@onekeyfe/hd-core 1.2.0-alpha.97 → 1.2.0-alpha.99

package/src/api/UploadPortfolio.ts

@@ -1,3 +1,6 @@
+import { createDeviceNotSupportMethodError } from '@onekeyfe/hd-shared';
+
+import { supportsProtocolV2Message } from '../protocols/protocol-v2/features';
 import FileWrite from './FileWrite';
 
 export type UploadPortfolioParams = {
@@ -7,6 +10,8 @@ export type UploadPortfolioParams = {
 
 const PORTFOLIO_PENDING_PATH = 'vol1:/portfolio/portfolio.okpkg.pending';
 const PORTFOLIO_CHUNK_SIZE = 2048;
+const FILESYSTEM_FILE_WRITE_MESSAGE_TYPE = 60805;
+const PORTFOLIO_UPDATE_MESSAGE_TYPE = 61400;
 
 export default class UploadPortfolio extends FileWrite {
   init() {
@@ -29,6 +34,19 @@ export default class UploadPortfolio extends FileWrite {
   }
 
   async run() {
+    const protocolInfo = await this.device.ensureProtocolV2RuntimeContext();
+    const hasFileWrite = supportsProtocolV2Message(
+      protocolInfo,
+      FILESYSTEM_FILE_WRITE_MESSAGE_TYPE
+    );
+    const hasPortfolioUpdate = supportsProtocolV2Message(
+      protocolInfo,
+      PORTFOLIO_UPDATE_MESSAGE_TYPE
+    );
+    if (!hasFileWrite || !hasPortfolioUpdate) {
+      throw createDeviceNotSupportMethodError(this.name, this.device.getCurrentFirmwareType());
+    }
+
     const stagedFile = await super.run();
     this.throwIfAborted();
     await this.device.commands.typedCall('PortfolioUpdate', 'Success', {});

package/src/api/device/DeviceUpdateBootloader.ts

@@ -14,6 +14,8 @@ import { resolveFirmwareUpdateHostBinding } from '../firmware/FirmwareHostBindin
 import {
   assertFirmwareUpdatePreparedPlanBinding,
   assertFirmwareUpdatePreparedPlanDeviceIdentity,
+  getFirmwareUpdatePreparedRawArtifact,
+  validateFirmwareUpdatePreparedPlan,
 } from '../firmware/FirmwareUpdatePreparedPlan';
 import { getDeviceType, getDeviceUUID } from '../../utils';
 import { resolveDeviceBootloaderMode } from '../../utils/deviceFeaturesCompat';
@@ -157,33 +159,59 @@ export default class DeviceUpdateBootloader extends FirmwareUpdateBaseMethod<any
     const { features } = device;
 
