Creating an STM32 firmware SBOM for the CRA

What is an STM32 project made of?

A project from STM32CubeMX or STM32CubeIDE takes code from the STM32Cube package of the chip family: the HAL driver, the chip's CMSIS files, board drivers and middlewares. Under Middlewares/Third_Party it holds libraries from other vendors, in STM32CubeF4 for example FreeRTOS, mbedTLS and LwIP. The linker decides which of them end up in the device.

For the SBOM you therefore need two answers: which version of the package the project uses, and which libraries from it are in the build.

Step 1: Which Cube package version does my project use?

The STM32CubeMX project file names the chip and the package version. With the package version you know which middleware versions ST shipped.

$ grep -E "FirmwarePackage=|DeviceId=" Discovery_Oscilloscope.ioc

ProjectManager.CustomerFirmwarePackage=
ProjectManager.DeviceId=STM32F429ZITx
ProjectManager.FirmwarePackage=STM32Cube FW_F4 V1.26.2

Step 2: Which middleware versions does the package ship?

The versions of the shipped libraries are in their headers. Shown here on the current release STM32CubeF4 v1.28.3, run in the package directory.

$ ls Middlewares/Third_Party

FatFs
FreeRTOS
LibJPEG
LwIP
mbedTLS

$ grep -h -m1 -E "tskKERNEL_VERSION_NUMBER|MBEDTLS_VERSION_STRING |FatFs - |JVERSION"  \
Middlewares/Third_Party/FreeRTOS/Source/include/task.h  \
Middlewares/Third_Party/mbedTLS/include/mbedtls/version.h  \
Middlewares/Third_Party/FatFs/src/ff.h  \
Middlewares/Third_Party/LibJPEG/include/jversion.h

#define tskKERNEL_VERSION_NUMBER "V10.3.1"
#define MBEDTLS_VERSION_STRING         "2.16.2"
/  FatFs - Generic FAT file system module  R0.12c                             /
#define JVERSION	"8d  15-Jan-2012"

$ jq -r ".components[].name" sbom_cdx.json  \
| grep -ciE "freertos|lwip|mbedtls|fatfs|libjpeg"

0

Step 3: What of it is really in the build?

The ELF symbol table shows which libraries are linked. In the test subject these are the HAL, the CMSIS-RTOS2 layer and the FreeRTOS kernel. A library from the package that leaves no function in the ELF does not belong in this device's SBOM.

Here the FreeRTOS version is in the ELF itself, because the debug build is compiled with -g3. According to GCC this level puts all macro definitions into the debug information; in the test subject the text sits in the .debug_str section. A build without debug information no longer has this line. Then you take the version from step 2.

$ nm STM32F429I-Oscilloscope.elf  \
| grep -E " T (HAL_Init|osKernelStart|vTaskStartScheduler|xTaskCreate)$"

08004ee9T HAL_Init08007f31T osKernelStart0800964dT vTaskStartScheduler080095f1T xTaskCreate

$ strings -a STM32F429I-Oscilloscope.elf | grep "tskKERNEL_VERSION_NUMBER"

RTOS_ID_s ("FreeRTOS " tskKERNEL_VERSION_NUMBER)
tskKERNEL_VERSION_NUMBER "V10.3.1"
KERNEL_ID ("FreeRTOS " tskKERNEL_VERSION_NUMBER)

$ strings -a STM32F429I-Oscilloscope.elf | grep -m1 "GCC: "

GCC: (GNU Tools for STM32 9-2020-q2-update.20201001-1621) 9.3.1 20200408 (release)

Step 4: What does the GCC map file show?

STM32CubeIDE compiles with -ffunction-sections -fdata-sections and links with --gc-sections. So every function sits in its own section, and the linker removes every section nothing uses. The map file (-Wl,-Map=) shows both: under “Archive member included” every library member that entered the image, with the symbol that pulled it in, and under “Discarded input sections” everything that was removed.

In the test subject the linker removes 37 functions from FreeRTOS tasks.c alone, among them vTaskGetInfo. For a CVE in FreeRTOS, check here whether the affected function is in the image or among the removed ones.

$ grep -o -- "-Wl,--gc-sections" makefile$ grep -o -- "-ffunction-sections -fdata-sections" subdir.mk | sort -u

-Wl,--gc-sections
-ffunction-sections -fdata-sections

$ sed -n '/^Archive member included/,/^Allocating common/p'  \
STM32F429I-Oscilloscope.map  \
| grep -o '[A-Za-z0-9_+-]*\.a(' | sort | uniq -c

76libc_nano.a(6libgcc.a(15libstdc++_nano.a(57libtouchgfx-float-abi-hard.a(

$ grep -A1 "^ \.text\.vTaskGetInfo" STM32F429I-Oscilloscope.map$ nm STM32F429I-Oscilloscope.elf | grep -c "vTaskGetInfo"

 .text.vTaskGetInfo
                0x0000000000000000       0x7c ./Middlewares/FreeRTOS/tasks.o
0

$ awk '/^Discarded input sections/,/^Memory Configuration/'  \
STM32F429I-Oscilloscope.map  \
| grep -A1 '^ \.text\.' | grep -c 'Middlewares/FreeRTOS/tasks.o'

37

Where does the version of a precompiled library like TouchGFX come from?

The test subject links the TouchGFX graphics library as a finished archive, libtouchgfx-float-abi-hard.a. The ELF carries 1,092 symbols with touchgfx, but no version number. The version is in the project file: X-CUBE-TOUCHGFX 4.17.0.

For the SBOM this means: name from the ELF, version from the .ioc, with a note on where it comes from. The same holds for every library a vendor ships only as .a or .lib.

The BIN of the same build does not name the FreeRTOS version either. In the debug ELF it is only in the debug information.

$ grep -o "X-CUBE-TOUCHGFX\.[0-9.]*[0-9]" Discovery_Oscilloscope.ioc | sort -u$ nm STM32F429I-Oscilloscope.elf | grep -c "touchgfx"$ strings -a STM32F429I-Oscilloscope.elf | grep -c "4\.17"

X-CUBE-TOUCHGFX.4.17.0
1092
0

$ strings -a STM32F429I-Oscilloscope.bin | grep -c "V10.3.1"

0

Can this run automatically?

Microcontroller builds from Keil MDK, IAR or GNU Arm. It finds the libraries built in, with their versions, for example CMSIS packs, RTX5, FreeRTOS, lwIP, mbedTLS and STM32Cube. Plus hardening (stack canary, MPU, privilege separation) and embedded keys.

Every component with an evidenced version is matched against the vulnerability sources. If the file evidences no version, the field stays blank. You export the SBOM as CycloneDX or SPDX.