STM32 MCUs Security

Hello,I would like clarification on the behaviour of STM32U3 devices when Readout Protection (RDP) Level 1 is enabled.Configuration:TrustZone: DisabledDebug interface: SWD/JTAGQuestions:With RDP Level 1, is Flash completely unreadable by any third-party tool or by any boot mode (system memory boot, RAM boot, etc.), except when accessed by application code running on the MCU?With RDP Level 1, is application debugging still supported (attach debugger, halt, step, breakpoints), and are there any known limitations compared to RDP Level 0?Any confirmation or documentation reference would be appreciated.Thank you,Vijay

Hi, I am trying to implement DA on an stm32H563, I have created the .obk file, and was selected in the Stm32Programmer. I have changed the product_state to provisioning and I got the message "Do you want to use the default?"I clicked YES and I got the default DA, located in ..\STM32CubeProgrammer\bin\DA_Default_Config\STM32H5I was able to perform a full regression and then I tried again to flash and secure the chip, and this time I did choose "NO" to the default. Now I have tried my DA password and the default and none of them works. Also, I did at first tried to provision the mcu with my obk file, but was complaining about the OB not in provisioning. So after the provisioning I got locked out.Can the board be saved in any way or I have just bricked an mcu?I am using the STM32H563 NucleoThanksAle

I'm working on a project which is being ported over to be TrustZone aware, part of this project makes use of an OCTOSPI configured in memory mapped mode for file access. Base settings come from the IOC however the memory mapping is executed in source.In the non-TrustZone project this works without issue, however in the TrustZone aware one it is triggering a SecureFault upon trying to access a memory region. // Sample access that causes the SecureFault uint32_t testAccess = *(uint32_t *)0x90008000; The SAU reports an AUTHVIOL error for the address 0x9000_8000.The SAU is configured to enable NonSecure access to the region 0x9000_0000 through 0x9FFF_FFFF.The MPCWM settings have also been configured to mark the same region as NonSecure and UnprivilegedThe OCTOSPI DMA channel is configured for NonSecure and UnprivilegedThe MPU is disabled, however we have also

Hello,After creating a new project based on the FreeRTOS_Queues_ThreadFlags_TrustZone example from MX and generating code, there is a compile error:[build] C:/Users/tuoma/AppData/Local/stm32cube/bundles/gnu-tools-for-stm32/13.3.1+st.9/bin/../lib/gcc/arm-none-eabi/13.3.1/../../../../arm-none-eabi/bin/ld.exe: CMakeFiles/FreeRTOS_Queues_ThreadFlags_TrustZone_AppliNonSecure.dir/Src/stm32n6xx_hal_timebase_tim.c.obj: in function `HAL_InitTick': [build] C:/Users/tuoma/STM32Cube/Example/FreeRTOS_Queues_ThreadFlags_TrustZone/AppliNonSecure/Src/stm32n6xx_hal_timebase_tim.c:56:(.text.HAL_InitTick+0x1e): undefined reference to `HAL_RCCEx_GetTIMGFreq' [build] Memory region Used Size Region Size %age Used [build] RAM: 66120 B 511 KB 12.64% [build] collect2.exe: error: ld returned 1 exit status [build] ninja: build stopped: subcommand failed. [build] ninja: build stopped: subcommand failed. [proc] The command: cube-cmake --build C:/Us

I have a working program on my own board using a STM32G081KBU6. Debug using SWD and programming a release version works fine. As long as RDP remains at Level 0, I'm able to debug, erase and reprogram updates to the board.Usually for other ST MCU's that I've used, once I've finalized a release version, I usually do the bare minimum of changing RDP to Level 1 to prevent code readout. If I need to do a firmware update, I'll just regress RDP back to Level 0 and update to the new version.However, for this device, once I change the RDP to level 1, it seems like the SWD debug port is completely killed, and Cube programmer is unable to connect to the device anymore.I've tried all the connection and reset modes in Cube programmer, including powering the board on and trying to connect immediately. I'll only keep getting this error.

Hello, I'm posting a new message because the previous one was not answered with successful connection. The problem is that when MCU is populated on my board with Read-Our Protection enabled, it is not possible to connect STM32CubeProgrammer v.2.21.0 to that MCU, it becomes a brick.This option was available in the version 2.0.0. that doesn't work on Windows 11.How can be done two step connection: 1) full erase and 2) connection ? Thanks,Alex

Hello,I'm looking for some clarification over how the PCROP area can be used.  The user manual for STM32L471 states that code in this area can be executed but that data at flash in this area cannot be read.   Does this mean if I put a decryption algorithm in this area that I cannot also put the key in this area also? As is would be unreadble?  Nick. 

