[SOLVED] Bricking STM32F4 after failed programming

  • [SOLVED] Bricking STM32F4 after failed programming

    Hi,

    I was trying to program a STM32F411CE which was in LPM (Standby) perhaps I should have power cycled it first. Anyways, it seems to have been left in a partially erased state and I cannot recover it. Any ideas to recover and reprogram ?

    Thanks

    Source Code

    1. Firmware: J-Link V9 compiled Oct 9 2015 20:34:47
    2. Hardware: V9.30
    5. PC = FFFFFFFE, CycleCnt = 00000008
    6. R0 = 00000000, R1 = 00000000, R2 = 00000000, R3 = 00000000
    7. R4 = 00000000, R5 = 00000000, R6 = 00000000, R7 = 00000000
    8. R8 = 00000000, R9 = 00000000, R10= 00000000, R11= 00000000
    9. R12= 00000000
    10. SP(R13)= FFFFFFD8, MSP= FFFFFFD8, PSP= 00000000, R14(LR) = FFFFFFF9
    11. XPSR = 01000003: APSR = nzcvq, EPSR = 01000000, IPSR = 003 (HardFault)
    12. CFBP = 00000000, CONTROL = 00, FAULTMASK = 00, BASEPRI = 00, PRIMASK = 00
    13. FPU regs: FPU not enabled / not implemented on connected CPU.
    15. Reset delay: 0 ms
    16. Reset type NORMAL: Resets core & peripherals via SYSRESETREQ & VECTRESET bit.
    18. Erasing device (STM32F411CE)...
    20. ****** Error: Failed to erase sectors 0 @ address 0x08000000 (erase error)
    21. Info: J-Link: Flash download: Total time needed: 0.057s (Prepare: 0.051s, Compare: 0.000s, Erase: 0.001s, Program: 0.000s, Verify: 0.000s, Restore: 0.004s)
    22. ERROR: Erase returned with error code -5.
    24. Downloading file [test.bin]...Info: J-Link: Flash download: Restarting flash programming due to program error (possibly skipped erasure of half-way erased sector).
    25. Info: J-Link: Flash download: Skip optimizations disabled for second try.
    26. Error while programming flash: Programming failed.
    Display All

  • Hi,


    could you start J-Link Commander (jlink.exe) , then enter the command "device STM32F411CE" and provide us with the output of J-Link Commander?


    Best regards,
    Niklas
    Please read the forum rules before posting.

    Keep in mind, this is *not* a support forum.
    Our engineers will try to answer your questions between their projects if possible but this can be delayed by longer periods of time.
    Should you be entitled to support you can contact us via our support system: segger.com/ticket/
    Or you can contact us via e-mail.

  • Hi Niklas,

    Here's the output

    Source Code

    1. $ JLinkExe -device STM32F411CE -speed 4000 -if swd
    2. SEGGER J-Link Commander V5.03e ('?' for help)
    3. Compiled Oct 22 2015 17:39:42
    4. Info: Device "STM32F411CE" selected.
    5. DLL version V5.03e, compiled Oct 22 2015 17:39:38
    6. Firmware: J-Link V9 compiled Oct 9 2015 20:34:47
    7. Hardware: V9.30
    8. S/N: 269304499
    9. OEM: SEGGER-EDU
    10. Feature(s): FlashBP, GDB
    11. Emulator has Trace capability
    12. VTarget = 3.285V
    13. Info: Found SWD-DP with ID 0x2BA01477
    14. Info: Found SWD-DP with ID 0x2BA01477
    15. Info: Found Cortex-M4 r0p1, Little endian.
    16. Info: FPUnit: 6 code (BP) slots and 2 literal slots
    17. Info: CoreSight components:
    18. Info: ROMTbl 0 @ E00FF000
    19. Info: ROMTbl 0 [0]: FFF0F000, CID: B105E00D, PID: 000BB00C SCS
    20. Info: ROMTbl 0 [1]: FFF02000, CID: B105E00D, PID: 003BB002 DWT
    21. Info: ROMTbl 0 [2]: FFF03000, CID: B105E00D, PID: 002BB003 FPB
    22. Info: ROMTbl 0 [3]: FFF01000, CID: B105E00D, PID: 003BB001 ITM
    23. Info: ROMTbl 0 [4]: FFF41000, CID: B105900D, PID: 000BB9A1 TPIU
    24. Info: ROMTbl 0 [5]: FFF42000, CID: B105900D, PID: 000BB925 ETM
    25. Cortex-M4 identified.
    26. Target interface speed: 4000 kHz
    27. J-Link>r
    28. Reset delay: 0 ms
    29. Reset type NORMAL: Resets core & peripherals via SYSRESETREQ & VECTRESET bit.
    30. J-Link>h
    31. PC = FFFFFFFE, CycleCnt = 00000000
    32. R0 = 00000000, R1 = 00000000, R2 = 00000000, R3 = 00000000
    33. R4 = 00000000, R5 = 00000000, R6 = 00000000, R7 = 00000000
    34. R8 = 00000000, R9 = 00000000, R10= 00000000, R11= 00000000
    35. R12= 00000000
    36. SP(R13)= FFFFFFFC, MSP= FFFFFFFC, PSP= 00000000, R14(LR) = FFFFFFFF
    37. XPSR = 01000000: APSR = nzcvq, EPSR = 01000000, IPSR = 000 (NoException)
    38. CFBP = 00000000, CONTROL = 00, FAULTMASK = 00, BASEPRI = 00, PRIMASK = 00
    39. FPU regs: FPU not enabled / not implemented on connected CPU.
    Display All

