0
\$\begingroup\$

I'm not sure if it is possible, to update the firmware of a STM32 over UART, when the read out protection is set? Basically, the firmware comes encripted to an ESP32, which should then update the STM32 firmware over UART without setting the option bytes.

Further, is there a safe concept to update an STM32, such that the firmware works only on this uC? What I have in mind is something, that uses the UUID of the chip and that only works, if it matches?

\$\endgroup\$
4
  • \$\begingroup\$ You can always write your own software bootloader which can authenticate and accept encrypted firmware. As for your question I assume you mean built-in bootloader? \$\endgroup\$
    – NStorm
    Nov 19, 2020 at 11:03
  • \$\begingroup\$ Why are you not sure? Have you read the manual which describes how the boot protection works? Sure what you describe is possible, but don't be surprised if it requires a custom bootloader. \$\endgroup\$
    – Justme
    Nov 19, 2020 at 11:06
  • \$\begingroup\$ Yes, i mean the built in bootloader \$\endgroup\$ Nov 19, 2020 at 11:30
  • \$\begingroup\$ Yes, when MCU is erased to remove readout protection you can use the built in bootloader to load in anything you want into Flash or RAM and execute it. \$\endgroup\$
    – Justme
    Nov 19, 2020 at 11:36

1 Answer 1

1
\$\begingroup\$

Assuming you mean built-in bootloader it is described in AN3155. Section 3.12 clearly states what you can disable RDP (read-out protection) by sending specific command. It will erase all flash memory contents as usual. So basically yes, you can clearly update your firmware over the built-in UART bootloader even with RDP enabled.

As for your 2nd questions - to provide security during updates you have to implement your own software bootloader on the STM32. Which will at least accept encrypted firmware. You can also add more security by implementing cryptographic authentication of some sort. Specific implementation will depend on your uC series. ST Micro offers some solutions on their own software and there some interesting open source secure bootloaders over the Internet you can use as a base for your own.

\$\endgroup\$
1
  • \$\begingroup\$ Thank you, so i will have a look at the secure bootloader from STM \$\endgroup\$ Nov 19, 2020 at 11:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.