Secure Firmware Install over USB on STM32H743

[scottro]

Is it possible to securely install firmware over USB on the STM32H743?  I am getting the error below when trying to download my SFI file.  MCU has been powered up with BOOT_0 pin high.  STM32CubeProgrammer finds and connects correctly to chip.

11:03:34 : Starting Firmware Install operation...
11:03:34 : Activating security...
11:03:34 : Time elapsed during option Bytes configuration: 00:00:00.145
11:03:34 : Error: Activating security Failure
11:03:34 : OPTION BYTES BANK: 0
11:03:34 : Read Out Protection:
11:03:34 : RDP : 0xAA (Level 0, no protection)
11:03:34 : BOR Level:
11:03:34 : BOR_LEV : 0x0 (reset level is set to VBOR0)
11:03:34 : User Configuration:
11:03:34 : IWDG1_SW : 0x1 (Independent watchdog is controlled by software)
11:03:34 : IWDG2_SW : 0x1 (Independent watchdog is controlled by software)
11:03:34 : NRST_STOP_D1 : 0x1 (STOP mode on Domain 1 is entering without reset)
11:03:34 : NRST_STBY_D1 : 0x1 (STANDBY mode on Domain 1 is entering without reset)
11:03:34 : FZ_IWDG_STOP : 0x1 (Independent watchdog is running in STOP mode)
11:03:34 : FZ_IWDG_SDBY : 0x1 (Independent watchdog is running in STANDBY mode)
11:03:34 : SECURITY : 0x0 (Security feature disabled)
11:03:34 : BCM4 : 0x1 (CM4 boot enabled)
11:03:34 : BCM7 : 0x1 (CM7 boot enabled)
11:03:34 : NRST_STOP_D2 : 0x1 (STOP mode on Domain 2 is entering without reset)
11:03:34 : NRST_STBY_D2 : 0x1 (STANDBY mode on Domain 2 is entering without reset)
11:03:34 : SWAP_BANK : 0x0 (after boot loading, no swap for user sectors)
11:03:34 : IO_HSLV : 0x0 (Product working in the full voltage range, I/O speed optimization at low-voltage disabled)
11:03:34 : Boot address Option Bytes:
11:03:34 : BOOT_CM7_ADD0: 0x800 (0x8000000)
11:03:34 : BOOT_CM7_ADD1: 0x1FF0 (0x1FF00000)
11:03:34 : BOOT_CM4_ADD0: 0x810 (0x8100000)
11:03:34 : BOOT_CM4_ADD1: 0x1000 (0x10000000)
11:03:34 : PCROP Protection:
11:03:34 : PROT_AREA_START1: 0xFF (0x800FF00)
11:03:34 : PROT_AREA_END1: 0x0 (0x80000FF)
11:03:34 : DMEP1 : 0x1 (Flash Bank 1 PCROP zone is erased when RDP level regression (change from level 1 to 0) occurs)
11:03:34 : PROT_AREA_START2: 0xFF (0x810FF00)
11:03:34 : PROT_AREA_END2: 0x0 (0x81000FF)
11:03:34 : DMEP2 : 0x1 (Flash Bank 2 PCROP zone is erased when RDP level regression (change from level 1 to 0) occurs)
11:03:34 : Secure Protection:
11:03:34 : SEC_AREA_START1: 0xFF (0x800FF00)
11:03:34 : SEC_AREA_END1: 0x0 (0x80000FF)
11:03:34 : DMES1 : 0x0 (Flash Bank 1 secure area is kept when RDP level regression (change from level 1 to 0) occurs)
11:03:34 : SEC_AREA_START2: 0xFF (0x810FF00)
11:03:34 : SEC_AREA_END2: 0x0 (0x81000FF)
11:03:34 : DMES2 : 0x0 (Flash Bank 2 secure area is kept when RDP level regression (change from level 1 to 0) occurs)
11:03:34 : DTCM RAM Protection:
11:03:34 : ST_RAM_SIZE : 0x0 (2 KB)
11:03:34 : Write Protection:
11:03:34 : nWRP0 : 0x1 (Write protection not active on this sector)
11:03:34 : nWRP1 : 0x1 (Write protection not active on this sector)
11:03:34 : nWRP2 : 0x1 (Write protection not active on this sector)
11:03:34 : nWRP3 : 0x1 (Write protection not active on this sector)
11:03:34 : nWRP4 : 0x1 (Write protection not active on this sector)
11:03:34 : nWRP5 : 0x1 (Write protection not active on this sector)
11:03:34 : nWRP6 : 0x1 (Write protection not active on this sector)
11:03:34 : nWRP7 : 0x1 (Write protection not active on this sector)
11:03:34 : nWRP8 : 0x1 (Write protection not active on this sector)
11:03:34 : nWRP9 : 0x1 (Write protection not active on this sector)
11:03:34 : nWRP10 : 0x1 (Write protection not active on this sector)
11:03:34 : nWRP11 : 0x1 (Write protection not active on this sector)
11:03:34 : nWRP12 : 0x1 (Write protection not active on this sector)
11:03:34 : nWRP13 : 0x1 (Write protection not active on this sector)
11:03:34 : nWRP14 : 0x1 (Write protection not active on this sector)
11:03:34 : nWRP15 : 0x1 (Write protection not active on this sector)
11:03:34 : Error: failed to activate security!

[Aziz BRIGUI]

Hello @scottro

Could you please provide further details ?

Did you test using the CLI, what is the initial OB configuration, what HSM are you using ?..

The more details you provide the higher the chance of getting the support you need either from ST or from community members.

Have a nice day,

Aziz

[Pavel A. · Accepted solution]

STM32H743 has no "secure area" (a.k.a. hide protection, HDP). This is the reason of "Error: Activating security Failure". If SFI cannot work without that, too bad. You need STM32H753.