Good morning everyone,I need to apply the "Closed" product state to my device using the STM32H573VI.I don't need TrustZone enabled and want to use a password for debug authentication.I wanted to perform the operation via "code" using the HALs, but once I set the state to "Provisioning(0x17)" from "Open(0xED)," my firmware won't boot, and I can't even provision the *.obk file using the STM32CubeProgrammer.bool ProductState::set(states newState) { FLASH_OBProgramInitTypeDef flashOptionBytes= {0}; HAL_StatusTypeDef ret {HAL_ERROR}; if(newState == states::Unknown) { Log::msg("Invalid product state\n"); return false; } Log::msg("Setting product state to %s ...\n", toString(newState).c_str()); HAL_FLASH_Unlock(); HAL_FLASH_OB_Unlock(); flashOptionBytes.OptionType = OPTIONBYTE_PROD_STATE; flashOptionBytes.ProductState = (static_cast<uint32_t>(newState) << FLASH_OPTSR_PRODUCT_STATE_Pos

 I have exported X509 certificate from STM32H573I-DK board, and checked how it is organised.The certificate was issued by "ST CA 01 for STM32 Initial Attestation".I would like to verify whether it is truely signed by ST's upper-level certificate.Where can I find the upper-level certificate? 

Hi ST team,I am using STM32U5G9 in my project. It would need simple firmware update feature and the image would be received by UART from a zigbee module.I have read UM2851 and AN5447 application notes and check the SBSFU example in STM32CubeU5 package (v1.8.0) in github. I believe this is what my project needs:1. MCUBOOT (Secure area)2. NS Application (non-secure primary slot)3. Nonsecure image secondary slot (for firmware update)4. Authentication and integrity check5. SWAP mode with scratch region I want to maximize the flash usage, so it doesn't need:1. Secure application2. Secure data3. Non-secure data4. Loader5. Encryption The bootloader would verify the signature in primary slot and execute the NS application. NS application would write the new image into Nonsecure image secondary slot when firmware update is needed.

We need to develop an offline programmer to program the STM32H562VIT. The product state need to be changed to Closed with an OBK file programmed. The OBK data only in HDPL1.We can't simply use the RSS to program the OBK like STM32Cubeprogrammer. We could only write and read the flash registers by SWD.When in OPEN state, we could program the OBK files successfully, then we change the state to provisioning and closed. But if we first change the state to Provisioning, then try to program the OBK data , the programming of OBK is always failed.So our questions is how to program the OBK file  data when in Provisioning state for a third programmer?

STM32 H573 TrustZone Enabled question. I'm executing the STM32 H573 example for TrustZone Enabled (OEMiROT, Secure, and Non Secure Apps).  I know the OEMiROT and Non Secure App prints out and logs info, but I want to be able to do that in the Secure App for logging purposes - errors and debugging.  I tried to use Gemini to create code that does that, but there appears to be many security hoops to jump through to do that, and I have been unsuccessful.  Do you have an example of what I can do to do this?   Gemini creates the following functions and instructs me to place it under the Non Secure App and call it from a Secure App function, but I keep running into the problem of where I'm getting multiple definition of `NS_putc_utility'  error. /*** @brief Non-Secure Call-able (NSC) function tha

Hello, I am looking for guidance regarding the STM32H533 MCU, specifically in the area of secure and non-secure memory management.Could you please let me know if there is a dedicated application note that explains how to store and manage encrypted keys on the STM32H533?Additionally, is there an application note or reference that provides a step-by-step example demonstrating the use of secure flash, secure memory, or secure storage on this MCU? Thank you for your support.Best regards,Aymen

Hi,I am using STM32H563 with OEMiROT_Boot example project, I got a problem to read the FLASH_SIZE register (0x08FFF80C).I found two issues,(1) the value of this register is 0 at begining of OEMiROT_Boot main() function.(2) the register become not accessable after sau_init_cfg(). Snaku

Hi,I am using STM32H56x with OEMiROT_Boot example project, and I use MCUBOOT_SWAP_USING_SCRATCH to install application images, is there an API like boot_set_confirmed( ) can used by secure applicaiton code, or a confirmation flag in SRAM like STM32H7?Thank you,Snaku

Hello, I have an STM32H755 nucleo board and I want to use the secure memory area features but I need to clarify my understanding of the reference manual "rm0399" and some follow up questions.My understanding is that:From my normal code (non-secure) in standard mode you enable secure access mode.Then an MCU reset is triggered.Then from my normal code in secure access mode I call RSS_resetAndInitializeSecureAreas that is mentioned in page 258 in the reference manual with the memory area I need to setup to be my secure code and this request triggers a reset.After reset the MCU enters the RSS ROM instead of my normal boot code and then it jumps to my secure code that won't exit it until the API RSS_exitSecureArea.Q1: If I don't call the RSS_exitSecureArea can I keep the secure code running on CM7, Can I run a normal non-secure application on CM4?Q2: Does the RSS have a feature to authenticate a bootloader c

All the provided examples are using USART YMODEM to transfer data. I know, that it really doesn't matter what kind of protocol you use as long as image is placed in a correct place in the memory, but I wonder if I can use DFU feature to update firmware and still use SBSFU. Additionaly is there any reference or resource that supports we only have to upload .sfb file and we can't use .bin file? If we have to use .sfb file only then what is the correct method of downloading it because we can't download .sfb file through cli as it doesnot support .sfb extension and same I am not able to upload it through STM32 CUBE Programmer.

