How to start with DA access on STM32H503

“How to start with Debug authentication (DA) access on STM32H503”45min

Target description

This tutorial describes provisioning and full regression on STM32H503 product lines.

The provisioning process goes through three steps:

• Programming of initial option bytes.
• Generating and flashing the code image.
• Provisioning of password.

The fourth step provides details on full regression.

Prerequisites

• Being familiar with Introduction to Debug Authentication for STM32H5 MCUs
• Being familiar with RM0492 STM32H503xx Reference Manual
• Basic knowledge of STM32CubeProgrammer (STM32CubeProg)
• Basic knowledge of JTAG / SWD interface
  

Hardware

• Nucleo MB1814 with STM32H503

Required tools

• STM32CubeProgrammer Software programming tool for STM32 (v2.13.0 min), including STM32TrustedPackageCreator
• STM32Cube_FW_H5_V1.0.0 or higher version
• IAR Embedded Workbench^© v9.20.1 or higher version
• Tera Term or equivalent UART Terminal emulator

Literature

• Introduction to Debug Authentication for STM32H5 MCUs
• RM0492 STM32H503xx Reference Manual
• UM2237 STM32CubeProgrammer software description
• UM2238 STM32 Trusted Package Creator tool software description
• AN5054 Secure programming using STM32CubeProgrammer
• AN2606 STM32 microcontroller system memory boot mode

Environment setup

The environment used in the Debug authentication process must be prepared beforehand.

• Download the STM32CubeH5 package and install it.
• A directory NUCLEO-H503RB is included in the Projects directory.

Warning

Place STM32CubeH5 package close to the C: root , avoiding longer paths.

Warning

When STM32CubeProgrammer is not installed in the default folder, custom installation paths need to be updated in the script NUCLEO-H503RB\ROT_Provisioning\env.bat :: ============================================================================== :: General :: ============================================================================== :: Configure tools installation path set stm32programmercli="C:\Program Files\STMicroelectronics\STM32Cube\STM32CubeProgrammer\bin\STM32_Programmer_CLI.exe" set stm32tpccli="C:\Program Files\STMicroelectronics\STM32Cube\STM32CubeProgrammer\bin\STM32TrustedPackageCreator_CLI.exe"

1. STM32H503 specific behavior

The STM32H503 product lines are based on the STM32H5x3 device architecture, without any Arm^® TrustZone^®.
To make regression possible with Debug authentication, a password must be provisioned on the STM32H503 product line.

The flash memory interface does not provide OBKeys. OTP is used to provision the HASH of the password.

Warning

The password is provisioned during the provisioning step. It cannot be changed at a later stage.

2. Provisioning

The script NUCLEO-H503RB\ROT_Provisioning\DA\provisioning.bat does the provisioning.
This script performs the following actions:

• Setting the option bytes of the device.
• Setting a password for the board.
• Setting the final chosen product state, according to the user selection.

• Note: For Linux and Mac operating systems, the end users may have to change manually the attribute of .sh scripts to executable.

2.1. Provisioning - Step 1: Programming of initial option bytes

1. Connect the board.
2. Run the provided provisioning.bat script by double clicking on it. The script proceeds with the programming of option bytes.
3. Remove all the protections.
4. Erase the user flash memory.

2.2. Provisioning - Step 2: Generating and flashing the code image

Once the option bytes are successfully programmed, the script requires the application to be flashed. To do so, follow the instructions.

Warning

Do not close the provisioning script window. Do not disconnect the board.

In the example, we use the GPIO_IOToggle application located in : Projects\NUCLEO-H503RB\Examples\GPIO\GPIO_IOToggle\EWARM

Make sure that the STM32H5 IAR patch is installed properly. This patch is available in the Utilities\PC_Software\IDEs_Patches\EWARM folder.

• Open the Project.eww, located in the EWARM directory:Projects\NUCLEO-H503RB\Examples\GPIO\GPIO_IOToggle\EWARM
• Go to Project\Rebuild all

• Once the project is correctly built, go to : Project\Download\Download active application to flash the code.

• Reset the board using the black button. The green led must blink at that stage.

2.3. Provisioning - Step 3: Provisioning the password and setting the final product state

Warning

On STM32H503, the password is provisioned on OTP. Once provisioned, the password cannot be changed.

• Go back to the provisioning script window and press a key to continue.
• If it is the first time you are provisioning your board, you have the possibility to update the default password in the user_password.bin file.
• For a commercial product it's mandatory to define your own password.

You can also use this default user_password.bin file without modifying it. If you already created and provisioned password for your board, this step is not taken into account you only have to press key in order to jump to the setting of the final product state.

user_password.bin: the password (16 bytes) to be filled by User is defined here.

board_password.bin: HASH of user password, which will be provisioned in the chip.

da_password.bin: the output file opening the DA access for regression.

board_password.bin and da_password.bin files are automatically updated with the new password saved in user_password.bin when the provisioning script is run.

Warning

The password cannot be updated after this step.

• Follow the script and choose the product state: PROVISIONED or CLOSED.

Warning

LOCKED is a definitive product step. It cannot be changed at a later stage.

Make a first trial setting the product in PROVISIONED state:

The installed code must run, and the led blinks.

Ignore next paragraph 3.2, and go to step4 : Full regression

3. Full regression

A full regression erases the user stored content and sets the product to open state. This can be done by following these steps:

• Erase the user flash memory content.
• Set the product to open state.

If the product is already in open state, a full regression is not needed. The device is not secured and changes can be done without any authentication. In this case, if the regression script is executed, errors are found.

If the product is not in open state, the product state can only be changed with a full regression.

3.1. Full regression using the provided script

The regression can be done using the provided script, or using STM32CubeProgrammer.

For a full regression, follow these steps:

• Launch the regression.bat script located in ROT_Provisioning\DA
• Note: For Linux and Mac operating systems, the end users may have to change manually the attribute of .sh scripts to executable.
• If the regression is successful, the following message is displayed:
  

Connect STM32CubeProgrammer to check that the flash memory content is properly erased, and that the option bytes and product state are at default values.

3.2. Full regression using STM32CubeProgrammer

• Disconnect the STM32CubeProgrammer, by removing the USB cable.
• Redo the exercise starting at step1. Set the CLOSED state.
• Select in the STM32CubeProgrammer and select Debug authentication.
• Click Discover. The information window is populated.

• Enter the da_password.bin file.

• Click Full regression. When performed successfully, this message is displayed :

• With the STM32CubeProgrammer, check that the flash memory content is sucessfully erased. Check that the product state and option bytes have default values using ST link SWD.