Flash SBSFU application on STM32H7B3I-DK board

[Ikbal]

Hello,

I am trying to flashing SBSFU application on the STM32H7B3I-DK board using STM32Cube Programmer. I am using STM32H7B3I-DK 1_Image example project from SRM32CubeExpansion_SBSFU_V2.6.1.

The board is working fine in the first boot and all the jumpers are in default settings. After checking the demo application I am trying to flashing the SBSFU application. For the flashing, I am taking guidance from section 8: Step-by-step execution of "UM2262-Getting started with the X-CUBE-SBSFU STM32Cube Expansion Package" document.

The above documents used NUCLEOL476RG board as a reference to flash the application, but I am using STM32H7B3I-DK. Due to different board I have not change the option bytes settings. The board read out protection is set at Leve 0. After completing the above steps and flashing the SBSFU_UserApp.bin, the application is work find and I can see the SBSFU application menu at the tera term screen.

After the restart the board I am not able to see anything's at tera term. I am unable to flash the STM32H7B3I-DK demo binary on the board. I am getting below message in the STM32Cube programmer:

 18:28:21 : Opening and parsing file: STM32Cube_Demo-STM32H7B3I-DK-V1.0.1.hex

 18:28:22 :  File     : STM32Cube_Demo-STM32H7B3I-DK-V1.0.1.hex

 18:28:22 :  Size     : 40.09 MB 

 18:28:22 :  Address    : 0x08000000 

 18:28:22 : Download in Progress:

 18:28:24 : Error: failed to download Segment[9]

 18:28:24 : Error: failed to download the File

 18:28:24 : RUNNING Program

 18:28:24 :  Address:   : 0x08000000

 18:28:24 : Warning: The core is locked up

 18:28:24 : Start operation achieved successfully

Here is my option bytes log:

C:\Program Files\STMicroelectronics\STM32Cube\STM32CubeProgrammer\bin>STM32_Programmer_CLI.exe -c port=swd -ob displ

   -------------------------------------------------------------------

            STM32CubeProgrammer v2.11.0

   -------------------------------------------------------------------

ST-LINK FW : V3J10M3

Board    : STM32H7B3I-DK

Voltage   : 3.29V

SWD freq  : 24000 KHz

Connect mode: Normal

Reset mode : Software reset

Device ID  : 0x480

Revision ID : Rev Z

Device name : STM32H7A/B

Flash size : 2 MBytes

Device type : MCU

Device CPU : Cortex-M7

BL Version : 0x90

UPLOADING OPTION BYTES DATA ...

 Bank     : 0x00

 Address    : 0x5200201c

 Size     : 308 Bytes

██████████████████████████████████████████████████ 100%

OPTION BYTES BANK: 0

  Read Out Protection:

   RDP     : 0xAA (Level 0, no protection)

  BOR Level:

   BOR_LEV   : 0x0 (reset level OFF)

  User Configuration:

   IWDG1_SW   : 0x1 (Independent watchdog is controlled by software)

   NRST_STOP  : 0x1 (STOP mode on Domain 1 is entering without reset)

   NRST_STBY  : 0x1 (STANDBY mode on Domain 1 is entering without reset)

   VDDMMC_HSLV : 0x0 (I/O speed optimization at low-voltage disabled)

   IWDG_FZ_STOP : 0x1 (Independent watchdog is running in STOP mode)

   IWDG_FZ_SDBY : 0x1 (Independent watchdog is running in STANDBY mode)

   SECURITY   : 0x0 (Security feature disabled)

   VDDIO_HSLV  : 0x0 (Product working in the full voltage range,I/O speed optimization at low-voltage disabled)

   SWAP_BANK_OPT: 0x0 (after boot loading, no swap for user sectors)

  Boot address Option Bytes:

   BOOT_CM7_ADD0: 0x801 (0x8010000)

   BOOT_CM7_ADD1: 0x1FF0 (0x1FF00000)

  PCROP Protection:

   PROT_AREA_START1: 0x0 (0x8000000)

   PROT_AREA_END1: 0x8 (0x80008FF)

   DMEP1    : 0x1 (Flash Bank 1 PCROP zone is erased when RDP level regression (change from level 1 to 0) occurs)

   PROT_AREA_START2: 0xFF (0x810FF00)

   PROT_AREA_END2: 0x0 (0x81000FF)

   DMEP2    : 0x1 (Flash Bank 2 PCROP zone is erased when RDP level regression (change from level 1 to 0) occurs)

  Secure Protection:

   SEC_AREA_START1: 0xFF (0x800FF00)

