Merge pull request #940 from danielinux/fix-erase-lastsector

Disallow single-sector partitions in flash + CUSTOM_TRAILER support for STM32F4

Author: dgarske

.github/workflows/test-build-cmake.yml

@@ -37,14 +37,14 @@ jobs:
       - name: Run CMake build for STM32F407-DISCOVERY
         run: |
           rm -rf ./build
-          cmake -B build -DWOLFBOOT_TARGET=stm32f4 -DWOLFBOOT_PARTITION_SIZE=0x20000 -DWOLFBOOT_SECTOR_SIZE=0x20000 -DWOLFBOOT_PARTITION_BOOT_ADDRESS=0x08020000 -DWOLFBOOT_PARTITION_UPDATE_ADDRESS=0x08040000 -DWOLFBOOT_PARTITION_SWAP_ADDRESS=0x08060000 -DCLOCK_SPEED=160000000 -DSTM32_PLLM=8 -DSTM32_PLLN=336 -DSTM32_PLLP=2 -DSTM32_PLLQ=7
+          cmake -B build -DWOLFBOOT_TARGET=stm32f4 -DWOLFBOOT_PARTITION_SIZE=0x60000 -DWOLFBOOT_SECTOR_SIZE=0x20000 -DWOLFBOOT_PARTITION_BOOT_ADDRESS=0x08020000 -DWOLFBOOT_PARTITION_UPDATE_ADDRESS=0x08080000 -DWOLFBOOT_PARTITION_SWAP_ADDRESS=0x080E0000 -DCLOCK_SPEED=160000000 -DSTM32_PLLM=8 -DSTM32_PLLN=336 -DSTM32_PLLP=2 -DSTM32_PLLQ=7
       - name: Build wolfBoot
         run: make -C build
 
       - name: Run CMake build for STM32F411-BLACKPILL
         run: |
           rm -rf ./build
-          cmake -B build -DWOLFBOOT_TARGET=stm32f4 -DWOLFBOOT_PARTITION_SIZE=0x20000 -DWOLFBOOT_SECTOR_SIZE=0x20000 -DWOLFBOOT_PARTITION_BOOT_ADDRESS=0x08020000 -DWOLFBOOT_PARTITION_UPDATE_ADDRESS=0x08040000 -DWOLFBOOT_PARTITION_SWAP_ADDRESS=0x08060000 -DCLOCK_SPEED=84000000 -DSTM32_PLLM=25 -DSTM32_PLLN=336 -DSTM32_PLLP=4 -DSTM32_PLLQ=7
+          cmake -B build -DWOLFBOOT_TARGET=stm32f4 -DCUSTOM_PARTITION_TRAILER=yes -DWOLFBOOT_PARTITION_SIZE=0x20000 -DWOLFBOOT_SECTOR_SIZE=0x20000 -DWOLFBOOT_PARTITION_BOOT_ADDRESS=0x08020000 -DWOLFBOOT_PARTITION_UPDATE_ADDRESS=0x08040000 -DWOLFBOOT_PARTITION_SWAP_ADDRESS=0x08060000 -DCLOCK_SPEED=84000000 -DSTM32_PLLM=25 -DSTM32_PLLN=336 -DSTM32_PLLP=4 -DSTM32_PLLQ=7
       - name: Build wolfBoot
         run: make -C build
 

.github/workflows/test-renode-blackpill-custom-trailer.yml

@@ -0,0 +1,42 @@
+name: Renode STM32F411 Black Pill custom partition trailer
+
+on:
+  push:
+    branches: [ 'master', 'main', 'release/**' ]
+  pull_request:
+    branches: [ '*' ]
+
+permissions:
+  contents: read
+  packages: read
+
+jobs:
+  blackpill-custom-trailer:
+    runs-on: ubuntu-22.04
+    timeout-minutes: 25
+
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          submodules: true
+
+      - name: Log in to GHCR
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Renode update and rollback, single-sector partitions
+        run: |
+          docker run --rm -e WORK=/workspace/test_results \
+            -v ${{ github.workspace }}:/workspace -w /workspace \
+            ghcr.io/wolfssl/wolfboot-ci-renode:v1.5 \
+            tools/scripts/renode-test-custom-trailer.sh
+
+      - name: Upload Output Dir
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: Renode Black Pill custom trailer results
+          path: test_results/

CMakeLists.txt

@@ -464,6 +464,9 @@ add_option("NO_XIP" "Disable execute-in-place (default: disabled)" "no" "yes;no"
 add_option(
     "NVM_FLASH_WRITEONCE"
     "Enable the workaround for 'write once' internal flash (default: disabled)" "no" "yes;no")
+add_option(
+    "CUSTOM_PARTITION_TRAILER"
+    "Keep the partition trailers outside the partitions (default: disabled)" "no" "yes;no")
 add_option(
     "RAM_CODE"
     "Move all code accessing internal flash for writing into a section in RAM (default: disabled)"
@@ -1088,6 +1091,10 @@ if(NVM_FLASH_WRITEONCE)
     list(APPEND WOLFBOOT_DEFS NVM_FLASH_WRITEONCE)
 endif()
 
