STM32H750 can not read flash bank1 while not in read protection

SandSwitch · ‎2025-01-16

Hi,
I'm encountering an issue with my STM32H750 MCU.

I download my program to the flash via the UART interface using STM32CubeProgrammer. The MCU can work well for a few days, but suddenly crashed. This problem occurred randomly on 2 out of 15 boards with the same hardware and software design.

Here are diagnostic steps taken:

(1)Connecting via the SWD interface using J-link and found option bytes(0x52002000) is able to read, but flash bank 1(0x08000000)is unable to read

Checked the read protection was set to level 0. J-link log:

SEGGER J-Link Commander V8.12a (Compiled Jan  9 2025 14:39:11)
DLL version V8.12a, compiled Jan  9 2025 14:38:21

Connecting to J-Link via USB...O.K.
Firmware: J-Link V9 compiled Dec 13 2022 11:14:50
Hardware version: V9.70
J-Link uptime (since boot): N/A (Not supported by this model)
S/N: 69730352
License(s): RDI, GDB, FlashDL, FlashBP, JFlash
VTref=3.296V


Type "connect" to establish a target connection, '?' for help
J-Link>connect
Please specify device / core. <Default>: STM32H750VB
Type '?' for selection dialog
Device>
Please specify target interface:
  J) JTAG (Default)
  S) SWD
  T) cJTAG
TIF>S
Specify target interface speed [kHz]. <Default>: 4000 kHz
Speed>
Device "STM32H750VB" selected.


Connecting to target via SWD
ConfigTargetSettings() start
ConfigTargetSettings() end - Took 11us
InitTarget() start
SWD selected. Executing JTAG -> SWD switching sequence.
DAP initialized successfully.
InitTarget() end - Took 19.9ms
Found SW-DP with ID 0x6BA02477
DPv0 detected
CoreSight SoC-400 or earlier
Scanning AP map to find all available APs
AP[3]: Stopped AP scan as end of AP map has been reached
AP[0]: AHB-AP (IDR: 0x84770001, ADDR: 0x00000000)
AP[1]: AHB-AP (IDR: 0x84770001, ADDR: 0x01000000)
AP[2]: APB-AP (IDR: 0x54770002, ADDR: 0x02000000)
Iterating through AP map to find AHB-AP to use
AP[0]: Core found
AP[0]: AHB-AP ROM base: 0xE00FE000
CPUID register: 0x411FC271. Implementer code: 0x41 (ARM)
Cache: L1 I/D-cache present
Found Cortex-M7 r1p1, Little endian.
FPUnit: 8 code (BP) slots and 0 literal slots
CoreSight components:
ROMTbl[0] @ E00FE000
[0][0]: E00FF000 CID B105100D PID 000BB4C7 ROM Table
ROMTbl[1] @ E00FF000
[1][0]: E000E000 CID B105E00D PID 000BB00C SCS-M7
[1][1]: E0001000 CID B105E00D PID 000BB002 DWT
[1][2]: E0002000 CID B105E00D PID 000BB00E FPB-M7
[1][3]: E0000000 CID B105E00D PID 000BB001 ITM
[0][1]: E0041000 CID B105900D PID 001BB975 ETM-M7
[0][2]: E0043000 CID B105900D PID 004BB906 CTI
I-Cache L1: 16 KB, 256 Sets, 32 Bytes/Line, 2-Way
D-Cache L1: 16 KB, 128 Sets, 32 Bytes/Line, 4-Way
Memory zones:
  Zone: "Default" Description: Default access mode
Cortex-M7 identified.
J-Link>mem 0x52002000 148
52002000 = 34 00 00 00 00 00 00 00  00 00 00 00 31 00 00 00  4...........1...
52002010 = 00 00 00 00 00 00 00 00  01 00 00 00 F0 AA C6 1B  ................
52002020 = F0 AA C6 1B 00 00 00 00  FF 00 00 00 FF 00 00 00  ................
52002030 = FF 00 00 00 FF 00 00 00  FF 00 00 00 FF 00 00 00  ................
52002040 = 00 08 F0 1F 00 08 F0 1F  10 08 00 10 10 08 00 10  ................
52002050 = 00 00 1C 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
52002060 = 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
52002070 = 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
52002080 = 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
52002090 = 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
520020A0 = 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
520020B0 = 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
520020C0 = 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
520020D0 = 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
520020E0 = 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
520020F0 = 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
52002100 = 34 00 00 00 00 00 00 00  00 00 00 00 31 00 00 00  4...........1...
52002110 = 00 00 00 00 00 00 00 00  01 00 00 00 F0 AA C6 1B  ................
52002120 = F0 AA C6 1B 00 00 00 00  FF 00 00 00 FF 00 00 00  ................
52002130 = FF 00 00 00 FF 00 00 00  FF 00 00 00 FF 00 00 00  ................
52002140 = 00 08 F0 1F 00 08 F0 1F                           ........
J-Link>mem 0x08000000 10
Could not read memory.
J-Link>

