How to change read out protection from level 1 to level 0 with STM32CubeProgrammer?

[Nicolas1]

Background information : we are using STM32F407 for our product and 2 of them (out of 3) encounters the same problem: RDP level has been changed from level 0 to level 1 and stopped working without any modification from our part. Before even thinking of solving the problem, we would like to switch back from RDP level 1 to level 0.

This problem is exactly the same than the one discussed here 7 years ago and where no solutions are given.

One way to do so is by using STM32CubeProgrammer. Here is what I tried:

• Open STM32CubeProgrammer
• Connect to the µC via ST-LINK: the data read failed because of RDP level

14:29:10 : STM32CubeProgrammer API v2.8.0
  14:29:24 : Warning: Device changed, refreshing...
  14:29:24 : ST-LINK SN  : 50FF70067867515335590967
  14:29:24 : ST-LINK FW  : V2J29S7
  14:29:24 : Board       : --
  14:29:24 : Voltage     : 3.18V
  14:29:24 : SWD freq    : 4000 KHz
  14:29:24 : Connect mode: Normal
  14:29:24 : Reset mode  : Software reset
  14:29:24 : Device ID   : 0x413
  14:29:24 : Revision ID : Rev 2.0
  14:29:24 : UPLOADING OPTION BYTES DATA ...
  14:29:24 :   Bank          : 0x00
  14:29:24 :   Address       : 0x40023c14
  14:29:24 :   Size          : 4 Bytes
  14:29:24 : UPLOADING ...
  14:29:24 :   Size          : 1024 Bytes
  14:29:24 :   Address       : 0x8000000
  14:29:24 : Read progress:
  14:29:24 : Error: Data read failed

•  Open the "Option bytes" tab
• Notice that the RDP value is 0xFF (level 1 as per the documentation)
• Change the value to 0xAA (for level 0) and click on "Apply" (with max verbosity)

