EndOfFwAddr : 0x080F3F80 // las WL stack @ (muste be less that actual SFSA)
FUS state : IDLE | FUS_STATE_ERROR_NO_ERROR
START UPDATE PROCEDURE
[-- FUS IS RUNNING --] // first manual reboot to trigg the start sequence 
Get Wireless Infos : SHCI_Success
Wireless Firmware version 0.0.0
Wireless Firmware build 0
FUS version 1.2.0
Wireless Firmware Type : Unknown
StartOfAppAddr : 0x08000000
EndOfAppAddr : 0x0803E800
SecureFlashStartAddr : 0x080F4000
StartOfFwPageAddr : 0x080D0000
SizeOfFW : 0x00023F80
EndOfFwAddr : 0x080F3F80
FUS state : IDLE | FUS_STATE_ERROR_NO_ERROR
DELETE CURRENT FUS FIRMWARE
call SHCI_C2_FUS_FwDelete() // clear actual WL stack
SHCI_Success
[-- FUS IS RUNNING --] // reboot trigged by FUS after SHCI_C2_FUS_FwDelete()
Get Wireless Infos : SHCI_Success
Wireless Firmware version 0.0.0
Wireless Firmware build 0
FUS version 1.2.0
Wireless Firmware Type : Unknown
StartOfAppAddr : 0x08000000
EndOfAppAddr : 0x0803E800
SecureFlashStartAddr : 0x080F4000
StartOfFwPageAddr : 0x080D0000
SizeOfFW : 0x00023F80
EndOfFwAddr : 0x080F3F80
FUS PROCESS on going ... FUS state : SERVICE_ONGOING | FUS_STATE_ERROR_IMG_NOT_FOUND // ok because no WL is installed yet (problem is the same if I avoid this step)
FUS state : IDLE | FUS_STATE_ERROR_NO_ERROR
UPGRADE WIRELESS FIRMWARE
Erasing internal memory sectors [62 244] // errase flash (even if it should ne be needed)
OK
flash wireless FW @ 0x080D0000 // copy C byte array to the 
OK
[AB A3 2C F4 ... 22 5E 2C A1 D3 ] // check that flash is ok regarding the input C byte array
Check Copy FW from: 0x080D0000 to : 0x080F3F80
0 err found // no error durring flash
call SHCI_C2_FUS_FwUpgrade(0,0)
SHCI_Success
[-- FUS IS RUNNING --] // reboot trigget by FUS right after SHCI_C2_FUS_FwUpgrade call
Get Wireless Infos : SHCI_Success
Wireless Firmware version 1.21.0 // WL stack looks to be found 
Wireless Firmware build 3
FUS version 1.2.0
Wireless Firmware Type : Unknown
StartOfAppAddr : 0x08000000
EndOfAppAddr : 0x0803E800
SecureFlashStartAddr : 0x080D0000 // SFSA looks to be well moved to the new WL Stack place 
StartOfFwPageAddr : 0x080AC000 // not relevant yet as SFSA is including new WL stack 
SizeOfFW : 0x00023F80
EndOfFwAddr : 0x080CFF80
FUS PROCESS on going ... FUS state : FW_UPGRD_ONGOING | FUS_STATE_ERROR_NO_ERROR // FUS stil in upgrade 
FUS PROCESS on going ... FUS state : FW_UPGRD_ONGOING | FUS_STATE_ERROR_NO_ERROR
FUS PROCESS on going ... FUS state : FW_UPGRD_ONGOING | FUS_STATE_ERROR_NO_ERROR
FUS PROCESS on going ... FUS state : FW_UPGRD_ONGOING | FUS_STATE_ERROR_NO_ERROR
FUS PROCESS on going ... FUS state : FW_UPGRD_ONGOING | FUS_STATE_ERROR_NO_ERROR
FUS PROCESS on going ... FUS state : FW_UPGRD_ONGOING | FUS_STATE_ERROR_NO_ERROR
[-- FUS IS RUNNING --] // new reboot triged by FUS 
Get Wireless Infos : SHCI_Success
Wireless Firmware version 0.0.0 // WL stack looks empty now 
Wireless Firmware build 0
FUS version 1.2.0
Wireless Firmware Type : Unknown
StartOfAppAddr : 0x08000000
EndOfAppAddr : 0x0803E800
SecureFlashStartAddr : 0x080F4000 // SFSA get back to "no WL stack" position
StartOfFwPageAddr : 0x080D0000
SizeOfFW : 0x00023F80
EndOfFwAddr : 0x080F3F80
FUS PROCESS on going ... FUS state : FW_UPGRD_ONGOING | FUS_STATE_ERROR_IMG_CORRUPT // ??? 
FUS state : IDLE | FUS_STATE_ERROR_NO_ERROR
END OF PROCESS

my issue is that even if at beginig new WL stack looks to be well discovered after fus upgrade call I got a new reboot with a "fus error image corrupted" even if I have well check my copy in flash

I did succeded few times to get this WLStack accepted by fus I didn changed anything to my byte array

heres my WL stack byte array files

#ifndef _BIN_IMAGE_H_
#define _BIN_IMAGE_H_
/***************************************************************************//**
 * file ./bin_image.h
 * Binary FW file to H file converter 
 * Generated on February 25, 2025 at 15:38:02
 ******************************************************************************/
#include <stdint.h>
/* stm32wb5x_BLE_Stack_full_fw.bin */

#define FW_DATETIME "February 25, 2025 at 15:38:02"
#define FW_NAME "stm32wb5x_BLE_Stack_full_fw.bin"
#define BIN_SIZE 0x23f80
extern const uint8_t FW_Bin[BIN_SIZE];
#endif //_BIN_IMAGE_H_
/***************************************************************************//**
 * file ./bin_image.c
 * Binary FW file to C file converter 
 * Generated on February 25, 2025 at 15:38:02
 ******************************************************************************/
#include <stdint.h>
#include "bin_image.h"
/* stm32wb5x_BLE_Stack_full_fw.bin */

const uint8_t FW_Bin [BIN_SIZE] = {0xab,0xa3,0x2c,0xf4,0x2,0x4a,0x25,0x30,0x9f,0x76,0xfd,0x2f,0x1e,0x36,0x15,0x0,
// reduced to not overtflow the forum 
0x45,0x0,0x11,0x22,0x5e,0x2c,0xa1,0xd3,};

my c bytes array representing the new Wireless  FW is generated by a  really simple python script

if anyone has an idea why I got this corrupted image error I'm more that happy to read it !

thanks a lot

 

 

Terms & ConditionsAccessibility statement