STM32 MCUs Security

Hello,Objective:I have to update the firmware of an STM32F412 using the bootloader in system memory (through UART protocol).Situation:A command in my user code allows jumping to the bootloader after a system reset (so the device is in nominal state). This works well and allows to update the firmware if the readout protection is not activated (RDP=0xaa).Problem:If the readout protection is activated (RDP=0xbb), the bootloader command that deactivates it does a mass erase (as expected) but also a system reset (as documented in AN3155 p.34). As there is no access to the BOOT0 pin in my case, this system reset makes the MCU exit the bootloader code and renders the flashing impossible.Questions:Is there a solution to remove the readout protection and stay in the bootloader so the new firmware could be written to flash? Or another way to achieve the stated objective?Thanks for reading!PA

I am working on STM32G030J6, and I programmed it using STMCubeProgrammer through BOOT0 pin. I have also changed the option bytes nboot_sel to 0 to boot from pin and NRST mode to GPIO. The code works fine when RDP level is set to 0. When RDP is set to 1, the MCU works randomly; it sometimes executes the code and sometimes doesn't. I was wondering if the problem is a hardware problem or a configuration mistake. Would highly appreciate your help and suggestions.

..

..

Hi I am going to use the binary file (SBSFU_STM32L496G-Discovery_Cloud_AWS_V1.4.0.bin) on development kit P-L496G-CELL02 to connect AWS server. However, the boot up prompt message does not include the configuration of external SIM card and VPN entry, so I cannot take the next step to do AWS root certificate update. Please let us know how to config the BG96 modem.Thanks !Beside, I cannot find project file (.ioc) in STM32CubeExpansion_Cloud_AWS_V1.4 2 folder. It only has (.uvprojx) and (.eww) project files but I don’t have IAR or KEIL compliers to open it. Can I know whether it has any project file that can be opened by STM32cubeMX ?Regards,Kelvin..= [SBOOT] System Security Check successfully passed. Starting...= [FWIMG] Slot #0 @: 8080800 / Slot #1 @: 8014000 / Swap @: 80ec800=======================================================================       (C) COPYRIGHT 2017 STMicroelectronics     &nbs

Please send the link

Hello,I am currently trying to understand exactly how CRC_Handle_16 function works within the stm32f0xx_hal_crc.c file so I can implement the algorithm in a non-hardware way. The non-hardware implementation I have works fine if there is an even number of BufferLength. The problem I'm having is when I try to insert an odd number of elements. Basically, what I want to know is what exactly is happening on lines 23-24 and how would I implement this in a non-hardware way? Any help is appreciated, thanks./** * @brief Enter 16-bit input data to the CRC calculator. * Specific data handling to optimize processing time. * @param hcrc CRC handle * @param pBuffer pointer to the input data buffer * @param BufferLength input data buffer length * @retval uint32_t CRC (returned value LSBs for CRC shorter than 32 bits) */ static uint32_t CRC_Handle_16(CRC_HandleTypeDef *hcrc, uint16_t pBuffer[], uint32_t BufferLength) { uint32_t i; /* input data buffer index */ __IO uint16_t *pReg;   /*

Hi,I've been successfully using the SBSFU example app found in STM32Cube_FW_L5_V1.2.0 SDK on the Nucleo-L552ZE. I'd now like to alter the partition size for the secure and non-secure f/w to suit my application. Initially I'd like to make the partitions both equally sized, so go from 4000h and 34000h to 1C000h for each (same overall size). I've altered the partition size definitions in flash_layout.h and all the project elements clean build fine (bootloader, secure and non-secure). However, after loading the files to the device in exactly the same way as used successfully before, the bootloader fails reading the image header and can find no bootable image.Can someone please detail all the steps required to change the partition size?I'm using the IAR EW for ARM v8.50.1.

