1. Overview[edit source]
The STM32 MPUs embed a tamper detection management system.
The tamper management and configuration functions have been added to the OP-TEE secure OS to protect against external attacks when the system is running. The tamper management is also present in the TF-A BL2 because tamper events can occur when the SoC is in low-power or power-off modes.
When a tamper event occurs, the platform's secrets are erased or blocked. The automatic erase mode of all secrets can be configured for some tampers. It is enabled by default but can be turned off (see TAMP device tree configuration) if the user application needs to control erase operations. The platform secrets access is blocked when erase is on-going.
Except for STM32MP15x lines , the tampers can be configured in 2 modes:
- Confirmed mode: immediate erase of secrets on tamper detection, including backup registers erase
- Potential mode: Some of the secrets are instead locked following a tamper detection until a software action.
On STM32MP15x lines , the secrets will be erased.
To learn more about which secrets are erased or blocked in which modes, refer to the TAMP interconnection in the TAMP chapter of the SoC reference manual.
![]() |
Because STMicroelectronics cannot provide generic sequences on how to handle tampers, someone wishing to use tampers is expected to customize the tampers interrupt handler sequence. The default behavior when a tamper event occurs is a system reset when running. When the tamper is in confirmed mode, the appropriate secret erase sequence is also performed by the hardware. Whereas in potential mode, the secrets are blocked but not erased until the handler sequence is performed. The files to custom are TF-A BL2 platform setup (when a tamper event happens when the SoC is in retention mode) and OP-TEE tamper driver for runtime management |
1.1. Internal tampers[edit source]
The table below represents the list of the supported internal tampers.
1.2. External tampers[edit source]
External tampers can be defined on all MPUs:
The external tampers can be configured as passive (they detect a level or an edge on one pin) or as active (2 pins have to be linked together, and the TAMP hardware regularly sends a random level on the OUT pin, then reads IN pins and raises the tamper flag if the values mismatch). Note that the number of mismatch before a tamper event is raised can be configured.
2. Software configuration[edit source]
2.1. Default internal tampers configuration[edit source]
Be aware that some of the internal tampers require other feature to be functional(LSE/HSE monitoring, voltage monitoring). Refer to the TAMP chapter of the SoC reference manual to learn more on this subject.
- By default, there is no internal tamper enabled. If you wish to enable one or more of them, please refer to the TAMP common property list
- By default, there is no internal tamper enabled. If you wish to enable one or more of them, please refer to the TAMP common property list
- By default, there is no internal tamper enabled. If you wish to enable one or more of them, please refer to the TAMP common property list
2.2. Default external tampers configuration[edit source]
For STMicroelectronics boards and except for STM32MP15x lines platforms, the TAMP button is default supported to generate tamper events. This is done in the board device tree file. See: Board device tree configuration