boot/bootutil/src/bootutil_priv.h - mirror/mcuboot - TrustedFirmware Git Browser

 /*
  * SPDX-License-Identifier: Apache-2.0
  *
  * Copyright (c) 2017-2020 Linaro LTD
  * Copyright (c) 2017-2019 JUUL Labs
  * Copyright (c) 2019-2021 Arm Limited
  *
  * Original license:
  *
  * Licensed to the Apache Software Foundation (ASF) under one
  * or more contributor license agreements.  See the NOTICE file
  * distributed with this work for additional information
  * regarding copyright ownership.  The ASF licenses this file
  * to you under the Apache License, Version 2.0 (the
  * "License"); you may not use this file except in compliance
  * with the License.  You may obtain a copy of the License at
  *
  *  http://www.apache.org/licenses/LICENSE-2.0
  *
  * Unless required by applicable law or agreed to in writing,
  * software distributed under the License is distributed on an
  * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
  * KIND, either express or implied.  See the License for the
  * specific language governing permissions and limitations
  * under the License.
  */

 #ifndef H_BOOTUTIL_PRIV_
 #define H_BOOTUTIL_PRIV_

 #include <inttypes.h>
 #include <string.h>

 #include "sysflash/sysflash.h"

 #include <flash_map_backend/flash_map_backend.h>

 #include "bootutil/bootutil.h"
 #include "bootutil/image.h"
 #include "bootutil/fault_injection_hardening.h"
 #include "mcuboot_config/mcuboot_config.h"

 #ifdef MCUBOOT_ENC_IMAGES
 #include "bootutil/enc_key.h"
 #endif

 #ifdef __cplusplus
 extern "C" {
 #endif

 struct flash_area;

 #define BOOT_TMPBUF_SZ  256

 /** Number of image slots in flash; currently limited to two. */
 #define BOOT_NUM_SLOTS                  2

 #if !defined(MCUBOOT_OVERWRITE_ONLY) && \
     !defined(MCUBOOT_SWAP_USING_MOVE) && \
     !defined(MCUBOOT_DIRECT_XIP) && \
     !(defined(MCUBOOT_RAM_LOAD) && !defined(MCUBOOT_MULTI_MEMORY_LOAD))
 #define MCUBOOT_SWAP_USING_SCRATCH 1
 #endif

 #if !defined(MCUBOOT_OVERWRITE_ONLY) && \
     !defined(MCUBOOT_SWAP_USING_MOVE)
 #define MCUBOOT_SWAP_USING_SCRATCH 1
 #endif

 #define BOOT_STATUS_OP_MOVE     1
 #define BOOT_STATUS_OP_SWAP     2

 /*
  * Maintain state of copy progress.
  */
 struct boot_status {
     uint32_t idx;         /* Which area we're operating on */
     uint8_t state;        /* Which part of the swapping process are we at */
     uint8_t op;           /* What operation are we performing? */
     uint8_t use_scratch;  /* Are status bytes ever written to scratch? */
     uint8_t swap_type;    /* The type of swap in effect */
     uint32_t swap_size;   /* Total size of swapped image */
 #ifdef MCUBOOT_ENC_IMAGES
 #define BOOT_UNINITIALIZED_KEY_FILL 0xFF
     uint8_t enckey[BOOT_NUM_SLOTS][BOOT_ENC_KEY_ALIGN_SIZE];
 #if MCUBOOT_SWAP_SAVE_ENCTLV
 #define BOOT_UNINITIALIZED_TLV_FILL 0xFF
     uint8_t enctlv[BOOT_NUM_SLOTS][BOOT_ENC_TLV_ALIGN_SIZE];
 #endif
 #endif
     int source;           /* Which slot contains swap status metadata */
 };

 #define BOOT_STATUS_IDX_0   1U

 #define BOOT_STATUS_STATE_0 1
 #define BOOT_STATUS_STATE_1 2
 #define BOOT_STATUS_STATE_2 3

 /**
  * End-of-image slot structure.
  *
  *   0                   1                   2                   3
  *   0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
  *  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
  *  ~                                                               ~
  *  ~    Swap status (BOOT_MAX_IMG_SECTORS * min-write-size * 3)    ~
  *  ~                                                               ~
  *  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
  *  |                 Encryption key 0 (16 octets) [*]              |
  *  |                                                               |
  *  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
  *  |                    0xff padding as needed                     |
  *  |  (BOOT_MAX_ALIGN minus 16 octets from Encryption key 0) [*]   |
  *  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
  *  |                 Encryption key 1 (16 octets) [*]              |
  *  |                                                               |
  *  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
  *  |                    0xff padding as needed                     |
  *  |  (BOOT_MAX_ALIGN minus 16 octets from Encryption key 1) [*]   |
  *  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
  *  |                      Swap size (4 octets)                     |
  *  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
  *  |                    0xff padding as needed                     |
  *  |        (BOOT_MAX_ALIGN minus 4 octets from Swap size)         |
  *  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
  *  |   Swap info   |  0xff padding (BOOT_MAX_ALIGN minus 1 octet)  |
  *  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
  *  |   Copy done   |  0xff padding (BOOT_MAX_ALIGN minus 1 octet)  |
  *  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
  *  |   Image OK    |  0xff padding (BOOT_MAX_ALIGN minus 1 octet)  |
  *  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
  *  |                    0xff padding as needed                     |
  *  |         (BOOT_MAX_ALIGN minus 16 octets from MAGIC)           |
  *  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
  *  |                       MAGIC (16 octets)                       |
  *  |                                                               |
  *  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
  *
  * [*]: Only present if the encryption option is enabled
  *      (`MCUBOOT_ENC_IMAGES`).
  */

 union boot_img_magic_t
 {
     struct {
         uint16_t align;
         uint8_t magic[14];
     };
     uint8_t val[16];
 };

 extern const union boot_img_magic_t boot_img_magic;

