blob: 625005016b67fe758db871bf03e1083eb0bfe03f [file] [log] [blame]
Christopher Collins92ea77f2016-12-12 15:59:26 -08001/*
2 * Licensed to the Apache Software Foundation (ASF) under one
3 * or more contributor license agreements. See the NOTICE file
4 * distributed with this work for additional information
5 * regarding copyright ownership. The ASF licenses this file
6 * to you under the Apache License, Version 2.0 (the
7 * "License"); you may not use this file except in compliance
8 * with the License. You may obtain a copy of the License at
9 *
10 * http://www.apache.org/licenses/LICENSE-2.0
11 *
12 * Unless required by applicable law or agreed to in writing,
13 * software distributed under the License is distributed on an
14 * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
15 * KIND, either express or implied. See the License for the
16 * specific language governing permissions and limitations
17 * under the License.
18 */
19
20/**
21 * This file provides an interface to the boot loader. Functions defined in
22 * this file should only be called while the boot loader is running.
23 */
24
25#include <assert.h>
26#include <stddef.h>
David Brown52eee562017-07-05 11:25:09 -060027#include <stdbool.h>
Christopher Collins92ea77f2016-12-12 15:59:26 -080028#include <inttypes.h>
29#include <stdlib.h>
30#include <string.h>
Christopher Collins92ea77f2016-12-12 15:59:26 -080031#include <hal/hal_flash.h>
32#include <os/os_malloc.h>
33#include "bootutil/bootutil.h"
34#include "bootutil/image.h"
35#include "bootutil_priv.h"
36
Marti Bolivarfd20c762017-02-07 16:52:50 -050037#define BOOT_LOG_LEVEL BOOT_LOG_LEVEL_INFO
38#include "bootutil/bootutil_log.h"
39
Fabio Utzigba1fbe62017-07-21 14:01:20 -030040#ifdef MCUBOOT_MYNEWT
41#include "mcuboot_config/mcuboot_config.h"
Fabio Utzigeed80b62017-06-10 08:03:05 -030042#endif
43
Marti Bolivar9b1f8bb2017-06-12 15:24:13 -040044static struct boot_loader_state boot_data;
Christopher Collins92ea77f2016-12-12 15:59:26 -080045
46struct boot_status_table {
47 /**
48 * For each field, a value of 0 means "any".
49 */
50 uint8_t bst_magic_slot0;
51 uint8_t bst_magic_scratch;
52 uint8_t bst_copy_done_slot0;
53 uint8_t bst_status_source;
54};
55
56/**
57 * This set of tables maps swap state contents to boot status location.
58 * When searching for a match, these tables must be iterated in order.
59 */
60static const struct boot_status_table boot_status_tables[] = {
61 {
62 /* | slot-0 | scratch |
63 * ----------+------------+------------|
64 * magic | Good | Any |
65 * copy-done | 0x01 | N/A |
66 * ----------+------------+------------'
67 * source: none |
68 * ------------------------------------'
69 */
70 .bst_magic_slot0 = BOOT_MAGIC_GOOD,
71 .bst_magic_scratch = 0,
72 .bst_copy_done_slot0 = 0x01,
73 .bst_status_source = BOOT_STATUS_SOURCE_NONE,
74 },
75
76 {
77 /* | slot-0 | scratch |
78 * ----------+------------+------------|
79 * magic | Good | Any |
80 * copy-done | 0xff | N/A |
81 * ----------+------------+------------'
82 * source: slot 0 |
83 * ------------------------------------'
84 */
85 .bst_magic_slot0 = BOOT_MAGIC_GOOD,
86 .bst_magic_scratch = 0,
87 .bst_copy_done_slot0 = 0xff,
88 .bst_status_source = BOOT_STATUS_SOURCE_SLOT0,
89 },
90
91 {
92 /* | slot-0 | scratch |
93 * ----------+------------+------------|
94 * magic | Any | Good |
95 * copy-done | Any | N/A |
96 * ----------+------------+------------'
97 * source: scratch |
98 * ------------------------------------'
99 */
100 .bst_magic_slot0 = 0,
101 .bst_magic_scratch = BOOT_MAGIC_GOOD,
102 .bst_copy_done_slot0 = 0,
103 .bst_status_source = BOOT_STATUS_SOURCE_SCRATCH,
104 },
105
106 {
107 /* | slot-0 | scratch |
108 * ----------+------------+------------|
109 * magic | Unset | Any |
110 * copy-done | 0xff | N/A |
111 * ----------+------------+------------|
112 * source: varies |
113 * ------------------------------------+------------------------------+
114 * This represents one of two cases: |
115 * o No swaps ever (no status to read, so no harm in checking). |
116 * o Mid-revert; status in slot 0. |
117 * -------------------------------------------------------------------'
118 */
119 .bst_magic_slot0 = BOOT_MAGIC_UNSET,
120 .bst_magic_scratch = 0,
121 .bst_copy_done_slot0 = 0xff,
122 .bst_status_source = BOOT_STATUS_SOURCE_SLOT0,
123 },
124};
125
126#define BOOT_STATUS_TABLES_COUNT \
127 (sizeof boot_status_tables / sizeof boot_status_tables[0])
128
Marti Bolivarfd20c762017-02-07 16:52:50 -0500129#define BOOT_LOG_SWAP_STATE(area, state) \
130 BOOT_LOG_INF("%s: magic=%s, copy_done=0x%x, image_ok=0x%x", \
131 (area), \
132 ((state)->magic == BOOT_MAGIC_GOOD ? "good" : \
133 (state)->magic == BOOT_MAGIC_UNSET ? "unset" : \
134 "bad"), \
135 (state)->copy_done, \
136 (state)->image_ok)
137
Christopher Collins92ea77f2016-12-12 15:59:26 -0800138/**
139 * Determines where in flash the most recent boot status is stored. The boot
140 * status is necessary for completing a swap that was interrupted by a boot
141 * loader reset.
142 *
143 * @return A BOOT_STATUS_SOURCE_[...] code indicating where * status should be read from.
144 */
145static int
146boot_status_source(void)
147{
148 const struct boot_status_table *table;
149 struct boot_swap_state state_scratch;
150 struct boot_swap_state state_slot0;
Christopher Collins92ea77f2016-12-12 15:59:26 -0800151 int rc;
152 int i;
Marti Bolivarfd20c762017-02-07 16:52:50 -0500153 uint8_t source;
Christopher Collins92ea77f2016-12-12 15:59:26 -0800154
Fabio Utzig2473ac02017-05-02 12:45:02 -0300155 rc = boot_read_swap_state_by_id(FLASH_AREA_IMAGE_0, &state_slot0);
Christopher Collins92ea77f2016-12-12 15:59:26 -0800156 assert(rc == 0);
157
Fabio Utzig2473ac02017-05-02 12:45:02 -0300158 rc = boot_read_swap_state_by_id(FLASH_AREA_IMAGE_SCRATCH, &state_scratch);
Christopher Collins92ea77f2016-12-12 15:59:26 -0800159 assert(rc == 0);
160
Marti Bolivarfd20c762017-02-07 16:52:50 -0500161 BOOT_LOG_SWAP_STATE("Image 0", &state_slot0);
Marti Bolivarfd20c762017-02-07 16:52:50 -0500162 BOOT_LOG_SWAP_STATE("Scratch", &state_scratch);
163
Christopher Collins92ea77f2016-12-12 15:59:26 -0800164 for (i = 0; i < BOOT_STATUS_TABLES_COUNT; i++) {
Fabio Utzig7ebb7c22017-04-26 10:59:31 -0300165 table = &boot_status_tables[i];
Christopher Collins92ea77f2016-12-12 15:59:26 -0800166
167 if ((table->bst_magic_slot0 == 0 ||
168 table->bst_magic_slot0 == state_slot0.magic) &&
169 (table->bst_magic_scratch == 0 ||
170 table->bst_magic_scratch == state_scratch.magic) &&
171 (table->bst_copy_done_slot0 == 0 ||
172 table->bst_copy_done_slot0 == state_slot0.copy_done)) {
Marti Bolivarfd20c762017-02-07 16:52:50 -0500173 source = table->bst_status_source;
174 BOOT_LOG_INF("Boot source: %s",
175 source == BOOT_STATUS_SOURCE_NONE ? "none" :
176 source == BOOT_STATUS_SOURCE_SCRATCH ? "scratch" :
177 source == BOOT_STATUS_SOURCE_SLOT0 ? "slot 0" :
178 "BUG; can't happen");
179 return source;
Christopher Collins92ea77f2016-12-12 15:59:26 -0800180 }
181 }
182
Marti Bolivarfd20c762017-02-07 16:52:50 -0500183 BOOT_LOG_INF("Boot source: none");
Christopher Collins92ea77f2016-12-12 15:59:26 -0800184 return BOOT_STATUS_SOURCE_NONE;
185}
186
187/**
188 * Calculates the type of swap that just completed.
