STM32 MCUs Security

Is there any configuration we need to modify in prepareimage.py to overcome this error "ERROR: overlapped zone is not empty" or any other configuration?Below is output.txt file.python /Users/username/Downloads/STM32Cube_FW_WL_V1.1.0/Middlewares/ST/STM32_Secure_Engine/Utilities/KeysAndImages/prepareimage.py block size =16 Magic: SFU2!! Magic: SFU2!! header 0x0803F000 merge: python /Users/username/Downloads/STM32Cube_FW_WL_V1.1.0/Middlewares/ST/STM32_Secure_Engine/Utilities/KeysAndImages/prepareimage.py mergev2 -v 0 -e 1 -b ../../../STM32CubeIDE/Binary/SBSFU_LoRaWAN_End_Node_DualCore_CM0Plus.bin@0x801f200;../../../STM32CubeIDE/Binary/LoRaWAN_End_Node_DualCore_CM4sfuh.bin@0x0803F000 -f ../../../../2_Images_SBSFU/STM32CubeIDE/CM4/Debug/SB.elf;./LoRaWAN_End_Node_DualCore_CM4.elf ../../../STM32CubeIDE/Binary/SBSFU_LoRaWAN_End_Node_DualCore_CM4.bin number of segment :4 0x8000138 0x80016a0 0x80016b0 Adding ELF file: ../../../../2_Images_SBSFU/STM32CubeIDE/CM4/Debug/SB.elf from 0x8000000 to 0x8

Hello!I have a problem with STM32L496RG booting from flash after activating readout protection level 1. The issue is that MCU seems to get stuck in system bootloader code. The only way to get it to boot from main flash is to apply power on reset.Accroding to RM0351 section 3.5.1 the readout protection is activated by system reset or power-on reset if debug was active. In my case I have no debugger connected and still the system reset is not enough to activate RDP and boot from main flash.I have tried activating readout protection option bit via STM32CubeProgrammer and also from my firmware. In firmware, after calling HAL_FLASH_OB_Launch() the MCU ends up in unknown state where it does not respond to system bootloader command nor start executing program from main flash.In my application I have backup power source constantly connected and there is no easy way for end user to apply power-on reset after firmware update. Is it known bug/feature for this device or am I doing something wrong?

Hello guys,I was setting up my STM32CubeIDE to use the SBSFU sample projets. I'm facing a issue with SECore engine, more specific the postbuild.sh script.When i compile SE, i get the following message:ln: failed to create symbolic link '../../postbuild.sh': File exists.ln -s ./SECBOOT_ECCDSA_WITH_AES128_CBC_SHA256.sh ../../postbuild.sh : failedAnyone know how i could solve this?

Hi everyone,I am using STM32F469/STM32F479 and want to integrate SBSFU with an SPI flash. Basically the active image is in MCU's 1 Mbytes flash and downloaded image is in the external flash. There are several questions I would like to know before I start.Refer to STM32F13ZHTx_FLASH.ld in STM32F413H_DISCOVERY_2_Images_SBSFU, there is a memory region for SE_CallGate. I assume this is a feature in firewall, which is not applied to F4 series. Do I need to care about it for my STM32F469?About memory region, can I simply change the address boundary in mapping_fwimg.ld and keep the same size for SBSFU itself for STM32F469? I just want to shrink the flash size for firmware image and keep SBSFU the same for simplicity.As for integrating the external flash for downloading new image, I plan to use the example in B-L475E-IOT01A as a reference. Is there any thing I need to aware in terms of the differences between F4 and L4 MCU?Any suggestion is welcomed. Thanks.Best,Sean

Hello comrades,I've downloaded the SBSFU package, but there is no example for the STM32H747, moreover, I couldn't find an example for dual-core MCU (H755 or H747, etc.).I've tried to make some changes to the NUCLEO-H753ZI project within the downloaded package, I've succeeded in building the project, but no boot output on the UART console.So:Is there any example for this with dual-core MCUs? Is there any solution to disable one core (from the option bytes for example) and boot with an existing project?Thanks in advance folks