 #define BOOT_IMG_MAGIC  (boot_img_magic.val)

 #if BOOT_MAX_ALIGN == 8
 #define BOOT_IMG_ALIGN  (BOOT_MAX_ALIGN)
 #else
 #define BOOT_IMG_ALIGN  (boot_img_magic.align)
 #endif

 _Static_assert(sizeof(boot_img_magic) == BOOT_MAGIC_SZ, "Invalid size for image magic");

 #if !defined(MCUBOOT_DIRECT_XIP) && !defined(MCUBOOT_RAM_LOAD)
 #define ARE_SLOTS_EQUIVALENT()    0
 #else
 #define ARE_SLOTS_EQUIVALENT()    1

 #if defined(MCUBOOT_DIRECT_XIP) && defined(MCUBOOT_ENC_IMAGES)
 #error "Image encryption (MCUBOOT_ENC_IMAGES) is not supported when MCUBOOT_DIRECT_XIP is selected."
 #endif /* MCUBOOT_DIRECT_XIP && MCUBOOT_ENC_IMAGES */
 #endif /* MCUBOOT_DIRECT_XIP || MCUBOOT_RAM_LOAD */

 #define BOOT_MAX_IMG_SECTORS       MCUBOOT_MAX_IMG_SECTORS

 #define BOOT_LOG_IMAGE_INFO(slot, hdr)                                    \
     BOOT_LOG_INF("%-9s slot: "                                            \
                  "version=%u.%u.%" PRIu16 "+%" PRIu32,                    \
                  ((slot) == BOOT_PRIMARY_SLOT) ? "Primary" : "Secondary", \
                  (unsigned)(hdr)->ih_ver.iv_major,                        \
                  (unsigned)(hdr)->ih_ver.iv_minor,                        \
                  (hdr)->ih_ver.iv_revision,                               \
                  (hdr)->ih_ver.iv_build_num)

 #if MCUBOOT_SWAP_USING_MOVE
 #define BOOT_STATUS_MOVE_STATE_COUNT    1
 #define BOOT_STATUS_SWAP_STATE_COUNT    2
 #define BOOT_STATUS_STATE_COUNT         (BOOT_STATUS_MOVE_STATE_COUNT + BOOT_STATUS_SWAP_STATE_COUNT)
 #else
 #define BOOT_STATUS_STATE_COUNT         3
 #endif

 /** Maximum number of image sectors supported by the bootloader. */
 #define BOOT_STATUS_MAX_ENTRIES         BOOT_MAX_IMG_SECTORS

 #define NO_ACTIVE_SLOT                  UINT32_MAX
 #define BOOT_PRIMARY_SLOT               0
 #define BOOT_SECONDARY_SLOT             1

 #define BOOT_STATUS_SOURCE_NONE         0
 #define BOOT_STATUS_SOURCE_SCRATCH      1
 #define BOOT_STATUS_SOURCE_PRIMARY_SLOT 2

 /**
  * Compatibility shim for flash sector type.
  *
  * This can be deleted when flash_area_to_sectors() is removed.
  */
 #ifdef MCUBOOT_USE_FLASH_AREA_GET_SECTORS
 typedef struct flash_sector boot_sector_t;
 #else
 typedef struct flash_area boot_sector_t;
 #endif

 /** Private state maintained during boot. */
 struct boot_loader_state {
     struct {
         struct image_header hdr;
         const struct flash_area *area;
         boot_sector_t *sectors;
         size_t num_sectors;
     } imgs[BOOT_IMAGE_NUMBER][BOOT_NUM_SLOTS];

 #if defined(MCUBOOT_SWAP_USING_SCRATCH)
     struct {
         const struct flash_area *area;
         boot_sector_t *sectors;
         size_t num_sectors;
     } scratch;
 #endif
 #if defined(MCUBOOT_SWAP_USING_STATUS)
     struct {
         const struct flash_area *area;
         boot_sector_t *sectors;
         size_t num_sectors;
     } status;
 #endif

     uint8_t swap_type[BOOT_IMAGE_NUMBER];
     uint32_t write_sz;

 #if defined(MCUBOOT_ENC_IMAGES)
     struct enc_key_data enc[BOOT_IMAGE_NUMBER][BOOT_NUM_SLOTS];
 #endif

 #if (BOOT_IMAGE_NUMBER > 1)
     uint8_t curr_img_idx;
     bool img_mask[BOOT_IMAGE_NUMBER];
 #endif

