Last edited one year ago

How to perform Secure Boot from Distribution package

Applicable for STM32MP13x lines, STM32MP15x lines

1. Article purpose[edit source]

The purpose of this article is to explain how to perform a secure boot on a STM32MP device with the Distribution package.
To perform this use-case you need to:

You must proceed step-by-step (you cannot roll back).

Warning white.png Warning
Make sure you save the generated signature key that is put on the STM32MP device. Once the signature is saved and the device is "closed", no change is possible

2. Creating signature key[edit source]

To perform the Secure Boot, you need to have binaries signed with a specific signature key.

If this signature key is already present on the STM32MP device, go directly to Distribution package with signed FIP.

To create the signature key, you must use the STM32MP KeyGen CLI Tool.

See KeyGen tool page for installation and command-line options.
The minimal command to use is: 

 STM32MP_KeyGen_CLI -abs <output directory> -pwd <password> -n <number of key>

With:

  • <output directory> = patch to the generated private and public key files (privateKey.pem and publicKey*.pem)
  • <password> = Password of the private key. The password must contain 4 characters at least.
  • <number of key> = number of key pairs, 1 for STM32MP15 or 8 for stm32MP13
Warning white.png Warning
Save the password associated to the signature key and the files generated (publicKey*.pem and privateKey.pem),

they are asked for when you need to sign a binary.

2.1. Creating signature key for STM32MP15x lines More info.png[edit source]

STM32MP15x lines More info.png device supports only one signature key pair (Public key / Private Key)
Example: 

 STM32MP_KeyGen_CLI -abs stm32mp15-key/ -pwd azerty -n 1
        -------------------------------------------------------------------
                        STM32MP Key Generator v1.0.0                              
        -------------------------------------------------------------------
 
  Prime256v1 curve is selected. 
  AES_256_cbc algorithm is selected for private key encryption
  Generating Prime256v1 keys... 
  Private key PEM file created 
  Public key PEM file created 
  public key hash file created 
  Keys packet 0 generated successfully.
  + public key:       /tmp/key/publicKey00.pem
  + private key:      /tmp/key/privateKey00.pem
  + public hash key:  /tmp/key/publicKeyHash00.bin
  ------------------------------------------------------------
  Hash of table of Hash of {algorithm + public Key} file generated successfully.
  + Hash Hash:  /tmp/key/publicKeysHashHashes.bin

2.2. Creating signature key for STM32MP13x lines More info.png[edit source]

STM32MP13x lines More info.png device supports up to 8 signature key pairs (Public key / Private Key)
Example: 

 STM32MP_KeyGen_CLI -abs stm32mp13-key/ -pwd azerty -n 8

       -------------------------------------------------------------------
                       STM32MP Key Generator v1.0.0                              
       -------------------------------------------------------------------