14:33:54:632 : Option byte command : -ob  RDP=170 
  14:33:54:639 : PROGRAMMING OPTION BYTES AREA ...
  14:33:54:640 :   Bank          : 0x00
  14:33:54:640 :   Address       : 0x40023c14
  14:33:54:640 :   Size          : 4 Bytes
  14:33:54:641 : OB buffer: edaaff0f
  14:33:54:642 : Buffer program...
  14:33:54:654 : halt ap 0 
  14:33:54:656 : w ap 0 reg 15 PC   (0x20000000)  
  14:33:54:656 : w ap 0 reg 17 MSP  (0x20000500)  
  14:33:54:656 : w ap 0 reg 16 xPSR (0x01000000)  
  14:33:54:669 : w ap 0 @0x20000C20 0x00000200 bytes Data 0x00000000
  14:33:54:670 : w ap 0 @0x20000000 0x00000004 bytes Data 0x0000BE00
  14:33:54:674 : w ap 0 @0x20000004 0x000007F4 bytes Data 0xF000B580
  14:33:54:674 : w ap 0 @0x20000C20 0x00000004 bytes Data 0x0FFFAAED
  14:33:54:675 : Loader write option bytes...
  14:33:54:675 : Init flashloader...
  14:33:54:675 : halt ap 0 
  14:33:54:675 : w ap 0 reg 0 R0   0x00000001
  14:33:54:675 : w ap 0 reg 1 R1   0x00000000
  14:33:54:675 : w ap 0 reg 2 R2   0x00000000
  14:33:54:675 : w ap 0 reg 3 R3   0x00000000
  14:33:54:675 : w ap 0 reg 4 R4   0x00000000
  14:33:54:675 : w ap 0 reg 5 R5   0x00000000
  14:33:54:675 : w ap 0 reg 6 R6   0x00000000
  14:33:54:675 : w ap 0 reg 7 R7   0x00000000
  14:33:54:675 : w ap 0 reg 8 R8   0x00000000
  14:33:54:676 : w ap 0 reg 9 R9   0x00000000
  14:33:54:676 : w ap 0 reg 10 R10  0x00000000
  14:33:54:677 : w ap 0 reg 11 R11  0x00000000
  14:33:54:677 : w ap 0 reg 12 R12  0x00000000
  14:33:54:677 : w ap 0 reg 13 SP   0x00000000
  14:33:54:677 : w ap 0 reg 14 LR   0x20000001
  14:33:54:681 : w ap 0 reg 15 PC   0x20000005
  14:33:54:681 : w ap 0 reg 16 xPSR 0x01000000
  14:33:54:681 : w ap 0 reg 17 MSP  0x20000BF4
  14:33:54:682 : w ap 0 reg 18 PSP  0x00000000
  14:33:54:682 : run ap 0 
  14:33:54:682 : halt ap 0 
  14:33:54:683 : r ap 0 reg 0 R0   0x00000001
  14:33:54:687 : w ap 0 reg 0 R0   0x40023C14
  14:33:54:688 : w ap 0 reg 1 R1   0x00000004
  14:33:54:690 : w ap 0 reg 2 R2   0x20000C20
  14:33:54:690 : w ap 0 reg 3 R3   0x00000002
  14:33:54:690 : w ap 0 reg 4 R4   0x00000000
  14:33:54:692 : w ap 0 reg 5 R5   0x00000000
  14:33:54:692 : w ap 0 reg 6 R6   0x00000000
  14:33:54:693 : w ap 0 reg 7 R7   0x00000000
  14:33:54:693 : w ap 0 reg 8 R8   0x00000000
  14:33:54:694 : w ap 0 reg 9 R9   0x00000000
  14:33:54:694 : w ap 0 reg 10 R10  0x00000000
  14:33:54:694 : w ap 0 reg 11 R11  0x00000000
  14:33:54:694 : w ap 0 reg 12 R12  0x00000000
  14:33:54:694 : w ap 0 reg 13 SP   0x00000000
  14:33:54:694 : w ap 0 reg 14 LR   0x20000001
  14:33:54:694 : w ap 0 reg 15 PC   0x200000AB
  14:33:54:694 : w ap 0 reg 16 xPSR 0x01000000
  14:33:54:694 : w ap 0 reg 17 MSP  0x20000BF4
  14:33:54:694 : w ap 0 reg 18 PSP  0x00000000
  14:33:54:694 : run ap 0 
  14:33:57:969 : UPLOADING OPTION BYTES DATA ...
  14:33:57:969 :   Bank          : 0x00
  14:33:57:969 :   Address       : 0x40023c14
  14:33:57:969 :   Size          : 4 Bytes
  14:33:57:970 : Reading data...
  14:33:57:971 : r ap 0 @0x40023C14 0x00000004 bytes Data 0x0FFFFFED
  14:33:57:972 : OPTION BYTE PROGRAMMING VERIFICATION:
  14:33:57:972 : Error: Expected value for Option Byte "RDP": 0xAA, found: 0xFF
  14:33:57:980 : Error: Option Byte Programming failed
  14:33:58:009 : UPLOADING OPTION BYTES DATA ...
  14:33:58:009 :   Bank          : 0x00
  14:33:58:009 :   Address       : 0x40023c14
  14:33:58:010 :   Size          : 4 Bytes
  14:33:58:010 : Reading data...
  14:33:58:010 : r ap 0 @0x40023C14 0x00000004 bytes Data 0x0FFFFFED

 What do I do wrong? Why can't I changed the RDP level back to 0?

[TDK]

I seem to recall you needing to do a full chip erase at the same time. (This is true, but STM32CubeProgrammer does it for you.)

Is this a custom board?

I can't replicate this on a STM32F4 board.

[Nicolas1]

Thank you for your reply. Yes, this is a custom board. The strange thing is that RDP level has changed without any intentional doing on our part, it may be a consequence of something else as people have experienced in the previously given link. With another software to write the µC's register, we will try to rewrite the RDP level and then do a mass erase.

[Nicolas1]

According to one of our hardware guys, the initial problem could have been triggered by the fact that the PDR_ON pin is a floating pin on our card. It seems to the "Option bytes" register could be corrupted if the power supply is defective while loading the "Option bytes" register.

This analysis doesn't change the fact that we should be able to modify the "Option bytes" register.

[Nicolas1]

Furthermore, the state in which our µC is doesn't allow us to re-program it.

[alister]

I experienced similar several months ago with ST-LINK/V2 on an STM32H7. The ST-LINK/V2 would not connect when RDP was level 1 despite STM32CubeProgrammer using Mode = Under reset and Reset mode = Hardware reset. It turned out the RST pin of the JTAG connector was broken, and the ST-LINK/V2' s mode was effectively always Hot plug.

[Nicolas1]

We checked the probe and it is fine. After unlocking it, we can write the "Flash option control register" to change its value from 0x0FFFFFED to 0x0FFFAAED but the register's value isn't kept after a reset.

[TDK]

> We checked the probe and it is fine. After unlocking it, we can write the "Flash option control register" to change its value from 0x0FFFFFED to 0x0FFFAAED but the register's value isn't kept after a reset.

You need to launch the option bytes to apply them. The option bytes are in flash (nonvolatile), the register you're accessing is just a shadow register in RAM (volatile).