SFI Option Bytes for STM32H753ZI

[jho]

Hi everyone,

I want to test Secure Firmware Install (SFI) for the STM32H753ZI with the Nucleo-H753ZI.

My current option bytes are:

{
 "deviceId" : 1104,
 "bitNameToValue" : {
 "RDP" : 170,
 "BOR_LEV" : 0,
 "IWDG1_SW" : 1,
 "NRST_STOP_D1" : 1,
 "NRST_STBY_D1" : 1,
 "FZ_IWDG_STOP" : 1,
 "FZ_IWDG_SDBY" : 1,
 "SECURITY" : 1,
 "BCM7" : 1,
 "NRST_STOP_D2" : 1,
 "NRST_STBY_D2" : 1,
 "SWAP_BANK" : 0,
 "IO_HSLV" : 0,
 "BOOT_CM7_ADD0" : 2048,
 "BOOT_CM7_ADD1" : 8176,
 "PROT_AREA_START1" : 255,
 "PROT_AREA_END1" : 0,
 "DMEP1" : 0,
 "PROT_AREA_START2" : 255,
 "PROT_AREA_END2" : 0,
 "DMEP2" : 0,
 "SEC_AREA_START1" : 255,
 "SEC_AREA_END1" : 0,
 "DMES1" : 0,
 "SEC_AREA_START2" : 255,
 "SEC_AREA_END2" : 0,
 "DMES2" : 0,
 "ST_RAM_SIZE" : 3,
 "nWRP0" : 1,
 "nWRP1" : 1,
 "nWRP2" : 1,
 "nWRP3" : 1,
 "nWRP4" : 1,
 "nWRP5" : 1,
 "nWRP6" : 1,
 "nWRP7" : 1,
 "nWRP8" : 1,
 "nWRP9" : 1,
 "nWRP10" : 1,
 "nWRP11" : 1,
 "nWRP12" : 1,
 "nWRP13" : 1,
 "nWRP14" : 1,
 "nWRP15" : 1
 }
}

 When generating SFI Option Bytes with the STM32TrustedPackageCreator for the STM32H753ZI I get:

FLASH_OPTSR_PRG,0x17DEBBF0
FLASH_PRAR_PRG1,0x0000000F
FLASH_PRAR_PRG2,0x0000000F
FLASH_SCAR_PRG1,0x81000200
FLASH_SCAR_PRG2,0x81000200
FLASH_WPSN_PRG1,0xFFFFFFFF
FLASH_WPSN_PRG2,0xFFFFFFFF
FLASH_BOOT7_PRG,0x08002400
RESERVED,0x24000810

When converting this to the JSON-schema (Option Bytes with the STM32TrustedPackageCreator) :

{
 "deviceId" : 1104,
 "bitNameToValue" : {
 "RDP" : 187,
 "BOR_LEV" : 0,
 "IWDG1_SW" : 1,
 "NRST_STOP_D1" : 1,
 "NRST_STBY_D1" : 1,
 "FZ_IWDG_STOP" : 1,
 "FZ_IWDG_SDBY" : 1,
 "SECURITY" : 0,
 // "BCM7" : not found in RM0433,
 // "NRST_STOP_D2" : H753 single core,
 // "NRST_STBY_D2" : H753 single core,
 "SWAP_BANK" : 0,
 "IO_HSLV" : 0,
 "BOOT_CM7_ADD0" : 9216,
 "BOOT_CM7_ADD1" : 2048,
 "PROT_AREA_START1" : 15,
 "PROT_AREA_END1" : 0,
 "DMEP1" : 0,
 "PROT_AREA_START2" : 15,
 "PROT_AREA_END2" : 0,
 "DMEP2" : 0,
 "SEC_AREA_START1" : 512,
 "SEC_AREA_END1" : 256,
 "DMES1" : 1,
 "SEC_AREA_START2" : 512,
 "SEC_AREA_END2" : 256,
 "DMES2" : 1,
 "ST_RAM_SIZE" : 3,
 "nWRP0" : 1,
 "nWRP1" : 1,
 "nWRP2" : 1,
 "nWRP3" : 1,
 "nWRP4" : 1,
 "nWRP5" : 1,
 "nWRP6" : 1,
 "nWRP7" : 1,
 "nWRP8" : 1,
 "nWRP9" : 1,
 "nWRP10" : 1,
 "nWRP11" : 1,
 "nWRP12" : 1,
 "nWRP13" : 1,
 "nWRP14" : 1,
 "nWRP15" : 1
 }
}

 So basically there will be a change in:
RDP: 170 > 187 (RDP Level 0 to 1)
SECURITY: 1 > 0

BOOT_CM7_ADD0: 2048 > 9216

BOOT_CM7_ADD1: 8176 > 2048

PROT_AREA_START1: 255 > 15
PROT_AREA_START2: 255 > 15

SEC_AREA_START1: 255 > 512

SEC_AREA_END1: 0 > 256
DMES1: 0 > 1

SEC_AREA_START2: 255 > 512
SEC_AREA_END2: 0 > 256
DMES2: 0 > 1

 

Questions:

1. After these changes, will I be able to reverse to the standard settings? The most crucial part will be reversing the RDP Level but as I read in RM0433 a change from Level 1 to 0 is fine.

2. Does changing BOOT_CM7_ADD0 and BOOT_CM7_ADD1 require a particular application code? Or will I be able to simply put a single blinky example at 0x08000000 when generating the SFI-Image?

 

Thanks in advance.

Best regards