Difference between revisions of "ST STM32U0 Option Bytes Programming"

From SEGGER Wiki
Jump to: navigation, search
(Created page with "TBD")
 
Line 1: Line 1:
  +
STM32H5 Option bytes programming and RDP locking/unlocking features are implemented in the PCode_DevPro_ST_STM32U0.pex script file.
TBD
 
  +
  +
__TOC__
  +
  +
== Important notes ==
  +
# Performing RDP level 1 unlocking starts regression sequence. Flash memory is completely erased in this case.
  +
# Setting RDP to level 2 without OEM 2 password(OEM2 Key) provided permanently locks the device. No unlock/regression possible.
  +
# After option bytes write operation, the target device must be power-cycled.
  +
  +
== Usage ==
  +
DevPro -operation [operation_name] -if SWD -speed 4000 [parameter_name=value] -ScriptFile PCode_DevPro_ST_STM32H5.pex
  +
  +
{| class="wikitable"
  +
|-
  +
! Operation !! Parameters !! Values !! Description
  +
|-
  +
|-
  +
|rowspan="4"|ReadOptionBytes
  +
|rowspan="4"|OptionName
  +
| FLASH_OPTR || Read FLASH option register.
  +
|-
  +
| FLASH_WRP1AR || Read FLASH WRP area A address register.
  +
|-
  +
| FLASH_WRP1BR || Read FLASH WRP area A address register.
  +
|-
  +
| FLASH_SECR || Read FLASH security register.
  +
|-
  +
|rowspan="5"|WriteOptionBytes
  +
|rowspan="4"|OptionName
  +
| FLASH_OPTR || FLASH option register.
  +
|-
  +
| FLASH_WRP1AR || FLASH WRP area A address register.
  +
|-
  +
| FLASH_WRP1BR || FLASH WRP area A address register.
  +
|-
  +
| FLASH_SECR || FLASH security register.
  +
|-
  +
| Value || 0xXXXXXXXX || 32-bit value to be written to the register specified in "OptionName" parameter.
  +
|-
  +
|rowspan="3"|UnlockDevice
  +
|rowspan="2"|Level
  +
| RDP1 || Performes RDP regression from level 1 to level 0.
  +
|-
  +
| RDP2 || Performes RDP regression from level 2 to level 1.
  +
|-
  +
| Password || XXXXXXXXYYYYYYYYKKKKKKKKLLLLLLLL || Password to unlock the device.<br> Where: XXXXXXXX - 1st hex word value,<br> YYYYYYYY - 2nd hex word value,<br> KKKKKKKK - 3rd hex word value,<br> LLLLLLLL - 4th hex word value
  +
|-
  +
|rowspan="3"|SetPassword
  +
|rowspan="2"|Level
  +
| RDP1 || Sets RDP1 128-bit password (OEM1 Key).
  +
|-
  +
| RDP2 || Sets RDP2 128-bit password (OEM2 Key).
  +
|-
  +
| Password || XXXXXXXXYYYYYYYYKKKKKKKKLLLLLLLL || Password to be written to FLASH_OEMxKEYRx registers. <br> Where: XXXXXXXX - 1st hex word value,<br> YYYYYYYY - 2nd hex word value,<br> KKKKKKKK - 3rd hex word value,<br> LLLLLLLL - 4th hex word value
  +
|-
  +
|rowspan="2"|RemovePassword
  +
|rowspan="2"|Level
  +
| RDP1 || Removes RDP level 1 password.
  +
|-
  +
| RDP2 || Removes RDP level 2 password.
  +
|-
  +
| CheckPassword || - || - || Prints status of the passwords and their CRC8 checksums.
  +
|}
  +
  +
== Detailed description ==
  +
=== ReadOptionBytes ===
  +
*Reads and prints out description of the selected option-byte register.
  +
  +
=== WriteOptionBytes ===
  +
*Writes selected option-byte register. Using hex value is recommended.
  +
{{Note|Writing FLASH_OPTR register is used to lock device. The least 8-bits represent device locking level:<br> Value 0xAA - Device not locked<br>Value 0xBB or other than 0xAA or 0xCC - Level 1 protection<br>Value 0xCC - Level 2 protection }}
  +
  +
=== UnlockDevice ===
  +
*Unlocks device with the password. Unlocking sequence is as follows: from Level 2 to Level 1, from Level 1 to Level 0.
  +
{{Note|Operation does not report if the password macth, only result of writing it to device.<br>If the password is wrong, all successive operations will fail.}}
  +
  +
=== SetPassword ===
  +
Sets one of the 2 password for subsequent authentication.
  +
For compatibility with STs STM32_Programmer_CLI the password value has the same format, except "0x" prefix and whitespaces. For example:<br>
  +
STM32_Programmer_CLI.exe -c port=SWD mode=hotplug ap=1 -unlockRDP1 0x00010203 0x04050607 0x08090A0B 0x0C0D0E0F<br>
  +
