[OpenSTDroid ]STM32MP257F-EV1: Infinite reboot with IAC exception 128 after switching from DFU to eMMC boot – cannot enter fastboot mode

[John Lee]

Hello Experts,

I am working on the STM32MP257F-EV1 board (MB1936 Var1.0 Rev.C-01) and following the official OpenSTDroid provisioning guide. I have successfully used flash-device(STM32CubeProgrammer v2.22.0 ) to flash the full eMMC starter image via DFU mode (FlashLayout_emmc_cm33tdcid.tsv). After that, I switched the boot mode from DFU to eMMC (M33-TD) and pressed USER2 + RESET to enter fastboot mode, as described in the documentation. However, instead of entering fastboot, the board goes into an infinite reboot loop.

Observed behavior:

• Serial console (minicom) shows the following repeated sequence:

  iac exceptions: [159:128]=0x000001
  IAC exception ID: 128
  Ooops...
  [INF] System reset
  [INF] Reset reason: System reset (SYSRST) (0x94)
  [INF] init:pmic@33 STPMIC:20 V1.1
  
  [INF] welcome to MCUboot: TF-Mv2.1.3-4-g0a94de886
  [INF] cpu: STM32MP257FAI Rev.?
  [INF] board: stm32mp257f eval1
  [INF] board ID: MB1936 Var1.0 Rev.C-01
  [INF] dts: stm32mp257f-ev1-cm33tdcid-ostl-emmc-bl2.dts
  [INF] boot device: sdmmc2
  [INF] mcu sysclk: 400000000
  [INF] Loading gpt header
  
  [INF] Starting bootloader
  [WRN] This device was provisioned with dummy keys.
  [WRN] This device is NOT SECURE
  
  [INF] PSA Crypto init done, sig_type: EC-P256
  [INF] Primary   slot: version=0.1.0+0
  [INF] Image 1 Secondary slot: Image not found
  [INF] Image 1 RAM loading to 0xe060000 is succeeded.
  [INF] Image 1 loaded from the primary slot
  [INF] BL2: image 1, enable DDR-FW
  [INF] Primary   slot: version=2.1.3+0
  [INF] Image 0 Secondary slot: Image not found
  [INF] Image 0 RAM loading to 0x80000000 is succeeded.
  [INF] Image 0 loaded from the primary slot
  [INF] Bootloader chainload address offset: 0x180000
  [INF] Jumping to the first image slot
  [INF] init:pmic@33 STPMIC:20 V1.1
  [INF] Enable Macronix quad support
  [INF] welcome to TF-M: TF-Mv2.1.3-4-g0a94de886
  [INF] board: stm32mp257f eval1
  [INF] dts: stm32mp257f-ev1-cm33tdcid-ostl-emmc-s.dts
  Booting TF-M v2.1.3+0a94de886
  [WAR] This device was provisioned with dummy keys.
  [WAR] This device is NOT SECURE
  [Sec Thread] Secure image initializing!
  INFO: low power firmware "v1.0.0"
  [    0.000000] SCP-firmware v2.13.0-stm32mp-r3-1-gb77869ed
  [    0.000000] 
  [    0.000000] [FWK] Module initialization complete!
  [INF][PS] Encryption alg: 0x5500100
  [INF][Crypto] Init HW accelerator...
  [INF][Crypto] Init HW accelerator... complete.
  Non-Secure system starting...
  [NS] [INF] watchdog timeout: 120000ms
  
  iac exceptions: [159:128]=0x000001
  IAC exception ID: 128
  Ooops...
  [INF] System reset
  ... (loop repeats)

  The flash-device script waits forever for a fastboot device and never proceeds. Its last output before hanging is:

  Flashing service completed successfully
  
  Change boot mode from DFU to normal boot (emmc), and select fastboot
  Provisionning remote target through USB fastboot using /home/pp/stm32mp2droid/OSD62V20260526/device/stm/stm32mp2/layout/android_layout.config partition config file
  
  [0] Start device provisioning
  
  

  When I press USER2 + RESET, the board does not​ enter fastboot mode (no fastboot devices on host, serial still shows the reboot loop). 
   

  My environment:

• Host PC: Ubuntu 22.04 inside VMware Workstation

• STM32CubeProgrammer v2.22.0 

• Android distribution built from ST's source code: OSD62V20260526 (compiled locally)

• Board: STM32MP257F-EV1 (MB1936)

• USB cable: same Type‑C port used for DFU and fastboot 

  What I have tried so far:

• Re‑flashed the entire eMMC multiple times using STM32_Programmer_CLI -c port=usb1  -w FlashLayout_emmc_cm33tdcid.tsv – always completes successfully.

• Also tried the _clear.tsv version followed by the _starter version.

• Manually erased the first 1 GB of eMMC from U‑Boot (mmc erase 0 0x200000) and verified it is zeroed, then re‑flashed via DFU.

• Checked udev rules for 0483:0afb – they are present and fastboot devices works when the board is actually in fastboot mode (which rarely happens).
   

  Additional context:

• Before this issue, I had experimented with some fastboot commands likefastboot stage rpmb/rpmbk.bin and fastboot oem run:'mmc rpmb key 0x84000000'. I also attempted fastboot mm dev 1, but it returned unknown command and was skipped. I suspect the RPMB region might now be in an inconsistent state.

• The board reports This device was provisioned with dummy keys and NOT SECURE – this is the default for the starter package, but perhaps my manual RPMB attempts broke the alignment between eMMC RPMB, TF‑M keys, and OTP.

  My questions:

• What exactly causes the IAC exception 128 in this context? Is it a mismatch between the TF‑M secure firmware and the non‑secure side (U‑Boot/Linux), specifically related to RPMB authentication? I want to note that I previously flashed the official ST Yocto Linux image to the same eMMC and it booted successfully without any issues. This confirms the eMMC hardware itself is fine, so the problem is likely related to the Android provisioning or RPMB state.

• Could the RPMB area be corrupted from my previous manual mmc rpmb key attempts? If so, how can I completely reset the RPMB region? Does FlashLayout_emmc_clear.tsv cover the RPMB partition, or do I need additional steps?

• Is there a reliable way to force the board into fastboot mode despite the crash loop? For example, a specific combination of hardware straps or a different key press timing?

• Should I try a different boot source (e.g., SD card) to rule out eMMC corruption, or should I attempt to fully reprovision the device using the flash-device script from a clean state?

• Any guidance would be greatly appreciated. I have attached the full serial log and the exact steps I followed.

  Thank you!
   

  

  

  

  

  

   

[Nicolas L]

Hi John

 

The last OpenSTDroid distribution is compatible only with STM32MP257F rev Y (which mean MB1936 Rev.D-01). You need to use the previous delivery v5.1.1 (Android 13) which is compatible with your board : https://wiki.st.com/stm32mpu-ecosystem-v5/wiki/STM32_MPU_OpenSTDroid_release_note.

 

Regards

Nicolas