 #if defined(MCUBOOT_DIRECT_XIP) || defined(MCUBOOT_RAM_LOAD) || defined(MCUBOOT_MULTI_MEMORY_BOOT)
     struct slot_usage_t {
         /* Index of the slot chosen to be loaded */
         uint32_t active_slot;
         bool slot_available[BOOT_NUM_SLOTS];
 #if defined(MCUBOOT_RAM_LOAD)
         /* Image destination and size for the active slot */
         uint32_t img_dst;
         uint32_t img_sz;
 #elif defined(MCUBOOT_DIRECT_XIP_REVERT)
         /* Swap status for the active slot */
         struct boot_swap_state swap_state;
 #endif
     } slot_usage[BOOT_IMAGE_NUMBER];
 #endif /* MCUBOOT_DIRECT_XIP || MCUBOOT_RAM_LOAD */
 };

 fih_int bootutil_verify_sig(uint8_t *hash, uint32_t hlen, uint8_t *sig,
                             size_t slen, uint8_t key_id);

 fih_int boot_fih_memequal(const void *s1, const void *s2, size_t n);

 bool boot_magic_compatible_check(uint8_t tbl_val, uint8_t val);
 uint32_t boot_status_sz(uint32_t min_write_sz);
 uint32_t boot_trailer_sz(uint32_t min_write_sz);
 int boot_status_entries(int image_index, const struct flash_area *fap);
 uint32_t boot_status_off(const struct flash_area *fap);
 int boot_write_magic(const struct flash_area *fap);
 int boot_write_status(const struct boot_loader_state *state, struct boot_status *bs);
 int boot_write_copy_done(const struct flash_area *fap);
 int boot_write_image_ok(const struct flash_area *fap);
 int boot_write_swap_info(const struct flash_area *fap, uint8_t swap_type,
                          uint8_t image_num);
 int boot_write_swap_size(const struct flash_area *fap, uint32_t swap_size);
 int boot_write_trailer(const struct flash_area *fap, uint32_t off,
                        const uint8_t *inbuf, uint8_t inlen);
 int boot_write_trailer_flag(const struct flash_area *fap, uint32_t off,
                             uint8_t flag_val);
 int boot_read_swap_size(int image_index, uint32_t *swap_size);
 int boot_slots_compatible(struct boot_loader_state *state);
 uint32_t boot_status_internal_off(const struct boot_status *bs, uint32_t elem_sz);
 int boot_read_image_header(struct boot_loader_state *state, int slot,
                            struct image_header *out_hdr, struct boot_status *bs);
 int boot_copy_region(struct boot_loader_state *state,
                      const struct flash_area *fap_src,
                      const struct flash_area *fap_dst,
                      uint32_t off_src, uint32_t off_dst, uint32_t sz);
 int boot_erase_region(const struct flash_area *fap, uint32_t off, uint32_t sz);
 bool boot_status_is_reset(const struct boot_status *bs);

 #ifdef MCUBOOT_SWAP_USING_STATUS
 uint32_t boot_copy_done_off(const struct flash_area *fap);
 uint32_t boot_image_ok_off(const struct flash_area *fap);
 uint32_t boot_swap_size_off(const struct flash_area *fap);
 #endif


 #ifdef MCUBOOT_ENC_IMAGES
 int boot_write_enc_key(const struct flash_area *fap, uint8_t slot,
                        const struct boot_status *bs);
 int boot_read_enc_key(int image_index, uint8_t slot, struct boot_status *bs);
 #endif

 /**
  * Checks that a buffer is filled by the specified value.
  *
  * @returns true if all bytes in the buffer are equal to `fill`; false if any
  * of the bytes does not match, or when buffer is NULL, or when len == 0.
  */
 bool bootutil_buffer_is_filled(const void *buffer, uint8_t fill, size_t len);

 /**
  * Checks that a buffer is erased according to what the erase value for the
  * flash device provided in `flash_area` is.
  *
  * @returns true if the buffer is erased; false if any of the bytes is not
  * erased, or when area is NULL, or when buffer is NULL, or when len == 0.
  */
 bool bootutil_buffer_is_erased(const struct flash_area *area,
                                const void *buffer, size_t len);

 /**
  * Safe (non-overflowing) uint32_t addition.  Returns true, and stores
  * the result in *dest if it can be done without overflow.  Otherwise,
  * returns false.
  */
 static inline bool boot_u32_safe_add(uint32_t *dest, uint32_t a, uint32_t b)
 {
     /*
      * "a + b <= UINT32_MAX", subtract 'b' from both sides to avoid
      * the overflow.
      */
     if (a > UINT32_MAX - b) {
         return false;
     } else {
         *dest = a + b;
         return true;
     }
 }

 /**
  * Safe (non-overflowing) uint16_t addition.  Returns true, and stores
  * the result in *dest if it can be done without overflow.  Otherwise,
  * returns false.
  */
 static inline bool boot_u16_safe_add(uint16_t *dest, uint16_t a, uint16_t b)
 {
     uint32_t tmp = (uint32_t)a + b;
     if (tmp > UINT16_MAX) {
         return false;
     } else {
         *dest = (uint16_t) tmp;
         return true;
     }
 }

 /*
  * Accessors for the contents of struct boot_loader_state.
  */
 #if (BOOT_IMAGE_NUMBER > 1)
 #define BOOT_CURR_IMG(state) ((state)->curr_img_idx)
 #else
 #define BOOT_CURR_IMG(state) 0u
 #endif
 #ifdef MCUBOOT_ENC_IMAGES
 #define BOOT_CURR_ENC(state) ((state)->enc[BOOT_CURR_IMG(state)])
 #else
 #define BOOT_CURR_ENC(state) NULL
 #endif
 /* These are macros so they can be used as lvalues. */
 #define BOOT_IMG(state, slot) ((state)->imgs[BOOT_CURR_IMG(state)][(slot)])
 #define BOOT_IMG_AREA(state, slot) (BOOT_IMG(state, slot).area)
 #define BOOT_WRITE_SZ(state) ((state)->write_sz)
 #define BOOT_SWAP_TYPE(state) ((state)->swap_type[BOOT_CURR_IMG(state)])
 #define BOOT_TLV_OFF(hdr) ((hdr)->ih_hdr_size + (hdr)->ih_img_size)

