blob: fb5940170058483503cd29f4a5b4a1e87668241f [file] [log] [blame]
Christopher Collins92ea77f2016-12-12 15:59:26 -08001/*
2 * Licensed to the Apache Software Foundation (ASF) under one
3 * or more contributor license agreements. See the NOTICE file
4 * distributed with this work for additional information
5 * regarding copyright ownership. The ASF licenses this file
6 * to you under the Apache License, Version 2.0 (the
7 * "License"); you may not use this file except in compliance
8 * with the License. You may obtain a copy of the License at
9 *
10 * http://www.apache.org/licenses/LICENSE-2.0
11 *
12 * Unless required by applicable law or agreed to in writing,
13 * software distributed under the License is distributed on an
14 * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
15 * KIND, either express or implied. See the License for the
16 * specific language governing permissions and limitations
17 * under the License.
18 */
19
20/**
21 * This file provides an interface to the boot loader. Functions defined in
22 * this file should only be called while the boot loader is running.
23 */
24
25#include <assert.h>
26#include <stddef.h>
David Brown52eee562017-07-05 11:25:09 -060027#include <stdbool.h>
Christopher Collins92ea77f2016-12-12 15:59:26 -080028#include <inttypes.h>
29#include <stdlib.h>
30#include <string.h>
Christopher Collins92ea77f2016-12-12 15:59:26 -080031#include <hal/hal_flash.h>
32#include <os/os_malloc.h>
33#include "bootutil/bootutil.h"
34#include "bootutil/image.h"
35#include "bootutil_priv.h"
36
Marti Bolivarfd20c762017-02-07 16:52:50 -050037#define BOOT_LOG_LEVEL BOOT_LOG_LEVEL_INFO
38#include "bootutil/bootutil_log.h"
39
Fabio Utzigba1fbe62017-07-21 14:01:20 -030040#ifdef MCUBOOT_MYNEWT
41#include "mcuboot_config/mcuboot_config.h"
Fabio Utzigeed80b62017-06-10 08:03:05 -030042#endif
43
Fabio Utzig9b0ee902017-11-23 19:49:00 -020044#ifdef __BOOTSIM__
45#undef assert
46void sim_assert(int, const char *test, const char *, unsigned int, const char *);
47#define assert(x) sim_assert((x), #x, __FILE__, __LINE__, __func__)
48#endif
49
Marti Bolivar9b1f8bb2017-06-12 15:24:13 -040050static struct boot_loader_state boot_data;
Christopher Collins92ea77f2016-12-12 15:59:26 -080051
52struct boot_status_table {
53 /**
54 * For each field, a value of 0 means "any".
55 */
56 uint8_t bst_magic_slot0;
57 uint8_t bst_magic_scratch;
58 uint8_t bst_copy_done_slot0;
59 uint8_t bst_status_source;
60};
61
62/**
63 * This set of tables maps swap state contents to boot status location.
64 * When searching for a match, these tables must be iterated in order.
65 */
66static const struct boot_status_table boot_status_tables[] = {
67 {
68 /* | slot-0 | scratch |
69 * ----------+------------+------------|
70 * magic | Good | Any |
71 * copy-done | 0x01 | N/A |
72 * ----------+------------+------------'
73 * source: none |
74 * ------------------------------------'
75 */
76 .bst_magic_slot0 = BOOT_MAGIC_GOOD,
77 .bst_magic_scratch = 0,
78 .bst_copy_done_slot0 = 0x01,
79 .bst_status_source = BOOT_STATUS_SOURCE_NONE,
80 },
81
82 {
83 /* | slot-0 | scratch |
84 * ----------+------------+------------|
85 * magic | Good | Any |
86 * copy-done | 0xff | N/A |
87 * ----------+------------+------------'
88 * source: slot 0 |
89 * ------------------------------------'
90 */
91 .bst_magic_slot0 = BOOT_MAGIC_GOOD,
92 .bst_magic_scratch = 0,
93 .bst_copy_done_slot0 = 0xff,
94 .bst_status_source = BOOT_STATUS_SOURCE_SLOT0,
95 },
96
97 {
98 /* | slot-0 | scratch |
99 * ----------+------------+------------|
100 * magic | Any | Good |
101 * copy-done | Any | N/A |
102 * ----------+------------+------------'
103 * source: scratch |
104 * ------------------------------------'
105 */
106 .bst_magic_slot0 = 0,
107 .bst_magic_scratch = BOOT_MAGIC_GOOD,
108 .bst_copy_done_slot0 = 0,
109 .bst_status_source = BOOT_STATUS_SOURCE_SCRATCH,
110 },
111
112 {
113 /* | slot-0 | scratch |
114 * ----------+------------+------------|
115 * magic | Unset | Any |
116 * copy-done | 0xff | N/A |
117 * ----------+------------+------------|
118 * source: varies |
119 * ------------------------------------+------------------------------+
120 * This represents one of two cases: |
121 * o No swaps ever (no status to read, so no harm in checking). |
122 * o Mid-revert; status in slot 0. |
123 * -------------------------------------------------------------------'
124 */
125 .bst_magic_slot0 = BOOT_MAGIC_UNSET,
126 .bst_magic_scratch = 0,
127 .bst_copy_done_slot0 = 0xff,
128 .bst_status_source = BOOT_STATUS_SOURCE_SLOT0,
129 },
130};
131
132#define BOOT_STATUS_TABLES_COUNT \
133 (sizeof boot_status_tables / sizeof boot_status_tables[0])
134
Marti Bolivarfd20c762017-02-07 16:52:50 -0500135#define BOOT_LOG_SWAP_STATE(area, state) \
136 BOOT_LOG_INF("%s: magic=%s, copy_done=0x%x, image_ok=0x%x", \
137 (area), \
138 ((state)->magic == BOOT_MAGIC_GOOD ? "good" : \
139 (state)->magic == BOOT_MAGIC_UNSET ? "unset" : \
140 "bad"), \
141 (state)->copy_done, \
142 (state)->image_ok)
143
Christopher Collins92ea77f2016-12-12 15:59:26 -0800144/**
145 * Determines where in flash the most recent boot status is stored. The boot
146 * status is necessary for completing a swap that was interrupted by a boot
147 * loader reset.
148 *
149 * @return A BOOT_STATUS_SOURCE_[...] code indicating where * status should be read from.
150 */
151static int
152boot_status_source(void)
153{
154 const struct boot_status_table *table;
155 struct boot_swap_state state_scratch;
156 struct boot_swap_state state_slot0;
Christopher Collins92ea77f2016-12-12 15:59:26 -0800157 int rc;
Fabio Utzigcd5774b2017-11-29 10:18:26 -0200158 size_t i;
Marti Bolivarfd20c762017-02-07 16:52:50 -0500159 uint8_t source;
Christopher Collins92ea77f2016-12-12 15:59:26 -0800160
Fabio Utzig2473ac02017-05-02 12:45:02 -0300161 rc = boot_read_swap_state_by_id(FLASH_AREA_IMAGE_0, &state_slot0);
Christopher Collins92ea77f2016-12-12 15:59:26 -0800162 assert(rc == 0);
163
Fabio Utzig2473ac02017-05-02 12:45:02 -0300164 rc = boot_read_swap_state_by_id(FLASH_AREA_IMAGE_SCRATCH, &state_scratch);
Christopher Collins92ea77f2016-12-12 15:59:26 -0800165 assert(rc == 0);
166
Marti Bolivarfd20c762017-02-07 16:52:50 -0500167 BOOT_LOG_SWAP_STATE("Image 0", &state_slot0);
Marti Bolivarfd20c762017-02-07 16:52:50 -0500168 BOOT_LOG_SWAP_STATE("Scratch", &state_scratch);
169
Christopher Collins92ea77f2016-12-12 15:59:26 -0800170 for (i = 0; i < BOOT_STATUS_TABLES_COUNT; i++) {
Fabio Utzig7ebb7c22017-04-26 10:59:31 -0300171 table = &boot_status_tables[i];
Christopher Collins92ea77f2016-12-12 15:59:26 -0800172
173 if ((table->bst_magic_slot0 == 0 ||
174 table->bst_magic_slot0 == state_slot0.magic) &&
175 (table->bst_magic_scratch == 0 ||
176 table->bst_magic_scratch == state_scratch.magic) &&
177 (table->bst_copy_done_slot0 == 0 ||
178 table->bst_copy_done_slot0 == state_slot0.copy_done)) {
Marti Bolivarfd20c762017-02-07 16:52:50 -0500179 source = table->bst_status_source;
180 BOOT_LOG_INF("Boot source: %s",
181 source == BOOT_STATUS_SOURCE_NONE ? "none" :
182 source == BOOT_STATUS_SOURCE_SCRATCH ? "scratch" :
183 source == BOOT_STATUS_SOURCE_SLOT0 ? "slot 0" :
184 "BUG; can't happen");
185 return source;
Christopher Collins92ea77f2016-12-12 15:59:26 -0800186 }
187 }
188
Marti Bolivarfd20c762017-02-07 16:52:50 -0500189 BOOT_LOG_INF("Boot source: none");
Christopher Collins92ea77f2016-12-12 15:59:26 -0800190 return BOOT_STATUS_SOURCE_NONE;
191}
192
193/**
194 * Calculates the type of swap that just completed.
Fabio Utzigb5b2f552017-06-30 10:03:47 -0300195 *
196 * This is used when a swap is interrupted by an external event. After
197 * finishing the swap operation determines what the initial request was.
