Secure Engine protected environment
UM2262
66/94
UM2262 Rev 6
Figure 36. Exiting a Secure Engine service
A.2.2 Constraints
The MPU-based Secure Engine isolation relies fully on the fact that privileged level of
software execution is required to access the Secure Engine services. The SVC handler is
the controlled access point to privileged level of execution (this must be trusted code).
Additionally, any piece of code running in privileged mode must be trusted also (interrupt
routines, initialization code, and others) so that the controlled access point is not bypassed.
It is key to partition the software very carefully and avoid granting privileged level of
execution when not required (the software must run in unprivileged mode as much as
possible).
The MPU controls the Cortex
®
-M access to the memory. Any peripheral acting as a master
on the bus might access the Secure Engine code and data without triggering an MPU fault
(for instance a DMA peripheral). It is therefore required to make sure that only trusted code
can program these peripherals. For instance, in the X-CUBE-SBSFU example for
32F413HDISCOVERY, an MPU region covers the DMA registers to make sure it is not
possible to program these peripherals in unprivileged mode of execution: only the privileged
code can configure the DMAs.
Last but not least, for the STM32F4 Series and the STM32F7 Series, the Secure Engine
protection is ensured only as long as the required MPU settings are maintained. If User
Application code is not fully trusted or if a bug can be exploited by a hacker, the MPU
configuration must be maintained during User Application execution.
This latter constraint does not exist for the STM32 Series with secure user memory. Before
launching the user application, the MPU protection is disabled and the secure user memory
protection is activated. When secured, any access to securable memory area (fetch, read,
programming, erase) is rejected, generating a bus error. All the code and secrets located
inside secure user memory (protected environment) is fully hidden. Secure user memory
closure is done through a service provided by the bootloader code (
BL_EXIT_STICKY
) for
the STM32G0 Series and STM32G4 Series or by RSS (
exitSecureArea()
) for the
STM32H7 Series.