blob: 6057b41e6aea508c30c69f15229e59cb2902ca2c [file] [log] [blame]
Andrzej Puzdrowskif573b392020-11-10 14:35:15 +01001/*
2 * SPDX-License-Identifier: Apache-2.0
3 *
4 * Copyright (c) 2017-2019 Linaro LTD
5 * Copyright (c) 2016-2019 JUUL Labs
6 * Copyright (c) 2019-2020 Arm Limited
7 * Copyright (c) 2020 Nordic Semiconductor ASA
8 *
9 * Original license:
10 *
11 * Licensed to the Apache Software Foundation (ASF) under one
12 * or more contributor license agreements. See the NOTICE file
13 * distributed with this work for additional information
14 * regarding copyright ownership. The ASF licenses this file
15 * to you under the Apache License, Version 2.0 (the
16 * "License"); you may not use this file except in compliance
17 * with the License. You may obtain a copy of the License at
18 *
19 * http://www.apache.org/licenses/LICENSE-2.0
20 *
21 * Unless required by applicable law or agreed to in writing,
22 * software distributed under the License is distributed on an
23 * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
24 * KIND, either express or implied. See the License for the
25 * specific language governing permissions and limitations
26 * under the License.
27 */
28
Andrzej Puzdrowski14ef5762020-12-11 17:17:59 +010029/**
30 * @file
31 * @brief Public MCUBoot interface API implementation
32 *
33 * This file contains API implementation which can be combined with
34 * the application in order to interact with the MCUBoot bootloader.
35 * This file contains shared code-base betwen MCUBoot and the application
36 * which controls DFU process.
37 */
38
Andrzej Puzdrowskif573b392020-11-10 14:35:15 +010039#include <string.h>
40#include <inttypes.h>
41#include <stddef.h>
42
43#include "sysflash/sysflash.h"
44#include "flash_map_backend/flash_map_backend.h"
45
46#include "bootutil/image.h"
47#include "bootutil/bootutil_public.h"
Andrzej Puzdrowskif573b392020-11-10 14:35:15 +010048#include "bootutil/bootutil_log.h"
Roman Okhrimenko13f79ed2021-03-11 19:05:41 +020049#include "swap_status.h"
Andrzej Puzdrowskif573b392020-11-10 14:35:15 +010050#ifdef MCUBOOT_ENC_IMAGES
Andrzej Puzdrowski360763d2021-02-04 18:01:01 +010051#include "bootutil/enc_key_public.h"
Andrzej Puzdrowskif573b392020-11-10 14:35:15 +010052#endif
53
54#ifdef CONFIG_MCUBOOT
55MCUBOOT_LOG_MODULE_DECLARE(mcuboot);
56#else
57MCUBOOT_LOG_MODULE_REGISTER(mcuboot_util);
58#endif
59
60const uint32_t boot_img_magic[] = {
61 0xf395c277,
62 0x7fefd260,
63 0x0f505235,
64 0x8079b62c,
65};
66
67#define BOOT_MAGIC_ARR_SZ \
68 (sizeof boot_img_magic / sizeof boot_img_magic[0])
69
70struct boot_swap_table {
71 uint8_t magic_primary_slot;
72 uint8_t magic_secondary_slot;
73 uint8_t image_ok_primary_slot;
74 uint8_t image_ok_secondary_slot;
75 uint8_t copy_done_primary_slot;
76
77 uint8_t swap_type;
78};
79
80/**
81 * This set of tables maps image trailer contents to swap operation type.
82 * When searching for a match, these tables must be iterated sequentially.
83 *
84 * NOTE: the table order is very important. The settings in the secondary
85 * slot always are priority to the primary slot and should be located
86 * earlier in the table.
87 *
88 * The table lists only states where there is action needs to be taken by
89 * the bootloader, as in starting/finishing a swap operation.