     const payload = this.payload as DeviceUpdateBootloaderParams;
-    const hostBinding = payload.artifact
-      ? resolveFirmwareUpdateHostBinding(payload.hostBindingGeneration)
+    const hasPreparedPlan = payload.preparedPlan !== undefined;
+    if (hasPreparedPlan && payload.binary !== undefined) {
+      throw ERRORS.TypedError(
+        HardwareErrorCode.CallMethodInvalidParameter,
+        'Prepared bootloader plans cannot be combined with a legacy binary'
+      );
+    }
+    if (!hasPreparedPlan && payload.artifact !== undefined) {
+      throw ERRORS.TypedError(
+        HardwareErrorCode.CallMethodInvalidParameter,
+        'Bootloader artifacts require a prepared plan'
+      );
+    }
+    const preparedPlan = hasPreparedPlan
+      ? validateFirmwareUpdatePreparedPlan(payload.preparedPlan)
+      : undefined;
+    const plannedArtifact = preparedPlan
+      ? getFirmwareUpdatePreparedRawArtifact({
+          preparedPlan,
+          target: 'bootloader',
+          role: 'bootloader',
+        }).artifact
       : undefined;
+    const artifactReader = preparedPlan
+      ? resolveFirmwareUpdateHostBinding(
+          payload.hostBindingGeneration,
+          preparedPlan.preparedPlanDigest
+        ).artifactReader
+      : payload.artifactReader;
     const executionParams = {
       ...payload,
-      artifactReader: hostBinding?.artifactReader ?? payload.artifactReader,
+      artifactReader,
     };
-    if (payload.artifact) {
+    if (preparedPlan && plannedArtifact) {
       assertFirmwareUpdatePreparedPlanDeviceIdentity({
-        preparedPlan: payload.preparedPlan,
+        preparedPlan,
         deviceIdentity: getDeviceUUID(features) || undefined,
         bootloaderMode: resolveDeviceBootloaderMode(features),
         deviceModel: String(getDeviceType(features)),
       });
       assertFirmwareUpdatePreparedPlanBinding({
-        preparedPlan: payload.preparedPlan,
+        preparedPlan,
         executor: 'v2',
         scopeTargets: ['bootloader'],
         bindings: [
           {
             target: 'bootloader',
-            artifact: payload.artifact,
+            artifact: payload.artifact ?? plannedArtifact,
           },
         ],
       });
       const source = await openFirmwareByteSource({
-        artifact: payload.artifact,
+        artifact: plannedArtifact,
         reader: executionParams.artifactReader,
       });
       if (!source) {
@@ -194,13 +222,11 @@ export default class DeviceUpdateBootloader extends FirmwareUpdateBaseMethod<any
       }
       try {
         const deviceType = device.getCurrentDeviceType();
-        const deviceFirmwareType = device.getCurrentFirmwareType();
-        const firmwareType = payload.firmwareType ?? deviceFirmwareType;
         if (DeviceModelToTypes.model_touch.includes(deviceType)) {
           return await this.updateTouchBootloader({
             device,
             features,
-            firmwareType,
+            firmwareType: preparedPlan.firmwareType,
             source,
           });
         }

package/src/api/firmware/FirmwareHostBinding.ts

@@ -1,5 +1,7 @@
 import { ERRORS, HardwareErrorCode } from '@onekeyfe/hd-shared';
 
+import { clearFirmwareUpdatePreparedPlanDeviceIdentityPin } from './FirmwareUpdatePreparedPlan';
+
 import type { FirmwareUpdateHostBinding } from '../../types/api/firmwareUpdate';
 
 const bindingError = (message: string): never => {
@@ -16,14 +18,20 @@ class FirmwareHostBindingRegistry {
   register(binding: FirmwareUpdateHostBinding): number {
     if (
       !binding ||
+      typeof binding.preparedPlanDigest !== 'string' ||
+      !/^[0-9a-f]{64}$/i.test(binding.preparedPlanDigest) ||
       typeof binding.artifactReader?.open !== 'function' ||
       typeof binding.artifactReader.read !== 'function' ||
       typeof binding.artifactReader.close !== 'function'
     ) {
       return bindingError('Firmware host binding is invalid');
     }
+    const replacedPreparedPlanDigest = this.binding?.preparedPlanDigest;
     this.generation += 1;
     this.binding = binding;
+    if (replacedPreparedPlanDigest) {
+      clearFirmwareUpdatePreparedPlanDeviceIdentityPin(replacedPreparedPlanDigest);
+    }
     return this.generation;
   }
 
@@ -31,8 +39,12 @@ class FirmwareHostBindingRegistry {
     if (generation !== undefined && generation !== this.generation) {
       return false;
     }
+    const releasedPreparedPlanDigest = this.binding?.preparedPlanDigest;
     this.generation += 1;
     this.binding = undefined;
+    if (releasedPreparedPlanDigest) {
+      clearFirmwareUpdatePreparedPlanDeviceIdentityPin(releasedPreparedPlanDigest);
+    }
     return true;
   }
 
@@ -40,7 +52,7 @@ class FirmwareHostBindingRegistry {
     return this.generation;
   }
 