 #define BOOT_IS_UPGRADE(swap_type)             \
     (((swap_type) == BOOT_SWAP_TYPE_TEST) ||   \
      ((swap_type) == BOOT_SWAP_TYPE_REVERT) || \
      ((swap_type) == BOOT_SWAP_TYPE_PERM))

 static inline struct image_header*
 boot_img_hdr(struct boot_loader_state *state, size_t slot)
 {
     return &BOOT_IMG(state, slot).hdr;
 }

 static inline size_t
 boot_img_num_sectors(const struct boot_loader_state *state, size_t slot)
 {
     return BOOT_IMG(state, slot).num_sectors;
 }

 /*
  * Offset of the slot from the beginning of the flash device.
  */
 static inline uint32_t
 boot_img_slot_off(struct boot_loader_state *state, size_t slot)
 {
     return flash_area_get_off(BOOT_IMG(state, slot).area);
 }

 #ifndef MCUBOOT_USE_FLASH_AREA_GET_SECTORS

 static inline size_t
 boot_img_sector_size(const struct boot_loader_state *state,
                      size_t slot, size_t sector)
 {
     return flash_area_get_size(&BOOT_IMG(state, slot).sectors[sector]);
 }

 /*
  * Offset of the sector from the beginning of the image, NOT the flash
  * device.
  */
 static inline uint32_t
 boot_img_sector_off(const struct boot_loader_state *state, size_t slot,
                     size_t sector)
 {
     return flash_area_get_off(&BOOT_IMG(state, slot).sectors[sector]) -
            flash_area_get_off(&BOOT_IMG(state, slot).sectors[0]);
 }

 #else  /* defined(MCUBOOT_USE_FLASH_AREA_GET_SECTORS) */

 static inline size_t
 boot_img_sector_size(const struct boot_loader_state *state,
                      size_t slot, size_t sector)
 {
     return flash_sector_get_size(&BOOT_IMG(state, slot).sectors[sector]);
 }

 static inline uint32_t
 boot_img_sector_off(const struct boot_loader_state *state, size_t slot,
                     size_t sector)
 {
     return flash_sector_get_off(&BOOT_IMG(state, slot).sectors[sector]) -
            flash_sector_get_off(&BOOT_IMG(state, slot).sectors[0]);
 }

 #endif  /* !defined(MCUBOOT_USE_FLASH_AREA_GET_SECTORS) */

 #if defined(MCUBOOT_RAM_LOAD)
 #   ifdef __BOOTSIM__

 /* Query for the layout of a RAM buffer appropriate for holding the
  * image.  This will be per-test-thread, and therefore must be queried
  * through this call. */
 struct bootsim_ram_info {
     uint32_t start;
     uint32_t size;
     uintptr_t base;
 };
 struct bootsim_ram_info *bootsim_get_ram_info(void);

 #define IMAGE_GET_FIELD(field) (bootsim_get_ram_info()->field)
 #define IMAGE_RAM_BASE IMAGE_GET_FIELD(base)
 #define IMAGE_EXECUTABLE_RAM_START IMAGE_GET_FIELD(start)
 #define IMAGE_EXECUTABLE_RAM_SIZE IMAGE_GET_FIELD(size)

 #   else
 #       define IMAGE_RAM_BASE ((uintptr_t)0)
 #   endif

 #else
 #define IMAGE_RAM_BASE ((uintptr_t)0)
 #endif /* MCUBOOT_RAM_LOAD */

 #define LOAD_IMAGE_DATA_RAM(hdr, fap, start, output, size)                    \
     (memcpy((output),(void*)(IMAGE_RAM_BASE + (hdr)->ih_load_addr + (start)), \
     (size)), 0)

 #define LOAD_IMAGE_DATA_FLASH(hdr, fap, start, output, size)    \
     (flash_area_read((fap), (start), (output), (size)))

 #if defined(MCUBOOT_MULTI_MEMORY_LOAD) && defined(MCUBOOT_RAM_LOAD)
 #define LOAD_IMAGE_DATA(hdr, fap, start, output, size)                         \
     ({                                                                         \
         int rc;                                                                \
         if (IS_RAM_BOOTABLE(hdr) && IS_RAM_BOOT_STAGE()) {                     \
             rc = LOAD_IMAGE_DATA_RAM((hdr), (fap), (start), (output), (size)); \
         } else {                                                               \
             rc = LOAD_IMAGE_DATA_FLASH((hdr), (fap), (start), (output),        \
                                        (size));                                \
         }                                                                      \
         rc;                                                                    \
     })
 #elif defined(MCUBOOT_RAM_LOAD)
 #define LOAD_IMAGE_DATA(hdr, fap, start, output, size) \
     LOAD_IMAGE_DATA_RAM((hdr), (fap), (start), (output), (size))
 #else /* !defined(MCUBOOT_RAM_LOAD)*/
 #define LOAD_IMAGE_DATA(hdr, fap, start, output, size) \
     LOAD_IMAGE_DATA_FLASH((hdr), (fap), (start), (output), (size))
 #endif /* MCUBOOT_MULTI_MEMORY_LOAD */

