STM32WL55JC Flash locked after using LoRaWAN_End_Node_DualCore from STM32Cube_FW_WL_V1.1.0

BCart.1 · ‎2021-09-16

Hi,

I wanted to update from version 1.0.0 to 1.1.0 and after flashing the LoRaWAN_End_Node_DualCore demo on my Nucleo WL55JC, I cannot take control over the device anymore.

I can connect with a debugger on CPU1 and access registers, but memory is only read as zeroes. CPU1 is in constant Hardfault, and I cannot modify the Flash in any way.

It seems that CPU2 security is activated and I cannot find a way to disable it, same for any security options. I'm using CubeProgrammer 2.8

RDP = 0xFF

ESE = 1

FSD = 0

DDS = 1

HDPAD = 0

If there is a way to recover this board I would be very grateful.

Thank you

BC

BCart.1 · ‎2021-09-16

Here is the full option bytes

-------------------------------------------------------------------

STM32CubeProgrammer v2.8.0

-------------------------------------------------------------------

ST-LINK SN : 004400313038511234333935

ST-LINK FW : V3J8M3

Board : NUCLEO-WL55JC

Voltage : 3.27V

SWD freq : 12000 KHz

Connect mode: Normal

Reset mode : Software reset

Device ID : 0x497

Revision ID : Rev Z

Device name : STM32WLxx

Flash size : 256 KBytes

Device type : MCU

Device CPU : Cortex-M4

BL Version : 0xc1

UPLOADING OPTION BYTES DATA ...

Bank : 0x00

Address : 0x58004020

Size : 96 Bytes

██████████████████████████████████████████████████ 100%

Bank : 0x01

Address : 0x58004080

Size : 8 Bytes

██████████████████████████████████████████████████ 100%

OPTION BYTES BANK: 0

Read Out Protection:

RDP : 0xFF (Level 1, read protection of memories)

BOR Level:

BOR_LEV : 0x0 (BOR Level 0 reset level threshold is around 1.7 V)

User Configuration:

nBOOT0 : 0x0 (nBOOT0=0)

nBOOT1 : 0x1 ()

nSWBOOT0 : 0x0 (BOOT0 taken from the option bit nBOOT0)

SRAM_RST : 0x1 (SRAM1 and SRAM2 are not erased when a system reset occurs)

SRAM2_PE : 0x1 (SRAM2 parity check disable)

nRST_STOP : 0x0 (Reset generated when entering the Stop mode)

nRST_STDBY : 0x0 (Reset generated when entering the Standby mode)

nRST_SHDW : 0x0 (Reset generated when entering the Shutdown mode)

WWDG_SW : 0x1 (Software window watchdog)

IWGD_STDBY : 0x1 (Independent watchdog counter running in Standby mode)

IWDG_STOP : 0x1 (Independent watchdog counter running in Stop mode)

IWDG_SW : 0x1 (Software independent watchdog)

BOOT_LOCK : 0x0 (CPU1 CM4 Boot lock disabled)

C2BOOT_LOCK : 0x0 (CPU2 CM0+ Boot lock disabled)

IPCCDBA : 0x3FFF (0x3FFF)

Security Configuration Option bytes ESE:

ESE : 0x1 (Security enabled)

PCROP Protection:

PCROP1A_STRT : 0xFF (0x803FC00)

PCROP1A_END : 0xFF (0x803FC00)

PCROP_RDP : 0x1 (PCROP zone is erased when RDP is decreased)

PCROP1B_STRT : 0xFF (0x803FC00)

PCROP1B_END : 0x0 (0x8000000)

Write Protection:

WRP1A_STRT : 0x7F (0x803F800)

WRP1A_END : 0x0 (0x8000000)

WRP1B_STRT : 0x7F (0x803F800)

WRP1B_END : 0x0 (0x8000000)

OPTION BYTES BANK: 1

Security Configuration Option bytes:

SFSA : 0x0 (0x0)

FSD : 0x0 (System and Flash secure. This bit can only be accessed when HDPADIS = 0)

DDS : 0x1 (CPU2 debug access disabled (when also enabled by C2SWDBGEN))

HDPSA : 0x0 (0x0)

HDPAD : 0x0 (User Flash hide protection area access enabled.)

SUBGHSPISD : 0x0 (FSD=0 and SUBGHSPISD=0: SPI3 security enabled)

C2OPT : 0x1 (SBRV will address Flash memory, from start address 0x0800 0000 + SBRV.)

NBRSD : 0x0 (SRAM1 is secure if FSD=0 and non-secure otherwise. This bit can only be accessed when HDPADIS = 0)

SNBRSA : 0x0 (0x0)

BRSD : 0x0 (SRAM2 is secure if FSD=0 and non-secure otherwise. This bit can only be accessed when HDPADIS = 0)

SBRSA : 0x0 (0x0)

SBRV : 0xFE00 (0xFE00)

BCart.1 · ‎2021-09-20

For further information, I modified both linker files for the M0 and the M4 to correspond to the memory mapping of our project. The only changes are in memory definitions and are :

M0 Linker file

MEMORY
{
  RAM    (xrw)   : ORIGIN = 0x2000B000, LENGTH = 20K
  FLASH    (rx)    : ORIGIN = 0x08029000, LENGTH = 92K
  RAM_SHARED (xrw): ORIGIN = 0x2000A000, LENGTH = 4K
}

M4 Linker file

MEMORY
{
  RAM    (xrw)   : ORIGIN = 0x20000000, LENGTH = 32K
  FLASH   (rx)   : ORIGIN = 0x08000000, LENGTH = 164K
  RAM_SHARED (rw) : ORIGIN = 0x20009000, LENGTH = 4K
}