STM32WB55 Unlock "Security Configuration Option bytes - 2"

[AlexJ]

Hello,

I have some trouble with a STM32 MCU.

I was playing with the radio firmware and delete it.

From now on, I'm unable to reprogram it, I always get this kind of error ( FUS_STATE_ERR_UNKNOWM) :

FUS seems to be in bad state :

 

By comparaison with a working board, I find that a secure flash address has been configured to this MCU and it overlap the FUS/radio firmware address :

Now I'm trying to revert back this value to the factory 0xF4 value but I'm unable to do so.
STM32CubeProgrammer won't accept to modify bits in the security option 2.

 

Even with the factory reset command using STM32_Programmer_CLI software it didn't work (I don't remember the exact command)

 

I checked the datasheet and find that I needed to enter keys to unlock these bits but either using the STM32_Programmer_CLI :

 

STM32_Programmer_CLI --connect port=SWD -w32 0x58004008 0x45670123
STM32_Programmer_CLI --connect port=SWD -w32 0x58004008 0xCDEF89AB

STM32_Programmer_CLI --connect port=SWD -w32 0x5800400C 0x08192A3B
STM32_Programmer_CLI --connect port=SWD -w32 0x5800400C 0x4C5D6E7F

STM32_Programmer_CLI --connect port=SWD --optionbytes SFSA=0xCE

or trying some code

FLASH->KEYR = 0x45670123; // set Flash key to allow writes to FLASH_CR
FLASH->KEYR = 0xCDEF89AB;
FLASH->OPTKEYR = 0x08192A3B;// set Flash optkey to allow writes to FLASH_OPTR
FLASH->OPTKEYR = 0x4C5D6E7F;
FLASH->SFR |= FLASH_SFR_FSD_Msk;

 

It didn't work at all, either command is not accepted, either, the software end up in an interruption

 

Is there any one who have any clue ?

 

Thanks

[Lubos KOUDELKA]

Hello,

for security reasons, security option are secured against write from CPU1, only CPU2 can change them. For more details you can check STM32WB55 reference manual (RM0434), CPU2 security part.

 

Please try following steps on your side:

1) Connect using STM32CubeProgrammer, make sure no RDP or write protection are activated in option bytes

2) Perform mass erase (to be sure about FW running in the MCU and be sure FUS operator is detecting right FW in memory)

3) In RF tab of STM32CubeProgrammer, activate WB command "Firmware delete"

- after command finishes, you shall see 0xf4 in SFSA

 

If not successful, please post back your error log.

 

Thank you, Best regards,

Lubos

[AlexJ]

Thanks for your message.

I try your procedure

1) No RDP :

No write protection (I think) :

2) Perform a mass erase :

3) Trying to delete radio firmware :

And got an error...

Any other clue ?

[Lubos KOUDELKA]

Hello,
thank you for posting pictures showing your steps. The last one with error shows also the log. From the log I can see operations fails, when STM32CubeProgrammer is erasing first two sectors (8 kB starting 0x08000000) to load FUS operator, but erase of those 2 sectors fails. Also before that is in log "failed to erase memory", but not visible to which commands it's tight.
This is typically issue with write protection, which you show is not enabled. Could you please verify write protection is not active?
Please check PCROP as well.

Please ensure your option bytes setting is correctly written in MCU. When you do power cycle (disconnect and connect USB cable), can you still see the same content?
When not successful, please post post also picture with Security Configuration Option bytes - 2.

Thank you, Best regards,
Lubos