Christopher Collins92ea77f2016-12-12 15:59:26 -0800198 */
199static int
200boot_previous_swap_type(void)
201{
202 int post_swap_type;
Christopher Collins92ea77f2016-12-12 15:59:26 -0800203
204 post_swap_type = boot_swap_type();
205
Fabio Utzigb5b2f552017-06-30 10:03:47 -0300206 switch (post_swap_type) {
207 case BOOT_SWAP_TYPE_NONE : return BOOT_SWAP_TYPE_PERM;
208 case BOOT_SWAP_TYPE_REVERT : return BOOT_SWAP_TYPE_TEST;
209 case BOOT_SWAP_TYPE_PANIC : return BOOT_SWAP_TYPE_PANIC;
Christopher Collins92ea77f2016-12-12 15:59:26 -0800210 }
Fabio Utzig7ebb7c22017-04-26 10:59:31 -0300211
Fabio Utzigb5b2f552017-06-30 10:03:47 -0300212 return BOOT_SWAP_TYPE_FAIL;
Christopher Collins92ea77f2016-12-12 15:59:26 -0800213}
214
David Brownf5b33d82017-09-01 10:58:27 -0600215/*
216 * Compute the total size of the given image. Includes the size of
217 * the TLVs.
218 */
Fabio Utzig13d9e352017-10-05 20:32:31 -0300219#if !defined(MCUBOOT_OVERWRITE_ONLY) || defined(MCUBOOT_OVERWRITE_ONLY_FAST)
David Brownf5b33d82017-09-01 10:58:27 -0600220static int
221boot_read_image_size(int slot, struct image_header *hdr, uint32_t *size)
222{
223 const struct flash_area *fap;
224 struct image_tlv_info info;
225 int area_id;
226 int rc;
227
228 area_id = flash_area_id_from_image_slot(slot);
229 rc = flash_area_open(area_id, &fap);
230 if (rc != 0) {
231 rc = BOOT_EFLASH;
232 goto done;
233 }
234
235 rc = flash_area_read(fap, hdr->ih_hdr_size + hdr->ih_img_size,
236 &info, sizeof(info));
237 if (rc != 0) {
238 rc = BOOT_EFLASH;
239 goto done;
240 }
241 if (info.it_magic != IMAGE_TLV_INFO_MAGIC) {
242 rc = BOOT_EBADIMAGE;
243 goto done;
244 }
245 *size = hdr->ih_hdr_size + hdr->ih_img_size + info.it_tlv_tot;
246 rc = 0;
247
248done:
249 flash_area_close(fap);
Fabio Utzig2eebf112017-09-04 15:25:08 -0300250 return rc;
David Brownf5b33d82017-09-01 10:58:27 -0600251}
Fabio Utzig36ec0e72017-09-05 08:10:33 -0300252#endif /* !MCUBOOT_OVERWRITE_ONLY */
David Brownf5b33d82017-09-01 10:58:27 -0600253
Fabio Utzigc08ed212017-06-20 19:28:36 -0300254static int
Christopher Collins92ea77f2016-12-12 15:59:26 -0800255boot_read_image_header(int slot, struct image_header *out_hdr)
256{
257 const struct flash_area *fap;
258 int area_id;
259 int rc;
260
261 area_id = flash_area_id_from_image_slot(slot);
262 rc = flash_area_open(area_id, &fap);
263 if (rc != 0) {
264 rc = BOOT_EFLASH;
265 goto done;
266 }
267
268 rc = flash_area_read(fap, 0, out_hdr, sizeof *out_hdr);
269 if (rc != 0) {
270 rc = BOOT_EFLASH;
271 goto done;
272 }
273
274 rc = 0;
275
276done:
277 flash_area_close(fap);
278 return rc;
279}
280
281static int
282boot_read_image_headers(void)
283{
284 int rc;
285 int i;
286
287 for (i = 0; i < BOOT_NUM_SLOTS; i++) {
Marti Bolivarf804f622017-06-12 15:41:48 -0400288 rc = boot_read_image_header(i, boot_img_hdr(&boot_data, i));
Christopher Collins92ea77f2016-12-12 15:59:26 -0800289 if (rc != 0) {
Fabio Utzig7ebb7c22017-04-26 10:59:31 -0300290 /* If at least the first slot's header was read successfully, then
291 * the boot loader can attempt a boot. Failure to read any headers
292 * is a fatal error.
Christopher Collins0ff3c6c2016-12-21 12:04:17 -0800293 */
294 if (i > 0) {
295 return 0;
296 } else {
297 return rc;
298 }
Christopher Collins92ea77f2016-12-12 15:59:26 -0800299 }
300 }
301
302 return 0;
303}
304
305static uint8_t
306boot_write_sz(void)
307{
308 uint8_t elem_sz;
309 uint8_t align;
310
311 /* Figure out what size to write update status update as. The size depends
312 * on what the minimum write size is for scratch area, active image slot.
313 * We need to use the bigger of those 2 values.
314 */
Marti Bolivare2587152017-06-12 15:52:05 -0400315 elem_sz = hal_flash_align(boot_img_fa_device_id(&boot_data, 0));
316 align = hal_flash_align(boot_scratch_fa_device_id(&boot_data));
Christopher Collins92ea77f2016-12-12 15:59:26 -0800317 if (align > elem_sz) {
318 elem_sz = align;
319 }
320
321 return elem_sz;
322}
323
Christopher Collins0ff3c6c2016-12-21 12:04:17 -0800324static int
325boot_slots_compatible(void)
326{
Marti Bolivard3269fd2017-06-12 16:31:12 -0400327 size_t num_sectors_0 = boot_img_num_sectors(&boot_data, 0);
328 size_t num_sectors_1 = boot_img_num_sectors(&boot_data, 1);
329 size_t size_0, size_1;
330 size_t i;
Christopher Collins0ff3c6c2016-12-21 12:04:17 -0800331
332 /* Ensure both image slots have identical sector layouts. */
Marti Bolivard3269fd2017-06-12 16:31:12 -0400333 if (num_sectors_0 != num_sectors_1) {
Christopher Collins0ff3c6c2016-12-21 12:04:17 -0800334 return 0;
335 }
Marti Bolivard3269fd2017-06-12 16:31:12 -0400336 for (i = 0; i < num_sectors_0; i++) {
337 size_0 = boot_img_sector_size(&boot_data, 0, i);
338 size_1 = boot_img_sector_size(&boot_data, 1, i);
339 if (size_0 != size_1) {
Christopher Collins0ff3c6c2016-12-21 12:04:17 -0800340 return 0;
341 }
342 }
343
344 return 1;
345}
346
Christopher Collins92ea77f2016-12-12 15:59:26 -0800347/**
348 * Determines the sector layout of both image slots and the scratch area.
349 * This information is necessary for calculating the number of bytes to erase
350 * and copy during an image swap. The information collected during this
351 * function is used to populate the boot_data global.
352 */
353static int
354boot_read_sectors(void)
355{
Christopher Collins92ea77f2016-12-12 15:59:26 -0800356 int rc;
Christopher Collins92ea77f2016-12-12 15:59:26 -0800357
Marti Bolivarcca28a92017-06-12 16:52:22 -0400358 rc = boot_initialize_area(&boot_data, FLASH_AREA_IMAGE_0);
Christopher Collins92ea77f2016-12-12 15:59:26 -0800359 if (rc != 0) {
360 return BOOT_EFLASH;
361 }
362
Marti Bolivarcca28a92017-06-12 16:52:22 -0400363 rc = boot_initialize_area(&boot_data, FLASH_AREA_IMAGE_1);
Christopher Collins92ea77f2016-12-12 15:59:26 -0800364 if (rc != 0) {
365 return BOOT_EFLASH;
366 }
367
Marti Bolivare10a7392017-06-14 16:20:07 -0400368 BOOT_WRITE_SZ(&boot_data) = boot_write_sz();
Christopher Collins92ea77f2016-12-12 15:59:26 -0800369
370 return 0;
371}
372
373static uint32_t
374boot_status_internal_off(int idx, int state, int elem_sz)
375{
376 int idx_sz;
377
378 idx_sz = elem_sz * BOOT_STATUS_STATE_COUNT;
379
380 return idx * idx_sz + state * elem_sz;
381}
382
383/**
384 * Reads the status of a partially-completed swap, if any. This is necessary
385 * to recover in case the boot lodaer was reset in the middle of a swap
386 * operation.
387 */
388static int
389boot_read_status_bytes(const struct flash_area *fap, struct boot_status *bs)
390{
391 uint32_t off;
392 uint8_t status;
Fabio Utzig7ebb7c22017-04-26 10:59:31 -0300393 int max_entries;
Christopher Collins92ea77f2016-12-12 15:59:26 -0800394 int found;
395 int rc;
396 int i;
397
398 off = boot_status_off(fap);
Fabio Utzig4cee4f72017-05-22 10:59:57 -0400399 max_entries = boot_status_entries(fap);
Fabio Utzig7ebb7c22017-04-26 10:59:31 -0300400
Christopher Collins92ea77f2016-12-12 15:59:26 -0800401 found = 0;
Fabio Utzig7ebb7c22017-04-26 10:59:31 -0300402 for (i = 0; i < max_entries; i++) {
Marti Bolivare10a7392017-06-14 16:20:07 -0400403 rc = flash_area_read(fap, off + i * BOOT_WRITE_SZ(&boot_data),
404 &status, 1);
Christopher Collins92ea77f2016-12-12 15:59:26 -0800405 if (rc != 0) {
406 return BOOT_EFLASH;
407 }
408
409 if (status == 0xff) {
410 if (found) {
411 break;
412 }
413 } else if (!found) {
414 found = 1;
415 }
416 }
417
418 if (found) {
419 i--;
Fabio Utzig94d998c2017-05-22 11:02:41 -0400420 bs->idx = i / BOOT_STATUS_STATE_COUNT;
421 bs->state = i % BOOT_STATUS_STATE_COUNT;
Christopher Collins92ea77f2016-12-12 15:59:26 -0800422 }
423
424 return 0;
425}
426
427/**
428 * Reads the boot status from the flash. The boot status contains
429 * the current state of an interrupted image copy operation. If the boot
430 * status is not present, or it indicates that previous copy finished,
431 * there is no operation in progress.