(2) Connecting via the UART interface using STM32CubeProgrammer, but can‘t receive apply. Log:

16:45:32:961 : RTS low
16:45:32:961 : DTR low
16:45:32:996 : Serial Port COM12 is successfully opened.
16:45:32:996 : Port configuration: parity = even, baudrate = 115200, data-bit = 8,                     stop-bit = 1.0, flow-control = off
16:45:32:996 : No Init bits value is : 0 
16:45:32:996 : Sending init command: 
16:45:32:998 : byte 0x7F sent successfully to target
16:45:32:998 : Wait ends after 1 loop, dataready = 1, delay = 1
16:45:32:998 : Received response from target: 0x79
16:45:33:007 : Activating device: OK
16:45:33:007 : Sending GetID command and its XOR:
16:45:33:008 : byte 0x02 sent successfully to target
16:45:33:008 : byte 0xFD sent successfully to target
16:45:33:009 : Wait ends after 1 loop, dataready = 1, delay = 1
16:45:33:009 : Received response from target: 0x79
16:45:33:009 : Received 4 data bytes from target : 0x01045079
16:45:33:009 : Chip ID: 0x450 
16:45:33:009 : Sending Get command and its XOR:
16:45:33:009 : byte 0x00 sent successfully to target
16:45:33:009 : byte 0xFF sent successfully to target
16:45:33:012 : Wait ends after 1 loop, dataready = 1, delay = 2
16:45:33:012 : Received response from target: 0x79
16:45:33:012 : Received 1 data bytes from target : 0x0b
16:45:33:012 : size of bytes in the response: 11
16:45:33:012 : Received 13 data bytes from target
16:45:33:012 : Full received response: 0b31000102112131446373829279
16:45:33:012 : BootLoader protocol version: 3.1
16:45:33:012 : byte 0x11 sent successfully to target
16:45:33:012 : byte 0xEE sent successfully to target
16:45:33:112 : data sent successfully to target: 0x0800000008
16:45:33:113 : byte 0x00 sent successfully to target
16:45:33:115 : byte 0xFF sent successfully to target
16:45:34:115 : Sending GetID command and its XOR:
16:45:34:116 : byte 0x02 sent successfully to target
16:45:34:116 : byte 0xFD sent successfully to target
16:45:35:117 : Wait ends after 1 loop, dataready = 0, delay = 1001
16:45:35:117 : Timeout error occured while waiting for acknowledgement.
16:45:35:117 : No response from target received
16:45:35:117 : Error: GETID command not acknowledged!
16:45:35:117 : Reemission of GetID command
16:45:35:117 : Sending GetID command and its XOR:
16:45:35:118 : byte 0x02 sent successfully to target
16:45:35:118 : byte 0xFD sent successfully to target
16:45:36:118 : Wait ends after 1 loop, dataready = 0, delay = 1001
16:45:36:118 : Timeout error occured while waiting for acknowledgement.
16:45:36:118 : No response from target received
16:45:36:118 : Error: GETID command not acknowledged!
16:45:36:118 : Reemission of GetID command
16:45:36:118 : Sending GetID command and its XOR:
16:45:36:120 : byte 0x02 sent successfully to target
16:45:36:120 : byte 0xFD sent successfully to target
16:45:37:118 : Wait ends after 1 loop, dataready = 0, delay = 1000
16:45:37:118 : Timeout error occured while waiting for acknowledgement.
16:45:37:118 : No response from target received
16:45:37:118 : Error: GETID command not acknowledged!
16:45:37:119 : byte 0x11 sent successfully to target
16:45:37:119 : byte 0xEE sent successfully to target
16:45:38:240 :  UART PORT CLOSE 
16:45:38:279 : Disconnected from device.

