Replace Factory Bootloader with Custom Secure Bootloader on STM32U3 ?

[ashraf21]

Hi ST Community,

I’m working on a secure boot implementation for the STM32U3 series and need to replace the factory ROM bootloader with my custom secure bootloader. Here’s what I’d like to clarify:

Can We Fully Remove the Factory Bootloader?

• The STM32U3’s ROM bootloader (System Memory) is in masked ROM, so is it even possible to erase or disable it completely?
• If not, what’s the most secure way to bypass it and ensure the MCU always boots from my custom bootloader in Flash?

[Andrew Neil]

No, you can't replace it.

[TDK]

> The STM32U3’s ROM bootloader (System Memory) is in masked ROM, so is it even possible to erase or disable it completely?

Read-only Memory (ROM) is read only and cannot be changed.

> If not, what’s the most secure way to bypass it and ensure the MCU always boots from my custom bootloader in Flash?

Change the option bytes such that the chip always boots to user flash, regardless of pin settings. Look at AN2606 and change NBOOT0 = NSWBOOT0 = 0 to avoid bootloader patterns.