How to Program stm32f103rc using j-Link when RDP enabled?

HJung.2 · ‎2021-07-07

Hello.

I'm trying to program the main flash memory of STM32F103RCT6 using J-Link while RDP is enabled.

I followed main flash memory programming procedure in PM0075 manual.

the procedure is in below picture.

When only RDP is enabled, I unlocked Flash_CR_LOCK bit and then Write FLASH_CR_PG to 1.

After this procedure, I tried to write half-word data to 0x080069f0.

However, J-Link reports the error like this.

****** Error: Timeout while calculating CRC, RAMCode did not respond in time. (PC = 0x00000000, CPSR = 0x00000000, LR = 0x01000000)!Failed to erase sectors 14 @ address 0x08006800 ((erase error))

Failed to erase sectors.

Is it impossible to program main flash memory when RDP is enabled?

If not, how can I do it?

Here is my J-Link Commander log.

Device "STM32F103RC (ALLOW OPT. BYTES)" selected.

Connecting to target via JTAG

InitTarget() start

Active read protection detected.

Skipping unsecure.

InitTarget() end

TotalIRLen = 9, IRPrint = 0x0011

JTAG chain detection found 2 devices:

#0 Id: 0x3BA00477, IRLen: 04, CoreSight JTAG-DP

#1 Id: 0x06414041, IRLen: 05, STM32 Boundary Scan

DPv0 detected

Scanning AP map to find all available APs

AP[1]: Stopped AP scan as end of AP map has been reached

AP[0]: AHB-AP (IDR: 0x14770011)

Iterating through AP map to find AHB-AP to use

AP[0]: Core found

AP[0]: AHB-AP ROM base: 0xE00FF000

CPUID register: 0x411FC231. Implementer code: 0x41 (ARM)

Found Cortex-M3 r1p1, Little endian.

FPUnit: 6 code (BP) slots and 2 literal slots

CoreSight components:

ROMTbl[0] @ E00FF000

ROMTbl[0][0]: E000E000, CID: B105E00D, PID: 001BB000 SCS

ROMTbl[0][1]: E0001000, CID: B105E00D, PID: 001BB002 DWT

ROMTbl[0][2]: E0002000, CID: B105E00D, PID: 000BB003 FPB

ROMTbl[0][3]: E0000000, CID: B105E00D, PID: 001BB001 ITM

ROMTbl[0][4]: E0040000, CID: B105900D, PID: 001BB923 TPIU-Lite

ROMTbl[0][5]: E0041000, CID: B105900D, PID: 101BB924 ETM-M3

Cortex-M3 identified.

J-Link>w4 40022004 45670123

Writing 45670123 -> 40022004

J-Link>w4 40022004 cdef89ab

Writing CDEF89AB -> 40022004

J-Link>mem32 40022010 1

40022010 = 00000000

J-Link>h

PC = 08003FFE, CycleCnt = 3A8FCF29

R0 = E000ED0C, R1 = 05FA0004, R2 = 05FA0004, R3 = 40003000

R4 = 20000924, R5 = 1FFFF810, R6 = 1FFFF810, R7 = 2000BFDC

R8 = 00000000, R9 = 00000000, R10= 00000000, R11= 00000000

R12= 00000000

SP(R13)= 2000BFDC, MSP= 2000BFDC, PSP= 00000000, R14(LR) = FFFFFFF9

XPSR = 01000003: APSR = nzcvq, EPSR = 01000000, IPSR = 003 (HardFault)

CFBP = 00000000, CONTROL = 00, FAULTMASK = 00, BASEPRI = 00, PRIMASK = 00

FPU regs: FPU not enabled / not implemented on connected CPU.

J-Link>w4 40022010 0000001

Writing 00000001 -> 40022010

J-Link>w2 080069f0 1111

Writing 1111 -> 080069F0

J-Link>mem32 4002200c 1

****** Error: Timeout while calculating CRC, RAMCode did not respond in time. (PC = 0x00000000, CPSR = 0x00000000, LR = 0x01000000)!Failed to erase sectors 14 @ address 0x08006800 ((erase error))

Failed to erase sectors.

Uwe Bonnes · ‎2021-07-08

Reset the option bits to default, meaning no protection. Mass erase of flash happens as result of the RDP downgrade. Then proceed as normal.

HJung.2 · ‎2021-07-08

Hello, Thank you for your answer.

However, I want to try programming 2 bytes of main flash memory when RDP is enabled not resetting the device.

Thank you

Uwe Bonnes · ‎2021-07-08

Carefully read pm0075:

Once the protection byte has been programmed:

...

Pages 0-3 (for low- and medium-density devices), or pages 0-1 (for high-density and

connectivity line devices) are automatically write-protected. The rest of the memory can

be programmed by the code executed from the main Flash memory (for IAP, constant

storage, etc.), but it is protected against write/erase (but not against mass erase) in

debug mode or when booting from the embedded SRAM.