90 */
91static const struct boot_swap_table boot_swap_tables[] = {
92 {
93 .magic_primary_slot = BOOT_MAGIC_ANY,
94 .magic_secondary_slot = BOOT_MAGIC_GOOD,
95 .image_ok_primary_slot = BOOT_FLAG_ANY,
96 .image_ok_secondary_slot = BOOT_FLAG_UNSET,
97 .copy_done_primary_slot = BOOT_FLAG_ANY,
98 .swap_type = BOOT_SWAP_TYPE_TEST,
99 },
100 {
101 .magic_primary_slot = BOOT_MAGIC_ANY,
102 .magic_secondary_slot = BOOT_MAGIC_GOOD,
103 .image_ok_primary_slot = BOOT_FLAG_ANY,
104 .image_ok_secondary_slot = BOOT_FLAG_SET,
105 .copy_done_primary_slot = BOOT_FLAG_ANY,
106 .swap_type = BOOT_SWAP_TYPE_PERM,
107 },
108 {
109 .magic_primary_slot = BOOT_MAGIC_GOOD,
110 .magic_secondary_slot = BOOT_MAGIC_UNSET,
111 .image_ok_primary_slot = BOOT_FLAG_UNSET,
112 .image_ok_secondary_slot = BOOT_FLAG_ANY,
113 .copy_done_primary_slot = BOOT_FLAG_SET,
114 .swap_type = BOOT_SWAP_TYPE_REVERT,
115 },
116};
117
118#define BOOT_SWAP_TABLES_COUNT \
119 (sizeof boot_swap_tables / sizeof boot_swap_tables[0])
120
Roman Okhrimenko13f79ed2021-03-11 19:05:41 +0200121#ifndef MCUBOOT_SWAP_USING_STATUS
Andrzej Puzdrowskif573b392020-11-10 14:35:15 +0100122static int
123boot_magic_decode(const uint32_t *magic)
124{
125 if (memcmp(magic, boot_img_magic, BOOT_MAGIC_SZ) == 0) {
126 return BOOT_MAGIC_GOOD;
127 }
128 return BOOT_MAGIC_BAD;
129}
Roman Okhrimenko13f79ed2021-03-11 19:05:41 +0200130#endif /* !MCUBOOT_SWAP_USING_STATUS */
Andrzej Puzdrowskif573b392020-11-10 14:35:15 +0100131
132static int
133boot_flag_decode(uint8_t flag)
134{
135 if (flag != BOOT_FLAG_SET) {
136 return BOOT_FLAG_BAD;
137 }
138 return BOOT_FLAG_SET;
139}
140
Roman Okhrimenko13f79ed2021-03-11 19:05:41 +0200141#ifndef MCUBOOT_SWAP_USING_STATUS
Andrzej Puzdrowskif573b392020-11-10 14:35:15 +0100142static inline uint32_t
143boot_magic_off(const struct flash_area *fap)
144{
145 return fap->fa_size - BOOT_MAGIC_SZ;
146}
147
148static inline uint32_t
149boot_image_ok_off(const struct flash_area *fap)
150{
151 return boot_magic_off(fap) - BOOT_MAX_ALIGN;
152}
153
154static inline uint32_t
155boot_copy_done_off(const struct flash_area *fap)
156{
157 return boot_image_ok_off(fap) - BOOT_MAX_ALIGN;
158}
159
Andrzej Puzdrowskif573b392020-11-10 14:35:15 +0100160uint32_t
161boot_swap_info_off(const struct flash_area *fap)
162{
163 return boot_copy_done_off(fap) - BOOT_MAX_ALIGN;
164}
Roman Okhrimenko13f79ed2021-03-11 19:05:41 +0200165#endif /* !MCUBOOT_SWAP_USING_STATUS */
Andrzej Puzdrowskif573b392020-11-10 14:35:15 +0100166
167/**
168 * Determines if a status source table is satisfied by the specified magic
169 * code.
170 *
171 * @param tbl_val A magic field from a status source table.
172 * @param val The magic value in a trailer, encoded as a
173 * BOOT_MAGIC_[...].
174 *
175 * @return 1 if the two values are compatible;
176 * 0 otherwise.
