The table below details the boot modes when the TrustZone is enabled.
Table 5.
Boot modes when TrustZone is enabled (TZEN = 1)
BOOT_
LOCK
nBOOT0
FLASH_
OPTR[27]
BOOT0
pin
PH3
nSWBOOT0
FLASH_
OPTR[26]
RSS
command
Boot address
option
‑
byte selection
Boot area
ST
programmed
default value
0
-
0
1
0
SECBOOTADD0[24:0]
Secure boot
address defined by
user option bytes
SECBOOTADD0[24:0]
Flash:
0x0C00 0000
-
1
1
0
N/A
RSS
RSS:
0x0FF8 0000
1
-
0
0
SECBOOTADD0[24:0]
Secure boot
address defined by
user option bytes
SECBOOTADD0[24:0]
Flash:
0x0C00 0000
0
-
0
0
N/A
RSS
RSS:
0x0FF8 0000
-
-
-
≠ 0
N/A
RSS
RSS:
0x0FF8 0000
1
-
-
-
-
SECBOOTADD0[24:0]
Secure boot
address defined by
user option bytes
SECBOOTADD0[24:0]
Flash:
0x0C00 0000
5.2
Embedded bootloader and RSS
The embedded bootloader is located in the system memory and programmed by ST during production. It is used
to reprogram the Flash memory by using the following serial interfaces:
•
USART
: USART1 on pins PA9/PA10, USART2 on pins PA2/PA3, USART3 on pins PC10/PC11
•
I2C
: I2C1 on pins PB6/PB7, I2C2 on pins PB10/PB11, I2C3 on pins PC0/PC1
•
SPI
: SPI1 on pins PA4/PA5/PA6/PA7, SPI2 on pins PB12/PB13/PB14/PB15, SPI3 on pins PB5/PG9/PG10/
PG12
•
FDCAN
1 on pins PB8/PB9
•
USB
in device mode through the DFU (device firmware upgrade) interface, on pins PA11/PA12
For further details on STM32 bootloader, refer to the application note
STM32 microcontroller system memory boot
mode
(AN2606).
The RSS (root secure services) are embedded in a Flash memory area named secure information block,
programmed during ST production.
The RSS enables for example the SFI (secure firmware installation) using the RSS extension firmware
(RSSe SFI). This feature allows the customers to protect the confidentiality of the firmware to be provisioned into
the STM32 device when the production is subcontracted to a third party. Refer to the application note
Overview
secure firmware install (SFI)
(AN4992).
The RSS is available on all devices, after enabling the TrustZone through the TZEN option bit.
AN5373
Embedded bootloader and RSS
AN5373
-
Rev 1
page 21/37