SBSFU Rollback with stm32L476RG

[Kurien_Raju]

Hi All,

I am following the UM2262 document. I will add a screenshot. I enabled the ENABLE_IMAGE_STATE_HANDLING flag to enable rollback, but after updating UserApp.bin, the device continues to reset. I will add a debug log screenshot (it’s not jumping into the application). Please help me with any references for the rollback feature using the SBSFU package version 2.6.x.  

Document image 1:

Debug image 2:

Regards,

Raju

[Jocelyn RICARD · Accepted solution]

Hello @Kurien_Raju ,

as far as I remember, you need to add this flag to all projects (SBSFU, SECoreBin, appli), and perform a clean build for each one to make this work.

Is this what you have done ?

Best regards

Jocelyn

[Kurien_Raju]

Hi @Jocelyn RICARD 

I followed same step, but I am getting undefined reference error I added screenshot

 screen shot image1:

screen shot image 2: error log stm32 cubeide:

C:/STM32SecuWS/L4/STM32CubeExpansion_SBSFU_V2.6.2/Projects/NUCLEO-L476RG/Applications/2_Images/2_Images_UserApp/Src/fw_update_app.c:411: undefined reference to `SE_APP_GetActiveFwState'

C:/ST/STM32CubeIDE_1.15.1/STM32CubeIDE/plugins/com.st.stm32cube.ide.mcu.externaltools.gnu-tools-for-stm32.12.3.rel1.win32_1.0.100.202403111256/tools/bin/../lib/gcc/arm-none-eabi/12.3.1/../../../../arm-none-eabi/bin/ld.exe: C:/STM32SecuWS/L4/STM32CubeExpansion_SBSFU_V2.6.2/Projects/NUCLEO-L476RG/Applications/2_Images/2_Images_UserApp/Src/fw_update_app.c:415: undefined reference to `SE_APP_GetActiveFwState'

C:/ST/STM32CubeIDE_1.15.1/STM32CubeIDE/plugins/com.st.stm32cube.ide.mcu.externaltools.gnu-tools-for-stm32.12.3.rel1.win32_1.0.100.202403111256/tools/bin/../lib/gcc/arm-none-eabi/12.3.1/../../../../arm-none-eabi/bin/ld.exe: C:/STM32SecuWS/L4/STM32CubeExpansion_SBSFU_V2.6.2/Projects/NUCLEO-L476RG/Applications/2_Images/2_Images_UserApp/Src/fw_update_app.c:423: undefined reference to `SE_APP_ValidateFw'

collect2.exe: error: ld returned 1 exit status

Regards,

Kurien Raju

[Prakash_Raj1994]

Hi @jocelyn RICARD,

I Resolve the undefined refers error. after enabling flag. but when new firmware updated. not valid it should rollback to previous version. but it's not rollback.

Debug log:

======================================================================
=              (C) COPYRIGHT 2017 STMicroelectronics                 =
=                                                                    =
=              Secure Boot and Secure Firmware Update                =
======================================================================

= [SBOOT] SECURE ENGINE INITIALIZATION SUCCESSFUL
= [SBOOT] STATE: CHECK STATUS ON RESET
          INFO: A Reboot has been triggered by a Software reset!
= [SBOOT] STATE: CHECK NEW FIRMWARE TO DOWNLOAD
= [SBOOT] STATE: CHECK USER FW STATUS
          Installation not validated: rollback procedure initiated (SLO
= [SBOOT] STATE: ROLLBACK INSTALLATION TO PREVIOUS USER FIRMWARE
        Backed-up fw not identified
========= End of Execution ==========

= [SBOOT] System Security Check successfully passed. Starting...