177 */
178int
179boot_magic_compatible_check(uint8_t tbl_val, uint8_t val)
180{
181 switch (tbl_val) {
182 case BOOT_MAGIC_ANY:
183 return 1;
184
185 case BOOT_MAGIC_NOTGOOD:
186 return val != BOOT_MAGIC_GOOD;
187
188 default:
189 return tbl_val == val;
190 }
191}
192
Andrzej Puzdrowskif573b392020-11-10 14:35:15 +0100193bool bootutil_buffer_is_erased(const struct flash_area *area,
194 const void *buffer, size_t len)
195{
196 size_t i;
197 uint8_t *u8b;
198 uint8_t erased_val;
199
200 if (buffer == NULL || len == 0) {
201 return false;
202 }
203
204 erased_val = flash_area_erased_val(area);
205 for (i = 0, u8b = (uint8_t *)buffer; i < len; i++) {
206 if (u8b[i] != erased_val) {
207 return false;
208 }
209 }
210
211 return true;
212}
213
Andrzej Puzdrowski4700b802020-12-09 14:55:36 +0100214static int
215boot_read_flag(const struct flash_area *fap, uint8_t *flag, uint32_t off)
216{
217 int rc;
218
219 rc = flash_area_read(fap, off, flag, sizeof *flag);
220 if (rc < 0) {
221 return BOOT_EFLASH;
222 }
223 if (bootutil_buffer_is_erased(fap, flag, sizeof *flag)) {
224 *flag = BOOT_FLAG_UNSET;
225 } else {
226 *flag = boot_flag_decode(*flag);
227 }
228
229 return 0;
230}
231
232static inline int
233boot_read_copy_done(const struct flash_area *fap, uint8_t *copy_done)
234{
235 return boot_read_flag(fap, copy_done, boot_copy_done_off(fap));
236}
237
Roman Okhrimenko13f79ed2021-03-11 19:05:41 +0200238#ifndef MCUBOOT_SWAP_USING_STATUS
Andrzej Puzdrowski4700b802020-12-09 14:55:36 +0100239
Andrzej Puzdrowskif573b392020-11-10 14:35:15 +0100240int
241boot_read_swap_state(const struct flash_area *fap,
242 struct boot_swap_state *state)
243{
244 uint32_t magic[BOOT_MAGIC_ARR_SZ];
245 uint32_t off;
246 uint8_t swap_info;
247 int rc;
248
249 off = boot_magic_off(fap);
250 rc = flash_area_read(fap, off, magic, BOOT_MAGIC_SZ);
251 if (rc < 0) {
252 return BOOT_EFLASH;
253 }
254 if (bootutil_buffer_is_erased(fap, magic, BOOT_MAGIC_SZ)) {
255 state->magic = BOOT_MAGIC_UNSET;
256 } else {
257 state->magic = boot_magic_decode(magic);
258 }
259
260 off = boot_swap_info_off(fap);
261 rc = flash_area_read(fap, off, &swap_info, sizeof swap_info);
262 if (rc < 0) {
263 return BOOT_EFLASH;
264 }
265
266 /* Extract the swap type and image number */
267 state->swap_type = BOOT_GET_SWAP_TYPE(swap_info);
268 state->image_num = BOOT_GET_IMAGE_NUM(swap_info);
269
270 if (bootutil_buffer_is_erased(fap, &swap_info, sizeof swap_info) ||
271 state->swap_type > BOOT_SWAP_TYPE_REVERT) {
272 state->swap_type = BOOT_SWAP_TYPE_NONE;
273 state->image_num = 0;
274 }
275
Andrzej Puzdrowski4700b802020-12-09 14:55:36 +0100276 rc = boot_read_copy_done(fap, &state->copy_done);
277 if (rc) {
Andrzej Puzdrowskif573b392020-11-10 14:35:15 +0100278 return BOOT_EFLASH;
279 }
Andrzej Puzdrowskif573b392020-11-10 14:35:15 +0100280
Andrzej Puzdrowski4700b802020-12-09 14:55:36 +0100281 return boot_read_image_ok(fap, &state->image_ok);
Andrzej Puzdrowskif573b392020-11-10 14:35:15 +0100282}
283
Roman Okhrimenko13f79ed2021-03-11 19:05:41 +0200284#endif /* !MCUBOOT_SWAP_USING_STATUS */
285
Andrzej Puzdrowskif573b392020-11-10 14:35:15 +0100286int
