Firmware Update - further details?

[JMoor.6]

Hi,

Release notes for STM32MPU ecosystem v4.0.0 mention “Add support of Firmware Update feature�?. Is there anymore information available on this feature? Or is it utilising an existing Yocto swupdate layer?

Any additional information would be appreciated.

Thanks

[Kevin HUBER · Accepted solution]

Hello @JMoor.6​ ,

The new Firmware Update feature follows the ARM proposal Platform Security Firmware Update for the A-profile Arm.

You can find the page about this topic on the wiki: https://wiki.st.com/stm32mpu/wiki/Secure_Firmware_Update

Best Regards,

Kevin

In order to give better visibility on the answered topics, please click on 'Select as Best' on the reply which solved your issue or answered your question. See also 'Best Answers'

[mteaching]

It's a really good question.

[pp2]

I would like to bring this question up again. I'm quite familiar with firmware update as is implemented in Trusted Firmware A, however I apparently do not fully understand what happens in this context in the "upper layers" like in u-boot.

Thus, I have some questions according to: https://wiki.st.com/stm32mpu/wiki/Secure_Firmware_Update#Update_client and would  be really grateful if you could answer:

- is there any UpdateClient implementation I could have a look?

- according to PSA, the UpdateAgent can sometimes be placed in the Normal World, thus in this case UpdateClient = UpdateAgent - therefore we could use e.g. swupdate to replace the FIP image and update metadata. Is there any tool to update metadata, (except for the u-boot's mkfwumdata that is used to generate the whole metadata binary)?

- should image acceptance (in other words - metadata update from trail state to accepted) happen in u-boot or in linux? I checked u-boot implementation for stm32mp13 and the u-boot is responsible for managing metadata but only when the firmware update goes through EFI capsule and all EFI ecosystem. What if one does not want to use EFI at all?