- Make the update and swap partitions secure and inaccessible from the
app except via NSC API
- Add a couple of necessary new NSC functions
- Update the app to only use NSC API
- Fix hal_flash_erase to account for secure addresses
- Fix some bugs in xmodem implementation
During fallback operations, use a different encryption IV than the one
used to encrypt the backup during the update. This ensures that the same
IV is never reused to encrypt different sectors.
As reported by @reza-hdd in #589:
> When Firmware is large enough to consume all the allocated boot partition sectors, in the the final swap and erase operations (_wolfBoot_swap_and_final_erase_) the last sector of FW in Boot partition, which is used as a temporary sector for a copy operation, gets corrupted after being copied in external Swap partition and copied back. It looks like the contents are copied to the external Swap partition without being encrypted, but get decrypted when it is read back.
This was due to the function wolfBoot_copy_sector() assuming that all
copies having an external SWAP as destination would not need any
encryption, as the "normal" case during update is to copy already
encrypted sectors from UPDATE->SWAP.
In the final state, after the update is successfully applied, the
mechanism saves a copy of the last sector from BOOT->SWAP. In this case,
if the application is big enough, an extra function is needed to
encrypt the content of this last sector before writing it to SWAP.
Restoring the backup is OK (normal case SWAP->BOOT, decryption was
already there as also noted by the reporter).
- Support ELF scatter-loading on TC3xx
- Modify TC3xx HAL flash erase to support arbitrary offsets and sizes
- Realign partition size and addresses to support more efficient sector mass erase on update
- Added missing `test-app/app_sim_scattered.c`
- Added missing `test-app/sim_scattered.ld`
- Fixed comments at the end of define blocks for consistency
- Removed unused constants as indicated
Only allow delta update if the sha digest of the base image matches the
expected value. This is to prevent the delta update from being applied
to an image that is not the expected base image, even if the version
matches.
The mismatch should never happen in real-life scenarios, but it is to check
for false positives during integration, testing and development.
* Initial draft with two test cases
* Added more unit tests. Found OOB access.
* Fix potential OOB access with too-large update img
* NO_FORK disabled by default
* Cover more corner cases
leave the encryption key for wolfBoot_success to erase.
FINAL_SWAP was also stopping the case where the partition was put into testing before the update sector status flags could be erased. now, don't erase the update sector flags. instead put the update partition in IMG_STATE_FINAL_FLAGS state before putting the boot partition in IMG_STATE_TESTING. Then only erase the update sector flags on wolfBoot_update_trigger. under this scheme, the sector flags are intact if the power failed before we could set IMG_STATE_TESTING but are wiped if we do need to swap over after after wolfBoot_success fails to be called
Mattia Moffa
Daniele Lacamera
gojimmypi
David Garske
Brett Nicholas
Daniele Lacamera
jordan
Daniele Lacamera
John Bland