STM32 MCUs Security

Hello,I am currently using STM32L010 MCU in my application where we have UART and SWD lines exposed to be accessed only by service personnel (under a cover but still accessible without dismantling the device). Since we want to have a possibility to perform software update in the field, we want those SWD pins physically accessible.We currently map those pins to GPIO in the start-up so that they cannot be used to debug the program while application is running, but still can be used to reprogram the chip by applying reset via MCU_RESET pin. We want to block this access and enable this access only if certain command is received via UART (i.e. only when SWD is actively enabled via a command) and not even upon reset to avoid unauthorized reprogramming of our product. Alternatively, if there's a way to block reset via MCU_RESET (unless it is activated by a command), that would also do the trick.Is it possible to block SWD access even upon chip reset and activate it via software whenever wante

I'm trying to build the SBSFU project for board STM32H7B3I-DK (2_Images_ExtFlash) but am unable to. Everything does build fine but it fails on the last step, the postbuild.sh step, at prepareimage.py enc.I'm using STM32CubeIDE 1.5.1 on LinuxThis is the error I get:arm-none-eabi-objcopy -O binary "UserApp.elf" "../../UserApp.bin" arm-none-eabi-size "UserApp.elf" text data bss dec hex filename 19680 160 2856 22696 58a8 UserApp.elf "../../../../2_Images_SECoreBin/STM32CubeIDE/postbuild.sh" "../.." "./UserApp.elf" "../../UserApp.bin" "1" "1" prepareimage with python script Traceback (most recent call last): File "STM32CubeExpansion_SBSFU_V2.4.0/Middlewares/ST/STM32_Secure_Engine/Utilities/KeysAndImages/prepareimage.py", line 861, in <module> args() File "STM32CubeExpansion_SBSFU_V2.4.0/Middlewares/ST/STM32_Secure_Engine/Utilities/KeysAndImages/prepareimage.py", line 858, in args subcmds[args.subcmd](args) File "STM32CubeExpansion_SBSFU_V2.4.0/Middlewares/ST/STM32_Secur

We have ported STM32CubeExpansion_SBSFU_V2.4.0 to use STM32H7B0 instead of the STM32H7B3-DK.When I enable SFU_MPU_PROTECT_ENABLE the bootloader generates MEMORY FAULT! when starting up and not yet called user application. I have tried to debug as much as I can and come to suspect the following entry in the MpuAreas data structure SFU_MPU_InitTypeDef in sfu_low_level_security.c{ SFU_PROTECT_MPU_PERIPH_2_RGNV, SFU_PROTECT_MPU_PERIPH_2_START, SFU_PROTECT_MPU_PERIPH_2_SIZE, SFU_PROTECT_MPU_PERIPH_2_PERM, SFU_PROTECT_MPU_PERIPH_2_EXECV, SFU_PROTECT_MPU_PERIPH_2_SREG, SFU_PROTECT_MPU_PERIPH_2_TEXV, SFU_PROTECT_MPU_PERIPH_2_C, SFU_PROTECT_MPU_PERIPH_2_B }If I comment out the above code the SBSFU boots okay. Examining the fault report dialog window I see that the fault is pointing to address 0x58024540 as the offender.But when I look at this register address it is the RCC AHB4 Clock Register (RCC_AHB4ENR) and I can not see why this is causing this fault. I am assuming that I am correct and

Hello everyone,I was wondering the proper way to use the STM32_CHACHA_20_Encrypt() and STM32_CHACHA_20_Decrypt() functions available on the ST CryptoLib. I run the standard demo code on a STM32F072C8 MCU and it apparently run correctly, returning PASSED on the Buffercmp() that compares the function outputs to the expected const arrays declared statically.Then I wrote a small code snipped, to encrypt a 'Test' buffer and decrypts it in sequence:--------------------- Plaintext[0] = 'T'; Plaintext[1] = 'e'; Plaintext[2] = 's'; Plaintext[3] = 'T'; // Encrypt status = STM32_CHACHA_20_Encrypt( (uint8_t *) Plaintext, 4, Key, IV, sizeof(IV), OutputMessage, &OutputMessageLength); // Copy encrypted output into Plaintext buffer for(idx=0;idx<4;idx++) Plaintext[idx] = OutputMessage[idx]; // Decrypt status = STM32_CHACHA_20_Decrypt( (uint8_t *) Plaintext, 4, Key, IV, sizeof(IV), OutputMessage, &OutputMessageLength); // Copy deencrypte

