Cannot update option_bytes using CubeProgrammer

[Thatseasy]

My STM32H573 option bytes are in weird state which might be the reason that the device could not run any fw even if the flash still can be programmed; I imported the option bytes from a 'good' device, but could not apply the changes to the device, any idea?  Tried "Reset MCU to Factory settings" did not work either. 

Also, although the CubeProgrammer can connect to the device, CubeIDE cannot debug the device, the discovery.bat cannot even read the device IDs:

c:\> discovery.bat
-------------------------------------------------------------------
STM32CubeProgrammer v2.19.0
-------------------------------------------------------------------

Start Debug Authentication Sequence

Open SDM Lib
SDMOpen : 624 : open : SDM API v1.0

SDMOpen : 625 : open : SDM Library version v1.2.0

open_comms : 513 : open : Asserting target reset

open_comms : 517 : open : Writing magic number

open_comms : 537 : open : De-asserting target reset

open_comms : 584 : open : Communication with the target established successfully

response_packet_lock
Timeout while receiving response...
discovery: target ID.......................:0x0
discovery: SoC ID..........................:0x00000000_00000001_00000000_00000000
discovery: SDA version.....................:∙
discovery: Vendor ID.......................:(null)
"discovery script failed"

All these seems caused by a call to HAL_FLASHEx_OBProgram().  Is there a way to recover from this?

Thanks!

[Amine_Jridi]

Hello @Thatseasy,

Could you send the Option Bytes dump using " STM32_Programmer_CLI.exe -c port=swd -ob displ " or export it in JSON format using GUI.

Thank you,

Amine.

[Thatseasy]

Here it is, thanks!

"c:\Program Files\STMicroelectronics\STM32Cube\STM32CubeProgrammer\bin\STM32_Programmer_CLI.exe" -c port=SWD mode=UR -ob displ
-------------------------------------------------------------------
STM32CubeProgrammer v2.19.0
-------------------------------------------------------------------

ST-LINK SN : 005500363234510936303532
ST-LINK FW : V3J16M7B5S1
Board : STLINK-V3SET
Voltage : 3.25V
Connection to AP 0 requested and failed, Connection established with AP 1

SWD freq : 8000 KHz
Connect mode: Under Reset
Reset mode : Hardware reset
Device ID : 0x484
Revision ID : Rev X
Device name : STM32H56x/573
Flash size : 2 MBytes
Device type : MCU
Device CPU : Cortex-M33
BL Version : 0xE4
SFSP Version: v2.5.0
Debug in Low Power mode enabled

UPLOADING OPTION BYTES DATA ...

Bank : 0x00
Address : 0x50022050
Size : 112 Bytes

██████████████████████████████████████████████████ 100%

Bank : 0x01
Address : 0x50022070
Size : 16 Bytes

██████████████████████████████████████████████████ 100%

Bank : 0x02
Address : 0x50022080
Size : 16 Bytes

██████████████████████████████████████████████████ 100%

Bank : 0x03
Address : 0x500220e0
Size : 16 Bytes

██████████████████████████████████████████████████ 100%

Bank : 0x04
Address : 0x500221e0
Size : 16 Bytes

██████████████████████████████████████████████████ 100%

Bank : 0x05
Address : 0x50022090
Size : 8 Bytes

██████████████████████████████████████████████████ 100%

Bank : 0x06
Address : 0x500220f0
Size : 8 Bytes

██████████████████████████████████████████████████ 100%

Bank : 0x07
Address : 0x500221f0
Size : 8 Bytes

██████████████████████████████████████████████████ 100%

Bank : 0x08
Address : 0x500220f8
Size : 8 Bytes

██████████████████████████████████████████████████ 100%

Bank : 0x09
Address : 0x500221f8
Size : 8 Bytes

██████████████████████████████████████████████████ 100%

OPTION BYTES BANK: 0

Product state:

PRODUCT_STATE: 0xED (Open)

BOR Level:

BOR_LEV : 0x0 (BOR Level 1, the threshold level is low (around 2.1 V))
BORH_EN : 0x0 (0x0)

User Configuration:

