STM32G4 – trying to understand readout protection

[EThom.3]

I am trying to understand the readout protection functionality in the STM32G4 series. When I read the G4 series manual, I get the impression that level 1 protection will protect the flash, option bytes, CCM SRAM and RTC backup registers from JTAG / SWD readout – but curiously not the regular SRAM.

Have I understood this correctly?

Furthermore, I understand that level 2 will protect the entire chip – but that this is irreversible. So, if I do that to a chip, I can never again use that one for debugging. Not even after a full chip erase, which I’m not even certain that I can perform. As a developer, I see this as pretty much bricking the board.

If I am correct that RDP level 1 will not protect the regular SRAM from readout via JTAG or SWD, are there other ways to protect it from JTAG / SRAM probing?

[Frantz LEFRERE]

Hello ​@EThom.3 
you understanding is correct.

https://www.st.com/resource/en/application_note/an4758-proprietary-code-readout-protection-on-stm32l4-stm32l4-stm32g4-and-stm32wb-series-mcus-stmicroelectronics.pdf

The read-out protection applies to:
• main Flash memory
• backup registers in the RTC (real-time clock)
• CCM-SRAM (STM32G4)
• option bytes (Level 2 only).

From security point of view, RDP2 should be used on product on the field.
As you stated no way to reopen the debugging ling in RDP2, but this doesn’t prevent firmware update from the embedded firmware.

 

[EThom.3]

Okay, thanks.

As I am unwilling to use level 2 (bricking a board due to a failed firmware update is completely unacceptable), I guess I’ll settle for level 1, and use CCM SRAM for the more secret stuff.