Error: Mass erase operation failed.Please verify flash protection on Nucleo L476G

[CWei .1]

Hello,

I wanted to try the SBSFU topic 6 step by step youtube video, i accidentally flash the Userapp.bin with the RDP level 1, (and also with Write protection enable in bank1).

I try to change the RDP level back to 0, and also disable the Write protection on bank1, however the mass erase option had not been successful, can you advise if such revert is possible? it means that those protected area was not able to be erase.(0x8000000), or the board had become unusable?

[Jocelyn RICARD]

Hello @CWei .1​,

Not sure what is the state of your board.

But it could be possible that PCROP is activated

In this case, you need to set back RDP level 1, and then launch regression setting RDP Level 0 and disabling PCROP at same time by setting PCROP End address lower than start address.

Best regards

Jocelyn

[CWei .1]

Hello Jocelyn

thanks for your tips, its seem that those protected area are being erased automatically once i perform those steps highlighted above, (by reading the FLASH memory as 0xFFFFFFFF), however, when i try to reprogram a new FW, the error message still appear as "Error: Mass erase operation failed.Please verify flash protection", what else that i can do? Its seem that the board cannot be re-programme anymore

[digidhamu]

I am facing the similar issue on STM32WLE5. I have tried setting the RDP and PCROP and below error from STM32CubeProgrammer GUI. Also attached OB outputs and tried using CLI too. I could not do anything like new firmware upload, mass erase, OB set, etc.,

07:07:30 : Error: Expected value for Option Byte "PCROP_RDP": 0x1, found: 0x0
07:07:30 : Error: Expected value for Option Byte "RDP": 0xBB, found: 0xAA
07:07:30 : Error: Option Byte Programming failed

Tried commands

./STM32_Programmer_CLI -c port=SWD ap=0 freq=4000 mode=HOTPLUG -dsecurity
 
./STM32_Programmer_CLI -c port=SWD ap=0 freq=4000 mode=HOTPLUG -setdefaultob
 
./STM32_Programmer_CLI -c port=swd  ap=0 mode=HOTPLUG -halt -w32dbg 0x58004014 0xC0000000 -w32dbg 0x58004008 0x45670123 -w32dbg 0x58004008 0xCDEF89AB -w32dbg 0x5800400C 0x08192A3B -w32dbg 0x5800400C 0x4C5D6E7F -w32dbg 0x58004020 0x3FFFF1BB -w32dbg 0x58004014 0x00020000
 
./STM32_Programmer_CLI -c port=swd  ap=0 mode=HOTPLUG -halt -w32dbg 0x58004014 0xC0000000 -w32dbg 0x58004008 0x45670123 -w32dbg 0x58004008 0xCDEF89AB -w32dbg 0x5800400C 0x08192A3B -w32dbg 0x5800400C 0x4C5D6E7F -w32dbg 0x58004020 0x3FFFF0AA -w32dbg 0x58004014 0x00020000
 
./STM32_Programmer_CLI -c port=SWD  ap=0 mode=HOTPLUG -w32dbg 0x58004014 0x08020000

OB Output

bin % ./STM32_Programmer_CLI -c port=SWD ap=0 freq=4000 mode=HOTPLUG -ob displ
      -------------------------------------------------------------------
                        STM32CubeProgrammer v2.10.0                  
      -------------------------------------------------------------------
 
ST-LINK SN  : 48FF68066578555531400667
ST-LINK FW  : V2J39S7
Board       : --
Voltage     : 3.24V
SWD freq    : 4000 KHz
Connect mode: Hot Plug
Reset mode  : Software reset
Device ID   : 0x497
Revision ID : Rev Z
Device name : STM32WLxx
Flash size  : 256 KBytes
Device type : MCU
Device CPU  : Cortex-M4
BL Version  : 0xc3
 
 
UPLOADING OPTION BYTES DATA ...
 
