blob: e94b2059fc0d50d36438ec89b9a52aaf6bb11dfa [file] [log] [blame]
Christopher Collins92ea77f2016-12-12 15:59:26 -08001/*
2 * Licensed to the Apache Software Foundation (ASF) under one
3 * or more contributor license agreements. See the NOTICE file
4 * distributed with this work for additional information
5 * regarding copyright ownership. The ASF licenses this file
6 * to you under the Apache License, Version 2.0 (the
7 * "License"); you may not use this file except in compliance
8 * with the License. You may obtain a copy of the License at
9 *
10 * http://www.apache.org/licenses/LICENSE-2.0
11 *
12 * Unless required by applicable law or agreed to in writing,
13 * software distributed under the License is distributed on an
14 * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
15 * KIND, either express or implied. See the License for the
16 * specific language governing permissions and limitations
17 * under the License.
18 */
19
20/**
21 * This file provides an interface to the boot loader. Functions defined in
22 * this file should only be called while the boot loader is running.
23 */
24
25#include <assert.h>
26#include <stddef.h>
27#include <inttypes.h>
28#include <stdlib.h>
29#include <string.h>
30#include "sysflash/sysflash.h"
31#include "flash_map/flash_map.h"
32#include <hal/hal_flash.h>
33#include <os/os_malloc.h>
34#include "bootutil/bootutil.h"
35#include "bootutil/image.h"
36#include "bootutil_priv.h"
37
Marti Bolivarfd20c762017-02-07 16:52:50 -050038#define BOOT_LOG_LEVEL BOOT_LOG_LEVEL_INFO
39#include "bootutil/bootutil_log.h"
40
Christopher Collins92ea77f2016-12-12 15:59:26 -080041#define BOOT_MAX_IMG_SECTORS 120
42
43/** Number of image slots in flash; currently limited to two. */
44#define BOOT_NUM_SLOTS 2
45
46static struct {
47 struct {
48 struct image_header hdr;
49 struct flash_area *sectors;
Christopher Collins0ff3c6c2016-12-21 12:04:17 -080050 int num_sectors;
Christopher Collins92ea77f2016-12-12 15:59:26 -080051 } imgs[BOOT_NUM_SLOTS];
52
Christopher Collins92ea77f2016-12-12 15:59:26 -080053 struct flash_area scratch_sector;
54
55 uint8_t write_sz;
56} boot_data;
57
58struct boot_status_table {
59 /**
60 * For each field, a value of 0 means "any".
61 */
62 uint8_t bst_magic_slot0;
63 uint8_t bst_magic_scratch;
64 uint8_t bst_copy_done_slot0;
65 uint8_t bst_status_source;
66};
67
68/**
69 * This set of tables maps swap state contents to boot status location.
70 * When searching for a match, these tables must be iterated in order.
71 */
72static const struct boot_status_table boot_status_tables[] = {
73 {
74 /* | slot-0 | scratch |
75 * ----------+------------+------------|
76 * magic | Good | Any |
77 * copy-done | 0x01 | N/A |
78 * ----------+------------+------------'
79 * source: none |
80 * ------------------------------------'
81 */
82 .bst_magic_slot0 = BOOT_MAGIC_GOOD,
83 .bst_magic_scratch = 0,
84 .bst_copy_done_slot0 = 0x01,
85 .bst_status_source = BOOT_STATUS_SOURCE_NONE,
86 },
87
88 {