Hello everyone!I am testing my own firmware with the sbsfu bootloader (stm32h723). I have the problem that when the MCU is trying to set up the ethernet the board will die.The ETH region is protected by MPU and before enabling it in my app I disable the sbsfu's 8 MPU regions. Switching off the MPU protection in sbsfu I can see that the code stops when calling "HAL_GPIO_Init" from "HAL_ETH_MspInit".Following my MPU set up:void MPU_Config(void) { MPU_Region_InitTypeDef MPU_InitStruct;   MPU_InitStruct.Enable = MPU_REGION_ENABLE; MPU_InitStruct.Number = MPU_REGION_NUMBER0; MPU_InitStruct.BaseAddress = 0x24020000; //netxduo packages MPU_InitStruct.Size = MPU_REGION_SIZE_64KB; MPU_InitStruct.SubRegionDisable = 0x0; MPU_InitStruct.TypeExtField = MPU_TEX_LEVEL0; MPU_InitStruct.AccessPermission = MPU_REGION_FULL_ACCESS; MPU_InitStruct.DisableExec = MPU_INSTRUCTION_ACCESS_ENABLE; MPU_InitStruct.IsShareable = MPU_ACCESS_NOT_SHAREABLE; MPU_InitStruct.IsCacheable = MPU_ACCESS_CACHE

Hi,I have download the newest version SBSFU v2.4.0.From the readme.txt, I compile the SBSFU project NUCLEO-G071RB 1_Image_SBSFU with the MINICOM_YMODEM switch enabled (app_sfu.h).But send the user encrypted firmware file UserApp.sfb always failed.How to send firmware by Minicom YMODEM successfully?My minicom version is 2.7.The following is the error message.+-----------[ymodem upload - Press CTRL-C to quit]------------+         |Sending: UserApp.sfb                     |         |Ymodem sectors/kbytes sent: 158/19kRetry 0: Cancelled    |         |                              &n

the stm32programmer can connect, erase whole chip, but cannot program.What I have done is to run example of SBSFU example (1 Image). I can see bootloader running. Then I try to erase the chip to program my other program.I try to load the PCROP and secure section from my coworker's setting, but it does not allow me to change.I attached all the stm32programmer logs.May I know anyway can solve this lock program, or this device is actually locked

Hi,I am trying to use external flash to download the FW and facing issue at FWPartialTag comparison. I want to debug SECoreBin project to see what is going on while I am in debugging SBSFU project.Is this debug jump possible? If so, Could you please let me know how to achieve this CubeIDE.Thanks,Ankush

We implemented an OTA update procedure where we provide an STM32L476 with a new firmware via serial using the Ymodem protocol in a two-image SBSFU configuration.We are executing long-running tests in which we use the same firmware image to test the update procedure over and over again. The majority of update attempts succeed, but once in a while, we see that SBSFU manages to download the new firmware and reboots, but instead of installing the new firmware (swapping the images) , SBSFU reports that our installation was not validated and a rollback is attempted. A rollback should never be performed at this stage, because the backup firmware was overwritten with the new firmware and the image swap has not yet been executed. This problem is difficult to reproduce but we have seen it on multiple of our hardware prototypes. See SBSFU log below. ----= [SBOOT] System Security Check successfully passed. Starting...======================================================================= &nbs

I ported the SBSFU to an STM32F429 and everything works but it takes almost up to 6s (!) before the bootloader exits and jumps to the main application. My application is about 1.3Mb (entire flash is 2Mb) so it is not exactly small, but 6s boot time is just unacceptable for my application. After analysing the where this time is lost I see that SFU_IMG_VerifyActiveImg is called twice and takes 1.4s to run each time, and SFU_IMG_VerifyActiveSlot is called once which takes a whopping 2.8s. Are these expected times ? Why call SFU_IMG_VerifyActiveImg twice( not that it would help much to do it only once timing wise) Apparently the sha256 calculation which is at the core of these is really slow.Any suggestions for speeding this up ? At the moment I am thinking of trying to either replace this by a simple CRC32 ( if I recall correctly I manage to do that in 500ms ) or just skip these verification steps entirely.

..