  • Hi,

    sorry for the delay in response.
    The J-Link output seems good. Connection to the target device was successful.


    You could give the STM32 unlock utility (JLinkSTM32.exe) a try.
    If this does not succeed, could you provide us with a J-Link Log file of a session containing an attempt to erase the device?

    Log output can be enabled like as follows:

    Open a connection to J-Link, e.g start J-Link Commander
    (Click the J-Link symbol located in the notification / tray area in order to open J-Link Control panel)
    Open the tab "Settings"
    Next to the field "Log file" check "Override" and click "..." in order to choose a log file path.

    This is also described in UM8001 Chapter 5 "Working with J-Link and J-Trace", Section 5.7 "J-Link control panel.


    Best regards,
    Niklas
    Please read the forum rules before posting.

    Keep in mind, this is *not* a support forum.
    Our engineers will try to answer your questions between their projects if possible but this can be delayed by longer periods of time.
    Should you be entitled to support you can contact us via our support system: segger.com/ticket/
    Or you can contact us via e-mail.

  • Hi Niklas,

    Tried no luck, attaching logs

    Unlock:

    Source Code

    1. Options:
    2. [0] Exit
    3. [1] STM32F0xxxx
    4. [2] STM32F1xxxx
    5. [3] STM32F2xxxx
    6. [4] STM32F3xxxx
    7. [5] STM32F4xxxx
    8. [6] STM32L1xxxx
    9. Please select the correct device family: 5
    10. Connecting to J-Link via USB...O.K.
    11. Powering target via J-Link.
    12. Using SWD as target interface.
    13. Target interface speed: 1000 kHz.
    14. VTarget = 3.258V
    15. Reset target...O.K.
    16. Reset option bytes (may take app. 20 seconds)...O.K.
    17. Press any key to exit.
    Display All


    Erase:

