CW308T-STM32X7
| CW308T-STM32X7 | |
|---|---|
 | |
| Target Device | ST STM32F |
| Target Architecture | Cortex M7, H7 |
| Hardware Crypto | Possible |
| Design Files | GITHub Link |
| Status | Beta |
THIS IS CURRENTLY A DRAFT, FURTHER READING NOT ADVISED
Supported Devices
The STM32X7 board supports several STM32X7 devices in the UFBGA-176 package. The devices have the same pinout. Various header jumpers can be set different positions to select appropriate power supply for the different power dominans of the device, and different measurements points. The devices in the following table shows two compatible devices:
| STM32X7 Series | Package | Device | Hardware AES | TRNG | Tested | Process node | Flash | SRAM | OTP |
|---|---|---|---|---|---|---|---|---|---|
| F7 | UFBGA-176 | STM32F746IEK6 | No | Yes | Yes | 90 nm | 1MB | 320KB | 1KB |
| H7 | UFBGA-176 | STM32H743IIK6 | No | Yes | Yes | 40 nm | 1MB | 320KB | 1KB |
There are other flavors of the devices with the same pinout, which makes them compatible with this target board. E.g.
Power supply
The device must be supplied 3v3, since the device's I/O logic uses 3v3. The logic core uses 1v2.
Internal regulators
The device contains an internal regulator regulating the input voltage down to 1v2. This can however be bypassed by supplying a slightly higher voltage to the target board's 1v2 pin.
Measuring power consumption =
The target board contains headers which lets the hacker select where to measure. It is possible to select to measure power on the 3v3 input and the 1v2 input/decoupling. VCAP1 and VCAP2 should be shorted, an only one shunt resistor should be used. It seems that the VCAP pins are from the same power domain, namely the digital core logic domain.
Hardware cryptography
Some flavors of the STM32X7 supports hardware cryptography . The tested devices in the above table do not support hardware cryptography, hence there are no firmware which supports the hardware cryptography yet.
Programming Connection
The target board supports using both JTAG and SWD for programming. An external programmer is needed, e.g. a SEGGER Jlink or a ST-Link.
Example Projects
STM32F7
SimpleSerial builds for the STM32F7 devices using the ChipWhisperer build system. Each device is a separate HAL. These HAL modules have been copied from ST's HAL.
STM32H7
SimpleSerial builds for the STM32H7 devices using Arm Keil uVision. This project could easily be ported to support the ChipWhisperer build system. The Keil-project is also included in the repo. Keil IDE also supports debugging, which is helpful for working out all the kinks in your firmware.
Building ST Example on Command Line
The regular firmware build process works with the STM32 devices. For example, to build `simpleserial-aes`, navigate to the folder `chipwhisperer\hardware\victims\firmware\simpleserial-aes` and run the following command on the command line:
make PLATFORM=CW308_STM32F7 CRYPTO_TARGET=TINYAES128C
Program the device using your preferred method. SEGGER JFlash is a great tool for that. After this, you're ready to go - you can use the ChipWhisperer terminal to talk to your target. You might need to reset the target before you do anything else.
Schematic
Rev -01 Schematic
The current revision of the target is -01. The following shows this schematic:
[[File:CW308T-STM32X7-01.png]