The code from the 1.16 example builds fine in the EWARM. It writes the source blocks to the terminal, but as I see in the debugger, it fails to encrypt the input block. That times out as it fails to return a HAL_OK status. /* Start decrypting aCyphertext, the decrypted data is available in aDecryptedtext */  if (HAL_CRYPEx_AES(&CrypHandle, aCyphertext, AES_TEXT_SIZE, aDecryptedtext, TIMEOUT_VALUE) == HAL_OK)  {   /* Display decrypted Data */   Display_DecryptedData(CBC, 128, AES_TEXT_SIZE);  }  else    {   /* Processing Error */   Error_Handler();  }I have read all the how-to info in the examples. Has anyone else run into this issue and found a solution?

I have the nucleo l152RE board and am trying to use this for following the mooc on sbsfu. It is possible for me to build (in cube IDE) both SECoreBin and SBSFU images. however, when building the UserApp it fails on the postbuild script. During build, I can see the UserApp.elf being created and showing up in my file explorer, but when the post-build script fails, the .elf file is also removed from my system.According to the build output, the file "OEM_KEY_COMPANY1_key_AES_CBC.bin" can not be found, but I can see it in my directory structure. I have the following build output:11:19:33 **** Incremental Build of configuration Debug for project NUCLEO-L152RE_2_Images_UserApp **** make all arm-none-eabi-gcc -z max-page-size=1 -o "UserApp.elf" @"objects.list" -l:se_interface_app.o -mcpu=cortex-m3 -T"../STM32L152RETx.ld" --specs=nosys.specs -Wl,-Map="NUCLEO-L152RE_2_Images_UserApp.map" -Wl,--gc-sections -static -L../../../../2_Images_SBSFU/SW4STM32/NUCLEO-L152RE_2_Images_SBSFU/Debug -Xlinker

..

I am using x-cube-sbsfu version 2.4.0 on a custom designed board using the STM32F722. I have ported the single slot code (1_Image) for the STM32F769I-Discovery board to the custom board. I have come across what looks like an error in the sfu_low_level_security.h file. The MPU configuration for the UserApp execution has the access set to bufferable but not cacheable. I believe this will disable the cache, and it also causes memory faults for unaligned memory accesses. Can anybody confirm that this is a mistake in the code?Here is a snippet for reference (I have changed the region size from 2 MB to 512 kB from the original code):/** * MPU configuration for UserApp execution * ======================================= * Reconfiguration of existing regions (useless during UserApp execution) * MPU constraint = Region base address should be aligned on Region size */   /** * @brief Region 3 - Enable the execution for active slots in unprivileged mode. * Read only capability configur

I know this was cracked before, but required high skills and expensive equipment, but nowthis method makes it really easy, basically anyone can do it.Any official statement concerning this from ST?Like the list of devices which are affected, possible mitigation solutions.This seems to be a pretty big oops, basically makes stm32 unusable for other than hobby projectsSee page for details:https://blog.zapb.de/stm32f1-exceptional-failure/

The ECDSA implementation in cryptolib does not provide means of implementing ECDSA without a random number. RFC6979 is a secure way of doing ECDSA without a random number, it is used in the blockchain implementations (bitcoin, ethereum)

Hello community,I have a few of questions regarding SFI:1) Does STM32H753AI support SFI (Secure Firmware Install)?2) Can I use SWD for the SFI?3) Is there any recommended HSM smart card reader for the SFI?Thank you :)

Hi all,I have two different batches of Revision V STM32H750VBT6. All units in one of the batches (Date Code 045) has issue with the hash peripheral while the one (Date Code 928) is working completely fine.I created a new basic project for testing this issue and the code is as shown. However, HAL_HASHEx_SHA256_Start() always ended up returning HAL_TIMEOUT. Based on the SFR register view in Atollic TrueSTUDIO, all the registers for hash peripheral remains at value 0x0.*Note : The same project is working fine for Revision V STM32H750VBT6 (Date Code 928) and Revision Y STM32H750VBT6 (Date Code 002) *Things I have done/triedDirectly editing the registers values in SFR register view shows illegal input while bit editing has no effect. (*There isn't any issue editing other peripheral registers for example SysTick SYST_CSR*)Checked RCC_AHB2ENR HASHEN bit is enabled indicating the clock to hash peripheral is enabled.Used different firmware packages STM32CubeH7 v1.5.0, v1.7.0 and v1.8.0Used code

