|
|
| (37 intermediate revisions by 3 users not shown) |
| Line 1: |
Line 1: |
| − | {{Infobox cw308target
| + | == Page Moved == |
| − | |name = CW308T-STM32F
| + | |
| − | |image = cw308_stm32f.jpg
| + | |
| − | |caption =
| + | |
| − | |Target Device = ST STM32F
| + | |
| − | |Target Architecture = Cortex M0,M3,M4
| + | |
| − | |Hardware Crypto = Possible
| + | |
| − | |Purchase Hardware =
| + | |
| − | |Design Files = [https://github.com/newaetech/chipwhisperer/tree/master/hardware/victims/cw308_ufo_target/stm32f GITHub Link]
| + | |
| | | | |
| − | [https://wiki.newae.com/CW308T-STM32F OSH Park PCBs] | + | See [https://rtfm.newae.com/Targets/UFO%20Targets/CW308T-STM32F/ NewAE RTFM Page] which is now built from the [https://github.com/newaetech/chipwhisperer-target-cw308t GIT Repo]. |
| | | | |
| − | |Supported Applications = [[SimpleSerial | Simple Serial Enc/Auth]]
| + | The previous content on this wiki has been moved to the above link. See wiki history if you would like to view exact older versions of this page. |
| − | |Programmer = ST-LINK/V2
| + | |
| − | |Status = Released
| + | |
| − | }}
| + | |
| − | | + | |
| − | == Supported Devices ==
| + | |
| − | | + | |
| − | The STM32F board supports several STM32F devices in the TQFP-64 package. Various solder jumpers need to bet set to either the "A" or "B" position to select appropriate VCC supply for the different series. The following table summarizes examples of suitable devices: | + | |
| − | {| class="wikitable"
| + | |
| − | !STM32F Series
| + | |
| − | !Package
| + | |
| − | !Device
| + | |
| − | !Hardware AES
| + | |
| − | !Tested
| + | |
| − | !Jumper
| + | |
| − | !Flash
| + | |
| − | !SRAM
| + | |
| − | !NAE P/N
| + | |
| − | |-
| + | |
| − | |F0
| + | |
| − | |TQFP-64
| + | |
| − | |STM32F071RBT6
| + | |
| − | |No
| + | |
| − | |Yes
| + | |
| − | |B
| + | |
| − | |128KB
| + | |
| − | |16KB
| + | |
| − | |NAE-CW308T-STM32F0
| + | |
| − | |-
| + | |
| − | |F1
| + | |
| − | |TQFP-64
| + | |
| − | |STM32F100RBT6B
| + | |
| − | |No
| + | |
| − | |Yes
| + | |
| − | |B
| + | |
| − | |128KB
| + | |
| − | |8KB
| + | |
| − | |NAE-CW308T-STM32F1
| + | |
| − | |-
| + | |
| − | |F2
| + | |
| − | |TQFP-64
| + | |
| − | |STM32F215RET6
| + | |
| − | |Yes
| + | |
| − | |Yes
| + | |
| − | |A
| + | |
| − | |512KB
| + | |
| − | |132KB
| + | |
| − | |NAE-CW308T-STM32F2HWC
| + | |
| − | |-
| + | |
| − | |F3
| + | |
| − | |TQFP-64
| + | |
| − | |STM32F303RCT7
| + | |
| − | |No
| + | |
| − | |Yes
| + | |
| − | |B
| + | |
| − | |256KB
| + | |
| − | |40KB
| + | |
| − | |NAE-CW308T-STM32F3
| + | |
| − | |-
| + | |
| − | |F4
| + | |
| − | |TQFP-64
| + | |
| − | |STM32F415RGT6
| + | |
| − | |Yes
| + | |
| − | |Yes
| + | |
| − | |A
| + | |
| − | |1MB
| + | |
| − | |192KB
| + | |
| − | |NAE-CW308T-STM32F4HWC
| + | |
| − | |-
| + | |
| − | |F4
| + | |
| − | |TQFP-64
| + | |
| − | |STM32F405RGT6
| + | |
| − | |No
| + | |
| − | |Yes
| + | |
| − | |A
| + | |
| − | |1MB
| + | |
| − | |192KB
| + | |
| − | |NAE-CW308T-STM32F4
| + | |
| − | |}
| + | |
| − | | + | |
| − | === VCC-Int Supply ===
| + | |
| − | Several devices (F2, F4) have internal core voltage regulators. By default the CW308 board attempts to provide power for these pins, but the voltage may not be high enough to cause the internal regulator to disable itself. In this case you can use the VADJ regulator to ensure the internal regulator is disabled. See [[Targets with Internal Regulators]] for details.
