How to start with STM32CubeMX STiRoT Boot path on STM32H57S

Target description

The purpose of this article is to provide step-by-step instructions on how to configure a boot path.
The example below demonstrates how to configure and provision a boot path for an STiRoT (ST immutable Root of Trust) and generate an application code using CubeMx.
The initially generated code is modified to blink the green led embedded on the board.

Read Secure Boot STM32H7RS How to Introduction before starting the practical example described below.

For more technical details which may be useful to know before getting started, check out the following articles:

• Security features on STM32H7RS
• STiRoT for STM32H7S

The figure below shows the possible bootpaths for the STM32H7RS.
The STiRoT is only supported for the STM32H7S, since it requires the Cryp hardware accelerator not supported on the STM32H7R.

The example described in this article uses the boot path indicated in bellows figure.

File:H7RS boot paths.png

Figure1 STM32H7RS boot paths

Prerequisites
To execute the example described below, you need an STM32H57S-DK discovery board:

Figure 2 STM32H7S DK MB1736

You'll also need the following tools:

• STM32CubeMX_6.11.0 or later
• IAR Embedded Workbench rev 9.20.1 or later
• STM32CubeProgrammer rev 2.16.0

Note:

• STM32 Trusted Package Creator (TPC) is automatically installed during the STM32CubeMX installation. This TPC version is dedicated to STM32CubeMX and installed in the STM32CubeMX/utilities folder.
• The latest STM32Cube_FW revision is installed through STM32CubeMX (see appendix).

1. Setting up the STM32CubeMX project

Launch STM32CubeMX

1. Click on Access to MCU Selector (for this example, it's easier to enable only the necessary single GPIO, so it's advised to use the MCU selector instead of the board selector).
2. From the Series column, select STM32H7
3. Select the device used in STM32H7S78-DK.
4. Click start project.
5. For the Memory Protection Unit, select No

File:STM32CubeMx STM32H7S-project start.png

Figure 3 STM32CubeMx project start, STM32H7S

Create the STM32CubeMX project:

1. Select Project Manager tab.
2. Type the name of the project.
3. Choose a folder for the project (avoid a long path). If it doesn't already exist, the related folder will be created.
4. Tick Appli Project
5. Select the relevant toolchain; for this example EWARM is used.
6. The correct MCU reference should be already filler in.
7. The Firmware Package Name and Version should be correct if the latest STM32CubeFW has been installed (see prerequisites)
8. The Firmware Relative Patch should indicate the path to your STM32CubeRepository
9. Select File > Save Project.
10. The project folder (if it doesn't already exist) and the H7S_STiRoT_blinking_LED.ioc file are created.

File:H7S STiRoT CubeMx project config.png

Figure 4 STM32CubeMx Project configuration

2. GPIO configuration

For the proposed example a single GPIO is defined in order to blink the green LED available in the Discovery kit

• PO1 is controlling the green LED (see MB1736 schematic)
• In STM32CubeMX, select the Pinout & Configuration window

File:GPIO configuration window H7S.png

Figure 5 GPIO configuration window

• Click on PO1 and select GPIO_Output. This will configure a push pull output that is needed to drive a LED.

File:GPIO config green LED H7S.png

Figure 6 GPIO configuration for discovery board green LED

• Click on System Core and select GPIO. A summary of the newly configured setting is displayed as shown in the figure below:

File:GPIO config summary.png

Figure 7 GPIO configuration summary