89 /* | slot-0 | scratch |
90 * ----------+------------+------------|
91 * magic | Good | Any |
92 * copy-done | 0xff | N/A |
93 * ----------+------------+------------'
94 * source: slot 0 |
95 * ------------------------------------'
96 */
97 .bst_magic_slot0 = BOOT_MAGIC_GOOD,
98 .bst_magic_scratch = 0,
99 .bst_copy_done_slot0 = 0xff,
100 .bst_status_source = BOOT_STATUS_SOURCE_SLOT0,
101 },
102
103 {
104 /* | slot-0 | scratch |
105 * ----------+------------+------------|
106 * magic | Any | Good |
107 * copy-done | Any | N/A |
108 * ----------+------------+------------'
109 * source: scratch |
110 * ------------------------------------'
111 */
112 .bst_magic_slot0 = 0,
113 .bst_magic_scratch = BOOT_MAGIC_GOOD,
114 .bst_copy_done_slot0 = 0,
115 .bst_status_source = BOOT_STATUS_SOURCE_SCRATCH,
116 },
117
118 {
119 /* | slot-0 | scratch |
120 * ----------+------------+------------|
121 * magic | Unset | Any |
122 * copy-done | 0xff | N/A |
123 * ----------+------------+------------|
124 * source: varies |
125 * ------------------------------------+------------------------------+
126 * This represents one of two cases: |
127 * o No swaps ever (no status to read, so no harm in checking). |
128 * o Mid-revert; status in slot 0. |
129 * -------------------------------------------------------------------'
130 */
131 .bst_magic_slot0 = BOOT_MAGIC_UNSET,
132 .bst_magic_scratch = 0,
133 .bst_copy_done_slot0 = 0xff,
134 .bst_status_source = BOOT_STATUS_SOURCE_SLOT0,
135 },
136};
137
138#define BOOT_STATUS_TABLES_COUNT \
139 (sizeof boot_status_tables / sizeof boot_status_tables[0])
140
141/**
142 * This table indicates the next swap type that should be performed. The first
143 * column contains the current swap type. The second column contains the swap
144 * type that should be effected after the first completes.
145 */
146static const uint8_t boot_swap_trans_table[][2] = {
147 /* From To */
148 { BOOT_SWAP_TYPE_REVERT, BOOT_SWAP_TYPE_NONE },
Christopher Collinsfd7eb5c2016-12-21 13:46:08 -0800149 { BOOT_SWAP_TYPE_PERM, BOOT_SWAP_TYPE_NONE },
Christopher Collins92ea77f2016-12-12 15:59:26 -0800150 { BOOT_SWAP_TYPE_TEST, BOOT_SWAP_TYPE_REVERT },
151};
152
153#define BOOT_SWAP_TRANS_TABLE_SIZE \
154 (sizeof boot_swap_trans_table / sizeof boot_swap_trans_table[0])
155
Marti Bolivarfd20c762017-02-07 16:52:50 -0500156#define BOOT_LOG_SWAP_STATE(area, state) \
157 BOOT_LOG_INF("%s: magic=%s, copy_done=0x%x, image_ok=0x%x", \
158 (area), \
159 ((state)->magic == BOOT_MAGIC_GOOD ? "good" : \
160 (state)->magic == BOOT_MAGIC_UNSET ? "unset" : \
161 "bad"), \
162 (state)->copy_done, \
163 (state)->image_ok)
164
Christopher Collins92ea77f2016-12-12 15:59:26 -0800165/**
166 * Determines where in flash the most recent boot status is stored. The boot
167 * status is necessary for completing a swap that was interrupted by a boot
168 * loader reset.
169 *
170 * @return A BOOT_STATUS_SOURCE_[...] code indicating where * status should be read from.
