STM32 MCUs Security

Hello, Having an issue with STM32G031K6Ux MCU. Below added function that checks Options bytes, and if needed - makes changes (power re-cycle is needed after it).This function CheckOptionBytes() works OK on several MCU's. But on this MCU we have an issue, that sometimes after flashing - we cannot reach MCU anymore, and we are thinking that it locks to Readout Protection Level 2. But it's random. We can reflash the same MCU N amounts, and then it locks in a random moment. I cannot see anything on Errata about it. Only about the BOOT0 pin issue on RDP1 (2.1.3 section), but it's not our case, we are not using it and it will not block reaching MCU again through SWD.Does anyone see a possible issue with the function or know another possible cause?Thank You!Code below:static void CheckOptionBytes(void) { FLASH_OBProgramInitTypeDef OBInit = { 0 };   /* Read Option bytes */ HAL_FLASHEx_OBGetConfig(&OBInit);   /* Check BOR, BOOT0 and RDP Option Bytes */ if (((OBInit.USERConfi

Hello,I am trying to access the MX25LM NOR-Flash chip on the B-U585I-IOT02A board via OCTOSPI2. The nCS pin is connected to PI5. However, attempting to enabe the peripheral clock for IO port I by setting Bit 8 (GPIOIEN) of register RCC_AHB2ENR1 fails (I.e. bit 8 remains at value 0). For all other IO ports (A-H) it works as expected.Any idea what might cause this behaviour?Note: The code is running as a device driver under the Apache NuttX RTOS in the non-secure world. TrustedFirmware-M (from STM32CubeU5 v1.0.2) is running on the secure side.Any help is very appreciated.Bye,Michael

Hey, I'm Working with STM32WB5x on a bare metal MAC 802.15.4 Application.I Have the BLE_MAC_***_FW latest (version 1.13.0) installed on CM0+ .I want to add security for MAC Frames with support for both ENC-MIC. The current ST WPAN MAC 802.15.4 implementation dose not provide any functions/ data types (structures) related to security. Also I cannot set any security related PIB Attributes and i end up with a Set Confirmation return status of 0xF4 (indicating that "A SET/GET request was issued with the identifier of a PIB attribute that is not supported" ... NORDIC).So logically, One can assume that these PIBs were not considered/developed on the CM0+ FW.Why does the ST WPAN Middleware lack Security Structures dentition ?Why the MAC_802_15_4_FW firmware for CM0+ does not handle Security, although as my understanding, ZigBee supports security & keys setup ?When will the ST team provide the missing functionality for the IEEE 802.15.4 standard ?

Hi All,I am almost finished integrating the SBSFU into my project. I can run the SBSFU and user app and update the processor, STM32L4R9VITx, successfully while no protections are enabled. When I enable firewall protection it boots into my application but fails on the first write to a special function register. The SBSFU restarts with a firewall reset detected and retries the application.My application uses FreeRTOS and the freeRTOS SVC and PendSVC handlers.Any ideas as to why I cant write to the SFR's?SBSFU Linker files and pictures of the debugger instructions below.mapping_sbsfu.ld /* SE Code region protected by firewall */ VECTOR_SIZE = 0x200; __ICFEDIT_SE_Code_region_ROM_start__ = 0x08000000 + VECTOR_SIZE; __ICFEDIT_SE_CallGate_region_ROM_start__ = __ICFEDIT_SE_Code_region_ROM_start__ + 0x4; __ICFEDIT_SE_CallGate_region_ROM_end__ = __ICFEDIT_SE_Code_region_ROM_start__ + 0x1FF;   /* SE key region protected by firewall */ __ICFEDIT_SE_Key_region_ROM_start__ = __ICFEDIT_SE_CallGa

Hello,I want to use the security features included in the TFM in my application, I have followed UM2851, now,I have a better understanding for TFM and I succeed to implement it in STM32U585, to go further I want ot implement my own non-secure application and to interact and use secure services via PSA APIs, I have searched all the web for that, but I didn't find a hint.Any explanation or a hint, please ! Thank you.Regards,ZK.

HelloI'm starting to implement AES-GCM on STM32H753 (rev V).I've found an inconsistency between the HAL and the Ref Manual.The STMicro HAL for AES for STM32H7x3 is setting some bits called NPBLB in CRYP_CR register if the product revision is above rev B.But these bits are not documented in the ref manual rev 7.Is it just an error of the HAL ?

I have requested a X-CUBE-CRYPTOLIB V4 download last week, and no answer from ST.I have indicated all requested information and received an acknowledge, but no link to download the library.Could you tell me why ?