DevPro.exe -operation SetPassword -if SWD -speed 4000 -SetConfigVal "Level=RDP1" -SetConfigVal "Password=000102030405060708090A0B0C0D0E0F" -ScriptFile PCode_DevPro_ST_STM32U0.pex<br>
  +
Password must not be all 1s or all 0s.
  +
  +
=== RemovePassword ===
  +
Removes the selected password. Using SetPassword operation with all 1s will also remove the password.<br>Passwords can be removed when Level 0 protection is set.
  +
  +
=== CheckPassword ===
  +
Used to check if teh passwords are already set. Also prints CRC8 check sums.
  +
  +
== Examples ==
  +
Reading option bytes register:
  +
C:\> DevPro.exe -operation ReadOptionBytes -if SWD -speed 4000 -SetConfigVal "OptionName=FLASH_OPTR" -ScriptFile PCode_DevPro_ST_STM32U0.pex
  +
SEGGER Device Provisioner V7.96e
  +
Compiled Apr 17 2024 16:25:36
  +
  +
'q' to quit '?' for help
  +
  +
Command line: -operation ReadOptionBytes -if SWD -speed 4000 -SetConfigVal OptionName=FLASH_OPTR -ScriptFile PCode_DevPro_ST_STM32U0.pex
  +
Opened script file: 'C:\Program Files\SEGGER\JLink\Script\PCode_DevPro_ST_STM32U0.pex'
  +
J-Link log: -----------------------------------------------------------------------------------------------
  +
J-Link log: FLASH_OPTR value: 0xFFFFFEAA
  +
J-Link log: -----------------------------------------------------------------------------------------------
  +
J-Link log: RDP: 0x000000AA
  +
J-Link log: |-> Level 0, read protection not active
  +
J-Link log: -----------------------------------------------------------------------------------------------
  +
J-Link log: BOR_LEV: 0x00000006
  +
J-Link log: |-> BOR level undefined
  +
J-Link log: -----------------------------------------------------------------------------------------------
  +
J-Link log: NRST_STOP: 0x00000001
  +
J-Link log: |-> No reset generated when entering the Stop mode
  +
J-Link log: -----------------------------------------------------------------------------------------------
  +
J-Link log: NRST_STDBY: 0x00000001
  +
J-Link log: |-> No reset generate when entering the Standby mode
  +
J-Link log: -----------------------------------------------------------------------------------------------
  +
J-Link log: NRST_SHDW: 0x00000001
  +
J-Link log: |-> No reset generated when entering the Shutdown mode
  +
J-Link log: -----------------------------------------------------------------------------------------------
  +
J-Link log: IWDG_SW: 0x00000001
  +
J-Link log: |-> Software independent watchdog
  +
J-Link log: -----------------------------------------------------------------------------------------------
  +
J-Link log: IWDG_STOP: 0x00000001
  +
J-Link log: |-> Independent watchdog counter is running in Stop mode
  +
J-Link log: -----------------------------------------------------------------------------------------------
  +
J-Link log: IWDG_STDBY: 0x00000001
  +
J-Link log: |-> Independent watchdog counter is running in Standby mode
  +
J-Link log: -----------------------------------------------------------------------------------------------
  +
J-Link log: WWDG_SW: 0x00000001
  +
J-Link log: |-> Software window watchdog
  +
J-Link log: -----------------------------------------------------------------------------------------------
  +
J-Link log: BDRST: 0x00000001
  +
J-Link log: |-> Reset of backup domain (RTC registers and backup registers) forced on shutdown exit
  +
J-Link log: -----------------------------------------------------------------------------------------------
  +
J-Link log: RAM_PARITY_CHECK: 0x00000001
  +
J-Link log: |-> SRAM parity check control disable
  +
J-Link log: -----------------------------------------------------------------------------------------------
  +
J-Link log: BKPSRAM_HW_ERASE_DISABLE: 0x00000001
  +
J-Link log: |-> Backup SRAM content is kept when a system reset occurs
  +
J-Link log: -----------------------------------------------------------------------------------------------
  +
