STMicroelectronics: Securing and Recovering STM32C5 Devices with RDP Regression

How to Program the OEM Password with PEmicro Tools

Unlike the STM32CubeProgrammer approach described on the ST wiki, PEmicro tools configure the regression password through option bytes using a user options (`.OPT`) file.

Step 1: Load the option bytes algorithm

In PROGACMP, use CM (Choose Module) to load the option bytes algorithm for your target STM32C5 device.

Step 2: Create the user options file

Select CU (Create/modify user options file) to open the option bytes configuration window. Scroll to the security key registers for your device. On STM32C5, configure the OEMKEY registers (four 32-bit values comprising the 128-bit key).

The workflow is the same as for other STM32 families; the register names differ on STM32C5.

Enter your desired password values as hexadecimal register contents. For example, a 128-bit OEMKEY of 00112233445566778899AABBCCDDEEFF would be programmed across four 32-bit registers:

0x00112233

0x44556677

0x8899AABB

0xCCDDEEFF

Save the configuration to a `.OPT` file.

The screenshot below shows the configuration window for the OEM1KEY, OEM2KEY, OEM3KEY, and OEM4KEY registers:

Step 3: Program the user options

1. Select SU (Specify user option files) and choose the `.OPT` file you created.

2. Select PU (Program User Options) to write the option bytes to the device.

3. Select LO (Launch Options) to load the configuration.

Note: `FLASH_OEMKEYR` and `FLASH_BSKEYR` always read as zero, so VU (Verify user options) cannot confirm the key values. 

Step 4: Set the RDP level

After setting and launching the OEMKEYS, the next step is to program the RDP level. Select CU (Create/modify user options file) again to create an RDP specific option byte configuration. Set the RDP value to 0x72 and save the new `.OPT` file. 

Repeat the same steps above to program the user options except with the RDP option bytes. Once the LO (Launch Options) command is run, the target will lose connection as it is now debug secured.

How to Regress the RDP Level with the OEM Password

Regression on STM32C5 is a single-step process: RDP2 → RDP0, conditioned on the correct OEMKEY and a full mass erase. This is simpler than the STM32U workflow, which may require an additional step to move from RDP level 1 to RDP level 0.

Configure security settings in the Connection Manager

To perform regression with PROGACMP:

1. Close PROGACMP completely and reopen it to return to the Connection Manager. This is required to access the security settings for regression.

2. In the Connection Manager, select your STM32C5 target device.

3. Open Security settings and enter the OEMKEY password (128-bit value) in the password field.

4. Enable the Mass erase upon connection to target checkbox. Regression performs a full flash mass erase, so this option must be selected.

Security settings with OEM key password and "Mass erase upon connection to target" enabled. Shown here on PROGACMP Connection Manager; the same security settings are available in the Cyclone Image Creation Utility Power & Communications tab when STM32C5 is selected. For SAP images, the STM32C5 target only needs a power on reset to proceed with the regression.

Connect to perform regression

With the security settings and mass erase option configured, connect to the target under reset (or run a SAP image with the same settings on a Cyclone programmer). Per RM0522, the 128-bit OEMKEY is shifted through JTAG/SWD under reset as four 32-bit words into the debug authentication register. Upon a successful connection with the correct key, hardware launches the regression sequence and flash memory is mass-erased.

On STM32C5, no additional user commands are needed after connection — the regression from RDP2 to RDP0 completes in a single step when the OEMKEY is correct. Apply a power-on reset after successful regression (cycle VDD off and on) before further debug or programming operations, as required by RM0522. If there is a failure connecting with to the target (i.e. $0007 error), then perform a power-on reset before retrying the regression.

Using Cyclone Image Creation Utility

For production programming with a Cyclone, the same security settings apply on the Power and Communication tab of the Image Creation Utility:

1. Select the STM32C5 target device.

2. Open Security settings and enter the OEMKEY password.

3. Enable Mass erase upon connection to target.

4. Build and run the SAP image.

Troubleshooting

If regression fails for any reason:

• Power-cycle the target device (remove and reapply power).
• Verify the OEMKEY password is correct — the full 128-bit value must match what was provisioned in RDP0.
• Confirm Mass erase upon connection to target is enabled.
• Close and reopen PROGACMP to ensure the Connection Manager security settings are applied fresh.
• Retry the connection.

If regression continues to fail, double-check that the OEMKEY was provisioned before the device was set to RDP2. A device closed to RDP2 without a provisioned OEMKEY cannot be recovered.

Summary

PEmicro tools provide a workflow for STM32C5 life-cycle management — from provisioning the OEMKEY regression password through option bytes, to closing the device at RDP2, to recovering it with password-protected regression from RDP2 to RDP0 — without requiring STM32CubeProgrammer. Boundary scan life-cycle operations are outside the scope of PEmicro tool support.

References

- [PEmicro Blog: STM32U RDP Regression (post 374)]

- [ST Wiki: RDP password and regression on STM32C5]

- [ST Wiki: Getting started with STM32C5 security]

- [RM0522 — STM32C5 Series Reference Manual (PDF)]