I received today the link to download version 2.6.0 of X-CUBE-SBSFU. Is it possible to install it along with the other X-CUBE Packages within the STM32CubeIDE? I successfully verified the integrity of the downloaded file and tried to install it using the "From Local..." button in the "Embedded Software Packages Manager" window.After the decompression of the file, the following error message is produced.  How should I proceed to install this expansion package?Nicola

I am using STM32CubeExpansion_SBSFU_V2.6.0 to test SBSFU on B-L4S5I-IOT01A board.I am using the projects in the Projects/B-L4S5I-IOT01A/2_Images_KMS folder with STM32CubeIDE. I did not change or modify anything regarding the files.I first built the SECoreBin and then the SBSFU project. Then I followed UM2262 documentation page 48 to flash the SBSFU.bin image. I connected to the board with Tera Term but getting the following error output:Am I missing something?

@Jocelyn RICARD​ My user app logs a status and error messages to an SD card. I would like to log all the SBSFU startup messages to the same SD card. Would I introduce security vulnerabilities if I modify the SBSFU to send its TRACE messages to an SD card?

..

Hi,We are currently using an stm32l5 in our product and experimenting with a stm32L562E-dk and with the official TFM (https://git.trustedfirmware.org/TF-M/trusted-firmware-m.git master branch on the latest commit at this date.) The TFM is unmodified.We are building the test-app and followed the documentation : https://tf-m-user-guide.trustedfirmware.org/platform/ext/target/stm/stm32l562e_dk/readme.html. The test-app is running well.The issues arises when we want to modify the test-app :lib/ext/tfm_test_repo-src/app/main_ns.cAccessing registers such as SCB, NVIC will trigger an Hardfault. (So impossible to call HAL_Init and impossible to build a real application to interract with the TFM).For example adding in the application :volatile uint32_t scb = SCB->AIRCR; LOG_MSG("Non-Secure system starting...\r\n");Will trigger an hardfault (busfault excalated to hardfault) on the register accessAfter a long investigation, we don't see an explanation as the current protection (MPU, IDAU, SAU,

Hi everyone.I am working on SMBus communication and i want to calculate PEC (packet error code) value. PEC value is using CRC-8 checksum with 0x07 polynomial. I want to use CRC peripheral in STM32G031F6 for PEC calculate. Cubemx settings are below.And code is here;CRC_Data[0] = 0x16; CRC_Data[1] = 0x0f; CRC_Data[2] = 0x17; CRC_Data[3] = 0xe9; CRC_Data[4] = 0x03; SMBus_PEC = HAL_CRC_Calculate (&hcrc, CRC_Data, 5);SMBus_PEC value is 0x54 but this is wrong. It must be 0xE8. I am calculating with online CRC calculation from this site ==> https://www.lddgo.net/en/encrypt/crcI read from the SMBus PEC value is also 0xE8. Also, when I calculate it manually, i get same value.What is the problem?Have a nice day.

I already used tamper detection mechanism, now I want to use it with Trustzone activated, I configured the tamper as non secure first and it works, but when I tried to configure it as secure, it didn't work, and I couldn't detect the tamper, we know from the documentation of trustzone that the system boots in the secure state and then switch to non secure state, and it stays in this state, access from secure to non-secure is always allowed, however from the non secure state we can access the secure state only through a non secure callable, my question is if the tamper is configured, can I detect tamper events and will the detection happened in the secure state or non-secure state........ I don't understand using tamper with trustzone!Thank you.

Actually, I'm trying to use passive tamper detection with trustzone activated in stm32U5. I'm using pushbutton to simulate the tamper and I want to to toggle an LED as a response, it works when I configure the tamper as non-secure, and the LED is configured in both scenarios (secure or non-secure), but unfortunately when I try to configure the tamper as secure it doesn't work and it's unable to generate interruption in the secure world, I'm wondering if we can use the tamper in the secure world, according to the documentation the TAMP is fully securable by trustzone, but when I tried it I didn't get any interruption and the tamper was not detected.Thank you.

