STM32 MCUs Security

Hello ST Team,I am evaluating the secure boot and secure firmware update solutions for the STM32H5 family and plan to implement OEMuRoT  on an STM32H5F4 device.While reviewing the wiki article OEMiRoT OEMuRoT for STM32H5, I noticed that the STM32H5F4xx is not listed as a supported device family.Security:OEMiRoT OEMuRoT for STM32H5 - stm32mcuI would like clarification on the following points:Is STM32H5F4xx intentionally excluded from OEMuRoT support? Are there any hardware or security-feature limitations in STM32H5F4 that prevent OEMuRoT implementation? My target device is STM32H5F4, and I am planning a secure firmware update architecture based on Root of Trust and authenticated firmware updates. Any guidance or roadmap information would be appreciated.  Thank you,             RJ

Hello ST Team,We are evaluating STM32TRUSTEE-SM (Secure Manager) on STM32H5F4 devices and would like clarification regarding the external flash support architecture.From the STM32TRUSTEE-SM documentation and wiki pages, we understand that:Secure Manager provides an External Flash Profile.An External Flash Driver is referenced as part of the Secure Manager configuration flow.External firmware and data confidentiality can be enabled through OTFDEC.OTFDEC-based secure external memory access is described together with the OCTOSPI peripheral.Secure Manager supports firmware download slots located in external flash memory.However, we need clarification on the supported external memory architecture and driver model.Questions1. External Flash Interface Support restricted to memories connected through the OCTOSPI peripheral, or are other                  external memory interfaces also supported? Specifically, does the External Flash Profile support:     Octal SPI NOR Flash, Quad SPI NOR Flash,

Hello,We are going to use the STM32H573 MCU (STM32H573IIK3Q) on our board, and we are now preparing for mass production. Production will be done at an external contract manufacturer (not in-house), and we need to provision keys and firmware securely during programming.My main question: Is the STM32HSM-V2 card strictly required for secure programming at high volume, or are there supported alternatives?Specifically:1. As far as I understand, the SFI license mechanism is tied to ST's key hierarchy inside the ROM bootloader, so a third-party/commercial HSM (Thales, nShield, etc.) cannot generate licenses that the chip will accept. Is that correct, or is there any supported way to run SFI with our own HSM infrastructure instead of the ST smartcard?2. If STM32HSM-V2 is the only option: for volumes well beyond 300 units, V2ML (10K) and V2HL (100K) do not seem to be orderable through distributors. Is the intended path to request them through an ST sales office, and what lead time should we pla

OverviewDebug Authentication Discovery occasionally succeeds in CLOSED state, but Full Regression fails (“Unable to boot on RSS_DA” / “Unable to detect DBGMCU Mailbox”)Get ready for the stm32 safari! Product / Environment- Board: Custom based off of STM32H7S78-DK (MB1736)- MCU: STM32H7S7L8H6H- Debugger(s) used: STLINK-V3SET- Tool: STM32CubeProgrammer v2.19.0- ST-LINK FW: V3J17M10B6S1- Board setup used during recovery attempts:- tried altering Boot0 (boot from RSS/system flash)- tried manual reset- tried low SWD speed and hardware reset modes Summary of the issueI was attempting to recover the board after secure configuration experiments. The board was originally reachable over SWD, but after running the **`ROT_Provisioning/DA/provisioning.sh`** flow from the STM32CubeH7RS package, normal SWD access stopped working. The board is now in **CLOSED** state, and **Debug Authentication Discovery** can occasionally succeed if I hit a very narrow timing window at power-up, but an

Hello,I would like to add Secure Boot + SFU functionality to my TouchGFX app with STM32N6. Since it is a graphics app, i don’t want to partition the external flash memory as installation and download slots as shown in the ST wiki for OEMuROT. https://wiki.st.com/stm32mcu/wiki/Security:OEMuRoT_for_STM32N6 To use external memory for apps and assests efficiently; below architecture is more suitable for me. Which changes are needed in the ST example ROT projects? With this, is it possible to debug the app code?                  Normal boot                      │                     ▼BootROM → Secure FSBL → verify App + Assets → HMI            Firmware update                      │                     ▼             USB / CAN                      │           signed package                      │                     ▼                Secure FSBL                      │     signature + version check                      │                 program NOR                      │                  verify