   SEC_AREA_END1: 0x0 (0x80000FF)

   DMES1    : 0x0 (Flash Bank 1 secure area is kept when RDP level regression (change from level 1 to 0) occurs)

   SEC_AREA_START2: 0xFF (0x810FF00)

   SEC_AREA_END2: 0x0 (0x81000FF)

   DMES2    : 0x0 (Flash Bank 2 secure area is kept when RDP level regression (change from level 1 to 0) occurs)

  DTCM RAM Protection:

   ST_RAM_SIZE : 0x0 (2 KB)

  Write Protection:

   nWRP0    : 0x1 (Write protection not active)

   nWRP1    : 0x1 (Write protection not active)

   nWRP2    : 0x1 (Write protection not active)

   nWRP3    : 0x1 (Write protection not active)

   nWRP4    : 0x1 (Write protection not active)

   nWRP5    : 0x1 (Write protection not active)

   nWRP6    : 0x1 (Write protection not active)

   nWRP7    : 0x1 (Write protection not active)

   nWRP8    : 0x1 (Write protection not active)

   nWRP9    : 0x1 (Write protection not active)

   nWRP10    : 0x1 (Write protection not active)

   nWRP11 to nWRP63   : 0x1 (Write protection not active)

C:\Program Files\STMicroelectronics\STM32Cube\STM32CubeProgrammer\bin>

Please guide me to fixed this to successfully flashing the SBSFU application on STM32H7B3I-DK board.

Look forward for your support.

Thanks,

[Jocelyn RICARD]

Hello @Ikbal​ ,

PROT_AREA_START1: 0x0 (0x8000000)

PROT_AREA_END1: 0x8 (0x80008FF)

means you have a PCROP area setup.

To remove it you need to

1) enable RDPL1

2) Regress from RDPL1 to RDPL0 and at the same time set start @ > end @ for the prot area. For instance reusing the values you have in pcrop area number 2.

This will remove the PCROP area and allow you to flash again.

Best regards

Jocelyn

[Ikbal]

Dear Ricard,

Thanks for the response.

I have removed the PCROP area setup as per your described steps. Here I am attaching my current optional bytes logs from STM32H7B3I-DK.

C:\Program Files\STMicroelectronics\STM32Cube\STM32CubeProgrammer\bin>STM32_Programmer_CLI.exe -c port=swd -ob displ

   -------------------------------------------------------------------

            STM32CubeProgrammer v2.11.0

   -------------------------------------------------------------------

ST-LINK FW : V3J10M3

Board    : STM32H7B3I-DK

Voltage   : 3.29V

SWD freq  : 24000 KHz

Connect mode: Normal

Reset mode : Software reset

Device ID  : 0x480

Revision ID : Rev Z

Device name : STM32H7A/B

Flash size : 2 MBytes

Device type : MCU

Device CPU : Cortex-M7

BL Version : 0x90

UPLOADING OPTION BYTES DATA ...

 Bank     : 0x00

 Address    : 0x5200201c

 Size     : 308 Bytes

██████████████████████████████████████████████████ 100%

OPTION BYTES BANK: 0

  Read Out Protection:

   RDP     : 0xAA (Level 0, no protection)

  BOR Level:

   BOR_LEV   : 0x0 (reset level OFF)

  User Configuration:

   IWDG1_SW   : 0x1 (Independent watchdog is controlled by software)

   NRST_STOP  : 0x1 (STOP mode on Domain 1 is entering without reset)

   NRST_STBY  : 0x1 (STANDBY mode on Domain 1 is entering without reset)

   VDDMMC_HSLV : 0x0 (I/O speed optimization at low-voltage disabled)

   IWDG_FZ_STOP : 0x1 (Independent watchdog is running in STOP mode)

   IWDG_FZ_SDBY : 0x1 (Independent watchdog is running in STANDBY mode)

   SECURITY   : 0x0 (Security feature disabled)

   VDDIO_HSLV  : 0x0 (Product working in the full voltage range,I/O speed optimization at low-voltage disabled)

   SWAP_BANK_OPT: 0x0 (after boot loading, no swap for user sectors)

  Boot address Option Bytes:

   BOOT_CM7_ADD0: 0x801 (0x8010000)

   BOOT_CM7_ADD1: 0x1FF0 (0x1FF00000)

  PCROP Protection:

   PROT_AREA_START1: 0xFF (0x800FF00)

   PROT_AREA_END1: 0x0 (0x80000FF)

   DMEP1    : 0x1 (Flash Bank 1 PCROP zone is erased when RDP level regression (change from level 1 to 0) occurs)

