i am trying to back up the firmware of an STM32F030 sitting on a PCB being the operating panel a lawnmover robot as in https://openmower.de/ , a new model (SA900ECO) and later to flash it .
It worked with openocd like a charm to Backup an STM32F1X sitting on the lawnmovers's mainboard.
When starting my script
backup_firmware_panel.sh
openocd -f yardforce500_panel.cfg -c "init" -c "reset halt" -c " dump_image panel_controller_backup.bin 0x08000000 0x10000" -c "reset" -c shutdown
i get the following error:
Open On-Chip Debugger 0.10.0+dev-01145-g2dfc1ed7 (2023-06-24-13:09)
Licensed under GNU GPL v2
For bug reports, read
http://openocd.org/doc/doxygen/bugs.html
Info : only one transport option; autoselect 'swd'
Info : BCM2835 SPI SWD driver
Info : SWD only mode enabled
Info : clock speed 31200 kHz
Info : SWD DPIDR 0x0bb11477
Error: Could not find MEM-AP to control the core
Info : Listening on port 3333 for gdb connections
Error: Could not find MEM-AP to control the core
Error: Target not examined, reset NOT asserted!
A community member on discord pointed me into the direction of unlocking the RDP, i have also found this post:
STM32 Read-out protection via OpenOCD
My setup is a forked version of openocd that works with the bcm2835spi of a rasppberry pi. I have connected the relevant pins on the GPIO of the raspi with the same on the mainboard holding the chip. It has been tested succesfully by dumping the firmware of an STM32F1X, so the wiring should be OK.
My yardforce500_panel.cfg file looks as following:
#source [find interface/stlink.cfg]
interface bcm2835spi
source [find target/stm32f0x.cfg]
#transport select hla_swd
#reset_config srst_only srst_nogate
#program "firmware.bin" 0x08000000 verify reset; shutdown;
I have then opened a connection via openocd -f yardforce500_panel.cfg
Open On-Chip Debugger 0.10.0+dev-01145-g2dfc1ed7 (2023-06-24-13:09)
Licensed under GNU GPL v2
For bug reports, read
http://openocd.org/doc/doxygen/bugs.html
Info : only one transport option; autoselect 'swd'
Info : Listening on port 6666 for tcl connections
Info : Listening on port 4444 for telnet connections
Info : BCM2835 SPI SWD driver
Info : SWD only mode enabled
Info : clock speed 31200 kHz
Info : SWD DPIDR 0x0bb11477
Error: Could not find MEM-AP to control the core
Info : Listening on port 3333 for gdb connections
Then on another terminal i open a telnet session:
telnet 127.0.0.1 4444
In the telnet terminal i tried:
Trying 127.0.0.1...
Connected to 127.0.0.1.
Escape character is '^]'.
Open On-Chip Debugger
> init
> reset init
Could not find MEM-AP to control the core
Target not examined, reset NOT asserted!
> reset halt
Could not find MEM-AP to control the core
Target not examined, reset NOT asserted!
>
I have read some guides like https://blog.dbrgn.ch/2020/5/16/nrf52-unprotect-flash-jlink-openocd/, where someone changes a register value, but i do not have a clue how to execute it on the STM32F03x chip.
I have found the section in the reference manual for the Read Protection
i have also tried in the telnet terminal:
> flash list
{name stm32f1x base 134217728 size 0 bus_width 0 chip_width 0}
> flash banks
#0 : stm32f0x.flash (stm32f1x) at 0x08000000, size 0x00000000, buswidth 0, chipwidth 0
> stm32f0x unlock
stm32f1x unlock bank_id
> stm32f0x unlock 0x08000000
flash bank 134217728 does not exist
> stm32f0x unlock #0
Invalid command argument
bank_num option value ('#0') is not valid
>
> stm32f0x unlock 0
Target not examined yet
auto_probe failed
> stm32f1x unlock 0
Target not examined yet
auto_probe failed
But i lack the knowledge how to set this RDP byte ... and before i brick my chip, i wanted to ask :)
