STM32F103: unlock RDP without reset

[Nick Belazor]

Posted on May 10, 2018 at 00:37

Hi, people!

how can i reset Read Out Protection on F103 series WITHOUT Power-off and reset??

HAL_FLASH_ob_launch --> it is reset (and hold MCU).

1. I set the LEVEL from 1 to 0 in subprogramm. All ok. Flash erased, all FF. good. But.. 2st first pages still in RW protect mode.

2. Then, I use my functions for remove write protection (chip now erased!). Then look debug on UART over terminal:

..before my operations: 0x1FFFF800: FFFFFF00

..after works my func: 0x1FFFF800: FFFF5AA5

Howerver, first 2st pages (4096 bytes) still on lock mode. And i can't modify it from my subprogram from RAM.

all other sectors is good, only first 2st FF FF FF FF FF........... and locked. not modified. Only after hard reset or power off - pages have a writable mode.

QUESTION: How can i write on 2st pages without reset when chip is already erased??????

(0x08000000..

0x08001000

is blocked, but level already set RDP == 0 and chip already erased... why?)

please, help

anybody

thx

#rdp #protection #stm32f103 #lock #f103

[Artur IWANICKI]

Posted on May 10, 2018 at 07:40

Hello,

What you are observing is a write protection of first pages (0-3 for low and medium density STM32F1) and 0-1 pages for high density and connectivity (F105, F107) devices) which is automatically enabled when readout protection is set.

It is done to protect potential bootloader against mass erase of the FLASH. Please refer to dedicated Flash Programming manual (PM0075 - link below) for more details.

http://www.st.com/content/ccc/resource/technical/document/programming_manual/10/98/e8/d4/2b/51/4b/f5/CD00283419.pdf/files/CD00283419.pdf/jcr:content/translations/en.CD00283419.pdf

In this case you would need to perform the reset to reload the option bytes after protection change. Please refer to Unprotection section (point 2.4.1) in above document.

Best Regards,

Artur

[Nick Belazor]

Posted on May 10, 2018 at 12:04

Thank you, Artur

yes.. i readed it before. In this manual saids for unprotect need reset:

Unprotection To disable the write protection, two application cases are provided:

â—� Case 1: Read protection disabled after the write unprotection:

– Erase the entire option byte area by using the OPTER bit in the Flash memory control register (FLASH_CR)

– Program the correct RDP code 0x00A5 to unprotect the memory. This operation first forces a Mass Erase of the main Flash memory.

– Reset the device (system reset) to reload the option bytes (and the new WRP[3:0] bytes), and to disable the write protection

â—� Case 2: Read protection maintained active after the write unprotection, useful for inapplication programming with a user boot loader:

– Erase the entire option byte area by using the OPTER bit in the Flash memory control register (FLASH_CR)

– Reset the device (system reset) to reload the option bytes (and the new WRP[3:0] bytes), and to disable the write protection.

How can i use it? My select is Case 2?

ok. i tryed it (RDP level == 1) in main program, my bootloader from flash after change RDP level to 1 and reboot:

..

HAL_FLASHEx_OBErase();

//*** press reset for reboot system

and next boot remove protection:

...

HAL_FLASHEx_OBGetConfig(&OptionsBytesStruct);

OptionsBytesStruct.OptionType = OPTIONBYTE_WRP;

OptionsBytesStruct.WRPPage = 0;

OptionsBytesStruct.WRPState = OB_WRPSTATE_DISABLE;

if(HAL_FLASHEx_OBProgram(&OptionsBytesStruct) != HAL_OK)

{ .. }

HAL_FLASHEx_OBGetConfig(&OptionsBytesStruct);

OptionsBytesStruct.OptionType = OPTIONBYTE_WRP;

OptionsBytesStruct.WRPPage = 1;

OptionsBytesStruct.WRPState = OB_WRPSTATE_DISABLE;

if(HAL_FLASHEx_OBProgram(&OptionsBytesStruct) != HAL_OK)

{ .. }

again reset!

again boot

nothing =(

RW protection still set and write data is impossible in first 2st pages

[Artur IWANICKI]

Posted on May 10, 2018 at 14:55

Hello Nick,

Have I understood you correctly that you would like to keep RDP=1 and then disable WRP on all pages, including first two ones?

From where you are executing the code (RAM, FLASH)?

This is what I have caught from your last message.

Concerning your code, WRPPage can be used with some predefined 32bit constants defined in stm32f1xx_hal_flash_ex.h and you can concatenate pages, so for page 0 and 1 you would need one OB_WRP_PAGES0TO1 (which is in face 0x1). There is no page defined for value 0.

Thank you in advance

Best Regards

Artur

[Nick Belazor]

Posted on May 11, 2018 at 00:15

Hello, Artur

thank you for your help!

Yes, i try change only WRite Protection to RW for first 2st pages. RDP need is 1 for protect my chip.

all operation i try making from my bootloader (app started from address 0x08000000, and RDP already set 1), also from subprogramm of own bootloader in RAM (over jump). and nothing...

Now i reworked my unlock function:

void UnProtectRWpages(void){

static FLASH_OBProgramInitTypeDef OptionsBytesStruct;

HAL_FLASH_Unlock();

HAL_FLASH_OB_Unlock();

HAL_FLASHEx_OBGetConfig(&OptionsBytesStruct);

OptionsBytesStruct.OptionType = OPTIONBYTE_WRP;

OptionsBytesStruct.WRPPage = OB_WRP_PAGES0TO1; //// Thx to Artur

OptionsBytesStruct.WRPState = OB_WRPSTATE_DISABLE;

if(HAL_FLASHEx_OBProgram(&OptionsBytesStruct) != HAL_OK) {

//*** Error occurred while options bytes programming. **********************

while (1) ;

}

HAL_FLASH_OB_Lock();

HAL_FLASH_Lock();

}

STEP 1, call func:

void MCU_PROTECTION_EraseOB(void){

HAL_FLASH_Unlock();

HAL_FLASH_OB_Unlock();

HAL_FLASHEx_OBErase();

HAL_FLASH_OB_Lock();

HAL_FLASH_Lock();

}

STEP 2 - reboot

STEP 3 - call UnProtectRWpages();

STEP 4 - reboot

.... look at 0x1FFFF800: 00 FF FF FF <<---- nothing... still locked and do not changed. First 2st pages is not modifable

[Artur IWANICKI]

Posted on May 11, 2018 at 08:20

Hello Nick,

I do not have good news for you unfortunately. The readout out protection on the STM32F1 family (it is not the case of other STM32 lines) automatically write protect first pages of Flash memory and till we have readout protection active we cannot erase/reprogram those first pages.

This is not visible in the option bytes, so it cannot be removed using write protection option bytes. The only way is to remove readout protection. The solution here would be to put some bootloader in first two sectors which would allow you to reprogram the FLASH content.

Best Regards,

Artur

[Nick Belazor]

Posted on May 11, 2018 at 10:18

Hello, Artur

Ohh.. Artur, i already understood it. But I got a good experience while trying to solve this issue and maybe I'll decide it over RAM or etc..need to think

well, thank you for your help! 

Best Regards,

Nick