STM32H750 can not read flash bank1 while not in read protection

SandSwitch · ‎2025-01-16

Hi,
I'm encountering an issue with my STM32H750 MCU.

I download my program to the flash via the UART interface using STM32CubeProgrammer. The MCU can work well for a few days, but suddenly crashed. This problem occurred randomly on 2 out of 15 boards with the same hardware and software design.

Here are diagnostic steps taken:

(1)Connecting via the SWD interface using J-link and found option bytes(0x52002000) is able to read, but flash bank 1(0x08000000)is unable to read

Checked the read protection was set to level 0. J-link log:

SEGGER J-Link Commander V8.12a (Compiled Jan  9 2025 14:39:11)
DLL version V8.12a, compiled Jan  9 2025 14:38:21

Connecting to J-Link via USB...O.K.
Firmware: J-Link V9 compiled Dec 13 2022 11:14:50
Hardware version: V9.70
J-Link uptime (since boot): N/A (Not supported by this model)
S/N: 69730352
License(s): RDI, GDB, FlashDL, FlashBP, JFlash
VTref=3.296V


Type "connect" to establish a target connection, '?' for help
J-Link>connect
Please specify device / core. <Default>: STM32H750VB
Type '?' for selection dialog
Device>
Please specify target interface:
  J) JTAG (Default)
  S) SWD
  T) cJTAG
TIF>S
Specify target interface speed [kHz]. <Default>: 4000 kHz
Speed>
Device "STM32H750VB" selected.


Connecting to target via SWD
ConfigTargetSettings() start
ConfigTargetSettings() end - Took 11us
InitTarget() start
SWD selected. Executing JTAG -> SWD switching sequence.
DAP initialized successfully.
InitTarget() end - Took 19.9ms
Found SW-DP with ID 0x6BA02477
DPv0 detected
CoreSight SoC-400 or earlier
Scanning AP map to find all available APs
AP[3]: Stopped AP scan as end of AP map has been reached
AP[0]: AHB-AP (IDR: 0x84770001, ADDR: 0x00000000)
AP[1]: AHB-AP (IDR: 0x84770001, ADDR: 0x01000000)
AP[2]: APB-AP (IDR: 0x54770002, ADDR: 0x02000000)
Iterating through AP map to find AHB-AP to use
AP[0]: Core found
AP[0]: AHB-AP ROM base: 0xE00FE000
CPUID register: 0x411FC271. Implementer code: 0x41 (ARM)
Cache: L1 I/D-cache present
Found Cortex-M7 r1p1, Little endian.
FPUnit: 8 code (BP) slots and 0 literal slots
CoreSight components:
ROMTbl[0] @ E00FE000
[0][0]: E00FF000 CID B105100D PID 000BB4C7 ROM Table
ROMTbl[1] @ E00FF000
[1][0]: E000E000 CID B105E00D PID 000BB00C SCS-M7
[1][1]: E0001000 CID B105E00D PID 000BB002 DWT
[1][2]: E0002000 CID B105E00D PID 000BB00E FPB-M7
[1][3]: E0000000 CID B105E00D PID 000BB001 ITM
[0][1]: E0041000 CID B105900D PID 001BB975 ETM-M7
[0][2]: E0043000 CID B105900D PID 004BB906 CTI
I-Cache L1: 16 KB, 256 Sets, 32 Bytes/Line, 2-Way
D-Cache L1: 16 KB, 128 Sets, 32 Bytes/Line, 4-Way
Memory zones:
  Zone: "Default" Description: Default access mode
Cortex-M7 identified.
J-Link>mem 0x52002000 148
52002000 = 34 00 00 00 00 00 00 00  00 00 00 00 31 00 00 00  4...........1...
52002010 = 00 00 00 00 00 00 00 00  01 00 00 00 F0 AA C6 1B  ................
52002020 = F0 AA C6 1B 00 00 00 00  FF 00 00 00 FF 00 00 00  ................
52002030 = FF 00 00 00 FF 00 00 00  FF 00 00 00 FF 00 00 00  ................
52002040 = 00 08 F0 1F 00 08 F0 1F  10 08 00 10 10 08 00 10  ................
52002050 = 00 00 1C 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
52002060 = 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
52002070 = 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
52002080 = 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
52002090 = 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
520020A0 = 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
520020B0 = 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
520020C0 = 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
520020D0 = 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
520020E0 = 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
520020F0 = 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
52002100 = 34 00 00 00 00 00 00 00  00 00 00 00 31 00 00 00  4...........1...
52002110 = 00 00 00 00 00 00 00 00  01 00 00 00 F0 AA C6 1B  ................
52002120 = F0 AA C6 1B 00 00 00 00  FF 00 00 00 FF 00 00 00  ................
52002130 = FF 00 00 00 FF 00 00 00  FF 00 00 00 FF 00 00 00  ................
52002140 = 00 08 F0 1F 00 08 F0 1F                           ........
J-Link>mem 0x08000000 10
Could not read memory.
J-Link>