 Prime256v1 curve is selected. 
 AES_256_cbc algorithm is selected for private key encryption
 Generating Prime256v1 keys... 
 Private key PEM file created 
 Public key PEM file created 
 public key hash file created 
 Keys packet 0 generated successfully.
 + public key:       /tmp/key/publicKey00.pem
 + private key:      /tmp/key/privateKey00.pem
 + public hash key:  /tmp/key/publicKeyHash00.bin
 ------------------------------------------------------------
 AES_256_cbc algorithm is selected for private key encryption
 Generating Prime256v1 keys... 
 Private key PEM file created 
 Public key PEM file created 
 public key hash file created 
 Keys packet 1 generated successfully.
 + public key:       /tmp/key/publicKey01.pem
 + private key:      /tmp/key/privateKey01.pem
 + public hash key:  /tmp/key/publicKeyHash01.bin
 ------------------------------------------------------------
 AES_256_cbc algorithm is selected for private key encryption
 Generating Prime256v1 keys... 
 Private key PEM file created 
 Public key PEM file created 
 public key hash file created 
 Keys packet 2 generated successfully.
 + public key:       /tmp/key/publicKey02.pem
 + private key:      /tmp/key/privateKey02.pem
 + public hash key:  /tmp/key/publicKeyHash02.bin
 ------------------------------------------------------------
 AES_256_cbc algorithm is selected for private key encryption
 Generating Prime256v1 keys... 
 Private key PEM file created 
 Public key PEM file created 
 public key hash file created must be signed with 
 Keys packet 3 generated successfully.
 + public key:       /tmp/key/publicKey03.pem
 + private key:      /tmp/key/privateKey03.pem
 + public hash key:  /tmp/key/publicKeyHash03.bin
 ------------------------------------------------------------
 AES_256_cbc algorithm is selected for private key encryption
 Generating Prime256v1 keys... 
 Private key PEM file created 
 Public key PEM file created 
 public key hash file created 
 Keys packet 4 generated successfully.
 + public key:       /tmp/key/publicKey04.pem
 + private key:      /tmp/key/privateKey04.pem
 + public hash key:  /tmp/key/publicKeyHash04.bin
 ------------------------------------------------------------
 AES_256_cbc algorithm is selected for private key encryption
 Generating Prime256v1 keys... 
 Private key PEM file created 
 Public key PEM file created 
 public key hash file created 
 Keys packet 5 generated successfully.
 + public key:       /tmp/key/publicKey05.pem
 + private key:      /tmp/key/privateKey05.pem
 + public hash key:  /tmp/key/publicKeyHash05.bin
 ------------------------------------------------------------
 AES_256_cbc algorithm is selected for private key encryption
 Generating Prime256v1 keys... 
 Private key PEM file created 
 Public key PEM file created 
 public key hash file created 
 Keys packet 6 generated successfully.
 + public key:       /tmp/key/publicKey06.pemsoc
 + private key:      /tmp/key/privateKey06.pem
 + public hash key:  /tmp/key/publicKeyHash06.bin
 ------------------------------------------------------------
 AES_256_cbc algorithm is selected for private key encryption
 Generating Prime256v1 keys... 
 Private key PEM file created 
 Public key PEM file created 
 public key hash file created 
 Keys packet 7 generated successfully.
 + public key:       /tmp/key/publicKey07.pem
 + private key:      /tmp/key/privateKey07.pem
 + public hash key:  /tmp/key/publicKeyHash07.bin
 ------------------------------------------------------------
 Hash of table of Hash of {algorithm + public Key} file generated successfully.
 + Hash Hash:  /tmp/key/publicKeysHashHashes.bin

3. Creating encryption key[edit source]

3.1. Creating encryption key for STM32MP13x lines More info.png[edit source]

To perform Secure Boot with encrypted binaries, you must have binaries encrypted with a specific encryption key.

If this signature key is already present on the STM32MP device, go directly to Distribution package with signed FIP.

To create an encryption key, you must generate a random key of 16 bytes'.
On Linux PC: 

 dd if=/dev/random of=stm32mp13_encryption_key.bin bs=1 count=16

On Linux with STM32MP_KeyGen_CLI: 

 STM32MP_KeyGen_CLI.exe -rand 16 stm32mp13_encryption_key.bin

On Windows with STM32MP_KeyGen_CLI: 

 STM32MP_KeyGen_CLI.exe -rand 16 stm32mp13_encryption_key.bin

4. Put signature key on STM32MP[edit source]

Info white.png Information
For demonstration and test purposes, the signature key can be put on the STM32MP device with a simple U-Boot command on the development board.

For production purposes, it must be set in the production step, as described in Secure_Secret_Provisioning_(SSP).

4.1. Put the hash key on the device for STM32MP15x lines More info.png[edit source]

To manually put the public key hash (PKH) on the STM32MP device with a U-Boot stm32key command, you need to:

  • Put the Public Key Hash' file (publicKeyhash.bin), generated in the previous section, on bootfs partition
  • Boot the board and stop it on th U-Boot console
  • Load the public key hash in DDR
    for example, the hash key file is located on 8th partition of the SD card:
 load mmc 0:8 0xc0000000 publicKeyhash.bin
  • Register public key hash
 stm32key fuse 0xc0000000

For more information, see How to use U-Boot stm32key command.