    Brainfuck Source Code

    1. T7D8D6700 005:243 SEGGER J-Link V5.02j Log File (0000ms, 0395ms total)
    2. T7D8D6700 005:243 DLL Compiled: Nov 6 2015 18:58:14 (0000ms, 0395ms total)
    3. T7D8D6700 005:243 Logging started @ 2015-11-13 20:25 (0001ms, 0396ms total)
    4. T7D8D6700 006:415 JLINK_SetResetDelay(0) (0001ms, 0397ms total)
    5. T7D8D6700 006:416 JLINK_Reset() -- CPU is running -- CPU_WriteMem(4 bytes @ 0xE000EDF0) -- CPU is running -- CPU_WriteMem(4 bytes @ 0xE000EDFC) >0x35 TIF> -- CPU is running -- CPU_WriteMem(4 bytes @ 0xE000ED0C) -- CPU is running -- CPU_ReadMem(4 bytes @ 0xE000EDF0) -- CPU is running -- CPU_ReadMem(4 bytes @ 0xE000EDF0) -- CPU is running -- CPU_WriteMem(4 bytes @ 0xE000EDF0) -- CPU is running -- CPU_WriteMem(4 bytes @ 0xE000EDFC) -- CPU is running -- CPU_ReadMem(4 bytes @ 0xE000EDF0)
    6. -- CPU_WriteMem(4 bytes @ 0xE0002000) -- CPU_ReadMem(4 bytes @ 0xE000EDFC) -- CPU_ReadMem(4 bytes @ 0xE0001000) (0096ms, 0493ms total)
    7. T7D8D6700 008:339 JLINK_Halt() returns 0x00 (0004ms, 0497ms total)
    8. T7D8D6700 008:343 JLINK_GetDeviceFamily() returns 14 (0000ms, 0497ms total)
    9. T7D8D6700 008:343 JLINK_ReadRegs(NumRegs = 28, Indexes: 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 17, 18, 14, 15, 16, 21, 22, 23, 20, 27, 26, 25, 24, 65) -- R0=0x00, R1=0x00, R2=0x00, R3=0x00, R4=0x00, R5=0x00, R6=0x00, R7=0x00, R8=0x00, R9=0x00, R10=0x00, R11=0x00, R12=0x00, R13 (SP)=0xFFFFFFFC, MSP=0xFFFFFFFC, PSP=0x00, R14=0xFFFFFFFF, R15 (PC)=0xFFFFFFFE, XPSR=0x1000000, APSR=0x00, EPSR=0x1000000, IPSR=0x00, CFBP=0x00, CONTROL=0x00, FAULTMASK=0x00, BASEPRI=0x00, PRIMASK=0x00, CycleCnt=0x00
    10. returns 0x00 (0000ms, 0497ms total)
    11. T7D8D6700 008:343 JLINK_ReadMemU32(0xE000ED88, 0x0001 Items, ...) -- CPU_ReadMem(4 bytes @ 0xE000ED88) - Data: 00 00 00 00 returns 0x01 (0003ms, 0500ms total)
    12. T7D8D6700 010:655 JLINK_IsHalted() returns TRUE (0004ms, 0504ms total)
    13. T7D8D6700 010:659 JLINK_EraseChip() -- -------------------------------------- -- Start of determining dirty areas -- End of determining dirty areas -- Start of preparing flash programming -- Calculating RAM usage -- RAM usage = 10020 Bytes -- Preserving CPU registers -- Preparing memory -- Determining CPU clock frequency -- CPU clock frequency: 15882 kHz -- CPU frequency = 15882 kHz -- Preparing target -- Downloading RAMCode -- Checking target RAM -- Preparing RAMCode
    14. -- End of preparing flash programming -- CPU is running at 72000 kHz. -- Start of erasing sectors -- Erasing range 0x08000000 - 0x08007FFF (002 Sectors, 32 KB) -- Erasing range 0x08008000 - 0x0800FFFF (002 Sectors, 32 KB) -- Erasing range 0x08010000 - 0x0801FFFF (001 Sector, 64 KB)
    15. ***** Error: Failed to erase sectors 0 @ address 0x08000000 (erase error) -- End of erasing sectors -- Start of restoring -- Restore RAMCode -- Restore content of target memory -- Restore target -- Restore memory
    16. -- Restoring CPU registers -- End of restoring -- Total time needed: 0.736s (Prepare: 0.628s, Compare: 0.000s, Erase: 0.021s, Program: 0.000s, Verify: 0.000s, Restore: 0.087s) returns -5 (0736ms, 1236ms total)
    17. T7D8D6700 012:746 JLINK_SetResetDelay(0) (0001ms, 1237ms total)
    18. T7D8D6700 012:747 JLINK_Reset() -- CPU_WriteMem(4 bytes @ 0xE000EDF0) -- CPU_WriteMem(4 bytes @ 0xE000EDFC) >0x35 TIF> -- CPU_WriteMem(4 bytes @ 0xE000ED0C) -- CPU_ReadMem(4 bytes @ 0xE000EDF0) -- CPU_ReadMem(4 bytes @ 0xE000EDF0) -- CPU_WriteMem(4 bytes @ 0xE000EDF0) -- CPU_WriteMem(4 bytes @ 0xE000EDFC) -- CPU is running -- CPU_ReadMem(4 bytes @ 0xE000EDF0) -- CPU_WriteMem(4 bytes @ 0xE0002000) -- CPU_ReadMem(4 bytes @ 0xE000EDFC) -- CPU_ReadMem(4 bytes @ 0xE0001000) (0096ms, 1333ms total)
    19. T7D8D6700 013:551 JLINK_Close() -- CPU_ReadMem(4 bytes @ 0xE0001000) -- CPU_WriteMem(4 bytes @ 0xE0001004) >0x42 TIF> >0x28 TIF> >0x0D TIF> >0x21 TIF> (0017ms, 1350ms total)
    20. T7D8D6700 013:551 (0017ms, 1350ms total)
    21. T7D8D6700 013:551 Closed (0017ms, 1350ms total)
    Display All