(3)Erasing full chip via the SWD interface using J-flash(J-flash->Target->Manual Programming->Erase Chip), and the MCU is back to normal.

Note: As there are 2 boards with the same problem, one has recovered to normal, while the other remains in the error state.

Given that the read protection is set to level 0 , I am puzzled as to why flash bank1 cannot be read.

Has anyone encountered a similar problem before? Any suggestions or advice would be greatly appreciated.

Pavel A. · ‎2025-01-16

With all respect to Segger - please try to use ST-LINK.

SandSwitch · ‎2025-01-16

Thanks for advice. I don't have a ST-LINK for now, but once I get one I will try it and share the results.

SandSwitch · ‎2025-01-16

Hi, Pavel A.
I got a ST-LINK. Reading option byte ok, checking RDP =0xAA means there are no read protection. But reading flash still failed. Log:

  15:46:53:482 : STLinkUSBDriver.dll loaded
  15:46:53:485 : STLinkUSBDriver.dll loaded
  15:46:53:485 : ST-LINK SN  : B55B5A1A000000003417F001
  15:46:53:485 : ST-LINK FW  : V2J37S7
  15:46:53:487 : Board       : --
  15:46:53:487 : Voltage     : 2.96V
  15:46:53:493 : SWD freq    : 4000 KHz
  15:46:53:493 : Connect mode: Normal
  15:46:53:493 : Reset mode  : Software reset
  15:46:53:495 : Device ID   : 0x450
  15:46:53:505 : Revision ID : Rev V
  15:46:53:507 : Buffer program...
  15:46:53:507 : w ap 0 @0x580244F4 0x00000004 bytes Data 0x00000002
  15:46:53:508 : Reading data...
  15:46:53:508 : r ap 0 @0x58000528 0x00000004 bytes Data 0x00000000
  15:46:53:510 : Buffer program...
  15:46:53:510 : w ap 0 @0x580244F4 0x00000004 bytes Data 0x00000002
  15:46:53:511 : Reading data...
  15:46:53:511 : r ap 0 @0x58000528 0x00000004 bytes Data 0x00000000
  15:46:53:512 : Buffer program...
  15:46:53:512 : w ap 0 @0x580244F4 0x00000004 bytes Data 0x00000002
  15:46:53:513 : Reading data...
  15:46:53:523 : r ap 0 @0x58000528 0x00000004 bytes Data 0x00000000
  15:46:53:523 : Reading data...
  15:46:53:523 : r ap 0 @0x1FF1E880 0x00000004 bytes Data 0x00000080
  15:46:53:523 : Buffer program...
  15:46:53:523 : w ap 0 @0x580244F4 0x00000004 bytes Data 0x00000002
  15:46:53:523 : Reading data...
  15:46:53:523 : r ap 0 @0x58000528 0x00000004 bytes Data 0x00000000
  15:46:53:523 : Buffer program...
  15:46:53:523 : w ap 0 @0x580244F4 0x00000004 bytes Data 0x00000002
  15:46:53:523 : Reading data...
  15:46:53:523 : r ap 0 @0x58000528 0x00000004 bytes Data 0x00000000
  15:46:53:523 : Buffer program...
  15:46:53:523 : w ap 0 @0x580244F4 0x00000004 bytes Data 0x00000002
  15:46:53:523 : Reading data...
  15:46:53:524 : r ap 0 @0x58000528 0x00000004 bytes Data 0x00000000
  15:46:53:524 : Buffer program...
  15:46:53:528 : w ap 0 @0x580244F4 0x00000004 bytes Data 0x00000002
  15:46:53:528 : Reading data...
  15:46:53:529 : r ap 0 @0x58000528 0x00000004 bytes Data 0x00000000
  15:46:53:529 : Reading data...
  15:46:53:530 : r ap 0 @0x1FF1E880 0x00000004 bytes Data 0x00000080
