How to change read out protection from level 1 to level 0 with STM32CubeProgrammer?

[Nicolas1]

Background information : we are using STM32F407 for our product and 2 of them (out of 3) encounters the same problem: RDP level has been changed from level 0 to level 1 and stopped working without any modification from our part. Before even thinking of solving the problem, we would like to switch back from RDP level 1 to level 0.

This problem is exactly the same than the one discussed here 7 years ago and where no solutions are given.

One way to do so is by using STM32CubeProgrammer. Here is what I tried:

• Open STM32CubeProgrammer
• Connect to the µC via ST-LINK: the data read failed because of RDP level

14:29:10 : STM32CubeProgrammer API v2.8.0
 14:29:24 : Warning: Device changed, refreshing...
 14:29:24 : ST-LINK SN : 50FF70067867515335590967
 14:29:24 : ST-LINK FW : V2J29S7
 14:29:24 : Board : --
 14:29:24 : Voltage : 3.18V
 14:29:24 : SWD freq : 4000 KHz
 14:29:24 : Connect mode: Normal
 14:29:24 : Reset mode : Software reset
 14:29:24 : Device ID : 0x413
 14:29:24 : Revision ID : Rev 2.0
 14:29:24 : UPLOADING OPTION BYTES DATA ...
 14:29:24 : Bank : 0x00
 14:29:24 : Address : 0x40023c14
 14:29:24 : Size : 4 Bytes
 14:29:24 : UPLOADING ...
 14:29:24 : Size : 1024 Bytes
 14:29:24 : Address : 0x8000000
 14:29:24 : Read progress:
 14:29:24 : Error: Data read failed

•  Open the "Option bytes" tab
• Notice that the RDP value is 0xFF (level 1 as per the documentation)
• Change the value to 0xAA (for level 0) and click on "Apply" (with max verbosity)

14:33:54:632 : Option byte command : -ob RDP=170 
 14:33:54:639 : PROGRAMMING OPTION BYTES AREA ...
 14:33:54:640 : Bank : 0x00
 14:33:54:640 : Address : 0x40023c14
 14:33:54:640 : Size : 4 Bytes
 14:33:54:641 : OB buffer: edaaff0f
 14:33:54:642 : Buffer program...
 14:33:54:654 : halt ap 0 
 14:33:54:656 : w ap 0 reg 15 PC (0x20000000) 
 14:33:54:656 : w ap 0 reg 17 MSP (0x20000500) 
 14:33:54:656 : w ap 0 reg 16 xPSR (0x01000000) 
 14:33:54:669 : w ap 0 @0x20000C20 0x00000200 bytes Data 0x00000000
 14:33:54:670 : w ap 0 @0x20000000 0x00000004 bytes Data 0x0000BE00
 14:33:54:674 : w ap 0 @0x20000004 0x000007F4 bytes Data 0xF000B580
 14:33:54:674 : w ap 0 @0x20000C20 0x00000004 bytes Data 0x0FFFAAED
 14:33:54:675 : Loader write option bytes...
 14:33:54:675 : Init flashloader...
 14:33:54:675 : halt ap 0 
 14:33:54:675 : w ap 0 reg 0 R0 0x00000001
 14:33:54:675 : w ap 0 reg 1 R1 0x00000000
 14:33:54:675 : w ap 0 reg 2 R2 0x00000000
 14:33:54:675 : w ap 0 reg 3 R3 0x00000000
 14:33:54:675 : w ap 0 reg 4 R4 0x00000000
 14:33:54:675 : w ap 0 reg 5 R5 0x00000000
 14:33:54:675 : w ap 0 reg 6 R6 0x00000000
 14:33:54:675 : w ap 0 reg 7 R7 0x00000000
 14:33:54:675 : w ap 0 reg 8 R8 0x00000000
 14:33:54:676 : w ap 0 reg 9 R9 0x00000000
 14:33:54:676 : w ap 0 reg 10 R10 0x00000000
 14:33:54:677 : w ap 0 reg 11 R11 0x00000000
 14:33:54:677 : w ap 0 reg 12 R12 0x00000000
 14:33:54:677 : w ap 0 reg 13 SP 0x00000000
 14:33:54:677 : w ap 0 reg 14 LR 0x20000001
 14:33:54:681 : w ap 0 reg 15 PC 0x20000005
 14:33:54:681 : w ap 0 reg 16 xPSR 0x01000000
 14:33:54:681 : w ap 0 reg 17 MSP 0x20000BF4
 14:33:54:682 : w ap 0 reg 18 PSP 0x00000000
 14:33:54:682 : run ap 0 
 14:33:54:682 : halt ap 0 
 14:33:54:683 : r ap 0 reg 0 R0 0x00000001
 14:33:54:687 : w ap 0 reg 0 R0 0x40023C14
 14:33:54:688 : w ap 0 reg 1 R1 0x00000004
 14:33:54:690 : w ap 0 reg 2 R2 0x20000C20
 14:33:54:690 : w ap 0 reg 3 R3 0x00000002
 14:33:54:690 : w ap 0 reg 4 R4 0x00000000
 14:33:54:692 : w ap 0 reg 5 R5 0x00000000
 14:33:54:692 : w ap 0 reg 6 R6 0x00000000
 14:33:54:693 : w ap 0 reg 7 R7 0x00000000
 14:33:54:693 : w ap 0 reg 8 R8 0x00000000
 14:33:54:694 : w ap 0 reg 9 R9 0x00000000
 14:33:54:694 : w ap 0 reg 10 R10 0x00000000
 14:33:54:694 : w ap 0 reg 11 R11 0x00000000
 14:33:54:694 : w ap 0 reg 12 R12 0x00000000
 14:33:54:694 : w ap 0 reg 13 SP 0x00000000
 14:33:54:694 : w ap 0 reg 14 LR 0x20000001
 14:33:54:694 : w ap 0 reg 15 PC 0x200000AB
 14:33:54:694 : w ap 0 reg 16 xPSR 0x01000000
 14:33:54:694 : w ap 0 reg 17 MSP 0x20000BF4
 14:33:54:694 : w ap 0 reg 18 PSP 0x00000000
 14:33:54:694 : run ap 0 
 14:33:57:969 : UPLOADING OPTION BYTES DATA ...
 14:33:57:969 : Bank : 0x00
 14:33:57:969 : Address : 0x40023c14
 14:33:57:969 : Size : 4 Bytes
 14:33:57:970 : Reading data...
 14:33:57:971 : r ap 0 @0x40023C14 0x00000004 bytes Data 0x0FFFFFED
 14:33:57:972 : OPTION BYTE PROGRAMMING VERIFICATION:
 14:33:57:972 : Error: Expected value for Option Byte "RDP": 0xAA, found: 0xFF
 14:33:57:980 : Error: Option Byte Programming failed
 14:33:58:009 : UPLOADING OPTION BYTES DATA ...
 14:33:58:009 : Bank : 0x00
 14:33:58:009 : Address : 0x40023c14
 14:33:58:010 : Size : 4 Bytes
 14:33:58:010 : Reading data...
 14:33:58:010 : r ap 0 @0x40023C14 0x00000004 bytes Data 0x0FFFFFED