-  resolve(generation: number): FirmwareUpdateHostBinding {
+  resolve(generation: number, preparedPlanDigest?: string): FirmwareUpdateHostBinding {
     if (
       !Number.isSafeInteger(generation) ||
       generation <= 0 ||
@@ -50,12 +62,21 @@ class FirmwareHostBindingRegistry {
       return bindingError(`Firmware host binding generation ${generation} is stale`);
     }
     const { binding } = this;
+    if (
+      preparedPlanDigest !== undefined &&
+      binding.preparedPlanDigest.toLowerCase() !== preparedPlanDigest.toLowerCase()
+    ) {
+      return bindingError(
+        `Firmware host binding generation ${generation} does not match the prepared plan`
+      );
+    }
     const assertCurrent = () => {
       if (generation !== this.generation || binding !== this.binding) {
         bindingError(`Firmware host binding generation ${generation} is stale`);
       }
     };
     return {
+      preparedPlanDigest: binding.preparedPlanDigest,
       artifactReader: {
         open: async input => {
           assertCurrent();
@@ -96,5 +117,7 @@ export const getFirmwareUpdateHostBindingGeneration = (): number =>
   firmwareHostBindingRegistry.getGeneration();
 
 export const resolveFirmwareUpdateHostBinding = (
-  generation: number | undefined
-): FirmwareUpdateHostBinding => firmwareHostBindingRegistry.resolve(generation ?? Number.NaN);
+  generation: number | undefined,
+  preparedPlanDigest?: string
+): FirmwareUpdateHostBinding =>
+  firmwareHostBindingRegistry.resolve(generation ?? Number.NaN, preparedPlanDigest);