 #ifdef __cplusplus
 }
 #endif

 #endif
	/*
	* SPDX-License-Identifier: Apache-2.0
	*
	* Copyright (c) 2017-2020 Linaro LTD
	* Copyright (c) 2017-2019 JUUL Labs
	* Copyright (c) 2019-2021 Arm Limited
	*
	* Original license:
	*
	* Licensed to the Apache Software Foundation (ASF) under one
	* or more contributor license agreements. See the NOTICE file
	* distributed with this work for additional information
	* regarding copyright ownership. The ASF licenses this file
	* to you under the Apache License, Version 2.0 (the
	* "License"); you may not use this file except in compliance
	* with the License. You may obtain a copy of the License at
	*
	* http://www.apache.org/licenses/LICENSE-2.0
	*
	* Unless required by applicable law or agreed to in writing,
	* software distributed under the License is distributed on an
	* "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
	* KIND, either express or implied. See the License for the
	* specific language governing permissions and limitations
	* under the License.
	*/

	#ifndef H_BOOTUTIL_PRIV_
	#define H_BOOTUTIL_PRIV_

	#include <inttypes.h>
	#include <string.h>

	#include "sysflash/sysflash.h"

	#include <flash_map_backend/flash_map_backend.h>

	#include "bootutil/bootutil.h"
	#include "bootutil/image.h"
	#include "bootutil/fault_injection_hardening.h"
	#include "mcuboot_config/mcuboot_config.h"

	#ifdef MCUBOOT_ENC_IMAGES
	#include "bootutil/enc_key.h"
	#endif

	#ifdef __cplusplus
	extern "C" {
	#endif

	struct flash_area;

	#define BOOT_TMPBUF_SZ 256

	/** Number of image slots in flash; currently limited to two. */
	#define BOOT_NUM_SLOTS 2

	#if !defined(MCUBOOT_OVERWRITE_ONLY) && \
	!defined(MCUBOOT_SWAP_USING_MOVE) && \
	!defined(MCUBOOT_DIRECT_XIP) && \
	!(defined(MCUBOOT_RAM_LOAD) && !defined(MCUBOOT_MULTI_MEMORY_LOAD))
	#define MCUBOOT_SWAP_USING_SCRATCH 1
	#endif

	#if !defined(MCUBOOT_OVERWRITE_ONLY) && \
	!defined(MCUBOOT_SWAP_USING_MOVE)
	#define MCUBOOT_SWAP_USING_SCRATCH 1
	#endif

	#define BOOT_STATUS_OP_MOVE 1
	#define BOOT_STATUS_OP_SWAP 2

	/*
	* Maintain state of copy progress.
	*/
	struct boot_status {
	uint32_t idx; /* Which area we're operating on */
	uint8_t state; /* Which part of the swapping process are we at */
	uint8_t op; /* What operation are we performing? */
	uint8_t use_scratch; /* Are status bytes ever written to scratch? */
	uint8_t swap_type; /* The type of swap in effect */
	uint32_t swap_size; /* Total size of swapped image */
	#ifdef MCUBOOT_ENC_IMAGES
	#define BOOT_UNINITIALIZED_KEY_FILL 0xFF
	uint8_t enckey[BOOT_NUM_SLOTS][BOOT_ENC_KEY_ALIGN_SIZE];
	#if MCUBOOT_SWAP_SAVE_ENCTLV
	#define BOOT_UNINITIALIZED_TLV_FILL 0xFF
	uint8_t enctlv[BOOT_NUM_SLOTS][BOOT_ENC_TLV_ALIGN_SIZE];
	#endif
	#endif
	int source; /* Which slot contains swap status metadata */
	};

	#define BOOT_STATUS_IDX_0 1U

	#define BOOT_STATUS_STATE_0 1
	#define BOOT_STATUS_STATE_1 2
	#define BOOT_STATUS_STATE_2 3

	/**
	* End-of-image slot structure.
	*
	* 0 1 2 3
	* 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
	* +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
	* ~ ~
	* ~ Swap status (BOOT_MAX_IMG_SECTORS * min-write-size * 3) ~
	* ~ ~
	* +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
	* \| Encryption key 0 (16 octets) [*] \|
	* \| \|
	* +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
	* \| 0xff padding as needed \|
	* \| (BOOT_MAX_ALIGN minus 16 octets from Encryption key 0) [*] \|
	* +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
	* \| Encryption key 1 (16 octets) [*] \|
	* \| \|
	* +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
	* \| 0xff padding as needed \|
	* \| (BOOT_MAX_ALIGN minus 16 octets from Encryption key 1) [*] \|
	* +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
	* \| Swap size (4 octets) \|
	* +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
	* \| 0xff padding as needed \|
	* \| (BOOT_MAX_ALIGN minus 4 octets from Swap size) \|
	* +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
	* \| Swap info \| 0xff padding (BOOT_MAX_ALIGN minus 1 octet) \|
	* +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
	* \| Copy done \| 0xff padding (BOOT_MAX_ALIGN minus 1 octet) \|
	* +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
	* \| Image OK \| 0xff padding (BOOT_MAX_ALIGN minus 1 octet) \|
	* +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
	* \| 0xff padding as needed \|
	* \| (BOOT_MAX_ALIGN minus 16 octets from MAGIC) \|
	* +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
	* \| MAGIC (16 octets) \|
	* \| \|
	* +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
	*
	* [*]: Only present if the encryption option is enabled
	* (`MCUBOOT_ENC_IMAGES`).
	*/

	union boot_img_magic_t
	{
	struct {
	uint16_t align;
	uint8_t magic[14];
	};
	uint8_t val[16];
	};

	extern const union boot_img_magic_t boot_img_magic;

