STM32H563 Provisioning (0x17) - Debug Authentication Discovery Works, Full Regression Fails
Hello ST Community,
I have an STM32H563 (Rev X) that appears to be stuck in the Provisioning state and I am trying to recover it.
Hardware / Tools
MCU : STM32H563
Device ID : 0x484
Revision : Rev X
STM32CubeProgrammer : v2.23.0
Probe : ST-LINK V3SET
ST-LINK FW : V3J16M9B5S1
NRST is connected to the ST-LINK and Debug Authentication discovery is working.
Current Option Bytes
PRODUCT_STATE = 0x1
TZEN = 0xB4 (TrustZone enabled)
BOOT_UBE = 0xB4 (OEM-iRoT selected)
SECWM1_STRT = 0x0
SECWM1_END = 0x7F
SECWM2_STRT = 0x0
SECWM2_END = 0x7F
WRPSGn1 = 0xFFFFFFFF
WRPSGn2 = 0xFFFFFFFF
LOCKBL = 0x0
HDP1_STRT = 0x1
HDP1_END = 0x0
HDP2_STRT = 0x1
HDP2_END = 0x0
Symptoms
I can:
- connect through ST-LINK V3
- read option bytes
- read flash
- erase sectors
I cannot:
- perform Mass Erase
- change PRODUCT_STATE back to 0xED
Attempting: PRODUCT_STATE = 0xED results in:
Expected value for Option Byte "PRODUCT_STATE": 0xED
found: 0x17
Option Byte Programming failed
Or modified by application after OB_LAUNCH
Debug Authentication Discovery
Using:
STM32_Programmer_CLI.exe -c port=SWD mode=HOTPLUG reset=HWrst debugauth=2
I get:
PSA lifecycle...................: ST_LIFECYCLE_PROVISIONING
cryptosystems...................: Ecdsa-P256 SHA256
ST provisioning integrity status: 0xEAEAEAEA
ST provisioning integrity status message: VALID
permission if authorized........: Full Regression
permission if authorized........: To TZ Regression
Discovery completes successfully.
Debug Authentication Discovery succeeds only after connecting NRST to ST-LINK V3SET.
Debug Authentication
Using:
STM32_Programmer_CLI.exe -c port=SWD mode=HOTPLUG reset=HWrst debugauth=1
I provide:
key_3_leaf.pem
cert_leaf_chain.b64
from:
STM32CubeProgrammer\bin\DA_Default_Config\STM32H5
Authentication progresses to:
Found 3 certificates
Signing token
but ends with:
Timeout while receiving response...
Debug Authentication Failed
This happens for both:
(a) Full Regression
(b) To TZ Regression
Additional Information
Earlier I used:
Reset MCU to Factory Settings
and CubeProgrammer reported:
Provisioning using default ST defined DA-Config PASSED
Performing discovery and regression PASSED
After that the device remained in:
PRODUCT_STATE = 0x17
and Debug Authentication became discoverable.
Questions
-
Is there a known recovery procedure for an STM32H563 in
PRODUCT_STATE = 0x17 ST_LIFECYCLE_PROVISIONING when DA Discovery succeeds but DA Authentication fails?
-
Are the default files:
key_3_leaf.pem and cert_leaf_chain.b64 expected to work with the DA configuration installed by "Reset MCU to Factory Settings"?
-
Is there a way to determine which certificate chain/root key is currently provisioned in the device?
-
Is the device recoverable through Full Regression or is another provisioning step required first?
Any help would be greatly appreciated.
Thanks!
