STM32 MCUs Security

Hi all,I’m working on STM32U385 with OEMiRoT and following this ST wiki page:https://wiki.st.com/stm32mcu/wiki/Security:How_to_adapt_a_user_application_to_ROT_for_STM32U3However, I cannot see any of the images/diagrams in the page (they appear blank or missing).I tried different browsers (Chrome, Edge, Firefox) and different PCs, but the issue remains.Can someone confirm if the images are visible on their side, or if this is a known issue with the wiki page?The diagrams are quite important to understand the ROT/OEMiRoT flow and flash layout.Thanks in advance.Marco Giacomin    

Hi,I am currently testing OEMiROT and I performed the following 3 tests.Test 1: Default example(Overwrite mode enabled + separate Secure and Non-Secure applications)How to start with OEMiRoT on STM32U3 - stm32mcuProject:OEMiROT_Appli_TrustZoneOEMiROT_BootConfiguration:#define MCUBOOT_OVERWRITE_ONLY /* Defined: FW installation uses overwrite method. Undefined: FW installation uses swap mode. */ #define MCUBOOT_APP_IMAGE_NUMBER 2 /* 1: S application only if FLASH_NS_PARTITION_SIZE = 0, otherwise S and NS binaries assembled in one single image. 2: Two separated images for S and NS applications. */ #define MCUBOOT_S_DATA_IMAGE_NUMBER 0 #define MCUBOOT_NS_DATA_IMAGE_NUMBER 0This test works correctly.Test 2:(Swap mode enabled + separate Secure and Non-Secure applications)Project:OEMiROT_Appli_TrustZoneOEMiROT_Boot/* #define MCUBOOT_OVERWRITE_ONLY */ /* Undefined: FW installation uses swap mode. */ #define MCUBOOT_APP_IMAGE_NUMBER 2 #define MCUBOOT_S_DATA_IMAGE_NUMBER 0 #define MCUBOOT

hello ST Community,I'm trying to protect sector 0 of the flash drive from mass erasure using the PCCOP Protection option on the NUCLEO-H755ZI-Q.After tinkering around a bit to understand its functions, I can no longer reset its protection to its default state. Currently, it looks like the one in the photo:When I try to set these valuesPROT_AREA_START1 = 0x0801FF00PROT_AREA_END1 = 0x080100FFwhich i believe are their default values, both in the RDP=0xAA and RDP=0xBB states, I get this error.How can I fix this? Is there a way to reset PCROP Protection to its default mode?Thanks for the support.

Hello, I've recently managed to modify the SBSFU example for the STM32F413H-Discovery board and adapt it for my STM32F419 mcu, building it and executing it successfully.Now the issue is, i need to modify the loading mode from serial ymodem to downloading the firmware image from a file inside of an USB stick To do this, im using the ST driver that is present already in other projects, which requires interrupts (specifically  OTG_HS_IRQn and possibly others) but when the code tries to setup the interrupt and its priority with HAL_NVIC_SetPriority(OTG_HS_IRQn, NVIC_PRIORITYGROUP_4, 0); HAL_NVIC_EnableIRQ(OTG_HS_IRQn); There's a reset of the MCU, so how do i make it so that the SBSFU project can use interrupts?I stumbled upon the AN5056 document where at page 38 talks about interrupt support in the SBSFU, but for the STM32L496 which has a Firewall feature i do not have. Is that still the correct way of proceeding? If so, how?Best regards

Hi everyone,I’m currently experimenting with the GPIO_IOToggle_TrustZone example using STM32 TrustZone.When I build and flash both the Secure and NonSecure firmware, everything works correctly: the LED toggles as expected, so the interaction between Secure and NonSecure worlds seems fine.However, I’m running into an issue with debugging:I can successfully debug the Secure projectbut I cannot seem to debug the NonSecure projectI am using STM32CubeIDE and I would like to understand how to properly configure the environment to be able to debug the NonSecure application as well.Specifically:Do I need a separate debug configuration for the NonSecure project?Is it required to start debugging the Secure project first and then attach to NonSecure?Or is there a specific STM32CubeIDE / ST-LINK / TrustZone debug configuration that I am missing?Any guidance on the correct way to set up STM32CubeIDE for debugging the NonSecure project would be really appreciated.Thanks in advance!

