[SOLVED] Problem Unsecuring STM32F103RC chip at JTAG TAP location > 0

This site uses cookies. By continuing to browse this site, you are agreeing to our Cookie Policy.

  • [SOLVED] Problem Unsecuring STM32F103RC chip at JTAG TAP location > 0

    Hi,



    I have a target board for a product that has 2 x STM32F103RC micros connected together in a JTAG scan chain. See J-Link Commander output to verify this shows up as 4 JTAG devices correctly:



    SEGGER J-Link Commander V4.17a ('?' for help)
    Compiled Aug 18 2010 20:00:10
    DLL version V4.17a, compiled Aug 18 2010 19:59:54
    Firmware: J-Link ARM V8 compiled Aug 12 2010 19:35:38
    Hardware: V8.00
    S/N : 58003432
    Feature(s) : JFlash
    VTarget = 3.293V
    Info: TotalIRLen = 18, IRPrint = 0x00442211
    Info: Found Cortex-M3 r1p1, Little endian.
    Info: TPIU fitted.
    Info: ETM fitted.
    Info: FPUnit: 6 code (BP) slots and 2 literal slots
    Found 4 JTAG devices, Total IRLen = 18:
    #0 Id: 0x3BA00477, IRLen: 04, IRPrint: 0x1, CoreSight JTAG-DP (ARM)
    #1 Id: 0x06414041, IRLen: 05, IRPrint: 0x1, STM32 Boundary Scan
    #2 Id: 0x3BA00477, IRLen: 04, IRPrint: 0x1, CoreSight JTAG-DP (ARM)
    #3 Id: 0x06414041, IRLen: 05, IRPrint: 0x1, STM32 Boundary Scan
    Cortex-M3 identified.
    JTAG speed: 100 kHz
    J-Link>



    I can program firmware into both micros by moving J-Flash ARM settings from
    Tap 0, IR len 0 to
    Tap 2, IR len 9



    I can secure both micros to prevent the code from being read out as well using J-Flash ARM.



    This is all good until I then want to reprogram the two micros...



    I can only unsecure the first micro on the JTAG scan chain (Tap 0, IR len 0). This causes the device to be erased and can then be reprogrammed.



    When I try to unsecure the second micro on the JTAG scan chain (Tap 2, IR len 9), it looks like it works, but the micro remains secured, the code is not erased and the micro cannot be reprogrammed. See following J-Flash output:



    Reading entire flash chip ...
    - Connecting ...
    - Connected successfully
    - 128 sectors, 1 range, 0x8000000 - 0x803FFFF
    - RAM tested O.K.
    - ERROR: Timeout while blank checking, core does not stop
    - ERROR: Failed to read back target memory [FAILED Read of a protected chip]
    Disconnecting ...
    - Disconnected
    Unsecure chip ...
    - Connecting via USB to J-Link device 0
    - Chip unsecured successfully - Completed after 2.284 sec [Seemingly successful unsecure, but chip is still secure...]
    Reading selected sectors ...
    - Connecting ...
    - Connected successfully
    - 128 of 128 sectors selected, 1 range, 0x8000000 - 0x803FFFF
    - RAM tested O.K.
    - ERROR: Timeout while blank checking, core does not stop
    - ERROR: Failed to read back target memory [Second FAILED Read of a protected chip (even after a power cycle, it is still secure)]
    Disconnecting ...
    - Disconnected



    I also tried to use the "JLinkSTM32.exe" utility to unlock the micro, but this utility seems to only work on the first device on the JTAG scan chain as it looks to be using SWD rather than JTAG to connect to the micro (and there is no command line options to specify Tap 2, IR len 9, if I wanted to use it to unlock the second micro on the JTAG scan chain anyway...). SWD does not support scanning anything other than the first connected micro so this is not likely to work for my product board anyway.



    This problem appears to me to be a bug in the J-Flash ARM software. It may relate to both securing and unsecuring a device at a Tap position greater than 0, I have only shown it to fail when trying the unsecure the device at Tap position 2. I secure the device during programming by writing to the Option Bytes rather than using the "-securechip" command line option.



    It would be great if this problem could be diagnosed and possibly fixed as it is causing a fair amount of grief with our product boards that do need to be reprogrammed after being secured from time to time.



    Our company has purchased several J-Link ARM devices and we are likely to run into this problem on a number of planned products that use JTAG scan chains to interconnect multiple devices on a single board and JTAG connector.



    Thanks,

    Nick

    Gallagher R&D

    New Zealand
  • Gave up waiting for this bug to be fixed, will workaround...

    Hi,

    Just an update to the original problem statement. I still believe that there is a bug in the J-Flash ARM software, but due to the lack of response, it is easier for us to workaround this problem by separating out the JTAG test points on our two micros rather than treating them as a JTAG chain.

    Nick
  • I had the same problem using JLink v478e

    Solution was to unlock chip using flash memory register via JLink commander.

    Mpu wes STM32F205RE


    Different devices may have different flash address space, and different sequence to unlock.
    Please refer to the flash programming datasheet of your device.

    ------------------------------------------------------- JLink script file



    device STM32F205RE
    si 0

    rsettype 2

    # Unsecure all chips

    # Select first IRLen=10, TAP=1
    config 10,1
    rx 10


    # Unlock flash opt register
    w4 0x40023C08, 0x08192A3B
    w4 0x40023C08, 0x4C5D6E7F

    # read status byte
    mem32 0x40023C14, 1
    sleep 100
    mem32 0x40023C14, 1
    # Write unlock command to flash opt register# AA - means unlock. # CC-Means full lock (do not use it, after this CPU is not accessible via JTag at all. After you put CC and wrong program - chip is garbage) # Other value - Read lock. JFlash put here FF to secure chip.
    w4 0x40023C14, 0x0FFFAAEE
    sleep 100

    # Next command can not execute, so it prints error. Wait approx. 20 seconds chip to erase.
    mem32 0x40023C14, 1

    sleep 22000
    # Now can read new opt register value and chip in unlocked
    mem32 0x40023C14, 1
    sleep 1000

    # Select second chip to unlock... IRLen 19, TAP 3
    config 19,3
    rx 10

    -- Repeat the procedure

    Thanks.
  • Hi,

    Can you please confirm that we understand you correct here and everything is working as expected so we consider this case as closed?


    Best regards
    Erik
    Please read the forum rules before posting.

    Keep in mind, this is *not* a support forum.
    Our engineers will try to answer your questions between their projects if possible but this can be delayed by longer periods of time.
    Should you be entitled to support you can contact us via our support system: segger.com/ticket/

    Or you can contact us via e-mail.
  • Hi,


    sorry for the delay in response. Currently, J-Flash does not support unlocking / locking of a device which is not the first or only device in the JTag chain.
    Lifting this limitation is planned, but without a fixed release date yet.

    Best regards,
    Niklas
    Please read the forum rules before posting.

    Keep in mind, this is *not* a support forum.
    Our engineers will try to answer your questions between their projects if possible but this can be delayed by longer periods of time.
    Should you be entitled to support you can contact us via our support system: segger.com/ticket/

    Or you can contact us via e-mail.