Rdp = 1, locks backup register

[LorenzoRosin]

I’m working on an STM32WLE5 device and I’m facing a reproducible issue when enabling Read-Out Protection level 1 (RDP = 1).

When RDP = 0, everything works as expected: i can write/read RTC Backup registers, my initialization sequence behaves correctly.

However, as soon as I set RDP = 1, the firmware can no longer access the backup domain: Any attempt to write Backup registers fails, even with SWD completely disconnected

The strange part: If I disconnect VBAT (short it to GND to fully drop the backup supply), everything works again — even with RDP = 1.

After removing VBAT and letting the backup domain fully reset, my firmware can again access backup registers normally.

This strongly suggests that the Backup Domain remains in a “protected” or “locked” state after enabling RDP, and can only be reset by removing VBAT.

My problem is that we have a supercap soldered on the vbat pin, and we cannot shortcircuit it during production. 

Any help? Thank you

[MM..1]

Try forced once sw reset 

__HAL_RCC_BACKUPRESET_FORCE();

[LorenzoRosin]

Hi,

I have tried to call 

__HAL_RCC_BACKUPRESET_FORCE

And just after the release function, but the backup registers are still not working.

It's seems like the backup domain demands a full reset after the activstion of the RDP, and with the presence of a supercap is not possible. 

[AScha.3]

Hi,

- i am not sure about , but try -

do regression to rdp level 0 , full chip erase. 

Then it should work....and you can set rdp level 1 again.

from ds / rm :

When the Readout Protection (RDP) level is set to 1 on STM32 devices, access to backup registers is restricted. Specifically:

• Allowed: Backup registers can be read and written when the device is booting from user flash memory (normal application execution).
• Denied: Access to backup registers is blocked if the device is booted from other sources (such as RAM or system bootloader) or if debug access is detected.

+

• RDP Level 1:
  • Forbids external access (read, erase, program) to flash memory and SRAM2 via debug features.
  • Allows internal application access.
  • Backup registers and SRAM are protected from unauthorized access through debug or bootloader methods.

[MM..1]

Then try place RDP 1 activation code in your aplication and not activate over STLINK.

[LorenzoRosin]

I’ve likely identified the root cause of the issue.

The tamper registers are powered by the VBAT domain and therefore are not reset when the board is powered off. The problem is that when we program the board, the TAMP_SR register sets the ITAMP6F flag (related to the JTAG connection). This flag does not appear to reset even after disconnecting JTAG and powering the board off.

As a result, when the RDP level is set to 1, the firmware prevents access to the backup registers. In my opinion, this is a significant problem.

At the moment, it seems I can access the backup domain only by disabling the ITAMP6NOER flag in TAMP_CR3 (Internal Tamper 6 no erase), but this workaround feels too hacky, and I need to run more tests to confirm this behaviour. Could someone verify whether my understanding is correct?

Thank you.

[LorenzoRosin]

I’ve tried both approaches without success. I suspect the issue is related to the tamper registers, which are not reset after a main-domain reset (I cannot reset the VBAT domain because there’s a supercapacitor connected to that pin, and I can’t desolder it during board production).

I’ve replied to another post in this thread with more details.
Thank you for your feedback.