Step 1 - Provision OEM1KEY

Provision OEM1KEY (0x11ABCDEF 0x12ABCDEF) in order to lock RDP level 1 to level 0 regression. Use the following command line:

> STM32_Programmer_CLI.exe -c port=swd mode=hotplug -lockrdp1 0x11ABCDEF 0x12ABCDEF
Device name : STM32U575/STM32U585
Flash size  : 2 MBytes
Device type : MCU
Device CPU  : Cortex-M33
BL Version  : 0x30
Debug in Low Power mode enabled
Lock RDP1 password successfully done

Step 2 - Provision OEM2KEY

Provision OEM2KEY (0x21ABCDEF 0x22ABCDEF) in order to authorize RDP level 2 to level 1 regression, or to lock RDP level 1 to level 0.5 regression. Use the following command line:

> STM32_Programmer_CLI.exe -c port=swd mode=hotplug -lockrdp2 0x21ABCDEF 0x22ABCDEF
Device name : STM32U575/STM32U585
Flash size  : 2 MBytes
Device type : MCU
Device CPU  : Cortex-M33
BL Version  : 0x20
Debug in Low Power mode enabled
Lock RDP2 password successfully done

Step 3 - Check if OEMxKEYs are provisioned

Check that OEM2LOCK and OEM1LOCK bits in the FLASH_NSSR register are set to be sure that OEM1KEY/OEM2KEY are provisioned and locked . Use the following command line:

> STM32_Programmer_CLI.exe -c port=swd mode=hotplug -r32 0x40022020 4
Reading 32-bit memory content
  Size          : 4 Bytes
  Address:      : 0x40022020

0x40022020 : 000C0000   --> FLASH_NSSR[19:18]=11

Using the GUI check the memory content at address 0x40022020 or the FLASH_NSSR register.

Step4 - Set option byte TZEN = 1

Program the TZEN option byte using the following command to enable the TrustZone.

>STM32_Programmer_CLI.exe -c port=swd mode=hotplug -ob TZEN=1

UPLOADING OPTION BYTES DATA ...
  Bank          : 0x00
  Address       : 0x50022040
  Size          : 32 Bytes
████████████████████████████████████████████████ 100%
  Bank          : 0x01
  Address       : 0x50022060
  Size          : 8 Bytes
████████████████████████████████████████████████ 100%
  Bank          : 0x02
  Address       : 0x50022068
  Size          : 8 Bytes
████████████████████████████████████████████████ 100%
OPTION BYTE PROGRAMMING VERIFICATION:
Option Bytes successfully programmed

Step 5 - Set RDP level 2

Rise RDP to level 2 by setting the option bytes (-ob rdp=0xCC) with the following command:

>STM32_Programmer_CLI.exe -c port=swd mode=hotplug -ob rdp=0xCC


UPLOADING OPTION BYTES DATA ...
  Bank          : 0x00
  Address       : 0x50022040
  Size          : 32 Bytes
████████████████████████████████████████████████ 100%
  Bank          : 0x01
  Address       : 0x50022060
  Size          : 8 Bytes
████████████████████████████████████████████████ 100%
  Bank          : 0x02
  Address       : 0x50022068
  Size          : 8 Bytes
████████████████████████████████████████████████ 100%
PROGRAMMING OPTION BYTES AREA ...
  Bank          : 0x00
  Address       : 0x50022040
  Size          : 32 Bytes
▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒
Reconnecting...
Error: failed to reconnect after reset !
UPLOADING OPTION BYTES DATA ...
  Bank          : 0x00
  Address       : 0x40022040
  Size          : 32 Bytes
▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒
Error: Uploading Option Bytes bank: 0 failed
Error: Reloading Option Bytes Data failed  --> Not possible to reconnect as RDP2

Step 6 - Unlock RDP level 2 with OEM2Key

Provide OEM2KEY to authorize the transition from RDP level 2 to the RDP level 1.

Note:

The under-reset mode (UR) is recommended.

