32F417 and RDP2: OTP (512 bytes) and SRAM execution

[PHolt.1]

This

suggests that one cannot execute code from SRAM. Is that really correct?

Also there is ambiguity on whether the OTP area (512 bytes plus the control block) is readable in RDP2. Why say "512 bytes" and not just all-OTP?

The OTP area must remain usable under RDP2 and readable by internal code, but not accessible externally (with a debugger).

Above is from

https://www.st.com/resource/en/application_note/an5156-introduction-to-security-for-stm32-mcus-stmicroelectronics.pdf

[TDK]

> Is the code for programming the OTP identical to programming the CPU FLASH?

I believe so. Just with the caveat that it can never be erased, and the addition of the lock byte functionality. If you want to modify less than 32 bits, you can set the other bits to 1 and they won't change as programming flash can only change a bit from 1 -> 0.

[PHolt.1]

My reading of the RM text is that you can write the OTP area as much as you like (IOW it is identical to other CPU FLASH) and it becomes non-writable only when the lock byte(s) get set.

But you cannot - even before the locks are set - erase any of it i.e. apply an erase command. Once a bit is 0 you cannot make it 1.

The code I posted above does not do any erase because I am using the block erase (block being 16k to 128k acocrding to where) beforehand.