432 */
433static int
434boot_read_status(struct boot_status *bs)
435{
436 const struct flash_area *fap;
437 int status_loc;
438 int area_id;
439 int rc;
440
441 memset(bs, 0, sizeof *bs);
442
443 status_loc = boot_status_source();
444 switch (status_loc) {
445 case BOOT_STATUS_SOURCE_NONE:
446 return 0;
447
448 case BOOT_STATUS_SOURCE_SCRATCH:
449 area_id = FLASH_AREA_IMAGE_SCRATCH;
450 break;
451
452 case BOOT_STATUS_SOURCE_SLOT0:
453 area_id = FLASH_AREA_IMAGE_0;
454 break;
455
456 default:
457 assert(0);
458 return BOOT_EBADARGS;
459 }
460
461 rc = flash_area_open(area_id, &fap);
462 if (rc != 0) {
463 return BOOT_EFLASH;
464 }
465
Fabio Utzig46490722017-09-04 15:34:32 -0300466 rc = boot_read_status_bytes(fap, bs);
467
468 flash_area_close(fap);
469 return rc;
Christopher Collins92ea77f2016-12-12 15:59:26 -0800470}
471
472/**
473 * Writes the supplied boot status to the flash file system. The boot status
474 * contains the current state of an in-progress image copy operation.
475 *
476 * @param bs The boot status to write.
477 *
478 * @return 0 on success; nonzero on failure.
479 */
480int
481boot_write_status(struct boot_status *bs)
482{
483 const struct flash_area *fap;
484 uint32_t off;
485 int area_id;
486 int rc;
Fabio Utziga0bc9b52017-06-28 09:19:55 -0300487 uint8_t buf[BOOT_MAX_ALIGN];
David Brown9d725462017-01-23 15:50:58 -0700488 uint8_t align;
Christopher Collins92ea77f2016-12-12 15:59:26 -0800489
Fabio Utzig7ebb7c22017-04-26 10:59:31 -0300490 /* NOTE: The first sector copied (that is the last sector on slot) contains
491 * the trailer. Since in the last step SLOT 0 is erased, the first
492 * two status writes go to the scratch which will be copied to SLOT 0!
493 */
494
Fabio Utzig2473ac02017-05-02 12:45:02 -0300495 if (bs->use_scratch) {
Christopher Collins92ea77f2016-12-12 15:59:26 -0800496 /* Write to scratch. */
497 area_id = FLASH_AREA_IMAGE_SCRATCH;
498 } else {
499 /* Write to slot 0. */
500 area_id = FLASH_AREA_IMAGE_0;
501 }
502
503 rc = flash_area_open(area_id, &fap);
504 if (rc != 0) {
505 rc = BOOT_EFLASH;
506 goto done;
507 }
508
509 off = boot_status_off(fap) +
Marti Bolivare10a7392017-06-14 16:20:07 -0400510 boot_status_internal_off(bs->idx, bs->state,
511 BOOT_WRITE_SZ(&boot_data));
Christopher Collins92ea77f2016-12-12 15:59:26 -0800512
David Brown9d725462017-01-23 15:50:58 -0700513 align = hal_flash_align(fap->fa_device_id);
Fabio Utziga0bc9b52017-06-28 09:19:55 -0300514 memset(buf, 0xFF, BOOT_MAX_ALIGN);
David Brown9d725462017-01-23 15:50:58 -0700515 buf[0] = bs->state;
516
517 rc = flash_area_write(fap, off, buf, align);
Christopher Collins92ea77f2016-12-12 15:59:26 -0800518 if (rc != 0) {
519 rc = BOOT_EFLASH;
520 goto done;
521 }
522
523 rc = 0;
524
525done:
526 flash_area_close(fap);
527 return rc;
528}
529
530/*
531 * Validate image hash/signature in a slot.
532 */
533static int
534boot_image_check(struct image_header *hdr, const struct flash_area *fap)
535{
David Browndb1d9d32017-01-06 11:07:54 -0700536 static uint8_t tmpbuf[BOOT_TMPBUF_SZ];
Christopher Collins92ea77f2016-12-12 15:59:26 -0800537
Christopher Collins92ea77f2016-12-12 15:59:26 -0800538 if (bootutil_img_validate(hdr, fap, tmpbuf, BOOT_TMPBUF_SZ,
539 NULL, 0, NULL)) {
540 return BOOT_EBADIMAGE;
541 }
542 return 0;
543}
544
545static int
546split_image_check(struct image_header *app_hdr,
547 const struct flash_area *app_fap,
548 struct image_header *loader_hdr,
549 const struct flash_area *loader_fap)
550{
551 static void *tmpbuf;
552 uint8_t loader_hash[32];
553
554 if (!tmpbuf) {
555 tmpbuf = malloc(BOOT_TMPBUF_SZ);
556 if (!tmpbuf) {
557 return BOOT_ENOMEM;
558 }
559 }
560
561 if (bootutil_img_validate(loader_hdr, loader_fap, tmpbuf, BOOT_TMPBUF_SZ,
562 NULL, 0, loader_hash)) {
563 return BOOT_EBADIMAGE;
564 }
565
566 if (bootutil_img_validate(app_hdr, app_fap, tmpbuf, BOOT_TMPBUF_SZ,
567 loader_hash, 32, NULL)) {
568 return BOOT_EBADIMAGE;
569 }
570
571 return 0;
572}
573
574static int
David Brownd930ec62016-12-14 07:59:48 -0700575boot_validate_slot(int slot)
Christopher Collins92ea77f2016-12-12 15:59:26 -0800576{
577 const struct flash_area *fap;
Marti Bolivarf804f622017-06-12 15:41:48 -0400578 struct image_header *hdr;
Christopher Collins92ea77f2016-12-12 15:59:26 -0800579 int rc;
Fabio Utzig7ebb7c22017-04-26 10:59:31 -0300580
Marti Bolivarf804f622017-06-12 15:41:48 -0400581 hdr = boot_img_hdr(&boot_data, slot);
582 if (hdr->ih_magic == 0xffffffff || hdr->ih_flags & IMAGE_F_NON_BOOTABLE) {
Fabio Utzig7ebb7c22017-04-26 10:59:31 -0300583 /* No bootable image in slot; continue booting from slot 0. */
Christopher Collins92ea77f2016-12-12 15:59:26 -0800584 return -1;
585 }
586
David Brownd930ec62016-12-14 07:59:48 -0700587 rc = flash_area_open(flash_area_id_from_image_slot(slot), &fap);
Christopher Collins92ea77f2016-12-12 15:59:26 -0800588 if (rc != 0) {
589 return BOOT_EFLASH;
590 }
591
Marti Bolivarf804f622017-06-12 15:41:48 -0400592 if ((hdr->ih_magic != IMAGE_MAGIC || boot_image_check(hdr, fap) != 0)) {
David Brownb38e0442017-02-24 13:57:12 -0700593 if (slot != 0) {
594 flash_area_erase(fap, 0, fap->fa_size);
595 /* Image in slot 1 is invalid. Erase the image and
596 * continue booting from slot 0.
597 */
598 }
Fabio Utzigb6297af2017-10-05 18:26:36 -0300599 BOOT_LOG_ERR("Image in slot %d is not valid!", slot);
Christopher Collins92ea77f2016-12-12 15:59:26 -0800600 return -1;
601 }
602
603 flash_area_close(fap);
604
605 /* Image in slot 1 is valid. */
606 return 0;
607}
608
609/**
610 * Determines which swap operation to perform, if any. If it is determined
611 * that a swap operation is required, the image in the second slot is checked
612 * for validity. If the image in the second slot is invalid, it is erased, and
613 * a swap type of "none" is indicated.
614 *
615 * @return The type of swap to perform (BOOT_SWAP_TYPE...)
616 */
617static int
618boot_validated_swap_type(void)
619{
620 int swap_type;
Christopher Collins92ea77f2016-12-12 15:59:26 -0800621
622 swap_type = boot_swap_type();
Fabio Utzigb5b2f552017-06-30 10:03:47 -0300623 switch (swap_type) {
624 case BOOT_SWAP_TYPE_TEST:
625 case BOOT_SWAP_TYPE_PERM:
626 case BOOT_SWAP_TYPE_REVERT:
627 /* Boot loader wants to switch to slot 1. Ensure image is valid. */
628 if (boot_validate_slot(1) != 0) {
629 swap_type = BOOT_SWAP_TYPE_FAIL;
630 }
Christopher Collins92ea77f2016-12-12 15:59:26 -0800631 }
632
633 return swap_type;
634}
635
636/**
637 * Calculates the number of sectors the scratch area can contain. A "last"
638 * source sector is specified because images are copied backwards in flash
639 * (final index to index number 0).