| + | |
| − | | + | |
| − | === Pin-outs across TQFP Devices ===
| + | |
| − | | + | |
| − | The following shows differences in pinouts between three groups of devices. The left-most is the STM32F051RB, which uses the same 3.3V VCORE as the STM32F1/F3. It has fewer VCC pins, so the I/O occupying that are VCC/GND pins on the STM32F1 (such as PF6/PF7) are tied to GND/VCC. The right-most part is the pinout of the STM32F2/F4. It has an internal regulator, where the VCAP pins are the output of this regulator (and input to the internal core logic).
| + | |
| − | | + | |
| − | [[File:power_diffstm32.png|800px]]
| + | |
| − | | + | |
| − | Note for the devices with a 3.3V VCORE, you should not mount decoupling capacitors C5/C6/C7/C8. You will still get some leakage with those capacitors mounted, but a stronger signal is present without them.
| + | |
| − | | + | |
| − | == Hardware AES ==
| + | |
| − | | + | |
| − | The STM32F21x, and STM32F41x/43x have hardware crypto modules (AES, DES, TDES) along with hardware hash (SHA1, MD5).
| + | |
| − | | + | |
| − | == Programming Connection ==
| + | |
| − | | + | |
| − | The 20-pin JTAG port (J6 on CW308 Board) can be used with the [https://www.digikey.com/product-detail/en/stmicroelectronics/ST-LINK-V2/497-10484-ND/2214535 ST-LINK/V2] which is a low-cost JTAG programmer.
| + | |
| − | | + | |
| − | It is also possible to use other JTAG programmers such as OpenOCD. The following command worked with an Olimex OpenOCD programmer and their [https://www.olimex.com/Products/ARM/JTAG/ARM-USB-OCD-H/ OpenOCD for Windows] software:
| + | |
| − | <pre>
| + | |
| − | openocd
| + | |
| − | -f path/to/board/files/cw308.cfg
| + | |
| − | -c init
| + | |
| − | -c targets
| + | |
| − | -c "halt"
| + | |
| − | -c "flash write_image erase path/to/firmware.hex"
| + | |
| − | -c "verify_image path/to/firmware.hex"
| + | |
| − | -c "reset run"
| + | |
| − | -c shutdown
| + | |
| − | </pre>
| + | |
| − | where the contents of <code>cw308.cfg</code> are
| + | |
| − | <pre>
| + | |
| − | source [find interface/olimex-arm-usb-ocd-h.cfg]
| + | |
| − | source [find target/stm32f4x.cfg]
| + | |
| − | reset_config srst_only
| + | |
| − | </pre>
| + | |
| − | | + | |
| − | == Example Projects ==
| + | |
| − | | + | |
| − | SimpleSerial builds for each of the STM32Fx Devices. Each device is a separate HAL. These HAL modules have been copied from ST's HAL (not the CUBE) and greatly reduced in size by deleting unused files (such as headers for unused devices), and combining several C-source files into a single low-level C-file.
| + | |
| − | | + | |
| − | === Building ST Example on Command Line ===
| + | |
| − | The regular firmware build process works with the STM32 devices. For example, to build `simpleserial-aes`, navigate to the folder `chipwhisperer\hardware\victims\firmware\simpleserial-aes` and run the following command on the command line:
| + | |
| − | | + | |
| − | <code>
| + | |
| − | make PLATFORM=CW308_STM32F0 CRYPTO_TARGET=TINYAES128C
| + | |
| − | </code>
| + | |
| − | | + | |
| − | If all goes well, this command will finish by printing the output file size and the platform:
| + | |
| − | [[File:Stm32-make.png]]
| + | |
| − | | + | |
| − | === Running ST Example with ST-Link ===
| + | |
| − | Once you've built a binary to load onto the target, you're ready to program it. Plug your programmer into the 20 pin JTAG connector (J6 on the UFO board):
| + | |
| − | | + | |
| − | [[File:Stm32-jtag.jpg|600px]]
| + | |
| − | | + | |
| − | Then, the details of this step will depend on your programmer. If you're using an ST-Link programmer, open the ST-Link utility and connect to the device:
| + | |
| − | | + | |
| − | [[File:Stm32-connect.png]]
| + | |
| − | | + | |
| − | Load your `.hex` file and program the device with the Program and Verify button:
| + | |
| − | | + | |
| − | [[File:Stm32-program.png]]
| + | |
| − | | + | |
| − | After this, you're ready to go - you can use the ChipWhisperer terminal to talk to your target. You might need to reset the target before you do anything else.