4.2. Put hash key on device for STM32MP13x lines More info.png[edit source]

To manually put the public key hash (PKH) on STM32MP device with U-Boot stm32key command, you need to:

  • Put the 'Public Key Hash file (publicKeysHashHashes.bin), generated on previous section, on bootfs partition
  • Boot the board and stop on U-Boot console
  • Load public key hash in DDR
    for example, the hash key file is located on 8th partition of sdcard:
 load mmc 0:8 0xc0000000 publicKeysHashHashes.bin
  • Register public key hash
 stm32key fuse 0xc0000000

For more information, see How to use U-Boot stm32key command.

5. Put encryption key on STM32MP[edit source]

Info white.png Information
For demonstration and test purposes, the encryption key can be put on the STM32MP device with a simple U-Boot command on the development board.

For production purposes, it must be set in the production step.

5.1. Put an encryption key on the device for STM32MP13x lines More info.png[edit source]

To manually put the key on the STM32MP device with a U-Boot stm32key command, you need to:

  • Put the encryption key file (stm32mp13_encryption_key.bin), generated in the previous section, on the bootfs partition
  • Boot the board and stop it on the U-Boot console
  • Load a hash public key in DDR
    for example, the hash key file is located on 8th partition of the SD card:
 load mmc 0:8 0xc0000000 stm32mp13_encryption_key.bin

 stm32key select EDMK
  • Register encryption key
 stm32key fuse 0xc0000000
  • Verify that the key is registered
 stm32key read

For more information, see How to use U-Boot stm32key command.

6. Distribution package with signed FIP[edit source]

6.1. Pre-requisites[edit source]

6.2. Generate Distribution package with signed binaries[edit source]

Info white.png Information
With this step only FIP binaries are signed
  • Source the environment of the Distribution package
 source layers/meta-st/scripts/envsetup.sh

Select your DISTRO and your machine

  • Indicate where to find your Signature key

(in this example we put the signature key on meta-st-stm32mp layer on key directory)
Add the following lines on your local.conf (on build directory)

For ST32MP15: 

 echo 'FIP_SIGN_KEY = "key/stm32mp15/privateKey.pem" ' >> conf/local.conf
 echo 'FIP_SIGN_KEY_stm32mp15 = "key/stm32mp15/privateKey.pem" ' >> conf/local.conf 
 echo 'FIP_SIGN_KEY_EXTERNAL = "1" ' >> conf/local.conf 
 echo 'FIP_SIGN_KEY_PASS = "<password of signature key>" ' >> conf/local.conf
 echo 'TF_A_SIGN_ENABLE = "1" ' >> conf/local.conf

For ST32MP13: 

 echo 'FIP_SIGN_KEY = "key/stm32mp13/privateKey00.pem" ' >> conf/local.conf
 echo 'FIP_SIGN_KEY_stm32mp13 = "key/stm32mp13/privateKey00.pem" ' >> conf/local.conf 
 echo 'FIP_SIGN_KEY_EXTERNAL = "1" ' >> conf/local.conf 
 echo 'FIP_SIGN_KEY_PASS = "<password of signature key>" ' >> conf/local.conf
 echo 'TF_A_SIGN_ENABLE = "1" ' >> conf/local.conf

Request to sign the FIP file generated: 

 echo 'FIP_SIGN_ENABLE = "1" ' >> conf/local.conf
  • Compile your binaries

bitbake st-image-weston

On tmp-glibc/deploy/images/<machine name>/fip/ you will found the FIP file signed ready to be programmed on board.

6.3. Generate a Distribution package with encrypted partition binaries for STM32MP13x lines More info.png[edit source]

To enable secure boot with encryption support, you must add DECRYPTION_SUPPORT=aes_gcm with the ENCRYPT_BLx to specify the encrypted binary.