(2) Connecting via the UART interface using STM32CubeProgrammer, but can‘t receive apply. Log:

16:45:32:961 : RTS low
16:45:32:961 : DTR low
16:45:32:996 : Serial Port COM12 is successfully opened.
16:45:32:996 : Port configuration: parity = even, baudrate = 115200, data-bit = 8,                     stop-bit = 1.0, flow-control = off
16:45:32:996 : No Init bits value is : 0 
16:45:32:996 : Sending init command: 
16:45:32:998 : byte 0x7F sent successfully to target
16:45:32:998 : Wait ends after 1 loop, dataready = 1, delay = 1
16:45:32:998 : Received response from target: 0x79
16:45:33:007 : Activating device: OK
16:45:33:007 : Sending GetID command and its XOR:
16:45:33:008 : byte 0x02 sent successfully to target
16:45:33:008 : byte 0xFD sent successfully to target
16:45:33:009 : Wait ends after 1 loop, dataready = 1, delay = 1
16:45:33:009 : Received response from target: 0x79
16:45:33:009 : Received 4 data bytes from target : 0x01045079
16:45:33:009 : Chip ID: 0x450 
16:45:33:009 : Sending Get command and its XOR:
16:45:33:009 : byte 0x00 sent successfully to target
16:45:33:009 : byte 0xFF sent successfully to target
16:45:33:012 : Wait ends after 1 loop, dataready = 1, delay = 2
16:45:33:012 : Received response from target: 0x79
16:45:33:012 : Received 1 data bytes from target : 0x0b
16:45:33:012 : size of bytes in the response: 11
16:45:33:012 : Received 13 data bytes from target
16:45:33:012 : Full received response: 0b31000102112131446373829279
16:45:33:012 : BootLoader protocol version: 3.1
16:45:33:012 : byte 0x11 sent successfully to target
16:45:33:012 : byte 0xEE sent successfully to target
16:45:33:112 : data sent successfully to target: 0x0800000008
16:45:33:113 : byte 0x00 sent successfully to target
16:45:33:115 : byte 0xFF sent successfully to target
16:45:34:115 : Sending GetID command and its XOR:
16:45:34:116 : byte 0x02 sent successfully to target
16:45:34:116 : byte 0xFD sent successfully to target
16:45:35:117 : Wait ends after 1 loop, dataready = 0, delay = 1001
16:45:35:117 : Timeout error occured while waiting for acknowledgement.
16:45:35:117 : No response from target received
16:45:35:117 : Error: GETID command not acknowledged!
16:45:35:117 : Reemission of GetID command
16:45:35:117 : Sending GetID command and its XOR:
16:45:35:118 : byte 0x02 sent successfully to target
16:45:35:118 : byte 0xFD sent successfully to target
16:45:36:118 : Wait ends after 1 loop, dataready = 0, delay = 1001
16:45:36:118 : Timeout error occured while waiting for acknowledgement.
16:45:36:118 : No response from target received
16:45:36:118 : Error: GETID command not acknowledged!
16:45:36:118 : Reemission of GetID command
16:45:36:118 : Sending GetID command and its XOR:
16:45:36:120 : byte 0x02 sent successfully to target
16:45:36:120 : byte 0xFD sent successfully to target
16:45:37:118 : Wait ends after 1 loop, dataready = 0, delay = 1000
16:45:37:118 : Timeout error occured while waiting for acknowledgement.
16:45:37:118 : No response from target received
16:45:37:118 : Error: GETID command not acknowledged!
16:45:37:119 : byte 0x11 sent successfully to target
16:45:37:119 : byte 0xEE sent successfully to target
16:45:38:240 :  UART PORT CLOSE 
16:45:38:279 : Disconnected from device.

(3)Erasing full chip via the SWD interface using J-flash(J-flash->Target->Manual Programming->Erase Chip), and the MCU is back to normal.

Note: As there are 2 boards with the same problem, one has recovered to normal, while the other remains in the error state.

Given that the read protection is set to level 0 , I am puzzled as to why flash bank1 cannot be read.

Has anyone encountered a similar problem before? Any suggestions or advice would be greatly appreciated.

Pavel A. · ‎2025-01-16

With all respect to Segger - please try to use ST-LINK.

SandSwitch · ‎2025-01-16

Thanks for advice. I don't have a ST-LINK for now, but once I get one I will try it and share the results.

