An update must never brick the device it updates.
Secure OTA · MCU and Embedded Linux
The problem
Devices update over the air with no technician nearby. A bad or tampered image must never run.
What I did
- A/B dual-bank updates with CRC, AES decryption and signature checks finished before the bank swap.
- On the EV charger, updates flashed only from the TrustZone-M secure region.
- A bare-metal secondary bootloader that boots only a verified image.
The proof
Deliberately corrupted images fed through the live update path. JTAG flash readback confirmed every one was rejected and the active image stayed untouched.