Fabio Utzigb5b2f552017-06-30 10:03:47 -0300189 *
190 * This is used when a swap is interrupted by an external event. After
191 * finishing the swap operation determines what the initial request was.
Christopher Collins92ea77f2016-12-12 15:59:26 -0800192 */
193static int
194boot_previous_swap_type(void)
195{
196 int post_swap_type;
Christopher Collins92ea77f2016-12-12 15:59:26 -0800197
198 post_swap_type = boot_swap_type();
199
Fabio Utzigb5b2f552017-06-30 10:03:47 -0300200 switch (post_swap_type) {
201 case BOOT_SWAP_TYPE_NONE : return BOOT_SWAP_TYPE_PERM;
202 case BOOT_SWAP_TYPE_REVERT : return BOOT_SWAP_TYPE_TEST;
203 case BOOT_SWAP_TYPE_PANIC : return BOOT_SWAP_TYPE_PANIC;
Christopher Collins92ea77f2016-12-12 15:59:26 -0800204 }
Fabio Utzig7ebb7c22017-04-26 10:59:31 -0300205
Fabio Utzigb5b2f552017-06-30 10:03:47 -0300206 return BOOT_SWAP_TYPE_FAIL;
Christopher Collins92ea77f2016-12-12 15:59:26 -0800207}
208
David Brownf5b33d82017-09-01 10:58:27 -0600209/*
210 * Compute the total size of the given image. Includes the size of
211 * the TLVs.
212 */
Fabio Utzig36ec0e72017-09-05 08:10:33 -0300213#ifndef MCUBOOT_OVERWRITE_ONLY
David Brownf5b33d82017-09-01 10:58:27 -0600214static int
215boot_read_image_size(int slot, struct image_header *hdr, uint32_t *size)
216{
217 const struct flash_area *fap;
218 struct image_tlv_info info;
219 int area_id;
220 int rc;
221
222 area_id = flash_area_id_from_image_slot(slot);
223 rc = flash_area_open(area_id, &fap);
224 if (rc != 0) {
225 rc = BOOT_EFLASH;
226 goto done;
227 }
228
229 rc = flash_area_read(fap, hdr->ih_hdr_size + hdr->ih_img_size,
230 &info, sizeof(info));
231 if (rc != 0) {
232 rc = BOOT_EFLASH;
233 goto done;
234 }
235 if (info.it_magic != IMAGE_TLV_INFO_MAGIC) {
236 rc = BOOT_EBADIMAGE;
237 goto done;
238 }
239 *size = hdr->ih_hdr_size + hdr->ih_img_size + info.it_tlv_tot;
240 rc = 0;
241
242done:
243 flash_area_close(fap);
Fabio Utzig2eebf112017-09-04 15:25:08 -0300244 return rc;
David Brownf5b33d82017-09-01 10:58:27 -0600245}
Fabio Utzig36ec0e72017-09-05 08:10:33 -0300246#endif /* !MCUBOOT_OVERWRITE_ONLY */
David Brownf5b33d82017-09-01 10:58:27 -0600247
Fabio Utzigc08ed212017-06-20 19:28:36 -0300248static int
Christopher Collins92ea77f2016-12-12 15:59:26 -0800249boot_read_image_header(int slot, struct image_header *out_hdr)
250{
251 const struct flash_area *fap;
252 int area_id;
253 int rc;
254
255 area_id = flash_area_id_from_image_slot(slot);
256 rc = flash_area_open(area_id, &fap);
257 if (rc != 0) {
258 rc = BOOT_EFLASH;
259 goto done;
260 }
261
262 rc = flash_area_read(fap, 0, out_hdr, sizeof *out_hdr);
263 if (rc != 0) {
264 rc = BOOT_EFLASH;
265 goto done;
266 }
267
268 rc = 0;
269
270done:
271 flash_area_close(fap);
272 return rc;
273}
274
275static int
276boot_read_image_headers(void)
277{
278 int rc;
279 int i;
280
281 for (i = 0; i < BOOT_NUM_SLOTS; i++) {
Marti Bolivarf804f622017-06-12 15:41:48 -0400282 rc = boot_read_image_header(i, boot_img_hdr(&boot_data, i));
Christopher Collins92ea77f2016-12-12 15:59:26 -0800283 if (rc != 0) {
Fabio Utzig7ebb7c22017-04-26 10:59:31 -0300284 /* If at least the first slot's header was read successfully, then
285 * the boot loader can attempt a boot. Failure to read any headers
286 * is a fatal error.
Christopher Collins0ff3c6c2016-12-21 12:04:17 -0800287 */
288 if (i > 0) {
289 return 0;
290 } else {
291 return rc;
292 }
Christopher Collins92ea77f2016-12-12 15:59:26 -0800293 }
294 }
295
296 return 0;
297}
298
299static uint8_t
300boot_write_sz(void)
301{
302 uint8_t elem_sz;
303 uint8_t align;
304
305 /* Figure out what size to write update status update as. The size depends
306 * on what the minimum write size is for scratch area, active image slot.
307 * We need to use the bigger of those 2 values.
308 */
Marti Bolivare2587152017-06-12 15:52:05 -0400309 elem_sz = hal_flash_align(boot_img_fa_device_id(&boot_data, 0));
310 align = hal_flash_align(boot_scratch_fa_device_id(&boot_data));
Christopher Collins92ea77f2016-12-12 15:59:26 -0800311 if (align > elem_sz) {
312 elem_sz = align;
313 }
314
315 return elem_sz;
316}
317
Christopher Collins0ff3c6c2016-12-21 12:04:17 -0800318static int
319boot_slots_compatible(void)
320{
Marti Bolivard3269fd2017-06-12 16:31:12 -0400321 size_t num_sectors_0 = boot_img_num_sectors(&boot_data, 0);
322 size_t num_sectors_1 = boot_img_num_sectors(&boot_data, 1);
323 size_t size_0, size_1;
324 size_t i;
Christopher Collins0ff3c6c2016-12-21 12:04:17 -0800325
326 /* Ensure both image slots have identical sector layouts. */
Marti Bolivard3269fd2017-06-12 16:31:12 -0400327 if (num_sectors_0 != num_sectors_1) {
Christopher Collins0ff3c6c2016-12-21 12:04:17 -0800328 return 0;
329 }
Marti Bolivard3269fd2017-06-12 16:31:12 -0400330 for (i = 0; i < num_sectors_0; i++) {
331 size_0 = boot_img_sector_size(&boot_data, 0, i);
332 size_1 = boot_img_sector_size(&boot_data, 1, i);
333 if (size_0 != size_1) {
Christopher Collins0ff3c6c2016-12-21 12:04:17 -0800334 return 0;
335 }
336 }
337
338 return 1;
339}
340
Christopher Collins92ea77f2016-12-12 15:59:26 -0800341/**
342 * Determines the sector layout of both image slots and the scratch area.
343 * This information is necessary for calculating the number of bytes to erase
344 * and copy during an image swap. The information collected during this
345 * function is used to populate the boot_data global.
346 */
347static int
348boot_read_sectors(void)
349{
Christopher Collins92ea77f2016-12-12 15:59:26 -0800350 int rc;
Christopher Collins92ea77f2016-12-12 15:59:26 -0800351
Marti Bolivarcca28a92017-06-12 16:52:22 -0400352 rc = boot_initialize_area(&boot_data, FLASH_AREA_IMAGE_0);
Christopher Collins92ea77f2016-12-12 15:59:26 -0800353 if (rc != 0) {
354 return BOOT_EFLASH;
355 }
356
Marti Bolivarcca28a92017-06-12 16:52:22 -0400357 rc = boot_initialize_area(&boot_data, FLASH_AREA_IMAGE_1);
Christopher Collins92ea77f2016-12-12 15:59:26 -0800358 if (rc != 0) {
359 return BOOT_EFLASH;
360 }
361
Marti Bolivare10a7392017-06-14 16:20:07 -0400362 BOOT_WRITE_SZ(&boot_data) = boot_write_sz();
Christopher Collins92ea77f2016-12-12 15:59:26 -0800363
364 return 0;
365}
366
367static uint32_t
368boot_status_internal_off(int idx, int state, int elem_sz)
369{
370 int idx_sz;
371
372 idx_sz = elem_sz * BOOT_STATUS_STATE_COUNT;
373
374 return idx * idx_sz + state * elem_sz;
375}
376
377/**
378 * Reads the status of a partially-completed swap, if any. This is necessary
379 * to recover in case the boot lodaer was reset in the middle of a swap
380 * operation.
