How to remove Read Protection (Level1->0) by an external SWD prgrammer?

[gmravil]

Posted on February 23, 2015 at 12:25

I am making a stand-alone SWD programmer for STM32F1 and L1 families, based on STM32F103. For that I have used AN0062 ''

Programming Internal Flash

Over the Serial Wire Debug

Interface

'' by Silicon Labs. Everything works fine and the final touch I need to implement is the ability to re-program read-protected targets. However, the procedure to lower the Read Protection (RDP) from Level 1 to Level 0, described in the Reference Manual for STM32F1/L1 requires to read and write into Flash controller registers inside the target, that is prohibited by the Read Protection itself.

Does anybody knows a correct way to set the RDP to Level0 by means of an external custom SWD programmer?

Thanks!

#rdp #swd

[damh]

Posted on February 23, 2015 at 13:12

Unlock RDP:

1. unlock flash

2. unlock option bytes

3. erase option bytes

4. write new read out protection value

5. reset (or for some systems: relaunch option bytes (with implicit reset))

6. program flash

[FLASH, RCC, PWR, ... are readable and writeable. With RDP, too]

[gmravil]

Posted on February 24, 2015 at 06:16

Thanks for response, damh!

I just have tried it, with no success. As soon I start to unlock the Flash, i.e. read the FLASH->PECR register:

flash_PECR = readMem(FLASH_PECR_ADDR);

where

uint32_t readMem(uint32_t addr)

{

  uint32_t ret;

  writeAP(AP_TAR, addr);

  readAP(AP_DRW, &ret);

  readDP(DP_RDBUFF, &ret);

  return ret;

}

and

#define FLASH_PECR_ADDR        0x40023C04

i get the FAULT ack by SWD at the first

writeAP(AP_TAR, addr);

inside readMem().

Also, I have tried to write to the FLASH_PEKEYR_ADDR immediately without reading anything from the Flash controller inside the target. Also without success - the first use of  writeAP(AP_TAR, addr); causes the SWD's FAULT ack.

Some other things I did unsuccessfully try too:

. read (or write) OB_RDP_ADDR

. read FLASH_OBR_ADDR

. read RAM (0x20000000)

At the same time, the ST-LINK Utility removes the RDP on my target without a hitch.

Am I doing something wrong?

Thanks in advance!

[damh]

Posted on February 24, 2015 at 06:53

hmm :\

you can try to write a small program to run from RAM. Can you read/write the RAM?

[gmravil]

Posted on February 24, 2015 at 12:04

Sorry for misinformation.

It was my error. I forgot to clear SWD's error sticky bit after getting the first FAULT ack from a read-protected target. After clearing the sticky bit I got the access to the Flash controller registers on the target.

(BTW, the target is STM32F107/)

However, now I can't remove the Read Protection. Writing the RDP_Key (0x00A5) goes without errors, but after target's power-reseting the RDP is still enabled.

The code is:

FLASH_Status flashEraseAllOptionBytes(void)

{

    FLASH_Status status = FLASH_COMPLETE;

    status = flashWaitForLastOperation(EraseTimeout);

    if(status == FLASH_COMPLETE)

    {

        // Authorize the small information block programming

//        FLASH->OPTKEYR = FLASH_KEY1;

//        FLASH->OPTKEYR = FLASH_KEY2;

        writeMem((uint32_t)&(FLASH->OPTKEYR), FLASH_KEY1);

        writeMem((uint32_t)&(FLASH->OPTKEYR), FLASH_KEY2);

        uint32_t flash_CR;

        // if the previous operation is completed, proceed to erase the option bytes

//        FLASH->CR |= CR_OPTER_Set;

//        FLASH->CR |= CR_STRT_Set;

        flash_CR = readMem((uint32_t)&(FLASH->CR));

        flash_CR |= CR_OPTER_Set;

        writeMem((uint32_t)&(FLASH->CR), flash_CR);

        flash_CR |= CR_STRT_Set;

        writeMem((uint32_t)&(FLASH->CR), flash_CR);

        status = flashWaitForLastOperation(EraseTimeout);

        // Disable the OPTER Bit

//        FLASH->CR &= CR_OPTER_Reset;

        flash_CR = readMem((uint32_t)&(FLASH->CR));

        flash_CR &= CR_OPTER_Reset;

        writeMem((uint32_t)&(FLASH->CR), flash_CR);

        // Enable the Option Bytes Programming operation

//        FLASH->CR |= CR_OPTPG_Set;

        flash_CR = readMem((uint32_t)&(FLASH->CR));

        flash_CR |= CR_OPTPG_Set;

        writeMem((uint32_t)&(FLASH->CR), flash_CR);

        // Disable Read Protection

//        OB->RDP = 0x00;

        writeAP(AP_CSW, AP_CSW_DEFAULT_16);    // as STM32F1's FPEC works in 16-bit mode, switch to AHB-AP size to 16-bit

//        writeMem((uint32_t)&(OB->RDP), RDP_Key);

        writeMem(0x1FFFF800, 0x00A5);

        writeAP(AP_CSW, AP_CSW_DEFAULT);    // switch to AHB-AP size back to 32-bit

        status = flashWaitForLastOperation(EraseTimeout);

        flash_CR = readMem((uint32_t)&(FLASH->CR));

        flash_CR &= CR_OPTPG_Reset;

        writeMem((uint32_t)&(FLASH->CR), flash_CR);

    }

    return status;

}

Just in case, I also tried writing RDP_key = 0x5AA5, without success.

Will try to remove RDP on an STM32L1 in meanwhile...

Thanks for your time!

[Tesla DeLorean]

Posted on February 24, 2015 at 13:03

You miss Step#1

[gmravil]

Posted on February 24, 2015 at 13:09

Sorry again for posting too fast without checking manuals. :)

All I had to do was to unlock the FPEC itself before starting to work with the Option Byte Register.

static void flashUnlock(void)

{

    writeMem((uint32_t)&(FLASH->KEYR), FLASH_KEY1);

    writeMem((uint32_t)&(FLASH->KEYR), FLASH_KEY2);

}

Thanks again for your support!

[peng jun]

Posted on July 15, 2018 at 04:59

Hi。From the  <PM0075  Programming manual>  ， P15，Mass Erase  as below code is successful 。Now，I  want to Main Flash memory programming  ,  but  I don't  how to do it  .  Help  me.....

Thanks!

FLASH_Status flashEraseAllOptionBytes_STM32(void)

{

   FLASH_Status status = FLASH_COMPLETE;

   uint32_t flash_CR,flash_SR;

  flash_CR = readMem((uint32_t)&(FLASH->CR));

  flash_CR |= CR_MER_Set;

  writeMem((uint32_t)&(FLASH->CR), flash_CR);

  flash_CR |= CR_STRT_Set;

  writeMem((uint32_t)&(FLASH->CR), flash_CR);

  status = FLASH_WaitForLastOperation(((uint32_t)0x000B0000));

return 0x09;

}