Request encryption support on BL2 TF-A binaries: 

 echo 'TF_A_ENCRYPTED_ENABLE = "1" ' >> conf/local.conf

7. Sign first stage bootloader binaries[edit source]

The first stage bootloader binaries = TF-A BL2 are generated unsigned; we need to sign them manually with the STM32MP_SigningTool_CLI.

For installation and command-line options, see Signing tool.

Info white.png Information
if you need to populate the FSBL binary via STM32CubeProgrammer, you also need to sign the serial boot TF-A BL2 loaded in memory

These tools are used to sign a binary with STM32 header, with the minimal options to sign the FSBL binary: 

 STM32MP_SigningTool_CLI -pubk <public key> -prvk  <private key> -pwd <password> -t fsbl -of <Option_Flags> -bin FSBL binary not signed>.stm32 -o <FSBL binary signed>.stm32

with:

  • <public key>= the path of the Public key file generated by KeyGen: publicKey.pem
  • <private key> = the path of the Private key files generated by KeyGen: privateKey*.pem, 1 for STM32MP15 and 8 for STM32MP13
  • <password> = pasword used by KeyGen to protect the key files
  • <Option_Flags> = the -of option is required only for STM32MP13, with 0x00000001 value

7.1. Signing first stage bootloader binaries for STM32MP15x lines More info.png[edit source]

For SDCARD: 

 STM32MP_SigningTool_CLI  -pubk <path to meta-st-stm32mp>key/stm32mp15/publicKey.pem -prvk  <path to meta-st-stm32mp>key/stm32mp15/privateKey.pem -pwd <password> -t fsbl -bin arm-trusted-firmware/tf-a-<board name>-sdcard.stm32 -o arm-trusted-firmware/tf-a-<board name>-sdcard_Signed.stm32

For EMMC: 

 STM32MP_SigningTool_CLI  -pubk <path to meta-st-stm32mp>key/stm32mp15/publicKey.pem -prvk  <path to meta-st-stm32mp>key/stm32mp15/privateKey.pem -pwd <password> -t fsbl -bin arm-trusted-firmware/tf-a-<board name>-emmc.stm32 -o arm-trusted-firmware/tf-a-<board name>-emmc_Signed.stm32

For NAND: 

 STM32MP_SigningTool_CLI  -pubk <path to meta-st-stm32mp>key/stm32mp15/publicKey.pem -prvk  <path to meta-st-stm32mp>key/stm32mp15/privateKey.pem -pwd <password> -t fsbl -bin arm-trusted-firmware/tf-a-<board name>-nand.stm32 -o arm-trusted-firmware/tf-a-<board name>-nand_Signed.stm32

For NOR: 

 STM32MP_SigningTool_CLI  -pubk <path to meta-st-stm32mp>key/stm32mp15/publicKey.pem -prvk  <path to meta-st-stm32mp>key/stm32mp15/privateKey.pem -pwd <password> -t fsbl -bin arm-trusted-firmware/tf-a-<board name>-nor.stm32 -o arm-trusted-firmware/tf-a-<board name>-nor_Signed.stm32

For USB (used with STM32CubeProgrammer): 

 STM32MP_SigningTool_CLI  -pubk <path to meta-st-stm32mp>key/stm32mp15/publicKey.pem -prvk  <path to meta-st-stm32mp>key/stm32mp15/privateKey.pem -pwd <password> -t fsbl -bin arm-trusted-firmware/tf-a-<board name>-usb.stm32 -o arm-trusted-firmware/tf-a-<board name>-usb_Signed.stm32

For UART (used with STM32CubeProgrammer): 

 STM32MP_SigningTool_CLI  -pubk <path to meta-st-stm32mp>key/stm32mp15/publicKey.pem -prvk  <path to meta-st-stm32mp>key/stm32mp15/privateKey.pem -pwd <password> -t fsbl -bin arm-trusted-firmware/tf-a-<board name>-uart.stm32 -o arm-trusted-firmware/tf-a-<board name>-uart_Signed.stm32

7.2. Signing first stage bootloader binaries for STM32MP13x lines More info.png[edit source]

For SDCARD: 