======================================================================
=              (C) COPYRIGHT 2017 STMicroelectronics                 =
=                                                                    =
=              Secure Boot and Secure Firmware Update                =
======================================================================

= [SBOOT] SECURE ENGINE INITIALIZATION SUCCESSFUL
= [SBOOT] STATE: CHECK STATUS ON RESET
          INFO: A Reboot has been triggered by a Software reset!
= [SBOOT] STATE: CHECK NEW FIRMWARE TO DOWNLOAD
= [SBOOT] STATE: CHECK USER FW STATUS
          New Fw to be installed from slot SLOT_DWL_1
= [SBOOT] STATE: INSTALL NEW USER FIRMWARE
        Fw version rejected (anti-rollback)
= [SBOOT] STATE: HANDLE CRITICAL FAILURE
= [SBOOT] STATE: REBOOT STATE MACHINE
========= End of Execution ==========

= [SBOOT] System Security Check successfully passed. Starting...

======================================================================
=              (C) COPYRIGHT 2017 STMicroelectronics                 =
=                                                                    =
=              Secure Boot and Secure Firmware Update                =
======================================================================

= [SBOOT] SECURE ENGINE INITIALIZATION SUCCESSFUL
= [SBOOT] STATE: CHECK STATUS ON RESET
          INFO: A Reboot has been triggered by a Software reset!
= [SBOOT] STATE: CHECK NEW FIRMWARE TO DOWNLOAD
= [SBOOT] STATE: CHECK USER FW STATUS
          Slot SLOT_ACTIVE_1 not empty : erasing ...
          No valid FW found in the active slots nor new FW to be instal
          Waiting for the local download to start...
= [SBOOT] STATE: DOWNLOAD NEW USER FIRMWARE
          File> Transfer> YMODEM> Send ......

Changes made in code:

did I miss anything.

regards,

Prakash

[Jocelyn RICARD]

Hello @Prakash_Raj1994 ,

I made the test on STM32L476 Nucleo.

There are 2 issues related to the activation of the image validation feature

1) The file Projects\NUCLEO-L476RG\Applications\2_Images\2_Images_SBSFU\STM32CubeIDE\se_interface.txt is missing the calls to SE_APP_ValidateFw and SE_APP_GetActiveFwState.

Here is the what should be the content of this file:

SE_APP_GetActiveFwInfo
SE_APP_ValidateFw
SE_APP_GetActiveFwState

2) With default configuration, the validation will trigger a reset.

Reason is MPU configuration setting all the active slot as read only.

An easy way to fix it is to comment #define SFU_MPU_USERAPP_ACTIVATION in app_sfu.h

Best regards

Jocelyn

[Prakash_Raj1994]

Hello @Jocelyn RICARD ,

I follow the same steps to resolve undefined refers and comment out the

// #define SFU_MPU_USERAPP_ACTIVATION in app_sfu.h

rollback function is triggering but rollback is not happening for next rest debug log  Backed-up fw not identified & waiting local download I attached Debug log:

Debug Log: -

=====================================================================
= (C) COPYRIGHT 2017 STMicroelectronics =
= =
= User App #B =
======================================================================

=================== Main Menu ============================

Download a new Fw Image ------------------------------- 1

Test Protections -------------------------------------- 2

Test SE User Code ------------------------------------- 3

Multiple download ------------------------------------- 4

Validate a FW Image------------------------------------ 5

Selection :

================ New Fw Download =========================

-- Send Firmware

-- -- Erasing download area ...

-- -- File> Transfer> YMODEM> Send .

-- -- Programming Completed Successfully!

-- -- Bytes: 22736

-- Image correctly downloaded - reboot

= [SBOOT] System Security Check successfully passed. Starting...

======================================================================
= (C) COPYRIGHT 2017 STMicroelectronics =
= =
= Secure Boot and Secure Firmware Update =
======================================================================

= [SBOOT] SECURE ENGINE INITIALIZATION SUCCESSFUL
= [SBOOT] STATE: CHECK STATUS ON RESET
INFO: A Reboot has been triggered by a Software reset!
= [SBOOT] STATE: CHECK NEW FIRMWARE TO DOWNLOAD
= [SBOOT] STATE: CHECK USER FW STATUS
Installation not validated: rollback procedure initiated (SLOT_ACTIVE_1 / SLOT_DWL_1)
= [SBOOT] STATE: ROLLBACK INSTALLATION TO PREVIOUS USER FIRMWARE
Backed-up fw not identified
========= End of Execution ==========

= [SBOOT] System Security Check successfully passed. Starting...

