STM32L562 sbsfu queries

[vrund]

Hello,

I want to use sbsfu for STM32L562 controller with STM32Cube IDE version 1.5.

AS per primary research i am using below package and project .

I am using STM32SecuWS package.

Under that project I am using is STM32SecuWS\TFM\STM32Cube_FW_L5_V1.3.0\Projects\NUCLEO-L552ZE-Q\Applications\SBSFU.

I have gone through the document.

overview-of-secure-boot-and-secure-firmware-update-solution-on-arm-trustzone-stm32l5-series-microcontrollers-stmicroelectronics.pdf

And I want to use STM32CubeL5 SBSFU on page 10.non secure image primary slot(single slot 1 image).

1) For single slot do i required SBSFU_Loader project?

2) I only want to upload non secure image(my user application) do i need to run SBSFU\SBSFU_Appli\Secure project?

3) Postbuild.bat process remains same as x cube sbsfu right?

4) project example is with L552ZE , i have to use STM32L562 what configuration or settings i need to change in cubeIDE?

5) Example project already using mbedTLS library right?

6) getting-started-with-stm32cubel5-tfm-application-stmicroelectronics.pdf

is not useful as i required SBSFU on stm32l562 and not TFM right?

Regards,

Vrund

[Jocelyn RICARD]

Hello Vrund,

First, there is a 1.3.1 release of the firmware already available.

Only change compared to 1.3.0 is that mcu boot related exe files used for signature operations are now digitally signed by ST avoiding issues with automatic removal.

Answers to your questions:

1) For single slot do i required SBSFU_Loader project?

A: Yes, you need a loader outside your application in this case.

2) I only want to upload non secure image(my user application) do i need to run SBSFU\SBSFU_Appli\Secure project?

A: Yes, the secure boot is checking authenticity of both secure and non secure images, and then jumps to secure.

The secure image is important to setup the security configuration of your platform.

3) Postbuild.bat process remains same as x cube sbsfu right?

A: No, in TFM we use a different implementation of SBSFU that is based on open source mcu boot.

So, scripts are different.

4) project example is with L552ZE , i have to use STM32L562 what configuration or settings i need to change in cubeIDE?

A: You need to adapt the target if you want to use HW accelerated crypto. Also, you will need to adapt the interfaces used by SBSFU: UART, LED and button.

But you can copy this from the TFM implementation on the STM32L562

5) Example project already using mbedTLS library right?

A: Yes, we don't use the ST S-CUBE-CRYPTOLIB here.

6) getting-started-with-stm32cubel5-tfm-application-stmicroelectronics.pdf

is not useful as i required SBSFU on stm32l562 and not TFM right?

A: You can have a look to the AN5447 that shows the differences between the 2.

Basically, TFM uses the same secure boot (based on mcuboot).

You can also have a look to the presentation made in the security MOOC part 6.

Best regards

Jocelyn

[vrund]

Hello Jocelyn,

I have gone through AN5447.

In my user application i don't want to access secure part of the flash.

A)For single Slot non secure user application i have to use below projects.

1) SBSFU_Boot

2) SBSFU_Secure App

3) SBSFU Non Secure App (my user app)

4) Any point in time i only want to update non secure application so SBSFU Loader non secure is required.

B) I have seen in SBSFU BOOT it uses TZEN =1 bit and RDP level 2 so it will boot from RSS flash address. is it right?

i have also seen it has used dual bank flash is it right? but why for single image slot it has used dual bank what's the advantage?

C) Rather than using SBSFU BOOT and modifying it,

it will be better if I create custom bootloader, which will check integrity and authenticity using mbed crypto library.

Configuration I am planning to use is TZEN =0 (disable), single bank, RDP level 2, WRP for protecting flash area of bootloader and HDP to store keys.

In that case I don't need to use SBSFU loader, bootloader size will be reduced and Remove secure and non secure application usage.

And I can easily manage public-private key as per my PKI infrastructure. rather depending on prebuild and Postbuild scripts.

is it sounds good.?

Regards,

Vrund

[Jocelyn RICARD]

Hi Vrund,

I'm not sure the reason why you want to use STM32L5.

You can use the L5 without activating TZEN, but you loose the HDP feature in that case.

Using this chip in non secure only, you can port the SBSFU or do your own secureboot.

You have other bootloader examples available: the mcuboot provided in L5 and also the wolf secureboot.

Also, we provide some very basic secureboot to show how things work in the MOOC security part 3.

So, many possible solutions.

Best regards

Jocelyn

[vrund]

Hello Jocelyn,

 MOOC security part 3.

have gone through the doc and video.

OK.

Using this chip in non secure only

BDW by porting SBSFU, you mean to say porting the code STM32CubeExpansion_SBSFU_V2.4.0\Projects\STM32F413H-Discovery\Applications to STM32L562

correct?

You have other bootloader examples available: the mcuboot provided in L5

Under which folder?

Regards,

Vrund

[Jocelyn RICARD]

Hi Vrund,

yes for the porting this is what I meant.

Reason is that you already know how X-CUBE-SBSFU is working.

The mcuboot is actually the secure boot used in the STM32L5 CubeFW implementation.

If you open projects:

STM32Cube_FW_L5_V1.3.1\Projects\STM32L562E-DK\Applications\TFM\TFM_SBSFU_Boot\

or

STM32Cube_FW_L5_V1.3.1\Projects\NUCLEO-L552ZE-Q\Applications\SBSFU\SBSFU_Boot\

You will see the secureboot implementation is based on files located in

STM32Cube_FW_L5_V1.3.1\Middlewares\Third_Party\mcuboot\

Best regards

Jocelyn