 STM32MP_SigningTool_CLI  -pubk <path to meta-st-stm32mp>key/stm32mp13/publicKey*.pem -prvk  <path to meta-st-stm32mp>key/stm32mp15/privateKey00.pem -pwd <password> -t fsbl -of 0x00000001 -bin arm-trusted-firmware/tf-a-<board name>-sdcard.stm32 -o arm-trusted-firmware/tf-a-<board name>-sdcard_Signed.stm32

For EMMC: 

 STM32MP_SigningTool_CLI  -pubk <path to meta-st-stm32mp>key/stm32mp13/publicKey*.pem -prvk  <path to meta-st-stm32mp>key/stm32mp13/privateKey00.pem -pwd <password> -t fsbl -of 0x00000001 -bin arm-trusted-firmware/tf-a-<board name>-emmc.stm32 -o arm-trusted-firmware/tf-a-<board name>-emmc_Signed.stm32

For NAND: 

 STM32MP_SigningTool_CLI  -pubk <path to meta-st-stm32mp>key/stm32mp13/publicKey*.pem -prvk  <path to meta-st-stm32mp>key/stm32mp13/privateKey00.pem -pwd <password> -t fsbl -of 0x00000001 -bin arm-trusted-firmware/tf-a-<board name>-nand.stm32 -o arm-trusted-firmware/tf-a-<board name>-nand_Signed.stm32

For NOR: 

 STM32MP_SigningTool_CLI  -pubk <path to meta-st-stm32mp>key/stm32mp13/publicKey*.pem -prvk  <path to meta-st-stm32mp>key/stm32mp13/privateKey00.pem -pwd <password> -t fsbl -of 0x00000001 -bin arm-trusted-firmware/tf-a-<board name>-nor.stm32 -o arm-trusted-firmware/tf-a-<board name>-nor_Signed.stm32

For USB (used with STM32CubeProgrammer): 

 STM32MP_SigningTool_CLI  -pubk <path to meta-st-stm32mp>key/stm32mp13/publicKey*.pem -prvk  <path to meta-st-stm32mp>key/stm32mp13/privateKey00.pem -pwd <password> -t fsbl -of 0x00000001 -bin arm-trusted-firmware/tf-a-<board name>-usb.stm32 -o arm-trusted-firmware/tf-a-<board name>-usb_Signed.stm32

For UART (used with STM32CubeProgrammer): 

 STM32MP_SigningTool_CLI  -pubk <path to meta-st-stm32mp>key/stm32mp13/publicKey*.pem -prvk  <path to meta-st-stm32mp>key/stm32mp13/privateKey00.pem -pwd <password> -t fsbl -of 0x00000001 -bin arm-trusted-firmware/tf-a-<board name>-uart.stm32 -o arm-trusted-firmware/tf-a-<board name>-uart_Signed.stm32

7.3. Encrypt first stage bootloader binaries for STM32MP13x lines More info.png[edit source]

For SDCARD: 

 STM32MP_SigningTool_CLI  -pubk <path to meta-st-stm32mp>key/stm32mp13/publicKey*.pem -prvk  <path to meta-st-stm32mp>key/stm32mp15/privateKey00.pem -pwd <password>  --enc-key  <path to meta-st-stm32mp>key/stm32mp13/stm32mp13_encryption_key.bin -t fsbl   --enc-dc 0x0E5F2025 --image-version 0 -of 0x80000003 -bin arm-trusted-firmware/tf-a-<board name>-sdcard.stm32 -o arm-trusted-firmware/tf-a-<board name>-sdcard_Encrypted.stm32

For EMMC: 

 STM32MP_SigningTool_CLI  -pubk <path to meta-st-stm32mp>key/stm32mp13/publicKey*.pem -prvk  <path to meta-st-stm32mp>key/stm32mp15/privateKey00.pem -pwd <password>  --enc-key  <path to meta-st-stm32mp>key/stm32mp13/stm32mp13_encryption_key.bin -t fsbl   --enc-dc 0x0E5F2025 --image-version 0 -of 0x80000003 -bin arm-trusted-firmware/tf-a-<board name>-emmc.stm32 -o arm-trusted-firmware/tf-a-<board name>-emmc_Encrypted.stm32

