Secure bootloader for STM32H735

BalazsP · ‎2026-02-05

Hi ST team,

I am trying to develop a secure bootloader and firmware update solution for STM32H735 MCU. I was looking at ST's implementations, SBSFU legacy and SBSFU by MCUboot. Could you give me some guidance, which would be the better choice to start from and port to my chip? I saw that SBSFU by MCUboot is targeted only to STM32H7S, and not STM32H7, so I assume if I want to go with MCUBoot, most of the code built on top of MCUBoot by ST is not going to be usable for me, is that correct?

I need these features for the bootloader:

immutable bootloader implementation
application authentication (using signature verification)
secure application update
anti-rollback protection
A/B update scheme to provide a fallback option
Preferably support for TCP communication for image download (or allowing easy integration for it)

Thank you for your help.

Jocelyn RICARD · ‎2026-02-06

Hello @BalazsP ,

Porting a X-CUBE-SBSFU H7 project would be the easiest way to go, I guess.

You can start from Projects\NUCLEO-H753ZI\Applications\2_Images\ for instance.

It uses Ymodem to download update but if you already have your own application with TCP you just need to reuse the part that writes to the flash (the Ymodem callback actually).

Best regards

Jocelyn

BalazsP · ‎2026-02-10

Thank you @Jocelyn RICARD
Is my understanding correct that for the core functionalities I will just need to modify memory mapping, and change the flash driver to single bank operations? Or are there other underlying differences in the security features of the 2 microcontrollers?