STM32 MCUs Security

..

According to the integration guide (an5056) it should be possible to use the flash memory to store user data (chapter 8.2) . However, when turning on the MPU protect define the controller goes into a memory fault when accessing the eeprom for reading (located at position 0x0808 0001) on stm32l151REThe code used for accessing the eeprom is the following:#include "sfu_low_level_eeprom.h" #include <stdbool.h> #include "sfu_low_level_flash.h"   static bool checkBounds(uint16_t address) { return address >= FLASH_EEPROM_END - FLASH_EEPROM_BASE; }     uint8_t sfu_ll_eeprom_readByte(uint16_t address, uint8_t * data) { if(checkBounds(address)) { return 0; } memcpy(data, (uint8_t *) (address + FLASH_EEPROM_BASE), 1); return 1; }  I've had the same problem when accessing the eeprom from the user application while using similar code.Should the eeprom only be accessible through the secure engine callgate ? because this seems like quite an unnecessary workaround

Dear allI want to check flash integrity with CRC checksum – IAR workbench has built-in features to calculate and add the CRC to the firmware.Under STM32CubeIDE I use a post buildsrec_cat.exe firmware.bin -binary -stm32-l-e 0xEFFC -o firmware_withCRC.bin -binaryWorks great with HAL library function HAL_CRC_CalculateBut how this can be combined with the debugger – there only elf-files can be loaded. My firmware stops executing if CRC is wrong - so I have to change the code each time I starts the debugger.Thanks in advance,Franz

Hi,I have seen, that for the bootloader with just one image, it is only possible to use the YMODEM with UART for updating the firmware with the SBSFU. Now what I'm am concerned about is, that the YMODEM seems not to be very error tolerant. So, what further mechanisms does the SBSFU use, to verify that the firmware is not corrupted anywhere (in case the checksum of the SBSFU fails somewhere, since it is only 16bit, right)? Will the whole firmware be checked with a checksum after reception to see, if it is valid?

Hi,When I have a look at the AN5056(https://www.st.com/resource/en/application_note/dm00414677-integration-guide-for-the-xcubesbsfu-stm32cube-expansion-package-stmicroelectronics.pdf), there is a possibility on page 39 to improve the boot time. That is exactly what I want to achieve, but it seems, the code of the SBSFU changed over time and it looks not anymore as in the AN5056:Now in the sfu_boot.c, there is much more code available and if I try to comment out as in the AN5056, I always get a critical handle failure: How is it possible to improve the SBSFU boot time in the newest version?

Hi,I am currently trying out the AES Accelerator of the STM32WB55, using the HAL. It is working fine on its own, but I am unable to get matching results to MbedTLS. So Ciphertexts and Tags generated by the Accelerator are not matching those generated by MbedTLS, and decryption of Accelerator Ciphertexts using MbedTLS fails (tags and cleartext do not match).In the process of checking different configuration options, i stumbled upon the header size. STM32CubeMX forces the header size to be 1 with no apparent reason. I tried the Accelerator and MbedTLS both with header sizes of 0 and 1 (by manually changing the CubeMX-generated code, termed additional data with MbedTLS), both do not match.Is there a reason why CubeMX forces the header size to be 1?I am appending the relevant code, in this case with header size 0. Did I make some mistake somewhere? Or is there some other hidden reason to this?CRYP_HandleTypeDef hcryp1; __ALIGN_BEGIN uint32_t pKeyAES1[8] __ALIGN_END = { 0x00000000,0x000000

Hi,Please advise how to verify token generate by "psa_initial_attest_get_token".My test kit is B-U585I-IOT02A and test application is TFM.Thanks,QiZhang

Hi,I am facing untraceable issue with SBSFU. I integrated SBSFU features to our application running on device with 512kb flash. After downloading the firmware, during the swapping, it is throwing some abnormal errors while writing to addresses 0x0803FE00, 0x0803EE00 and 0x0803DE00. Below is the error from the trace.=======================================================================       (C) COPYRIGHT 2017 STMicroelectronics         ==                                  ==       Secure Boot and Secure Firmware Update        ======================================================================== [SBOOT] SECURE ENGINE INITIALIZATION SUCCESSFUL= [SBOOT] STATE: CHECK

..

Hello everyone,I have pretty uncommon question. I'm working on STM32WB with SBSFU, and I'm wondering, if it's possible to use non-secure boot with it? As far as I'm concerned, secure boot is enabled by default, but many security features can be disable using flags.Also, another question: All the provided examples are using USART YMODEM to transfer data. I know, that it really doesn't matter what kind of protocol you use as long as image is placed in a correct place in the memory, but I wonder if I can use DFU feature to update firmware and still use SBSFU. I think it should be possible.Thank you in advance.