171 */
172static int
173boot_status_source(void)
174{
175 const struct boot_status_table *table;
176 struct boot_swap_state state_scratch;
177 struct boot_swap_state state_slot0;
178 struct boot_swap_state state_slot1;
179 int rc;
180 int i;
Marti Bolivarfd20c762017-02-07 16:52:50 -0500181 uint8_t source;
Christopher Collins92ea77f2016-12-12 15:59:26 -0800182
183 rc = boot_read_swap_state_img(0, &state_slot0);
184 assert(rc == 0);
185
186 rc = boot_read_swap_state_img(1, &state_slot1);
187 assert(rc == 0);
188
189 rc = boot_read_swap_state_scratch(&state_scratch);
190 assert(rc == 0);
191
Marti Bolivarfd20c762017-02-07 16:52:50 -0500192 BOOT_LOG_SWAP_STATE("Image 0", &state_slot0);
193 BOOT_LOG_SWAP_STATE("Image 1", &state_slot1);
194 BOOT_LOG_SWAP_STATE("Scratch", &state_scratch);
195
Christopher Collins92ea77f2016-12-12 15:59:26 -0800196 for (i = 0; i < BOOT_STATUS_TABLES_COUNT; i++) {
197 table = boot_status_tables + i;
198
199 if ((table->bst_magic_slot0 == 0 ||
200 table->bst_magic_slot0 == state_slot0.magic) &&
201 (table->bst_magic_scratch == 0 ||
202 table->bst_magic_scratch == state_scratch.magic) &&
203 (table->bst_copy_done_slot0 == 0 ||
204 table->bst_copy_done_slot0 == state_slot0.copy_done)) {
Marti Bolivarfd20c762017-02-07 16:52:50 -0500205 source = table->bst_status_source;
206 BOOT_LOG_INF("Boot source: %s",
207 source == BOOT_STATUS_SOURCE_NONE ? "none" :
208 source == BOOT_STATUS_SOURCE_SCRATCH ? "scratch" :
209 source == BOOT_STATUS_SOURCE_SLOT0 ? "slot 0" :
210 "BUG; can't happen");
211 return source;
Christopher Collins92ea77f2016-12-12 15:59:26 -0800212 }
213 }
214
Marti Bolivarfd20c762017-02-07 16:52:50 -0500215 BOOT_LOG_INF("Boot source: none");
Christopher Collins92ea77f2016-12-12 15:59:26 -0800216 return BOOT_STATUS_SOURCE_NONE;
217}
218
219/**
220 * Calculates the type of swap that just completed.
221 */
222static int
223boot_previous_swap_type(void)
224{
225 int post_swap_type;
226 int i;
227
228 post_swap_type = boot_swap_type();
229
230 for (i = 0; i < BOOT_SWAP_TRANS_TABLE_SIZE; i++){
231 if (boot_swap_trans_table[i][1] == post_swap_type) {
232 return boot_swap_trans_table[i][0];
233 }
234 }
235
236 /* XXX: Temporary assert. */
237 assert(0);
238
239 return BOOT_SWAP_TYPE_REVERT;
240}
241
242static int
243boot_read_image_header(int slot, struct image_header *out_hdr)
244{
245 const struct flash_area *fap;
246 int area_id;
247 int rc;
248
249 area_id = flash_area_id_from_image_slot(slot);
250 rc = flash_area_open(area_id, &fap);
251 if (rc != 0) {
252 rc = BOOT_EFLASH;
253 goto done;
254 }
255
256 rc = flash_area_read(fap, 0, out_hdr, sizeof *out_hdr);
257 if (rc != 0) {
258 rc = BOOT_EFLASH;
259 goto done;
260 }
261
262 rc = 0;
263
264done:
265 flash_area_close(fap);
266 return rc;
267}
268
269static int
270boot_read_image_headers(void)
271{
272 int rc;
273 int i;
274
275 for (i = 0; i < BOOT_NUM_SLOTS; i++) {
276 rc = boot_read_image_header(i, &boot_data.imgs[i].hdr);
277 if (rc != 0) {
Christopher Collins0ff3c6c2016-12-21 12:04:17 -0800278 /* If at least one header was read successfully, then the boot
279 * loader can attempt a boot. Failure to read any headers is a
280 * fatal error.
281 */
282 if (i > 0) {
283 return 0;
284 } else {
285 return rc;
286 }
Christopher Collins92ea77f2016-12-12 15:59:26 -0800287 }
288 }
289
290 return 0;
291}
292
293static uint8_t
294boot_write_sz(void)
295{
296 uint8_t elem_sz;
297 uint8_t align;
298
299 /* Figure out what size to write update status update as. The size depends
300 * on what the minimum write size is for scratch area, active image slot.
301 * We need to use the bigger of those 2 values.