Hi Frantz , Jocelyn and All,I worked ~year ago ago with Jocelyn on SBSFU SMT32L0 security project (IAR environnement @ Deltadore), starting now this workshop for a refresh :)Now, with CubeIDE and my old windows laptop, not sure the Board is well recognized, see attached screen-shotAlso, can you tell me about Linux support, as I have cube Ide running under linux too.Thanks for your supportYou can also contact me with my @deltadore emailGilles Bourgeois

I've recently acquired the P-L496G-CELL02 board to test the ST integration with Azure IoT Hub.The software provided by ST includes projects for the next boards:STM32F769I-DISCO (2 Mbytes of Flash)STM32F413H-DISCO (1.5 Mbytes of Flash)B-L475E-IOT01A (1 Mbyte of Flash)P-L496G-CELL02 (1 Mbyte of Flash)I imported all the SW4STM32 projects from SMT32CubeIDE, running on Ubuntu.The first 2 cases compile as expected, generating both bin and sfb files, which combine bootloader and user application.On the other hand, the last 2 projects include 2 linker scripts, one which adds the bootloader, and another which excludes it. These 2 projects were configured to use the later linker script, so I modified the project settings to use the first one and to use size optimizations.After that, I'm getting this error:STM32L496G-Discovery_Azure.elf section `.rodata' will not fit in region `APPLI_region_ROM'I think this issue is related to the memory size of the output files, because I also found this comment

Hi, I make the programming my stm32f4x chip using raspberry pi through OpenOcd. It's working and upload the code inboard but I am stuck in read protection level 2.If we can not enable/active this through openocd then other option is also okay for me. I just need to active level 2 protection through raspberry pi.

For my new article project "Secure Elements" on www.chip-info.com I am trying to figure out which personalisation options are available for STSAFE-A.  STSAFE brochure explains that that ST offers customer-specific personalisation service for projects > 50ku. In addition, AN5435 describes a standard profile used for generic STSAFE-A samples. Can I create a custom personalisation profiles myself - for in-house production use? How? Do I have to sign an NDA?

My collegue and I did not receive demo boards.We will attend the workshop this monday (22nd June).Have the demo boards been sent ?Can we join the workshop on the 26th June instead ? Will the boards be delivered before the 26th ?

..

..

I have implemented an application with FreeRTOS. Now I want to run it as an application with SBSFU. It seemed to have a hard fault in SFU_LL_SB_SRAM_Erase(). It stuck in a place with R15(PC) 0x08008FEC ( The function HardFault_Handler for SBSFU is 0x08008ff2).I tried to comment SFU_LL_SB_SRAM_Erase() and then it did jump to the application, but still stuck in HardFault_Handler for the application.My application is a bit big. Its .sfb is 185KB. But it can run correctly alone without SBSFU. I also tried to make my application much smaller, to be 40KB, and then the application can running with SBSFU correctly. So, it seems to be related to the size of the application?Any idea how to solve the problem? Thanks! 

Hi, I have a question with linker descriptions. I am using the sbsfu example projects of STM32L432KCUx with my user application which runs on STM32L452CEUX. This user application had the attached different linker description. I modified the linker descriptions for SECorebin and SBSFU projects.Could anyone let me know if the modifications are correct and inline with the linker description of user application.

Hello,I'm working on two ST Nucleo-F439ZI boards, and using the Eclipse based STM32 IDE for the development and deployment on the boards.I'm using the CRYP module in DMA mode to carry out AES-CBC operations.I've generated the main skeleton of the code using the code generator, and this is the relevant output:void HAL_CRYP_MspInit(CRYP_HandleTypeDef* hcryp) { if(hcryp->Instance==CRYP) { /* USER CODE BEGIN CRYP_MspInit 0 */ /* USER CODE END CRYP_MspInit 0 */ /* Peripheral clock enable */ __HAL_RCC_CRYP_CLK_ENABLE(); /* CRYP DMA Init */ /* CRYP_IN Init */ hdma_cryp_in.Instance = DMA2_Stream6; hdma_cryp_in.Init.Channel = DMA_CHANNEL_2; hdma_cryp_in.Init.Direction = DMA_MEMORY_TO_PERIPH; hdma_cryp_in.Init.PeriphInc = DMA_PINC_DISABLE; hdma_cryp_in.Init.MemInc = DMA_MINC_ENABLE; hdma_cryp_in.Init.PeriphDataAlignment = DMA_PDATAALIGN_BYTE; hdma_cryp_in.Init.MemDataAlignment = DMA_MDATAALIGN_BYTE; hdma_cryp_in.Init.Mode = DMA_NORMAL; hdma_cryp_in.Init.Priority = DMA_PRIOR