I am a user of the NUCLEO-N657X0-Q board.I would like to use Keil MDK RTX5 RTOS together with Root of Trust.My development environment is as follows:1> Development tool: Keil uVision V5.422> Example source: STM32Cube\Repository\STM32Cube_FW_N6_V1.2.0\Projects\NUCLEO-N657X0-Q\Applications\ROT\OEMuROT_Appli3> Development board: NUCLEO-N657X0-Q4> Manage Run-Time Environment Setting I have added the osKernelInitialize() function to the main function as shown below.int main(void) { #ifdef PRINT_BOOT_TIME /* Get boot cycles */ end = DWT->CYCCNT; #endif /* Reset of all peripherals, Initializes the Flash interface and the systick. */ HAL_Init(); #ifdef PRINT_BOOT_TIME /* Get Boot Time */ time = ((uint64_t)(end) * 1000U / SystemCoreClock); #endif /* Register SecureFault callback defined in non-secure and to be called by secure handler */ SECURE_RegisterCallback(SECURE_FAULT_CB_ID, (void *)SecureFault_Callback); /* Register SecureError callback defined in non-sec

Hello ST Community, I am working with an STM32U585 custom board and I would like to clarify the supported and recommended workflow for flashing TrustZone‑enabled firmware with SBSFU using USB DFU via STM32CubeProgrammer. Hardware / Software Setup MCU: STM32U585 Custom hardware board Tool: STM32CubeProgrammer v2.19.0 Interface tested: ST‑LINK (SWD) USB DFU Security configuration: TrustZone enabled (TZEN = 1) SBSFU (Secure Boot & Secure Firmware Update) used What works (via ST‑LINK / SWD) Using STM32CubeProgrammer CLI with ST‑LINK, I am able to successfully flash all components: SBSFU bootloader File: SBSFU.bin  Address: 0x0C004000 Initial SBSFU application image File: sbsfu_app_init.bin Size: ~1.80 MB (0x1c000) Address: 0x0C030000  The script erases the correct flash sectors, programs the binaries, verifies them successfully, and the board boots correctly. So SWD flashing works as expected for: TrustZone‑enabled device SBSFU bootloader SBSFU appli

Hi,On a custom board I get the following message: Unable to detect DBGMCU Mailbox STwhen i run regression.bat.I did several test (provisionning, regression) before and i didn't notice any issuesDA with password and TZ disabledA program is running on my custom board but i cannot come back to OPEN state with the regression script.I tried with HRST wired to my STLINK with no success ...Any ideas ?Regards

and how will the information be made available for non-EU residents ? 

Hello Team,Believing STM32H5 series is most secure Devices , just doing comparision between H563 and H573 security aspects.Just to know PSA Certified Level 3 and SESIP will also applied to H563 device as well ( being into same Family ) ? We are more concern about firmware protection against Physical and side channel attacks.    

Dear community,I am looking for help to have TFM ported for nucleo_u385rg_q so that I can build the tfm secure and non secure images and do a secure boot on this board. The closest board is b_u585i_iot02a which is a stm32u5 variant. But there are many low level code required for this in trusted-firmware-m repo. Is there a work done by someone that I can use for my work? Any pointers as to how to accomplish this. Thanks in advance for your support.