302 */
303 elem_sz = hal_flash_align(boot_data.imgs[0].sectors[0].fa_device_id);
304 align = hal_flash_align(boot_data.scratch_sector.fa_device_id);
305 if (align > elem_sz) {
306 elem_sz = align;
307 }
308
309 return elem_sz;
310}
311
Christopher Collins0ff3c6c2016-12-21 12:04:17 -0800312static int
313boot_slots_compatible(void)
314{
315 const struct flash_area *sector0;
316 const struct flash_area *sector1;
317 int i;
318
319 /* Ensure both image slots have identical sector layouts. */
320 if (boot_data.imgs[0].num_sectors != boot_data.imgs[1].num_sectors) {
321 return 0;
322 }
323 for (i = 0; i < boot_data.imgs[0].num_sectors; i++) {
324 sector0 = boot_data.imgs[0].sectors + i;
325 sector1 = boot_data.imgs[1].sectors + i;
326 if (sector0->fa_size != sector1->fa_size) {
327 return 0;
328 }
329 }
330
331 return 1;
332}
333
Christopher Collins92ea77f2016-12-12 15:59:26 -0800334/**
335 * Determines the sector layout of both image slots and the scratch area.
336 * This information is necessary for calculating the number of bytes to erase
337 * and copy during an image swap. The information collected during this
338 * function is used to populate the boot_data global.
339 */
340static int
341boot_read_sectors(void)
342{
Christopher Collins92ea77f2016-12-12 15:59:26 -0800343 const struct flash_area *scratch;
344 int num_sectors_slot0;
345 int num_sectors_slot1;
346 int rc;
Christopher Collins92ea77f2016-12-12 15:59:26 -0800347
348 num_sectors_slot0 = BOOT_MAX_IMG_SECTORS;
349 rc = flash_area_to_sectors(FLASH_AREA_IMAGE_0, &num_sectors_slot0,
350 boot_data.imgs[0].sectors);
351 if (rc != 0) {
352 return BOOT_EFLASH;
353 }
Christopher Collins0ff3c6c2016-12-21 12:04:17 -0800354 boot_data.imgs[0].num_sectors = num_sectors_slot0;
Christopher Collins92ea77f2016-12-12 15:59:26 -0800355
356 num_sectors_slot1 = BOOT_MAX_IMG_SECTORS;
357 rc = flash_area_to_sectors(FLASH_AREA_IMAGE_1, &num_sectors_slot1,
358 boot_data.imgs[1].sectors);
359 if (rc != 0) {
360 return BOOT_EFLASH;
361 }
Christopher Collins0ff3c6c2016-12-21 12:04:17 -0800362 boot_data.imgs[1].num_sectors = num_sectors_slot1;
Christopher Collins92ea77f2016-12-12 15:59:26 -0800363
364 rc = flash_area_open(FLASH_AREA_IMAGE_SCRATCH, &scratch);
365 if (rc != 0) {
366 return BOOT_EFLASH;
367 }
368 boot_data.scratch_sector = *scratch;
Christopher Collins92ea77f2016-12-12 15:59:26 -0800369
370 boot_data.write_sz = boot_write_sz();
371
372 return 0;
373}
374
375static uint32_t
376boot_status_internal_off(int idx, int state, int elem_sz)
377{
378 int idx_sz;
379
380 idx_sz = elem_sz * BOOT_STATUS_STATE_COUNT;
381
382 return idx * idx_sz + state * elem_sz;
383}
384
385/**
386 * Reads the status of a partially-completed swap, if any. This is necessary
387 * to recover in case the boot lodaer was reset in the middle of a swap
388 * operation.