SandSwitch · ‎2025-01-16

Hi, Pavel A.
I got a ST-LINK. Reading option byte ok, checking RDP =0xAA means there are no read protection. But reading flash still failed. Log:

  15:46:53:482 : STLinkUSBDriver.dll loaded
  15:46:53:485 : STLinkUSBDriver.dll loaded
  15:46:53:485 : ST-LINK SN  : B55B5A1A000000003417F001
  15:46:53:485 : ST-LINK FW  : V2J37S7
  15:46:53:487 : Board       : --
  15:46:53:487 : Voltage     : 2.96V
  15:46:53:493 : SWD freq    : 4000 KHz
  15:46:53:493 : Connect mode: Normal
  15:46:53:493 : Reset mode  : Software reset
  15:46:53:495 : Device ID   : 0x450
  15:46:53:505 : Revision ID : Rev V
  15:46:53:507 : Buffer program...
  15:46:53:507 : w ap 0 @0x580244F4 0x00000004 bytes Data 0x00000002
  15:46:53:508 : Reading data...
  15:46:53:508 : r ap 0 @0x58000528 0x00000004 bytes Data 0x00000000
  15:46:53:510 : Buffer program...
  15:46:53:510 : w ap 0 @0x580244F4 0x00000004 bytes Data 0x00000002
  15:46:53:511 : Reading data...
  15:46:53:511 : r ap 0 @0x58000528 0x00000004 bytes Data 0x00000000
  15:46:53:512 : Buffer program...
  15:46:53:512 : w ap 0 @0x580244F4 0x00000004 bytes Data 0x00000002
  15:46:53:513 : Reading data...
  15:46:53:523 : r ap 0 @0x58000528 0x00000004 bytes Data 0x00000000
  15:46:53:523 : Reading data...
  15:46:53:523 : r ap 0 @0x1FF1E880 0x00000004 bytes Data 0x00000080
  15:46:53:523 : Buffer program...
  15:46:53:523 : w ap 0 @0x580244F4 0x00000004 bytes Data 0x00000002
  15:46:53:523 : Reading data...
  15:46:53:523 : r ap 0 @0x58000528 0x00000004 bytes Data 0x00000000
  15:46:53:523 : Buffer program...
  15:46:53:523 : w ap 0 @0x580244F4 0x00000004 bytes Data 0x00000002
  15:46:53:523 : Reading data...
  15:46:53:523 : r ap 0 @0x58000528 0x00000004 bytes Data 0x00000000
  15:46:53:523 : Buffer program...
  15:46:53:523 : w ap 0 @0x580244F4 0x00000004 bytes Data 0x00000002
  15:46:53:523 : Reading data...
  15:46:53:524 : r ap 0 @0x58000528 0x00000004 bytes Data 0x00000000
  15:46:53:524 : Buffer program...
  15:46:53:528 : w ap 0 @0x580244F4 0x00000004 bytes Data 0x00000002
  15:46:53:528 : Reading data...
  15:46:53:529 : r ap 0 @0x58000528 0x00000004 bytes Data 0x00000000
  15:46:53:529 : Reading data...
  15:46:53:530 : r ap 0 @0x1FF1E880 0x00000004 bytes Data 0x00000080
  15:46:53:530 : Database: Config 6 is active.
  15:46:53:540 : flash loader E:\stm32cube\bin/FlashLoader/0x450.stldr is loaded
  15:46:53:541 : Reading data...
  15:46:53:541 : r ap 0 @0x1FF1E880 0x00000004 bytes Data 0x00000080
  15:46:53:542 : r ap 0 @0x1FF1E7FE 0x00000004 bytes Data 0x003FFF91
  15:46:53:543 : Security available
  15:46:53:649 : Reading data...
  15:46:53:649 : r ap 0 @0x1FF095F0 0x00000004 bytes Data 0x00030100
  15:46:53:650 : UPLOADING OPTION BYTES DATA ...
  15:46:53:650 :   Bank          : 0x00
  15:46:53:650 :   Address       : 0x5200201c
  15:46:53:650 :   Size          : 308 Bytes
  15:46:53:650 : Reading data...
  15:46:53:671 : r ap 0 @0x5200201C 0x00000134 bytes Data 0x1BC6AAF0
  15:46:53:671 : UPLOADING OPTION BYTES DATA ...
  15:46:53:671 :   Bank          : 0x00
  15:46:53:671 :   Address       : 0x5200201c
  15:46:53:671 :   Size          : 308 Bytes
  15:46:53:671 : Reading data...
  15:46:53:671 : r ap 0 @0x5200201C 0x00000134 bytes Data 0x1BC6AAF0
  15:46:53:671 : r ap 0 @0x1FF1E7FE 0x00000004 bytes Data 0x003FFF91
  15:46:53:671 : UPLOADING ...
  15:46:53:671 :   Size          : 256 Bytes
  15:46:53:671 :   Address       : 0x8000000
  15:46:53:671 : Read progress:
  15:46:53:672 : Reading data...
  15:46:53:672 : r ap 0 @0x08000000 0x00000100 bytes Data 0x20036450
  15:46:53:672 : Error: Data read failed
  15:46:53:733 : r ap 0 @0x1FF1E7FE 0x00000004 bytes Data 0x003FFF91

Best Regards!

ADD:
The first 32 bytes of the MCU's flash bank cannot be read, but the subsequent parts can be

0x08000000-0x0800001F read fail

0x08000020-0x0801FFFF read ok