I am working on a batch script to disable TrustZone on an STM32U595VJT connected via JLINK using the STM32CubeProgrammer CLI tool.The device has both OEM1KEY and OEM2KEY set to [31:0] = 0xABCDEFAB, [63:32] = 0x12345678I am trying to run the following command when the RDP level is 1 and TrustZone is enabled with the device booted into the root secure services:STM32_Programmer_CLI.exe -c port=JLINK mode=HotPlug reset=HWrst freq=4000 ap=0 speed=Reliable -unlockRDP1 0xABCDEFAB 0x12345678 -ob RDP=0xAA TZEN=0The command fails to set the RDP level and TZEN flag with the following output: ------------------------------------------------------------------- STM32CubeProgrammer v2.20.0 -------------------------------------------------------------------Connecting to J-Link/Flasher ProbeWarning: The frequency input is not supported by the connected J-Link/Flasher !Device=Cortex-M33Unlock RDP1 password successfully doneDevice ID : 0x481Voltage : 3.33VFrequency

On the STM32C542RC, this is my current FLASH layout:-- OEMiRoT flash layout:-- Bootloader : 0x08000000 .. +0x10000-- Keys : +0x10000 (0x2000)-- NV counters : +0x12000 (0x2000)-- Primary app slot : 0x8014000 size=0x16000-- App code (post-hdr) : 0x8014400 size=0x15c00-- Secondary app slot : 0x802a000 size=0x16000-- OEMiRoT option bytes to program:-- HDP1_END = 0x9 WRPSGn1 = 0xfe00Everything is working well (update of user application, boot, etc...) (MCUBOOT_USE_HASH_REF is not defined).But I have an issue:I want to use the external User Data Flash at the address FLASH_EXT_USER_BASE 0x08400000UL, requiring the option byte EDATA_EN = 0. When I read from that address in the User Application, I only read zeroes (RAZ) -- simple as `*(const int *)FLASH_EXT_USER_BASE == 0`, so this feels like the cause is some sort of HDP. By the way, the writes do work (at least when the MCU is reset, as STM32CubeProgramm

Hi all,Are these available for these samples? I am working on some secure boot devices and would like to try these chips as I am familiar with the STM32 ecosystem. Are you guys have any suggestion which NUCLEO can use for secure-boot purpose?I see there are NUCLEO-H5xx are designed for hardware crypto, sample project and we can build for chain of trust from these family chips?Please let me know, thank you.

There is a problem with STM32 signing tool version 2.21.0. When header version is 2.3 and alignment flag is used, then image length in header is greater by the alignment byte count.To reproduce:Create dummy.bin that is filled with 256 bytes of FF's. For example with HxD tool.Sign it with no keys:STM32_SigningTool_CLI.exe -bin dummy.bin --type fsbl --no-keys --option-flags 0x80000000 --output signed.bin --dump-header signed.bin --header-version 2.3 --alignView the signed.bin with hex viewer (e.g. HxD) at offset 0x6C which is Image length by UM3234 rev 2:It is 0x2C0 = 704. This is 448 bytes more than original 256 bytes.When removing --align flag from signing call, the length becomes correct, but this image is not bootable anymore because STM32N6 Boot ROM expects FSBL image start address to be aligned to 0x400.I want to use this length field to check during OTA that FSBL upgrade file size and checksum are correct before programming it into Flash. But I wonder how does N6 Boot ROM treat th

In the STM32H5 series security document, STM32H5F4 is missing from the OEMiRoT + OEMuROT support controller list. Is STM32H5F4 a derivative of STM32H5F5, and does STM32H5F4 have the same security support as STM32H5F5?  

 I have been reading the discussion here: Understanding the bootloader GO command on the STM32H5 seriesI am trying to understand one point in particular. The discussion describes the problems associated with using the bootloader GO command on STM32H5, and refers to the state of the device and peripherals when the bootloader transfers control to the application. Does the H5 system bootloader GO command actually support transferring execution to an application loaded into SRAM? I ask because the wording left me uncertain about whether the issue being discussed applies to SRAM applications, Flash applications, or both. Perhaps ​@STea or someone else from ST, could clarify please?