Background information : we are using STM32F407 for our product and 2 of them (out of 3) encounters the same problem: RDP level has been changed from level 0 to level 1 and stopped working without any modification from our part. Before even thinking of solving the problem, we would like to switch back from RDP level 1 to level 0.This problem is exactly the same than the one discussed here 7 years ago and where no solutions are given.One way to do so is by using STM32CubeProgrammer. Here is what I tried:Open STM32CubeProgrammerConnect to the µC via ST-LINK: the data read failed because of RDP level14:29:10 : STM32CubeProgrammer API v2.8.0 14:29:24 : Warning: Device changed, refreshing... 14:29:24 : ST-LINK SN : 50FF70067867515335590967 14:29:24 : ST-LINK FW : V2J29S7 14:29:24 : Board : -- 14:29:24 : Voltage : 3.18V 14:29:24 : SWD freq : 4000 KHz 14:29:24 : Connect mode: Normal 14:29:24 : Reset mode : Software reset 14:29:24 : Device ID : 0x413 14:29:24 : Revision ID : Rev 2.0

hello,this is soleiman,I have used a stm32f429igt6 and programing with "C", i have finished my project and I'm ready to sent it in the bazar for sale,so I'm really worried about steal, there is no rule about copyright in my country,do you have any advice for me to safe my programing?what can i do to prevention people that they be not able to access my programing?thank you for your help,best regards,

Hello,I'm having trouble getting the interrupt for the RNG on the STM32F207 to trigger. Below is a code snippet of what I'm doing;.void generate_rnd_num(uint32_t *rnd_num) { RNG_HandleTypeDef rng_handler; rng_handler.Instance = RNG // Point to RNG Peripheral base addr (RNG_BASE = (AHB2PERIPH_BASE + 0x60800))   __RNG_CLK_ENABLE(); // Enable RNG Clock: (RCC->AHB2ENR |= (RCC_AHB2ENR_RNGEN)) __HAL_RNG_ENABLE(&rng_handler) // Enale RNG Peripheral: ((__HANDLE__)->Instance->CR |= RNG_CR_RNGEN)   __HAL_RNG_ENABLE_IT(&rng_handler) // Enable RNG Interrupts: ((__HANDLE__)->Instance->CR |= RNG_CR_IE)   ... // Waiting for a sempahore to be released ... }   /* --------------------------- STM HAL --------------------------- */ void HAL_RNG_IRQHandler(RNG_HandleTypeDef *hrng) {   ...   /* Check RNG data ready flag */ if(__HAL_RNG_GET_FLAG(hrng, RNG_FLAG_DRDY) != RESET) { /* Data Ready callback */ HAL_RNG_ReadyCallback(hrng); /* Chang

I have ported the SBSFU application from NUCLEO-L552ZE-Q to STM32L562E-DK.The single-slot partition is working fine as expected without any issue.For my requirement, I have added a second slot in OSPI flash. Changed flash_layout.h and respective files accordingly. on bootup, signature verification is passed for the primary slot and jumping to the application code. But Application code is not starting to execute.@Frantz LEFRERE​ , Can you please help me regarding this?I am sharing the flash_layout.h file and boot log for reference purposes. Let me know if you need further details

Hello community, how are u?Hope everyone is well and safe =)I'm developing an application using SBSFU. While testing the examples (withoout provisioning a AESKEY, only flashing SBSFU engine) i could always return my microcontroller to factory, just changing the RDP option byte in STM32CubeProgrammer. After doing that, all code of my microcontroller was erased and i was able to use it normally again.My problems began when i provisioned AES KEY to CM0 CPU.To return to factory, i tried to do the same procedure i described above, but when i try to flash a new firmware i keep receiving a message from IDE that "Flash erase was not possible in sector 1-79", even though i'm able to erase and read the flash using STM32CubeProgrammer. All my write protections, read protection and PCROP are disabled. I'm not able to flash a firmware using STM32CubeProgrammer aswell, i get a message of "Flash download error".Previously the AESKey provisioning i was able to factory reset, now i'm not and to make ma

Hello, i have have included the stm32g4xx_hal_cryp.c v1.4.0.The clock is for AES is started (__HAL_RCC_AES_CLK_ENABLE)But the AES Registers are always 0, even writting with a debugger is not possible.Do you have any advice ?With friendly regardsMark Rudolph

