ST X-CUBE-SBSFU, Руководство пользователя, Страница: 26 / 94

Protection measures and security strategy UM2262
26/94 UM2262 Rev 6
Besides, the MPU also ensures that only authorized code is granted execution permission
when the Secure Boot and Secure Firmware Update processes are running. This is the
reason why the MPU configuration is updated before launching the user application to
authorize its execution. Nevertheless, the Secure Engine isolation settings and supervisor
call mechanisms still apply when running the user application (not only when running the
SBSFU code).
5.3 STM32G0 Series, STM32G4 Series and STM32H7 Series
Figure 8 illustrates how the system, the code, and the data are protected in the
X-CUBE-SBSFU application example for the STM32G0 Series, STM32G4 Series and
STM32H7 Series.
For the specificities of STM32H7B3 devices, refer to appendix I.3 External Flash on
STM32H7B3 devices .
Figure 8. STM32G0, STM32G4 and STM32H7 protection overview during SBSFU execution
Table 4. MPU regions in the STM32F4 Series, STM32F7 Series and STM32L1 Series
Region content Privileged permission Unprivileged permission
Secure Engine code & constants
Read Only
(execution allowed)
No access
Secure Engine stack & VDATA
Read Write
(not executable)
No access