Hello, I am new with NUCLEO STM32G4754 and trying the SBSFU examples (1 image). I can flash and launch the SBSFU but I can't load any user application (userapp.sfb)I use STM32 tools, Windows with the same result :I connect using Teraterm (on Windows) with YMODEM protocol,The terminal display the SBSFU sequence, which is good and terminates by waiting for a user applion to be downloadedI Send the UserApp.sfb with (File->Transfer->Ymodem)AND the load remains stopped only elapsed time is increases..

Hi,Device - STM32H7B3I-DKSBSFU base Project - STM32H7B3I-DK\Applications\2_Images_ExtFlashI are using a different flash chip than STM32H7B3I-DK has MX25LM51245G and I am using MX25L51245G1) I have implemented the flash driver and test with standalone project its working as expected.2) Tested the code with Images_SBSFU project before beginning of secure code#if 1 // Test the OCTO flash driver uint32_t buf_len = 0x100; uint32_t start_address = EXTERNAL_FLASH_ADDRESS + 0x20000; uint8_t spibuffer[buf_len]; uint8_t spibuffer_read[buf_len]; volatile uint8_t *flash_area_mm = (uint8_t *) (start_address);   for(int i =0; i < buf_len; i++) { spibuffer[i] = i; spibuffer_read[i] = 0xAA; }   SFU_LL_FLASH_EXT_Init(); SFU_FLASH_StatusTypeDef *pFlashStatus = NULL; if( SFU_LL_FLASH_EXT_Erase_Size(pFlashStatus, (uint8_t*)start_address, buf_len) == SFU_SUCCESS) {   if (SFU_LL_FLASH_EXT_Write( pFlashStatus, (uint8_t*)start_address, (uint8_t*)spibuffer, buf_len) == S

Hi,Device - STM32H7B3I-DKProject - STM32H7B3I-DK\Applications\2_Images_ExtFlashHardFault when transfer control from BL to APP1) Last trace of codelaunch_application: /****************************************************** * return from exception to application launch function * R0: application vector address * R1: exit function address * push interrupt context R0 R1 R2 R3 R12 LR PC xPSR *******************************************************/ MOV R2, #0x01000000 /* xPSR activate Thumb bit */ PUSH {R2} MOV R2, #1 BIC R1, R1, R2 /* clear least significant bit of exit function */ PUSH {R1} /* return address = application entry point */ MOV R1, #0 /* clear other context registers */ PUSH {R1} PUSH {R1} PUSH {R1} PUSH {R1} PUSH {R1} PUSH {R0} /* R0 = application entry point */ MOV LR, #0xFFFFFFF9 /* set LR to return to thread mode with main stack */ BX LR /* return from interrupt */ .endValue of LR,SP Memory of stack pointer :  2) LR : 0xFFFF.FFF9 return from Ha

I'm working on a project with SBSFU implemented on STM32H755. I'm using slot 1 for CM7 and slot 2 for CM4. I'm using the IAR workbench. Both CM4 and CM7 hex files work just fine in debug mode and everything seems to work with SBSFU implementation. But when I'm trying to test the performance of the code. I found that the SBSFU version has lower performance than I expect. The use case is there are two interrupt services (SPI 2Mbps, UART for MODBUS 500kbps) that may occur at the same time and SPI has a higher priority. In debug mode, everything works just fine. But in SBSFU mode, with the same bin files and the same SPI/UART communication requests, I got a lot of timeout errors for MODBUS. The optimization level now is the highest for speed and no size constraint. I was wondering if SBSFU affected the performance of the same code. Any suggestions or information are appreciated.

I'm learning using cryptography method on stm32f429. But there is no Hash proccesor on the system. Although there is no hash proccessor, could I use the STM32CubeCrypto Libraries HASH examples on my board ? What kind of changes if my proccessor has proccesor unit inside ?

I'm trying to get the HAL_CRC module to generate a 32bit CRC32 that matches the online calculators and matches what I get out of python with binascii.crc32() or zlib. I have a DoCkecksum() call below that calls HAL_CRC_Calculate() and I have called it with every combination of the input parameters but none of them match the calculated crc I get with the online calculators or with my python script. My python script does match the online calculators and for the value in the function the CRC should be 0x47A79BF9. I'm running a project on an STM32H745 Nucleo board. I've also attached the project. All the relevant code is in main.c.uint32_t DoChecksum(uint32_t inputFormat, uint32_t inputReverse, uint32_t outReverse){   uint32_t uiCRCCalc;   uint32_t uiVal;   uiVal= 0xC0DE50FF;   hcrc.Init.DefaultPolynomialUse = DEFAULT_POLYNOMIAL_ENABLE;   hcrc.Init.DefaultInitValueUse = DEFAULT_INIT_VALUE_ENABLE;   hc

We had a project built using ST Crypto V2.0.6 (M3_CryptoHW_2_0_6.lib) library in Keil IDE. Now we replaced the ST Crypto library by V4.0.1 (libSTM32Cryptographic_CM3.a)We are seeing the following errors..\STM32_Crypto\lib\libSTM32Cryptographic_CM3.a(1): error: A1167E: Invalid line start ..\STM32_Crypto\lib\libSTM32Cryptographic_CM3.a(2): error: A1167E: Invalid line start ..\STM32_Crypto\lib\libSTM32Cryptographic_CM3.a(3): error: A1167E: Invalid line start Attached is the screen shot of the project.Let us know the procedure to update the library and if any workarounds are present.

