Hello,
I want to integrate a secure boot and secure software update (SBSFU) on a nucleo H753ZI board.
I downloaded the software from https://www.st.com/en/embedded-software/x-cube-sbsfu.html and followed the steps to compile the three programs (SECore, SBSFU and UserApp) proposed in the "projects" folder using the 1-image version of the SBSFU.
The next step was to program the SBSFU application on the board which I tried to do using STM32CubeProgrammer. However, the program has not been completely installed. The first image below shows the device memory after the introduction of the application and the second image shows what should have been programmed. You can observe that the code abruptly stops after the address 0x08000100 while it should continue.
I suspect that something went wrong when I prepared the board and that the region after 0x08000100 has been mistakenly let as an area protected against writing.
My problem is that since this incomplete code has been inserted inside the board, I can not access it in normal mode using STM32CubeProgrammer, I get a DEV_TARGET_NOT_HALTED error. The only way I can connect to the board is through hot plug mode. But from there I am unable to change any configuration, erase the memory or program anything else on the board.
Is there any way to somehow reset the board, or force it to clean anything that has been programmed on it to put it out from its idle and non-available state?
Any suggestions are welcome.
Thank you in advance.
1 ACCEPTED SOLUTION
Accepted Solutions
> My first impression when I read this'd been built and programmed without debugging and without complete knowledge was "what the heck".
Yeah, I am out of my comfort zone with this secure boot. Which is why I tried to stick to the example projects provided by STM first. You have to start somewhere, right? But I guess debugging would have been much better.
> But later you say " it seems that I am not able to connect to the board through STLINK either". You must have "connected" to ascertain "only the bytes from address 0x08000000 to 0x080000FF have been modified".
To clarify, there are a few modes in which you can connect to the board using STM32CubeProgrammer. The mode in which I want to connect is the "normal mode" but I am unable to connect to the board in this mode since I loaded the SBSFU. However, I can connect to the board in "hot plug" mode which allows me to inspect the memory but does not allow me to change option bytes or to erase parts of the memory.
> PCROP regions are 0x100-byte aligned and possibly STM32CubeProgrammer incorrectly displays 0s for unsuccessful read accesses.
PCROP regions are definitely 0x100-byte aligned (see screenshot below).
> Please post yours so we can see what "not able to connect" means.
Here is my output when I try to connect in normal mode, the DEV_TARGET_NOT_HALTED error shows up:
17:36:52 : STM32CubeProgrammer API v2.7.0
17:37:02:823 : STLinkUSBDriver.dll loaded
17:37:02:844 : STLinkUSBDriver.dll loaded
17:37:02:844 : ST-LINK SN : 0036003B3137511039383538
17:37:02:845 : ST-LINK FW : V3J8M3
17:37:02:845 : Board : NUCLEO-H753ZI
17:37:02:845 : Voltage : 3,29V
17:37:04:005 : ST-LINK error (DEV_TARGET_NOT_HALTED)
17:37:04:006 : STLinkUSBDriver.dll loaded
17:37:04:009 : ST-LINK SN : 0036003B3137511039383538
17:37:04:009 : ST-LINK FW : V3J8M3
17:37:04:009 : Board : NUCLEO-H753ZI
17:37:04:009 : Voltage : 3,29V
17:37:06:005 : Error: ST-LINK error (DEV_TARGET_NOT_HALTED)> In my second post I said "Look for the addresses and sizes of each of the protections". Inspect the code and its outputs. What protections does your SBSFU configure? What are their addresses/sizes?
I have the following linker script, is it what you were refering to? It seems that no secure region is defined before 0x08000400.