389 */
390static int
391boot_read_status_bytes(const struct flash_area *fap, struct boot_status *bs)
392{
393 uint32_t off;
394 uint8_t status;
395 int found;
396 int rc;
397 int i;
398
399 off = boot_status_off(fap);
400
401 found = 0;
402 for (i = 0; i < BOOT_STATUS_MAX_ENTRIES; i++) {
403 rc = flash_area_read(fap, off + i * boot_data.write_sz, &status, 1);
404 if (rc != 0) {
405 return BOOT_EFLASH;
406 }
407
408 if (status == 0xff) {
409 if (found) {
410 break;
411 }
412 } else if (!found) {
413 found = 1;
414 }
415 }
416
417 if (found) {
418 i--;
419 bs->idx = i / BOOT_STATUS_STATE_COUNT;
420 bs->state = i % BOOT_STATUS_STATE_COUNT;
421 }
422
423 return 0;
424}
425
426/**
427 * Reads the boot status from the flash. The boot status contains
428 * the current state of an interrupted image copy operation. If the boot
429 * status is not present, or it indicates that previous copy finished,
430 * there is no operation in progress.
431 */
432static int
433boot_read_status(struct boot_status *bs)
434{
435 const struct flash_area *fap;
436 int status_loc;
437 int area_id;
438 int rc;
439
440 memset(bs, 0, sizeof *bs);
441
442 status_loc = boot_status_source();
443 switch (status_loc) {
444 case BOOT_STATUS_SOURCE_NONE:
445 return 0;
446
447 case BOOT_STATUS_SOURCE_SCRATCH:
448 area_id = FLASH_AREA_IMAGE_SCRATCH;
449 break;
450
451 case BOOT_STATUS_SOURCE_SLOT0:
452 area_id = FLASH_AREA_IMAGE_0;
453 break;
454
455 default:
456 assert(0);
457 return BOOT_EBADARGS;
458 }
459
460 rc = flash_area_open(area_id, &fap);
461 if (rc != 0) {
462 return BOOT_EFLASH;
463 }
464
465 rc = boot_read_status_bytes(fap, bs);
466 if (rc != 0) {
467 return rc;
468 }
469
470 return 0;
471}
472
473/**
474 * Writes the supplied boot status to the flash file system. The boot status
475 * contains the current state of an in-progress image copy operation.
476 *
477 * @param bs The boot status to write.
478 *
479 * @return 0 on success; nonzero on failure.
480 */
481int
482boot_write_status(struct boot_status *bs)
483{
484 const struct flash_area *fap;
485 uint32_t off;
486 int area_id;
487 int rc;
David Brown9d725462017-01-23 15:50:58 -0700488 uint8_t buf[8];
489 uint8_t align;
Christopher Collins92ea77f2016-12-12 15:59:26 -0800490
491 if (bs->idx == 0) {
492 /* Write to scratch. */
493 area_id = FLASH_AREA_IMAGE_SCRATCH;
494 } else {
495 /* Write to slot 0. */
496 area_id = FLASH_AREA_IMAGE_0;
497 }
498
499 rc = flash_area_open(area_id, &fap);
500 if (rc != 0) {
501 rc = BOOT_EFLASH;
502 goto done;
503 }
504
505 off = boot_status_off(fap) +
506 boot_status_internal_off(bs->idx, bs->state, boot_data.write_sz);
507
David Brown9d725462017-01-23 15:50:58 -0700508 align = hal_flash_align(fap->fa_device_id);
509 // ASSERT(align <= 8);
510 memset(buf, 0xFF, 8);
511 buf[0] = bs->state;
512
513 rc = flash_area_write(fap, off, buf, align);
Christopher Collins92ea77f2016-12-12 15:59:26 -0800514 if (rc != 0) {
515 rc = BOOT_EFLASH;
516 goto done;
517 }
518
519 rc = 0;
520
521done:
522 flash_area_close(fap);
523 return rc;
524}
525
526/*
527 * Validate image hash/signature in a slot.
