cancel
Showing results for 
Search instead for 
Did you mean: 

H753ZI board unaccessible after download of incomplete secure boot

EBonv
Associate III

Hello,

I want to integrate a secure boot and secure software update (SBSFU) on a nucleo H753ZI board.

I downloaded the software from https://www.st.com/en/embedded-software/x-cube-sbsfu.html and followed the steps to compile the three programs (SECore, SBSFU and UserApp) proposed in the "projects" folder using the 1-image version of the SBSFU.

The next step was to program the SBSFU application on the board which I tried to do using STM32CubeProgrammer. However, the program has not been completely installed. The first image below shows the device memory after the introduction of the application and the second image shows what should have been programmed. You can observe that the code abruptly stops after the address 0x08000100 while it should continue.0693W00000APJdCQAX.png0693W00000APJd7QAH.png 

I suspect that something went wrong when I prepared the board and that the region after 0x08000100 has been mistakenly let as an area protected against writing.

My problem is that since this incomplete code has been inserted inside the board, I can not access it in normal mode using STM32CubeProgrammer, I get a  DEV_TARGET_NOT_HALTED error. The only way I can connect to the board is through hot plug mode. But from there I am unable to change any configuration, erase the memory or program anything else on the board.

Is there any way to somehow reset the board, or force it to clean anything that has been programmed on it to put it out from its idle and non-available state?

Any suggestions are welcome.

Thank you in advance.

13 REPLIES 13
Remi QUINTIN
ST Employee

I don’t know the H7 option bytes. Setting the PCROP-RDP to 1 enables the complete erasure of all protected areas when the RDP is reset on the WB.

Could it be the case for the H7 if this PCROP-RDP exists?

On the H7 there is a combination of OBs that reaches the same behavior. There are two option bytes (DMEP1 and DMEP2) which, if they are set, erase the two flash banks when RDP level regression occurs. These two OBs are set on my board, unfortunately the RDP protection is currently set to the level 0, so no regression of that is possible.

Also, I am only able to connect to the board using the "hot plug" mode. In this mode, I am unable to modify any of the option bytes.

Remi QUINTIN
ST Employee

Set the RDP level to 1 and then back to 0 and the regression will trigger the complete erasure of the flash memory.

It works like that on the WB.

As discussed previously with Alister, I am only able to connect to my board in hot plug mode. Connecting in any other mode fails. While in hot plug mode, I can not modify the values of the option bytes, therefore I can not change the RDP level. Here follows the output in STM32CubeProgrammer when I try to set the RDP level to 1 :

