Provisioning STM32H5 via UART and RSS

[aco990]

Hi everyone,
Hi @Jocelyn RICARD, @D.Botelho 

@Jocelyn RICARDyou made this small bootloader example for testing H7 security features, e.g. RDP:
https://community.st.com/ysqtg83639/attachments/ysqtg83639/mcu-security-forum/6051/1/STM32H753_SecureMem_ExampleV1.1.7z

Is it possible to provision H5 MCUs and activate the closed product state using UART like the H7 example above?

What i want is to implement a custom app that can get commands via UART and provision the device.
I would like to have methods like:

void setProductState(State state);
void provisionDevice(const uin8_t* obkey,size_t obkey_size); // provisionDevice would then provision the device using the obkey send via UART.

I see in the reference manual that the RSS offers functions that i can use for the provisioning.

But i read somewhere that in PROVISIONING State the flashed application won't run and the device waits to be provisioned via debugger. If that is the case my idea described above won't work because after setting the PROVISIONING state i can't supply the obkey via UART. So my question before breaking the board is, is it possible to provision the H5 using a custom app via UART?

Thank you!

[Jocelyn RICARD]

Hello @aco990 ,

You can have a look to this code I put on STM32 hotspot.

This is doing the provisioning from embedded software, writing directly into the OBKeys.

On this device the DA must be encrypted. As this encryption uses DHUK, and DHUK is only available if you are not in OPEN state, the firmware first moves to CLOSED state, and then provision the DA.

Best regards

Jocelyn