======================================================================
= (C) COPYRIGHT 2017 STMicroelectronics =
= =
= Secure Boot and Secure Firmware Update =
======================================================================

= [SBOOT] SECURE ENGINE INITIALIZATION SUCCESSFUL
= [SBOOT] STATE: CHECK STATUS ON RESET
INFO: A Reboot has been triggered by a Software reset!
= [SBOOT] STATE: CHECK NEW FIRMWARE TO DOWNLOAD
= [SBOOT] STATE: CHECK USER FW STATUS
New Fw to be installed from slot SLOT_DWL_1
= [SBOOT] STATE: INSTALL NEW USER FIRMWARE
Fw version rejected (anti-rollback)
= [SBOOT] STATE: HANDLE CRITICAL FAILURE
= [SBOOT] STATE: REBOOT STATE MACHINE
========= End of Execution ==========

= [SBOOT] System Security Check successfully passed. Starting...

======================================================================
= (C) COPYRIGHT 2017 STMicroelectronics =
= =
= Secure Boot and Secure Firmware Update =
======================================================================

= [SBOOT] SECURE ENGINE INITIALIZATION SUCCESSFUL
= [SBOOT] STATE: CHECK STATUS ON RESET
INFO: A Reboot has been triggered by a Software reset!
= [SBOOT] STATE: CHECK NEW FIRMWARE TO DOWNLOAD
= [SBOOT] STATE: CHECK USER FW STATUS
Slot SLOT_ACTIVE_1 not empty : erasing ...
No valid FW found in the active slots nor new FW to be installed
Waiting for the local download to start...
= [SBOOT] STATE: DOWNLOAD NEW USER FIRMWARE
File> Transfer> YMODEM> Send ................................

regards,

Prakash 

[Jocelyn RICARD]

Hello @Prakash_Raj1994 ,

I don't have such issue.

Here you seem to have a new firmware that is not valid, so installation does not even occur.

Please check if you didn't change anything mode compared to original example

Best regards

Jocelyn

[Prakash_Raj1994]

Hello @Jocelyn RICARD,

I have imported a fresh project and made only the modifications you mentioned.

Here are the steps I followed:

1. I enabled the flags (BSFU, SECoreBin, userapp) for ENABLE_IMAGE_STATE_HANDLING and added three entries to the se_interface.txt file:

   • SE_APP_GetActiveFwInfo
   • SE_APP_ValidateFw
   • SE_APP_GetActiveFwState

2. I flashed the userapp.bin using the 01_Flash_SBSFU_UserApp.bat script.

3. I compiled only the SECoreBin and userApp (a new key is generated and added into UserApp.sfb), making the original UserApp.sfb invalid, and then updated it through UART.

These are the steps I followed to test the rollback functionality.

Regards,
Prakash

[Jocelyn RICARD]

Hello @Prakash_Raj1994 ,

You need to disable #define SFU_MPU_USERAPP_ACTIVATION in app_sfu.h

"I compiled only the SECoreBin and userApp (a new key is generated and added into UserApp.sfb), making the original UserApp.sfb invalid, and then updated it through UART."

First, you need to compile SECoreBin, SBSFU, and UserApp

There is never new key generated. Keys are located in SECodeBin/Binary. What is generated is se_key.s 

Also, if you want to check the rollback, please rename the output binary files generated to avoid losing previous one.

Something like UserAppA.sfb/UserAppB.sfb

Best regards

Jocelyn

[Prakash_Raj1994]

Hello @Jocelyn RICARD ,

I need to make changes for rollback with this criteria 

1. When Firmware Update fails

2.when Invalid firmware updated

please guide me for changing the statemechine in SBSFU 

Best regards

Prakash