Hello ST Community,I am working on the NUCLEO-N657X0-Q board with a TrustZone project configured in STM32CubeMX with three contexts: FSBL, AppSecure (AppS), and AppNonSecure (AppNS). The FSBL is working correctly and jumping to AppS successfully.I was having an issue with the SAU Configuration. As per the wiki article, "How to start with RIF on STM32N6 MCUs"  https://wiki.st.com/stm32mcu/wiki/Security:How_to_start_with_RIF_on_STM32N6_MCUsI configured the SAU region. I configured the FLEXRAM, AXISRAM1 and AXISRAM 2 in STM32Cube IDE. But it stays disabled when I tried to generate code. My partition_stm32n657xx.h file looks like :How to resolve this issue?

 After porting the application "STM32Cube_FW_U5_V1.8.0\Projects\B-U585I-IOT02A\Applications\SBSFU" to our own board we have everything operational apart from the ability to invoke the local loader in production mode (RDP2).I have reverted to the original B-U585I-IOT02A board and project and have a similar issue so I am wondering if this is broken or we have misunderstood something. The loader can be invoked in TFM_DEV_MODE with RDP0 but not in production mode with RDP2. The SBSFU application runs fine.Changes from the default STM SBSFU project settings we used to test this on B-U585I-IOT02A1) In SBSFU_Boot project remove the TFM_DEV_MODE pre-processor symbol definition2) In boot_hal_cfg.h >> #define TFM_TAMPER_ENABLE NO_TAMPER3) In boot_hal_cfg.h >> #define #define TFM_OB_BOOT_LOCK 04) In flash_layout.h >> //#define MCUBOOT_PRIMARY_ONLY (definition commented out)5) In flash_layout.h >> #define MCUBOOT_APP_IMAGE_NUMBER 26) In hardening.sh

hello ST Community, Is it possible to change the RDP "Read Out Protection" level from level 1 to level 0 without erasing the flash data? I've currently been able to change the level from RDP level 1 to level 0 for Nucleo-H755ZI-Q, but changing the level causes a mass erase of the flash drive. Is it possible to avoid this? If so, is there a code example? Thanks for your support.

Hello,I am working on the boot process and security of the STM32H757.For my tests, I have placed the two boot addresses for the two cores (ADD0 and ADD1 for CM7 and CM4) in the internal flash memory, with an ISR vector at each boot address :ADD0: standard ISR vector calling the standard Reset_Handler, which in turn calls the main function g_pfnVectors: .word __initial_spTop /* Use internal RAM for stack for calling SystemInit. */ .word Reset_Handler .word NMI_Handler .word HardFault_Handler .word MemManage_Handler .word BusFault_Handler .word UsageFault_Handler ... and ADD1: virtually the same ISR vector but calling BootPin_Handler instead of Reset_Handlerg_bootPinVectors: .word __initial_spTop .word BootPin_Handler .word NMI_Handler .word HardFault_Handler .word MemManage_Handler .word BusFault_Handler .word UsageFault_Handler ... Everything seems to be working properly, at least up until the security test.When RDP is set to level 0 or 1, everything is fine and

Post Edited by ST moderator to apply source code formatting Hello, To need to disable external read/write access to flash in stm32c071 i have changed the RDP from level 0(0xAA) to level 1(0xBB) and was successful in doing so. But when I try to change from level 1 to level 0 i am unable to change it.  code to change from level 1  to level 0. eFLASH_ErrorType_t FlashReadWriteEnable(void) { eFLASH_ErrorType_t err_code = e_SUCCESS; // Check if flash is busy err_code = CheckFlashBusy(); if(err_code == e_SUCCESS) { // Unlock flash err_code = flashUnlock(); if(err_code == e_FLASH_UNLOCKED) { // user options unlock err_code = flashOptUnlock(); if(err_code == e_FLASH_OPT_UNLOCKED) { FLASH->OPTR &= (~FLASH_OPTR_RDP_Msk); FLASH->OPTR |= (0xAA << FLASH_OPTR_RDP_Pos); FLASH->CR |= FLASH_CR_OPTSTRT; // Check if flash is busy err_code = CheckFlashBusy(); if(err_code == e_SUCCESS) { FLASH->CR |= FLASH_CR_OBL_LAUNCH; } } } } return err_code;

