OEM1KEY unlock sequence STM32U575

[Pawel250]

Hi,
I am working on regression from RDP1 to RDP0 with OEM1KEY but made from inside and not by external debugger.
I want  device to be able to make self unlocking.
As I read in documentation RM0456, OEM1KEY unlock sequence requires:
Shift OEM1KEY[31:0] then OEM1KEY[63:32] through JTAG or SWD in the
DBGMCU_DBG_AUTH_HOST.

Questions:
1. Is it possible to do OEM1KEY unlock sequence (write DBGMCU_DBG_AUTH_HOST register) from firmware code ?
2. Lets assume simpler scenario. OEM1KEY has been never programmed. Does it possible to do regression RDP1->RDP0 from internal Firmware ? I've got stuck on SET_BIT(FLASH->NSCR, FLASH_NSCR_OPTSTRT) and I had to make manual POR and manually change RDP level using debugger. Flash probably was erased.

I've read the topic
Solved: How to process RDP regression from appplication co... - STMicroelectronics Community
but this topic doesnt answer on given questions!!! Movie on youtube also doesnt give the answers.

Please explain it in details.
Thanks

[Jocelyn RICARD · Accepted solution]

Hello @Pawel250 ,

It is not possible to perform the RDP regression from embedded firmware if OEM1KEY was provisioned.

It can only be performed using JTAG/SWD.

If OEM1KEY was already programmed, you can "disable" this key by writing FFs in the key.

If OEM1KEY is not active, then regression from embedded firmware is possible.

You need to unlock flash and option byte before doing it

Best regards

Jocelyn

[Pawel250]

Hi @Jocelyn RICARD 
Thanks for reply and very good clarification all of my though about OEM1KEY.

Best Regards
Pawel.