I have a problem with erasing sector 0 in Bank 1 of a stm32h7 CPU. See my code snipped below...When I run the code in the debugger, the CPU never returns from the call to HAL_FLASHEx_Erase. When I interrupt the programm the PC is set to 0xFFFFFFFE which I learned, means the CPU has stopped.The code is called from BL_SBSFU bootloader and runs in a complete copy of the bootloader in RAM. The code seems to be correct, because when I try to erase sector 1 or bank 2 the code runs without an error and the sector is erased.Only when I try to erase sector 0 the CPU stops.The code runs completely in RAM and does not access the FLASH so I think there should be no problem in deleting sector 0.Has anyone an idea why the CPU stops when I try to erase sector 0 ? __disable_irq(); if (HAL_FLASH_Unlock() == HAL_OK) { FLASH_EraseInitTypeDef p_erase_init; p_erase_init.TypeErase = FLASH_TYPEERASE_SECTORS; p_erase_init.Banks = FLASH_BANK_1; p_erase_init.Sector = 0;  p_erase_init.NbSectors = 1U;

=================== Main Menu ============================ Download a new Fw Image ------------------------------- 1 Test Protections -------------------------------------- 2 Test SE User Code ------------------------------------- 3 Multiple download ------------------------------------- 4 Validate a FW Image------------------------------------ 5 Selection :================ New Fw Download ========================= -- Send Firmware -- -- Erasing download area ... -- -- File> Transfer> YMODEM> Send . -- -- !!Aborted by user!! -- !!Operation failed!!

Hi,As title. I imported project and try to build code. But got error as below:21:47:18 **** Build of configuration Release for project B-L475E-IOT01_GoogleIoT ****make -j16 all rm -f B-L475E-IOT01_GoogleIoT.elfmake[1]: *** No rule to make target 'C:/Middlewares/Third_Party/GCP/third_party/protobuf-c/library/protobuf-c.c', needed by 'Middlewares/Third_Party/protobuf-c/library/protobuf-c.o'. Stop.make: *** [makefile:84: all] Error 2"make -j16 all" terminated with exit code 2. Build might be incomplete.21:47:20 Build Failed. 2 errors, 0 warnings. (took 1s.723ms)​

..

..

..

Hi ,I have to use IAR IDE to develop SBSFU function , But I found that after "2_Images_SECoreBin" compiler success, I try to compiler "2_Images_SBSFU" as below picture. It's seem show post build fail.Dose anyone find this issue and some suggest? (but there are no fail if use STM32CubeIDE 1.8.0)My path : C:\SBSFU\Projects\NUCLEO-G071RB\Applications\2_Images2_Images_SECoreBin success 2_Images_SBSFU fail 

Normally the bootloader is the first thing to program in the MCU by the manufacturer,. Bootloader contains a way how to update the firmware of the device from the firmware file (encrypted), which is openly passed to the customer. Hence the bootloader is concidered to the the most secret thing to take care of.But what to do if there is no way to go physically to the place where the newly manufacured devices are located and physically program the bootloader? Is there any way to remotely program the bootloader in a secured way, so that the people having the devices could not steal or sniff it? Are there any ready solutions to this problem?The MCU related is STM32F427.

I tried to do an experiment with PC-ROP protection in Cubeprogrammer, but an exception occurred when I disabled protection.My Memory Data seems to be protected all the time, the value is always 0, and there is no way to Erase the entire Chip normally.I took a normal board to compare and found that Option Bytes are different.​In normal boardaddress(0x52002010) SR1 Data: 0x00000000address(0x5200211C&0x5200201C) OPTSR_CUR&OPTSR_PRG Data: 0x0306AAD0address(0x52002030&0x52002034) SCAR_CUR1&SCAR_PRG Data: 0x000000FF​On unusual boardsaddress(0x52002010) SR1  Data 0x01000000address(0x5200211C&0x5200201C) OPTSR_CUR&OPTSR_PRG  Data:0x0006AAD0address(0x52002030&0x52002034) SCAR_CUR1&SCAR_PRG Data:0x80000000​I would like to know if there is a way to adjust to normal, or how to restore to default factory setting?​​​​​

Hi everyone,currently, I'm struggling to make interrupt working with SBSFU (STM32WB55).If I run the program without SBSFU, interrupt event working properly.but when I compiled it along with SBSFU, the interrupt not working.I see on another post that is possibility its caused by interrupt vector.I used this configuration on system_wbxx.c#if defined(__ICCARM__)extern uint32_t __vector_table;#define INTVECT_START ((uint32_t)& __vector_table)#elif defined(__CC_ARM) || defined(__ARMCC_VERSION)extern void * __Vectors;#define INTVECT_START ((uint32_t) & __Vectors)#elif defined(__GNUC__)extern void * g_pfnVectors;#define INTVECT_START ((uint32_t)& g_pfnVectors)#endifactually, the program is running but interrupt still not working.I also tried with this code:#if defined(__ICCARM__)||defined(__GNUC__)extern uint32_t __ICFEDIT_intvec_start__;#define INTVECT_START ((uint32_t)& __ICFEDIT_intvec_start__)#elif defined(__CC_ARM)extern uint32_t Image$$vector_start$$Base;#define INTVECT_