287boot_read_swap_state_by_id(int flash_area_id, struct boot_swap_state *state)
288{
289 const struct flash_area *fap;
290 int rc;
291
292 rc = flash_area_open(flash_area_id, &fap);
293 if (rc != 0) {
294 return BOOT_EFLASH;
295 }
296
297 rc = boot_read_swap_state(fap, state);
298 flash_area_close(fap);
299 return rc;
300}
301
Roman Okhrimenko13f79ed2021-03-11 19:05:41 +0200302#ifndef MCUBOOT_SWAP_USING_STATUS
303
Andrzej Puzdrowskif573b392020-11-10 14:35:15 +0100304int
305boot_write_magic(const struct flash_area *fap)
306{
307 uint32_t off;
308 int rc;
309
310 off = boot_magic_off(fap);
311
312 BOOT_LOG_DBG("writing magic; fa_id=%d off=0x%lx (0x%lx)",
313 fap->fa_id, (unsigned long)off,
314 (unsigned long)(fap->fa_off + off));
315 rc = flash_area_write(fap, off, boot_img_magic, BOOT_MAGIC_SZ);
316 if (rc != 0) {
317 return BOOT_EFLASH;
318 }
319
320 return 0;
321}
322
323/**
324 * Write trailer data; status bytes, swap_size, etc
325 *
326 * @returns 0 on success, != 0 on error.
327 */
Dominik Ermela7f9e9f2021-03-24 17:31:57 +0000328int
Andrzej Puzdrowskif573b392020-11-10 14:35:15 +0100329boot_write_trailer(const struct flash_area *fap, uint32_t off,
330 const uint8_t *inbuf, uint8_t inlen)
331{
332 uint8_t buf[BOOT_MAX_ALIGN];
333 uint8_t align;
334 uint8_t erased_val;
335 int rc;
336
337 align = flash_area_align(fap);
Dominik Ermel48281622021-03-24 18:04:54 +0000338 align = (inlen + align - 1) & ~(align - 1);
339 if (align > BOOT_MAX_ALIGN) {
Andrzej Puzdrowskif573b392020-11-10 14:35:15 +0100340 return -1;
341 }
342 erased_val = flash_area_erased_val(fap);
Dominik Ermel48281622021-03-24 18:04:54 +0000343
Andrzej Puzdrowskif573b392020-11-10 14:35:15 +0100344 memcpy(buf, inbuf, inlen);
345 memset(&buf[inlen], erased_val, align - inlen);
346
347 rc = flash_area_write(fap, off, buf, align);
348 if (rc != 0) {
349 return BOOT_EFLASH;
350 }
351
352 return 0;
353}
354
Roman Okhrimenko13f79ed2021-03-11 19:05:41 +0200355#endif /* !MCUBOOT_SWAP_USING_STATUS */
356
Dominik Ermela7f9e9f2021-03-24 17:31:57 +0000357int
Andrzej Puzdrowskif573b392020-11-10 14:35:15 +0100358boot_write_trailer_flag(const struct flash_area *fap, uint32_t off,
359 uint8_t flag_val)
360{
361 const uint8_t buf[1] = { flag_val };
362 return boot_write_trailer(fap, off, buf, 1);
363}
364
365int
366boot_write_image_ok(const struct flash_area *fap)
367{
368 uint32_t off;
369
370 off = boot_image_ok_off(fap);
371 BOOT_LOG_DBG("writing image_ok; fa_id=%d off=0x%lx (0x%lx)",
372 fap->fa_id, (unsigned long)off,
373 (unsigned long)(fap->fa_off + off));
374 return boot_write_trailer_flag(fap, off, BOOT_FLAG_SET);
375}
376
Andrzej Puzdrowski4700b802020-12-09 14:55:36 +0100377int
378boot_read_image_ok(const struct flash_area *fap, uint8_t *image_ok)
379{
380 return boot_read_flag(fap, image_ok, boot_image_ok_off(fap));
381}
382
Andrzej Puzdrowskif573b392020-11-10 14:35:15 +0100383/**
384 * Writes the specified value to the `swap-type` field of an image trailer.
385 * This value is persisted so that the boot loader knows what swap operation to
386 * resume in case of an unexpected reset.
