SFI + SBSFU Production Setup on STM32U585

[Ananth_]

Hi ST Team,

I am using an STM32U585AII6Q on a custom hardware board. My firmware is based on SBSFU with TrustZone enabled.

For production manufacturing, I would like to provision blank devices using STM Secure Firmware Install (SFI) over the ROM USB DFU interface.

I would appreciate clarification on the following points:

1. What is the recommended procedure to create and use an SFI package that contains both my custom firmware and the required production option bytes?
2. Can the SFI package program both the firmware and the option bytes in a single operation through the USB DFU interface?

3. My intended production option byte configuration is:

   • TrustZone (TZEN) enabled
   • BOOT0 pin tied High on the hardware
   • BOOT_LOCK enabled
   • RDP Level 2 enabled
   • No OEM password provisioning (OEM2 not provisioned)

   Is this configuration supported through the SFI provisioning flow?

4. After the SFI package has been programmed with the above option bytes, can anyone confirm that the ROM USB DFU bootloader will no longer be accessible, since the device will always boot from the secure boot address and BOOT_LOCK/RDP Level 2 are enabled?
5. In this case, is the expected solution for future firmware updates to implement the update mechanism (for example, USB DFU or another communication interface) inside the SBSFU bootloader?

My goal is to understand the correct production provisioning flow for a custom SBSFU + TrustZone application on the STM32U585 before locking the devices with RDP Level 2.

Thank you in advance for your guidance.