- Integrates wolfPSA as psa_crypto/psa_store engine in TrustZone
- Provides interface to access APIs from non-secure mode
- Patches to enable wolfboot as TEE module in zephyr
- Patches to enable stm32h563-nucleo/ns as target in zephyr
- psa_crypto zephyr example using wolfboot/wolfPSA as secure engine
- New config flags for flash geometry
- New script to automatically set option bytes
- End of stack address fix for the STM32U5 test app
- STM32U5 support for NUCLEO-U575ZI-Q (previously only supported
discovery board)
Cleanup STM32H5 HAL port.
Refactor `__ARM_FEATURE_CMSE` to `TZ_SECURE()`
Refactor attribute cmse_nonsecure_entry to use new macro `CSME_NSE_API`
Added TPM Non Secure Callable API's
Added TPM support to STM32H5 test application
- Add filesystem access implementation in HAL (`hal/filesystem.c`)
- Introduce new library_fs target and build rules for filesystem-backed partition management
- Provide example configuration for library_fs
- Add CLI application (`hal/library_fs.c`) to query and manage partitions
- Update documentation with usage instructions and build steps for the new CLI tool
- Update .gitignore
- Make the update and swap partitions secure and inaccessible from the
app except via NSC API
- Add a couple of necessary new NSC functions
- Update the app to only use NSC API
- Fix hal_flash_erase to account for secure addresses
- Fix some bugs in xmodem implementation
During fallback operations, use a different encryption IV than the one
used to encrypt the backup during the update. This ensures that the same
IV is never reused to encrypt different sectors.
As reported by @reza-hdd in #589:
> When Firmware is large enough to consume all the allocated boot partition sectors, in the the final swap and erase operations (_wolfBoot_swap_and_final_erase_) the last sector of FW in Boot partition, which is used as a temporary sector for a copy operation, gets corrupted after being copied in external Swap partition and copied back. It looks like the contents are copied to the external Swap partition without being encrypted, but get decrypted when it is read back.
This was due to the function wolfBoot_copy_sector() assuming that all
copies having an external SWAP as destination would not need any
encryption, as the "normal" case during update is to copy already
encrypted sectors from UPDATE->SWAP.
In the final state, after the update is successfully applied, the
mechanism saves a copy of the last sector from BOOT->SWAP. In this case,
if the application is big enough, an extra function is needed to
encrypt the content of this last sector before writing it to SWAP.
Restoring the backup is OK (normal case SWAP->BOOT, decryption was
already there as also noted by the reporter).
Daniele Lacamera
David Garske
Mattia Moffa
gojimmypi
Brett Nicholas
Juliusz Sosinowicz