+if(CUSTOM_PARTITION_TRAILER)
+    list(APPEND WOLFBOOT_DEFS CUSTOM_PARTITION_TRAILER)
+endif()
+
 if(DISABLE_BACKUP)
     message(WARNING "DISABLE_BACKUP=1 disables power-fail-safe updates; losing power during an update can leave BOOT partially written and unrecoverable")
     list(APPEND WOLFBOOT_DEFS DISABLE_BACKUP)
@@ -1434,6 +1441,10 @@ list(APPEND WOLFBOOT_INCLUDE_DIRS ${WOLFBOOT_ROOT} ${WOLFBOOT_ROOT}/include)
 
 # set default linker script
 set(WOLFBOOT_LSCRIPT_TEMPLATE hal/${WOLFBOOT_TARGET}.ld)
+# Partition trailers in sectors 1-2, see hal/stm32f4.c
+if(WOLFBOOT_TARGET STREQUAL "stm32f4" AND CUSTOM_PARTITION_TRAILER)
+    set(WOLFBOOT_LSCRIPT_TEMPLATE hal/stm32f4-trailer.ld)
+endif()
 
 #---------------------------------------------------------------------------------------------
 # wolfcrypt

CMakePresets.json

@@ -206,13 +206,11 @@
         "WOLFBOOT_VERSION": "OFF",
         "SPMATH": "ON",
         "RAM_CODE": "OFF",
-        "WOLFBOOT_PARTITION_SIZE": "0x4000",
-        "WOLFBOOT_SECTOR_SIZE": "0x4000",
-        "WOLFBOOT_PARTITION_BOOT_ADDRESS": "0x8000",
-        "WOLFBOOT_PARTITION_UPDATE_ADDRESS": "0x00000",
-        "WOLFBOOT_PARTITION_SWAP_ADDRESS": "0x4000",
-        "WOLFBOOT_LOAD_ADDRESS": "0x200000",
-        "WOLFBOOT_LOAD_DTS_ADDRESS": "0x400000",
+        "WOLFBOOT_PARTITION_SIZE": "0x60000",
+        "WOLFBOOT_SECTOR_SIZE": "0x20000",
+        "WOLFBOOT_PARTITION_BOOT_ADDRESS": "0x08020000",
+        "WOLFBOOT_PARTITION_UPDATE_ADDRESS": "0x08080000",
+        "WOLFBOOT_PARTITION_SWAP_ADDRESS": "0x080E0000",
         "CLOCK_SPEED": "160000000",
         "STM32_PLLM": "8",
         "STM32_PLLN": "336",

Makefile

@@ -367,6 +367,7 @@ SIGN_ENV=IMAGE_HEADER_SIZE=$(IMAGE_HEADER_SIZE) \
 		 WOLFBOOT_SECTOR_SIZE=$(WOLFBOOT_SECTOR_SIZE) \
 		 NVM_FLASH_WRITEONCE=$(NVM_FLASH_WRITEONCE) \
 		 NVM_FLASH_JOURNAL_DUAL=$(NVM_FLASH_JOURNAL_DUAL) \
+		 CUSTOM_PARTITION_TRAILER=$(CUSTOM_PARTITION_TRAILER) \
 		 ML_DSA_LEVEL=$(ML_DSA_LEVEL) \
 		 IMAGE_SIGNATURE_SIZE=$(IMAGE_SIGNATURE_SIZE) \
 		 LMS_LEVELS=$(LMS_LEVELS) \

arch.mk

@@ -508,6 +508,10 @@ ifeq ($(ARCH),ARM)
   ifeq ($(TARGET),stm32f4)
     ARCH_FLASH_OFFSET=0x08000000
     SPI_TARGET=stm32
+    # Partition trailers in sectors 1-2, see hal/stm32f4.c
+    ifeq ($(CUSTOM_PARTITION_TRAILER),1)
+      LSCRIPT_IN=hal/stm32f4-trailer.ld
+    endif
   endif
 
   ifeq ($(TARGET),max32666)

config/examples/stm32f4-small-blocks-uart-update.config

@@ -20,11 +20,11 @@ RAM_CODE?=0
 DUALBANK_SWAP?=0
 PKA?=1
 WOLFTPM?=0
-WOLFBOOT_PARTITION_SIZE?=0x4000
+WOLFBOOT_PARTITION_SIZE?=0x8000
 WOLFBOOT_SECTOR_SIZE?=0x4000
 WOLFBOOT_PARTITION_BOOT_ADDRESS?=0x8000
 WOLFBOOT_PARTITION_UPDATE_ADDRESS?=0x00000
-WOLFBOOT_PARTITION_SWAP_ADDRESS?=0x4000
+WOLFBOOT_PARTITION_SWAP_ADDRESS?=0x8000
 WOLFBOOT_LOAD_ADDRESS?=0x200000
 WOLFBOOT_LOAD_DTS_ADDRESS?=0x400000
 CLOCK_SPEED?=160000000