640 *
641 * @param last_sector_idx The index of the last source sector
642 * (inclusive).
643 * @param out_first_sector_idx The index of the first source sector
644 * (inclusive) gets written here.
645 *
646 * @return The number of bytes comprised by the
647 * [first-sector, last-sector] range.
648 */
Fabio Utzig3488eef2017-06-12 10:25:43 -0300649#ifndef MCUBOOT_OVERWRITE_ONLY
Christopher Collins92ea77f2016-12-12 15:59:26 -0800650static uint32_t
651boot_copy_sz(int last_sector_idx, int *out_first_sector_idx)
652{
Marti Bolivard3269fd2017-06-12 16:31:12 -0400653 size_t scratch_sz;
Christopher Collins92ea77f2016-12-12 15:59:26 -0800654 uint32_t new_sz;
655 uint32_t sz;
656 int i;
657
658 sz = 0;
659
Marti Bolivard3269fd2017-06-12 16:31:12 -0400660 scratch_sz = boot_scratch_area_size(&boot_data);
Christopher Collins92ea77f2016-12-12 15:59:26 -0800661 for (i = last_sector_idx; i >= 0; i--) {
Marti Bolivard3269fd2017-06-12 16:31:12 -0400662 new_sz = sz + boot_img_sector_size(&boot_data, 0, i);
663 if (new_sz > scratch_sz) {
Christopher Collins92ea77f2016-12-12 15:59:26 -0800664 break;
665 }
666 sz = new_sz;
667 }
668
669 /* i currently refers to a sector that doesn't fit or it is -1 because all
670 * sectors have been processed. In both cases, exclude sector i.
671 */
672 *out_first_sector_idx = i + 1;
673 return sz;
674}
Fabio Utzig3488eef2017-06-12 10:25:43 -0300675#endif /* !MCUBOOT_OVERWRITE_ONLY */
Christopher Collins92ea77f2016-12-12 15:59:26 -0800676
677/**
678 * Erases a region of flash.
679 *
680 * @param flash_area_idx The ID of the flash area containing the region
681 * to erase.
682 * @param off The offset within the flash area to start the
683 * erase.
684 * @param sz The number of bytes to erase.
685 *
686 * @return 0 on success; nonzero on failure.
687 */
688static int
689boot_erase_sector(int flash_area_id, uint32_t off, uint32_t sz)
690{
691 const struct flash_area *fap;
692 int rc;
693
694 rc = flash_area_open(flash_area_id, &fap);
695 if (rc != 0) {
696 rc = BOOT_EFLASH;
697 goto done;
698 }
699
700 rc = flash_area_erase(fap, off, sz);
701 if (rc != 0) {
702 rc = BOOT_EFLASH;
703 goto done;
704 }
705
706 rc = 0;
707
708done:
709 flash_area_close(fap);
710 return rc;
711}
712
713/**
714 * Copies the contents of one flash region to another. You must erase the
715 * destination region prior to calling this function.
716 *
717 * @param flash_area_id_src The ID of the source flash area.
718 * @param flash_area_id_dst The ID of the destination flash area.
719 * @param off_src The offset within the source flash area to
720 * copy from.
721 * @param off_dst The offset within the destination flash area to
722 * copy to.
723 * @param sz The number of bytes to copy.
724 *
725 * @return 0 on success; nonzero on failure.
726 */
727static int
728boot_copy_sector(int flash_area_id_src, int flash_area_id_dst,
729 uint32_t off_src, uint32_t off_dst, uint32_t sz)
730{
731 const struct flash_area *fap_src;
732 const struct flash_area *fap_dst;
733 uint32_t bytes_copied;
734 int chunk_sz;
735 int rc;
736
737 static uint8_t buf[1024];
738
739 fap_src = NULL;
740 fap_dst = NULL;
741
742 rc = flash_area_open(flash_area_id_src, &fap_src);
743 if (rc != 0) {
744 rc = BOOT_EFLASH;
745 goto done;
746 }
747
748 rc = flash_area_open(flash_area_id_dst, &fap_dst);
749 if (rc != 0) {
750 rc = BOOT_EFLASH;
751 goto done;
752 }
753
754 bytes_copied = 0;
755 while (bytes_copied < sz) {
756 if (sz - bytes_copied > sizeof buf) {
757 chunk_sz = sizeof buf;
758 } else {
759 chunk_sz = sz - bytes_copied;
760 }
761
762 rc = flash_area_read(fap_src, off_src + bytes_copied, buf, chunk_sz);
763 if (rc != 0) {
764 rc = BOOT_EFLASH;
765 goto done;
766 }
767
768 rc = flash_area_write(fap_dst, off_dst + bytes_copied, buf, chunk_sz);
769 if (rc != 0) {
770 rc = BOOT_EFLASH;
771 goto done;
772 }
773
774 bytes_copied += chunk_sz;
775 }
776
777 rc = 0;
778
779done:
Fabio Utzige7686262017-06-28 09:26:54 -0300780 if (fap_src) {
781 flash_area_close(fap_src);
782 }
783 if (fap_dst) {
784 flash_area_close(fap_dst);
785 }
Christopher Collins92ea77f2016-12-12 15:59:26 -0800786 return rc;
787}
788
David Brown6b1b3b92017-09-19 08:59:10 -0600789#ifndef MCUBOOT_OVERWRITE_ONLY
Fabio Utzig2473ac02017-05-02 12:45:02 -0300790static inline int
Fabio Utzig46490722017-09-04 15:34:32 -0300791boot_status_init_by_id(int flash_area_id, const struct boot_status *bs)
Fabio Utzig2473ac02017-05-02 12:45:02 -0300792{
793 const struct flash_area *fap;
794 struct boot_swap_state swap_state;
795 int rc;
796
797 rc = flash_area_open(flash_area_id, &fap);
798 assert(rc == 0);
799
800 rc = boot_read_swap_state_by_id(FLASH_AREA_IMAGE_1, &swap_state);
801 assert(rc == 0);
802
Fabio Utzigde8a38a2017-05-23 11:15:01 -0400803 if (swap_state.image_ok == BOOT_FLAG_SET) {
Fabio Utzig2473ac02017-05-02 12:45:02 -0300804 rc = boot_write_image_ok(fap);
805 assert(rc == 0);
806 }
807
Fabio Utzig46490722017-09-04 15:34:32 -0300808 rc = boot_write_swap_size(fap, bs->swap_size);
809 assert(rc == 0);
810
Fabio Utzig2473ac02017-05-02 12:45:02 -0300811 rc = boot_write_magic(fap);
812 assert(rc == 0);
813
814 flash_area_close(fap);
815
816 return 0;
817}
David Brown6b1b3b92017-09-19 08:59:10 -0600818#endif
Fabio Utzig2473ac02017-05-02 12:45:02 -0300819
Fabio Utzig358c9352017-07-25 22:10:45 -0300820#ifndef MCUBOOT_OVERWRITE_ONLY
Fabio Utzig2473ac02017-05-02 12:45:02 -0300821static int
822boot_erase_last_sector_by_id(int flash_area_id)
823{
824 uint8_t slot;
825 uint32_t last_sector;
Fabio Utzig2473ac02017-05-02 12:45:02 -0300826 int rc;
827
828 switch (flash_area_id) {
829 case FLASH_AREA_IMAGE_0:
830 slot = 0;
831 break;
832 case FLASH_AREA_IMAGE_1:
833 slot = 1;
834 break;
835 default:
836 return BOOT_EFLASH;
837 }
838
Marti Bolivard3269fd2017-06-12 16:31:12 -0400839 last_sector = boot_img_num_sectors(&boot_data, slot) - 1;
Fabio Utzig2473ac02017-05-02 12:45:02 -0300840 rc = boot_erase_sector(flash_area_id,
Marti Bolivarea088872017-06-12 17:10:49 -0400841 boot_img_sector_off(&boot_data, slot, last_sector),
Marti Bolivard3269fd2017-06-12 16:31:12 -0400842 boot_img_sector_size(&boot_data, slot, last_sector));
Fabio Utzig2473ac02017-05-02 12:45:02 -0300843 assert(rc == 0);
844
845 return rc;
846}
Fabio Utzig358c9352017-07-25 22:10:45 -0300847#endif /* !MCUBOOT_OVERWRITE_ONLY */
Fabio Utzig2473ac02017-05-02 12:45:02 -0300848
Christopher Collins92ea77f2016-12-12 15:59:26 -0800849/**
850 * Swaps the contents of two flash regions within the two image slots.
851 *
852 * @param idx The index of the first sector in the range of
853 * sectors being swapped.
854 * @param sz The number of bytes to swap.
855 * @param bs The current boot status. This struct gets
856 * updated according to the outcome.
857 *
858 * @return 0 on success; nonzero on failure.