   PROT_AREA_START2: 0xFF (0x810FF00)

   PROT_AREA_END2: 0x0 (0x81000FF)

   DMEP2    : 0x1 (Flash Bank 2 PCROP zone is erased when RDP level regression (change from level 1 to 0) occurs)

  Secure Protection:

   SEC_AREA_START1: 0xFF (0x800FF00)

   SEC_AREA_END1: 0x0 (0x80000FF)

   DMES1    : 0x0 (Flash Bank 1 secure area is kept when RDP level regression (change from level 1 to 0) occurs)

   SEC_AREA_START2: 0xFF (0x810FF00)

   SEC_AREA_END2: 0x0 (0x81000FF)

   DMES2    : 0x0 (Flash Bank 2 secure area is kept when RDP level regression (change from level 1 to 0) occurs)

  DTCM RAM Protection:

   ST_RAM_SIZE : 0x0 (2 KB)

  Write Protection:

   nWRP0    : 0x1 (Write protection not active)

   nWRP1    : 0x1 (Write protection not active)

   nWRP2    : 0x1 (Write protection not active)

   nWRP3    : 0x1 (Write protection not active)

   nWRP4    : 0x1 (Write protection not active)

   nWRP5    : 0x1 (Write protection not active)

   nWRP6    : 0x1 (Write protection not active)

  .. to ..

   nWRP63    : 0x1 (Write protection not active)

C:\Program Files\STMicroelectronics\STM32Cube\STM32CubeProgrammer\bin>

I don't want to make the same mistake to flash the SBSFU application. So, please help me with proper flashing and executing procedure for 1_Image example of SBSFU application from STM32H7B3I-DK project of SRM32CubeExpansion_SBSFU_V2.6.1 package.

Look forward for your support.

Thanks and Regards,

Ikbal

[Jocelyn RICARD]

Hello @Ikbal​ 

You can disable the SBSFU protections to be able to make tests.

This is done with compilation flags you will find in Projects\STM32H7B3I-DK\Applications\1_Image\1_Image_SBSFU\SBSFU\App\app_sfu.h

Best regards

Jocelyn

[Ikbal]

Dear Ricard,

Thank you for sharing. I will go through the file.

I have one more query regarding flashing of SBSFU example on the STM32H7B3I-DK board using STM32 Cube programmer.

1. STM32 board preparation section of UM2262 user manual explain the option bytes settings for NUCLEO-L476RG. Is it will be same for STM32H7B3I-DK? if not, what will be the settings of option bytes and addresses for STM32H7B3I-DK?
2. How can I download the SBSFU application to the target?

Currently I am using STM32H7B3I-DK 1_Image example without any changes to understand the SBSFU application.

Thanks and Regards,

Ikbal

[Jocelyn RICARD]

Hello @Ikbal​ 

You can have a look to the readme files of the SBSFU on UserApp projects, everything is explained.

Basically, you just need to flash the SBSFU_UserApp.bin to a clean target through the programmer.

Best regards

Jocelyn

[Ikbal]

Dear Ricard,

Thank you for your support.

I have followed all the steps that you have maintain and UM2262 have, but still I am unable to see any messages on my tera term screen.

I want to quickly summarize what I have done till now.

A. I have chosen STM32H7B3I-DK 1_Image project. Successfully compiled the project with below changes:

1. #define SECBOOT_CRYPTO_SCHEME SECBOOT_ECCDSA_WITHOUT_ENCRYPT_SHA256   /*!< Selected Crypto Scheme */

2. Building prebuild and post-build scripts using python scripts.

3. Using app_sfu.h as same

B. Connect the board with PC and check the option bytes and ease the full chip. I am attaching my options bytes log as a text fine in attachment.

C. Flashed the SBSFU_UserApp.bin using STM32 Cube programmer download options to STM32H7B3I-DK.

D. Opening the tera term after restart the board according to the UM2262 but not able to see any message.

Please correct me if I am doing anything wrong.

It looks like I am missing something. Please help to to execute the SBSFU application on STM32H7B3I-DK.

Thanks and Regards,

Ikbal

[Jocelyn RICARD]

Hello @Ikbal​ 

in you option bytes log, you can see that Boot address is set to 0x08010000 which is wrong.

The secure boot is supposed to start at beginning of flash, that is 0x08000000.

So, please change this address, it should work

Best regards

Jocelyn

[Ikbal]

Dear Ricard,

Thank you for the support. Now I am able to see the logs in Tera term.

Thanks and Regards,

Ikbal