Hello ST Community,I am working on the NUCLEO-N657X0-Q board with a TrustZone project configured in STM32CubeMX with three contexts: FSBL, AppSecure (AppS), and AppNonSecure (AppNS). The FSBL is working correctly and jumping to AppS successfully. I followed the wiki article "How to start with RIF on STM32N6 MCUs" as reference. https://wiki.st.com/stm32mcu/wiki/Security:How_to_start_with_RIF_on_STM32N6_MCUs The secure LED (configured as output push-pull, pulled low initially) turns ON but never toggles. I have tried both HAL_Delay() and a pure software loop  for (volatile uint32_t i = 0; i < 800000; i++);  inside the while(1) — neither causes the LED to blink. The GPIO write to set it HIGH works, but the toggle never happens. This suggests the secure while(1) loop itself may not be executing, or the app is hanging somewhere before it. The NS LED does not turn ON or toggle at any point. The NS app appears to not execute at all. I have configured RISAF for

Hello,My STM32H573I-DK board is bricked after a failed provisioning attempt.What happened:Accidentally changed PRODUCT_STATE from Open (0xED) to 0x17 (Provisioning) via programmerThen an AI coding assistant (Copilot) attempted some configuration via DFU mode and enabled TrustZoneI no longer have access to the PC where this was doneCurrent symptoms:SWD: "Unable to get core ID", "Cannot connect to access port 1"DA discovery (debugauth=2): "The target is unable to boot on RSS_DA or is in OPEN mode"DA regression (debugauth=1) with default STM32CubeFW_H5 keys: "Unable to detect DBGMCU Mailbox" or "unable to boot on RSS_DA"DFU (USB0): "Target device not found" (with boot jumper set to SYS/MEM)UART bootloader: timeoutWhat I tried:SWD with HOTPLUG, UR, HWrst, ap=0, freq=100DA regression with default key_3_leaf.pem and cert_leaf_chain.b64regression.bat from ROT_Provisioning\DADFU via User USB (CN17) with JP4 on USB-PD positionUART via ST-Link VCPSetup:Board: STM32H573I-DKSTM32CubeProgrammer: v2

Following the ST sample : STM32CubeH5\Projects\NUCLEO-H563ZII regenerated OEMiRoT_Config.obk with the STM32TrustedPackageCreator.then, rebuild the OEMiRot application and the applications OEMiROT_Appli_TrustZone_Secure & OEMiROT_Appli_TrustZone_NonSecureI ran the script : \ROT_Provisioning\OEMiROT\provisioning.batusing the 'PROVISIONED' choice.The script returns No error. But When I check the PRODUCT_STATE with STM32CubeProgrammer, the state came back to OPEN instead of PROVISIONED.But, I had to use the DA to connect to the device with the STM32CubeProgrammer. So, OBK files seems to be applied.I has already checked that the PROVISIONING state has been correct before the OBK provisioning sequence.So it's the action "set state PROVISIONED" that fails (or maybe an issue with the OBK files ???,  but no way to check if they are OK).Someone has already meet this issue ? How to fix it ?  

Post edited by a ST moderator to be inline with the community rules especially on the code sharing. In next time please use </> button to paste your code. Hi I am struggling getting context save restore working correctly, when operating the HASH hardware block using polling mode.Basicly the flow is like this: /* --- STEP 1: Start hashing first chunk --- */ HAL_HASHEx_SHA256_Start(&hhash, input1,strlen((char*)input1), digest,HAL_MAX_DELAY); /* --- STEP 2: Save context --- */ HAL_HASH_ContextSaving(&hhash, context); /* --- STEP 3: Restore context --- */ HAL_HASH_ContextRestoring(&hhash, context); /* --- STEP 4: Continue hashing --- */ HAL_HASHEx_SHA256_Accumulate(&hhash, input2, strlen((char*)input2)); /* --- STEP 5: Finalize hash --- */ status = HAL_HASHEx_SHA256_Finish(&hhash, digest, HAL_MAX_DELAY); However when calling HAL_HASH_ContextSaving the DINIS is not equal to 1 and CSRx registers return zeros as stated in the reference manualHow do it

