STM32H573 code protection

abba · ‎2025-10-01

How can the debug interface on the STM32H573 be permanently locked via nonvolatile configuration or fuse?

The SBS chapter of the manual says

The debug configuration can be locked thanks to DBGCFG_LOCK in SBS_DBGLOCKR.
SBS_DBGCR is then no longer writable.
When DBGCFG_LOCK is set to 1, it can be reset only by system or power-on reset.

So SBS_DBGLOCKR is not what I want, as it is not permanent.

The manual refers to PRODUCT_STATE in several places. The "SBS Signals" table in the manual says that the sbs_product_state signal comes from Flash memory:

Signal based on PRODUCT_STATE option byte to activate the different security
mechanisms depending on the product use. Expected values are described in
Section 7: Embedded flash memory (FLASH).

However, there is no mention of this signal in Section 7. What is the Flash programming procedure to change sbs_product_state?

Frantz LEFRERE · ‎2025-10-01

hello @abba

I would recommend to have a look in the product state description in the wiki :

https://wiki.st.com/stm32mcu/wiki/Category:Security_with_STM32H5#Product_State

https://wiki.st.com/stm32mcu/wiki/Security:Product_state_for_STM32H5

If you want to deactivate the debug link permanently without any way to reopen it then just move to Locked state.
Be carefull in such config no way to reopen the device.
This is just an option byte that could be program thanks debuging link or from the embedded sofware.

Br,

Frantz

abba · ‎2025-10-09

Hello Frantz,

Yes, I have searched these documents as well as many other ST documents that refer to the product state, as well as the existence of option bytes, tools that might query these option bytes, and the meaning of the product states. It is important to understand these things and fun to talk about them in the abstract.

However, in order to use the feature, I need documentation on the format (and access sequence, if applicable) for these option bytes, that could be integrated into a custom production fixture. Here is an example of the kind of documentation that I am looking for, and have used for a competitor MCU. This is a critical feature for my product, and therefore actionable documentation is important for determining whether the ST parts can work for me.

I appreciate your help.

abba · ‎2025-10-20

I found the address, encodings, and access sequence on this stackexchange thread.