dmitrystu / Sboot_stm32

Secure USB DFU1.1 bootloader for STM32

Features

• Small size. Fits in 4K ROM segment (ASM or no encription, otherwise a bit more).
• USB DFU1.1 compatible
• supports by dfu-util
• Supports one of the following ciphers
  • No encryption
  • ARCFOUR stream cipher
  • CHACHA20 stream cipher
  • RC5-32/12/16 block cipher (C and ASM implementation)
  • RC6-32/20/16 block cipher (C and ASM implementation)
  • GOST R 34.12-2015 "MAGMA" block cipher
  • RAIDEN block cipher
  • SPECK 64/128 block cipher
  • XTEA (classic and XTEA-1) block cipher
  • RTEA block cipher
  • BLOWFISH type block cipher
  • Rijndael AES-128/192/256 block cipher
• Cipher modes for block ciphers
  • Electronic Codebook (ECB)
  • Cipher Block Chaining (CBC)
  • Propagating CBC (PCBC)
  • Cipher Feedback (CFB)
  • Output Feedback (OFB)
  • Counter (CTR)
• Frmware verification signature
  • CRC (CRC32, CRC64)
  • Fowler-Noll-Vo (FNV-1A-32, FNV1A-64)
• Different interfaces for flash and eeprom programming
• Autoseal using RDP level 1 or 2 (prevents reading decrypted FW trough debug interface). Be careful when you set RDP to level 2. This operation is irreversible and disables all debug functions and option bytes programming.
• Software for firmaware encryption/decription included
• Supported STM32 family
  • STM32L0x2
  • STM32L1xx
  • STM32L476xx (OTG FS in device mode)
  • STM32F103
  • STM32F105, STM32F107 (OTG FS in device mode)
  • STM32F0 series
  • STM32F3 series
  • STM32F4 series
  • STM32G4 series

Generic flow

Usage:

Configure bootloader

Bootloader can be configured trough the make parameters. See CONFIG.md for details.

Building bootloader

1. Prerequisites

• GNU make
• arm-none-eabi-gcc toolchaipren v4.9 or later to build bootloader
• gcc toolchain to build fwcrypt software
• CMSIS V4 or CMSIS V5.
• Device peripheral access layer header files for STM32. See Vendor Template for details.
• stm32.h STM32 universal header
• optional st-util tool to program bootloader

2. Makefile targets

• make prerequisites to download required libs and headers
• make mcu_target to build bootloader
• make program to flash bootloader using st-flash
• make crypter to build encryption software

3. Makefile and environmental variables

4. MCU targets

Adjusting user firmware

• check bootloader's linker map for the __app_start address. This is the new ROM origin for the user firmware (isr vectors).
• Adjust your linker script to set new ROM origin and ROM length

Utilizing usbd core and usbd driver from bootloader in the user firmware

• check bootloader's linker map for the usbd_poll entry point and usbd driver (usbd_devfs, usbd_otgfs, e.t.c. depends used MCU). It's located just after .isr_vector section
• add address for usbd_driver structure to your linker script. For example usbd_drv = 0x08000040;
• add address for usbd_poll entry point to your linker script. For example usbd_poll = 0x08000074;
• add extern struct usbd_driver usbd_drv; driver declaration to your code
• include at least "usbd_core.h" and "usb_std.h" to your code

Now you can use usbd core and driver from bootloader in your application. Don't forget to set GPIO and RCC for USB according to MCU requirements.

Activating bootloader

• put DFU_BOOTKEY on DFU_BOOTKEY_ADDR (RAM top by default) and make a software reset
• by DFU_BOOTSTRAP_PIN on DFU_BOOTSTRAP_PORT on startup (optional)
• make a double reset in DFU_DBLRESET_MS period (optional)

Encryption/Decryption user firmware

At this moment only binary files supported

To encrypt:

fwcrypt -e -i infile.bin -o outfile.bin

To decrypt:

fwcrypt -d -i infile.bin -o outfile.bin