Reverting Option Byte Configuration after TF-M Testing in STM32U585

[PJose.4]

Hi Channel

I have tested the TF-M Package Released by ST, on the STM32U585 and its working fine. Now i want to revert back my STM32U585 (B-U585I-IOT02A Kit) as for the testing of TF-M SBSFU there is some configuration of option bytes as given in UM2851 manual.

Now i want to test some normal applications on the same board. I have made the following changes

1. changed RDP to to 0 and changed TZEN bit =0 at the same time to disable the trust zone controller.
2. i have disabled wrp 1 and wrp2 bits.

But now i am not able to do a full chip erase and am not able to any other program (for example led test or UART test example).

Kindly help me out in the clear procedure on how to revert back the option byte configuration to the default one.

Thanks for the support

[JMill.17]

@Community member​ 

I have been your query and it is very difficult to get out of this, but I tried hard to come up with a solution.

As per my knowledge, the changes you made to the option bytes have caused some issues with programming and erasing the STM32U585.

To revert back to the default option byte configuration, I recommend you follow these steps:

Connect the STM32U585 board to your computer and open the STM32CubeProgrammer software.

In the STM32CubeProgrammer software, select the STM32U585 device and click on the "Read" button under the "Option Bytes" tab to read the current option byte values.

Check the default values for the RDP, TZEN, WRP1, and WRP2 bits in the UM2851 manual, and modify the option byte values accordingly.

Once you have modified the option byte values, click on the "Write" button under the "Option Bytes" tab to write the new values to the STM32U585.

After writing the new option byte values, perform a full chip erase by clicking on the "Erase Full Chip" button in the main STM32CubeProgrammer window.

In the last, program your desired application onto the STM32U585 using the STM32CubeProgrammer software.

By following these steps, you should be able to revert back to the default option byte configuration and program your desired application onto the STM32U585 board.

I hope it will help.

Thanks

[PJose.4]

Hi @JMill.17 and community
Thanks for your reply

i have made the default configuration of option bytes that were already in a perfectly working similar board.
but now my issue is the UNLOCK1A and UNLOCK1B and UNLOCK2A and UNLOCK2B bits. its throwing a error

Kindly support me in how to solve this particular error only then i will be able to program the flash memory

i am connecting under the default conditions

Awaiting your support in this regard
Thanks in advance

Psj

[Jocelyn RICARD]

Hi @PJose.4 ,

For some reason you enabled the write protect lock even if it is not activated by default in the TFM example (TFM_DEV_MODE).

To be able to disable these flags you need a transition from RDP1 to RDP0

So a simple solution is to 

1) switch SW1 to 0 to force bootloader

2) Check that you are running inside bootloader 

• Press reset button
• Connect with STM32Programmer in hotplug
• Click on CPU icon on the left
• Check PC : should be in  0xBF979xx range

3) Once you now you are in bootloader, you can set RDP Level 1 and then regress to RDP0

The Write protection lock should be removed.

Best regards

Jocelyn

[PJose.4]

Hi @Jocelyn RICARD 
thanks for your update

I have followed the steps that was shared in the above. But even after following the same i am unable to remove the write protection the difference i observed is the PC (from CPU option in the Cube Progammer)range showing like this:

In this setup i changed the RDP regression from 1 to 0 and checked the sequence mentioned above but same result. The Unlock option byte is not being checked(for all the registers WRP1A,WRP1B,WRP2A,WRP2B) - meaning these are locked(as shown in the figure below)

And if i am trying to check the unlock byte in the cube programmer i am getting an error

I hope the mentioned points are clear to understand the issue. I cross checked with another working B-U585-IOT2A module that i have and have found the only difference is this particular option byte.
please guide me if i am wrong
Thanks again

Philip

[PJose.4]

Hi @Jocelyn RICARD 
i tried couple of methods 
i booted the board from Rss(Boot0 pin =1) and referred to the document(AN5347) and followed the steps mentioned to deactivate the TZEN by providing separate power supply to the device and then rdp regression from level DC to Level AA and TZEN bit disable at the same time. That option byte was successfully removed. but still i am unable to do a flash mass erase the message displayed is "veriify write protection"(screenshot for the same is shown in the previous post).
Is the board permanently locked that cannot be reverted back(iam sure rdp regression was never given to level 2 and we hadnt enabled the wrp lock bits). i tried programming the unlock sequence to the wrp pins but still its the same result.
iam kind of stuck now.
Following is my option byte configuration. please have a look

 STM32_Programmer_CLI.exe -c port=SWD -ob displ
      -------------------------------------------------------------------
                       STM32CubeProgrammer v2.13.0
      -------------------------------------------------------------------

ST-LINK SN  : 002C001E4D46501220383832
ST-LINK FW  : V3J9M3
Board       : B-U585I-IOT02A
Voltage     : 3.29V
SWD freq    : 8000 KHz
Connect mode: Normal
Reset mode  : Software reset
Device ID   : 0x482
Revision ID : Rev X
Device name : STM32U575/STM32U585
Flash size  : 2 MBytes
Device type : MCU
Device CPU  : Cortex-M33
BL Version  : 0x92
Debug in Low Power mode enabled


UPLOADING OPTION BYTES DATA ...