381 */
382static int
383boot_read_status_bytes(const struct flash_area *fap, struct boot_status *bs)
384{
385 uint32_t off;
386 uint8_t status;
Fabio Utzig7ebb7c22017-04-26 10:59:31 -0300387 int max_entries;
Christopher Collins92ea77f2016-12-12 15:59:26 -0800388 int found;
389 int rc;
390 int i;
391
392 off = boot_status_off(fap);
Fabio Utzig4cee4f72017-05-22 10:59:57 -0400393 max_entries = boot_status_entries(fap);
Fabio Utzig7ebb7c22017-04-26 10:59:31 -0300394
Christopher Collins92ea77f2016-12-12 15:59:26 -0800395 found = 0;
Fabio Utzig7ebb7c22017-04-26 10:59:31 -0300396 for (i = 0; i < max_entries; i++) {
Marti Bolivare10a7392017-06-14 16:20:07 -0400397 rc = flash_area_read(fap, off + i * BOOT_WRITE_SZ(&boot_data),
398 &status, 1);
Christopher Collins92ea77f2016-12-12 15:59:26 -0800399 if (rc != 0) {
400 return BOOT_EFLASH;
401 }
402
403 if (status == 0xff) {
404 if (found) {
405 break;
406 }
407 } else if (!found) {
408 found = 1;
409 }
410 }
411
412 if (found) {
413 i--;
Fabio Utzig94d998c2017-05-22 11:02:41 -0400414 bs->idx = i / BOOT_STATUS_STATE_COUNT;
415 bs->state = i % BOOT_STATUS_STATE_COUNT;
Christopher Collins92ea77f2016-12-12 15:59:26 -0800416 }
417
418 return 0;
419}
420
421/**
422 * Reads the boot status from the flash. The boot status contains
423 * the current state of an interrupted image copy operation. If the boot
424 * status is not present, or it indicates that previous copy finished,
425 * there is no operation in progress.
426 */
427static int
428boot_read_status(struct boot_status *bs)
429{
430 const struct flash_area *fap;
431 int status_loc;
432 int area_id;
433 int rc;
434
435 memset(bs, 0, sizeof *bs);
436
437 status_loc = boot_status_source();
438 switch (status_loc) {
439 case BOOT_STATUS_SOURCE_NONE:
440 return 0;
441
442 case BOOT_STATUS_SOURCE_SCRATCH:
443 area_id = FLASH_AREA_IMAGE_SCRATCH;
444 break;
445
446 case BOOT_STATUS_SOURCE_SLOT0:
447 area_id = FLASH_AREA_IMAGE_0;
448 break;
449
450 default:
451 assert(0);
452 return BOOT_EBADARGS;
453 }
454
455 rc = flash_area_open(area_id, &fap);
456 if (rc != 0) {
457 return BOOT_EFLASH;
458 }
459
Fabio Utzig46490722017-09-04 15:34:32 -0300460 rc = boot_read_status_bytes(fap, bs);
461
462 flash_area_close(fap);
463 return rc;
Christopher Collins92ea77f2016-12-12 15:59:26 -0800464}
465
466/**
467 * Writes the supplied boot status to the flash file system. The boot status
468 * contains the current state of an in-progress image copy operation.
469 *
470 * @param bs The boot status to write.
471 *
472 * @return 0 on success; nonzero on failure.
473 */
474int
475boot_write_status(struct boot_status *bs)
476{
477 const struct flash_area *fap;
478 uint32_t off;
479 int area_id;
480 int rc;
Fabio Utziga0bc9b52017-06-28 09:19:55 -0300481 uint8_t buf[BOOT_MAX_ALIGN];
David Brown9d725462017-01-23 15:50:58 -0700482 uint8_t align;
Christopher Collins92ea77f2016-12-12 15:59:26 -0800483
Fabio Utzig7ebb7c22017-04-26 10:59:31 -0300484 /* NOTE: The first sector copied (that is the last sector on slot) contains
485 * the trailer. Since in the last step SLOT 0 is erased, the first
486 * two status writes go to the scratch which will be copied to SLOT 0!
487 */
488
Fabio Utzig2473ac02017-05-02 12:45:02 -0300489 if (bs->use_scratch) {
Christopher Collins92ea77f2016-12-12 15:59:26 -0800490 /* Write to scratch. */
491 area_id = FLASH_AREA_IMAGE_SCRATCH;
492 } else {
493 /* Write to slot 0. */
494 area_id = FLASH_AREA_IMAGE_0;
495 }
496
497 rc = flash_area_open(area_id, &fap);
498 if (rc != 0) {
499 rc = BOOT_EFLASH;
500 goto done;
501 }
502
503 off = boot_status_off(fap) +
Marti Bolivare10a7392017-06-14 16:20:07 -0400504 boot_status_internal_off(bs->idx, bs->state,
505 BOOT_WRITE_SZ(&boot_data));
Christopher Collins92ea77f2016-12-12 15:59:26 -0800506
David Brown9d725462017-01-23 15:50:58 -0700507 align = hal_flash_align(fap->fa_device_id);
Fabio Utziga0bc9b52017-06-28 09:19:55 -0300508 memset(buf, 0xFF, BOOT_MAX_ALIGN);
David Brown9d725462017-01-23 15:50:58 -0700509 buf[0] = bs->state;
510
511 rc = flash_area_write(fap, off, buf, align);
Christopher Collins92ea77f2016-12-12 15:59:26 -0800512 if (rc != 0) {
513 rc = BOOT_EFLASH;
514 goto done;
515 }
516
517 rc = 0;
518
519done:
520 flash_area_close(fap);
521 return rc;
522}
523
524/*
525 * Validate image hash/signature in a slot.
526 */
527static int
528boot_image_check(struct image_header *hdr, const struct flash_area *fap)
529{
David Browndb1d9d32017-01-06 11:07:54 -0700530 static uint8_t tmpbuf[BOOT_TMPBUF_SZ];
Christopher Collins92ea77f2016-12-12 15:59:26 -0800531
Christopher Collins92ea77f2016-12-12 15:59:26 -0800532 if (bootutil_img_validate(hdr, fap, tmpbuf, BOOT_TMPBUF_SZ,
533 NULL, 0, NULL)) {
534 return BOOT_EBADIMAGE;
535 }
536 return 0;
537}
538
539static int
540split_image_check(struct image_header *app_hdr,
541 const struct flash_area *app_fap,
542 struct image_header *loader_hdr,
543 const struct flash_area *loader_fap)
544{
545 static void *tmpbuf;
546 uint8_t loader_hash[32];
547
548 if (!tmpbuf) {
549 tmpbuf = malloc(BOOT_TMPBUF_SZ);
550 if (!tmpbuf) {
551 return BOOT_ENOMEM;
552 }
553 }
554
555 if (bootutil_img_validate(loader_hdr, loader_fap, tmpbuf, BOOT_TMPBUF_SZ,
556 NULL, 0, loader_hash)) {
557 return BOOT_EBADIMAGE;
558 }
559
560 if (bootutil_img_validate(app_hdr, app_fap, tmpbuf, BOOT_TMPBUF_SZ,
561 loader_hash, 32, NULL)) {
562 return BOOT_EBADIMAGE;
563 }
564
565 return 0;
566}
567
568static int
David Brownd930ec62016-12-14 07:59:48 -0700569boot_validate_slot(int slot)
Christopher Collins92ea77f2016-12-12 15:59:26 -0800570{
571 const struct flash_area *fap;
Marti Bolivarf804f622017-06-12 15:41:48 -0400572 struct image_header *hdr;
Christopher Collins92ea77f2016-12-12 15:59:26 -0800573 int rc;
Fabio Utzig7ebb7c22017-04-26 10:59:31 -0300574
Marti Bolivarf804f622017-06-12 15:41:48 -0400575 hdr = boot_img_hdr(&boot_data, slot);
576 if (hdr->ih_magic == 0xffffffff || hdr->ih_flags & IMAGE_F_NON_BOOTABLE) {
Fabio Utzig7ebb7c22017-04-26 10:59:31 -0300577 /* No bootable image in slot; continue booting from slot 0. */
Christopher Collins92ea77f2016-12-12 15:59:26 -0800578 return -1;
579 }
580
David Brownd930ec62016-12-14 07:59:48 -0700581 rc = flash_area_open(flash_area_id_from_image_slot(slot), &fap);
Christopher Collins92ea77f2016-12-12 15:59:26 -0800582 if (rc != 0) {
583 return BOOT_EFLASH;
584 }
585
Marti Bolivarf804f622017-06-12 15:41:48 -0400586 if ((hdr->ih_magic != IMAGE_MAGIC || boot_image_check(hdr, fap) != 0)) {
David Brownb38e0442017-02-24 13:57:12 -0700587 if (slot != 0) {
588 flash_area_erase(fap, 0, fap->fa_size);
589 /* Image in slot 1 is invalid. Erase the image and
590 * continue booting from slot 0.