config/examples/stm32f407-discovery.config

@@ -4,11 +4,13 @@ SIGN?=ED25519
 HASH?=SHA256
 VTOR?=1
 SPMATH?=1
-WOLFBOOT_PARTITION_SIZE?=0x20000
+# Trailers in sectors 1-2 (hal/stm32f4.c): the image can fill the partition
+CUSTOM_PARTITION_TRAILER?=1
+WOLFBOOT_PARTITION_SIZE?=0x60000
 WOLFBOOT_SECTOR_SIZE?=0x20000
 WOLFBOOT_PARTITION_BOOT_ADDRESS?=0x08020000
-WOLFBOOT_PARTITION_UPDATE_ADDRESS?=0x08040000
-WOLFBOOT_PARTITION_SWAP_ADDRESS?=0x08060000
+WOLFBOOT_PARTITION_UPDATE_ADDRESS?=0x08080000
+WOLFBOOT_PARTITION_SWAP_ADDRESS?=0x080E0000
 CLOCK_SPEED?=160000000
 STM32_PLLM?=8
 STM32_PLLN?=336

config/examples/stm32f411-blackpill.config

@@ -5,6 +5,8 @@ HASH?=SHA256
 VTOR?=1
 SPMATH?=1
 WOLFBOOT_ORIGIN?=0x08000000
+# Single-sector partitions: the trailers are in sectors 1-2 (hal/stm32f4.c)
+CUSTOM_PARTITION_TRAILER?=1
 WOLFBOOT_PARTITION_SIZE?=0x20000
 WOLFBOOT_SECTOR_SIZE?=0x20000
 WOLFBOOT_PARTITION_BOOT_ADDRESS?=0x08020000

docs/flash_partitions.md

@@ -124,12 +124,36 @@ If the `FLAGS_HOME` build option is used then all flags are placed at the end of
                          flag
 ```
 
+The trailer sector is erased independently from the image, so it can never hold any part of it,
+and the final step of the swap needs one more sector to stage the image tail. For this reason each
+partition must be at least two sectors long (three with `NVM_FLASH_WRITEONCE`, which keeps two
+copies of the trailer), and the image can use the partition up to the trailer sector(s). The build
+fails if `WOLFBOOT_PARTITION_SIZE` is smaller, unless `CUSTOM_PARTITION_TRAILER` is used.
+
+### Custom partition trailer
+
 You can use the `CUSTOM_PARTITION_TRAILER` option to implement your own functions for: `get_trailer_at`, `set_trailer_at` and `set_partition_magic`.
+The trailers are then stored outside of the BOOT and UPDATE partitions, so:
+
+ - the image can use the whole partition, which may be a single sector long;
+ - triggering an update does not erase anything in the UPDATE partition;
+ - at the end of the swap, the bootloader resets the sector flags and the UPDATE state itself.
+
+`set_trailer_at` may be asked to set bits back to 1 (e.g. resetting the flags to `SECT_FLAG_NEW`),
+so on flash it has to erase and rewrite the storage where needed. The flash is unlocked when it is called.
 
 To enable:
-1) Add the `CUSTOM_PARTITION_TRAILER` build option to your `.config`: `CFLAGS_EXTRA+=--DCUSTOM_PARTITION_TRAILER`
+1) Add `CUSTOM_PARTITION_TRAILER=1` to your `.config` (or `CFLAGS_EXTRA+=-DCUSTOM_PARTITION_TRAILER`,
+   in which case also export `CUSTOM_PARTITION_TRAILER=1` when running the `sign` tool, so it allows images as
+   large as the partition)
 2) Add your own .c file using `OBJS_EXTRA`. For example for your own `src/custom_trailer.c` add this to your `.config`: `OBJS_EXTRA=src/custom_trailer.o`.
 
+STM32F4 provides its own implementation in `hal/stm32f4.c`: the boot and update trailers are stored in
+the 16KB flash sectors 1 and 2 (0x08004000 and 0x08008000, overridable with
+`STM32F4_TRAILER_BOOT_ADDRESS` / `STM32F4_TRAILER_UPDATE_ADDRESS`), and wolfBoot is linked around them
+(`hal/stm32f4-trailer.ld`: vector table in sector 0, code from sector 3). This allows the BOOT and UPDATE
+partitions to use the 128KB sectors without wasting one of them for each trailer, see
+`config/examples/stm32f407-discovery.config` and `config/examples/stm32f411-blackpill.config`.
 
 ## Overview of the content of the FLASH partitions