| + | |
| − | | + | |
| − | === Building and Debugging via ST's System Workbench ===
| + | |
| − | It's also possible to work on the example projects using [http://www.st.com/en/development-tools/sw4stm32.html ST's System Workbench IDE]. This IDE also supports debugging, which is helpful for working out all the kinks in your firmware.
| + | |
| − | | + | |
| − | To build the ChipWhisperer examples in System Workbench:
| + | |
| − | | + | |
| − | 1. Create a ''Makefile Project with Existing Code'' and enter the firmware's location in Existing Code Location:
| + | |
| − | | + | |
| − | [[File:Stm32-st-1.png]]
| + | |
| − | | + | |
| − | 2. Link the external files into the project. To do this, under ''File > Import'', select ''File System''. In the `chipwhisperer\hardware\victims\firmware` directory, select all of the relevant files and folders (Makefile in base folder, Makefile in HAL folder, STM32Fx HAL folder). Ensure that make links to these files (instead of directly importing them):
| + | |
| − | | + | |
| − | [[File:Stm32-st-2.png]]
| + | |
| − | | + | |
| − | 3. Set up the build command. In ''File > Properties'', go to ''C/C++ Build'' and deselect 'Use default build command'. Enter the command you would normally enter on the command line:
| + | |
| − | | + | |
| − | [[File:Stm32-st-3.png]]
| + | |
| − | | + | |
| − | 4. Build the project and confirm that the build works from the output in the IDE console.
| + | |
| − | | + | |
| − | Then, if you want to set up debugging:
| + | |
| − | | + | |
| − | 1. Find ST's list of debugging targets (check around `C:\STMicro\Ac6\SystemWorkbench\plugins\fr.ac6.mcu.debug_1.12.1.201703061527\resources\openocd\scripts\board`). Make a config file for your target. This file's contents should be something like (adjust for your board):
| + | |
| − | <pre>
| + | |
| − | # This is an CW308T_STM32F0 board with a single STM32F071R8Tx chip.
| + | |
| − | # Generated by System Workbench for STM32
| + | |
| − | | + | |
| − | source [find ../interface/stlink-v2-1.cfg]
| + | |
| − | | + | |
| − | set WORKAREASIZE 0x2000
| + | |
| − | transport select "hla_swd"
| + | |
| − | | + | |
| − | set CHIPNAME STM32F071R8Tx
| + | |
| − | | + | |
| − | source [find ../target/stm32f0x_stlink.cfg]
| + | |
| − | | + | |
| − | # use hardware reset, connect under reset
| + | |
| − | reset_config srst_only srst_nogate
| + | |
| − | </pre>
| + | |
| − | | + | |
| − | 2. In ''Run > Debug Configurations'', make a new ''Ac6 STM32 Debugging'' configuration. Under the 'Debugger' tab, select ''Use local script'' and select your custom script:
| + | |
| − | | + | |
| − | [[File:Stm32-st-4.png]]
| + | |
| − | | + | |
| − | 3. Enter debugging mode.
| + | |
| − | | + | |
| − | '''Caveat''': the I/O register map in the debugger appears to use the last known device (ie: if you debugged an STM32F4 project before your Makefile project, it sticks with F4's registers). Check that the registers' addresses are correct before you trust them!
| + | |
| − | | + | |
| − | == Schematic ==
| + | |
| − | The following variants are possible, see the table above for SRAM/FLASH/HW-Crypto status:
| + | |
| − | {| class="wikitable"
| + | |
| − | !Variant
| + | |
| − | !U1
| + | |
| − | !R3 (VCC-Shunt)
| + | |
| − | !R4 (Clock)
| + | |
| − | |-
| + | |
| − | |F0
| + | |
| − | |STM32F071RBT6
| + | |
| − | |33-ohm
| + | |
| − | |120-ohm
| + | |
| − | |-
| + | |
| − | |F1
| + | |
| − | |STM32F100RBT6
| + | |
| − | |22-ohm
| + | |
| − | |51-ohm
| + | |
| − | |-
| + | |
| − | |F2
| + | |
| − | |
| + | |
| − | |
| + | |
| − | |
| + | |
| − | |-
| + | |
| − | |F3
| + | |
| − | |STM32F303RCT7
| + | |
| − | |22-ohm
| + | |
| − | |51-ohm
| + | |
| − | |-
| + | |
| − | |F4
| + | |
| − | |STM32F405RGT6
| + | |
| − | |10-ohm
| + | |
| − | |51-ohm
| + | |
| − | |}
| + | |
| − | | + | |
| − | [[File:CW308T_STM32F_02.png|1100px]]
| + | |
| − | | + | |
| − | | + | |
| − | [[Category: CW308 Targets]]
| + | |
