STM32 gotchas
74.Write Protection (WRP) granularity may be non-uniform (in large-FLASH 'F1/'F0/'F3)

Write Protection (WRP) of FLASH is a feature, which prevents accidental overwrite of portions of FLASH from both program running in mcu, and external programmer. It is useful for example to protect a bootloader from being inadvertently corrupted, resulting in the device controlled by the mcu to be "bricked" from the user point of view.

The various STM32 families approach this problem in different ways, but WRP always works on portions (sectors, pages - terminology varies across families) of FLASH, each portion being several kilobytes large - this is called WRP granularity. Whether some FLASH portion is write protected or not, is controlled by Option Bytes dedicated to WRP.

Granularity of WRP in the historically first 'F11 family is 4kB (4 pages in lower-end 'F1 and 2 pages in higher-end 'F1, but the pages' size is different so that it always results in 4kB WRP granularity). Each "granule" is write protected, if the corresponding bit in the WRP Option Bytes is programmed (= cleared, as is the usual confusion with the Option Bytes). However, the largest-FLASH 'F1 have 256kB and 512kB FLASH, which would mean 64/128 WRP "granules", while there are only 4 WRP Option Bytes i.e. 32 bits; so how does this work?

Easily: in these 'F1, the first 31 option bits write protect the first 31 WRP "granules", i.e. the first 124kB in 4kB granularity; and the 32th option bit simply write protects whatever portion of FLASH is left (i.e. size of the last "granule" is 132kB/388kB).

This same scheme is used also in 'F0 and 'F3. While their respective Reference Manual do describe this at the description of the WRP Option Bytes, they fail to mention it in the dedicated Write protection subchapter of the Embedded Flash memory chapter, leaving the reader confused.

In 'L1, there are truly uniform WRP "granules", at the cost of implementing up to 16 WRP bytes (i.e. 4 WRP words, 128 bits).

The 'F2/'F4/'F7 families use a different scheme, where WRP copies the non-uniform erase sectors. As these sectors are mostly large (up to 128kB), there are fewer than 32 of them even in the largest-FLASH models.

The FLASH in 'L0 is different from all other models (maybe consequence of the effort to implement true EEPROM as a portion of it). Its WRP is an alternative option to the more complex PCROP protection, with uniform granularity and 48 related option bits.

In 'L4, again a different scheme was introduced: instead of bit-mapping WRP "granules", two areas (consisting of an integer number of "granules") can be selected for write protection using two pairs of "boundary" registers within the Option bytes. This scheme is used also on 'G0 and 'G4.


1. Contrary to other families where descripiton of FLASH is part of the Reference Manual, 'F1 has the FLASH and its features described in a separate document, Programming Manual PM0075. In this family, confusingly, write protection of first few pages of FLASH is also switched on, whenever Readout Protection is switched on.
However, there's an exception to this exception, too: the largest-FLASH STM32F103xF/xG (>=512kB FLASH), aka XL-density, are described in PM0068, and they don't have this quirk.