859 */
Fabio Utzig3488eef2017-06-12 10:25:43 -0300860#ifndef MCUBOOT_OVERWRITE_ONLY
Christopher Collins4772ac42017-02-27 20:08:01 -0800861static void
Christopher Collins92ea77f2016-12-12 15:59:26 -0800862boot_swap_sectors(int idx, uint32_t sz, struct boot_status *bs)
863{
Fabio Utzig7ebb7c22017-04-26 10:59:31 -0300864 const struct flash_area *fap;
Christopher Collins92ea77f2016-12-12 15:59:26 -0800865 uint32_t copy_sz;
Fabio Utzig7ebb7c22017-04-26 10:59:31 -0300866 uint32_t trailer_sz;
Christopher Collins92ea77f2016-12-12 15:59:26 -0800867 uint32_t img_off;
Fabio Utzig7ebb7c22017-04-26 10:59:31 -0300868 uint32_t scratch_trailer_off;
869 struct boot_swap_state swap_state;
Marti Bolivard3269fd2017-06-12 16:31:12 -0400870 size_t last_sector;
Christopher Collins92ea77f2016-12-12 15:59:26 -0800871 int rc;
872
873 /* Calculate offset from start of image area. */
Marti Bolivarea088872017-06-12 17:10:49 -0400874 img_off = boot_img_sector_off(&boot_data, 0, idx);
Christopher Collins92ea77f2016-12-12 15:59:26 -0800875
Fabio Utzig7ebb7c22017-04-26 10:59:31 -0300876 copy_sz = sz;
Marti Bolivare10a7392017-06-14 16:20:07 -0400877 trailer_sz = boot_slots_trailer_sz(BOOT_WRITE_SZ(&boot_data));
Fabio Utzig9678c972017-05-23 11:28:56 -0400878
879 /* sz in this function is always is always sized on a multiple of the
Marti Bolivarea088872017-06-12 17:10:49 -0400880 * sector size. The check against the start offset of the last sector
Fabio Utzig9678c972017-05-23 11:28:56 -0400881 * is to determine if we're swapping the last sector. The last sector
882 * needs special handling because it's where the trailer lives. If we're
883 * copying it, we need to use scratch to write the trailer temporarily.
884 *
885 * NOTE: `use_scratch` is a temporary flag (never written to flash) which
886 * controls if special handling is needed (swapping last sector).
887 */
Marti Bolivard3269fd2017-06-12 16:31:12 -0400888 last_sector = boot_img_num_sectors(&boot_data, 0) - 1;
Marti Bolivarea088872017-06-12 17:10:49 -0400889 if (img_off + sz > boot_img_sector_off(&boot_data, 0, last_sector)) {
Fabio Utzig7ebb7c22017-04-26 10:59:31 -0300890 copy_sz -= trailer_sz;
891 }
892
Fabio Utzig2473ac02017-05-02 12:45:02 -0300893 bs->use_scratch = (bs->idx == 0 && copy_sz != sz);
894
Christopher Collins92ea77f2016-12-12 15:59:26 -0800895 if (bs->state == 0) {
896 rc = boot_erase_sector(FLASH_AREA_IMAGE_SCRATCH, 0, sz);
Christopher Collins4772ac42017-02-27 20:08:01 -0800897 assert(rc == 0);
Christopher Collins92ea77f2016-12-12 15:59:26 -0800898
899 rc = boot_copy_sector(FLASH_AREA_IMAGE_1, FLASH_AREA_IMAGE_SCRATCH,
Fabio Utzig7ebb7c22017-04-26 10:59:31 -0300900 img_off, 0, copy_sz);
Christopher Collins4772ac42017-02-27 20:08:01 -0800901 assert(rc == 0);
Christopher Collins92ea77f2016-12-12 15:59:26 -0800902
Fabio Utzig2473ac02017-05-02 12:45:02 -0300903 if (bs->idx == 0) {
904 if (bs->use_scratch) {
Fabio Utzig46490722017-09-04 15:34:32 -0300905 boot_status_init_by_id(FLASH_AREA_IMAGE_SCRATCH, bs);
Fabio Utzig2473ac02017-05-02 12:45:02 -0300906 } else {
907 /* Prepare the status area... here it is known that the
908 * last sector is not being used by the image data so it's
909 * safe to erase.
910 */
911 rc = boot_erase_last_sector_by_id(FLASH_AREA_IMAGE_0);
Fabio Utzig7ebb7c22017-04-26 10:59:31 -0300912 assert(rc == 0);
Fabio Utzig2473ac02017-05-02 12:45:02 -0300913
Fabio Utzig46490722017-09-04 15:34:32 -0300914 boot_status_init_by_id(FLASH_AREA_IMAGE_0, bs);
Fabio Utzig7ebb7c22017-04-26 10:59:31 -0300915 }
Fabio Utzig7ebb7c22017-04-26 10:59:31 -0300916 }
917
Christopher Collins92ea77f2016-12-12 15:59:26 -0800918 bs->state = 1;
Christopher Collins4772ac42017-02-27 20:08:01 -0800919 rc = boot_write_status(bs);
920 assert(rc == 0);
Christopher Collins92ea77f2016-12-12 15:59:26 -0800921 }
Fabio Utzig7ebb7c22017-04-26 10:59:31 -0300922
Christopher Collins92ea77f2016-12-12 15:59:26 -0800923 if (bs->state == 1) {
924 rc = boot_erase_sector(FLASH_AREA_IMAGE_1, img_off, sz);
Christopher Collins4772ac42017-02-27 20:08:01 -0800925 assert(rc == 0);
Christopher Collins92ea77f2016-12-12 15:59:26 -0800926
Christopher Collins92ea77f2016-12-12 15:59:26 -0800927 rc = boot_copy_sector(FLASH_AREA_IMAGE_0, FLASH_AREA_IMAGE_1,
928 img_off, img_off, copy_sz);
Christopher Collins4772ac42017-02-27 20:08:01 -0800929 assert(rc == 0);
Christopher Collins92ea77f2016-12-12 15:59:26 -0800930
Fabio Utzig2473ac02017-05-02 12:45:02 -0300931 if (bs->idx == 0 && !bs->use_scratch) {
932 /* If not all sectors of the slot are being swapped,
933 * guarantee here that only slot0 will have the state.
934 */
935 rc = boot_erase_last_sector_by_id(FLASH_AREA_IMAGE_1);
936 assert(rc == 0);
937 }
938
Christopher Collins92ea77f2016-12-12 15:59:26 -0800939 bs->state = 2;
Christopher Collins4772ac42017-02-27 20:08:01 -0800940 rc = boot_write_status(bs);
941 assert(rc == 0);
Christopher Collins92ea77f2016-12-12 15:59:26 -0800942 }
Fabio Utzig7ebb7c22017-04-26 10:59:31 -0300943
Christopher Collins92ea77f2016-12-12 15:59:26 -0800944 if (bs->state == 2) {
945 rc = boot_erase_sector(FLASH_AREA_IMAGE_0, img_off, sz);
Christopher Collins4772ac42017-02-27 20:08:01 -0800946 assert(rc == 0);
Christopher Collins92ea77f2016-12-12 15:59:26 -0800947
Fabio Utzig7ebb7c22017-04-26 10:59:31 -0300948 /* NOTE: also copy trailer from scratch (has status info) */
Christopher Collins92ea77f2016-12-12 15:59:26 -0800949 rc = boot_copy_sector(FLASH_AREA_IMAGE_SCRATCH, FLASH_AREA_IMAGE_0,
Fabio Utzig7ebb7c22017-04-26 10:59:31 -0300950 0, img_off, copy_sz);
Christopher Collins4772ac42017-02-27 20:08:01 -0800951 assert(rc == 0);
Christopher Collins92ea77f2016-12-12 15:59:26 -0800952
Fabio Utzig94d998c2017-05-22 11:02:41 -0400953 if (bs->use_scratch) {
Fabio Utzig7ebb7c22017-04-26 10:59:31 -0300954 rc = flash_area_open(FLASH_AREA_IMAGE_SCRATCH, &fap);
955 assert(rc == 0);
956
957 scratch_trailer_off = boot_status_off(fap);
958
959 flash_area_close(fap);
960
961 rc = flash_area_open(FLASH_AREA_IMAGE_0, &fap);
962 assert(rc == 0);
963
964 /* copy current status that is being maintained in scratch */
965 rc = boot_copy_sector(FLASH_AREA_IMAGE_SCRATCH, FLASH_AREA_IMAGE_0,
Marti Bolivare10a7392017-06-14 16:20:07 -0400966 scratch_trailer_off,
Fabio Utziga0bc9b52017-06-28 09:19:55 -0300967 img_off + copy_sz,
Marti Bolivare10a7392017-06-14 16:20:07 -0400968 BOOT_STATUS_STATE_COUNT * BOOT_WRITE_SZ(&boot_data));
Fabio Utzig7ebb7c22017-04-26 10:59:31 -0300969 assert(rc == 0);
970
Fabio Utzig2473ac02017-05-02 12:45:02 -0300971 rc = boot_read_swap_state_by_id(FLASH_AREA_IMAGE_SCRATCH,
972 &swap_state);
Fabio Utzig7ebb7c22017-04-26 10:59:31 -0300973 assert(rc == 0);
974
Fabio Utzigde8a38a2017-05-23 11:15:01 -0400975 if (swap_state.image_ok == BOOT_FLAG_SET) {
Fabio Utzig7ebb7c22017-04-26 10:59:31 -0300976 rc = boot_write_image_ok(fap);
977 assert(rc == 0);
978 }
979
Fabio Utzig46490722017-09-04 15:34:32 -0300980 rc = boot_write_swap_size(fap, bs->swap_size);
981 assert(rc == 0);
982
Fabio Utzig7ebb7c22017-04-26 10:59:31 -0300983 rc = boot_write_magic(fap);
984 assert(rc == 0);
985
986 flash_area_close(fap);
987 }
988
Christopher Collins92ea77f2016-12-12 15:59:26 -0800989 bs->idx++;
990 bs->state = 0;
Fabio Utzig2473ac02017-05-02 12:45:02 -0300991 bs->use_scratch = 0;
Christopher Collins4772ac42017-02-27 20:08:01 -0800992 rc = boot_write_status(bs);
993 assert(rc == 0);
Christopher Collins92ea77f2016-12-12 15:59:26 -0800994 }
Christopher Collins92ea77f2016-12-12 15:59:26 -0800995}
Fabio Utzig3488eef2017-06-12 10:25:43 -0300996#endif /* !MCUBOOT_OVERWRITE_ONLY */
Christopher Collins92ea77f2016-12-12 15:59:26 -0800997
998/**
999 * Swaps the two images in flash. If a prior copy operation was interrupted
1000 * by a system reset, this function completes that operation.