IO_VDD_HSLV : 0x0 (0x0)
IO_VDDIO2_HSLV: 0x0 (0x0)
IWDG_STOP : 0x1 (0x1)
IWDG_STDBY : 0x1 (0x1)
BOOT_UBE : 0xB4 (OEM-iRoT (user flash) selected)
SWAP_BANK : 0x0 (0x0)
IWDG_SW : 0x1 (0x1)
NRST_STOP : 0x1 (0x1)
NRST_STDBY : 0x1 (0x1)
OPTION BYTES BANK: 1

User Configuration 2:

TZEN : 0xB4 (Trust zone enabled)
SRAM2_ECC : 0x0 (SRAM2 ECC check enabled )
SRAM3_ECC : 0x1 (SRAM3 ECC check disabled)
BKPRAM_ECC : 0x1 (BKPRAM ECC check disabled)
SRAM2_RST : 0x0 (SRAM2 erase when system reset)
SRAM1_3_RST : 0x1 (SRAM1 and SRAM3 not erased when a system reset occurs)
OPTION BYTES BANK: 2

Boot Configuration:

NSBOOTADD : 0x80000 (0x8000000)
NSBOOT_LOCK : 0xC3 (The SWAP_BANK and NSBOOTADD can still be modified following their individual rules.)
SECBOOT_LOCK : 0xC3 (The BOOT_UBE, SWAP_BANK and SECBOOTADD can still be modified following their individual rules.)
SECBOOTADD : 0xC0000 (0xC000000)
OPTION BYTES BANK: 3

Bank1 - Flash watermark area definition:

SECWM1_STRT : 0x0 (0x8000000)
SECWM1_END : 0x7F (0x80FE000)

Write sector group protection 1:

WRPSGn1 : 0xFFFFFFFF (0x0)
OPTION BYTES BANK: 4

Bank2 - Flash watermark area definition:

SECWM2_STRT : 0x0 (0x8100000)
SECWM2_END : 0x7F (0x81FE000)

Write sector group protection 2:

WRPSGn2 : 0xFFFFFFFF (0x8000000)
OPTION BYTES BANK: 5

OTP write protection:

LOCKBL : 0x0 (0x0)
OPTION BYTES BANK: 6

Flash data bank 1 sectors:

EDATA1_EN : 0x0 (No Flash high-cycle data area)
EDATA1_STRT : 0x0 (0x0)
OPTION BYTES BANK: 7

Flash data bank 2 sectors :

EDATA2_EN : 0x0 (No Flash high-cycle data area)
EDATA2_STRT : 0x0 (0x0)
OPTION BYTES BANK: 8

Flash HDP bank 1:

HDP1_STRT : 0x7F (0xFE000)
HDP1_END : 0x0 (0x0)
OPTION BYTES BANK: 9

Flash HDP bank 2:

HDP2_STRT : 0x7F (0xFE000)
HDP2_END : 0x0 (0x0)

[Amine_Jridi]

Hello @Thatseasy,

I have applied the same OBs you provided, and I am able to change OBs, however due to the secure watermark area the FW download verification fails and that's a normal behavior. Can you try to manually set SECWM1_STRT to be greater than SECWM1_END or disabling TrustZone ?

Thanks,

Amine.

[Thatseasy]

@Amine_Jridi The TrustZone was not enabled, not sure why UserConfig2 TZEN had 0xB4, but I was able to change it to C3 from the GUI.  Tried to set SECWM1_STRT to 0x7F, got the following error:

Not sure the option bytes are the problem, but as mentioned earlier, the board started to have problems after a call to HAL_FLASHEx_OBProgram() which I suspected something got messed up.

In the meantime, I wrote a small program to run from the SDRAM, in the program, tried to write the USERConfig using the values read from a good board, but still not able to recover the board.

pOBInit.OptionType = OPTIONBYTE_USER;

pOBInit.USERType = OB_USER_ALL;

pOBInit.USERConfig = 821035256;

pOBInit.USERConfig2 = 3271557172;

if ( HAL_FLASHEx_OBProgram(&pOBInit) != HAL_OK )

{

Error_Handler();

}

Is there a way to do a factory reset to the H573 chip? Thanks!