STM32 custom bootloader: how to verify the firmware?

Question

Using a custom SDIO/FAT in the application bootloader for a STM32 chip, is it possible to make the jump from the bootloader to the new firmware fail-safe?

I would like to verify the new firmware sanity before jumping to it and ideally do so in a sandboxed or safe environment to treat failures if need be. All examples and documentation I found verify the firmware has correctly been placed in the flash memory and then jump to it without a second thought.

Answer 1

What you're probably looking for is a checksum or a hash of the entire application image.

Say you'd be using CRC32 since the chip may already have hardware support for it.

1. After compiling the firmware, you create the checksum for it and store it in a separate file.
2. Transfer both these files onto the filesystem.
3. The bootloader then reads the firmware image, creating the checksum once again.
4. If the generated and stored checksums match, then you're good to go.

Sorry if I understood the question incorrectly.

Answer 2

If you want to go step further and check the image before each boot, you can include a header in your application image. The header contains meta-information about the application (name, version, CRC/hash) and a checksum.

So you use the following boot process:

1. Check if header is valid?
2. Check if image CRC matches the CRC stored in the header.
3. If checks passed, boot application.

I use this on a STM32 for SD card update. Works very well. The header can be built using the srecord tool and a little script around it.

To make the process failsafe, you can use a STM32 part with two separate flash banks, so you write the new firmware in the inactive flash bank, check it and make the switch over.