1001 *
1002 * @param bs The current boot status. This function reads
1003 * this struct to determine if it is resuming
1004 * an interrupted swap operation. This
1005 * function writes the updated status to this
1006 * function on return.
1007 *
1008 * @return 0 on success; nonzero on failure.
1009 */
Fabio Utzig3488eef2017-06-12 10:25:43 -03001010#ifdef MCUBOOT_OVERWRITE_ONLY
David Brown17609d82017-05-05 09:41:34 -06001011static int
1012boot_copy_image(struct boot_status *bs)
1013{
Marti Bolivard3269fd2017-06-12 16:31:12 -04001014 size_t sect_count;
1015 size_t sect;
David Brown17609d82017-05-05 09:41:34 -06001016 int rc;
Fabio Utzig13d9e352017-10-05 20:32:31 -03001017 size_t size;
Marti Bolivard3269fd2017-06-12 16:31:12 -04001018 size_t this_size;
Fabio Utzig13d9e352017-10-05 20:32:31 -03001019 size_t last_sector;
1020
Fabio Utzigaaf767c2017-12-05 10:22:46 -02001021 (void)bs;
1022
Fabio Utzig13d9e352017-10-05 20:32:31 -03001023#if defined(MCUBOOT_OVERWRITE_ONLY_FAST)
1024 uint32_t src_size = 0;
1025 rc = boot_read_image_size(1, boot_img_hdr(&boot_data, 1), &src_size);
1026 assert(rc == 0);
1027#endif
David Brown17609d82017-05-05 09:41:34 -06001028
1029 BOOT_LOG_INF("Image upgrade slot1 -> slot0");
1030 BOOT_LOG_INF("Erasing slot0");
1031
Marti Bolivard3269fd2017-06-12 16:31:12 -04001032 sect_count = boot_img_num_sectors(&boot_data, 0);
Fabio Utzig13d9e352017-10-05 20:32:31 -03001033 for (sect = 0, size = 0; sect < sect_count; sect++) {
Marti Bolivard3269fd2017-06-12 16:31:12 -04001034 this_size = boot_img_sector_size(&boot_data, 0, sect);
David Brown17609d82017-05-05 09:41:34 -06001035 rc = boot_erase_sector(FLASH_AREA_IMAGE_0,
1036 size,
1037 this_size);
1038 assert(rc == 0);
1039
1040 size += this_size;
Fabio Utzig13d9e352017-10-05 20:32:31 -03001041
1042#if defined(MCUBOOT_OVERWRITE_ONLY_FAST)
1043 if (size >= src_size) {
1044 break;
1045 }
1046#endif
David Brown17609d82017-05-05 09:41:34 -06001047 }
1048
Fabio Utzig6a537ee2017-09-13 17:31:44 -03001049 BOOT_LOG_INF("Copying slot 1 to slot 0: 0x%lx bytes", size);
David Brown17609d82017-05-05 09:41:34 -06001050 rc = boot_copy_sector(FLASH_AREA_IMAGE_1, FLASH_AREA_IMAGE_0,
1051 0, 0, size);
1052
Fabio Utzig13d9e352017-10-05 20:32:31 -03001053 /*
1054 * Erases header and trailer. The trailer is erased because when a new
1055 * image is written without a trailer as is the case when using newt, the
1056 * trailer that was left might trigger a new upgrade.
1057 */
David Brown17609d82017-05-05 09:41:34 -06001058 rc = boot_erase_sector(FLASH_AREA_IMAGE_1,
Fabio Utzig13d9e352017-10-05 20:32:31 -03001059 boot_img_sector_off(&boot_data, 1, 0),
1060 boot_img_sector_size(&boot_data, 1, 0));
David Brown17609d82017-05-05 09:41:34 -06001061 assert(rc == 0);
Fabio Utzig13d9e352017-10-05 20:32:31 -03001062 last_sector = boot_img_num_sectors(&boot_data, 1) - 1;
1063 rc = boot_erase_sector(FLASH_AREA_IMAGE_1,
1064 boot_img_sector_off(&boot_data, 1, last_sector),
1065 boot_img_sector_size(&boot_data, 1, last_sector));
1066 assert(rc == 0);
1067
1068 /* TODO: Perhaps verify slot 0's signature again? */
David Brown17609d82017-05-05 09:41:34 -06001069
1070 return 0;
1071}
1072#else
Christopher Collins92ea77f2016-12-12 15:59:26 -08001073static int
1074boot_copy_image(struct boot_status *bs)
1075{
1076 uint32_t sz;
1077 int first_sector_idx;
1078 int last_sector_idx;
Fabio Utzigcd5774b2017-11-29 10:18:26 -02001079 uint32_t swap_idx;
Fabio Utzig2473ac02017-05-02 12:45:02 -03001080 struct image_header *hdr;
1081 uint32_t size;
1082 uint32_t copy_size;
Fabio Utzig2473ac02017-05-02 12:45:02 -03001083 int rc;
1084
1085 /* FIXME: just do this if asked by user? */
1086
1087 size = copy_size = 0;
1088
Fabio Utzig46490722017-09-04 15:34:32 -03001089 if (bs->idx == 0 && bs->state == 0) {
1090 /*
1091 * No swap ever happened, so need to find the largest image which
1092 * will be used to determine the amount of sectors to swap.
1093 */
1094 hdr = boot_img_hdr(&boot_data, 0);
Fabio Utzig2473ac02017-05-02 12:45:02 -03001095 if (hdr->ih_magic == IMAGE_MAGIC) {
Fabio Utzig46490722017-09-04 15:34:32 -03001096 rc = boot_read_image_size(0, hdr, &copy_size);
David Brownf5b33d82017-09-01 10:58:27 -06001097 assert(rc == 0);
Fabio Utzig2473ac02017-05-02 12:45:02 -03001098 }
Fabio Utzig2473ac02017-05-02 12:45:02 -03001099
Fabio Utzig46490722017-09-04 15:34:32 -03001100 hdr = boot_img_hdr(&boot_data, 1);
1101 if (hdr->ih_magic == IMAGE_MAGIC) {
1102 rc = boot_read_image_size(1, hdr, &size);
1103 assert(rc == 0);
1104 }
1105
1106 if (size > copy_size) {
1107 copy_size = size;
1108 }
1109
1110 bs->swap_size = copy_size;
1111 } else {
1112 /*
1113 * If a swap was under way, the swap_size should already be present
1114 * in the trailer...
1115 */
1116 rc = boot_read_swap_size(&bs->swap_size);
1117 assert(rc == 0);
1118
1119 copy_size = bs->swap_size;
Fabio Utzig2473ac02017-05-02 12:45:02 -03001120 }
1121
1122 size = 0;
1123 last_sector_idx = 0;
1124 while (1) {
Marti Bolivard3269fd2017-06-12 16:31:12 -04001125 size += boot_img_sector_size(&boot_data, 0, last_sector_idx);
Fabio Utzig2473ac02017-05-02 12:45:02 -03001126 if (size >= copy_size) {
1127 break;
1128 }
1129 last_sector_idx++;
1130 }
Christopher Collins92ea77f2016-12-12 15:59:26 -08001131
1132 swap_idx = 0;
Christopher Collins92ea77f2016-12-12 15:59:26 -08001133 while (last_sector_idx >= 0) {
1134 sz = boot_copy_sz(last_sector_idx, &first_sector_idx);
1135 if (swap_idx >= bs->idx) {
1136 boot_swap_sectors(first_sector_idx, sz, bs);
1137 }
1138
1139 last_sector_idx = first_sector_idx - 1;
1140 swap_idx++;
1141 }
1142
1143 return 0;
1144}
David Brown17609d82017-05-05 09:41:34 -06001145#endif
Christopher Collins92ea77f2016-12-12 15:59:26 -08001146
1147/**
Fabio Utzigdb5bd3c2017-07-13 22:20:22 -03001148 * Marks the image in slot 0 as fully copied.
Christopher Collins92ea77f2016-12-12 15:59:26 -08001149 */
Fabio Utzig8d0e5882017-09-13 17:32:44 -03001150#ifndef MCUBOOT_OVERWRITE_ONLY
Christopher Collins92ea77f2016-12-12 15:59:26 -08001151static int
Fabio Utzigdb5bd3c2017-07-13 22:20:22 -03001152boot_set_copy_done(void)
Christopher Collins92ea77f2016-12-12 15:59:26 -08001153{
1154 const struct flash_area *fap;
1155 int rc;
1156
1157 rc = flash_area_open(FLASH_AREA_IMAGE_0, &fap);
1158 if (rc != 0) {
1159 return BOOT_EFLASH;
1160 }
1161
1162 rc = boot_write_copy_done(fap);
Fabio Utzigdb5bd3c2017-07-13 22:20:22 -03001163 flash_area_close(fap);
1164 return rc;
Christopher Collins92ea77f2016-12-12 15:59:26 -08001165}
Fabio Utzig8d0e5882017-09-13 17:32:44 -03001166#endif /* !MCUBOOT_OVERWRITE_ONLY */
Christopher Collins92ea77f2016-12-12 15:59:26 -08001167
1168/**
1169 * Marks a reverted image in slot 0 as confirmed. This is necessary to ensure
1170 * the status bytes from the image revert operation don't get processed on a
1171 * subsequent boot.
