Hi All,
I've got a question about the documentation and operation of the SBSFU partial image generation.
The partial image feature of the image preparation tool is documented in the appendix of the getting started document here: https://www.st.com/resource/en/user_manual/um2262-getting-started-with-the-xcubesbsfu-stm32cube-expansion-package-stmicroelectronics.pdf
See here for the relevant portions of documentation:
Using the readme, which is referenced above in the documentation, it explains briefly how to use the image generation tool to create a partial image, encrypt and then sign it. Shown below are the contents of the readme relevant to partial image generation:
Example for partial update :
----------------------------
[0] Generate partial image
python prepareimage.py diff -1 UserApp_v1.bin -2 UserApp_v2.bin UserApp_partial.bin -a 16 --poffset UserApp_partial.offset
(-a 16: align partial binary on 16 bytes. Partial binary size will also be aligned on 16 bytes)
[1] Generate the keys - OPTION
python prepareimage.py keygen -k AES_CBC.bin -t aes-cbc
=> for aes_cbc , "AES_CBC" must be in file name else key is not created, this
is used to discriminate AES_GCM key versus AES_CBC key
python prepareimage.py keygen -k ECCKEY.txt -t ecdsa-p256
This step is not mandatory but if you do so, please make sure:
* to copy the content of ECCKEY.txt in SECoreBin\Binary
* to use AES_CBC.bin instead of OEM_KEY_COMPANY1_key.bin
Then the prebuild operations (SE_CoreBin) must be performed.
[2] Encrypt the complete image
python prepareimage.py enc -k AES_CBC.bin -i iv.bin UserApp_v2.bin UserApp_v2.sfu
[3] Encrypt the partial image
python prepareimage.py enc -k AES_CBC.bin -i iv.bin UserApp_partial.bin UserApp_partial.sfu
[4] Generate the clear complete FW tag (SHA256 of the clear FW)
python prepareimage.py sha256 UserApp_v2.bin UserApp_v2.sign
[5] Generate the clear partial FW tag (SHA256 of the clear FW)
python prepareimage.py sha256 UserApp_partial.bin UserApp_partial.sign
[6] Generate the .sfb FW metadata (header) and encrypted partial binary
python prepareimage.py pack -k ECCKEY.txt -r 28 -p 1 -v 2 -i iv.bin -f UserApp_v2.sfu -t UserApp_v2.sign --pfw UserApp_partial.sfu --ptag UserApp_partial.sign --poffset UserApp_partial.offset UserApp_partial.sfb
(Please note the use of -r 28 to have a FW header length of 192 bytes. This is needed to match the FLASH constraint.)
I took this snippet of code and converted it into a PowerShell script (which is what my company mainly uses for scripting). Here is the source code for the PowerShell script:
param (
[Parameter(Mandatory=$true)]
[ValidateScript({Test-Path $_ -PathType Leaf})]
[string]$UserApp_v1,
[Parameter(Mandatory=$true)]
[ValidateScript({Test-Path $_ -PathType Leaf})]
[string]$UserApp_v2,
[Parameter(Mandatory=$true)]
[string]$UserApp_partial
)
# Create the build directory, if it does not exist
if (-not (Test-Path "build")) {
New-Item -ItemType Directory -Path "build"
}
# Add build directory to the the UserApp_partial path
$UserApp_partial = "build\$UserApp_partial"
# [0] Generate partial image
python prepareimage.py diff -1 $UserApp_v1 -2 $UserApp_v2 $UserApp_partial -a 16 --poffset "build/UserApp_partial.offset"
# [1] Generate the keys - OPTION, stick everything in the build folder
python prepareimage.py keygen -k "build/AES_CBC.bin" -t aes-cbc
python prepareimage.py keygen -k "build/ECCKEY.txt" -t ecdsa-p256
# [2] Encrypt the complete image
python prepareimage.py enc -k "build/AES_CBC.bin" -i "build/iv.bin" $UserApp_v2 "build/UserApp_v2.sfu"
# [3] Encrypt the partial image
python prepareimage.py enc -k "build/AES_CBC.bin" -i "build/iv.bin" $UserApp_partial "build/UserApp_partial.sfu"
# [4] Generate the clear complete FW tag (SHA256 of the clear FW)
python prepareimage.py sha256 $UserApp_v2 "build/UserApp_v2.sign"
# [5] Generate the clear partial FW tag (SHA256 of the clear FW)
python prepareimage.py sha256 $UserApp_partial "build/UserApp_partial.sign"
# [6] Generate the .sfb FW metadata (header) and encrypted partial binary
python prepareimage.py pack -k "build/ECCKEY.txt" -r 28 -p 1 -v 2 -i "build/iv.bin" -f "build/UserApp_v2.sfu" -t "build/UserApp_v2.sign" --pfw "build/UserApp_partial.sfu" --ptag "build/UserApp_partial.sign" --poffset "build/UserApp_partial.offset" "build/UserApp_partial.sfb"
Now, it's my understanding that if this is done correctly, the output of my script will be an encrypted, signed, binary patch file which if applied to the base firmware image will result in the target firmware image being deployed on the device. A patch file, based on the binary difference between the base firmware image and target firmware image should be smaller than the target firmware image (correct?). However, when I perform these operations on my base firmware image (312 KB) and my target firmware image (360 KB), I get an output binary which is (360 KB), and a .sfb output file of (360 KB) in size as well. It seems to me like we are not taking a patch / diff properly but just applying the target firmware image as is. Can someone help explain the partial image feature to me in a more comprehensive manner? Is my interpretation of the matter correct?
