Need OEMiROT example on STM32C5 controller with STM32Cube IDE and STM32 CubeMX setting

[arpit.shah1]

I am following this link for OEMiROT example with STM32C5 : https://wiki.st.com/stm32mcu/wiki/Security:How_to_start_with_OEMiRoT_on_STM32C5

 

But this example and steps are with IAR embedded workbench and Open-CMSIS.

I need example and configuration with STM32Cube IDE to achieve OEMiROT with STM32C5 series. Let me know if any hint or example already provided

[Khaled_DHIF]

Hello ​@arpit.shah1 ,

 

For STM32CubeIDE, use the Open-CMSIS variant of the OEMiRoT example (NUCLEO-C562RE/open-cmsis). 
The overall OEMiRoT process stays the same as in the wiki (provisioning, build OEMiRoT, build Appli, generate signed/encrypted images, then program/provision).  
What changes vs EWARM is mainly the build integration:

1. OEMiRoT project: pre-build runs project_oemirot.py prebuild.  
2. Appli project: pre-build runs project_appli.py prebuild, and post-build runs project_appli.py postbuild (image generation).  
3. Build order: OEMiRoT first, then Appli (Release).  
4. Then run provisioning.py to program OB + binaries.

The prebuild/postbuild commands for CubeIDE: 

# OEMiRoT prebuild
python ./../../../oemirot/project_oemirot.py prebuild --compiler AC6

# Appli prebuild
python ./../../../appli/project_appli.py prebuild --compiler AC6

# Appli postbuild
python ./../../../appli/project_appli.py postbuild

To know how to import the Open-CMSIS project in the STM32CubeIDE please refer to this link.

Kind regards, 

DHIF Khaled

[arpit.shah1]

​@Khaled_DHIF Thank you.

 

The prebuild/postbuild commands:

#OEMiRoT prebuild

python ./../../../oemirot/project_oemirot.py prebuild --compiler AC6

# Appli prebuild

python ./../../../appli/project_appli.py prebuild --compiler AC6

# Appli postbuild

python ./../../../appli/project_appli.py postbuild

 

Are for AC6 toolchain. Is there any support for GCC toolchain in STM32 Cube IDE? Also which ide to add these commands?

Because examples are given for IAR and AC6 and not for GCC with Cube IDE

[Khaled_DHIF]

Hello ​@arpit.shah1 ,

Yes, STM32CubeIDE can build the STM32C5 OEMiRoT example with GCC. Use the Open-CMSIS example as the reference, but integrate the scripts into the CubeIDE CMake project.

Use:

project_appli.py prebuild --compiler GCC

before compilation, then after linking:

project_appli.py postbuild

The CMake build must first convert the linked ELF file to the HEX file expected by OEMiRoT:

add_custom_target(oemirot_appli_prebuild
  COMMAND ${Python3_EXECUTABLE}
    "${C5_APPLI_SCRIPT}" prebuild --compiler GCC
)

add_dependencies(MyApplication oemirot_appli_prebuild)

add_custom_command(TARGET MyApplication POST_BUILD
  COMMAND ${CMAKE_OBJCOPY} -O ihex
    "$<TARGET_FILE:MyApplication>"
    "${C5_APPLI_HEX}"
  COMMAND ${Python3_EXECABLE}
    "${C5_APPLI_SCRIPT}" postbuild
)

For a CMake project, add these commands to CMakeLists.txt; they will not appear in CubeIDE’s managed-build Pre-build steps menu.

The GCC linker script must use the OEMiRoT application region and define the symbols required by project_appli.py, for example:

#define ROM_APPLI_ADDRESS 0x08018400
#define ROM_APPLI_SIZE    0x33C00

Also configure the GCC linker path in project_appli.ini:

[GCC]
linker = path/to/stm32c562xe_flash.ld

The complete sequence is:

prebuild -> GCC build -> appli.hex -> postbuild -> signed/encrypted images

For the full production flow, build OEMiRoT first, then the application, and finally run provisioning.py to program the option bytes and generated images.

Kind regards, 

DHIF Khaled 

[User_MV]

This might be of interest to you:

 

The provided Cmake Config can be imported with CubeIDE and GCC based project generation works (see patches for the provisioning scripts ...)