 What do I do wrong? Why can't I changed the RDP level back to 0?

[TDK]

I seem to recall you needing to do a full chip erase at the same time. (This is true, but STM32CubeProgrammer does it for you.)

Is this a custom board?

I can't replicate this on a STM32F4 board.

[Nicolas1]

Thank you for your reply. Yes, this is a custom board. The strange thing is that RDP level has changed without any intentional doing on our part, it may be a consequence of something else as people have experienced in the previously given link. With another software to write the µC's register, we will try to rewrite the RDP level and then do a mass erase.

[Nicolas1]

According to one of our hardware guys, the initial problem could have been triggered by the fact that the PDR_ON pin is a floating pin on our card. It seems to the "Option bytes" register could be corrupted if the power supply is defective while loading the "Option bytes" register.

This analysis doesn't change the fact that we should be able to modify the "Option bytes" register.

[Nicolas1]

Furthermore, the state in which our µC is doesn't allow us to re-program it.

[alister]

I experienced similar several months ago with ST-LINK/V2 on an STM32H7. The ST-LINK/V2 would not connect when RDP was level 1 despite STM32CubeProgrammer using Mode = Under reset and Reset mode = Hardware reset. It turned out the RST pin of the JTAG connector was broken, and the ST-LINK/V2' s mode was effectively always Hot plug.

[Nicolas1]

We checked the probe and it is fine. After unlocking it, we can write the "Flash option control register" to change its value from 0x0FFFFFED to 0x0FFFAAED but the register's value isn't kept after a reset.

[TDK]

> We checked the probe and it is fine. After unlocking it, we can write the "Flash option control register" to change its value from 0x0FFFFFED to 0x0FFFAAED but the register's value isn't kept after a reset.

You need to launch the option bytes to apply them. The option bytes are in flash (nonvolatile), the register you're accessing is just a shadow register in RAM (volatile).