Stm32H5 Debug Authentication Services Description; Discovery Service; Discovery Service Details; Cli Command For Discovery Command - ST STM32H5 Series Getting Started

3

STM32H5 debug authentication services description

3.1

Discovery service

3.1.1

Discovery service details

The discovery service allows the user to get information about the device state, especially when debug is closed.
The discovery service is available through the STM32CubeProgrammer GUI or CLI.
The information provided by the discovery service is the following:
• Target ID: ID of the product. For example, 0x484 for STM32H573 or STM32H563.
• SoC ID: ID of the SoC, which is different from one device to another. This ID can be used to restrict a
certificate to only one device.
• SDA version: version of DA named sda_id in Arm
• Vendor ID: it is a two-byte value defined by JEP106 ID spec. IT is SDM which translates the two bytes to
"STMicroelectronics".
• PSA life cycle: it is a two-byte value representing the PSA life cycle for the upper byte, then the STM32H5
PRODUCT_STATE for the lower byte.
• PSA auth version: fixed to "1.0".
• ST HDPL1 status: value coming from HDPL1 OBK.
– These values are defined by the user when creating the firmware running in HDPL1 (if needed).
– Or if the user uses STiROT, the values are defined in document [4].
• ST HDPL2 status: value coming from HDPL2 OBK
– These values are defined by the user when creating the firmware running in HDPL2 (if needed).
• ST HDPL3 status: value coming from HDPL3 OBK.
– These values are defined by the user when creating the firmware running in HDPL3 (if needed).
• Token formats: fixed to "0x200".
• Certificate formats: fixed to "0x201".
• Cryptosystem: "Ecdsa-P256 SHA256" (certificate) or "ST password".
• ST provisioning integrity: indicates if integrity of provisioned DA data is correct (0xeaeaeaea) or wrong
(0xf5f5f5f5).
The discovery service is available in every product state except locked.
3.1.2

CLI command for discovery command

In order to launch a discovery command, use the following command:
.\STM32_Programmer_CLI.exe -c port=SWD debugauth=2
3.2

Full regression service

3.2.1

Full regression details

The full regression service changes the product state to open.
Debug authentication filters the regression request according to the user credential that comes with it. Therefore,
if a full regression is requested and it is not authorized by the device configuration, the request is rejected.
When launching the full regression service, the following actions are performed:
• Erase fully the memories of the STM32H5 (user flash memory, OBK, SRAM, and back-up RAM).
• Increments secure and nonsecure EPOCH.
• Remove HDP, secure watermarks, and WRP protections.
• Reset TZEN and boot lock to default value.
• Erases key registers within cryptographic peripherals (AES, SAES, PKA, OTFDEC).
• Change product state to open.
AN6008 - Rev 1
STM32H5 debug authentication services description
®
PSA ADAC specification document.
AN6008
page 5/25