package/src/api/firmware/FirmwareMemoryHost.ts

@@ -0,0 +1,143 @@
+import { sha256 } from '@noble/hashes/sha256';
+import { bytesToHex } from '@noble/hashes/utils';
+import { ERRORS, HardwareErrorCode } from '@onekeyfe/hd-shared';
+
+import type { CoreApi } from '../../types/api';
+import type {
+  FirmwareArtifactReader,
+  FirmwareArtifactReference,
+} from '../../types/api/firmwareUpdate';
+import type { FirmwareUpdatePlan } from '../../types/api/firmwareUpdatePlan';
+
+export type FirmwareMemoryArtifactEntry = {
+  entryName: string;
+  binary: ArrayBuffer;
+};
+
+export type FirmwareMemoryArtifact = {
+  artifactId: string;
+  binary: ArrayBuffer;
+  materializedEntries?: FirmwareMemoryArtifactEntry[];
+};
+
+export type FirmwareUpdateV4MemoryHost = {
+  preparedPlan: ReturnType<CoreApi['prepareFirmwareUpdatePlan']>;
+  hostBindingGeneration: number;
+  release: () => void;
+};
+
+let memoryHostSequence = 0;
+
+const createReference = (binary: ArrayBuffer, prefix: string): FirmwareArtifactReference => {
+  const digest = bytesToHex(sha256(new Uint8Array(binary)));
+  return {
+    artifactRef: `fwmem:${prefix}:${digest.slice(0, 32)}`,
+    size: binary.byteLength,
+    sha256: digest,
+  };
+};
+
+export function prepareFirmwareUpdateV4MemoryHost({
+  sdk,
+  plan,
+  artifacts,
+}: {
+  sdk: Pick<
+    CoreApi,
+    | 'prepareFirmwareUpdatePlan'
+    | 'registerFirmwareUpdateHostBinding'
+    | 'unregisterFirmwareUpdateHostBinding'
+  >;
+  plan: FirmwareUpdatePlan;
+  artifacts: FirmwareMemoryArtifact[];
+}): FirmwareUpdateV4MemoryHost {
+  if (plan.executor !== 'v4') {
+    throw ERRORS.TypedError(
+      HardwareErrorCode.RuntimeError,
+      'Firmware memory host only supports V4 plans'
+    );
+  }
+  memoryHostSequence += 1;
+  const hostId = `${Date.now()}:${memoryHostSequence}`;
+  const binaries = new Map<string, Uint8Array>();
+  const inputs = artifacts.map((input, artifactIndex) => {
+    const artifactBinary = new Uint8Array(input.binary).slice();
+    const artifact = createReference(
+      artifactBinary.buffer as ArrayBuffer,
+      `${hostId}:artifact:${artifactIndex}`
+    );
+    binaries.set(artifact.artifactRef, artifactBinary);
+    const materializedEntries = input.materializedEntries?.map((entry, entryIndex) => {
+      const entryArtifact = createReference(
+        entry.binary,
+        `${hostId}:entry:${artifactIndex}:${entryIndex}`
+      );
+      // Entry references are compact receipts for bytes that will be re-derived
+      // from the verified archive. Retaining another readable copy here doubles
+      // resource memory without adding an execution trust boundary.
+      return {
+        entryName: entry.entryName,
+        artifact: entryArtifact,
+      };
+    });
+    return {
+      artifactId: input.artifactId,
+      artifact,
+      ...(materializedEntries?.length ? { materializedEntries } : {}),
+    };
+  });
+  const preparedPlan = sdk.prepareFirmwareUpdatePlan({
+    plan,
+    leaseRef: `fwmemlease:${hostId}`,
+    artifacts: inputs,
+  });
+  const readers = new Map<string, Uint8Array>();
+  let readerSequence = 0;
+  const artifactReader: FirmwareArtifactReader = {
+    open({ artifactRef }) {
+      const binary = binaries.get(artifactRef);
+      if (!binary) {
+        throw ERRORS.TypedError(
+          HardwareErrorCode.RuntimeError,
+          'Firmware memory artifact is unavailable'
+        );
+      }
+      readerSequence += 1;
+      const readerId = `fwmemreader:${hostId}:${readerSequence}`;
+      readers.set(readerId, binary);
+      return Promise.resolve({ readerId, size: binary.byteLength });
+    },
+    read({ readerId, offset, length }) {
+      const binary = readers.get(readerId);
+      if (!binary || offset < 0 || length <= 0 || offset + length > binary.byteLength) {
+        throw ERRORS.TypedError(
+          HardwareErrorCode.RuntimeError,
+          'Firmware memory artifact read is invalid'
+        );
+      }
+      const data = binary.slice(offset, offset + length).buffer;
+      return Promise.resolve({
+        data,
+        bytesRead: data.byteLength,
+        eof: offset + length === binary.byteLength,
+      });
+    },
+    close({ readerId }) {
+      readers.delete(readerId);
+      return Promise.resolve();
+    },
+  };
+  const hostBindingGeneration = sdk.registerFirmwareUpdateHostBinding({
+    artifactReader,
+    preparedPlanDigest: preparedPlan.preparedPlanDigest,
+  });
+  return {
+    preparedPlan,
+    hostBindingGeneration,
+    release: () => {
+      sdk.unregisterFirmwareUpdateHostBinding(hostBindingGeneration);
+      readers.clear();
+      binaries.clear();
+    },
+  };
+}

