How do I configure the SBSFU to handle two active images on the H7 dual core boards?

[AKhri.1]

I have recently adapted the STM32H753ZI-Nucleo SBSFU project to run on the H745ZI-Q, but only on the CM7. I am trying to adapt the project to handle another active image slot dedicated to the CM4, but I am having a bit of a problem with the firmware headers.

As stated in section 3.2.4 of the integration guide (AN5056): "As a constraint, all the headers must be grouped in a single area to be protected inside the isolated environment. Each header must be located in its own Flash memory sector."

Following this guideline and the example shown, I mapped the header of the first active slot to 0x0802000 and the header of the second active slot to 0x084000. The firmware images start at 0x0806000 and 0x0812000 respectively.

I changed the size of the header MPU region to 256K to cover both sectors of the header, but when the board is flashed, the SBSFU fails to run. Turning on the verbose debug mode produces this output:

Seeing this, I changed the mapping and tried to see if I could group the headers into one sector and apply MPU on that. So, I changed the MPU region size to 128K and changed the second FW header address to 0x0803000.

This seems to satisfy the MPU check, but when run the SB produces the following:

It seems to no longer be able to verify firmware images and deletes any images sent over immediately.

I then tried to simply put the headers at the beginning of their respective active slot addresses. I defined a new MPU region which protects 1K of the second slot's header and it initialized without any problems, but then the SB will still refuse to jump to the firmware as the MPU protection check only verifies if both headers are covered by the same MPU region.

Should I simply add to the protection check by adding the if that verifies the second region? Or is there another way that I can satisfy the constraint described in the integration guide?

[Jocelyn RICARD]

Hello @AKhri.1​ ,

The grouping of the firmware headers is useful when you can use secure memory with STM32H7 or firewall with STM32L4 to really protect them while application is running.

The STM32H745 does not implement this secure memory (only STM32H755 with crypto provides this feature)

The protection of the headers with MPU is useful only during SBSFU operation to avoid executing anything inside this header. Probability to have an attack using this is very low IMHO.

So, I wouldn't bother too much about such MPU protection.

Now, if you still want to have this protection, your last proposal looks good.

Best regards

Jocelyn