For some reason, when I enable CRS Automatic Trimming my USB connection gets unstable. I need to unplug/plug back the USB several times for the PC to recognize the device. When I disable the Automatic Trimming mode and use the default HSI48CalibrationValue = 0x20, the connectivity improves a lot. See below the clock initialization. I appreciate any input.void Clocks_Init(void) { static RCC_CRSInitTypeDef RCC_CRSInitStruct; // CLOCK CONFIGURATION REGISTERS RCC->CFGR = RCC_CFGR_SW_HSI; // Confgure SYSCLK RCC->CFGR |= RCC_CFGR_INIT; // Confgure PLL clk // CLOCK CONTROL REGISTERS RCC->CR2 |= RCC_CR2_INIT; // Enable HSI14 CLK // AHB PERIPHERAL CLOCK ENABLE REGISTERS RCC->AHBENR |= RCC_AHBENR_INIT; // Enable DMA, CRC, and GPIO Clks   // APB PERIPHERAL CLOCK ENABLE REGISTERS 1 RCC->APB1ENR |= RCC_APB1ENR_INIT; // Enable CRS, WWDOG, & TIM3/2 CLKs // APB PERIPHERAL CLOCK ENABLE REGISTERS 2 RCC->APB2ENR |= RCC_APB2ENR_INIT; // Enable ADC inter

Hello, Is below problem very common for this STM32F072VBH6 MCU? Parts were not blank and have already been programmed we are not able to program parts with our programmersParts bought from online distributor

My project uses SBSFU template ported to my STM32L496 board. I need to call the crypto library from the user app. UM2262 mentions cryptographic middleware support in sections 6.2.3 and 6.2.4, but it is vague. Are there other documents that explain better, or perhaps specific examples for calling the crypto lib from the user app?

Hello,I want to implement my own UserApp (just a blinking LED for the moment but it will implement FreeRTOS and LwIP in future) on Nucleo-H753ZI. I followed Youtube tutorials for SBSFU especially Security Part6 - 04 Experience SBSFU benefits. Then, I managed to run successfully the SBSFU example like in Security Part6 - 02 Building the SBSFU.I made my linker script like this:/* Entry Point */ ENTRY(Reset_Handler)   /* Highest address of the user mode stack */ _estack = ORIGIN(RAM_D1) + LENGTH(RAM_D1); /* end of "RAM_D1" Ram type memory */   _Min_Heap_Size = 0x200 ; /* required amount of heap */ _Min_Stack_Size = 0x800 ; /* required amount of stack */   /* Memories definition */ MEMORY { ITCMRAM (xrw) : ORIGIN = 0x00000000, LENGTH = 64K RAM_D1 (xrw) : ORIGIN = 0x24000000, LENGTH = 512K RAM_D2 (xrw) : ORIGIN = 0x30000000, LENGTH = 288K RAM_D3 (xrw) : ORIGIN = 0x38000000, LENGTH = 64K ISR_VECTOR (rx) : ORIGIN = 0x8020000 + 0x400, LENGTH = 0x400 FLASH (rx) : ORIGIN = 0

In SBSFU, bootloader image will be signed? I am using stm32l562e-dk. I want to use SBSFU.1) I Have found the SBSFU example for NUCLEO-L552ZE-Q, but I am not able to find it for stm32l562e-dk. Is it available?2) IN SBSFU when the bootloader is first time flashed, the bootloader's integrity and authenticity are checked? 3) Can i update bootloader in future if i have kept my RDP level to 1?

I have successfully taken the sbsfu sample code and gotten it to work on my hardware. Now, I am trying to adapt my existing application to be SBSFU compatible. Section 8.1 of AN5056 tries to explain this but the examples are all for an .icf linker file (IAR?). My linker files are .ld and completely different. Are there examples that use a .ld linker file? Specifically, I don't know how to configure the vector table to run from active slot 1. thanks in advance for your help,Brent

I am trying to modify the way secure boot handles the reset cause. In the code, I find CHECK STATUS ON RESET function and a comment that reads; "Hence this piece of code must systematically be revisited and tuned for the targeted system." List of all code sections that "must systematically be revisited" anyone?John G