13:07:38:611 : Option byte command : -ob  RDP=187 
  13:07:38:646 : PROGRAMMING OPTION BYTES AREA ...
  13:07:38:646 : Buffer program...
  13:07:38:646 : w ap 0 @0x580244F4 0x00000004 bytes Data 0x00000002
  13:07:38:646 : Reading data...
  13:07:38:647 : r ap 0 @0x58000528 0x00000004 bytes Data 0x00000000
  13:07:38:647 : Buffer program...
  13:07:38:652 : w ap 0 @0x580244F4 0x00000004 bytes Data 0x00000002
  13:07:38:653 : Reading data...
  13:07:38:653 : r ap 0 @0x58000528 0x00000004 bytes Data 0x00000000
  13:07:38:653 : Buffer program...
  13:07:38:654 : w ap 0 @0x580244F4 0x00000004 bytes Data 0x00000002
  13:07:38:654 : Reading data...
  13:07:38:662 : r ap 0 @0x58000528 0x00000004 bytes Data 0x00000000
  13:07:38:683 : Reading data...
  13:07:38:695 : r ap 0 @0x1FF1E880 0x00000004 bytes Data 0x00000800
  13:07:38:695 : Database: Config 2 is active.
  13:07:38:695 :   Bank          : 0x00
  13:07:38:696 :   Address       : 0x5200201c
  13:07:38:696 :   Size          : 308 Bytes
  13:07:38:696 : OB buffer: �?�����?���?���?����?���?���?���?���?���?���?����?���?���?����?����?���?���?����?���?���?����?���?���?����?���?���?���?����?����?����?����?����?���?���?����?���?���?���?����?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?����?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?���?�����?���?�����?���?���?���?���?���?���?����?���?���?����?����?���?���?����?���?���?����?���?���?����?���?���?���?����?����?����?����?����?���?���?����?���?��
  13:07:38:696 : Buffer program...
  13:07:40:003 : halt ap 0 Status = 18
  13:07:40:003 : halt ap 1 Status = 32
  13:07:40:010 : halt ap 2 Status = 32
  13:07:40:010 : w ap 0 reg 15 PC   (0x24000000)  
  13:07:40:011 : w ap 0 reg 17 MSP  (0x24000500)  
  13:07:40:011 : w ap 0 reg 16 xPSR (0x01000000)  
  13:07:40:012 : w ap 0 @0x24001220 0x00000200 bytes Data 0x00000000
  13:07:40:013 : w ap 0 @0x24000000 0x00000004 bytes Data 0x0000BE00
  13:07:40:073 : w ap 0 @0x24000004 0x00000DF4 bytes Data 0xB672B580
  13:07:40:074 : w ap 0 @0x24001220 0x00000134 bytes Data 0x1BC6AAF0
  13:07:40:075 : Loader write option bytes...
  13:07:40:075 : Init flashloader...
  13:07:40:076 : halt ap 0 
  13:07:40:076 : halt ap 0 
  13:07:42:003 : w ap 0 reg 0 R0   0x00000001
  13:07:42:003 : WriteOB function terminated with connection error due to OB_Launch
  13:07:42:006 : UPLOADING OPTION BYTES DATA ...
  13:07:42:006 :   Bank          : 0x00
  13:07:42:006 :   Address       : 0x5200201c
  13:07:42:006 :   Size          : 308 Bytes
  13:07:42:007 : Reading data...
  13:07:42:008 : r ap 0 @0x5200201C 0x00000134 bytes Data 0x1BC6AAF0
  13:07:42:008 : OPTION BYTE PROGRAMMING VERIFICATION:
  13:07:42:009 : Error: Expected value for Option Byte "RDP": 0xBB, found: 0xAA
  13:07:42:095 : Error: Option Byte Programming failed
  13:07:42:117 : Buffer program...
  13:07:42:119 : w ap 0 @0x580244F4 0x00000004 bytes Data 0x00000002
  13:07:42:130 : Reading data...
  13:07:42:131 : r ap 0 @0x58000528 0x00000004 bytes Data 0x00000000
  13:07:42:132 : Buffer program...
  13:07:42:141 : w ap 0 @0x580244F4 0x00000004 bytes Data 0x00000002
  13:07:42:142 : Reading data...
  13:07:42:144 : r ap 0 @0x58000528 0x00000004 bytes Data 0x00000000
  13:07:42:144 : Buffer program...
  13:07:42:145 : w ap 0 @0x580244F4 0x00000004 bytes Data 0x00000002
  13:07:42:145 : Reading data...
  13:07:42:145 : r ap 0 @0x58000528 0x00000004 bytes Data 0x00000000
  13:07:42:165 : Reading data...
  13:07:42:192 : r ap 0 @0x1FF1E880 0x00000004 bytes Data 0x00000800
  13:07:42:194 : Database: Config 2 is active.
  13:07:42:393 : UPLOADING OPTION BYTES DATA ...
  13:07:42:394 :   Bank          : 0x00
  13:07:42:394 :   Address       : 0x5200201c
  13:07:42:394 :   Size          : 308 Bytes
  13:07:42:395 : Reading data...
  13:07:42:395 : r ap 0 @0x5200201C 0x00000134 bytes Data 0x1BC6AAF0

Observe line 47 that the programming of the option byte failed. On the line above, the value 0xBB corresponds to the level 1 RDP and 0xAA corresponds to the level 0. I obtain similar outputs whenever I try to change the value of any option byte.