For NAND: 

 STM32MP_SigningTool_CLI  -pubk <path to meta-st-stm32mp>key/stm32mp13/publicKey*.pem -prvk  <path to meta-st-stm32mp>key/stm32mp15/privateKey00.pem -pwd <password>  --enc-key  <path to meta-st-stm32mp>key/stm32mp13/stm32mp13_encryption_key.bin -t fsbl   --enc-dc 0x0E5F2025 --image-version 0 -of 0x80000003 -bin arm-trusted-firmware/tf-a-<board name>-nand.stm32 -o arm-trusted-firmware/tf-a-<board name>-nand_Encrypted.stm32

For NOR: 

 STM32MP_SigningTool_CLI  -pubk <path to meta-st-stm32mp>key/stm32mp13/publicKey*.pem -prvk  <path to meta-st-stm32mp>key/stm32mp15/privateKey00.pem -pwd <password>  --enc-key  <path to meta-st-stm32mp>key/stm32mp13/stm32mp13_encryption_key.bin -t fsbl   --enc-dc 0x0E5F2025 --image-version 0 -of 0x80000003 -bin arm-trusted-firmware/tf-a-<board name>-nor.stm32 -o arm-trusted-firmware/tf-a-<board name>-nor_Encrypted.stm32

8. Create FlashLayout for signed binaries[edit source]

To populate the correct binaries on the board, you need to create a FlashLayout file with the signed binaries:

  • FSBL = tf-a-*_Signed.stm32
  • FIP = fip-*.bin

Example for FlashLayout_sdcard_stm32mp157f-dk2-optee.tsv: 

#Opt	Id	Name	Type	IP	Offset	Binary
- 	0x01	fsbl-boot	Binary	none	0x0	arm-trusted-firmware/tf-a-stm32mp157f-dk2-usb.stm32
-	0x03	fip-boot	FIP	none	0x0	fip/fip-stm32mp157f-dk2-optee.bin
P	0x04	fsbl1	Binary	mmc0	0x00004400	arm-trusted-firmware/tf-a-stm32mp157f-dk2-sdcard.stm32
P	0x05	fsbl2	Binary	mmc0	0x00044400	arm-trusted-firmware/tf-a-stm32mp157f-dk2-sdcard.stm32
P	0x06	metadata1	Binary	mmc0	0x00084400	arm-trusted-firmware/metadata.bin
P	0x07	metadata2	Binary	mmc0	0x000C4400	arm-trusted-firmware/metadata.bin 
P	0x08	fip-a	FIP	mmc0	0x00104400	fip/fip-stm32mp157f-dk2-optee.bin
PED	0x09	fip-b	FIP	mmc0	0x00504400	none
PED	0x0A	u-boot-env	Binary	mmc0	0x00904400	none
P	0x10	bootfs	System	mmc0	0x00984400	st-image-bootfs-openstlinux-weston-stm32mp1.ext4
P	0x11	vendorfs	FileSystem	mmc0	0x04984400	st-image-vendorfs-openstlinux-weston-stm32mp1.ext4
P	0x12	rootfs	FileSystem	mmc0	0x05984400	st-image-weston-openstlinux-weston-stm32mp1.ext4
P	0x13	userfs	FileSystem	mmc0	0x33984400	st-image-userfs-openstlinux-weston-stm32mp1.ext4

You need to update the fsbl1-boot, fip-boot, fsbl1, fsbl2 and fip partitions.
Result: 