  Bank          : 0x00
  Address       : 0x58004020
  Size          : 96 Bytes
 
[==================================================] 100% 
 
  Bank          : 0x01
  Address       : 0x58004080
  Size          : 8 Bytes
 
[==================================================] 100% 
 
 
OPTION BYTES BANK: 0
 
   Read Out Protection:
 
     RDP          : 0xAA (Level 0, no protection) 
 
   BOR Level:
 
     BOR_LEV      : 0x0 (BOR Level 0 reset level threshold is around 1.7 V) 
 
   User Configuration:
 
     nBOOT0       : 0x1 (nBOOT0=1) 
     nBOOT1       : 0x1 () 
     nSWBOOT0     : 0x1 (BOOT0 taken from PH3/BOOT0 pin) 
     SRAM_RST     : 0x1 (SRAM1 and SRAM2 are not erased when a system reset occurs) 
     SRAM2_PE     : 0x1 (SRAM2 parity check disable) 
     nRST_STOP    : 0x1 (No reset generated when entering the Stop mode) 
     nRST_STDBY   : 0x1 (No reset generated when entering the Standby mode) 
     nRST_SHDW    : 0x1 (No reset generated when entering the Shutdown mode) 
     WWDG_SW      : 0x1 (Software window watchdog) 
     IWGD_STDBY   : 0x1 (Independent watchdog counter running in Standby mode) 
     IWDG_STOP    : 0x1 (Independent watchdog counter running in Stop mode) 
     IWDG_SW      : 0x1 (Software independent watchdog) 
     BOOT_LOCK    : 0x0 (CPU1 CM4 Boot lock disabled) 
 
   Security Configuration Option bytes ESE:
 
     ESE          : 0x0 (Security disabled) 
 
   PCROP Protection:
 
     PCROP1A_STRT : 0xFF  (0x803FC00) 
     PCROP1A_END  : 0x0  (0x8000000) 
     PCROP_RDP    : 0x0 (PCROP zone is kept when RDP is decreased) 
     PCROP1B_STRT : 0xFF  (0x803FC00) 
     PCROP1B_END  : 0x0  (0x8000000) 
 
   Write Protection:
 
     WRP1A_STRT   : 0x7F  (0x803F800) 
     WRP1A_END    : 0x0  (0x8000000) 
     WRP1B_STRT   : 0x7F  (0x803F800) 
     WRP1B_END    : 0x0  (0x8000000)

[CWei .1]

Hello @Jocelyn RICARD​ 

If i understand correctly, once flash with the option byte of RDP level 1 and Write Protection Enable. The Protected Flash area will become "ROM" alike behavior and the BOOT pin is also disable (default boot ROM area for flashing new firmware), hence there is no way to flash new firmware anymore. Can you confirm this behavior? I mean if the board become unusable then i will have to buy a new one. I just need your confirmation ASAP. A million thanks in advance.

[Jocelyn RICARD]

Hello @CWei .1​ 

This ROM like state only occurs if you set WRP + RDP2.

When setting RDP2, the JTAG is no more accessible, and you cannot change anymore the option bytes from embedded firmware.

This mecanism is used with SRBSFU, setting the secure bootloader area in WRP.

With RDP1 you can always connect to the target under reset and regress RDP to level 0. I'm talking here about STM32L4. On more recent STM32 this could be different in case you apply other protections.

Best regards

Jocelyn

[Jocelyn RICARD]

Hello @digidhamu​,

I'm not sure to understand your issue as your option bytes look fine.

2 first things I would try:

• update to latest programmer 2.11
• Use connect under reset

Best regards

Jocelyn

[CWei .1]

Hello @Jocelyn RICARD​ 

I had try using the latest STM32 Cube programmer 2.11, and also try to connect with the under reset mode, the error message is still the same, i uploaded the log file which contain the CPU register and option byte option.

[Jocelyn RICARD]

Hello @CWei .1​ ,

could you please provide the output of command

STM32_ProgrammerCLI.exe -c port=SWD mode=UR -ob displ

Thank you

Best regards

Jocelyn

[digidhamu]

@Jocelyn RICARD​ Thanks for your quick response.

I have updated to 2.11 now. However here is the status and issue still persist

When I connect using mode either "Under Reset" or Normal with RESET pin to GND and BOOT pin to VCC

Error: Cannot connect to access port 1 If you are trying to connect to a device with TrustZone enabled please try to connect with HotPlug mode

When I connect using mode "Hot Plug" with RESET pin to GND and BOOT pin to VCC.

Connection is successful but not able perform full erase as original issue

If I make RESET pin float (not connected), I could not able to connect with any of the modes