2 small bugs I encountered:** sfu_error.c l.246function SFU_ErrorStatus SFU_EXCPT_Check_Code(SFU_EXCPT_IdTypeDef eExceptionId)=> missing case SFU_EXCPT_NONE=> never returns SFU_ERROR (should be added in default case)** When assertion is enabled in CubeMx project, compilation fails.There's an extra line which can be removed I guess (assert_param)cf below:sfu_low_level_security.c  l.886in function FU_ErrorStatus SFU_LL_SECU_SetProtectionDAP(void)<< assert_param(SFU_IS_FUNCTIONAL_STATE(eState));>>  

I tried several time to download the X-CUBE-SBSFU from the ST official page. Every time I request the software I got the message that after 48h I will get it by mail. But when I check I don't find it (even in spam).Do you have any idea plz ?

Hi,I am now trying to make my own SBSFU project to receive the firmware from the USB HS interface instead of the UART interface.However, the USB related code caused the memory fault exception.I've extended the size of MPU protection to 512KB with full access from address PERIPH_BASE(0x40000000UL) to cover the USB_OTG_HS_PERIPH_BASE(0x40040000UL).But it doesn't solve the memory fault issue.#define SFU_PROTECT_MPU_PERIPH_1_RGNV MPU_REGION_NUMBER0 #define SFU_PROTECT_MPU_PERIPH_1_START PERIPH_BASE /*!< Peripheral memory area */ #define SFU_PROTECT_MPU_PERIPH_1_SIZE MPU_REGION_SIZE_512KB//MPU_REGION_SIZE_128KB #define SFU_PROTECT_MPU_PERIPH_1_SREG 0x00U /*!< All subregions activated */ #define SFU_PROTECT_MPU_PERIPH_1_PERM MPU_REGION_FULL_ACCESS #define SFU_PROTECT_MPU_PERIPH_1_EXECV MPU_INSTRUCTION_ACCESS_DISABLE #define SFU_PROTECT_MPU_PERIPH_1_TEXV MPU_TEX_LEVEL0 #define SFU_PROTECT_MPU_PERIPH_1_B MPU_ACCESS_BUFFERABLE #define SFU_PROTECT_MPU_PERIPH_1_C MPU_ACCESS_NOT_CACHEABLEWit

I have 2 different files, and I want to add a header to them in order to use them in SBSFU and check to header before installing the image.I have found this image that shows how the header should be but I don't know how to add it (or add some of it)Can any one plz help me with this ?

Hi, I have the STM32F427VI, I don't know how this happend but now is read/write protected Level1. How can I reset this, I want to disable read protection at all to burn my application.Now I can't read the memory with STM Utility with J-TAG and coudn't erase memory with Demonstrator GUI via RS232. Please see the attached image.

Hi,Although not specified in the reference manual it looks like the CRC process within the FLASH module (see section 4.3.12) has to have start and end addresses aligned to possibly the CRC_BURST size (I've only tried 128 byte bursts so far). If not aligned the same data contents produces different CRC results depending on the values before and after the data.Some might say this is implied when described in the CRC paragraph but the HAL code does not check for it and the documentation for the address registers do not mention it (sections 4.9.20 and 4.9.21 plus those for bank 2).This is a fairly important thing to know if you intend to compare the CRC that the STM FLASH module calculates with one that was calculated somewhere else.Hope this info prevents someone else wasting an afternoon finding it out.Nigel

I receive the mail to download the X-CUBE-SBSFU but the link seems not workin