/*
*****************************************************************************
**
** File : LinkerScript.ld
**
** Abstract : Linker script for STM32H753ZITx Device with
** 2048KByte FLASH, 128KByte RAM
**
** Set heap size, stack size and stack location according
** to application requirements.
**
** Set memory bank area and size if external memory is used.
**
** Target : STMicroelectronics STM32
**
**
** Distribution: The file is distributed as is, without any warranty
** of any kind.
**
** (c)Copyright Ac6.
** You may use this file as-is or modify it according to the needs of your
** project. Distribution of this file (unmodified or modified) is not
** permitted. Ac6 permit registered System Workbench for MCU users the
** rights to distribute the assembled, compiled & linked contents of this
** file as part of an application binary file, provided that it is built
** using the System Workbench for MCU toolchain.
**
*****************************************************************************
*/
VECTOR_SIZE = 0x400;
/* SE Code region protected by MPU isolation */
__ICFEDIT_SE_Code_region_ROM_start__ = 0x08000000 + VECTOR_SIZE;
__ICFEDIT_SE_CallGate_region_ROM_start__ = __ICFEDIT_SE_Code_region_ROM_start__ + 0x4;
__ICFEDIT_SE_CallGate_region_ROM_end__ = __ICFEDIT_SE_Code_region_ROM_start__ + 0x1FF;
/* SE key region protected by MPU isolation */
__ICFEDIT_SE_Key_region_ROM_start__ = __ICFEDIT_SE_CallGate_region_ROM_end__ + 0x1;
__ICFEDIT_SE_Key_region_ROM_end__ = __ICFEDIT_SE_Key_region_ROM_start__ + 0x2FF; /* H7: The minimum PCROP area that can be set is 16 Flash words, that is 512 bytes. */
/* SE Startup */
__ICFEDIT_SE_Startup_region_ROM_start__ = __ICFEDIT_SE_Key_region_ROM_end__ + 0x1;
__ICFEDIT_SE_Code_nokey_region_ROM_start__ = __ICFEDIT_SE_Startup_region_ROM_start__ + 0x100;
/* Aligned SE End at the end of the 1st 32Kbytes of flash, MPU protection isolation constraints */
__ICFEDIT_SE_Code_region_ROM_end__ = 0x08007FFF;
/* SE IF ROM: used to locate Secure Engine interface code out of MPU isolation */
/*
* We must be out of Region 2 to allow unprivileged access
* With the current settings Region 2 starts from 0x08000000 and covers 32kB of code (0x8000)
*/
__ICFEDIT_SE_IF_region_ROM_start__ = 0x08000000 + 0x8000;
__ICFEDIT_SE_IF_region_ROM_end__ = __ICFEDIT_SE_IF_region_ROM_start__ + 0x8FF;
/* Secure memory activation code - initialization area */
__ICFEDIT_SB_HDP_region_ROM_start__ = __ICFEDIT_SE_IF_region_ROM_end__ + 1;
__ICFEDIT_SB_HDP_region_ROM_end__ = __ICFEDIT_SB_HDP_region_ROM_start__ + 0xFF;
/* SBSFU Code region */
__ICFEDIT_SB_region_ROM_start__ = __ICFEDIT_SB_HDP_region_ROM_end__ + 1;
/* Aligned SBSFU end at the end of the 1st 128Kbytes of FLASH, MPU protection constraints */
__ICFEDIT_SB_region_ROM_end__ = 0x0801FFFF;
SE_Entry_Secure_ROM_Region_Length = __ICFEDIT_SE_CallGate_region_ROM_end__ - __ICFEDIT_SE_CallGate_region_ROM_start__ + 1;
SE_Key_region_ROM_Length = __ICFEDIT_SE_Key_region_ROM_end__ - __ICFEDIT_SE_Key_region_ROM_start__ + 1;
SE_Startup_region_ROM_Length = __ICFEDIT_SE_Code_nokey_region_ROM_start__ - __ICFEDIT_SE_Startup_region_ROM_start__ ;
SE_ROM_region_Length = __ICFEDIT_SE_Code_region_ROM_end__ - __ICFEDIT_SE_Code_nokey_region_ROM_start__ + 1;
SE_IF_region_ROM_Length = __ICFEDIT_SE_IF_region_ROM_end__ - __ICFEDIT_SE_IF_region_ROM_start__ + 1;
SB_HDP_ROM_region_Length = __ICFEDIT_SB_HDP_region_ROM_end__ - __ICFEDIT_SB_HDP_region_ROM_start__ + 1;
SB_ROM_region_Length = __ICFEDIT_SB_region_ROM_end__ - __ICFEDIT_SB_region_ROM_start__ + 1;
/* RAM section */
/* SE RAM1 region protected by firewall */
/* SE stack is placed 1st in RAM, stack overflow does not write on other RAM area */
__ICFEDIT_SE_region_RAM_start__ = 0x20000000;
__ICFEDIT_SE_region_RAM_stack_top__ = 0x20000400;
__ICFEDIT_SE_region_RAM_end__ = 0x20000FFF;
/* Secure memory activation code area - execution in RAM */
__ICFEDIT_SB_HDP_Code_region_RAM_start__ = __ICFEDIT_SE_region_RAM_end__ + 1;
__ICFEDIT_SB_HDP_Code_region_RAM_end__ = __ICFEDIT_SB_HDP_Code_region_RAM_start__ + 0xFF;
/* SBSFU RAM1 region */
__ICFEDIT_SB_region_RAM_start__ = __ICFEDIT_SB_HDP_Code_region_RAM_end__ + 1;
__ICFEDIT_SB_region_RAM_end__ = 0x2001FFFF;
SE_RAM_region_Length = __ICFEDIT_SE_region_RAM_end__ - __ICFEDIT_SE_region_RAM_stack_top__ + 1;
SB_HDP_CODE_RAM_region_Length = __ICFEDIT_SB_HDP_Code_region_RAM_end__ - __ICFEDIT_SB_HDP_Code_region_RAM_start__ + 1;
SB_RAM_region_Length = __ICFEDIT_SB_region_RAM_end__ - __ICFEDIT_SB_region_RAM_start__ + 1;
MEMORY
{
SE_Entry_Secure_ROM_Region (rx) : ORIGIN = __ICFEDIT_SE_CallGate_region_ROM_start__, LENGTH = SE_Entry_Secure_ROM_Region_Length
SE_Key_region_ROM (rx) : ORIGIN = __ICFEDIT_SE_Key_region_ROM_start__, LENGTH = SE_Key_region_ROM_Length
SE_Startup_region_ROM (rx) : ORIGIN = __ICFEDIT_SE_Startup_region_ROM_start__, LENGTH = SE_Startup_region_ROM_Length
SE_ROM_region (rx) : ORIGIN = __ICFEDIT_SE_Code_nokey_region_ROM_start__, LENGTH = SE_ROM_region_Length
SE_IF_region_ROM (rx) : ORIGIN = __ICFEDIT_SE_IF_region_ROM_start__, LENGTH = SE_IF_region_ROM_Length
SB_HDP_ROM_region (rx) : ORIGIN = __ICFEDIT_SB_HDP_region_ROM_start__, LENGTH = SB_HDP_ROM_region_Length
SB_ROM_region (rx) : ORIGIN = __ICFEDIT_SB_region_ROM_start__, LENGTH = SB_ROM_region_Length
SE_RAM_region (xrw) : ORIGIN = __ICFEDIT_SE_region_RAM_stack_top__, LENGTH = SE_RAM_region_Length
SB_HDP_Code_RAM_region (xrw) : ORIGIN = __ICFEDIT_SB_HDP_Code_region_RAM_start__, LENGTH = SB_HDP_CODE_RAM_region_Length
SB_RAM_region (xrw) : ORIGIN = __ICFEDIT_SB_region_RAM_start__, LENGTH = SB_RAM_region_Length
}