Writing provisioning password data to OBKeys causes hard fault

[JimJW]

On an STM32H563, I am trying to write the OBkey1 data.
I have successfully set the product state to provisioning (0x17) with:

    FLASH_OBProgramInitTypeDef optionBytes;
    HAL_FLASHEx_OBGetConfig(&optionBytes);
    HAL_FLASH_Unlock();
    HAL_FLASH_OB_Unlock();

    optionBytes.OptionType   = OPTIONBYTE_PROD_STATE;
    optionBytes.ProductState = OB_PROD_STATE_PROVISIONING;
    HAL_FLASHEx_OBProgram(&optionBytes);
    HAL_FLASH_OB_Launch();
    HAL_FLASH_OB_Lock();

Now, when I try to write too OBKey1 with:

    uint32_t dataAddr = 0x20050000;
    memcpy ((void*)dataAddr, source, 0x60);
    RSSLIB_DataProvisioningConf_t * pConfig = (RSSLIB_DataProvisioningConf_t *)0x20050100;

    pConfig->pSource      = (uint32_t*)dataAddr;
    pConfig->pDestination = (uint32_t*)0xffd0100;
    pConfig->Size         = 0x60;
    pConfig->DoEncryption = 0xCACA0AA0U;
    pConfig->Crc         = 0;

    HAL_FLASHEx_OBK_Unlock();

    provisioningResult = RSSLIB_PFUNC->NSC.DataProvisioning(pConfig);

    HAL_FLASHEx_OBK_Lock();

The call to DataProvisioning() causes a hard fault.

I am aware that the checksum (0) is currently incorrect but the reference manual suggests that should return error code  0xF5F58080U .

My source data is copied to a buffer in SRAM3 (0x20050000) as specified in the RM - I also have  the config struct in SRAM3 (I'm not sure if that is needed or not but it doesn't seem to make a difference).
I would be grateful for any suggestions about what I am doing wrong. I have noticed that SCB->BFSR_S-> IBUSERR is set  to 1 but nothing in BFSR_NS which seems strange because I have Trust Zone disabled and understood that means everything should be Non Secure.

[Jocelyn RICARD]

Hello  ,

you cannot use the DataProvisioning service when TrustZone is disabled because it is a non secure callable service.

Now, as you use a non crypto device (STM32H563), you can just write the data directly in the OBK with your firmware.

I provided an example for crypto device here that you can use as example. You will need to remove the encryption part.

Best regards

Jocelyn