I am using STM32L4A6VG with 1 MB flash and my application is about 600+KB. I want to update the user app from an external flash and need some guide to modify SBSFU.​After reading these 2 examples (STM32CubeExpansion_SBSFU_V2.4.0\Projects\B-L475E-IOT01A\Applications\2_Images_ExtFlash and STM32CubeExpansion_SBSFU_V2.4.0\Projects\32L496GDISCOVERY\Applications\2_Images), I can update user image from my external flash with RDP and WRP on. Here is my configuration of memory mapping. I know this configuration violates FWALL and MPU settings (like active image header should be in FWALL NVDATA) so I comment the sanity check of FWALL and turn off FWALL protection./* Header does not start at the beginning of the sector to ensure the overlap constraint between firewall NVDATA section and firewall CODE section. This constraint is relevant only for products with dual bank and firewall isolation */ __ICFEDIT_SLOT_Active_1_start__ = 0x08012000; __ICFEDIT_SLOT_Active_1_end__ = 0x080F1FFF; __ICFEDIT

I am trying to use AES-GCM with the crypto hardware accelerator the normal Testvectors are working, but when I connect it to openssl the authentication Tag is wrong. Do you have any idea how to fix this? The normal Encryption in ECB is working. If I use the software Version of the authentication Tag the program is working. Is there any problem with the crypto hardware accelerator and TLS. Please help me.

Hi,I am facing some issues with debugging SBSFU project.When I flash the application in debug mode, I can not jump to breakpoints set in SBSFU projects.Is there any way to perfrom this.Best Regards,Ankush Nagaraju

HiI'm using the dual image function on a 512kB STM32G474. I like to adjust the bootloader size to 32kb because my user App is too big.In the AN5056 there is a note how to adjust it, but I'm not sure if this lines in the file low_level_security.h are correct? Can anybody help me please?#define SFU_PROTECT_MPU_EXEC_SE_RGNV MPU_REGION_NUMBER7 #define SFU_PROTECT_MPU_EXEC_SE_START FLASH_BASE /*!< Flash memory area */ #define SFU_PROTECT_MPU_EXEC_SE_SIZE MPU_REGION_SIZE_16KB //eud MPU_REGION_SIZE_32KB #if defined (__GNUC__) #define SFU_PROTECT_MPU_EXEC_SE_SREG 0xE0U /*!< 32 Kbytes / 8 * 5 ==> 20 Kbytes */ #elif defined(__CC_ARM) #define SFU_PROTECT_MPU_EXEC_SE_SREG 0x80U /*!< 32 Kbytes / 8 * 7 ==> 28 Kbytes */ #else #define SFU_PROTECT_MPU_EXEC_SE_SREG 0xC0U /*!< 32 Kbytes / 8 * 6 ==> 24 Kbytes */ #endif /* (__GNUC__) */ #define SFU_PROTECT_MPU_EXEC_SE_PERM MPU_REGION_PRIV_RO #define SFU_PROTECT_MPU_EXEC_SE_EXECV MPU_INSTRUCTION_ACCESS_ENABLE #define SFU_PROTECT_MPU_EXE

Project imported: D:\Vrund\STM32CubeExpansion_SBSFU_V2.4.0\Projects\STM32F413H-Discovery\Applications\1_ImageIssue faced:15:42:35 **** Build of configuration Debug for project STM32F413H_DISCOVERY_1_Image_SECoreBin ****make all Building file: D:/Vrund/STM32CubeExpansion_SBSFU_V2.4.0/Middlewares/ST/STM32_Secure_Engine/Core/se_bootinfo.cInvoking: MCU GCC CompilerD:\Vrund\STM32CubeExpansion_SBSFU_V2.4.0\Projects\STM32F413H-Discovery\Applications\1_Image\1_Image_SECoreBin\SW4STM32\STM32F413H_DISCOVERY_1_Image_SECoreBin\Debugarm-none-eabi-gcc -mcpu=cortex-m4 -mthumb -mfloat-abi=softfp -mfpu=fpv4-sp-d16 -DSTM32F413xx -DUSE_HAL_DRIVER -DUSE_STM32F413H_DISCOVERY -I"D:/Vrund/STM32CubeExpansion_SBSFU_V2.4.0/Projects/STM32F413H-Discovery/Applications/1_Image/1_Image_SECoreBin/Inc" -I"D:/Vrund/STM32CubeExpansion_SBSFU_V2.4.0/Drivers/CMSIS/Device/ST/STM32F4xx/Include" -I"D:/Vrund/STM32CubeExpansion_SBSFU_V2.4.0/Drivers/CMSIS/Include" -I"D:/Vrund/STM32CubeExpansion_SBSFU_V2.4.0/Drivers/STM32F4x