591 */
592 }
Christopher Collins92ea77f2016-12-12 15:59:26 -0800593 return -1;
594 }
595
596 flash_area_close(fap);
597
598 /* Image in slot 1 is valid. */
599 return 0;
600}
601
602/**
603 * Determines which swap operation to perform, if any. If it is determined
604 * that a swap operation is required, the image in the second slot is checked
605 * for validity. If the image in the second slot is invalid, it is erased, and
606 * a swap type of "none" is indicated.
607 *
608 * @return The type of swap to perform (BOOT_SWAP_TYPE...)
609 */
610static int
611boot_validated_swap_type(void)
612{
613 int swap_type;
Christopher Collins92ea77f2016-12-12 15:59:26 -0800614
615 swap_type = boot_swap_type();
Fabio Utzigb5b2f552017-06-30 10:03:47 -0300616 switch (swap_type) {
617 case BOOT_SWAP_TYPE_TEST:
618 case BOOT_SWAP_TYPE_PERM:
619 case BOOT_SWAP_TYPE_REVERT:
620 /* Boot loader wants to switch to slot 1. Ensure image is valid. */
621 if (boot_validate_slot(1) != 0) {
622 swap_type = BOOT_SWAP_TYPE_FAIL;
623 }
Christopher Collins92ea77f2016-12-12 15:59:26 -0800624 }
625
626 return swap_type;
627}
628
629/**
630 * Calculates the number of sectors the scratch area can contain. A "last"
631 * source sector is specified because images are copied backwards in flash
632 * (final index to index number 0).
633 *
634 * @param last_sector_idx The index of the last source sector
635 * (inclusive).
636 * @param out_first_sector_idx The index of the first source sector
637 * (inclusive) gets written here.
638 *
639 * @return The number of bytes comprised by the
640 * [first-sector, last-sector] range.
641 */
Fabio Utzig3488eef2017-06-12 10:25:43 -0300642#ifndef MCUBOOT_OVERWRITE_ONLY
Christopher Collins92ea77f2016-12-12 15:59:26 -0800643static uint32_t
644boot_copy_sz(int last_sector_idx, int *out_first_sector_idx)
645{
Marti Bolivard3269fd2017-06-12 16:31:12 -0400646 size_t scratch_sz;
Christopher Collins92ea77f2016-12-12 15:59:26 -0800647 uint32_t new_sz;
648 uint32_t sz;
649 int i;
650
651 sz = 0;
652
Marti Bolivard3269fd2017-06-12 16:31:12 -0400653 scratch_sz = boot_scratch_area_size(&boot_data);
Christopher Collins92ea77f2016-12-12 15:59:26 -0800654 for (i = last_sector_idx; i >= 0; i--) {
Marti Bolivard3269fd2017-06-12 16:31:12 -0400655 new_sz = sz + boot_img_sector_size(&boot_data, 0, i);
656 if (new_sz > scratch_sz) {
Christopher Collins92ea77f2016-12-12 15:59:26 -0800657 break;
658 }
659 sz = new_sz;
660 }
661
662 /* i currently refers to a sector that doesn't fit or it is -1 because all
663 * sectors have been processed. In both cases, exclude sector i.
664 */
665 *out_first_sector_idx = i + 1;
666 return sz;
667}
Fabio Utzig3488eef2017-06-12 10:25:43 -0300668#endif /* !MCUBOOT_OVERWRITE_ONLY */
Christopher Collins92ea77f2016-12-12 15:59:26 -0800669
670/**
671 * Erases a region of flash.
672 *
673 * @param flash_area_idx The ID of the flash area containing the region
674 * to erase.
675 * @param off The offset within the flash area to start the
676 * erase.
677 * @param sz The number of bytes to erase.
678 *
679 * @return 0 on success; nonzero on failure.
680 */
681static int
682boot_erase_sector(int flash_area_id, uint32_t off, uint32_t sz)
683{
684 const struct flash_area *fap;
685 int rc;
686
687 rc = flash_area_open(flash_area_id, &fap);
688 if (rc != 0) {
689 rc = BOOT_EFLASH;
690 goto done;
691 }
692
693 rc = flash_area_erase(fap, off, sz);
694 if (rc != 0) {
695 rc = BOOT_EFLASH;
696 goto done;
697 }
698
699 rc = 0;
700
701done:
702 flash_area_close(fap);
703 return rc;
704}
705
706/**
707 * Copies the contents of one flash region to another. You must erase the
708 * destination region prior to calling this function.
709 *
710 * @param flash_area_id_src The ID of the source flash area.
711 * @param flash_area_id_dst The ID of the destination flash area.
712 * @param off_src The offset within the source flash area to
713 * copy from.
714 * @param off_dst The offset within the destination flash area to
715 * copy to.
716 * @param sz The number of bytes to copy.
717 *
718 * @return 0 on success; nonzero on failure.
719 */
720static int
721boot_copy_sector(int flash_area_id_src, int flash_area_id_dst,
722 uint32_t off_src, uint32_t off_dst, uint32_t sz)
723{
724 const struct flash_area *fap_src;
725 const struct flash_area *fap_dst;
726 uint32_t bytes_copied;
727 int chunk_sz;
728 int rc;
729
730 static uint8_t buf[1024];
731
732 fap_src = NULL;
733 fap_dst = NULL;
734
735 rc = flash_area_open(flash_area_id_src, &fap_src);
736 if (rc != 0) {
737 rc = BOOT_EFLASH;
738 goto done;
739 }
740
741 rc = flash_area_open(flash_area_id_dst, &fap_dst);
742 if (rc != 0) {
743 rc = BOOT_EFLASH;
744 goto done;
745 }
746
747 bytes_copied = 0;
748 while (bytes_copied < sz) {
749 if (sz - bytes_copied > sizeof buf) {
750 chunk_sz = sizeof buf;
751 } else {
752 chunk_sz = sz - bytes_copied;
753 }
754
755 rc = flash_area_read(fap_src, off_src + bytes_copied, buf, chunk_sz);
756 if (rc != 0) {
757 rc = BOOT_EFLASH;
758 goto done;
759 }
760
761 rc = flash_area_write(fap_dst, off_dst + bytes_copied, buf, chunk_sz);
762 if (rc != 0) {
763 rc = BOOT_EFLASH;
764 goto done;
765 }
766
767 bytes_copied += chunk_sz;
768 }
769
770 rc = 0;
771
772done:
Fabio Utzige7686262017-06-28 09:26:54 -0300773 if (fap_src) {
774 flash_area_close(fap_src);
775 }
776 if (fap_dst) {
777 flash_area_close(fap_dst);
778 }
Christopher Collins92ea77f2016-12-12 15:59:26 -0800779 return rc;
780}
781
Fabio Utzig2473ac02017-05-02 12:45:02 -0300782static inline int
Fabio Utzig46490722017-09-04 15:34:32 -0300783boot_status_init_by_id(int flash_area_id, const struct boot_status *bs)
Fabio Utzig2473ac02017-05-02 12:45:02 -0300784{
785 const struct flash_area *fap;
786 struct boot_swap_state swap_state;
787 int rc;
788
789 rc = flash_area_open(flash_area_id, &fap);
790 assert(rc == 0);
791
792 rc = boot_read_swap_state_by_id(FLASH_AREA_IMAGE_1, &swap_state);
793 assert(rc == 0);
794
Fabio Utzigde8a38a2017-05-23 11:15:01 -0400795 if (swap_state.image_ok == BOOT_FLAG_SET) {
Fabio Utzig2473ac02017-05-02 12:45:02 -0300796 rc = boot_write_image_ok(fap);
797 assert(rc == 0);
798 }
799
Fabio Utzig46490722017-09-04 15:34:32 -0300800 rc = boot_write_swap_size(fap, bs->swap_size);
801 assert(rc == 0);
802
Fabio Utzig2473ac02017-05-02 12:45:02 -0300803 rc = boot_write_magic(fap);
804 assert(rc == 0);
805
806 flash_area_close(fap);
807
808 return 0;
809}
810
Fabio Utzig358c9352017-07-25 22:10:45 -0300811#ifndef MCUBOOT_OVERWRITE_ONLY
Fabio Utzig2473ac02017-05-02 12:45:02 -0300812static int
813boot_erase_last_sector_by_id(int flash_area_id)
814{
815 uint8_t slot;
816 uint32_t last_sector;
Fabio Utzig2473ac02017-05-02 12:45:02 -0300817 int rc;
818
819 switch (flash_area_id) {
820 case FLASH_AREA_IMAGE_0:
821 slot = 0;
822 break;
823 case FLASH_AREA_IMAGE_1:
824 slot = 1;
825 break;
826 default:
827 return BOOT_EFLASH;
828 }
829
Marti Bolivard3269fd2017-06-12 16:31:12 -0400830 last_sector = boot_img_num_sectors(&boot_data, slot) - 1;
Fabio Utzig2473ac02017-05-02 12:45:02 -0300831 rc = boot_erase_sector(flash_area_id,
Marti Bolivarea088872017-06-12 17:10:49 -0400832 boot_img_sector_off(&boot_data, slot, last_sector),
Marti Bolivard3269fd2017-06-12 16:31:12 -0400833 boot_img_sector_size(&boot_data, slot, last_sector));
Fabio Utzig2473ac02017-05-02 12:45:02 -0300834 assert(rc == 0);
835
836 return rc;
837}
Fabio Utzig358c9352017-07-25 22:10:45 -0300838#endif /* !MCUBOOT_OVERWRITE_ONLY */
Fabio Utzig2473ac02017-05-02 12:45:02 -0300839
Christopher Collins92ea77f2016-12-12 15:59:26 -0800840/**
841 * Swaps the contents of two flash regions within the two image slots.