package/src/api/firmware/FirmwarePreparedResourceArchive.ts

@@ -0,0 +1,207 @@
+import { sha256 } from '@noble/hashes/sha256';
+import { bytesToHex } from '@noble/hashes/utils';
+import { ERRORS, HardwareErrorCode } from '@onekeyfe/hd-shared';
+import JSZip from 'jszip';
+
+import { openFirmwareByteSource, readFirmwareByteSourceFully } from './FirmwareArtifactSource';
+import { getFirmwareUpdateResourceName } from './FirmwareUpdatePreparedPlan';
+
+import type { FirmwareArtifactReader } from '../../types/api/firmwareUpdate';
+import type { FirmwareUpdatePreparedPlan } from '../../types/api/firmwareUpdatePreparedPlan';
+
+const PREPARED_RESOURCE_ARCHIVE_MAX_BYTES = 256 * 1024 * 1024;
+const PREPARED_RESOURCE_ENTRY_MAX_COUNT = 512;
+
+type JSZipSizedEntry = JSZip.JSZipObject & {
+  _data?: {
+    compressedSize?: unknown;
+    uncompressedSize?: unknown;
+  };
+};
+
+export type VerifiedPreparedResourceEntry = {
+  entryName: string;
+  binary: ArrayBuffer;
+};
+
+const resourceArchiveError = (
+  message: string,
+  firmwareUpdateCode: 'FirmwareArtifactsNotPrepared' | 'FirmwareArtifactReceiptMismatch'
+): never => {
+  throw ERRORS.TypedError(HardwareErrorCode.RuntimeError, message, { firmwareUpdateCode });
+};
+
+const getZipEntrySizes = (entry: JSZip.JSZipObject) => {
+  const { compressedSize, uncompressedSize } = (entry as JSZipSizedEntry)._data ?? {};
+  if (
+    !Number.isSafeInteger(compressedSize) ||
+    Number(compressedSize) < 0 ||
+    !Number.isSafeInteger(uncompressedSize) ||
+    Number(uncompressedSize) <= 0
+  ) {
+    return resourceArchiveError(
+      `Firmware prepared resource ZIP entry size is invalid: ${entry.name}`,
+      'FirmwareArtifactsNotPrepared'
+    );
+  }
+  return {
+    compressedSize: Number(compressedSize),
+    uncompressedSize: Number(uncompressedSize),
+  };
+};
+
+/**
+ * 从 PreparedPlan 批准的 ZIP 本体生成资源条目。
+ * 宿主提供的 materializedEntries 仅作为 receipt，设备写入始终使用 ZIP 内的规范字节。
+ */
+export const readVerifiedPreparedResourceArchive = async ({
+  preparedPlan,
+  reader,
+}: {
+  preparedPlan: FirmwareUpdatePreparedPlan;
+  reader: FirmwareArtifactReader | undefined;
+}): Promise<VerifiedPreparedResourceEntry[]> => {
+  const resourceArtifacts = preparedPlan.artifacts.filter(
+    artifact => artifact.target === 'resource'
+  );
+  if (!preparedPlan.targetsToUpdate.includes('resource')) {
+    if (resourceArtifacts.length > 0) {
+      return resourceArchiveError(
+        'Firmware prepared resource artifact is outside the approved targets',
+        'FirmwareArtifactsNotPrepared'
+      );
+    }
+    return [];
+  }
+  if (resourceArtifacts.length !== 1) {
+    return resourceArchiveError(
+      'Firmware prepared plan must contain exactly one materialized resource ZIP',
+      'FirmwareArtifactsNotPrepared'
+    );
+  }
+
+  const archiveArtifact = resourceArtifacts[0];
+  const preparedEntries = archiveArtifact.materializedEntries;
+  if (
+    archiveArtifact.role !== 'resource' ||
+    archiveArtifact.container !== 'zip' ||
+    !preparedEntries?.length
+  ) {
+    return resourceArchiveError(
+      'Firmware prepared plan must contain exactly one materialized resource ZIP',
+      'FirmwareArtifactsNotPrepared'
+    );
+  }
+  const archiveSource = await openFirmwareByteSource({
+    artifact: archiveArtifact.artifact,
+    reader,
+  });
+  if (!archiveSource) {
+    return resourceArchiveError(
+      'Firmware prepared resource ZIP is unavailable',
+      'FirmwareArtifactsNotPrepared'
+    );
+  }
+  if (archiveSource.size > PREPARED_RESOURCE_ARCHIVE_MAX_BYTES) {