Hello. For my automotive project I need to imitate motorcycle handlebar that uses LINbus for buttons many buttons. Since I can't always take handle off motorcycle I need to make emulator of it.This is Typical frame, and I mapped all bits of this burst. Brak , sync, ID is by my understanding is generated by master ( ECU ) and data is generated by handlebar controller.Is where any example how to use LINbus? My understanding it should be something like CANBus, I get I whould get IRQ then ID is matched and simply send data just like regular UART message as well as calculate message CRC ? Any information would be welcome. Thank you !

Hi,Have a code that modifies the option bytes on G0 micro which seems bricks the IC from further programming attempts aka device locks itself.Did anyone face a similar issue with G070? What are the solutions to make the programming process robust and avoid bricking of G070?Pls help.

I have signature of my user app and user app in .bin format.if i have to use only these two inputs, what modification i need to do in SBSFU? and under what files?i dont want to use post built .bat and prebuilt.bat.i am using Single slot image example for stm32f407.Regards,Vrund

Hello,I am trying to do a proof-of-concept running the Apache NuttX RTOS on the ST32L562E-DK board as the non-secure application with TrustedFirmware-M.I can build, sign and flash NuttX as the non-secure application and TF-M boots into the RTOS initialization code. However, once the RTOS initialization code issues the first SVC instruction (to request an initial context switch to the 'init' task) the corresponding exception handler is not called (I do see systick exception handler calls, so generally the vector table seems to be set up correctly).What could be the reason that an SVC instruction does not trigger the corresponding exception handler (both the SVC and the handler being in non-secure code)?Any help is highly appreciated.Thanks!Michael

Hello,I want to use sbsfu for STM32L562 controller with STM32Cube IDE version 1.5.AS per primary research i am using below package and project .I am using STM32SecuWS package.Under that project I am using is STM32SecuWS\TFM\STM32Cube_FW_L5_V1.3.0\Projects\NUCLEO-L552ZE-Q\Applications\SBSFU.I have gone through the document.overview-of-secure-boot-and-secure-firmware-update-solution-on-arm-trustzone-stm32l5-series-microcontrollers-stmicroelectronics.pdfAnd I want to use STM32CubeL5 SBSFU on page 10.non secure image primary slot(single slot 1 image).1) For single slot do i required SBSFU_Loader project?2) I only want to upload non secure image(my user application) do i need to run SBSFU\SBSFU_Appli\Secure project? 3) Postbuild.bat process remains same as x cube sbsfu right?4) project example is with L552ZE , i have to use STM32L562 what configuration or settings i need to change in cubeIDE?5) Example project already using mbedTLS library right?6) getting-started-with-stm32cubel5-tfm-appli

Hi,I've been trying to port the STM32H753 SBSFU project to the STM32H735G-DK.The bootloader fails in SFU_BOOT_Init due to failing SE_Init().This is the result of __IS_SFU_RESERVED() failing it's test: 0x08008A00 < 0x08008061 < 0x0801FFFF (SB_REGION_ROM_START < __get_LR() < SB_REGION_ROM_END).As you can see the LR register value is outside of the expected range.Does anyone have an idea why this could be the case?Thanks!

..

I would like to use the RNG of the H743ZI2. The provided example works, but on a new project I can't get it work, The CPU clock is configured to 400MHz just like in the example./* RNG Initialization */   if (HAL_RNG_DeInit(&hrng) != HAL_OK) { /* DeInitialization Error */ Error_Handler(); }   /* Initialize the RNG peripheral */ if (HAL_RNG_Init(&hrng) != HAL_OK) { /* Initialization Error */ Error_Handler(); }uint32_t rnd_number;   void main() { while (1) {   status = HAL_RNG_GenerateRandomNumber(&hrng, &rnd_number); if (status != HAL_OK) { Error_Handler(); } } }