Skip to main content
stst9187
stst9187
Associate III
May 11, 2026
Question

OEMiRoT – S-only application (no TrustZone isolation): correct configuration of MCUBOOT_APP_IMAGE_NUMBER and FLASH_NS_PARTITION_SIZE

  • May 11, 2026
  • 1 reply
  • 116 views

 

Hi,

I am working with the OEMiRoT reference project (STM32U385) and I need to configure a single Secure application image without TrustZone isolation (S-only application), while still keeping the Secure Data Image enabled.

From flash_layout.h, I see the following:

 

 
#define MCUBOOT_APP_IMAGE_NUMBER 1
#define FLASH_NS_PARTITION_SIZE (0x32000) /* default case */

and also this condition:

 
#if (MCUBOOT_APP_IMAGE_NUMBER == 1) && (FLASH_NS_PARTITION_SIZE == 0)
 

which seems to define the “FULL SECURE” case.

Question

To correctly implement an S-only application (no S/NS split) in OEMiRoT:

  • Should I explicitly set both:
    • MCUBOOT_APP_IMAGE_NUMBER = 1
    • FLASH_NS_PARTITION_SIZE = 0

OR

  • Is FLASH_NS_PARTITION_SIZE automatically set to 0 by the OEMiRoT provisioning/build system when selecting the S-only configuration, meaning it should NOT be manually modified in flash_layout.h?

Concern

The header comment suggests that some Flash layout values are automatically generated by the ROT provisioning scripts depending on the selected boot path, so it is unclear whether manual modification is supported or recommended.

Target configuration

  • Single Secure application image (no NS image)
  • No TrustZone isolation at application level
  • Secure Data Image enabled

Any clarification on the correct and recommended configuration flow would be appreciated.

1 reply

Jocelyn RICARD
Jocelyn RICARD
ST Employee
July 6, 2026

Hello ​@stst9187 ,

it looks like there is not much documentation to address this configuration. You need to guess …

So, in order to run with OEMiROT_Appli that is without TrustZone isolation, you need first to update the env.bat (if you are on windows, .sh otherwise) to uncomment the OEMiROT_Appli and comment out the OEMiROT_AppliTrustZone:

:: ==============================================================================
::                            OEMiROT Appli TrustZone path
:: ==============================================================================
:: Select OEMiROT Application TrustZone project below
::set oemirot_appli_path_project=Templates\ROT\OEMiROT_Appli
set oemirot_appli_path_project=Applications\ROT\OEMiROT_Appli
::set oemirot_appli_path_project=Templates\ROT\OEMiROT_Appli_TrustZone
::set oemirot_appli_path_project=Applications\ROT\OEMiROT_Appli_TrustZone

Then update the flash_layout.h the way you did it.

NS_PARTITION_SIZE should be set to 0 in your case.

You can adapt the size and enable data, as well as disable the overwrite mode.

 

If you are not sure about what is actually done, in order to understand what parameters are propagated you can read the content of the postbuild.bat of the OEMiROT.

If uses the “generated” image_macros_preprocessed_bl2.c as input and updates different headers and scripts with computed values.

So, all configuration lies in the env.bat + flash_layout.h + possibly the configuration of the protections in boot_hal_cfg.h

Best regards

Jocelyn

 

 

Terms & ConditionsAccessibility statement