I got an error when downloading the .sfi file to STM32H753II using the STM32Programmer_CLI, my HSM version is V2AE.The error message is as follows:What its mean?V2AE cannot support STM32H753,and must use HSM_V1?or H753 cannot support SFI ?I’m a new use about SFI.Looking forward to your reply.

Hi,I am using SBSFU v2.8 with an STM32H750. I have successfully booted my firmware without any protections. I have also enabled protections and succeeded all tests in the test suite provided in the example code in sfu_test.c.However, when I attempt to boot my firmware with any protections enabled at all, I get the following, followed by a reset.This is happening at the first control flow check at line 1092 in sfu_boot.c.In my research, I found this post. I replicated it and included app_sfu.h in sfu_boot.h. It works now.I would like some clarification on this whole situation. Is this a bug? or is my build system just not including app_sfu.h appropriately ?Thanks!

Hello, I am working with an STM32 B-U585I development kit. The board has been previously used, and some protection-related configurations have been modified. I am now trying to perform new tests on the device, but I believe I am unable to bypass the current protection settings. I would appreciate your assistance on this matter. A TFM application was previously installed on the board. When connecting via STM32CubeProgrammer, I observe the following: 1. Connection settings: I connect with the following configuration: Boot0 = 1 Port: SWD Mode: HotPlug Reset Mode: Hardware 2. STLinkUpgrade tool: When opened, the ST-LINK is identified as: Type: STM32Debug+VCP 3. STM32CubeProgrammer observations: RDP = 0xDC (Level 1, read protection of memories) TrustZone = 1 OEM1LOCK = 1 OEM2LOCK = 0 I do have the required password to unlock RDP, and I am able to successfully unlock the RDP protection. My development environment: STM32CubeIDE v1.19.0 To verify firmware download capability, I created

Hi everyone,I’m currently working with STM32 Secure Boot and Secure Firmware Update (SBSFU) and integrating it with my custom application. I’m trying to design the project in a modular and scalable way for long-term use, and I would really appreciate some guidance from those who have worked with SBSFU in production. Current ScenarioMCU: STM32 (Cortex-M series)Bootloader: SBSFUApplication: Custom firmware using HAL, middleware, and CubeMX-generated codeDevelopment tool: STM32CubeIDE Challenges I’m Facing1. Shared Drivers & MiddlewareBoth my bootloader and application require:HAL DriversSome middleware components What is the best way to manage duplication vs sharing?Should bootloader and application maintain completely separate copies of Drivers/Middleware?Is there any recommended way to keep them in sync without tight coupling? 2. Impact of .ioc ChangesI use CubeMX via .ioc for peripheral configuration.If I:Add a new peripheralModify clock or pin configurationHow

Hi Team,I have successfully integrated and run SBSFU with my custom application, and it is working as expected.Currently, I am transferring the .sfb file .via USB to the DWL_SLOT. Once  the transfer is complete, I trigger a reset using    NVIC_SystemReset(), and the process works fine.I have a few questions regarding the .sfb header. It contains fields such as:FW Tag (SHA-256)Header SignatureFirmware Size (FwSize), etc.My questions are:Using FW Tag (SHA-256) for validationIs it possible to use the FW Tag (SHA-256) to validate the received image in the DWL_SLOT before performing the reset?If yes, could you please guide me on the correct process to implement this?Current CRC-based approachAt present, I am calculating a CRC for the .sfb file after it is generated by the Python script. I then transfer both:The .sfb fileA separate CRC fileOn the firmware side, I recompute the CRC from the received data and compare it with the provided value. If it matches, I proceed with