Options bytes in STM32H73x: How do I apply them all from STM32CubeProgrammer?

[Kayas Ahmed]

Hello,

I am having trouble applying all the option bytes from STM32CubeProgrammer.

I have ported the SBSFU example to use it as a bootloader, I am at the stage where I would test all the security settings by configuring the option bytes externally.

From my testing, I am able to set PCROP, WRP, and Secure memory but when I try to set RDP which I think should be configured at the end, It fails.

Can someone please tell me the proper sequence of option bytes configuration?

Looking forward to a positive response

Thanks,

Kayas Ahmed

[FBL]

Hi @Kayas Ahmed​ 

Could you please share a screenshot of STM32CubeProgrammer showing the issue you are facing?

If possible to add the steps you follow, this would be helpful.

[Piranha]

The tool shows that the connection fails because, when the RDP is set, the SWD is disabled.

[Kayas Ahmed]

Hello @F.Belaid​ ,

Please find the screenshot attached,

The sequence of option bytes configuration is shown below,

PCROP, WRP, and Security bit -> Secure Area and RDP

or

PCROP, WRP, and Security bit -> Secure Area -> RDP

Both sequences would give me the same error as attached,

Thanks,

Kayas Ahmed

[FBL]

Hi @Kayas Ahmed​ 

I made similar test using STM32H750B-DK, and it's working as expected.

STM32CubeProgrammer v2.11.0 is used on my side.

Could you please precise your environment (exact device + STM32CubeProgrammer Version) ?

You need to pay attention when trying to do an RDP regression from level1 to level0:

All Option Bytes have to be updated at the same time.

[Kayas Ahmed]

Hi @F.Belaid​ ,

May I know the sequence you set the option bytes?

I am also using STM32CubeProgrammer v2.11.0, and my device is STM32H735.

Thanks & Regards,

Kayas Ahmed

[FBL]

Hello again @Kayas Ahmed​ 

Here are the steps to activate PCROP, WRP, Security bit, Secure Area and RDP:

1. Check DMEP
2. Check Security (under User Configuration)
3. Uncheck nWRP0, nWRP1 or whatever needed
4. Click Apply
5. Check DMES (under Secure Protection)
6. Set RDP value to BB
7. Click Apply

Now, in order to deactivate these features PCROP, WRP, Security bit, Secure Area and RDP, you follow these steps:

1. You need to uncheck DMEP, Security bit, DMES, check nWRPx also set RDP value to AA at the same time then click APPLY

Note : In case you are deactivating, and you don't follow the correct sequence, You should start by enabling level 1 protection then you follow the process (you need to step back to restore the protection so that you can start the regression)

[Kayas Ahmed]

Hello @F.Belaid​ ,

Thank you for the explanation.

I tried the sequence that you listed, but It didn't work. I noticed that you are not setting the secure area, which is causing the issue (enables secure mode boot).

Thanks,

Kayas Ahmed

[Pavel A.]

@Kayas Ahmed​ Do you have problem connecting with debugger after activation of secure area?

[Kayas Ahmed]

Hi @Pavel A.​ 

No, I don't have a problem connecting to the debugger as I have enabled JTAG in the code (as it is disabled in secure mode).

I want to make a few things clear

1) What I am trying to achieve is to enable all the options bytes from the debugger

2) When the secure area is enabled, RDP (from the debugger) set fails when in the bootloader (secure area), Only can be set after jumping out of the secure memory area, in my case jumping to the application (from the bootloader). This works and I have tried it many times. Note: JTAG is connected in hotplug mode

3) My intention is not to boot the application without setting all the option bytes.

So I want the procedure to do so if at all it is possible.

Thanks & Regards,

Kayas Ahmed

[Pavel A.]

While STM32H7 is executing in the secure area, bootloader cannot access the flash. The option bytes are part of the flash module. As you have seen, only after leaving the secure area the debugger can access the flash and option bytes . In hotplug mode of course, because the secure area code starts executing immediately after reset. This is by design.

> My intention is not to boot the application without setting all the option bytes.

The most reliable and simple way IMHO is to set all the option bytes from your own code (bootloader).

[Kayas Ahmed]

Hi @Pavel A.​ ,

From my understanding (and experience) yes, a bootloader would be the only answer, but this is not what the SBSFU example illustrates. According to the SBSFU, it should be possible to set all the options bytes using a debugger. If it was written somewhere it is not possible, I would have not posted this question here.

> While STM32H7 is executing in the secure area, the bootloader cannot access the flash

This is not correct, the bootloader has access to everything, I assume you meant debugger.

Thanks & Regards,

Kayas Ahmed

[Pavel A.]

Of course debugger, you're right!