c6f334272a
This commit adds support to stm32's mboot for signe, encrypted and compressed DFU updates. It is based on inital work done by Andrew Leech. The feature is enabled by setting MBOOT_ENABLE_PACKING to 1 in the board's mpconfigboard.mk file, and by providing a header file in the board folder (usually called mboot_keys.h) with a set of signing and encryption keys (which can be generated by mboot_pack_dfu.py). The signing and encryption is provided by libhydrogen. Compression is provided by uzlib. Enabling packing costs about 3k of flash. The included mboot_pack_dfu.py script converts a .dfu file to a .pack.dfu file which can be subsequently deployed to a board with mboot in packing mode. This .pack.dfu file is created as follows: - the firmware from the original .dfu is split into chunks (so the decryption can fit in RAM) - each chunk is compressed, encrypted, a header added, then signed - a special final chunk is added with a signature of the entire firmware - all chunks are concatenated to make the final .pack.dfu file The .pack.dfu file can be deployed over USB or from the internal filesystem on the device (if MBOOT_FSLOAD is enabled). See #5267 and #5309 for additional discussion. Signed-off-by: Damien George <damien@micropython.org>
83 lines
2.9 KiB
C
83 lines
2.9 KiB
C
/*
|
|
* This file is part of the MicroPython project, http://micropython.org/
|
|
*
|
|
* The MIT License (MIT)
|
|
*
|
|
* Copyright (c) 2017-2019 Damien P. George
|
|
*
|
|
* Permission is hereby granted, free of charge, to any person obtaining a copy
|
|
* of this software and associated documentation files (the "Software"), to deal
|
|
* in the Software without restriction, including without limitation the rights
|
|
* to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
|
* copies of the Software, and to permit persons to whom the Software is
|
|
* furnished to do so, subject to the following conditions:
|
|
*
|
|
* The above copyright notice and this permission notice shall be included in
|
|
* all copies or substantial portions of the Software.
|
|
*
|
|
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
|
* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
|
* FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
|
* AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
|
* LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
|
* OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
|
|
* THE SOFTWARE.
|
|
*/
|
|
#ifndef MICROPY_INCLUDED_STM32_MBOOT_PACK_H
|
|
#define MICROPY_INCLUDED_STM32_MBOOT_PACK_H
|
|
|
|
#include <stdint.h>
|
|
#include "py/mphal.h"
|
|
|
|
#if MBOOT_ENABLE_PACKING
|
|
|
|
#include "lib/libhydrogen/hydrogen.h"
|
|
|
|
// Encrypted & signed bootloader support
|
|
|
|
/******************************************************************************/
|
|
// Interface
|
|
|
|
#define MBOOT_PACK_HEADER_VERSION (1)
|
|
|
|
// Used by libhydrogen for signing and secretbox context.
|
|
#define MBOOT_PACK_HYDRO_CONTEXT "mbootenc"
|
|
|
|
// Maximum size of the firmware payload.
|
|
#define MBOOT_PACK_DFU_CHUNK_BUF_SIZE (MBOOT_PACK_CHUNKSIZE + hydro_secretbox_HEADERBYTES)
|
|
|
|
enum mboot_pack_chunk_format {
|
|
MBOOT_PACK_CHUNK_META = 0,
|
|
MBOOT_PACK_CHUNK_FULL_SIG = 1,
|
|
MBOOT_PACK_CHUNK_FW_RAW = 2,
|
|
MBOOT_PACK_CHUNK_FW_GZIP = 3,
|
|
};
|
|
|
|
// Each DFU chunk transfered has this header to validate it.
|
|
|
|
typedef struct _mboot_pack_chunk_buf_t {
|
|
struct {
|
|
uint8_t header_vers;
|
|
uint8_t format; // enum mboot_pack_chunk_format
|
|
uint8_t _pad[2];
|
|
uint32_t address;
|
|
uint32_t length; // number of bytes in following "data" payload, excluding "signature"
|
|
} header;
|
|
uint8_t data[MBOOT_PACK_DFU_CHUNK_BUF_SIZE];
|
|
uint8_t signature[hydro_sign_BYTES];
|
|
} mboot_pack_chunk_buf_t;
|
|
|
|
// Signing and encryption keys, stored in mboot flash, provided externally.
|
|
extern const uint8_t mboot_pack_sign_public_key[hydro_sign_PUBLICKEYBYTES];
|
|
extern const uint8_t mboot_pack_secretbox_key[hydro_secretbox_KEYBYTES];
|
|
|
|
/******************************************************************************/
|
|
// Implementation
|
|
|
|
void mboot_pack_init(void);
|
|
int mboot_pack_write(uint32_t addr, const uint8_t *src8, size_t len);
|
|
|
|
#endif // MBOOT_ENABLE_PACKING
|
|
|
|
#endif // MICROPY_INCLUDED_STM32_MBOOT_PACK_H
|