RDP regression from Level 1 to level 0

Akhil0812 · ‎2025-09-15

Hi teams,
CPU: STM32U0
Current RDP level: Level 1
OEM1 RDP lock: Enabled.
I had set the 128bit OEM1 key to the OEM key registers [FLASH_OEM1KEYWyR ]accordingly, and the written OEM1 key values was verified using their CRC values by reading OEM1KEYCRC register.
Now I am trying to make the regression from level 1 to level 0 according to the user manual description [section: 3.5.1 FLASH read protection (RDP)].

But the operation was failed using my source code. Which is attached below

#define STM32U0_DBGMCU_BASE 0x40015800 // Accessible to the software via the APB access port AP0
#define STM32U0_DBGMCU_DBG_AUTH_HOST (STM32U0_DBGMCU_BASE + 0x100) // Debug authentication mailbox host register

Could you please clarify the following doubts,
1. The unlock sequence says, debug access port 1 has to be used for programming the 128-bit OEM1 key in the DBGMCU_DBG_AUTH_HOST register,

but when I checked the DBGMCU_DBG_AUTH_HOST register base, it says

So, what is the base address for DBGMCU_DBG_AUTH_HOST register and which AP should be selected during OEM key write process.
2. After connecting the target from the following settings via STM32 Cube programmer. I have tried to change RDP level using secure programming page.

What could be the reason behind this?
3. If I select the AP to 1, target connection is not feasible and the following error prompt was occurred.

Right now the flash memory is not accessible, please let me know how can I recover from this issue.

Thanks
Akhil

Bubbles · ‎2025-09-16

Hi @Akhil0812,

I believe the problem is setting 'Mode: Normal'. Normal mode is indented for normal debugging. For regression, the connection mode should be 'Under reset'. This way the code is not executed and regression can proceed.

BR,

J

To give better visibility on the answered topics, please click on Accept as Solution on the reply which solved your issue or answered your question.

Akhil0812 · ‎2025-09-16

I had tried this method, but didn't work. In both cases, the error was same.

Bubbles · ‎2025-09-17

Did you try regression.bat (or regression.sh) from the Cube package?

To give better visibility on the answered topics, please click on Accept as Solution on the reply which solved your issue or answered your question.

Andrew Neil · ‎2025-09-17

@Akhil0812 wrote:
I had tried this method, but didn't work.

So why have you marked it as The Solution?

Instructions to un-mark it here.

A complex system that works is invariably found to have evolved from a simple system that worked.
A complex system designed from scratch never works and cannot be patched up to make it work.

Akhil0812 · ‎2025-09-17

It was clicked by accident; I appreciate the link. I have marked it as unsolved.

Akhil0812 · ‎2025-09-17

1. Yes, I had tried this, but it didn't work. Probably the reason is the OEM1 lock bit.
May I know, is there any way to execute the similar .bat file, which supports with user password?
Following was the result of the execution,

OPTION BYTE PROGRAMMING VERIFICATION:

Error: Expected value for Option Byte "rdp": 0xAA, found: 0xBB
Error: Option Byte Programming failed Or modified by application after OB_LAUNCH

2. And I have tried to make the RDP regression according to the steps mentioned in the UM2237 User manual,

and the result is as follows,
Upon connecting to the target, the RDP level was recorded as 0. Subsequently, when I attempted to modify the OB RDP level to 0xAA immediately after writing the OEM1 key, the following error was observed.

Lee42 · ‎2025-10-03

This is also not working for me either. I have also tried "under reset" as well. I have not found a solution yet.