Hi,Unable to set the Product state to OPEN using the Provisioning script in the STiROT_OEMuROT example.Getting the below error: But,when i’m trying to set the Product state as CLOSED it is getting Success.Note: Ensured to connect the CN7/pin5 to CN7/pin7. Also,Below is the obkey_provisioning.log content:C:\My_New_Stuff\GIT\STM32H5\Projects\NUCLEO-H533RE\ROT_Provisioning\STiROT_OEMuROT>call ../env.bat Provisionning the .obk files ...      -------------------------------------------------------------------                       STM32CubeProgrammer v2.20.0                        -------------------------------------------------------------------ST-LINK SN  : 000E00264142501820353451ST-LINK FW  : V3J13M4Board       : NUCLEO-H533REVoltage     : 3.29VSWD freq    : 8000 KHzConnect mode: Hot PlugReset mode  : Software resetDevice ID   : 0x478Revision ID : --Error: Fail to read Flash SizeDevice name : STM32H533/523Flash size  : 512 KBytes (default)Device type : MCUDevice CPU  : Cortex-M33BL

Hi Community,I’m provisioning an STM32H573 (installed on a NUCLEO-H563ZI board; I replaced H563 with H573). I followed the ST example STiRoT_OEMuROT from STM32Cube FW H5 v1.6.0. During provisioning the script aborts with:Error when trying to Set SECBOOT_LOCK option byte to 0xC3 (unlock secure boot address)  Provisioning aborted.Environment: - MCU: STM32H573 (2 MB flash)- Host tools: STM32_Programmer_CLI v2.19.0- Product state chosen in provisioning script: OPEN.after i read the option bytes using STM32_Programmer_CLI -c port=SWD -ob displ i found that,   Product state: PRODUCT_STATE: 0xED (Open) BOR Level: BOR_LEV : 0x0 (BOR Level 1, the threshold level is low (around 2.1 V)) BORH_EN : 0x0 (0x0) User Configuration: IO_VDD_HSLV : 0x0 (0x0) IO_VDDIO2_HSLV: 0x0 (0x0) IWDG_STOP : 0x1 (0x1) IWDG_STDBY : 0x1 (0x1) BOOT_UBE : 0xC3 (ST-iRoT (system flash) selected) SWAP_BANK : 0x0 (0x0) IWDG_SW : 0x1 (0x1

Hi ST Team,We are currently considering the STM32H5F4 for an upcoming product, and Secure Manager support is a key factor in our device selection process.Could you please confirm whether STM32H5-SMAK support for STM32H5F4Z devices is planned and whether there is any documentation, reference project, or preliminary guidance available for evaluation?This information will help us assess the suitability of STM32H5F4 for our product architecture.Thank you for your support.Best regards,RJ

Dear ST Team,I am writing to follow up on my request for access to the STM32TRUSTEE-SM (Secure Manager) resources. I submitted my request several weeks ago, but I have not yet received any update, approval notification, or access instructions.Could you please check the status of my request and help expedite the approval process? If any additional information or action is required from my side, please let me know.The product page I am referring to is:https://www.st.com/en/embedded-software/stm32trustee-sm.htmlThank you for your support. I look forward to your response.Best regards,RJ

Reverting STM32H7B3 from Secure Access Mode to Standard ModeHello,I am working with an STM32H7B3 and currently evaluating the Secure Access Mode and secure user area functionality.I am going to configure the device as follows:Create a secure user area in Bank 1 with DMES1 = 1 Create a secure user area in Bank 2 with DMES2 = 1 Enable Secure Access Mode (SECURITY = 1) The device is currently at RDP Level 0My requirement is to support reverting the device from Secure Access Mode back to Standard Mode during development/service.My understanding is that the following sequence can be used:Change RDP from Level 0 to Level 1. Perform an RDP regression from Level 1 to Level 0. Since DMES1/DMES2 are set to 1, the secure areas should be erased during the RDP regression. After the secure areas have been removed, disable Secure Access Mode (SECURITY = 0). Reset the device and boot normally in Standard Mode.In other words:RDP Level 1 → RDP Level 0 regression → secure areas removed due to DMES1/DMES2