+    await archiveSource.close().catch(() => undefined);
+    return resourceArchiveError(
+      'Firmware prepared resource ZIP exceeds the archive size limit',
+      'FirmwareArtifactsNotPrepared'
+    );
+  }
+
+  let archiveBinary: ArrayBuffer;
+  try {
+    archiveBinary = await readFirmwareByteSourceFully(archiveSource);
+  } finally {
+    await archiveSource.close().catch(() => undefined);
+  }
+  const archiveDigest = bytesToHex(sha256(new Uint8Array(archiveBinary)));
+  if (archiveDigest !== archiveArtifact.artifact.sha256.toLowerCase()) {
+    return resourceArchiveError(
+      'Firmware prepared resource ZIP does not match its approved receipt',
+      'FirmwareArtifactReceiptMismatch'
+    );
+  }
+
+  let zip: JSZip;
+  try {
+    zip = await JSZip.loadAsync(archiveBinary);
+  } catch {
+    return resourceArchiveError(
+      'Firmware prepared resource ZIP cannot be parsed',
+      'FirmwareArtifactsNotPrepared'
+    );
+  }
+  const zipEntries = Object.values(zip.files);
+  if (
+    zipEntries.some(entry => entry.unsafeOriginalName && entry.unsafeOriginalName !== entry.name)
+  ) {
+    return resourceArchiveError(
+      'Firmware prepared resource ZIP contains an unsafe entry path',
+      'FirmwareArtifactsNotPrepared'
+    );
+  }
+  const files = zipEntries.filter(entry => !entry.dir);
+  if (files.length === 0 || files.length > PREPARED_RESOURCE_ENTRY_MAX_COUNT) {
+    return resourceArchiveError(
+      'Firmware prepared resource ZIP entry set is invalid',
+      'FirmwareArtifactsNotPrepared'
+    );
+  }
+
+  let totalSize = 0;
+  const canonicalNames = new Set<string>();
+  for (const entry of files) {
+    const { compressedSize, uncompressedSize } = getZipEntrySizes(entry);
+    const resourceName = getFirmwareUpdateResourceName(entry.name);
+    const canonicalName = resourceName.toLowerCase();
+    totalSize += uncompressedSize;
+    if (
+      compressedSize > archiveBinary.byteLength ||
+      uncompressedSize > PREPARED_RESOURCE_ARCHIVE_MAX_BYTES ||
+      totalSize > PREPARED_RESOURCE_ARCHIVE_MAX_BYTES ||
+      canonicalNames.has(canonicalName)
+    ) {
+      return resourceArchiveError(
+        `Firmware prepared resource ZIP entry bounds are invalid: ${entry.name}`,
+        'FirmwareArtifactsNotPrepared'
+      );
+    }
+    canonicalNames.add(canonicalName);
+  }
+
+  const preparedEntriesByName = new Map(
+    preparedEntries.map(entry => [entry.entryName, entry] as const)
+  );
+  if (preparedEntriesByName.size !== files.length || preparedEntries.length !== files.length) {
+    return resourceArchiveError(
+      'Firmware prepared resource entries do not match the approved ZIP',
+      'FirmwareArtifactReceiptMismatch'
+    );
+  }
+
+  const verifiedEntries: VerifiedPreparedResourceEntry[] = [];
+  for (const entry of files) {
+    const { uncompressedSize } = getZipEntrySizes(entry);
+    const binary = await entry.async('arraybuffer');
+    const preparedEntry = preparedEntriesByName.get(entry.name);
+    const digest = bytesToHex(sha256(new Uint8Array(binary)));
+    if (
+      binary.byteLength !== uncompressedSize ||
+      !preparedEntry ||
+      preparedEntry.artifact.size !== binary.byteLength ||
+      preparedEntry.artifact.sha256.toLowerCase() !== digest
+    ) {
+      return resourceArchiveError(
+        `Firmware prepared resource entry does not match the approved ZIP: ${entry.name}`,
+        'FirmwareArtifactReceiptMismatch'
+      );
+    }
+    verifiedEntries.push({
+      entryName: getFirmwareUpdateResourceName(entry.name),
+      binary,
+    });
+  }
+  return verifiedEntries;
+};