cleanup flash protection on stm32wle5-based device (wio e5 mini/grove/devboard) with openocd

gistfile1.txt

# https://wiki.seeedstudio.com/LoRa-E5_STM32WLE5JC_Module/
# NOTE: seeedstudio AT firmware will be erased and there are no firmware binaries on the internet, so after described procedure module can be programmed only with custom LoRa/stm32 firmwares (!)

# press RESET on board (grove version should be reset with some kind of jumper wire between GND and RST pad on pcb bottom side)

# run openocd
openocd.exe -f interface/stlink.cfg -f target/stm32wlx.cfg

# in new session run telnet
telnet 127.0.0.1 4444

# following commands are entered into telnet:

# reset device
reset halt

# https://www.st.com/resource/en/reference_manual/rm0461-stm32wlex-advanced-armbased-32bit-mcus-with-subghz-radio-solution-stmicroelectronics.pdf
# check FLASH_OPTR register, on WioE5 based boards it has RDP=0xbb in lower byte (protection level 1)
mdw 0x58004020

# Clear flash memory LOCK in FLASH_CR with key sequence
mww 0x58004008 0x45670123
mww 0x58004008 0xCDEF89AB

# Clear option byte lock OPTLOCK in FLASH_CR with key sequence
mww 0x5800400c 0x08192A3B
mww 0x5800400c 0x4C5D6E7F

# read lock bits in FLASH_CR (should be 0)
mdw 0x58004014

# validate FLASH_SR (should be 0)
# 0x00010000 - FLASH_SR_BSY
# 0x00080000 - FLASH_SR_PESD
mdw 0x58004010

# write the desired options value (.....AA, protection level 0) in the options registers. set bytes 0xAA, clear bytes 0x55
mmw 0x58004020 0xAA 0x55

# start write: FLASH->CR |= FLASH_CR_OPTSTRT
mmw 0x58004014 0x00020000 0x0

# wait until finish, should be 0 (FLASH_SR_BSY is 0)
mdw 0x58004010

# reload register, set OBL_LAUNCH bit, device will be reset
mmw 0x58004014 0x08000000 0x0

# reset
reset halt

# check FLASH_OPTR, should end with aa (protection level 0)
mdw 0x58004020

# you can flash new firmware

# NOTE: after first firmware flashing on "clean" device you should check if memory address 0x00000000 (interrupt vectors) is mapped to user flash (0x08000000) and not system flash (0x1FFF0000).
# when device boots with empty user, it sets FLASH_ACR->EMPTY bit and remaps default boot code to system bootloader

# SYSCFG 0x4001000+0x000
mdw 0x40010000
; => 0 - user flash
; => 1 -> system flash

# FLASH_ACR 0x58004000+0x000
#  Bit16 -> EMPTY 
mdw 0x58004000
; 0x58004000: 00010600 user memory detected as empty
; 0x58004000: 00000600 user memory detected as non-empty

# to force reload empty flag - power cycle the device
# also, it should be possible to reload empty flag by forcing "option byte reset": 
# FLASH_CR |= FLASH_CR_OBL_LAUNCH
# FLASH_CR 0x58004000 + 0x014
mmw 0x58004014 0x08000000 0x0
; but it doesn't help in my case, possible due to non-changed option byte (FLASH_OPTR)