  Bank          : 0x00
  Address       : 0x40022040
  Size          : 36 Bytes

██████████████████████████████████████████████████ 100%

  Bank          : 0x01
  Address       : 0x40022068
  Size          : 8 Bytes

██████████████████████████████████████████████████ 100%


OPTION BYTES BANK: 0

   Read Out Protection:

     RDP          : 0xAA (Level 0, no protection)

   BOR Level:

     BOR_LEV      : 0x0 (BOR Level 0, reset level threshold is around 1.7 V)

   User Configuration:

     TZEN         : 0x0 (Global TrustZone security disabled)
     nRST_STOP    : 0x1 (No reset generated when entering Stop mode)
     nRST_STDBY   : 0x1 (No reset generated when entering Standby mode)
     nRST_SHDW    : 0x1 (No reset generated when entering the Shutdown mode)
     SRAM134_RST  : 0x1 (SRAM1, SRAM3 and SRAM4 not erased when a system reset occurs)
     IWDG_SW      : 0x1 (Software independent watchdog)
     IWDG_STOP    : 0x1 (IWDG counter active in stop mode)
     IWDG_STDBY   : 0x1 (IWDG counter active in standby mode)
     WWDG_SW      : 0x1 (Software window watchdog)
     SWAP_BANK    : 0x0 (Bank 1 and bank 2 address are not swapped)
     DBANK        : 0x1 (Dual-bank Flash with contiguous addresses)
     BKPRAM_ECC   : 0x1 (Backup RAM ECC check disabled)
     SRAM3_ECC    : 0x1 (SRAM3 ECC check disabled)
     SRAM2_ECC    : 0x1 (SRAM2 ECC check disabled)
     SRAM2_RST    : 0x0 (SRAM2 erased when a system reset occurs)
     nSWBOOT0     : 0x1 (BOOT0 taken from PH3/BOOT0 pin)
     nBOOT0       : 0x1 (nBOOT0 = 1)
     PA15_PUPEN   : 0x1 (USB power delivery dead-battery disabled/ TDI pull-up activated)
     IO_VDD_HSLV  : 0x0 (High-speed IO at low VDD voltage feature disabled (VDD can exceed 2.5 V))
     IO_VDDIO2_HSLV: 0x0 (High-speed IO at low VDDIO2 voltage feature disabled (VDDIO2 can exceed 2.5 V))

   Boot Configuration:

     NSBOOTADD0   : 0x100000  (0x8000000)
     NSBOOTADD1   : 0x17F200  (0xBF90000)

   Write Protection 1:

     WRP1A_PSTRT  : 0x2  (0x8004000)
     WRP1A_PEND   : 0xC  (0x8018000)
     UNLOCK_1A    : 0x0 (WRP1A start and end pages locked)
     WRP1B_PSTRT  : 0x7F  (0x80FE000)
     WRP1B_PEND   : 0x0  (0x8000000)
     UNLOCK_1B    : 0x0 (WRP1B start and end pages locked)
OPTION BYTES BANK: 1

   Write Protection 2:

     WRP2A_PSTRT  : 0x7D  (0x81FA000)
     WRP2A_PEND   : 0x7F  (0x81FE000)
     UNLOCK_2A    : 0x0 (WRP2A start and end pages locked)
     WRP2B_PSTRT  : 0x7F  (0x81FE000)
     WRP2B_PEND   : 0x0  (0x8100000)
     UNLOCK_2B    : 0x0 (WRP2B start and end pages locked)

please help to solve this issue

Thanks and Regards

Pjose

[Jocelyn RICARD]

Hello @PJose.4,

I'm really sorry for answering so late. I didn't realise I didn't get  email notification with the new forum and was also too busy to poll for it.

I took a U5 board, and set option bytes as you have provided in last ob display output.

I would propose following sequence:

First set option bytes to boot on system bootloader

STM32_Programmer_CLI.exe -c port=SWD -ob nSWBOOT0=0 nBOOT0=0

Then  switch to RDP Level1 

STM32_Programmer_CLI.exe -c port=SWD -ob RDP=0xDC

Then while doing the regression, unlock the write protection

STM32_Programmer_CLI.exe -c port=SWD -ob RDP=0xAA UNLOCK_1A=1 UNLOCK_1B=1 UNLOCK_2A=1 UNLOCK_2B=1

After that you can remove the write protections

STM32_Programmer_CLI.exe -c port=SWD -ob RDP=0xAA UNLOCK_1A=1 UNLOCK_1B=1 UNLOCK_2A=1 UNLOCK_2B=1

I hope this will work on your side.

Best regards

Jocelyn

[PJose.4]

Hi @Jocelyn RICARD 
I tried the same sequence as you mentioned in the above post
the unlock bits are now 1 itself as shown below

UNLOCK_1A=1 UNLOCK_1B=1 UNLOCK_2A=1 UNLOCK_2B=1

 But i am unable to do a full chip erase. The same error message is coming like "verify write protection".
Thanks for your reply on this issue.
Awaiting your support in this regard

Philip

[Jocelyn RICARD · Accepted solution]

Hello @PJose.4 ,

The procedure I provided is to unlock the write protection.

Now you can change the write protection without restriction.

Just set start values higher than end values and you are done.

Best regards

Jocelyn

[PJose.4]

Hi @Jocelyn RICARD 

Thanks very much for your support
I was able to remove the flash protection with your support.
Thanks again. It worked
Regards
Philip