Skip to main content
MarioM
Associate II
September 4, 2026
Solved

STM32H573 Secure Manager – Change PRODUCT_STATE from TZ-CLOSED to CLOSED at runtime without SWD/JTAG

  • September 4, 2026
  • 2 replies
  • 23 views

Hi everbody,

we are using an STM32H573 with ST Secure Manager and would like to perform the final Product State transition from TZ-CLOSED to CLOSED at the end of production.

At this point, the device is already assembled and SWD/JTAG is no longer accessible. Therefore, we would like to trigger the transition through an authenticated internal command from the Non-Secure application.

From the documentation, we understand that:

  • PRODUCT_STATE is controlled via Flash Option Bytes.
  • The Non-Secure application cannot directly modify the relevant Secure Flash registers.
  • We could not find a documented Secure Manager runtime API for changing the Product State.

Could you please clarify:

  1. Is there an existing Secure Manager API to perform TZ-CLOSED → CLOSED at runtime without SWD/JTAG?
  2. If not, can this be implemented via an OEM Secure Module?
  3. Is an OEM Secure Module allowed to modify the PRODUCT_STATE Option Byte?

Thanks and best regards

Mario

Best answer by Jocelyn RICARD

Hello ​@MarioM ,

This is normal that you cannot change the product state from application, it does not have such right.

One first question: why do you set TZ-CLOSED in production instead of CLOSED directly.

Do you need to do some tests in TZ-CLOSED ?

If not, you just need to change the value of product state in Option_Bytes.csv from 0xC6 to 0x72

You can also change in the SM_Config_Other.xml the minimal product state from 0xC6 to 0x72.

Best regards

Jocelyn 

2 replies

Jocelyn RICARD
Jocelyn RICARDBest answer
ST Employee
September 4, 2026

Hello ​@MarioM ,

This is normal that you cannot change the product state from application, it does not have such right.

One first question: why do you set TZ-CLOSED in production instead of CLOSED directly.

Do you need to do some tests in TZ-CLOSED ?

If not, you just need to change the value of product state in Option_Bytes.csv from 0xC6 to 0x72

You can also change in the SM_Config_Other.xml the minimal product state from 0xC6 to 0x72.

Best regards

Jocelyn 

    MarioMAuthor
    Associate II
    September 4, 2026

    Hi ​@Jocelyn RICARD,

    thanks for the reply! Yes, I had read that in the documentation too. I just wanted to double-check to make sure I hadn't missed anything. For whatever reason, the customer wants to start production in TZ-Closed and only switch to CLOSED at the end, after the tests have been successfully completed. However, since the tests aren't performed via SWD/JTAG but rather via Ethernet—and therefore debug authentication isn't required—I don't see any reason not to start directly in CLOSED from the very beginning. Thanks again.

     

    Best regards

    Mario

    Terms & ConditionsAccessibility statement