387 */
388int
389boot_write_swap_info(const struct flash_area *fap, uint8_t swap_type,
390 uint8_t image_num)
391{
392 uint32_t off;
393 uint8_t swap_info;
394
395 BOOT_SET_SWAP_INFO(swap_info, image_num, swap_type);
396 off = boot_swap_info_off(fap);
397 BOOT_LOG_DBG("writing swap_info; fa_id=%d off=0x%lx (0x%lx), swap_type=0x%x"
398 " image_num=0x%x",
399 fap->fa_id, (unsigned long)off,
400 (unsigned long)(fap->fa_off + off), swap_type, image_num);
401 return boot_write_trailer(fap, off, (const uint8_t *) &swap_info, 1);
402}
403
Roman Okhrimenko13f79ed2021-03-11 19:05:41 +0200404#define BOOT_LOG_SWAP_STATE(area, state) \
405 BOOT_LOG_INF("%s: magic=%s, swap_type=0x%x, copy_done=0x%x, " \
406 "image_ok=0x%x", \
407 (area), \
408 ((state)->magic == BOOT_MAGIC_GOOD ? "good" : \
409 (state)->magic == BOOT_MAGIC_UNSET ? "unset" : \
410 "bad"), \
411 (state)->swap_type, \
412 (state)->copy_done, \
413 (state)->image_ok)
414
Andrzej Puzdrowskif573b392020-11-10 14:35:15 +0100415int
416boot_swap_type_multi(int image_index)
417{
418 const struct boot_swap_table *table;
419 struct boot_swap_state primary_slot;
420 struct boot_swap_state secondary_slot;
421 int rc;
422 size_t i;
423
424 rc = boot_read_swap_state_by_id(FLASH_AREA_IMAGE_PRIMARY(image_index),
425 &primary_slot);
426 if (rc) {
427 return BOOT_SWAP_TYPE_PANIC;
428 }
429
430 rc = boot_read_swap_state_by_id(FLASH_AREA_IMAGE_SECONDARY(image_index),
431 &secondary_slot);
432 if (rc) {
433 return BOOT_SWAP_TYPE_PANIC;
434 }
435
Roman Okhrimenko13f79ed2021-03-11 19:05:41 +0200436 BOOT_LOG_SWAP_STATE("boot_swap_type_multi: Primary image", &primary_slot);
437 BOOT_LOG_SWAP_STATE("boot_swap_type_multi: Secondary image", &secondary_slot);
438
Andrzej Puzdrowskif573b392020-11-10 14:35:15 +0100439 for (i = 0; i < BOOT_SWAP_TABLES_COUNT; i++) {
440 table = boot_swap_tables + i;
441
442 if (boot_magic_compatible_check(table->magic_primary_slot,
443 primary_slot.magic) &&
444 boot_magic_compatible_check(table->magic_secondary_slot,
445 secondary_slot.magic) &&
446 (table->image_ok_primary_slot == BOOT_FLAG_ANY ||
447 table->image_ok_primary_slot == primary_slot.image_ok) &&
448 (table->image_ok_secondary_slot == BOOT_FLAG_ANY ||
449 table->image_ok_secondary_slot == secondary_slot.image_ok) &&
450 (table->copy_done_primary_slot == BOOT_FLAG_ANY ||
451 table->copy_done_primary_slot == primary_slot.copy_done)) {
452 BOOT_LOG_INF("Swap type: %s",
453 table->swap_type == BOOT_SWAP_TYPE_TEST ? "test" :
454 table->swap_type == BOOT_SWAP_TYPE_PERM ? "perm" :
455 table->swap_type == BOOT_SWAP_TYPE_REVERT ? "revert" :
456 "BUG; can't happen");
457 if (table->swap_type != BOOT_SWAP_TYPE_TEST &&
458 table->swap_type != BOOT_SWAP_TYPE_PERM &&
459 table->swap_type != BOOT_SWAP_TYPE_REVERT) {
460 return BOOT_SWAP_TYPE_PANIC;
461 }
462 return table->swap_type;
463 }
464 }
465
466 BOOT_LOG_INF("Swap type: none");
467 return BOOT_SWAP_TYPE_NONE;
468}
469
470/*
471 * This function is not used by the bootloader itself, but its required API
472 * by external tooling like mcumgr.
