这是参考STM32U585修改的工程用于U575实验学习。代码下载地址git clone https://gitcode.com/u012988644/stm32u5-sbsfu-release.git代码分支stm32u575调试记录手里没有 STM32U585 板子只有一块 NUCLEO-U575ZI-Q 评估板STM32U575。阶段一直接使用 U585 固件烧录 U575失败步骤在 STM32CubeIDE 下依次编译 SBSFU_Boot、SBSFU_Loader、SBSFU_Appli在SBSFU_Boot/STM32CubeIDE路径下打开 Git Bash连接开发板运行regression.sh回滚选项字节配置运行SBSFU_UPDATE.sh烧录固件打开串口复位后持续触发 TAMPER 检测循环打印日志[INF] TAMPER SEED [0x3fb7deba,0x7c7718e3,0x53d6d43b,0x3a978920] [INF] TAMPER Activated [INF] BANK 1 secur[INF] TAMPER SEED [0x509fe951,0x695476d2,0xe72c8c8d,0xc2208dfc] [INF] TAMPER Activated ...原因默认同时激活了内部和外部 tamperTFM_TAMPER_ENABLE ALL_TAMPER// SBSFU_Boot/Inc/boot_hal_cfg.h#defineNO_TAMPER(0)/*! No tamper activated */#defineINTERNAL_TAMPER_ONLY(1)/*! Only Internal tamper activated */#defineALL_TAMPER(2)/*! Internal and External tamper activated */#defineTFM_TAMPER_ENABLEALL_TAMPERMCU 变砖与恢复过了一会 log 停止输出STLink 也无法连接由于未运行hardening.sh该脚本会锁死启动地址仍可恢复短接PH3BOOT 引脚到 VDD按复位按钮STLink 连接后同时修改选项字RDP0xAA并取消TZENTZ 关闭必须伴随 RDP 降级需同时 ApplyMCU 恢复正常临时绕过外部 TAMPER查数据手册TAMP8 的 IN/OUT 引脚为PE5/PE4短接这两个引脚后重新烧录TAMPER 循环日志消失[INF] BANK 1 secure flash [0, 15] : OB [0, 127] [ERR] Unexpected value for secure flash protection: set wmsec1 [INF] BANK 1 flash write protection [2, 12] : OB [127, 0] [ERR] Unexpected value for write protection : set wrp1 [INF] BANK 2 flash write protection [123, 127] : OB [127, 0] [ERR] Unexpected value for write protection : set wrp2 [INF] BANK 1 secure user flash [0, 11] : OB [0, 0] [ERR] Unexpected value for secure user flash protection : set hdp1 [INF] RDPLevel 0xaa (0xbb) [ERR] Unexpected value for RDP level [INF] Programming RDP to bb [INF] Unplug/Plug jumper JP3 (IDD)最简解法将TFM_TAMPER_ENABLE改为INTERNAL_TAMPER_ONLY重新编译烧录直接关闭外部 tamper 检测无需短接引脚。根据 log 提示断开 IDD 跳线代码内部修改了 RDP 等级必须断电才能生效复位无效。断电重新上电后[INF] Starting bootloader OEMiROT [INF] Initializing BL2 NV area : Power down/reset not supported... [INF] BL2 NV Area Initialized : Power Down/reset supported [INF] Consistent BL2 NV Counter 0 0x0 [WRN] Image 0 is installed [INF] verify sig key id 0 [INF] checking public key 47 5b [INF] verifying signature hlen 20日志未完成跳转菜单无输出 —— 确认是未修改目标芯片型号导致的不能偷懒。阶段二移植到 STM32U575成功修改芯片型号STM32CubeIDEProperties→C/C Build→Settings→Build Steps→ Pre-build steps将STM32U585xx改为STM32U575xxProperties→C/C General→Paths and Symbols→SymbolsGNU C同样替换编译宏SBSFU_Boot 移植问题 1STM32U585 有 CRYP 外设CRYP_HandleTypeDefSTM32U575 只有 AES 外设AES_HandleTypeDef修改config-boot.h禁用硬件加速/* STM32U575 has no CRYP peripheral (only AES), disable HW accel *//* #define BL2_HW_ACCEL_ENABLE */效果MBEDTLS_AES_ALT、MBEDTLS_ECDSA_VERIFY_ALT、MBEDTLS_ECP_ALT均不启用aes_alt.c不参与编译改用MBEDTLS_HMAC_DRBG_C软件 DRBG。问题 2STM32U575 无 SAES 外设RCC_PeriphCLKInitTypeDef中无SaesClockSelection字段修改stm32u5xx_hal_msp.c加条件编译#ifdefined(SAES).SaesClockSelection0,#endif/* defined(SAES) */Boot 工程编译通过。✅SBSFU_Loader 移植问题编译 Secure 分区报错缺少partition_stm32u575xx.h将partition_stm32u585xx.h复制为partition_stm32u575xx.h修改文件头 include guard 即可内容完全基于region_defs.h宏无需其他改动。Appli 工程同步处理。Loader 工程 S/NS 全部编译通过。✅SBSFU_Appli 移植问题缺少链接脚本STM32U575AIIX_FLASH.ld将STM32U585AIIX_FLASH.ld复制为STM32U575AIIX_FLASH.ld内容同样基于region_defs.h宏无需修改S 和 NS 子工程均需添加。Appli 工程 S/NS 全部编译通过。✅烧录与启动依次执行regression.sh→SBSFU_UPDATE.sh开机成功串口输出[INF] TAMPER Activated [INF] BANK 1 secure flash [0, 15] : OB [0, 127] [ERR] Unexpected value for secure flash protection: set wmsec1 [INF] BANK 1 flash write protection [2, 12] : OB [127, 0] [ERR] Unexpected value for write protection : set wrp1 [INF] BANK 2 flash write protection [123, 127] : OB [127, 0] [ERR] Unexpected value for write protection : set wrp2 [INF] BANK 1 secure user flash [0, 11] : OB [0, 0] [ERR] Unexpected value for secure user flash protection : set hdp1 [INF] RDPLevel 0xaa (0xbb) [ERR] Unexpected value for RDP level [INF] Programming RDP to bb [INF] Unplug/Plug jumper JP3 (IDD) [INF] Flash operation: Op0x0, Area0x0, Address0x0 [INF] Starting bootloader OEMiROT [INF] Initializing BL2 NV area : Power down/reset not supported... [INF] Init BL2 NV Header area: Done [INF] Initializing BL2 NV Counters [INF] Init BL2 NV counters to 0 : Done [INF] BL2 NV Area Initialized : Power Down/reset supported [INF] Checking BL2 NV area [INF] Checking BL2 NV area header [INF] Checking BL2 NV Counter consistency [INF] Consistent BL2 NV Counter 0 0x0 [WRN] Image 0 is installed [INF] Starting validation of primary slot(s) [INF] verify counter 0 1000000 0 [INF] counter 0 : ok [INF] verify sig key id 0 [INF] checking public key 46 5b [INF] verifying signature hlen 20 [INF] signature OK [INF] Counter 0 set to 0x1000000 [INF] Bootloader chainload address offset: 0x1a000 [INF] Jumping to the first image slot (C) COPYRIGHT 2021 STMicroelectronics User App #A Main Menu Test Protections -------------------------------------- 1 Toggle Secure LED ------------------------------------- 2 Selection :启动成功应用菜单正常输出。✅