Fabio Utzig1e56fcc2017-07-17 15:39:14 -03001172 *
1173 * NOTE: image_ok is tested before writing because if there's a valid permanent
1174 * image installed on slot0 and the new image to be upgrade to has a bad sig,
1175 * image_ok would be overwritten.
Christopher Collins92ea77f2016-12-12 15:59:26 -08001176 */
Fabio Utzig8d0e5882017-09-13 17:32:44 -03001177#ifndef MCUBOOT_OVERWRITE_ONLY
Christopher Collins92ea77f2016-12-12 15:59:26 -08001178static int
Fabio Utzigdb5bd3c2017-07-13 22:20:22 -03001179boot_set_image_ok(void)
Christopher Collins92ea77f2016-12-12 15:59:26 -08001180{
1181 const struct flash_area *fap;
Fabio Utzig1e56fcc2017-07-17 15:39:14 -03001182 struct boot_swap_state state;
Christopher Collins92ea77f2016-12-12 15:59:26 -08001183 int rc;
1184
1185 rc = flash_area_open(FLASH_AREA_IMAGE_0, &fap);
1186 if (rc != 0) {
1187 return BOOT_EFLASH;
1188 }
1189
Fabio Utzig1e56fcc2017-07-17 15:39:14 -03001190 rc = boot_read_swap_state(fap, &state);
1191 if (rc != 0) {
1192 rc = BOOT_EFLASH;
1193 goto out;
1194 }
1195
1196 if (state.image_ok == BOOT_FLAG_UNSET) {
1197 rc = boot_write_image_ok(fap);
1198 }
1199
1200out:
Fabio Utzigdb5bd3c2017-07-13 22:20:22 -03001201 flash_area_close(fap);
1202 return rc;
Christopher Collins92ea77f2016-12-12 15:59:26 -08001203}
Fabio Utzig8d0e5882017-09-13 17:32:44 -03001204#endif /* !MCUBOOT_OVERWRITE_ONLY */
Christopher Collins92ea77f2016-12-12 15:59:26 -08001205
1206/**
Christopher Collins0ff3c6c2016-12-21 12:04:17 -08001207 * Performs an image swap if one is required.
1208 *
1209 * @param out_swap_type On success, the type of swap performed gets
1210 * written here.
1211 *
1212 * @return 0 on success; nonzero on failure.
1213 */
1214static int
1215boot_swap_if_needed(int *out_swap_type)
1216{
1217 struct boot_status bs;
1218 int swap_type;
1219 int rc;
1220
1221 /* Determine if we rebooted in the middle of an image swap
1222 * operation.
1223 */
1224 rc = boot_read_status(&bs);
Fabio Utzig7ebb7c22017-04-26 10:59:31 -03001225 assert(rc == 0);
Christopher Collins0ff3c6c2016-12-21 12:04:17 -08001226 if (rc != 0) {
1227 return rc;
1228 }
1229
1230 /* If a partial swap was detected, complete it. */
1231 if (bs.idx != 0 || bs.state != 0) {
1232 rc = boot_copy_image(&bs);
1233 assert(rc == 0);
1234
Fabio Utzigb5b2f552017-06-30 10:03:47 -03001235 /* NOTE: here we have finished a swap resume. The initial request
1236 * was either a TEST or PERM swap, which now after the completed
1237 * swap will be determined to be respectively REVERT (was TEST)
1238 * or NONE (was PERM).
1239 */
1240
Christopher Collins0ff3c6c2016-12-21 12:04:17 -08001241 /* Extrapolate the type of the partial swap. We need this
1242 * information to know how to mark the swap complete in flash.
1243 */
1244 swap_type = boot_previous_swap_type();
1245 } else {
1246 swap_type = boot_validated_swap_type();
1247 switch (swap_type) {
1248 case BOOT_SWAP_TYPE_TEST:
Christopher Collinsfd7eb5c2016-12-21 13:46:08 -08001249 case BOOT_SWAP_TYPE_PERM:
Christopher Collins0ff3c6c2016-12-21 12:04:17 -08001250 case BOOT_SWAP_TYPE_REVERT:
1251 rc = boot_copy_image(&bs);
1252 assert(rc == 0);
1253 break;
1254 }
1255 }
1256
1257 *out_swap_type = swap_type;
1258 return 0;
1259}
1260
1261/**
Christopher Collins92ea77f2016-12-12 15:59:26 -08001262 * Prepares the booting process. This function moves images around in flash as
1263 * appropriate, and tells you what address to boot from.
1264 *
1265 * @param rsp On success, indicates how booting should occur.
1266 *
1267 * @return 0 on success; nonzero on failure.
1268 */
1269int
1270boot_go(struct boot_rsp *rsp)
1271{
Christopher Collins92ea77f2016-12-12 15:59:26 -08001272 int swap_type;
Marti Bolivar84898652017-06-13 17:20:22 -04001273 size_t slot;
Christopher Collins92ea77f2016-12-12 15:59:26 -08001274 int rc;
Marti Bolivarc0b47912017-06-13 17:18:09 -04001275 int fa_id;
David Brown52eee562017-07-05 11:25:09 -06001276 bool reload_headers = false;
Christopher Collins92ea77f2016-12-12 15:59:26 -08001277
1278 /* The array of slot sectors are defined here (as opposed to file scope) so
1279 * that they don't get allocated for non-boot-loader apps. This is
1280 * necessary because the gcc option "-fdata-sections" doesn't seem to have
Christopher Collins0ff3c6c2016-12-21 12:04:17 -08001281 * any effect in older gcc versions (e.g., 4.8.4).
Christopher Collins92ea77f2016-12-12 15:59:26 -08001282 */
Marti Bolivarc50926f2017-06-14 09:35:40 -04001283 static boot_sector_t slot0_sectors[BOOT_MAX_IMG_SECTORS];
1284 static boot_sector_t slot1_sectors[BOOT_MAX_IMG_SECTORS];
Christopher Collins92ea77f2016-12-12 15:59:26 -08001285 boot_data.imgs[0].sectors = slot0_sectors;
1286 boot_data.imgs[1].sectors = slot1_sectors;
1287
Marti Bolivarc0b47912017-06-13 17:18:09 -04001288 /* Open boot_data image areas for the duration of this call. */
1289 for (slot = 0; slot < BOOT_NUM_SLOTS; slot++) {
1290 fa_id = flash_area_id_from_image_slot(slot);
1291 rc = flash_area_open(fa_id, &BOOT_IMG_AREA(&boot_data, slot));
1292 assert(rc == 0);
1293 }
1294 rc = flash_area_open(FLASH_AREA_IMAGE_SCRATCH,
1295 &BOOT_SCRATCH_AREA(&boot_data));
1296 assert(rc == 0);
1297
Christopher Collins92ea77f2016-12-12 15:59:26 -08001298 /* Determine the sector layout of the image slots and scratch area. */
1299 rc = boot_read_sectors();
1300 if (rc != 0) {
Marti Bolivarc0b47912017-06-13 17:18:09 -04001301 goto out;
Christopher Collins92ea77f2016-12-12 15:59:26 -08001302 }
1303
1304 /* Attempt to read an image header from each slot. */
1305 rc = boot_read_image_headers();
1306 if (rc != 0) {
Marti Bolivarc0b47912017-06-13 17:18:09 -04001307 goto out;
Christopher Collins92ea77f2016-12-12 15:59:26 -08001308 }
1309
Christopher Collins0ff3c6c2016-12-21 12:04:17 -08001310 /* If the image slots aren't compatible, no swap is possible. Just boot
1311 * into slot 0.
1312 */
1313 if (boot_slots_compatible()) {
1314 rc = boot_swap_if_needed(&swap_type);
Fabio Utzig7ebb7c22017-04-26 10:59:31 -03001315 assert(rc == 0);
Christopher Collins0ff3c6c2016-12-21 12:04:17 -08001316 if (rc != 0) {
Marti Bolivarc0b47912017-06-13 17:18:09 -04001317 goto out;
Christopher Collins92ea77f2016-12-12 15:59:26 -08001318 }
Fabio Utzigdb5bd3c2017-07-13 22:20:22 -03001319
1320 /*
1321 * The following states need image_ok be explicitly set after the
1322 * swap was finished to avoid a new revert.