842 *
843 * @param idx The index of the first sector in the range of
844 * sectors being swapped.
845 * @param sz The number of bytes to swap.
846 * @param bs The current boot status. This struct gets
847 * updated according to the outcome.
848 *
849 * @return 0 on success; nonzero on failure.
850 */
Fabio Utzig3488eef2017-06-12 10:25:43 -0300851#ifndef MCUBOOT_OVERWRITE_ONLY
Christopher Collins4772ac42017-02-27 20:08:01 -0800852static void
Christopher Collins92ea77f2016-12-12 15:59:26 -0800853boot_swap_sectors(int idx, uint32_t sz, struct boot_status *bs)
854{
Fabio Utzig7ebb7c22017-04-26 10:59:31 -0300855 const struct flash_area *fap;
Christopher Collins92ea77f2016-12-12 15:59:26 -0800856 uint32_t copy_sz;
Fabio Utzig7ebb7c22017-04-26 10:59:31 -0300857 uint32_t trailer_sz;
Christopher Collins92ea77f2016-12-12 15:59:26 -0800858 uint32_t img_off;
Fabio Utzig7ebb7c22017-04-26 10:59:31 -0300859 uint32_t scratch_trailer_off;
860 struct boot_swap_state swap_state;
Marti Bolivard3269fd2017-06-12 16:31:12 -0400861 size_t last_sector;
Christopher Collins92ea77f2016-12-12 15:59:26 -0800862 int rc;
863
864 /* Calculate offset from start of image area. */
Marti Bolivarea088872017-06-12 17:10:49 -0400865 img_off = boot_img_sector_off(&boot_data, 0, idx);
Christopher Collins92ea77f2016-12-12 15:59:26 -0800866
Fabio Utzig7ebb7c22017-04-26 10:59:31 -0300867 copy_sz = sz;
Marti Bolivare10a7392017-06-14 16:20:07 -0400868 trailer_sz = boot_slots_trailer_sz(BOOT_WRITE_SZ(&boot_data));
Fabio Utzig9678c972017-05-23 11:28:56 -0400869
870 /* sz in this function is always is always sized on a multiple of the
Marti Bolivarea088872017-06-12 17:10:49 -0400871 * sector size. The check against the start offset of the last sector
Fabio Utzig9678c972017-05-23 11:28:56 -0400872 * is to determine if we're swapping the last sector. The last sector
873 * needs special handling because it's where the trailer lives. If we're
874 * copying it, we need to use scratch to write the trailer temporarily.
875 *
876 * NOTE: `use_scratch` is a temporary flag (never written to flash) which
877 * controls if special handling is needed (swapping last sector).
878 */
Marti Bolivard3269fd2017-06-12 16:31:12 -0400879 last_sector = boot_img_num_sectors(&boot_data, 0) - 1;
Marti Bolivarea088872017-06-12 17:10:49 -0400880 if (img_off + sz > boot_img_sector_off(&boot_data, 0, last_sector)) {
Fabio Utzig7ebb7c22017-04-26 10:59:31 -0300881 copy_sz -= trailer_sz;
882 }
883
Fabio Utzig2473ac02017-05-02 12:45:02 -0300884 bs->use_scratch = (bs->idx == 0 && copy_sz != sz);
885
Christopher Collins92ea77f2016-12-12 15:59:26 -0800886 if (bs->state == 0) {
887 rc = boot_erase_sector(FLASH_AREA_IMAGE_SCRATCH, 0, sz);
Christopher Collins4772ac42017-02-27 20:08:01 -0800888 assert(rc == 0);
Christopher Collins92ea77f2016-12-12 15:59:26 -0800889
890 rc = boot_copy_sector(FLASH_AREA_IMAGE_1, FLASH_AREA_IMAGE_SCRATCH,
Fabio Utzig7ebb7c22017-04-26 10:59:31 -0300891 img_off, 0, copy_sz);
Christopher Collins4772ac42017-02-27 20:08:01 -0800892 assert(rc == 0);
Christopher Collins92ea77f2016-12-12 15:59:26 -0800893
Fabio Utzig2473ac02017-05-02 12:45:02 -0300894 if (bs->idx == 0) {
895 if (bs->use_scratch) {
Fabio Utzig46490722017-09-04 15:34:32 -0300896 boot_status_init_by_id(FLASH_AREA_IMAGE_SCRATCH, bs);
Fabio Utzig2473ac02017-05-02 12:45:02 -0300897 } else {
898 /* Prepare the status area... here it is known that the
899 * last sector is not being used by the image data so it's
900 * safe to erase.
901 */
902 rc = boot_erase_last_sector_by_id(FLASH_AREA_IMAGE_0);
Fabio Utzig7ebb7c22017-04-26 10:59:31 -0300903 assert(rc == 0);
Fabio Utzig2473ac02017-05-02 12:45:02 -0300904
Fabio Utzig46490722017-09-04 15:34:32 -0300905 boot_status_init_by_id(FLASH_AREA_IMAGE_0, bs);
Fabio Utzig7ebb7c22017-04-26 10:59:31 -0300906 }
Fabio Utzig7ebb7c22017-04-26 10:59:31 -0300907 }
908
Christopher Collins92ea77f2016-12-12 15:59:26 -0800909 bs->state = 1;
Christopher Collins4772ac42017-02-27 20:08:01 -0800910 rc = boot_write_status(bs);
911 assert(rc == 0);
Christopher Collins92ea77f2016-12-12 15:59:26 -0800912 }
Fabio Utzig7ebb7c22017-04-26 10:59:31 -0300913
Christopher Collins92ea77f2016-12-12 15:59:26 -0800914 if (bs->state == 1) {
915 rc = boot_erase_sector(FLASH_AREA_IMAGE_1, img_off, sz);
Christopher Collins4772ac42017-02-27 20:08:01 -0800916 assert(rc == 0);
Christopher Collins92ea77f2016-12-12 15:59:26 -0800917
Christopher Collins92ea77f2016-12-12 15:59:26 -0800918 rc = boot_copy_sector(FLASH_AREA_IMAGE_0, FLASH_AREA_IMAGE_1,
919 img_off, img_off, copy_sz);
Christopher Collins4772ac42017-02-27 20:08:01 -0800920 assert(rc == 0);
Christopher Collins92ea77f2016-12-12 15:59:26 -0800921
Fabio Utzig2473ac02017-05-02 12:45:02 -0300922 if (bs->idx == 0 && !bs->use_scratch) {
923 /* If not all sectors of the slot are being swapped,
924 * guarantee here that only slot0 will have the state.
