Flash TrustZone‑enabled firmware with SBSFU using USB DFU (CubeProgrammer)?

[Ananth_]

Hello ST Community,

I am working with an STM32U585 custom board and I would like to clarify the supported and recommended workflow for flashing TrustZone‑enabled firmware with SBSFU using USB DFU via STM32CubeProgrammer.

Hardware / Software Setup

• MCU: STM32U585
• Custom hardware board
• Tool: STM32CubeProgrammer v2.19.0
• Interface tested:
  • ST‑LINK (SWD)
  • USB DFU
• Security configuration:
  • TrustZone enabled (TZEN = 1)
  • SBSFU (Secure Boot & Secure Firmware Update) used

---

What works (via ST‑LINK / SWD)

Using STM32CubeProgrammer CLI with ST‑LINK, I am able to successfully flash all components:

1. SBSFU bootloader

   • File: SBSFU.bin 
   • Address: 0x0C004000

2. Initial SBSFU application image

   • File: sbsfu_app_init.bin
   • Size: ~1.80 MB (0x1c000)
   • Address: 0x0C030000 

The script erases the correct flash sectors, programs the binaries, verifies them successfully, and the board boots correctly.

So SWD flashing works as expected for:

• TrustZone‑enabled device
• SBSFU bootloader
• SBSFU application slot

---

What I am trying to understand (USB DFU case)

After SBSFU and TrustZone are enabled, I tried to flash the same application image using USB DFU via STM32CubeProgrammer.

Observed behavior in CubeProgrammer DFU log:

• When attempting to write to 0x0C030000 , CubeProgrammer reports:

  Warning: Translated to 0x08030000 to be accessible by the Bootloader interface

• It also reports:

  Not flash memory: No erase done

• The DFU transfer completes, but the firmware does not boot, which is expected since the address is translated.

This indicates that:

• USB DFU bootloader cannot access 0x0cxxxxx secure flash regions
• CubeProgrammer remaps the address to 0x0803xxxx, which is not the SBSFU application slot

---

My Understanding So Far

From my experiments, it appears that:

• ROM USB DFU:
  • Can only access non‑secure flash regions
  • Cannot program SBSFU slots (0x0cxxxxx )
• SBSFU‑based DFU:
  • Does not allow absolute address programming
  • Expects a signed application image
  • SBSFU internally decides where to write the image (slot0)

    Questions to the Community / ST Team

    1. Is it supported to flash a TrustZone‑enabled device with SBSFU bootloader entirely using USB DFU via STM32CubeProgrammer (without ST‑LINK)?
    2. Is the correct approach that ST‑LINK is mandatory at least once (factory provisioning) to install SBSFU and enable TrustZone, and USB DFU can only be used later for signed application upgrades?
    3. Is it correct that sbsfu_app_init.bin is only meant for SWD provisioning and not for USB DFU updates?
    4. For USB DFU with SBSFU, should CubeProgrammer be used without specifying any flash address, letting SBSFU handle the internal placement?
    5. Is there any official ST documentation explicitly stating that SBSFU + TrustZone cannot be initially flashed via USB DFU?