	#define BOOT_IMG_MAGIC (boot_img_magic.val)

	#if BOOT_MAX_ALIGN == 8
	#define BOOT_IMG_ALIGN (BOOT_MAX_ALIGN)
	#else
	#define BOOT_IMG_ALIGN (boot_img_magic.align)
	#endif

	_Static_assert(sizeof(boot_img_magic) == BOOT_MAGIC_SZ, "Invalid size for image magic");

	#if !defined(MCUBOOT_DIRECT_XIP) && !defined(MCUBOOT_RAM_LOAD)
	#define ARE_SLOTS_EQUIVALENT() 0
	#else
	#define ARE_SLOTS_EQUIVALENT() 1

	#if defined(MCUBOOT_DIRECT_XIP) && defined(MCUBOOT_ENC_IMAGES)
	#error "Image encryption (MCUBOOT_ENC_IMAGES) is not supported when MCUBOOT_DIRECT_XIP is selected."
	#endif /* MCUBOOT_DIRECT_XIP && MCUBOOT_ENC_IMAGES */
	#endif /* MCUBOOT_DIRECT_XIP \|\| MCUBOOT_RAM_LOAD */

	#define BOOT_MAX_IMG_SECTORS MCUBOOT_MAX_IMG_SECTORS

	#define BOOT_LOG_IMAGE_INFO(slot, hdr) \
	BOOT_LOG_INF("%-9s slot: " \
	"version=%u.%u.%" PRIu16 "+%" PRIu32, \
	((slot) == BOOT_PRIMARY_SLOT) ? "Primary" : "Secondary", \
	(unsigned)(hdr)->ih_ver.iv_major, \
	(unsigned)(hdr)->ih_ver.iv_minor, \
	(hdr)->ih_ver.iv_revision, \
	(hdr)->ih_ver.iv_build_num)

	#if MCUBOOT_SWAP_USING_MOVE
	#define BOOT_STATUS_MOVE_STATE_COUNT 1
	#define BOOT_STATUS_SWAP_STATE_COUNT 2
	#define BOOT_STATUS_STATE_COUNT (BOOT_STATUS_MOVE_STATE_COUNT + BOOT_STATUS_SWAP_STATE_COUNT)
	#else
	#define BOOT_STATUS_STATE_COUNT 3
	#endif

	/** Maximum number of image sectors supported by the bootloader. */
	#define BOOT_STATUS_MAX_ENTRIES BOOT_MAX_IMG_SECTORS

	#define NO_ACTIVE_SLOT UINT32_MAX
	#define BOOT_PRIMARY_SLOT 0
	#define BOOT_SECONDARY_SLOT 1

	#define BOOT_STATUS_SOURCE_NONE 0
	#define BOOT_STATUS_SOURCE_SCRATCH 1
	#define BOOT_STATUS_SOURCE_PRIMARY_SLOT 2

	/**
	* Compatibility shim for flash sector type.
	*
	* This can be deleted when flash_area_to_sectors() is removed.
	*/
	#ifdef MCUBOOT_USE_FLASH_AREA_GET_SECTORS
	typedef struct flash_sector boot_sector_t;
	#else
	typedef struct flash_area boot_sector_t;
	#endif

	/** Private state maintained during boot. */
	struct boot_loader_state {
	struct {
	struct image_header hdr;
	const struct flash_area *area;
	boot_sector_t *sectors;
	size_t num_sectors;
	} imgs[BOOT_IMAGE_NUMBER][BOOT_NUM_SLOTS];

	#if defined(MCUBOOT_SWAP_USING_SCRATCH)
	struct {
	const struct flash_area *area;
	boot_sector_t *sectors;
	size_t num_sectors;
	} scratch;
	#endif
	#if defined(MCUBOOT_SWAP_USING_STATUS)
	struct {
	const struct flash_area *area;
	boot_sector_t *sectors;
	size_t num_sectors;
	} status;
	#endif

	uint8_t swap_type[BOOT_IMAGE_NUMBER];
	uint32_t write_sz;

	#if defined(MCUBOOT_ENC_IMAGES)
	struct enc_key_data enc[BOOT_IMAGE_NUMBER][BOOT_NUM_SLOTS];
	#endif

	#if (BOOT_IMAGE_NUMBER > 1)
	uint8_t curr_img_idx;
	bool img_mask[BOOT_IMAGE_NUMBER];
	#endif