528 */
529static int
530boot_image_check(struct image_header *hdr, const struct flash_area *fap)
531{
David Browndb1d9d32017-01-06 11:07:54 -0700532 static uint8_t tmpbuf[BOOT_TMPBUF_SZ];
Christopher Collins92ea77f2016-12-12 15:59:26 -0800533
Christopher Collins92ea77f2016-12-12 15:59:26 -0800534 if (bootutil_img_validate(hdr, fap, tmpbuf, BOOT_TMPBUF_SZ,
535 NULL, 0, NULL)) {
536 return BOOT_EBADIMAGE;
537 }
538 return 0;
539}
540
541static int
542split_image_check(struct image_header *app_hdr,
543 const struct flash_area *app_fap,
544 struct image_header *loader_hdr,
545 const struct flash_area *loader_fap)
546{
547 static void *tmpbuf;
548 uint8_t loader_hash[32];
549
550 if (!tmpbuf) {
551 tmpbuf = malloc(BOOT_TMPBUF_SZ);
552 if (!tmpbuf) {
553 return BOOT_ENOMEM;
554 }
555 }
556
557 if (bootutil_img_validate(loader_hdr, loader_fap, tmpbuf, BOOT_TMPBUF_SZ,
558 NULL, 0, loader_hash)) {
559 return BOOT_EBADIMAGE;
560 }
561
562 if (bootutil_img_validate(app_hdr, app_fap, tmpbuf, BOOT_TMPBUF_SZ,
563 loader_hash, 32, NULL)) {
564 return BOOT_EBADIMAGE;
565 }
566
567 return 0;
568}
569
570static int
David Brownd930ec62016-12-14 07:59:48 -0700571boot_validate_slot(int slot)
Christopher Collins92ea77f2016-12-12 15:59:26 -0800572{
573 const struct flash_area *fap;
574 int rc;
575
David Brownd930ec62016-12-14 07:59:48 -0700576 if (boot_data.imgs[slot].hdr.ih_magic == 0xffffffff ||
577 boot_data.imgs[slot].hdr.ih_flags & IMAGE_F_NON_BOOTABLE) {
Christopher Collins92ea77f2016-12-12 15:59:26 -0800578
579 /* No bootable image in slot 1; continue booting from slot 0. */
580 return -1;
581 }
582
583 /* Image in slot 1 is invalid. Erase the image and continue booting
584 * from slot 0.
585 */
David Brownd930ec62016-12-14 07:59:48 -0700586 rc = flash_area_open(flash_area_id_from_image_slot(slot), &fap);
Christopher Collins92ea77f2016-12-12 15:59:26 -0800587 if (rc != 0) {
588 return BOOT_EFLASH;
589 }
590
David Brownd930ec62016-12-14 07:59:48 -0700591 if ((boot_data.imgs[slot].hdr.ih_magic != IMAGE_MAGIC ||
592 boot_image_check(&boot_data.imgs[slot].hdr, fap) != 0) &&
593 slot == 1) {
Christopher Collins92ea77f2016-12-12 15:59:26 -0800594
595 /* Image in slot 1 is invalid. Erase the image and continue booting
596 * from slot 0.
597 */
598 flash_area_erase(fap, 0, fap->fa_size);
599 return -1;
600 }
601
602 flash_area_close(fap);
603
604 /* Image in slot 1 is valid. */
605 return 0;
606}
607
608/**
609 * Determines which swap operation to perform, if any. If it is determined
610 * that a swap operation is required, the image in the second slot is checked
611 * for validity. If the image in the second slot is invalid, it is erased, and
612 * a swap type of "none" is indicated.
613 *
614 * @return The type of swap to perform (BOOT_SWAP_TYPE...)
615 */
616static int
617boot_validated_swap_type(void)
618{
619 int swap_type;
620 int rc;
621
622 swap_type = boot_swap_type();
623 if (swap_type == BOOT_SWAP_TYPE_NONE) {
624 /* Continue using slot 0. */
625 return BOOT_SWAP_TYPE_NONE;
626 }
627
628 /* Boot loader wants to switch to slot 1. Ensure image is valid. */
David Brownd930ec62016-12-14 07:59:48 -0700629 rc = boot_validate_slot(1);
Christopher Collins92ea77f2016-12-12 15:59:26 -0800630 if (rc != 0) {
631 return BOOT_SWAP_TYPE_FAIL;
632 }
633
634 return swap_type;
635}
636
637/**
638 * Calculates the number of sectors the scratch area can contain. A "last"
639 * source sector is specified because images are copied backwards in flash
640 * (final index to index number 0).