  15:46:53:530 : Database: Config 6 is active.
  15:46:53:540 : flash loader E:\stm32cube\bin/FlashLoader/0x450.stldr is loaded
  15:46:53:541 : Reading data...
  15:46:53:541 : r ap 0 @0x1FF1E880 0x00000004 bytes Data 0x00000080
  15:46:53:542 : r ap 0 @0x1FF1E7FE 0x00000004 bytes Data 0x003FFF91
  15:46:53:543 : Security available
  15:46:53:649 : Reading data...
  15:46:53:649 : r ap 0 @0x1FF095F0 0x00000004 bytes Data 0x00030100
  15:46:53:650 : UPLOADING OPTION BYTES DATA ...
  15:46:53:650 :   Bank          : 0x00
  15:46:53:650 :   Address       : 0x5200201c
  15:46:53:650 :   Size          : 308 Bytes
  15:46:53:650 : Reading data...
  15:46:53:671 : r ap 0 @0x5200201C 0x00000134 bytes Data 0x1BC6AAF0
  15:46:53:671 : UPLOADING OPTION BYTES DATA ...
  15:46:53:671 :   Bank          : 0x00
  15:46:53:671 :   Address       : 0x5200201c
  15:46:53:671 :   Size          : 308 Bytes
  15:46:53:671 : Reading data...
  15:46:53:671 : r ap 0 @0x5200201C 0x00000134 bytes Data 0x1BC6AAF0
  15:46:53:671 : r ap 0 @0x1FF1E7FE 0x00000004 bytes Data 0x003FFF91
  15:46:53:671 : UPLOADING ...
  15:46:53:671 :   Size          : 256 Bytes
  15:46:53:671 :   Address       : 0x8000000
  15:46:53:671 : Read progress:
  15:46:53:672 : Reading data...
  15:46:53:672 : r ap 0 @0x08000000 0x00000100 bytes Data 0x20036450
  15:46:53:672 : Error: Data read failed
  15:46:53:733 : r ap 0 @0x1FF1E7FE 0x00000004 bytes Data 0x003FFF91

Best Regards!

ADD:
The first 32 bytes of the MCU's flash bank cannot be read, but the subsequent parts can be

0x08000000-0x0800001F read fail

0x08000020-0x0801FFFF read ok

SofLit · ‎2025-01-17

Hello,

What kind of data is located from 0x08000000 to 0x0800001F? code? data? are you doing special operations on that region: ex: frequent erase/write?

To give better visibility on the answered topics, please click on "Accept as Solution" on the reply which solved your issue or answered your question.
PS: This is NOT an online support (https://ols.st.com) but a collaborative space. So please be polite in your reply. Otherwise, it will be reported as inappropriate and you will be permanently blacklisted from my help/support.

SandSwitch · ‎2025-01-17

Hi,
0x08000000 is the start address of our code.
There is an OTA in the code to do remote updates via TCP, it can download firmware to ram and then write to flash. So the flash is written a few times, but not too often.
Thanks for your reply, best regards.

SofLit · ‎2025-01-17

Try to find if you have Flash ECC errors.

To give better visibility on the answered topics, please click on "Accept as Solution" on the reply which solved your issue or answered your question.
PS: This is NOT an online support (https://ols.st.com) but a collaborative space. So please be polite in your reply. Otherwise, it will be reported as inappropriate and you will be permanently blacklisted from my help/support.