925 */
926 rc = boot_erase_last_sector_by_id(FLASH_AREA_IMAGE_1);
927 assert(rc == 0);
928 }
929
Christopher Collins92ea77f2016-12-12 15:59:26 -0800930 bs->state = 2;
Christopher Collins4772ac42017-02-27 20:08:01 -0800931 rc = boot_write_status(bs);
932 assert(rc == 0);
Christopher Collins92ea77f2016-12-12 15:59:26 -0800933 }
Fabio Utzig7ebb7c22017-04-26 10:59:31 -0300934
Christopher Collins92ea77f2016-12-12 15:59:26 -0800935 if (bs->state == 2) {
936 rc = boot_erase_sector(FLASH_AREA_IMAGE_0, img_off, sz);
Christopher Collins4772ac42017-02-27 20:08:01 -0800937 assert(rc == 0);
Christopher Collins92ea77f2016-12-12 15:59:26 -0800938
Fabio Utzig7ebb7c22017-04-26 10:59:31 -0300939 /* NOTE: also copy trailer from scratch (has status info) */
Christopher Collins92ea77f2016-12-12 15:59:26 -0800940 rc = boot_copy_sector(FLASH_AREA_IMAGE_SCRATCH, FLASH_AREA_IMAGE_0,
Fabio Utzig7ebb7c22017-04-26 10:59:31 -0300941 0, img_off, copy_sz);
Christopher Collins4772ac42017-02-27 20:08:01 -0800942 assert(rc == 0);
Christopher Collins92ea77f2016-12-12 15:59:26 -0800943
Fabio Utzig94d998c2017-05-22 11:02:41 -0400944 if (bs->use_scratch) {
Fabio Utzig7ebb7c22017-04-26 10:59:31 -0300945 rc = flash_area_open(FLASH_AREA_IMAGE_SCRATCH, &fap);
946 assert(rc == 0);
947
948 scratch_trailer_off = boot_status_off(fap);
949
950 flash_area_close(fap);
951
952 rc = flash_area_open(FLASH_AREA_IMAGE_0, &fap);
953 assert(rc == 0);
954
955 /* copy current status that is being maintained in scratch */
956 rc = boot_copy_sector(FLASH_AREA_IMAGE_SCRATCH, FLASH_AREA_IMAGE_0,
Marti Bolivare10a7392017-06-14 16:20:07 -0400957 scratch_trailer_off,
Fabio Utziga0bc9b52017-06-28 09:19:55 -0300958 img_off + copy_sz,
Marti Bolivare10a7392017-06-14 16:20:07 -0400959 BOOT_STATUS_STATE_COUNT * BOOT_WRITE_SZ(&boot_data));
Fabio Utzig7ebb7c22017-04-26 10:59:31 -0300960 assert(rc == 0);
961
Fabio Utzig2473ac02017-05-02 12:45:02 -0300962 rc = boot_read_swap_state_by_id(FLASH_AREA_IMAGE_SCRATCH,
963 &swap_state);
Fabio Utzig7ebb7c22017-04-26 10:59:31 -0300964 assert(rc == 0);
965
Fabio Utzigde8a38a2017-05-23 11:15:01 -0400966 if (swap_state.image_ok == BOOT_FLAG_SET) {
Fabio Utzig7ebb7c22017-04-26 10:59:31 -0300967 rc = boot_write_image_ok(fap);
968 assert(rc == 0);
969 }
970
Fabio Utzig46490722017-09-04 15:34:32 -0300971 rc = boot_write_swap_size(fap, bs->swap_size);
972 assert(rc == 0);
973
Fabio Utzig7ebb7c22017-04-26 10:59:31 -0300974 rc = boot_write_magic(fap);
975 assert(rc == 0);
976
977 flash_area_close(fap);
978 }
979
Christopher Collins92ea77f2016-12-12 15:59:26 -0800980 bs->idx++;
981 bs->state = 0;
Fabio Utzig2473ac02017-05-02 12:45:02 -0300982 bs->use_scratch = 0;
Christopher Collins4772ac42017-02-27 20:08:01 -0800983 rc = boot_write_status(bs);
984 assert(rc == 0);
Christopher Collins92ea77f2016-12-12 15:59:26 -0800985 }
Christopher Collins92ea77f2016-12-12 15:59:26 -0800986}
Fabio Utzig3488eef2017-06-12 10:25:43 -0300987#endif /* !MCUBOOT_OVERWRITE_ONLY */
Christopher Collins92ea77f2016-12-12 15:59:26 -0800988
989/**
990 * Swaps the two images in flash. If a prior copy operation was interrupted
991 * by a system reset, this function completes that operation.
992 *
993 * @param bs The current boot status. This function reads
994 * this struct to determine if it is resuming
995 * an interrupted swap operation. This
996 * function writes the updated status to this
997 * function on return.
998 *
999 * @return 0 on success; nonzero on failure.
1000 */
Fabio Utzig3488eef2017-06-12 10:25:43 -03001001#ifdef MCUBOOT_OVERWRITE_ONLY
David Brown17609d82017-05-05 09:41:34 -06001002static int
1003boot_copy_image(struct boot_status *bs)
1004{
Marti Bolivard3269fd2017-06-12 16:31:12 -04001005 size_t sect_count;
1006 size_t sect;
David Brown17609d82017-05-05 09:41:34 -06001007 int rc;
Marti Bolivard3269fd2017-06-12 16:31:12 -04001008 size_t size = 0;
1009 size_t this_size;
David Brown17609d82017-05-05 09:41:34 -06001010
1011 BOOT_LOG_INF("Image upgrade slot1 -> slot0");
1012 BOOT_LOG_INF("Erasing slot0");
1013
Marti Bolivard3269fd2017-06-12 16:31:12 -04001014 sect_count = boot_img_num_sectors(&boot_data, 0);
David Brown17609d82017-05-05 09:41:34 -06001015 for (sect = 0; sect < sect_count; sect++) {
Marti Bolivard3269fd2017-06-12 16:31:12 -04001016 this_size = boot_img_sector_size(&boot_data, 0, sect);
David Brown17609d82017-05-05 09:41:34 -06001017 rc = boot_erase_sector(FLASH_AREA_IMAGE_0,
1018 size,
1019 this_size);
1020 assert(rc == 0);
1021
1022 size += this_size;
1023 }
1024
Fabio Utzig6a537ee2017-09-13 17:31:44 -03001025 BOOT_LOG_INF("Copying slot 1 to slot 0: 0x%lx bytes", size);
David Brown17609d82017-05-05 09:41:34 -06001026 rc = boot_copy_sector(FLASH_AREA_IMAGE_1, FLASH_AREA_IMAGE_0,
1027 0, 0, size);
1028
1029 /* Erase slot 1 so that we don't do the upgrade on every boot.
1030 * TODO: Perhaps verify slot 0's signature again? */
1031 rc = boot_erase_sector(FLASH_AREA_IMAGE_1,
Marti Bolivard3269fd2017-06-12 16:31:12 -04001032 0, boot_img_sector_size(&boot_data, 1, 0));
David Brown17609d82017-05-05 09:41:34 -06001033 assert(rc == 0);
1034
1035 return 0;
1036}
1037#else
Christopher Collins92ea77f2016-12-12 15:59:26 -08001038static int
1039boot_copy_image(struct boot_status *bs)
1040{
1041 uint32_t sz;
1042 int first_sector_idx;
1043 int last_sector_idx;
1044 int swap_idx;
Fabio Utzig2473ac02017-05-02 12:45:02 -03001045 struct image_header *hdr;
1046 uint32_t size;
1047 uint32_t copy_size;
Fabio Utzig2473ac02017-05-02 12:45:02 -03001048 int rc;
1049
1050 /* FIXME: just do this if asked by user? */
1051
1052 size = copy_size = 0;
1053
Fabio Utzig46490722017-09-04 15:34:32 -03001054 if (bs->idx == 0 && bs->state == 0) {
1055 /*
1056 * No swap ever happened, so need to find the largest image which
1057 * will be used to determine the amount of sectors to swap.
1058 */
1059 hdr = boot_img_hdr(&boot_data, 0);
Fabio Utzig2473ac02017-05-02 12:45:02 -03001060 if (hdr->ih_magic == IMAGE_MAGIC) {
Fabio Utzig46490722017-09-04 15:34:32 -03001061 rc = boot_read_image_size(0, hdr, &copy_size);
David Brownf5b33d82017-09-01 10:58:27 -06001062 assert(rc == 0);
Fabio Utzig2473ac02017-05-02 12:45:02 -03001063 }
Fabio Utzig2473ac02017-05-02 12:45:02 -03001064
Fabio Utzig46490722017-09-04 15:34:32 -03001065 hdr = boot_img_hdr(&boot_data, 1);
1066 if (hdr->ih_magic == IMAGE_MAGIC) {
1067 rc = boot_read_image_size(1, hdr, &size);
1068 assert(rc == 0);
1069 }
1070
1071 if (size > copy_size) {
1072 copy_size = size;
1073 }
1074
1075 bs->swap_size = copy_size;
1076 } else {
1077 /*
1078 * If a swap was under way, the swap_size should already be present
1079 * in the trailer...
1080 */
1081 rc = boot_read_swap_size(&bs->swap_size);
1082 assert(rc == 0);
1083
1084 copy_size = bs->swap_size;
Fabio Utzig2473ac02017-05-02 12:45:02 -03001085 }
1086
1087 size = 0;
1088 last_sector_idx = 0;
1089 while (1) {
Marti Bolivard3269fd2017-06-12 16:31:12 -04001090 size += boot_img_sector_size(&boot_data, 0, last_sector_idx);
Fabio Utzig2473ac02017-05-02 12:45:02 -03001091 if (size >= copy_size) {
1092 break;
1093 }
1094 last_sector_idx++;
1095 }
Christopher Collins92ea77f2016-12-12 15:59:26 -08001096
1097 swap_idx = 0;
Christopher Collins92ea77f2016-12-12 15:59:26 -08001098 while (last_sector_idx >= 0) {
1099 sz = boot_copy_sz(last_sector_idx, &first_sector_idx);
1100 if (swap_idx >= bs->idx) {
1101 boot_swap_sectors(first_sector_idx, sz, bs);
1102 }
1103
1104 last_sector_idx = first_sector_idx - 1;
1105 swap_idx++;
1106 }
1107
1108 return 0;
1109}
David Brown17609d82017-05-05 09:41:34 -06001110#endif
Christopher Collins92ea77f2016-12-12 15:59:26 -08001111
1112/**
Fabio Utzigdb5bd3c2017-07-13 22:20:22 -03001113 * Marks the image in slot 0 as fully copied.