In my application on an STM32H7S3 I’ll have to often read option byte keys, and I want to limit the possibility of accidentally writing to option byte keys.According to the reference manual, that’s where the PG_OPT bit of FLASH_OPTCR comes in:PG_OPT: Program options0: Update operations to user option bytes and option byte keys do not start1: Write operation to user option bytes and option byte keys is enabledPerfect, so I just need to be sure this bit is not set when I don’t want writes.To double check this bit is not needed to be set during the configuration of FLASH_OBKCR to initiate read operations, the description of the KEYPROG bit - when set to 0 - seems to hint the PG_OPT bit doesn’t need to be set according to the reference manual:KEYPROG: Key programThis bit must be set to write option byte keys (keys are read otherwise).0: Read key. Result of the operation is stored in FLASH_OBKDRx registers, if applicable.1: Program key if PG_OPT is set in FLASH_OPTCR register, and KDREF fla

Hi everbody,we are using an STM32H573 with ST Secure Manager and would like to perform the final Product State transition from TZ-CLOSED to CLOSED at the end of production.At this point, the device is already assembled and SWD/JTAG is no longer accessible. Therefore, we would like to trigger the transition through an authenticated internal command from the Non-Secure application.From the documentation, we understand that:PRODUCT_STATE is controlled via Flash Option Bytes. The Non-Secure application cannot directly modify the relevant Secure Flash registers. We could not find a documented Secure Manager runtime API for changing the Product State.Could you please clarify:Is there an existing Secure Manager API to perform TZ-CLOSED → CLOSED at runtime without SWD/JTAG? If not, can this be implemented via an OEM Secure Module? Is an OEM Secure Module allowed to modify the PRODUCT_STATE Option Byte?Thanks and best regardsMario

Hello Team,I am currently reviewing the Secure Manager memory layout described in UM3254 (Secure Manager for STM32H573xx microcontrollers). The document provides predefined flash memory mappings for STM32H573 devices, including the Large Profile layouts shown in Figure 9 and Figure 10.       Our plan is to use STM32H5F4, which provides 4 MB of Flash, and I would like to understand the recommended Secure Manager memory mapping for this device. Could you please help with the following:Is there a predefined Secure Manager flash layout available for STM32H5F4 (4 MB Flash)?If available, could you share the corresponding memory map.Could you point me to the exact documentation, application note, user manual section, or reference project that describes Secure Manager support for STM32H5F4 devices?If no predefined layout exists, could you provide guidance on how the memory regions should be scaled from the STM32H573 large profile/External Flash profile example to support 4 MB Flash devices? Th

Hi,We’ve been trying to implement secure-boot on our STM32H573-based device and the new code boots fine when the product state is OPEN. From what I understood, the PROVISIONING state does not boot the user code, and we thus need to put the device in iRoT-Provisioned to see if our boot chain works as expected.More info about our setup: Part: STM32H573AIIxQ DBGMCU_IDCODE (0x44024000): 0x10076484 Boot: STiRoT (BOOT_UBE=0xC3), TZEN=0xB4 Layout: secure app at 0x0C000400 (24 KB), non-secure app at 0x08006400 Software: STM32CubeMX-generated project, STM32Cube H5 HAL Debug: ST-LINK + OpenOCD, debug authentication (certificate chain), session reports Secure stateBack to the topic, I can see that te PKA register interface is fully alive, but the PKA compute engine never starts once thedevice is in iRoT-Provisioned product state. HAL_PKA_Init() spins in PKA_WaitOnFlagUntilTimeout() waiting for PKA_SR.INITOK, times out after 5 s, and the application lands in Error_Handler().The exact same binary a