	#if defined(MCUBOOT_DIRECT_XIP) \|\| defined(MCUBOOT_RAM_LOAD) \|\| defined(MCUBOOT_MULTI_MEMORY_BOOT)
	struct slot_usage_t {
	/* Index of the slot chosen to be loaded */
	uint32_t active_slot;
	bool slot_available[BOOT_NUM_SLOTS];
	#if defined(MCUBOOT_RAM_LOAD)
	/* Image destination and size for the active slot */
	uint32_t img_dst;
	uint32_t img_sz;
	#elif defined(MCUBOOT_DIRECT_XIP_REVERT)
	/* Swap status for the active slot */
	struct boot_swap_state swap_state;
	#endif
	} slot_usage[BOOT_IMAGE_NUMBER];
	#endif /* MCUBOOT_DIRECT_XIP \|\| MCUBOOT_RAM_LOAD */
	};

	fih_int bootutil_verify_sig(uint8_t hash, uint32_t hlen, uint8_t sig,
	size_t slen, uint8_t key_id);

	fih_int boot_fih_memequal(const void s1, const void s2, size_t n);

	bool boot_magic_compatible_check(uint8_t tbl_val, uint8_t val);
	uint32_t boot_status_sz(uint32_t min_write_sz);
	uint32_t boot_trailer_sz(uint32_t min_write_sz);
	int boot_status_entries(int image_index, const struct flash_area *fap);
	uint32_t boot_status_off(const struct flash_area *fap);
	int boot_write_magic(const struct flash_area *fap);
	int boot_write_status(const struct boot_loader_state state, struct boot_status bs);
	int boot_write_copy_done(const struct flash_area *fap);
	int boot_write_image_ok(const struct flash_area *fap);
	int boot_write_swap_info(const struct flash_area *fap, uint8_t swap_type,
	uint8_t image_num);
	int boot_write_swap_size(const struct flash_area *fap, uint32_t swap_size);
	int boot_write_trailer(const struct flash_area *fap, uint32_t off,
	const uint8_t *inbuf, uint8_t inlen);
	int boot_write_trailer_flag(const struct flash_area *fap, uint32_t off,
	uint8_t flag_val);
	int boot_read_swap_size(int image_index, uint32_t *swap_size);
	int boot_slots_compatible(struct boot_loader_state *state);
	uint32_t boot_status_internal_off(const struct boot_status *bs, uint32_t elem_sz);
	int boot_read_image_header(struct boot_loader_state *state, int slot,
	struct image_header out_hdr, struct boot_status bs);
	int boot_copy_region(struct boot_loader_state *state,
	const struct flash_area *fap_src,
	const struct flash_area *fap_dst,
	uint32_t off_src, uint32_t off_dst, uint32_t sz);
	int boot_erase_region(const struct flash_area *fap, uint32_t off, uint32_t sz);
	bool boot_status_is_reset(const struct boot_status *bs);

	#ifdef MCUBOOT_SWAP_USING_STATUS
	uint32_t boot_copy_done_off(const struct flash_area *fap);
	uint32_t boot_image_ok_off(const struct flash_area *fap);
	uint32_t boot_swap_size_off(const struct flash_area *fap);
	#endif


	#ifdef MCUBOOT_ENC_IMAGES
	int boot_write_enc_key(const struct flash_area *fap, uint8_t slot,
	const struct boot_status *bs);
	int boot_read_enc_key(int image_index, uint8_t slot, struct boot_status *bs);
	#endif

	/**
	* Checks that a buffer is filled by the specified value.
	*
	* @returns true if all bytes in the buffer are equal to `fill`; false if any
	* of the bytes does not match, or when buffer is NULL, or when len == 0.
	*/
	bool bootutil_buffer_is_filled(const void *buffer, uint8_t fill, size_t len);

	/**
	* Checks that a buffer is erased according to what the erase value for the
	* flash device provided in `flash_area` is.
	*
	* @returns true if the buffer is erased; false if any of the bytes is not
	* erased, or when area is NULL, or when buffer is NULL, or when len == 0.
	*/
	bool bootutil_buffer_is_erased(const struct flash_area *area,
	const void *buffer, size_t len);

	/**
	* Safe (non-overflowing) uint32_t addition. Returns true, and stores
	* the result in *dest if it can be done without overflow. Otherwise,
	* returns false.
	*/
	static inline bool boot_u32_safe_add(uint32_t *dest, uint32_t a, uint32_t b)
	{
	/*
	* "a + b <= UINT32_MAX", subtract 'b' from both sides to avoid
	* the overflow.
	*/
	if (a > UINT32_MAX - b) {
	return false;
	} else {
	*dest = a + b;
	return true;
	}
	}

	/**
	* Safe (non-overflowing) uint16_t addition. Returns true, and stores
	* the result in *dest if it can be done without overflow. Otherwise,
	* returns false.
	*/
	static inline bool boot_u16_safe_add(uint16_t *dest, uint16_t a, uint16_t b)
	{
	uint32_t tmp = (uint32_t)a + b;
	if (tmp > UINT16_MAX) {
	return false;
	} else {
	*dest = (uint16_t) tmp;
	return true;
	}
	}

	/*
	* Accessors for the contents of struct boot_loader_state.
	*/
	#if (BOOT_IMAGE_NUMBER > 1)
	#define BOOT_CURR_IMG(state) ((state)->curr_img_idx)
	#else
	#define BOOT_CURR_IMG(state) 0u
	#endif
	#ifdef MCUBOOT_ENC_IMAGES
	#define BOOT_CURR_ENC(state) ((state)->enc[BOOT_CURR_IMG(state)])
	#else
	#define BOOT_CURR_ENC(state) NULL
	#endif
	/* These are macros so they can be used as lvalues. */
	#define BOOT_IMG(state, slot) ((state)->imgs[BOOT_CURR_IMG(state)][(slot)])
	#define BOOT_IMG_AREA(state, slot) (BOOT_IMG(state, slot).area)
	#define BOOT_WRITE_SZ(state) ((state)->write_sz)
	#define BOOT_SWAP_TYPE(state) ((state)->swap_type[BOOT_CURR_IMG(state)])
	#define BOOT_TLV_OFF(hdr) ((hdr)->ih_hdr_size + (hdr)->ih_img_size)

