The table below details the boot modes when the TrustZone
®
is enabled.
Table 5. Boot modes when TrustZone
®
is enabled (TZEN = 1)
BOOT_
LOCK
nBOOT0
FLASH_
OPTR[27]
BOOT0
pin
PH3
nSWBOOT0
FLASH_
OPTR[26]
RSS
command
Boot address
option‑byte selection
Boot area
ST
programmed
default value
0
-
0 1 0 SECBOOTADD0[24:0]
Secure boot address
defined by user option
bytes
SECBOOTADD0[24:0]
Flash:
0x0C00 0000
- 1 1 0 N/A RSS
RSS:
0x0FF8 0000
1 - 0 0 SECBOOTADD0[24:0]
Secure boot address
defined by user option
bytes
SECBOOTADD0[24:0]
Flash:
0x0C00 0000
0 - 0 0 N/A RSS
RSS:
0x0FF8 0000
- - - ≠ 0 N/A RSS
RSS:
0x0FF8 0000
1 - - - - SECBOOTADD0[24:0]
Secure boot address
defined by user option
bytes
SECBOOTADD0[24:0]
Flash:
0x0C00 0000
5.2 Embedded bootloader and RSS
The embedded bootloader is located in the system memory and programmed by ST during production. It is used
to reprogram the flash memory by using the following serial interfaces:
• USART: USART1 on pins PA9/PA10, USART2 on pins PA2/PA3, USART3 on pins PC10/PC11
• I2C: I2C1 on pins PB6/PB7, I2C2 on pins PB10/PB11, I2C3 on pins PC0/PC1
• SPI: SPI1 on pins PA4/PA5/PA6/PA7, SPI2 on pins PB12/PB13/PB14/PB15, SPI3 on pins PB5/PG9/PG10/
PG12
• FDCAN: FDCAN1 on pins PB8/PB9
• USB in device mode through the DFU (device firmware upgrade) interface, on pins PA11/PA12
For further details on the STM32 bootloader, refer to document [2].
The RSS (root secure services) are embedded in a flash memory area named secure information block,
programmed during ST production.
The RSS enable, for example, the SFI (secure firmware installation) using the RSS extension firmware
(RSSe SFI). This feature allows the customers to protect the confidentiality of the firmware to be provisioned into
the STM32 device when the production is subcontracted to a third party. Refer to document [4].
The RSS are available on all devices, after enabling the TrustZone
®
through the TZEN option bit.
AN5373
Embedded bootloader and RSS
AN5373 - Rev 6
page 29/47
To Next Page
Loading...
Need help?
General
