3 ms·

It looks like many of STM’s newer chips (at least STM32F4, STM32L1) use a fuse to protect RDP level 2 (per e.g. https://www.st.com/content/ccc/resource/technica

It looks like many of STM’s newer chips (at least STM32F4, STM32L1) use a fuse to protect RDP level 2 (per e.g. https://www.st.com/content/ccc/resource/technical/document/application_note/89/12/c5/e2/0d/0e/45/7f/DM00186528.pdf/files/DM00186528.pdf/jcr:content/translations/en.DM00186528.pdf https://www.st.com/content/ccc/resource/technical/document/a...), making the downgrade attack significantly harder to pull off. It would be nice to know if this was indeed the case, because then there would be a viable mitigation for these exploits (move to a different chip family and enable RDP 2 there).

duskwuff 8y ago
I'm not sure there's actually any difference. The language describing memory protection in the reference manuals for STM32F0 and STM32F4 is largely identical; the only difference is that the F4 manual mentions that JTAG boundary scan is disabled (which is irrelevant to F0, as that family only supports SWD). Some newer ST parts, like the F7 series, have OTP fuses which can be programmed in addition to the flash option bytes (which control read protection, among other things). However, the OTP fuses have no hardware effect -- they're just for use in user applications. Additionally, it isn't even clear they're truly OTP, or if they're just flash with weird write protection.
- flyinglizard 8y ago
  SWD and JTAG are both disabled in RDP2. The OTP bytes were there on the F4 too.
  - duskwuff 8y ago
    Right; the specific quote I'm referring to is: > The JTAG port is permanently disabled when Level 2 is active (acting as a JTAG fuse). As a consequence, boundary scan cannot be performed. (RM0385, page 89) I'm pretty sure that this quote is only intended to mean that setting RDP2 disables JTAG boundary scan, as if a JTAG fuse were blown. I don't believe there is any actual fuse involved; AN4701 (the document you're quoting) may be the result of another ST employee misinterpreting the reference manual as a statement that there is an actual fuse.
    - nneonneo 8y ago
      That's too bad - I would call that misleading documentation. Is there a reliable way to check for sure whether they mean a physical fuse, or a "virtual" fuse derived from the flash bits?

duskwuff 8y ago

I'm not sure there's actually any difference. The language describing memory protection in the reference manuals for STM32F0 and STM32F4 is largely identical; the only difference is that the F4 manual mentions that JTAG boundary scan is disabled (which is irrelevant to F0, as that family only supports SWD). Some newer ST parts, like the F7 series, have OTP fuses which can be programmed in addition to the flash option bytes (which control read protection, among other things). However, the OTP fuses have no hardware effect -- they're just for use in user applications. Additionally, it isn't even clear they're truly OTP, or if they're just flash with weird write protection.

flyinglizard 8y ago
SWD and JTAG are both disabled in RDP2. The OTP bytes were there on the F4 too.
- duskwuff 8y ago
  Right; the specific quote I'm referring to is: > The JTAG port is permanently disabled when Level 2 is active (acting as a JTAG fuse). As a consequence, boundary scan cannot be performed. (RM0385, page 89) I'm pretty sure that this quote is only intended to mean that setting RDP2 disables JTAG boundary scan, as if a JTAG fuse were blown. I don't believe there is any actual fuse involved; AN4701 (the document you're quoting) may be the result of another ST employee misinterpreting the reference manual as a statement that there is an actual fuse.
  - nneonneo 8y ago
    That's too bad - I would call that misleading documentation. Is there a reliable way to check for sure whether they mean a physical fuse, or a "virtual" fuse derived from the flash bits?