Use the following command:

>STM32_Programmer_CLI.exe -c port=swd mode=UR -unlockrdp2 0x21ABCDEF 0x22ABCDEF
      -------------------------------------------------------------------
                       STM32CubeProgrammer v2.8.0
      -------------------------------------------------------------------
ST-LINK SN  : 0028003D3038510234333935
ST-LINK FW  : V3J8M3
Board       : NUCLEO-U575ZE
Voltage     : 3.31V
Unlock RDP2 password succefully done!
Error: Cannot connect to access port 0
If you are trying to connect to a device with TrustZone enabled please try to connect with HotPlug mode

If some issues occur:

Check that the system boots from the RSS and that PH3-BOOT0 PIN of the board is connected to VDD.

Check that DBGMCU is accessible on RDP level 2 (DBGMCU_CR @0xE0044000) with the following command:

>STM32_Programmer_CLI.exe -c port=swd mode=hotplug -r32 0xE0044104 4
Reconnected with the recommended frequency (3300 kHz)!
Device name : STM32U575/STM32U585
Flash size  : 2 MBytes
Device type : MCU
Device CPU  : Cortex-M33
BL Version  : 0x20
Debug in Low Power mode enabled
Reading 32-bit memory content
  Size          : 4 Bytes
  Address:      : 0xE0044104

0xE0044104 : 292D8E4A

If DBGMCU is not accessible, it means that OEM2KEY was not provisioned.

Step 7 - Set RDP to level 1

Launch the RDP level 2 to level 1 regression (unlocked by OEM2KEY in Step 6) with the following command:

> STM32_Programmer_CLI.exe -c port=swd mode=hotplug -ob rdp=0xDC
….
UPLOADING OPTION BYTES DATA ...
  Bank          : 0x00
  Address       : 0x40022040
  Size          : 32 Bytes
████████████████████████████████████████████████ 100%
  Bank          : 0x01
  Address       : 0x40022060
  Size          : 8 Bytes
████████████████████████████████████████████████ 100%
  Bank          : 0x02
  Address       : 0x40022068
  Size          : 8 Bytes
████████████████████████████████████████████████ 100%
OPTION BYTE PROGRAMMING VERIFICATION:
Option Bytes successfully programmed

Step 8 - Unlock RDP level 1 with OEM2 key

OEM2KEY is provisioned to authorize RDP level 2 to RDP level 1, and RDP level 1 to RDP level 0.5 regressions. For the second one, the RDP level 1 must be unlocked with OEM2KEY (0x21ABCDEF 0x22ABCDEF), using the following command:

> STM32_Programmer_CLI.exe -c port=swd mode=hotplug -unlockrdp1 0x21ABCDEF 0x22ABCDEF
      -------------------------------------------------------------------
                       STM32CubeProgrammer v2.8.0
      -------------------------------------------------------------------
ST-LINK SN  : 0028003D3038510234333935
ST-LINK FW  : V3J8M3
Board       : NUCLEO-U575ZE
Voltage     : 3.31V
SWD freq    : 24000 KHz
Connect mode: Hot Plug
Reset mode  : Software reset
Device ID   : 0x482
Revision ID : Rev B
Reconnecting with the recommended frequency (1000 kHz)!
…
Reconnected with the recommended frequency (3300 kHz)!
Device name : STM32U575/STM32U585
Flash size  : 2 MBytes
Device type : MCU
Device CPU  : Cortex-M33
BL Version  : 0x90
Debug in Low Power mode enabled

Unlock RDP1 password successfully done

Step 9 - Set RDP level 0.5

Launch the RDP level 1 to level 0.5 regression (unlocked by OEM2KEY in Step 8) with the following command:

>STM32_Programmer_CLI.exe -c port=swd mode=hotplug -ob rdp=0x55
….
UPLOADING OPTION BYTES DATA ...
  Bank          : 0x00
  Address       : 0x40022040
  Size          : 32 Bytes
████████████████████████████████████████████████ 100%
  Bank          : 0x01
  Address       : 0x40022068
  Size          : 8 Bytes
████████████████████████████████████████████████ 100%
OPTION BYTE PROGRAMMING VERIFICATION:
Option Bytes successfully programmed