J-Link log: NBOOT_SEL: 0x00000001
  +
J-Link log: |-> NBOOT0 option bit
  +
J-Link log: -----------------------------------------------------------------------------------------------
  +
J-Link log: NBOOT1: 0x00000001
  +
J-Link log: |-> Boot from Flash if BOOT0 = 1, otherweise system memory
  +
J-Link log: -----------------------------------------------------------------------------------------------
  +
J-Link log: NBOOT0: 0x00000001
  +
J-Link log: |-> NBOOT0 = 1
  +
J-Link log: -----------------------------------------------------------------------------------------------
  +
J-Link log: NRST_MODE: 0x00000003
  +
J-Link log: |-> Bidirectional reset: the NRST pin is configured in reset input/output (legacy) mode
  +
J-Link log: -----------------------------------------------------------------------------------------------
  +
J-Link log: IRHEN: 0x00000001
  +
J-Link log: |-> Internal resets drives NRST pin low until it is seen as low level
  +
J-Link log: -----------------------------------------------------------------------------------------------
  +
  +
Writing option bytes register (setting RDP level 1 protection):
  +
DevPro.exe -operation WriteOptionBytes -if SWD -speed 4000 -SetConfigVal "OptionName=FLASH_OPTR" -SetConfigVal "Value=0xFFFFFCBB" -ScriptFile PCode_DevPro_ST_STM32U0.pex
  +
SEGGER Device Provisioner V7.96e
  +
Compiled Apr 17 2024 16:25:36
  +
  +
'q' to quit '?' for help
  +
  +
Command line: -operation WriteOptionBytes -if SWD -speed 4000 -SetConfigVal OptionName=FLASH_OPTR -SetConfigVal Value=0xFFFFFCBB -ScriptFile PCode_DevPro_ST_STM32U0.pex
  +
Opened script file: 'PCode_DevPro_ST_STM32U0.pex'
  +
J-Link log: Option bytes programmed successfully
  +
  +
Setting password(OEM Key)
  +
DevPro.exe -operation SetPassword -if SWD -speed 4000 -SetConfigVal "Level=RDP1" -SetConfigVal "Password=deadbeefdeadbeefdeadbeefdeadbeef" -ScriptFile PCode_DevPro_ST_STM32U0.pex
  +
SEGGER Device Provisioner V7.96e
  +
Compiled Apr 17 2024 16:25:36
  +
  +
'q' to quit '?' for help
  +
  +
Command line: -operation SetPassword -if SWD -speed 4000 -SetConfigVal Level=RDP1 -SetConfigVal Password=deadbeefdeadbeefdeadbeefdeadbeef -ScriptFile PCode_DevPro_ST_STM32U0.pex
  +
Opened script file: 'PCode_DevPro_ST_STM32U0.pex'
  +
J-Link log: RDP password has been set successfully
  +
  +
Checking passwords status
  +
DevPro.exe -operation CheckPassword -if SWD -speed 4000 -ScriptFile PCode_DevPro_ST_STM32U0.pex
  +
SEGGER Device Provisioner V7.96e
  +
Compiled Apr 17 2024 16:25:36
  +
  +
'q' to quit '?' for help
  +
  +
Command line: -operation CheckPassword -if SWD -speed 4000 -ScriptFile PCode_DevPro_ST_STM32U0.pex
  +
Opened script file: 'PCode_DevPro_ST_STM32U0.pex'
  +
J-Link log: RDP 1 password is set. CRC8: 0x00000027
  +
J-Link log: RDP 2 password is not set
  +
  +
Removing password
  +
DevPro.exe -operation RemovePassword -if SWD -speed 4000 -SetConfigVal "Level=RDP2" -ScriptFile PCode_DevPro_ST_STM32U0.pex
  +
SEGGER Device Provisioner V7.96e
  +
Compiled Apr 17 2024 16:25:36
  +
  +
'q' to quit '?' for help
  +
  +
Command line: -operation RemovePassword -if SWD -speed 4000 -SetConfigVal Level=RDP2 -ScriptFile PCode_DevPro_ST_STM32U0.pex
  +
Opened script file: 'PCode_DevPro_ST_STM32U0.pex'
  +
J-Link log: RDP password has been removed successfully
  +
  +
Unlocking device with password
  +
DevPro.exe -operation UnlockDevice -if SWD -speed 4000 -SetConfigVal "Level=RDP1" -SetConfigVal "Password=deadbeefdeadbeefdeadbeefdeadbeef" -ScriptFile PCode_DevPro_ST_STM32U0.pex
  +
SEGGER Device Provisioner V7.96e
  +
Compiled Apr 17 2024 16:25:36
  +
  +
'q' to quit '?' for help
  +
  +
Command line: -operation UnlockDevice -if SWD -speed 4000 -SetConfigVal Level=RDP1 -SetConfigVal Password=deadbeefdeadbeefdeadbeefdeadbeef -ScriptFile PCode_DevPro_ST_STM32U0.pex
  +
Opened script file: 'PCode_DevPro_ST_STM32U0.pex'
  +
J-Link log: RDP password has been written successfully