1323 */
1324 if (swap_type == BOOT_SWAP_TYPE_REVERT || swap_type == BOOT_SWAP_TYPE_FAIL) {
Fabio Utzig8d0e5882017-09-13 17:32:44 -03001325#ifndef MCUBOOT_OVERWRITE_ONLY
Fabio Utzig695d5642017-07-20 09:47:16 -03001326 rc = boot_set_image_ok();
1327 if (rc != 0) {
1328 swap_type = BOOT_SWAP_TYPE_PANIC;
1329 }
Fabio Utzig8d0e5882017-09-13 17:32:44 -03001330#endif /* !MCUBOOT_OVERWRITE_ONLY */
Fabio Utzigdb5bd3c2017-07-13 22:20:22 -03001331 }
Christopher Collins0ff3c6c2016-12-21 12:04:17 -08001332 } else {
1333 swap_type = BOOT_SWAP_TYPE_NONE;
Christopher Collins92ea77f2016-12-12 15:59:26 -08001334 }
1335
1336 switch (swap_type) {
1337 case BOOT_SWAP_TYPE_NONE:
1338 slot = 0;
1339 break;
1340
Fabio Utzig695d5642017-07-20 09:47:16 -03001341 case BOOT_SWAP_TYPE_TEST: /* fallthrough */
1342 case BOOT_SWAP_TYPE_PERM: /* fallthrough */
Christopher Collins92ea77f2016-12-12 15:59:26 -08001343 case BOOT_SWAP_TYPE_REVERT:
1344 slot = 1;
David Brown52eee562017-07-05 11:25:09 -06001345 reload_headers = true;
Fabio Utzig8d0e5882017-09-13 17:32:44 -03001346#ifndef MCUBOOT_OVERWRITE_ONLY
Fabio Utzig695d5642017-07-20 09:47:16 -03001347 rc = boot_set_copy_done();
1348 if (rc != 0) {
1349 swap_type = BOOT_SWAP_TYPE_PANIC;
1350 }
Fabio Utzig8d0e5882017-09-13 17:32:44 -03001351#endif /* !MCUBOOT_OVERWRITE_ONLY */
Christopher Collins92ea77f2016-12-12 15:59:26 -08001352 break;
1353
1354 case BOOT_SWAP_TYPE_FAIL:
1355 /* The image in slot 1 was invalid and is now erased. Ensure we don't
1356 * try to boot into it again on the next reboot. Do this by pretending
1357 * we just reverted back to slot 0.
1358 */
1359 slot = 0;
David Brown52eee562017-07-05 11:25:09 -06001360 reload_headers = true;
Christopher Collins92ea77f2016-12-12 15:59:26 -08001361 break;
1362
Fabio Utzigdb5bd3c2017-07-13 22:20:22 -03001363 default:
Fabio Utzig695d5642017-07-20 09:47:16 -03001364 swap_type = BOOT_SWAP_TYPE_PANIC;
1365 }
1366
1367 if (swap_type == BOOT_SWAP_TYPE_PANIC) {
1368 BOOT_LOG_ERR("panic!");
Fabio Utzigb5b2f552017-06-30 10:03:47 -03001369 assert(0);
Fabio Utzig695d5642017-07-20 09:47:16 -03001370
1371 /* Loop forever... */
1372 while (1) {}
Christopher Collins92ea77f2016-12-12 15:59:26 -08001373 }
1374
David Brown52eee562017-07-05 11:25:09 -06001375 if (reload_headers) {
Fabio Utzigc6a7b0c2017-09-13 19:01:15 -03001376 rc = boot_read_image_headers();
1377 if (rc != 0) {
1378 goto out;
1379 }
1380 /* Since headers were reloaded, it can be assumed we just performed a
1381 * swap or overwrite. Now the header info that should be used to
1382 * provide the data for the bootstrap, which previously was at Slot 1,
1383 * was updated to Slot 0.
1384 */
1385 slot = 0;
David Brown52eee562017-07-05 11:25:09 -06001386 }
1387
Marti Bolivarc1f939d2017-11-14 20:04:51 -05001388#ifdef MCUBOOT_VALIDATE_SLOT0
David Brown554c52e2017-06-30 16:01:07 -06001389 rc = boot_validate_slot(0);
1390 assert(rc == 0);
1391 if (rc != 0) {
1392 rc = BOOT_EBADIMAGE;
1393 goto out;
1394 }
Fabio Utzig1e56fcc2017-07-17 15:39:14 -03001395#else
Marti Bolivarc1f939d2017-11-14 20:04:51 -05001396 /* Even if we're not re-validating slot 0, we could be booting
1397 * onto an empty flash chip. At least do a basic sanity check that
1398 * the magic number on the image is OK.
1399 */
1400 if (boot_data.imgs[0].hdr.ih_magic != IMAGE_MAGIC) {
1401 BOOT_LOG_ERR("bad image magic 0x%x", boot_data.imgs[0].hdr.ih_magic);
1402 rc = BOOT_EBADIMAGE;
1403 goto out;
1404 }
David Brown554c52e2017-06-30 16:01:07 -06001405#endif
1406
Christopher Collins92ea77f2016-12-12 15:59:26 -08001407 /* Always boot from the primary slot. */
Marti Bolivar428cdbf2017-05-01 22:32:42 -04001408 rsp->br_flash_dev_id = boot_img_fa_device_id(&boot_data, 0);
Marti Bolivar88f48d92017-05-01 22:30:02 -04001409 rsp->br_image_off = boot_img_slot_off(&boot_data, 0);
Marti Bolivarf804f622017-06-12 15:41:48 -04001410 rsp->br_hdr = boot_img_hdr(&boot_data, slot);
Christopher Collins92ea77f2016-12-12 15:59:26 -08001411
Marti Bolivarc0b47912017-06-13 17:18:09 -04001412 out:
1413 flash_area_close(BOOT_SCRATCH_AREA(&boot_data));
1414 for (slot = 0; slot < BOOT_NUM_SLOTS; slot++) {
1415 flash_area_close(BOOT_IMG_AREA(&boot_data, BOOT_NUM_SLOTS - 1 - slot));
1416 }
1417 return rc;
Christopher Collins92ea77f2016-12-12 15:59:26 -08001418}
1419
1420int
1421split_go(int loader_slot, int split_slot, void **entry)
1422{
Marti Bolivarc50926f2017-06-14 09:35:40 -04001423 boot_sector_t *sectors;
Christopher Collins034a6202017-01-11 12:19:37 -08001424 uintptr_t entry_val;
Christopher Collins92ea77f2016-12-12 15:59:26 -08001425 int loader_flash_id;
Marti Bolivarc0b47912017-06-13 17:18:09 -04001426 int split_flash_id;
Christopher Collins92ea77f2016-12-12 15:59:26 -08001427 int rc;
1428
Christopher Collins92ea77f2016-12-12 15:59:26 -08001429 sectors = malloc(BOOT_MAX_IMG_SECTORS * 2 * sizeof *sectors);
1430 if (sectors == NULL) {
Marti Bolivarc0b47912017-06-13 17:18:09 -04001431 return SPLIT_GO_ERR;
Christopher Collins92ea77f2016-12-12 15:59:26 -08001432 }
Marti Bolivarc0b47912017-06-13 17:18:09 -04001433 boot_data.imgs[loader_slot].sectors = sectors + 0;
1434 boot_data.imgs[split_slot].sectors = sectors + BOOT_MAX_IMG_SECTORS;
1435
1436 loader_flash_id = flash_area_id_from_image_slot(loader_slot);
1437 rc = flash_area_open(loader_flash_id,
1438 &BOOT_IMG_AREA(&boot_data, split_slot));
1439 assert(rc == 0);
1440 split_flash_id = flash_area_id_from_image_slot(split_slot);
1441 rc = flash_area_open(split_flash_id,
1442 &BOOT_IMG_AREA(&boot_data, split_slot));
1443 assert(rc == 0);
Christopher Collins92ea77f2016-12-12 15:59:26 -08001444
1445 /* Determine the sector layout of the image slots and scratch area. */
1446 rc = boot_read_sectors();
1447 if (rc != 0) {
1448 rc = SPLIT_GO_ERR;
1449 goto done;
1450 }
1451
1452 rc = boot_read_image_headers();
1453 if (rc != 0) {
1454 goto done;
1455 }
1456
Christopher Collins92ea77f2016-12-12 15:59:26 -08001457 /* Don't check the bootable image flag because we could really call a
1458 * bootable or non-bootable image. Just validate that the image check
1459 * passes which is distinct from the normal check.
1460 */
Marti Bolivarf804f622017-06-12 15:41:48 -04001461 rc = split_image_check(boot_img_hdr(&boot_data, split_slot),
Marti Bolivarc0b47912017-06-13 17:18:09 -04001462 BOOT_IMG_AREA(&boot_data, split_slot),
Marti Bolivarf804f622017-06-12 15:41:48 -04001463 boot_img_hdr(&boot_data, loader_slot),
Marti Bolivarc0b47912017-06-13 17:18:09 -04001464 BOOT_IMG_AREA(&boot_data, loader_slot));
Christopher Collins92ea77f2016-12-12 15:59:26 -08001465 if (rc != 0) {
1466 rc = SPLIT_GO_NON_MATCHING;
1467 goto done;
1468 }
1469
Marti Bolivarea088872017-06-12 17:10:49 -04001470 entry_val = boot_img_slot_off(&boot_data, split_slot) +
Marti Bolivarf804f622017-06-12 15:41:48 -04001471 boot_img_hdr(&boot_data, split_slot)->ih_hdr_size;
Christopher Collins034a6202017-01-11 12:19:37 -08001472 *entry = (void *) entry_val;
Christopher Collins92ea77f2016-12-12 15:59:26 -08001473 rc = SPLIT_GO_OK;
1474
1475done:
Marti Bolivarc0b47912017-06-13 17:18:09 -04001476 flash_area_close(BOOT_IMG_AREA(&boot_data, split_slot));
1477 flash_area_close(BOOT_IMG_AREA(&boot_data, loader_slot));
Christopher Collins92ea77f2016-12-12 15:59:26 -08001478 free(sectors);
Christopher Collins92ea77f2016-12-12 15:59:26 -08001479 return rc;
1480}