STM32 MCUs secure firmware install (SFI)
STM32 SFI is a solution for secure manufacturing in production environments that guarantees the authenticity, integrity, and confidentiality of the firmware. It is available on select STM32L4, and most STM32L5, STM32U5, STM32H5 and STM32H7 microcontrollers.
Instructions
The procedure consists of two main steps:
Preparation of files and Hardware Secure Module (HSM) using the source code and the toolkit provided by STMicroelectronics. Two elements are necessary to perform an SFI sequence using FlashPro-ARM/GangPro-ARM
Encrypted firmware binary in a SFI file (*.sfi)
Programming of the target’s flash memory and option bytes using FlashPro-ARM/GangPro-ARM using the files prepared in the first step.
1. Preparing necessary files:
Preparation of the Encryption key and Encryption nonce files (AES128Key.bin and Nonce.bin) - both files can be generated using STM32TrustedPackageCreator (SFI tab). To generate Encryption nonce file and Encryption key file, proceed as follows:
Open Trusted Package Creator and select SFI
Open SFI tab
Press “Generate” buttons(red arrows) and set destination place for generated files
Preparation of Option Bytes Config file (OptionBytesSetting.csv) - file can be generated using STM32TrustedPackageCreator (SFI Option Bytes tab).
To generate Option Bytes Config file file, proceed as follows:Open Trusted Package Creator and select SFI
Open SFI Option Bytes tab
Select target microcontroller
In window set finall option bytes configuration after secure firmware install operation
Press “Open Option Bytes File” button and set destination place for generated file
Preparation of firmware files (firmware.bin, .hex, .srec, etc.)
Preparation of an encrypted firmware binary file (*.sfi) using STM32TrustedPackageCreator (SFI tab) or STM32TrustedPackageCreator_CLI (-sfi option), keys, option bytes config file and input firmware are necessary in this step.
Programming HSM modules with a limited number of licenses using STM32TrustedPackageCreator (HSM tab) or STM32TrustedPackageCreator_CLI (-hsm option), keys (AES128Key.bin and Nonce.bin) are necessary in this step and they must be the same as for firmware encryption.
2. Programming flash memory and option bytes using FlashPro-ARM/GangPro-ARM on Windows
Configuration for FlashPro-ARM and GangPro-ARM is the same, but GangPro-ARM can program up to 6 device simultaneously.
Open FlashPro-ARM/GangPro-ARM software
Open Setup → SFI Setup window
Set HSM card index(by default 1)
Check “Enable” box
Use “Browse” button and pick *.sfi file, generated by STM32TrustedPackageCreator
Check “Set log file path” box only if you would like to save used licenses from HSM module (using saved licenses allows reprogramming of the same DUT without using HSM quota)
Use “Browse” button and set place where log file with licenses should be saved
Press “Ok” button to save SFI setup
Press “AUTO PROG.”(or “WRITE FLASH”) button to execute secure firmware install operation
Check output logs after AutoProgram
FlashPro-ARM
Communication initialization......... OK OSC=48.15 MHz, Sys.CLK=48.15 MHz Erasing memory ............................... done Secure firmware install procedure start... OK Communication initialization................... OK Reading MCU decriptor......................... OK Option bytes setup................................. OK Certificate analyze................................. OK Request HSM license............................ OK Firmware install...................................... OK RSS version = 1.4.0.............................. OK RSSe version = 2.3.0............................ OK Install license......................................... OK Processing Image Header..................... OK SFI programming.................................... OK Warning: Could not verify security state after last chunk programming -------- D O N E --- ( run time = 10.7 sec.)
GangPro-ARM
Secure firmware install procedure start... OK
RSS version = 3.1.0... OK
Reading the chip Certificate...... OK
Request HSM license.........................
#1: .. OK
#2: .. OK
#6: .. OK
Option bytes setup..............................
#1: .. OK
#2: .. OK
#6: .. OK
Starting SFI part 1
Install license......................................
#1: .. OK
#2: .. OK
#6: .. OK
Processing Image Header..................
#1: .. OK
#2: .. OK
#6: .. OK
Programming memory..................
#1: .. OK
#2: .. OK
#6: .. OK
Starting SFI part 2
Install license......................................
#1: .. OK
#2: .. OK
#6: .. OK
Processing Image Header..................
#1: .. OK
#2: .. OK
#6: .. OK
Programming memory..................
#1: .. OK
#2: .. OK
#6: .. OK
Starting SFI part 3
Install license......................................
#1: .. OK
#2: .. OK
#6: .. OK
Processing Image Header..................
#1: .. OK
#2: .. OK
#6: .. OK
Programming memory..................
#1: .. OK
#2: .. OK
#6: .. OK
Starting SFI part 4
Install license......................................
#1: .. OK
#2: .. OK
#6: .. OK
Processing Image Header..................
#1: .. OK
#2: .. OK
#6: .. OK
Programming memory..................
#1: .. OK
#2: .. OK
#6: .. OK
Warning: Could not verify security state after last chunk programming
-------- D O N E --- ( run time = 15.7 sec.)
Useful links
STMicroelectronics application notes and user manuals:
[1] AN5054 - Secure programming using STM32CubeProgrammer
[2] AN4992- STM32 MCUs secure firmware install (SFI) overview
[3] AN5156 - Introduction to STM32 microcontrollers security
[4] UM2238 - STM32 Trusted Package Creator tool software description