Revision as of 15:42, 8 May 2024

STM32H5 Option bytes programming and RDP locking/unlocking features are implemented in the PCode_DevPro_ST_STM32U0.pex script file.

Important notes

  1. Performing RDP level 1 unlocking starts regression sequence. Flash memory is completely erased in this case.
  2. Setting RDP to level 2 without OEM 2 password(OEM2 Key) provided permanently locks the device. No unlock/regression possible.
  3. After option bytes write operation, the target device must be power-cycled.

Usage

DevPro -operation [operation_name] -if SWD -speed 4000 [parameter_name=value] -ScriptFile PCode_DevPro_ST_STM32H5.pex
Operation Parameters Values Description
ReadOptionBytes OptionName FLASH_OPTR Read FLASH option register.
FLASH_WRP1AR Read FLASH WRP area A address register.
FLASH_WRP1BR Read FLASH WRP area A address register.
FLASH_SECR Read FLASH security register.
WriteOptionBytes OptionName FLASH_OPTR FLASH option register.
FLASH_WRP1AR FLASH WRP area A address register.
FLASH_WRP1BR FLASH WRP area A address register.
FLASH_SECR FLASH security register.
Value 0xXXXXXXXX 32-bit value to be written to the register specified in "OptionName" parameter.
UnlockDevice Level RDP1 Performes RDP regression from level 1 to level 0.
RDP2 Performes RDP regression from level 2 to level 1.
Password XXXXXXXXYYYYYYYYKKKKKKKKLLLLLLLL Password to unlock the device.
Where: XXXXXXXX - 1st hex word value,
YYYYYYYY - 2nd hex word value,
KKKKKKKK - 3rd hex word value,
LLLLLLLL - 4th hex word value
SetPassword Level RDP1 Sets RDP1 128-bit password (OEM1 Key).
RDP2 Sets RDP2 128-bit password (OEM2 Key).
Password XXXXXXXXYYYYYYYYKKKKKKKKLLLLLLLL Password to be written to FLASH_OEMxKEYRx registers.
Where: XXXXXXXX - 1st hex word value,
YYYYYYYY - 2nd hex word value,
KKKKKKKK - 3rd hex word value,
LLLLLLLL - 4th hex word value
RemovePassword Level RDP1 Removes RDP level 1 password.
RDP2 Removes RDP level 2 password.
CheckPassword - - Prints status of the passwords and their CRC8 checksums.

Detailed description

ReadOptionBytes

  • Reads and prints out description of the selected option-byte register.

WriteOptionBytes

  • Writes selected option-byte register. Using hex value is recommended.
Note:
Writing FLASH_OPTR register is used to lock device. The least 8-bits represent device locking level:
Value 0xAA - Device not locked
Value 0xBB or other than 0xAA or 0xCC - Level 1 protection
Value 0xCC - Level 2 protection

UnlockDevice

  • Unlocks device with the password. Unlocking sequence is as follows: from Level 2 to Level 1, from Level 1 to Level 0.
Note:
Operation does not report if the password macth, only result of writing it to device.
If the password is wrong, all successive operations will fail.