Christopher Collins92ea77f2016-12-12 15:59:26 -08001114 */
1115static int
Fabio Utzigdb5bd3c2017-07-13 22:20:22 -03001116boot_set_copy_done(void)
Christopher Collins92ea77f2016-12-12 15:59:26 -08001117{
1118 const struct flash_area *fap;
1119 int rc;
1120
1121 rc = flash_area_open(FLASH_AREA_IMAGE_0, &fap);
1122 if (rc != 0) {
1123 return BOOT_EFLASH;
1124 }
1125
1126 rc = boot_write_copy_done(fap);
Fabio Utzigdb5bd3c2017-07-13 22:20:22 -03001127 flash_area_close(fap);
1128 return rc;
Christopher Collins92ea77f2016-12-12 15:59:26 -08001129}
1130
1131/**
1132 * Marks a reverted image in slot 0 as confirmed. This is necessary to ensure
1133 * the status bytes from the image revert operation don't get processed on a
1134 * subsequent boot.
Fabio Utzig1e56fcc2017-07-17 15:39:14 -03001135 *
1136 * NOTE: image_ok is tested before writing because if there's a valid permanent
1137 * image installed on slot0 and the new image to be upgrade to has a bad sig,
1138 * image_ok would be overwritten.
Christopher Collins92ea77f2016-12-12 15:59:26 -08001139 */
1140static int
Fabio Utzigdb5bd3c2017-07-13 22:20:22 -03001141boot_set_image_ok(void)
Christopher Collins92ea77f2016-12-12 15:59:26 -08001142{
1143 const struct flash_area *fap;
Fabio Utzig1e56fcc2017-07-17 15:39:14 -03001144 struct boot_swap_state state;
Christopher Collins92ea77f2016-12-12 15:59:26 -08001145 int rc;
1146
1147 rc = flash_area_open(FLASH_AREA_IMAGE_0, &fap);
1148 if (rc != 0) {
1149 return BOOT_EFLASH;
1150 }
1151
Fabio Utzig1e56fcc2017-07-17 15:39:14 -03001152 rc = boot_read_swap_state(fap, &state);
1153 if (rc != 0) {
1154 rc = BOOT_EFLASH;
1155 goto out;
1156 }
1157
1158 if (state.image_ok == BOOT_FLAG_UNSET) {
1159 rc = boot_write_image_ok(fap);
1160 }
1161
1162out:
Fabio Utzigdb5bd3c2017-07-13 22:20:22 -03001163 flash_area_close(fap);
1164 return rc;
Christopher Collins92ea77f2016-12-12 15:59:26 -08001165}
1166
1167/**
Christopher Collins0ff3c6c2016-12-21 12:04:17 -08001168 * Performs an image swap if one is required.
1169 *
1170 * @param out_swap_type On success, the type of swap performed gets
1171 * written here.
1172 *
1173 * @return 0 on success; nonzero on failure.
1174 */
1175static int
1176boot_swap_if_needed(int *out_swap_type)
1177{
1178 struct boot_status bs;
1179 int swap_type;
1180 int rc;
1181
1182 /* Determine if we rebooted in the middle of an image swap
1183 * operation.
1184 */
1185 rc = boot_read_status(&bs);
Fabio Utzig7ebb7c22017-04-26 10:59:31 -03001186 assert(rc == 0);
Christopher Collins0ff3c6c2016-12-21 12:04:17 -08001187 if (rc != 0) {
1188 return rc;
1189 }
1190
1191 /* If a partial swap was detected, complete it. */
1192 if (bs.idx != 0 || bs.state != 0) {
1193 rc = boot_copy_image(&bs);
1194 assert(rc == 0);
1195
Fabio Utzigb5b2f552017-06-30 10:03:47 -03001196 /* NOTE: here we have finished a swap resume. The initial request
1197 * was either a TEST or PERM swap, which now after the completed
1198 * swap will be determined to be respectively REVERT (was TEST)
1199 * or NONE (was PERM).
1200 */
1201
Christopher Collins0ff3c6c2016-12-21 12:04:17 -08001202 /* Extrapolate the type of the partial swap. We need this
1203 * information to know how to mark the swap complete in flash.
1204 */
1205 swap_type = boot_previous_swap_type();
1206 } else {
1207 swap_type = boot_validated_swap_type();
1208 switch (swap_type) {
1209 case BOOT_SWAP_TYPE_TEST:
Christopher Collinsfd7eb5c2016-12-21 13:46:08 -08001210 case BOOT_SWAP_TYPE_PERM:
Christopher Collins0ff3c6c2016-12-21 12:04:17 -08001211 case BOOT_SWAP_TYPE_REVERT:
1212 rc = boot_copy_image(&bs);
1213 assert(rc == 0);
1214 break;
1215 }
1216 }
1217
1218 *out_swap_type = swap_type;
1219 return 0;
1220}
1221
1222/**
Christopher Collins92ea77f2016-12-12 15:59:26 -08001223 * Prepares the booting process. This function moves images around in flash as
1224 * appropriate, and tells you what address to boot from.
1225 *
1226 * @param rsp On success, indicates how booting should occur.
1227 *
1228 * @return 0 on success; nonzero on failure.
1229 */
1230int
1231boot_go(struct boot_rsp *rsp)
1232{
Christopher Collins92ea77f2016-12-12 15:59:26 -08001233 int swap_type;
Marti Bolivar84898652017-06-13 17:20:22 -04001234 size_t slot;
Christopher Collins92ea77f2016-12-12 15:59:26 -08001235 int rc;
Marti Bolivarc0b47912017-06-13 17:18:09 -04001236 int fa_id;
David Brown52eee562017-07-05 11:25:09 -06001237 bool reload_headers = false;
Christopher Collins92ea77f2016-12-12 15:59:26 -08001238
1239 /* The array of slot sectors are defined here (as opposed to file scope) so
1240 * that they don't get allocated for non-boot-loader apps. This is
1241 * necessary because the gcc option "-fdata-sections" doesn't seem to have
Christopher Collins0ff3c6c2016-12-21 12:04:17 -08001242 * any effect in older gcc versions (e.g., 4.8.4).
Christopher Collins92ea77f2016-12-12 15:59:26 -08001243 */
Marti Bolivarc50926f2017-06-14 09:35:40 -04001244 static boot_sector_t slot0_sectors[BOOT_MAX_IMG_SECTORS];
1245 static boot_sector_t slot1_sectors[BOOT_MAX_IMG_SECTORS];
Christopher Collins92ea77f2016-12-12 15:59:26 -08001246 boot_data.imgs[0].sectors = slot0_sectors;
1247 boot_data.imgs[1].sectors = slot1_sectors;
1248
Marti Bolivarc0b47912017-06-13 17:18:09 -04001249 /* Open boot_data image areas for the duration of this call. */
1250 for (slot = 0; slot < BOOT_NUM_SLOTS; slot++) {
1251 fa_id = flash_area_id_from_image_slot(slot);
1252 rc = flash_area_open(fa_id, &BOOT_IMG_AREA(&boot_data, slot));
1253 assert(rc == 0);
1254 }
1255 rc = flash_area_open(FLASH_AREA_IMAGE_SCRATCH,
1256 &BOOT_SCRATCH_AREA(&boot_data));
1257 assert(rc == 0);
1258
Christopher Collins92ea77f2016-12-12 15:59:26 -08001259 /* Determine the sector layout of the image slots and scratch area. */
1260 rc = boot_read_sectors();
1261 if (rc != 0) {
Marti Bolivarc0b47912017-06-13 17:18:09 -04001262 goto out;
Christopher Collins92ea77f2016-12-12 15:59:26 -08001263 }
1264
1265 /* Attempt to read an image header from each slot. */
1266 rc = boot_read_image_headers();
1267 if (rc != 0) {
Marti Bolivarc0b47912017-06-13 17:18:09 -04001268 goto out;
Christopher Collins92ea77f2016-12-12 15:59:26 -08001269 }
1270
Christopher Collins0ff3c6c2016-12-21 12:04:17 -08001271 /* If the image slots aren't compatible, no swap is possible. Just boot
1272 * into slot 0.
1273 */
1274 if (boot_slots_compatible()) {
1275 rc = boot_swap_if_needed(&swap_type);
Fabio Utzig7ebb7c22017-04-26 10:59:31 -03001276 assert(rc == 0);
Christopher Collins0ff3c6c2016-12-21 12:04:17 -08001277 if (rc != 0) {
Marti Bolivarc0b47912017-06-13 17:18:09 -04001278 goto out;
Christopher Collins92ea77f2016-12-12 15:59:26 -08001279 }
Fabio Utzigdb5bd3c2017-07-13 22:20:22 -03001280
1281 /*
1282 * The following states need image_ok be explicitly set after the
1283 * swap was finished to avoid a new revert.
