Embedded Memory Security : MPU, TAMPER, Read/Write Protect

Develop a modular bare-metal driver framework and enable the floating point unit on stm32f4 cortex-m4, using the cpacr register in privileged mode to access core peripherals.

Develop a uart driver by enabling the apb1 clock for usart2 and mapping pa2/pa3 to af7. Configure pins for alternate function.

Implement a uart init by enabling gpio and apb1 clocks, configuring gpio to alternate function af7, computing baud rate to 115200, and enabling the uart transmitter.

Implement a static uart write function to transmit a character by polling the transmit data register TXE flag in the status register, then write to the uart data register.

Test the uart driver by wiring the init function, printing 'hello from stm32' over uart2 to a pc, and verify with a serial viewer like real time or teraterm.

Develop a system time base using the systick timer on stm32 cortex-m4. Configure the systick control and status register, and decide between internal or external clock sources.

Define control register bits, implement time base init to load systick with 16 mhz clock cycles per second, clear the current value, select internal clock, and enable interrupts.

Develop a systick-based timebase with a tick increment and get_tick reader, then implement a delay that uses tick timing and the 16 mhz clock.

Develop and test the system timebase on the stm32 by initializing the timebase, implementing a one-second delay, and printing a message each second to validate a precise real-time delay.

Develop a board support package for the stm32f4 nuclear board by implementing gpio drivers for pa5 led and pc13 button, including led init, led on/off, and button state checks.

Enable gpio a and c clocks via ahb1enr, configure pa5 as output, and drive it high with the odr; expose gpio and button init functions for the next lesson.

Enable clock access to gpio c, configure pc13 as an input, and implement a push button driver that reads the active-low button state and returns the pressed signal.

Develop an adc driver to read analog sensor data on adc1 channel one, configure the corresponding gpio in analog mode, and consult the datasheet block diagram to map channels.

Enable clock access to gpio a and set pa1 to analog mode. Configure the adc module, set the conversion sequence length, enable continuous conversion, and read the converted value.

Enable clock access to gpio a and set pa1 as analog, then enable adc1 on apb2 and configure sequence register 3 for channel 1 to prepare for conversion.

Implement an adc read function by enabling continuous conversion, starting conversion, waiting for end-of-conversion, and returning the 12-bit data from the adc data register.

Configure the memory protection unit (NPU) to assign permissions and attributes to memory map regions, enabling read-only areas, execute never data, and protection against code injection in RTOS tasks.

Explore cortex-m3/m4 memory protection with up to eight programmable regions in ram. Dynamically or statically configure base address, size, and attributes—read only, read/write, or execute never.

Analyze the MPU registers, including type, control, region number, region base address, and region attribute and size, to configure protected memory regions with valid, enable, and execute never settings.

Explore memory attributes and access permissions, including execute never, access permission bits, type extension, shareable, cacheable, buffer, and subregion control, plus region size and base address alignment.

Read the MPU type register to detect an MPU and its regions. Use a volatile uint32_t read at the address, shift bit eight, and print the number of regions.

Catch stack overflow with the NPU by enabling mem fault in SH CSR and guarding end of stack with a 32-byte region; implement mem manage and hard fault handlers.

Create a reusable mpu driver interface with np.c and mp.h. Use the cortex-m4 cmsis header to define symbolic region sizes and access attributes, simplifying memory protection configuration.

Learn to enable and disable the MPU, configure memory regions, and build an NPU driver that sets the control register and predev bit 2 to control access and protection.

Learn to disable mpu regions in the driver by setting the region number and clearing base and attribute registers, with 0/1 validation and 32-byte size notes.

Implement the MPU region config function by accepting region number, base address, size, and attribute, then writing to the region number, base address, and combined attribute-size registers using OR.

Implement the mpu config function by checking npu presence, disabling it, configuring flash, ram, and gpio a regions with appropriate access, and enabling the mpu.

Test the mpu driver and memory protection by configuring npu regions, enabling priv dev enable, and validating faults with gpio access and led tests, using debug uart for verification.

Develop a tamper detection driver for the RTC module that uses VBAT backup registers (2032 bits) and timestamps tamper events, with edge or level detection and automatic wipe on tamper.

Explore real-time clock architecture, backup domain, and tamper detection, including backup registers, alarms, wakeup, and calendar features, with battery-backed memory and tamper-triggered data clearance.

Implement tamper detection initialization for the stm32 rtc backup domain by enabling power and rtc clocks, configuring pc13 as tamper input on falling edge, and enabling the nvic tamper interrupt.

Implement initialization function to enable apb1 clock and backup access, activate rtc via bdcr, configure tamper trigger on fall edge, enable tamper interrupt, and connect it to nvic line 21.

Implement a function that stores a 32-bit value into a selected rtc backup register by calculating the target address from the register index and writing through a volatile uint32_t pointer.

Learn to read 32‑bit data from RTC backup registers with a backup get data function, computing the register address and returning the content, as prep for tamper interrupt request handler.

Implement the tamper interrupt callback to verify data deletion by reading RTC backup registers. Enable debug prints to inspect backup contents during development, looping through the 0 to 19 registers.

Test the tamper detection by triggering the tamper pin with the blue button, store data in RTC backup registers, and print the content before and after tamper.

Store sensor values in backup registers by sampling with the ADC, writing to backup register zero and one, and observe tamper detection with time base initialization.

Explore how option bytes protect flash memory with read and write protection and proprietary code readout protection. Learn how to navigate the RDP, WRP, and option byte control registers.

Explore read protection (RDP), its levels 0, 1, and 2, and how they restrict debugging and memory access, plus the role of in-application programming for firmware updates.

Explore and test the flash memory storage driver to read, write, and erase option bytes on STM32 devices, applying read and write protection experiments.

Implement the flash protection driver by creating the flash protection interface and configuration structures, including option bytes, read protection levels, and sector write protection.

Examine how to configure read protection, write protection, and PCROP using option bytes, option key sequences, and the flash option control register with busy checks.

Derive option-byte addresses by computing offsets from the flash interface base address, define symbolic names (rdp, wrp) for each byte, and implement a driver to read them.

Implement a function to read flash option bytes, including rdp, wrp, and user bits, by dereferencing option byte addresses and masking the flash option control register.

Lock and unlock the MCU option bytes by setting the option lock bit in the option control register, flushing option bytes, and writing unlock keys to the option key register.

Implements a sector right protection function by defining a sector enum mapped to register bit positions and constructing a hex-based wrp mask for precise read/write protection.

Implement sector write protection by unlocking option byte, waiting for flash ready, setting WRP bits for the sector via option control register, and enabling opt status before locking option bytes.

Implement the set RDP level function to configure read protection for the flash. Apply the level via OR at the correct bit offset, then enable opt start and wait.

Implement and expose a function to return all current option bytes settings, RDP, WRP, and user, using a config structure and get functions for testing in embedded memory security.

Test the flash protection driver by installing Cube Programmer and St-link utility, inspect option bytes, and verify read and write protection levels via getconfig in main.c.

Enable write protection on sector four to test read/write behavior and troubleshoot access. Use cube programmer and st-link utility to manage option bytes and read protection.