  • Hi,


    Can you type mem 0x8000000, 0x800 in J-Link Commander to check whether the first sector is erased or not?

    My assumption is: It is not and the write protection bit is set.
    In this case I need to ask you to check the UM of your target device and to figure out the address of the write protection bit of the first sector.
    Once you have it, you can read it using J-Link Commander in order to confirm this assumption.

    Best regards,
    Niklas
    Please read the forum rules before posting.

    Keep in mind, this is *not* a support forum.
    Our engineers will try to answer your questions between their projects if possible but this can be delayed by longer periods of time.
    Should you be entitled to support you can contact us via our support system: segger.com/ticket/
    Or you can contact us via e-mail.

  • Hi Niklas,

    The first sector appears to be erased, but unlock does not reset the option bytes.

    Source Code

    1. J-Link>mem 0x8000000, 0x800
    2. 08000000 = FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
    3. 08000010 = FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
    4. 08000020 = FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
    5. 08000030 = FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
    6. 08000040 = FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
    7. 08000050 = FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
    8. 08000060 = FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
    9. 08000070 = FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
    10. 08000080 = FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
    11. 08000090 = FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
    12. <snip>
    Display All


    Source Code

    1. J-Link>mem 0x1fffc000, 8
    2. 1FFFC000 = EF AA 10 55 EF AA 10 55
    3. J-Link>mem 0x1fffc008, 8
    4. 1FFFC008 = FF BF 00 40 FF BF 00 40 <--- nWRPi


    That seems weird, the unlock tool itself reports everything worked -- it does return immediately and not like the 20s it claims it may take, but that might be due to mass erase being skipped on already erased sectors.

  • Hi,

    sorry for the delay in response.
    the unlock utility does not necessary touch the write protection bits.

    Did you try to unlock the write protection bits manually?


    Best regards,
    Niklas
    Please read the forum rules before posting.

    Keep in mind, this is *not* a support forum.
    Our engineers will try to answer your questions between their projects if possible but this can be delayed by longer periods of time.
    Should you be entitled to support you can contact us via our support system: segger.com/ticket/
    Or you can contact us via e-mail.

  • Hi,

    I am curious:
    What did try in order to revert the write protection with J-Link?
    Do I understand correctly, that this failed with J-Link but succeed using a ST-Link?
    Or did you use an utility provided by ST in order to revert the write protection bits?

    The JLinkSTM32 utility executes a chip erase in order to unlock a device. (STM32 devices only). This does not influence the write protection bits.


    Best regards,
    Niklas
    Please read the forum rules before posting.

    Keep in mind, this is *not* a support forum.
    Our engineers will try to answer your questions between their projects if possible but this can be delayed by longer periods of time.
    Should you be entitled to support you can contact us via our support system: segger.com/ticket/
    Or you can contact us via e-mail.

  • > I am curious: What did try in order to revert the write protection with J-Link?

    I followed the instructions in the STM32F4 flash programming manual, Section 1.6.2: Programming user option bytes. Perhaps I did something incorrect there, I don't have the logs unfortunately.

    > Or did you use an utility provided by ST in order to revert the write protection bits?

    Yes, I used a ST-Link v2 and the ST-Link software to revert the write protection bits.

  • Hi,

    I followed the instructions in the STM32F4 flash programming manual, Section 1.6.2: Programming user option bytes.


    Following the steps given in 1.6.1 in order to write to the Flash option control register (FLASH_OPTCR, described in 1.8.6) should do / have done the trick, correct.

    Best regards,
    Niklas
    Please read the forum rules before posting.

    Keep in mind, this is *not* a support forum.
    Our engineers will try to answer your questions between their projects if possible but this can be delayed by longer periods of time.
    Should you be entitled to support you can contact us via our support system: segger.com/ticket/
    Or you can contact us via e-mail.