1284 */
1285 if (swap_type == BOOT_SWAP_TYPE_REVERT || swap_type == BOOT_SWAP_TYPE_FAIL) {
Fabio Utzig695d5642017-07-20 09:47:16 -03001286 rc = boot_set_image_ok();
1287 if (rc != 0) {
1288 swap_type = BOOT_SWAP_TYPE_PANIC;
1289 }
Fabio Utzigdb5bd3c2017-07-13 22:20:22 -03001290 }
Christopher Collins0ff3c6c2016-12-21 12:04:17 -08001291 } else {
1292 swap_type = BOOT_SWAP_TYPE_NONE;
Christopher Collins92ea77f2016-12-12 15:59:26 -08001293 }
1294
1295 switch (swap_type) {
1296 case BOOT_SWAP_TYPE_NONE:
1297 slot = 0;
1298 break;
1299
Fabio Utzig695d5642017-07-20 09:47:16 -03001300 case BOOT_SWAP_TYPE_TEST: /* fallthrough */
1301 case BOOT_SWAP_TYPE_PERM: /* fallthrough */
Christopher Collins92ea77f2016-12-12 15:59:26 -08001302 case BOOT_SWAP_TYPE_REVERT:
1303 slot = 1;
David Brown52eee562017-07-05 11:25:09 -06001304 reload_headers = true;
Fabio Utzig695d5642017-07-20 09:47:16 -03001305 rc = boot_set_copy_done();
1306 if (rc != 0) {
1307 swap_type = BOOT_SWAP_TYPE_PANIC;
1308 }
Christopher Collins92ea77f2016-12-12 15:59:26 -08001309 break;
1310
1311 case BOOT_SWAP_TYPE_FAIL:
1312 /* The image in slot 1 was invalid and is now erased. Ensure we don't
1313 * try to boot into it again on the next reboot. Do this by pretending
1314 * we just reverted back to slot 0.
1315 */
1316 slot = 0;
David Brown52eee562017-07-05 11:25:09 -06001317 reload_headers = true;
Christopher Collins92ea77f2016-12-12 15:59:26 -08001318 break;
1319
Fabio Utzigdb5bd3c2017-07-13 22:20:22 -03001320 default:
Fabio Utzig695d5642017-07-20 09:47:16 -03001321 swap_type = BOOT_SWAP_TYPE_PANIC;
1322 }
1323
1324 if (swap_type == BOOT_SWAP_TYPE_PANIC) {
1325 BOOT_LOG_ERR("panic!");
Fabio Utzigb5b2f552017-06-30 10:03:47 -03001326 assert(0);
Fabio Utzig695d5642017-07-20 09:47:16 -03001327
1328 /* Loop forever... */
1329 while (1) {}
Christopher Collins92ea77f2016-12-12 15:59:26 -08001330 }
1331
David Brown554c52e2017-06-30 16:01:07 -06001332#ifdef MCUBOOT_VALIDATE_SLOT0
David Brown52eee562017-07-05 11:25:09 -06001333 if (reload_headers) {
1334 rc = boot_read_image_headers();
1335 if (rc != 0) {
1336 goto out;
1337 }
1338 }
1339
David Brown554c52e2017-06-30 16:01:07 -06001340 rc = boot_validate_slot(0);
1341 assert(rc == 0);
1342 if (rc != 0) {
1343 rc = BOOT_EBADIMAGE;
1344 goto out;
1345 }
Fabio Utzig1e56fcc2017-07-17 15:39:14 -03001346#else
1347 (void)reload_headers;
David Brown554c52e2017-06-30 16:01:07 -06001348#endif
1349
Christopher Collins92ea77f2016-12-12 15:59:26 -08001350 /* Always boot from the primary slot. */
Marti Bolivar428cdbf2017-05-01 22:32:42 -04001351 rsp->br_flash_dev_id = boot_img_fa_device_id(&boot_data, 0);
Marti Bolivar88f48d92017-05-01 22:30:02 -04001352 rsp->br_image_off = boot_img_slot_off(&boot_data, 0);
Marti Bolivarf804f622017-06-12 15:41:48 -04001353 rsp->br_hdr = boot_img_hdr(&boot_data, slot);
Christopher Collins92ea77f2016-12-12 15:59:26 -08001354
Marti Bolivarc0b47912017-06-13 17:18:09 -04001355 out:
1356 flash_area_close(BOOT_SCRATCH_AREA(&boot_data));
1357 for (slot = 0; slot < BOOT_NUM_SLOTS; slot++) {
1358 flash_area_close(BOOT_IMG_AREA(&boot_data, BOOT_NUM_SLOTS - 1 - slot));
1359 }
1360 return rc;
Christopher Collins92ea77f2016-12-12 15:59:26 -08001361}
1362
1363int
1364split_go(int loader_slot, int split_slot, void **entry)
1365{
Marti Bolivarc50926f2017-06-14 09:35:40 -04001366 boot_sector_t *sectors;
Christopher Collins034a6202017-01-11 12:19:37 -08001367 uintptr_t entry_val;
Christopher Collins92ea77f2016-12-12 15:59:26 -08001368 int loader_flash_id;
Marti Bolivarc0b47912017-06-13 17:18:09 -04001369 int split_flash_id;
Christopher Collins92ea77f2016-12-12 15:59:26 -08001370 int rc;
1371
Christopher Collins92ea77f2016-12-12 15:59:26 -08001372 sectors = malloc(BOOT_MAX_IMG_SECTORS * 2 * sizeof *sectors);
1373 if (sectors == NULL) {
Marti Bolivarc0b47912017-06-13 17:18:09 -04001374 return SPLIT_GO_ERR;
Christopher Collins92ea77f2016-12-12 15:59:26 -08001375 }
Marti Bolivarc0b47912017-06-13 17:18:09 -04001376 boot_data.imgs[loader_slot].sectors = sectors + 0;
1377 boot_data.imgs[split_slot].sectors = sectors + BOOT_MAX_IMG_SECTORS;
1378
1379 loader_flash_id = flash_area_id_from_image_slot(loader_slot);
1380 rc = flash_area_open(loader_flash_id,
1381 &BOOT_IMG_AREA(&boot_data, split_slot));
1382 assert(rc == 0);
1383 split_flash_id = flash_area_id_from_image_slot(split_slot);
1384 rc = flash_area_open(split_flash_id,
1385 &BOOT_IMG_AREA(&boot_data, split_slot));
1386 assert(rc == 0);
Christopher Collins92ea77f2016-12-12 15:59:26 -08001387
1388 /* Determine the sector layout of the image slots and scratch area. */
1389 rc = boot_read_sectors();
1390 if (rc != 0) {
1391 rc = SPLIT_GO_ERR;
1392 goto done;
1393 }
1394
1395 rc = boot_read_image_headers();
1396 if (rc != 0) {
1397 goto done;
1398 }
1399
Christopher Collins92ea77f2016-12-12 15:59:26 -08001400 /* Don't check the bootable image flag because we could really call a
1401 * bootable or non-bootable image. Just validate that the image check
1402 * passes which is distinct from the normal check.
1403 */
Marti Bolivarf804f622017-06-12 15:41:48 -04001404 rc = split_image_check(boot_img_hdr(&boot_data, split_slot),
Marti Bolivarc0b47912017-06-13 17:18:09 -04001405 BOOT_IMG_AREA(&boot_data, split_slot),
Marti Bolivarf804f622017-06-12 15:41:48 -04001406 boot_img_hdr(&boot_data, loader_slot),
Marti Bolivarc0b47912017-06-13 17:18:09 -04001407 BOOT_IMG_AREA(&boot_data, loader_slot));
Christopher Collins92ea77f2016-12-12 15:59:26 -08001408 if (rc != 0) {
1409 rc = SPLIT_GO_NON_MATCHING;
1410 goto done;
1411 }
1412
Marti Bolivarea088872017-06-12 17:10:49 -04001413 entry_val = boot_img_slot_off(&boot_data, split_slot) +
Marti Bolivarf804f622017-06-12 15:41:48 -04001414 boot_img_hdr(&boot_data, split_slot)->ih_hdr_size;
Christopher Collins034a6202017-01-11 12:19:37 -08001415 *entry = (void *) entry_val;
Christopher Collins92ea77f2016-12-12 15:59:26 -08001416 rc = SPLIT_GO_OK;
1417
1418done:
Marti Bolivarc0b47912017-06-13 17:18:09 -04001419 flash_area_close(BOOT_IMG_AREA(&boot_data, split_slot));
1420 flash_area_close(BOOT_IMG_AREA(&boot_data, loader_slot));
Christopher Collins92ea77f2016-12-12 15:59:26 -08001421 free(sectors);
Christopher Collins92ea77f2016-12-12 15:59:26 -08001422 return rc;
1423}