Hello, I’m working on STM32H533 project with trust zone and secure and non-secure firmware.The project has an OCTOSPI external flash w25q64jvssiq memory, configuring the OCTOSPI in the non-secure side. I have configured the SAU unit for memory mapped mode, gice access to the OCTOSPI from the secure side with HAL function: HAL_GTZC_TZSC_ConfigPeriphAttributes(GTZC_PERIPH_OCTOSPI1,GTZC_TZSC_PERIPH_NSEC | GTZC_TZSC_PERIPH_NPRIV); At the non-secure side I can write/read the memory using QSPI instruction. Also I can change to memory mapped mode and have access with debugging tool (uVision).When I change to memory mapped mode and use any instruction to acces directly to memory an interruption occurs and give back to secure side on SecureFault_Handler showing AUVIOL violation.  Attached you can find the SAU configuration file, made by myself because STM32CubeMX does not make any change in the file, like this post:  So, obviously I missed something or I’m doing some mistake, I need help ASAP t

Hi everyone,I am working with an STM32U5 device and have enabled TrustZone (TZEN = 1)  using STM32PROGRAMMERI created both the Secure and Non-Secure projects, and they compile and program successfully.ProblemAfter downloading the firmware from STM32CubeIDE:Programming completes successfully. The application does not start automatically. My LED does not blink.However:If I press the hardware RESET button, the LED immediately starts blinking. If I start a Debug session, the LED also starts blinking.So the firmware itself appears to be correct because it works after a reset.What I have verifiedTrustZone (TZEN) is enabled. Secure and Non-Secure projects are generated by CubeMX. Secure project jumps to the Non-Secure application. Programming finishes without any errors. The issue only occurs immediately after programming. Without TrustZone, the application starts automatically after programming.My questionIs this expected behaviour with STM32U5 TrustZone?Has anyone experienced the same issue

Hello!I a new in this.I have two sets of DA files: for password access and for access via certificate.I've tried to flash a NS-firmware, provision a password.obk, then change Product state to Provisioned/closed. Thas was successful. I can perform a regression from this state.But i also tried to open a debug session. Without success. CubeProgrammer says, that I am able to make full regression only, while Cube IDE asks for certificate DA.I know, that certificate auth method is valid with TZEN=1 only, but I tried to provision that obk with TZEN=0.As a result, I Have this:The default ST password from CubeProgrammer's folder is not working,I tried to provide all-zeros and all-FF password without success.But maybe I need to change something in the header. Or change a password length.So, 3 questions:1. Is this device totally bricked, or I can some-how calculate a password.bin2. How to perform debug in closed product state on STM32H563 if TZEN=0 ?3. How to perform debug of the the secured

Hi ST,I’ve run into a whole lot of issues adding interrupt-based UART to your OEMiRoT w/ Trustzone example on a NUCLEO-U385RG-Q.As you may know this example is not compatible with CubeMX, and it’s not clear which steps are needed to manually incorporate UART4 so that it activates an interrupt on receipt of input when running in the Non-Secure region of code. The idea is to only access the Secure region when needing to utilise certain sensitive variables, called from within a Non-Secure function.Let’s take this opportunity to establish a step-by-step guide for someone who isn’t (yet) an embedded professional, please excuse my ignorance if this already exists, I’d be just as happy to be directed there. My settings so far are:1. Secure/Inc/partition_stm32u385xx.h: Initialise UART4_IRQn as Non-Secure#define NVIC_INIT_ITNS2    1#define NVIC_INIT_ITNS2_VAL      0x000000012. Secure/Src/main.c: Define UART4 pins (CN7 1 & 2, or PC10 & 11) as NonSecureHAL_GPIO_ConfigPinAttributes(GPIOC,

Hello, I am currently performing an ISO 13849-1 assessment and creating a SISTEMA model for a chemical dosing system.The safety-related control architecture includes a STM32F767BI. I have reviewed:- STM32F767 datasheet- STM32F7 Safety Manual (UM2318)- STM32F7 self-test library documentation The Safety Manual references:- AN5132 (FMEDA results)- AN5137 (FMEA results) However, these documents do not appear to be publicly available. I am looking for guidance on the following: 1. Is there an official FIT value, failure rate, PFHd or MTTFd available for the STM32F767 family?2. Are AN5132 and AN5137 available through ST support or under NDA? Thank you.