SetPassword

Sets one of the 2 password for subsequent authentication. For compatibility with STs STM32_Programmer_CLI the password value has the same format, except "0x" prefix and whitespaces. For example:

STM32_Programmer_CLI.exe -c port=SWD mode=hotplug ap=1 -unlockRDP1 0x00010203 0x04050607 0x08090A0B 0x0C0D0E0F
DevPro.exe -operation SetPassword -if SWD -speed 4000 -SetConfigVal "Level=RDP1" -SetConfigVal "Password=000102030405060708090A0B0C0D0E0F" -ScriptFile PCode_DevPro_ST_STM32U0.pex

Password must not be all 1s or all 0s.

RemovePassword

Removes the selected password. Using SetPassword operation with all 1s will also remove the password.
Passwords can be removed when Level 0 protection is set.

CheckPassword

Used to check if teh passwords are already set. Also prints CRC8 check sums.

Examples

Reading option bytes register:

C:\> DevPro.exe -operation ReadOptionBytes -if SWD -speed 4000 -SetConfigVal "OptionName=FLASH_OPTR" -ScriptFile PCode_DevPro_ST_STM32U0.pex
SEGGER Device Provisioner V7.96e
Compiled Apr 17 2024 16:25:36

'q' to quit '?' for help

Command line: -operation ReadOptionBytes -if SWD -speed 4000 -SetConfigVal OptionName=FLASH_OPTR -ScriptFile PCode_DevPro_ST_STM32U0.pex 
Opened script file: 'C:\Program Files\SEGGER\JLink\Script\PCode_DevPro_ST_STM32U0.pex'
J-Link log: -----------------------------------------------------------------------------------------------
J-Link log: FLASH_OPTR value:         0xFFFFFEAA
J-Link log: -----------------------------------------------------------------------------------------------
J-Link log: RDP:                      0x000000AA
J-Link log: |-> Level 0, read protection not active
J-Link log: -----------------------------------------------------------------------------------------------
J-Link log: BOR_LEV:                  0x00000006
J-Link log: |-> BOR level undefined
J-Link log: -----------------------------------------------------------------------------------------------
J-Link log: NRST_STOP:                0x00000001
J-Link log: |-> No reset generated when entering the Stop mode
J-Link log: -----------------------------------------------------------------------------------------------
J-Link log: NRST_STDBY:               0x00000001
J-Link log: |-> No reset generate when entering the Standby mode
J-Link log: -----------------------------------------------------------------------------------------------
J-Link log: NRST_SHDW:                0x00000001
J-Link log: |-> No reset generated when entering the Shutdown mode
J-Link log: -----------------------------------------------------------------------------------------------
J-Link log: IWDG_SW:                  0x00000001
J-Link log: |-> Software independent watchdog
J-Link log: -----------------------------------------------------------------------------------------------
J-Link log: IWDG_STOP:                0x00000001
J-Link log: |-> Independent watchdog counter is running in Stop mode
J-Link log: -----------------------------------------------------------------------------------------------
J-Link log: IWDG_STDBY:               0x00000001
J-Link log: |-> Independent watchdog counter is running in Standby mode
J-Link log: -----------------------------------------------------------------------------------------------
J-Link log: WWDG_SW:                  0x00000001
J-Link log: |-> Software window watchdog
J-Link log: -----------------------------------------------------------------------------------------------
J-Link log: BDRST:                    0x00000001
J-Link log: |-> Reset of backup domain (RTC registers and backup registers) forced on shutdown exit
J-Link log: -----------------------------------------------------------------------------------------------
J-Link log: RAM_PARITY_CHECK:         0x00000001
J-Link log: |-> SRAM parity check control disable
J-Link log: -----------------------------------------------------------------------------------------------
J-Link log: BKPSRAM_HW_ERASE_DISABLE: 0x00000001
J-Link log: |-> Backup SRAM content is kept when a system reset occurs
J-Link log: -----------------------------------------------------------------------------------------------
J-Link log: NBOOT_SEL:                0x00000001
J-Link log: |-> NBOOT0 option bit
J-Link log: -----------------------------------------------------------------------------------------------
J-Link log: NBOOT1:                   0x00000001
J-Link log: |-> Boot from Flash if BOOT0 = 1, otherweise system memory
J-Link log: -----------------------------------------------------------------------------------------------
J-Link log: NBOOT0:                   0x00000001
J-Link log: |-> NBOOT0 = 1
J-Link log: -----------------------------------------------------------------------------------------------
J-Link log: NRST_MODE:                0x00000003
J-Link log: |-> Bidirectional reset: the NRST pin is configured in reset input/output (legacy) mode
J-Link log: -----------------------------------------------------------------------------------------------
J-Link log: IRHEN:                    0x00000001
J-Link log: |-> Internal resets drives NRST pin low until it is seen as low level
J-Link log: -----------------------------------------------------------------------------------------------

