Can I erase an STM32, using JTAG, once Read Out Protection has been enabled?

[darcy23]

Posted on May 04, 2011 at 00:58

Can I erase an STM32, using JTAG, once Read Out Protection has been enabled?

[Tesla DeLorean]

Posted on May 17, 2011 at 14:33

Honestly I think a call to Segger might be in order, if they don't have something that does 95% of what you want out-of-the-box, I think they have enough wherewithal to get you there.

The format of their configuration file suggests they can handle multiple devices on a chain. Even if you had to create a script for each device, cherry-picking it out of the chain, to mash-up a proof of concept.

AppVersion = 41518

[GENERAL]

  ConnectMode = 0

  CurrentFile = ''C:\Documents and Settings\Alex\Desktop\AT91SAM9G20-EK\RAMCodeV2_AT91SAM9G20-EK_DataFlashAT45DBxxxD_LE.mot''

  DataFileSAddr = 0x00000000

  GUIMode = 0

  HostName = ''''

  TargetIF = 0

  USBPort = 0

  USBSerialNo = 0x00000000

[JTAG]

  Device0_ID = 0x0792603F

  Device0_IRLen = 0x00000004

  Device0_Name = ''ARM926EJ-S Core''

  IRLen = 0

  MultipleTargets = 2

  NumDevices = 1

  Speed0 = 5

  Speed1 = 12000

  TAP_Number = 0

  UseAdaptive0 = 1

  UseAdaptive1 = 0

  UseMaxSpeed0 = 0

  UseMaxSpeed1 = 0

...

I seem to remember ST had release some test/program tools/libraries for the STM32, they probably used the ST-LINK, and who knows how many devices in a chain it supports.

[darcy23]

Posted on May 17, 2011 at 14:33

Hi Clive,

Inevitably, the problems I always bump in to are with regards to the JTAG chain.  We're happy to pay for tools if I could find something that would work without days of trial & error. The solution can have a manual involvment if neccessary since we produce a high value, low numbers sort of product.

[Tesla DeLorean]

Posted on May 17, 2011 at 14:33

I'd wager that you could do it with any JTAG tools that permits you to poke registers, load and run code.

Examine the tools you have to see if they have any scripting to get debugging working, handle SRAM mapping, chip select(s), loading to SDRAM, etc. Look at board support for other vendors' ARM solutions, most require you jump through a lot of hoops to get the hardware to a debuggable state, and this is often exposed in an INI or initialization file, because you have to be able to customize the tool chain to your specific board, processor, hardware, etc.

While I haven't done it with an STM32, the Segger JLink/JFlash tool permits you to script an initialization file (poke assorted registers), and upload custom code as a Motorola S file. They have a DLL library that might also permit you to chase devices down a chain one-by-one, as I presume you want an automated solution.

To see some example JFlash initialization scripts, download a current driver set. And look at an example :

C:\Program Files\SEGGER\JLinkARM_V420h\Samples\JFlash\ProjectFiles\AT91SAM9G20-EK\AT91SAM9G20-EK_DataFlash.jflash

With Keil there are INI files which do a similar job poking registers, downloading code with the debug button (ie can reset a processor, setup SDRAM, load code, run). These presumably work with both ULink and JLink pods, although on more of a one-up basis.

It's possible also to code your firmware to enable/disable ROP too. Although ROP'd devices are clearly a PITA to work with, for obvious reasons.

[mrost9]

Posted on May 17, 2011 at 14:33

I once did it with OpenOCD and USBJtag (FT2232-based).

OpenOCD can also easily be scripted to use multiple Devices per Chain, and works with a lot of hardware. I've had no luck getting anything newer than 0.1.0 to work, though.

This is my code:

-------------------------

#wait_halt

#poll

#### Read RAM ####

mdw 0x20000000 32

#### Read Flash (Read out protection?) ####

mdw 0x08000000 32

shutdown

###### dont change anything! This will clear readout protection!

###### dont forget to power cycle afterwards!

stm32x options_read 0

stm32x unlock 0

stm32x options_read 0

flash protect 0 0 last off

stm32x options_read 0

stm32x options_write 0 SWWDG NORSTSTNDBY NORSTSTOP

stm32x options_read 0

#stm32x mass_erase 0

reset

resume

poll

shutdown

----------------------------------

I assume there are some safety exits in the code, e.g. line 9.

Disclaimer: I'm certain I found this code in some forum, maybe even here ;)

[darcy23]

Posted on May 17, 2011 at 14:33

Cheers... I'll have another look at the Segger tool chain.

If anyone else has any experience with this please sing out...

[mrost9]

Posted on May 17, 2011 at 14:33

Well, the OpenOCD 0.1.0 contains a setup for the STM32 Performance-Stick ready to run.

The PerformanceStick JTAG is a FT2232, with a STM32 and a STR7 daisy-chained.

Worked for me without a problem.

[darcy23]

Posted on May 17, 2011 at 14:33

Thanks,

My biggest issue with OpenOCD scripts are that I have never found a good example of scan chain devices...  I'd definitely give this a go if I just had the one device, but this damn scan chain limits what I can do because I can't find examples to teach me otherwise...