RDP regression from Level 1 to level 0

[Akhil0812]

Hi teams,
CPU: STM32U0
Current RDP level: Level 1
OEM1 RDP lock: Enabled.
I had set the 128bit OEM1 key to the OEM key registers  [FLASH_OEM1KEYWyR ]accordingly, and the written OEM1 key values was verified using their CRC values by reading  OEM1KEYCRC register.
Now I am trying to make the regression from level 1 to level 0 according to the user manual description [section: 3.5.1 FLASH read protection (RDP)].

But the operation was failed using my source code. Which is attached below

#define STM32U0_DBGMCU_BASE 0x40015800 // Accessible to the software via the APB access port AP0
#define STM32U0_DBGMCU_DBG_AUTH_HOST (STM32U0_DBGMCU_BASE + 0x100) // Debug authentication mailbox host register

Could you please clarify the following doubts,
1. The unlock sequence says, debug access port 1 has to be used for programming the 128-bit OEM1 key in the DBGMCU_DBG_AUTH_HOST register,

but when I checked the  DBGMCU_DBG_AUTH_HOST register base, it says

So, what is the base address for DBGMCU_DBG_AUTH_HOST register and which AP should be selected during OEM key write process.
2. After connecting the target from the following settings via STM32 Cube programmer. I have tried to change RDP level using secure programming page.

What could be the reason behind this?
3. If I select the AP to 1, target connection is not feasible and the following error prompt was occurred.

Right now the flash memory is not accessible, please let me know how can I recover from this issue.

Thanks
Akhil

[Bubbles]

Hi @Akhil0812,

I believe the problem is setting 'Mode: Normal'. Normal mode is indented for normal debugging. For regression, the connection mode should be 'Under reset'. This way the code is not executed and regression can proceed.

BR,

J

[Akhil0812]

I had tried this method, but didn't work. In both cases, the error was same.

[Bubbles]

Did you try regression.bat (or regression.sh) from the Cube package?

[Andrew Neil]

---

@Akhil0812 wrote:

I had tried this method, but didn't work. 

---

So why have you marked it as The Solution?

Instructions to un-mark it here.

[Akhil0812]

It was clicked by accident; I appreciate the link. I have marked it as unsolved.

[Akhil0812]

1. Yes, I had tried this, but it didn't work. Probably the reason is the OEM1 lock bit.
May I know, is there any way to execute the similar .bat file, which supports with user password?
Following was the result of the execution,

OPTION BYTE PROGRAMMING VERIFICATION:

Error: Expected value for Option Byte "rdp": 0xAA, found: 0xBB
Error: Option Byte Programming failed Or modified by application after OB_LAUNCH

2. And I have tried to make the RDP regression according to the steps mentioned in the  UM2237 User manual,

and the result is as follows,
Upon connecting to the target, the RDP level was recorded as 0. Subsequently, when I attempted to modify the OB RDP level to 0xAA immediately after writing the OEM1 key, the following error was observed.

[Lee42]

This is also not working for me either. I have also tried "under reset" as well. I have not found a solution yet.

[Lee42]

This process does work using the STM32Cubeprogrammer when all 4 32bit password fields are set the same value example 0x12345678. Note after the Unlock RDP1 and then applying OPTSTRT. The target processor is Disconnect and reconnect with Access port 0. The RDP can then be set to AA. If the password fields have different value the regression fails. Is there issue with the STM32Cube Programmer RDP Level 1 Unlock RDP1 process.