#Opt	Id	Name	Type	IP	Offset	Binary
- 	0x01	fsbl-boot	Binary	none	0x0	arm-trusted-firmware/tf-a-stm32mp157f-dk2-usb_Signed.stm32
-	0x03	fip-boot	FIP	none	0x0	fip/fip-stm32mp157f-dk2-optee_Signed.bin
P	0x04	fsbl1	Binary	mmc0	0x00004400	arm-trusted-firmware/tf-a-stm32mp157f-dk2- sdcard_Signed.stm32
P	0x05	fsbl2	Binary	mmc0	0x00044400	arm-trusted-firmware/tf-a-stm32mp157f-dk2- sdcard_Signed.stm32
P	0x06	metadata1	Binary	mmc0	0x00084400	arm-trusted-firmware/metadata.bin
P	0x07	metadata2	Binary	mmc0	0x000C4400	arm-trusted-firmware/metadata.bin 
P	0x08	fip-a	FIP	mmc0	0x00104400	fip/fip-stm32mp157f-dk2-optee_Signed.bin
PED	0x09	fip-b	FIP	mmc0	0x00504400	none
PED	0x0A	u-boot-env	Binary	mmc0	0x00904400	none
P	0x10	bootfs	System	mmc0	0x00984400	st-image-bootfs-openstlinux-weston-stm32mp1.ext4
P	0x11	vendorfs	FileSystem	mmc0	0x04984400	st-image-vendorfs-openstlinux-weston-stm32mp1.ext4
P	0x12	rootfs	FileSystem	mmc0	0x05984400	st-image-weston-openstlinux-weston-stm32mp1.ext4
P	0x13	userfs	FileSystem	mmc0	0x33984400	st-image-userfs-openstlinux-weston-stm32mp1.ext4

9. Program and test[edit source]

To populate the correct binaries on the board with STM32CubeProgrammer, you must use the previous FlashLayout file with the signed binaries.

At board boot time, you must check the two level of the secure boot: the ROM code secure boot validation, and the TF-A BL2 trusted board boot validation.

10. Close the device[edit source]

Info white.png Information
For demonstration and test purposes, the STM32MP device can be closed with a simple U-Boot command on the development board. For production purposes, it must be set in production step as described in AN5510: Overview of the secure secret provisioning (SSP) on STM32MP1 Series.

For more information, see How to secure STM32 MPU.

Warning white.png Warning
Make sure you only close the device if the previous authentication test succeeded, otherwise the chip is bricked, and is now unusable.

In U-Boot console: 

  stm32key close

For more information, see the How to use U-Boot stm32key command.

As soon as the device is closed, the operation is irreversible; the user is forced to only use signed images.

Warning white.png Warning
This must not be done on STM32MP13 or STM32MP15 part numbers without Secure boot enabled, otherwise the chip is bricked, and is now unusable.

11. References[edit source]


Advanced encryption standard

Privacy enhanced mail (File format for storing and sending cryptographic keys, certificates, and other data)

Linux® is a registered trademark of Linus Torvalds.

Das U-Boot -- the universal boot loader (see U-Boot)

Public key hash, used for secure boot - NEW

Doubledata rate (memory domain)

SD memory card (https://www.sdcard.org)

Encryption Decryption master key, used for secure boot - NEW

Firmware image package is a packaging format used by TF-A

Boot loader stage 2

Trusted firmware for Arm® Cortex®-A

First stage boot loader

Universal asynchronous receiver/transmitter

Read only memory

Advanced encryption standard

Privacy enhanced mail (File format for storing and sending cryptographic keys, certificates, and other data)

Linux® is a registered trademark of Linus Torvalds.

Das U-Boot -- the universal boot loader (see U-Boot)

Public key hash, used for secure boot - NEW

Doubledata rate (memory domain)

SD memory card (https://www.sdcard.org)

Encryption Decryption master key, used for secure boot - NEW

Firmware image package is a packaging format used by TF-A

Boot loader stage 2

Trusted firmware for Arm® Cortex®-A

First stage boot loader

Universal asynchronous receiver/transmitter

Read only memory

Secure digital

Arm® is a registered trademark of Arm Limited (or its subsidiaries) in the US and/or elsewhere. Arm logo.png

Cortex®

Retrieved from "https://wiki.stmicroelectronics.cn/stm32mpu-ecosystem-v4/index.php?title=How_to_perform_Secure_Boot_from_Distribution_package&oldid=91129"