Re: Manufacturing Image Proposal

[Christopher Collins]

Hi Will,

On Tue, Dec 11, 2018 at 04:25:41PM -0800, will sanfilippo wrote:
> I read this over myself and it looks good to me. What I am not sure I 
> understood, and still not sure I do, is the sectors where these MMR will go. 
> Are these going to go into some write protected location? Or will they just 
> so somewhere that does not get erased when we do image upgrades? Not sure I 
> need to understand either :-) 

That is a good point.  The firmware probably ought to write protect
the extra MMR areas at startup.  Ideally, the `sys/mfg` package which
reads the MMRs would do this automatically.  This package can do this
using the `hal_flash_write_protect()` function, but that is just
software protection.  I don't believe we have support for generic
hardware-based protection.

Chris

Re: Manufacturing Image Proposal

[Christopher Collins]

On Tue, Dec 11, 2018 at 12:43:02PM +0100, Łukasz Rymanowski wrote:
> Hi Chris,
> 
> I read it all and indeed it was thrilling :)

Thanks for reading!

> I think this is a good idea and this is a way to go. I have just feeling
> that internal mfgimage should be able to verify external one somehow, to
> make sure second factory did a good job
> But maybe this is not needed as  bootloader will do signature validation of
> the images inside the external mfgimage (if I recall correctly). Anyway,
> just a thought to consider.

I agree that it would be good if the boot mfgimage could verify the
others.  I think there is a problem here, though.  Mfgimages are weird
things in that their contents don't remain intact on a device.  An
mfgimage might contain a Mynewt image and a pre-filled sys/config FCB,
for example.  When the device starts up in the field, it will append new
data to the FCB.  A back end management service may upload a new Mynewt
image to the device, overwriting the one that came from the mfgimage.
So, the mfgimage hashes on a device become inaccurate very quickly.
Their purpose is not to validate what is on the device now, but to
identify what was put on the device originally.

So, I don't think we can use the mfgimage hash to verify anything.
Maybe there is another approach that would work?

Chris