Hi,I'm using a STM32F722RE and in my current application, I used sector 2 and 3 of the flash as a virtual EEPROM. The memory of the controller looks like this: So sector 4 should be enough for the SBSFU and I would like to set my application to sector 5 and the download area to sector 6. Now, when I change everything in the linkerscript, the controller goes somewhere unexpected and I lose the debug connection,What I have done:The linkerscript of the SECoreBin is unchanged.The linkerscripts of the SBSFU are changed as follow:STM32F722REx_FLASH.ld:/* Entry Point */ ENTRY(Reset_Handler)   /* Highest address of the user mode stack */ _estack = 0x2003C000; /* end of RAM */ /* Generate a link error if heap and stack don't fit into RAM */ _Min_Heap_Size = 0; /* required amount of heap */ _Min_Stack_Size = 0x2000; /* required amount of stack */   INCLUDE mapping_fwimg.ld INCLUDE mapping_sbsfu.ld   /* Specific SBSFU definition */ __ICFEDIT_intvec_start__ = 0x08010000; SE_Bin

According to me there is problem in Receive call back function but I don't understand what should I do to resolve this....Please find the attached screenshot for understanding.In that screenshot we are able to see 1 to 5 option but after pressing 1 or 2 etc. It cannot take any action means it cannot take our input

..

Hi,I'm using a STM32F446RE Discovery board and would like to test the SBSFU on it. At them moment, I take the example code from the STM32F413H Discovery board, but I'm not sure what I'm doing wrong to never get access over the tera terminal. What I have done so far according to AN5056 is:Change the flash memory, since the STM32F446RE has only 512kBytemapping_fwimg.ld:/* ***************************************************************************** ** ** File : LinkerScript.ld ** ** Abstract : Linker script for STM32F413ZHTx Device with ** 1536KByte FLASH, 320KByte RAM ** ** Set heap size, stack size and stack location according ** to application requirements. ** ** Set memory bank area and size if external memory is used. ** ** Target : STMicroelectronics STM32 ** ** ** Distribution: The file is distributed as is, without any warranty ** of any kind. ** ** (c)Copyright Ac6. ** You may use this file as-is or modify it according to the needs of your ** project. Distribution of this file (

Hi,I have some trouble with using the SBSFU. In the first place, I could not build the SECoreBin project, but I found out, it was the path length in Windows making me the trouble. Now, after solving this and building a complete new project example, I see a very strange flash usage for this:The SE_Entry... has a huge flash overflow. Is this a problem? I see also the same thing, when I build other example projects.Now, when I try to debug the whole thing on a board by activating the debug optimizer, I directly fall into a hardfault and I don't see, what the problem really is. So I expect somehow this to be the problem, but I cannot really be sure.

Hi,I have trouble adapting the STM32F769I_Discovery_2_Images_SBSFU example for the STM32F722. There are so much inconsistencies and I don't really know what I should let out and what really is necessary. For example, the STM32F769I uses somehow the stm32f7xx_hal_flash_ex.h, which is not used by the STM32F722 etc. Is there a built project available for the STM32F722?Edit: I could solve all the problems, it was because of the dual bank used in the STM32F769I example

There are multiple crypto algorithm supported with SBSFU framework SECBOOT_AES128_GCM_AES128_GCM_AES128_GCM: Authentication, Integrity, Confidentiality are ensured.  *                           Authenticate Firmware Metadata using AES128-GCM tag.  *                           Decrypt Firmware image using AES128-GCM algo.  *                           Firmware Image Integrity using AES128-GCM tag.#define SECBOOT_ECCDSA_WITHOUT_ENCRYPT_SHA256 (1U) /*!< asymmetric crypto, no FW encryption */   #define SECBOOT_ECCDSA_WITH_AES128_CBC_SHA256 (2U) /*!< asymmetric crypto with encrypted Firmware */   #define SECBOOT_AES128_GCM_AES128_GCM_AES128_GCM (3U) /*!< symmetric crypto I am not an expert on crytpo so hoping someone can educate me asymmetric crypto with encrypted Fir

The size of system memory on STM32H743 is 2 sectors of 128KB each.What is the size of the option bytes block?