1. RDP level management
The STM32U0 silicon device life cycle is based on the RDP mechanism implemented for the FLASH interface, as specified in the STM32U0 reference manual RM0503[1] (section: 3.5.1).
RDP protection level | Debug | Comments |
Level 0: Device open | Allowed | Boot address can be either user flash, bootloader in system memory or embedded SRAM depending on boot mode configuration. Any security configuration including OEM1 and OEM2 keys can be provisioned in flash user option bytes. |
Level 1: Device memories protected | Limited | Boot address can be either user flash, bootloader in system memory or embedded SRAM depending on boot mode configuration. Debug access to user FLASH memory, embedded SRAM and backup registers is not allowed. |
Level 2: Device closed | None | Boot address must target the user flash memory. Flash user option bytes are read-only, hence RDP level 2 cannot be changed, unless OEM2 unlocking key is activated. |
The level transition are illustrated on the figure below:
Changing the read protection level:
- from level 0 to level 1: write any other values than 0xCC or 0x AA in the RDP register
- from level 0 or level 1 to level 2: write 0xCC in the RDP register
- from level 2 to level 1: inject the OEM2KEY value through the debug interface under reset. This operation is relevant only if the OEM2 password lock activation has been previously done.
- from level 1 to level 0:
- if OEM1 password lock activation done: inject the OEM1KEY value through the debug interface under reset
- if OEM1 password lock activation not done: write 0xAA in the RDP register
2. RDP Password Regression
Regression allows reopening the product, by returning to RDP level 0.
A full flash user memory mass erase is applied prior to the reopening.
The devices support both permanent RDP level 2 or password-based RDP level 2 regression to level 1.
This level 2 to level 1 regression does not erase the application code, and it does not change the RDP level 1 protections in place.
The provisioning of two 128-bit passwords controls independently the unlocking of:
- RDP level 2 to RDP level 1 regression password configured when OEM2LOCK=1
- RDP level 1 to level 0 regression password configured when OEM1LOCK=1
The table below describes the possible combinations of mutual passwords usage:
OEM2LOCK | OEM1LOCK | |
0 |
1 | |
0 | RDP 1 to 0 always granted RDP 2 to 1 never granted |
RDP 1 to 0 needs OEM1KEY unlock sequence RDP 2 to 1 never granted |
1 | RDP 1 to 0 always granted RDP 2 to 1 needs OEM2KEY unlock sequence |
RDP 1 to 0 needs OEM1KEY unlock sequence RDP 2 to 1 needs OEM2KEY unlock sequence |