Writing option bytes register (setting RDP level 1 protection):

DevPro.exe -operation WriteOptionBytes -if SWD -speed 4000 -SetConfigVal "OptionName=FLASH_OPTR" -SetConfigVal "Value=0xFFFFFCBB" -ScriptFile PCode_DevPro_ST_STM32U0.pex
SEGGER Device Provisioner V7.96e
Compiled Apr 17 2024 16:25:36

'q' to quit '?' for help

Command line: -operation WriteOptionBytes -if SWD -speed 4000 -SetConfigVal OptionName=FLASH_OPTR -SetConfigVal Value=0xFFFFFCBB -ScriptFile PCode_DevPro_ST_STM32U0.pex 
Opened script file: 'PCode_DevPro_ST_STM32U0.pex'
J-Link log: Option bytes programmed successfully

Setting password(OEM Key)

DevPro.exe -operation SetPassword -if SWD -speed 4000 -SetConfigVal "Level=RDP1" -SetConfigVal "Password=deadbeefdeadbeefdeadbeefdeadbeef" -ScriptFile PCode_DevPro_ST_STM32U0.pex
SEGGER Device Provisioner V7.96e
Compiled Apr 17 2024 16:25:36

'q' to quit '?' for help

Command line: -operation SetPassword -if SWD -speed 4000 -SetConfigVal Level=RDP1 -SetConfigVal Password=deadbeefdeadbeefdeadbeefdeadbeef -ScriptFile PCode_DevPro_ST_STM32U0.pex
Opened script file: 'PCode_DevPro_ST_STM32U0.pex'
J-Link log: RDP password has been set successfully

Checking passwords status

DevPro.exe -operation CheckPassword -if SWD -speed 4000 -ScriptFile PCode_DevPro_ST_STM32U0.pex
SEGGER Device Provisioner V7.96e
Compiled Apr 17 2024 16:25:36

'q' to quit '?' for help

Command line: -operation CheckPassword -if SWD -speed 4000 -ScriptFile PCode_DevPro_ST_STM32U0.pex
Opened script file: 'PCode_DevPro_ST_STM32U0.pex'
J-Link log: RDP 1 password is set. CRC8: 0x00000027
J-Link log: RDP 2 password is not set

Removing password

DevPro.exe -operation RemovePassword -if SWD -speed 4000 -SetConfigVal "Level=RDP2" -ScriptFile PCode_DevPro_ST_STM32U0.pex
SEGGER Device Provisioner V7.96e
Compiled Apr 17 2024 16:25:36

'q' to quit '?' for help

Command line: -operation RemovePassword -if SWD -speed 4000 -SetConfigVal Level=RDP2 -ScriptFile PCode_DevPro_ST_STM32U0.pex
Opened script file: 'PCode_DevPro_ST_STM32U0.pex'
J-Link log: RDP password has been removed successfully

Unlocking device with password

DevPro.exe -operation UnlockDevice -if SWD -speed 4000 -SetConfigVal "Level=RDP1" -SetConfigVal "Password=deadbeefdeadbeefdeadbeefdeadbeef" -ScriptFile PCode_DevPro_ST_STM32U0.pex
SEGGER Device Provisioner V7.96e
Compiled Apr 17 2024 16:25:36

'q' to quit '?' for help

Command line: -operation UnlockDevice -if SWD -speed 4000 -SetConfigVal Level=RDP1 -SetConfigVal Password=deadbeefdeadbeefdeadbeefdeadbeef -ScriptFile PCode_DevPro_ST_STM32U0.pex
Opened script file: 'PCode_DevPro_ST_STM32U0.pex'
J-Link log: RDP password has been written successfully