WRP bits not working ?

[Ronan Gaillard]

Posted on March 22, 2018 at 11:06

Hi,

I am working with the STM32f407 : I have a bootloader in the first flash sector (ie. @ 0x0800 0000), and my main program in the following sectors (ie. @ 0x0800 4000). I want to protect my bootloader against unwanted writes, so I used the WRP bits to protect it.

What I've done is write 0xFFFE (ie. Sector 0 with write protection enable) to the 0x1FFF C008 Option Bytes. By reading it back I'm sure that it has been well written. (I'm writing the Option Bytes by DFU using dfu-utils).

After reset I am able to write to sector 0 using either DFU or ST-LINK, which I should not be allowed to.

Am I missing something ?

Best,

Ronan

#wrp #dfu #option-bytes #stm32f407

[waclawek.jan]

Posted on March 22, 2018 at 13:06

Can you read out and check the option bytes using ST-Link?

JW

[Ronan Gaillard]

Posted on March 22, 2018 at 14:55

Hi,

I am able to read bytes by using 

st-flash read tmp.bin 0x1fffc008 1

Which result in a file containing 0x00f0ff0f

But I am not able to write using 

st-flash write tmp.bin 0x1fffc008

The result is : Unknown memory region

Also in the finished product the only access to the stm32 will be by USB, so I would like to manipulate WRP bytes by DFU.

Thanks for your time !

[waclawek.jan]

Posted on March 22, 2018 at 16:01

What is st-flash?

If 0x00f0ff0f is content of memory on 0x1fffc008, then it's clearly not set to 0xFFFE, is it?

Can you try the ST-Link Utility to read out or set  the option bytes?

JW

[Ronan Gaillard]

Posted on March 22, 2018 at 16:17

st-flash is the open source version of the STMicroelectronics Stlink Tools. I am working on a mac, st-link utility is not supported.

It shows0x00f0ff0f because I wrote different values to see if anything changed, my bad.

Reading these bytes using DFU i get the same value :

dfu-util -a 1 -s0x01FFFC008:2 -U tmp.bin && xxd -p tmp.bin

Result is

0x00f0

So Sector 0 is protected for sure according to datasheet. But I am still able to write to it.

I switched to a windows machine and attached the screenshot, stlink utility reads0x0FFF which is completely different. Trying to figure out what's happening.

________________ Attachments : screenshot.png : https://st--c.eu10.content.force.com/sfc/dist/version/download/?oid=00Db0000000YtG6&ids=0680X000006Hxr5&d=%2Fa%2F0X0000000b1a%2Fasuw397ZASS6PSCvqtTiFok3LxI0AVQSeaE0tuEm0Gc&asPdf=false

[Ronan Gaillard]

Posted on March 22, 2018 at 16:28

So I changed the option bytes using stlink utility to the following (details in screenshot).

I am still able to write to sector 0 using dfu. Any idea ?

[waclawek.jan]

Posted on March 24, 2018 at 19:49

So is this the readout value of the option bytes?

And does the DFU actually overwrite the 1st sector? AN3156 in footnote to Table 4. DFU bootloader commands , for write when write protection enabled, says:

This operation is allowed but not effective: the bootloader does not return an error but the operation is not

executed since the sectors are write-protected. This applies only to the Flash memory. It does not apply tothe RAM memory or the option byte area.

I know nothing of DFU, but the quote above says that principially it *is* possible to remove the write protection by writing to the options, so the PC side program may do this before performing the write itself (as the STLink Utility does, albeit it does warn about it too).

JW