STM32H755ZI-Q NUCLEO Board Inaccessible After Enabling Secure Memory Area
I am working on a secure bootloader implementation for the STM32H755 microcontroller using the NUCLEO-H755ZI-Q development board.
I am facing an issue where the MCU has become inaccessible after configuring the secure memory area through option bytes. I would appreciate your guidance on recovering the device.
Hardware and software details
- Board: NUCLEO-H755ZI-Q
- MCU: STM32H755
- STM32CubeProgrammer: Version 2.20.0
- Debug probe: Onboard ST-LINK V3
- RDP: 0xAA (Level 0)
- SECURITY: Enabled
- SEC_AREA_START1: 0x000
- SEC_AREA_END1: 0x1FF (128 KB secure area)
Sequence of events
- I erased the user flash before configuring the secure memory area, so the bootloader firmware was no longer present.
- I enabled the SECURITY option byte and configured a 128 KB secure area from 0x08000000 to 0x0801FFFF.
- After applying the option-byte configuration, I could no longer connect to the MCU.
- The RDP level remains 0xAA (Level 0). I have not intentionally changed it to Level 1 or Level 2.
Recovery attempts
I have tried the following without success:
- ST-LINK connection using SWD.
- Connection under reset and Hot Plug modes.
- Reduced SWD frequency.
- Entering System Memory boot mode using BOOT0 (LD3 is not glowing).
- Connecting through the UART ROM bootloader on COM13 at 115200 baud.
- Tried with all available connection modes using cube programmer.
The ST-LINK connection reports errors such as “Unable to get core ID” and “No STM32 target found.” The UART connection fails during device activation with a timeout waiting for acknowledgement.
I also reviewed the STM32H755 reference manual and found the documented mass-erase-with-protection-removal procedure. However, because the MCU is inaccessible and the bootloader has already been erased, I currently have no way to execute the required recovery firmware on the target.
Request for assistance
Could you please advise on the officially supported recovery procedure for this condition?
Specifically, I would like to know:
- Is it possible to recover the MCU while RDP remains at Level 0 and the secure memory area is enabled?
- Is there a supported method to execute the protection-removal or mass-erase sequence when both SWD and the ROM bootloader are inaccessible?
- Can the secure-area configuration be removed through any supported ST-LINK, STM32CubeProgrammer, or factory recovery procedure?
- If recovery is not possible through the available interfaces, is there another recommended solution?
My intention is to secure the bootloader code for a production implementation, and I would like to understand the correct procedure before enabling this feature again on another board.
Please let me know if you require the option-byte configuration screenshots, connection logs, or any additional information.