	#define BOOT_IS_UPGRADE(swap_type) \
	(((swap_type) == BOOT_SWAP_TYPE_TEST) \|\| \
	((swap_type) == BOOT_SWAP_TYPE_REVERT) \|\| \
	((swap_type) == BOOT_SWAP_TYPE_PERM))

	static inline struct image_header*
	boot_img_hdr(struct boot_loader_state *state, size_t slot)
	{
	return &BOOT_IMG(state, slot).hdr;
	}

	static inline size_t
	boot_img_num_sectors(const struct boot_loader_state *state, size_t slot)
	{
	return BOOT_IMG(state, slot).num_sectors;
	}

	/*
	* Offset of the slot from the beginning of the flash device.
	*/
	static inline uint32_t
	boot_img_slot_off(struct boot_loader_state *state, size_t slot)
	{
	return flash_area_get_off(BOOT_IMG(state, slot).area);
	}

	#ifndef MCUBOOT_USE_FLASH_AREA_GET_SECTORS

	static inline size_t
	boot_img_sector_size(const struct boot_loader_state *state,
	size_t slot, size_t sector)
	{
	return flash_area_get_size(&BOOT_IMG(state, slot).sectors[sector]);
	}

	/*
	* Offset of the sector from the beginning of the image, NOT the flash
	* device.
	*/
	static inline uint32_t
	boot_img_sector_off(const struct boot_loader_state *state, size_t slot,
	size_t sector)
	{
	return flash_area_get_off(&BOOT_IMG(state, slot).sectors[sector]) -
	flash_area_get_off(&BOOT_IMG(state, slot).sectors[0]);
	}

	#else /* defined(MCUBOOT_USE_FLASH_AREA_GET_SECTORS) */

	static inline size_t
	boot_img_sector_size(const struct boot_loader_state *state,
	size_t slot, size_t sector)
	{
	return flash_sector_get_size(&BOOT_IMG(state, slot).sectors[sector]);
	}

	static inline uint32_t
	boot_img_sector_off(const struct boot_loader_state *state, size_t slot,
	size_t sector)
	{
	return flash_sector_get_off(&BOOT_IMG(state, slot).sectors[sector]) -
	flash_sector_get_off(&BOOT_IMG(state, slot).sectors[0]);
	}

	#endif /* !defined(MCUBOOT_USE_FLASH_AREA_GET_SECTORS) */

	#if defined(MCUBOOT_RAM_LOAD)
	# ifdef __BOOTSIM__

	/* Query for the layout of a RAM buffer appropriate for holding the
	* image. This will be per-test-thread, and therefore must be queried
	* through this call. */
	struct bootsim_ram_info {
	uint32_t start;
	uint32_t size;
	uintptr_t base;
	};
	struct bootsim_ram_info *bootsim_get_ram_info(void);

	#define IMAGE_GET_FIELD(field) (bootsim_get_ram_info()->field)
	#define IMAGE_RAM_BASE IMAGE_GET_FIELD(base)
	#define IMAGE_EXECUTABLE_RAM_START IMAGE_GET_FIELD(start)
	#define IMAGE_EXECUTABLE_RAM_SIZE IMAGE_GET_FIELD(size)

	# else
	# define IMAGE_RAM_BASE ((uintptr_t)0)
	# endif

	#else
	#define IMAGE_RAM_BASE ((uintptr_t)0)
	#endif /* MCUBOOT_RAM_LOAD */

	#define LOAD_IMAGE_DATA_RAM(hdr, fap, start, output, size) \
	(memcpy((output),(void*)(IMAGE_RAM_BASE + (hdr)->ih_load_addr + (start)), \
	(size)), 0)

	#define LOAD_IMAGE_DATA_FLASH(hdr, fap, start, output, size) \
	(flash_area_read((fap), (start), (output), (size)))

	#if defined(MCUBOOT_MULTI_MEMORY_LOAD) && defined(MCUBOOT_RAM_LOAD)
	#define LOAD_IMAGE_DATA(hdr, fap, start, output, size) \
	({ \
	int rc; \
	if (IS_RAM_BOOTABLE(hdr) && IS_RAM_BOOT_STAGE()) { \
	rc = LOAD_IMAGE_DATA_RAM((hdr), (fap), (start), (output), (size)); \
	} else { \
	rc = LOAD_IMAGE_DATA_FLASH((hdr), (fap), (start), (output), \
	(size)); \
	} \
	rc; \
	})
	#elif defined(MCUBOOT_RAM_LOAD)
	#define LOAD_IMAGE_DATA(hdr, fap, start, output, size) \
	LOAD_IMAGE_DATA_RAM((hdr), (fap), (start), (output), (size))
	#else /* !defined(MCUBOOT_RAM_LOAD)*/
	#define LOAD_IMAGE_DATA(hdr, fap, start, output, size) \
	LOAD_IMAGE_DATA_FLASH((hdr), (fap), (start), (output), (size))
	#endif /* MCUBOOT_MULTI_MEMORY_LOAD */

	#ifdef __cplusplus
	}
	#endif

	#endif