Hi Team,Firmware file are just signed not encrypted through STM32 SigningTool - stm32mcu (STM32_SigningTool_CLI.exe) after generating public and private keys through STM32_KeyGen_CLI.exe.Public key in raw 64 bytes is provided to bootloader_main.c as constant and hash is calculated from firmware data file after placing it at known location.Able to verify magic number as after signing a firmware file a header of 256 bytes is placed at top but failing to verify ECDSA signature. Using API ECDSAverify from legacy_v3 cryptographic library to verify signature.Please anyone help me with example as a reference to know where it is getting wrong.

HelloDo I unterstand correctly that the recommended secure boot option for STM32L4 is SBSFU?It seems that the only resource on how to get started with examples is the playlist on YouTube where a non signed exe from google drive has to be installed.Is there another way to get started with an example that doesn't involve having to install an exe from google drive?Are the scripts shown on the video available without installing the exe?I would really appreciate some guidance.Thank you very much in advance.

Hi everyone,Hi @Jocelyn RICARD, @D.Botelho @Jocelyn RICARDyou made this small bootloader example for testing H7 security features, e.g. RDP:https://community.st.com/ysqtg83639/attachments/ysqtg83639/mcu-security-forum/6051/1/STM32H753_SecureMem_ExampleV1.1.7zIs it possible to provision H5 MCUs and activate the closed product state using UART like the H7 example above?What i want is to implement a custom app that can get commands via UART and provision the device.I would like to have methods like: void setProductState(State state); void provisionDevice(const uin8_t* o

Hi ST Team, I am using STM32H7S78-DK development board.I have read and tested following article:https://wiki.st.com/stm32mcu/wiki/Security:STiRoT_for_STM32H7Shttps://wiki.st.com/stm32mcu/wiki/Security:OEMiRoT_OEMuRoT_for_STM32H7Shttps://wiki.st.com/stm32mcu/wiki/Security:How_to_start_with_STiRoT_OEMuRoT_on_STM32H7SI need some help on my project.In How_to_start_with_STiRoT_OEMuRoT_on_STM32H7S wiki page, I got the correct result following "1.5 Full regression" section. But for the "3.1 Debug Opening procedure" section, I got error

On a secured STM32H7Sx device (in CLOSED or LOCKED product state), what is the recommended way of passing volatile data to lower HDPL levels?According to the reference manual, the SBS_RSSCMDR register can be used to pass volatile data from HDPL 1, 2 or 3 to HDPL 0 (RSS), so that part of the answer is covered:Bits 15:0 RSSCMD[15:0]: RSS commandThe application can use this bitfield to pass on a command to the RSS, executed at thenext reset.But what if you want to pass volatile data from HDPL 2 or 3 to HDPL 1?(E.g., HDPL 2 wants to call into HDPL 1 so HDPL 2 first needs to write some volatile command somewhere, then execute a reset, then HDPL 0 (RSS) boots, then HDPL 1 boots and picks up the volatile command from somewhere.)SBS_RSSCMDR cannot be used because RSS will interpret this value as well, and RSS might clear this value at the m

Hi everyone, I was trying to port TFM + TFM_SB on my STMU575ZI-Q Nucleo following this guide: https://www.st.com/resource/en/user_manual/um2851-getting-started-with-stm32cubeu5-tfm-application-stmicroelectronics.pdf and I've managed to flash secure bootloader and TFM. I've managed to do the regression of the MCU setting the option bytes. When I finally lunched TFM_UPDATE.sh script, logs appeared on tera term as expected, but in the end it got stuck in TFM BOOT log. So I disconnected the board and tried to repeat the process, cleaning and building again the TFM SB image, TFM Appl image etc... But When I tried to mass erase the system flash, an error has occurred: DEV TARGET NOT HALTED. When I reset the board and I observe tera term logs, I can see the following:

HelloI am developing on the STM32H7B3-DK using X-CUBE-SBSFU v2.7.0 with IAR compiler version 9.70. During the build, I encountered the following critical error:Fatal error[Li004]: file "STM32CryptographicV3.1.3_CM7_IARv8.a" is not an object or archive fileIt appears that the provided static library (STM32CryptographicV3.1.3_CM7_IARv8.a) was built with IAR v8.x and is incompatible with IAR v9.70, preventing successful linking. The static library is present in STM32CubeExpansion_SBSFU_V2.7.0\Middlewares\ST\STM32_Cryptographic\Fw_Crypto\STM32H7A3\LibCould you please advise:Is there an official version of the STM32 Cryptographic static library compatible with IAR v9.x for STM32H7B3?

Hello,I have already read the AN4758 application note and I still have a few questions regarding PCROP.I have a project for end-users where the main application provides functions (API) that users can call to develop their own code. I was originally planning to provide these functions as a static library, but since PCROP is very useful and secure, I would prefer to protect my API using PCROP instead of distributing a library with unnecessary header files.In my application, the region 0x08000000 to 0x0805DFFF contains my API code. I plan to flash this code first and then protect this area with PCROP.Here are my questions:If the end-user creates an empty project and I only provide the header files, can they still debug their own application even though the API code region is PCROP-protected?Since a PCROP-protected area cannot be read or written, is there any way to update my API code later? I