473 */
474int
475boot_swap_type(void)
476{
477 return boot_swap_type_multi(0);
478}
479
480/**
481 * Marks the image in the secondary slot as pending. On the next reboot,
482 * the system will perform a one-time boot of the the secondary slot image.
483 *
484 * @param permanent Whether the image should be used permanently or
485 * only tested once:
486 * 0=run image once, then confirm or revert.
487 * 1=run image forever.
488 *
489 * @return 0 on success; nonzero on failure.
490 */
491int
492boot_set_pending(int permanent)
493{
494 const struct flash_area *fap;
495 struct boot_swap_state state_secondary_slot;
496 uint8_t swap_type;
497 int rc;
498
499 rc = boot_read_swap_state_by_id(FLASH_AREA_IMAGE_SECONDARY(0),
500 &state_secondary_slot);
501 if (rc != 0) {
502 return rc;
503 }
504
505 switch (state_secondary_slot.magic) {
506 case BOOT_MAGIC_GOOD:
507 /* Swap already scheduled. */
508 return 0;
509
510 case BOOT_MAGIC_UNSET:
511 rc = flash_area_open(FLASH_AREA_IMAGE_SECONDARY(0), &fap);
512 if (rc != 0) {
513 rc = BOOT_EFLASH;
514 } else {
515 rc = boot_write_magic(fap);
516 }
517
518 if (rc == 0 && permanent) {
519 rc = boot_write_image_ok(fap);
520 }
521
522 if (rc == 0) {
523 if (permanent) {
524 swap_type = BOOT_SWAP_TYPE_PERM;
525 } else {
526 swap_type = BOOT_SWAP_TYPE_TEST;
527 }
528 rc = boot_write_swap_info(fap, swap_type, 0);
529 }
530
531 flash_area_close(fap);
532 return rc;
533
534 case BOOT_MAGIC_BAD:
535 /* The image slot is corrupt. There is no way to recover, so erase the
536 * slot to allow future upgrades.
537 */
538 rc = flash_area_open(FLASH_AREA_IMAGE_SECONDARY(0), &fap);
539 if (rc != 0) {
540 return BOOT_EFLASH;
541 }
542
543 flash_area_erase(fap, 0, fap->fa_size);
544 flash_area_close(fap);
545 return BOOT_EBADIMAGE;
546
547 default:
548 assert(0);
549 return BOOT_EBADIMAGE;
550 }
551}
552
553/**
554 * Marks the image in the primary slot as confirmed. The system will continue
555 * booting into the image in the primary slot until told to boot from a
556 * different slot.
557 *
558 * @return 0 on success; nonzero on failure.
559 */
560int
561boot_set_confirmed(void)
562{
563 const struct flash_area *fap;
564 struct boot_swap_state state_primary_slot;
565 int rc;
566
567 rc = boot_read_swap_state_by_id(FLASH_AREA_IMAGE_PRIMARY(0),
568 &state_primary_slot);
569 if (rc != 0) {
570 return rc;
571 }
572
573 switch (state_primary_slot.magic) {
574 case BOOT_MAGIC_GOOD:
575 /* Confirm needed; proceed. */
576 break;
577
578 case BOOT_MAGIC_UNSET:
579 /* Already confirmed. */
580 return 0;
581
582 case BOOT_MAGIC_BAD:
583 /* Unexpected state. */
584 return BOOT_EBADVECT;
585 }
586
587 rc = flash_area_open(FLASH_AREA_IMAGE_PRIMARY(0), &fap);
588 if (rc) {
589 rc = BOOT_EFLASH;
590 goto done;
591 }
592
593 if (state_primary_slot.copy_done == BOOT_FLAG_UNSET) {
594 /* Swap never completed. This is unexpected. */
595 rc = BOOT_EBADVECT;
596 goto done;
597 }
598
599 if (state_primary_slot.image_ok != BOOT_FLAG_UNSET) {
600 /* Already confirmed. */
601 goto done;
602 }
603
604 rc = boot_write_image_ok(fap);
605
606done:
607 flash_area_close(fap);
608 return rc;
609}