Step 10 - Raise RDP from level 0.5 to level 1

Raise RDP to level 1 to be able to reach RDP level 0 in next step (no RDP level 0.5 to level 0 authorized), with the following command:

> STM32_Programmer_CLI.exe -c port=swd mode=hotplug -ob rdp=0xDC
….
UPLOADING OPTION BYTES DATA ...
  Bank          : 0x00
  Address       : 0x40022040
  Size          : 32 Bytes
████████████████████████████████████████████████ 100%
  Bank          : 0x01
  Address       : 0x40022068
  Size          : 8 Bytes
████████████████████████████████████████████████ 100%
OPTION BYTE PROGRAMMING VERIFICATION:
Option Bytes successfully programmed

Step 11 - Unlock RDP level 1 with OEM1Key

The correct OEM1KEY must be provided, otherwise no regression is possible. The following command unlocks the RDP level 1:

> STM32_Programmer_CLI.exe -c port=swd mode=hotplug -unlockrdp1 0x11ABCDEF 0x12ABCDEF
…
Reconnected with the recommended frequency (3300 kHz)!
Device name : STM32U575/STM32U585
Flash size  : 2 MBytes
Device type : MCU
Device CPU  : Cortex-M33
BL Version  : 0xf0
Debug in Low Power mode enabled

Unlock RDP1 password successfully done

Step 12 - Set RDP level 0 and reset TZEN = 0

When TrustZone is enabled, the deactivation of TZEN option byte must be done simultaneously with RDP level 1 to level 0 regression. Use the following commands:

> STM32_Programmer_CLI.exe -c port=swd mode=hotplug -ob rdp=0xAA tzen=0
….
UPLOADING OPTION BYTES DATA ...
  Bank          : 0x00
  Address       : 0x40022040
  Size          : 32 Bytes
████████████████████████████████████████████████ 100%
  Bank          : 0x01
  Address       : 0x40022068
  Size          : 8 Bytes
████████████████████████████████████████████████ 100%
OPTION BYTE PROGRAMMING VERIFICATION:
Option Bytes successfully programmed

Note: When TrustZone is disabled, the command is the following:

STM32_Programmer_CLI.exe -c port=swd mode=hotplug -ob rdp=0xAA

Clear OEMxKEYs

Clear OEM1Key and/or OEM2KEY by writing 0xFFFFFFFF 0xFFFFFFFF in both OEM1KEY and OEM2KEY flash memory option bytes.

The OEM1_LOCK and/or OEM2_LOCK bits in FLASH_NSSR [19:18] are consequently cleared. They can be checked as described in Step 3 - Check if OEMxKEYs are provisioned (FLASH_NSSR [19:18] = 00).

CAUTION:

When OEM2KEY is cleared or not provisioned at all, RDP level 2 to level 1 regression is not possible.

When OEM1 and OEM2 keys are initially provisioned with keys as in Step 1 (Step 1 - Provision OEM1KEY) and Step 2 (Step 2 - Provision OEM2KEY):

The OEM1key can be cleared at RDP level 0.
The OEM2Key can be cleared at RDP level 1, level 0.5, or level 0.

Clear OEM1KEY

Use the following command in the STM32CubeProgrammer CLI interface:

> STM32_Programmer_CLI.exe -c port=swd mode=hotplug -lockrdp1 0xFFFFFFFF  0xFFFFFFFF
Device name : STM32U575/STM32U585
Flash size  : 2 MBytes
Device type : MCU
Device CPU  : Cortex-M33
BL Version  : 0x30
Debug in Low Power mode enabled
Lock RDP1 password successfully done

Clear OEM2KEY

Use the following command:

> STM32_Programmer_CLI.exe -c port=swd mode=hotplug -lockrdp2 0xFFFFFFFF  0xFFFFFFFF
Device name : STM32U575/STM32U585
Flash size  : 2 MBytes
Device type : MCU
Device CPU  : Cortex-M33
BL Version  : 0x30
Debug in Low Power mode enabled
Lock RDP2 password successfully done

The user can check that the OEM1LOCK and OEM2LOCK bits are cleared by reading the content of the FLASH_NSSR register as in Step3 (Step 3 - Check if OEMxKEYs are provisioned).