641 *
642 * @param last_sector_idx The index of the last source sector
643 * (inclusive).
644 * @param out_first_sector_idx The index of the first source sector
645 * (inclusive) gets written here.
646 *
647 * @return The number of bytes comprised by the
648 * [first-sector, last-sector] range.
649 */
650static uint32_t
651boot_copy_sz(int last_sector_idx, int *out_first_sector_idx)
652{
653 uint32_t new_sz;
654 uint32_t sz;
655 int i;
656
657 sz = 0;
658
659 for (i = last_sector_idx; i >= 0; i--) {
660 new_sz = sz + boot_data.imgs[0].sectors[i].fa_size;
661 if (new_sz > boot_data.scratch_sector.fa_size) {
662 break;
663 }
664 sz = new_sz;
665 }
666
667 /* i currently refers to a sector that doesn't fit or it is -1 because all
668 * sectors have been processed. In both cases, exclude sector i.
669 */
670 *out_first_sector_idx = i + 1;
671 return sz;
672}
673
674/**
675 * Erases a region of flash.
676 *
677 * @param flash_area_idx The ID of the flash area containing the region
678 * to erase.
679 * @param off The offset within the flash area to start the
680 * erase.
681 * @param sz The number of bytes to erase.
682 *
683 * @return 0 on success; nonzero on failure.
684 */
685static int
686boot_erase_sector(int flash_area_id, uint32_t off, uint32_t sz)
687{
688 const struct flash_area *fap;
689 int rc;
690
691 rc = flash_area_open(flash_area_id, &fap);
692 if (rc != 0) {
693 rc = BOOT_EFLASH;
694 goto done;
695 }
696
697 rc = flash_area_erase(fap, off, sz);
698 if (rc != 0) {
699 rc = BOOT_EFLASH;
700 goto done;
701 }
702
703 rc = 0;
704
705done:
706 flash_area_close(fap);
707 return rc;
708}
709
710/**
711 * Copies the contents of one flash region to another. You must erase the
712 * destination region prior to calling this function.
713 *
714 * @param flash_area_id_src The ID of the source flash area.
715 * @param flash_area_id_dst The ID of the destination flash area.
716 * @param off_src The offset within the source flash area to
717 * copy from.
718 * @param off_dst The offset within the destination flash area to
719 * copy to.
720 * @param sz The number of bytes to copy.
721 *
722 * @return 0 on success; nonzero on failure.
723 */
724static int
725boot_copy_sector(int flash_area_id_src, int flash_area_id_dst,
726 uint32_t off_src, uint32_t off_dst, uint32_t sz)
727{
728 const struct flash_area *fap_src;
729 const struct flash_area *fap_dst;
730 uint32_t bytes_copied;
731 int chunk_sz;
732 int rc;
733
734 static uint8_t buf[1024];
735
736 fap_src = NULL;
737 fap_dst = NULL;
738
739 rc = flash_area_open(flash_area_id_src, &fap_src);
740 if (rc != 0) {
741 rc = BOOT_EFLASH;
742 goto done;
743 }
744
745 rc = flash_area_open(flash_area_id_dst, &fap_dst);
746 if (rc != 0) {
747 rc = BOOT_EFLASH;
748 goto done;
749 }
750
751 bytes_copied = 0;
752 while (bytes_copied < sz) {
753 if (sz - bytes_copied > sizeof buf) {
754 chunk_sz = sizeof buf;
755 } else {
756 chunk_sz = sz - bytes_copied;
757 }
758
759 rc = flash_area_read(fap_src, off_src + bytes_copied, buf, chunk_sz);
760 if (rc != 0) {
761 rc = BOOT_EFLASH;
762 goto done;
763 }
764
765 rc = flash_area_write(fap_dst, off_dst + bytes_copied, buf, chunk_sz);
766 if (rc != 0) {
767 rc = BOOT_EFLASH;
768 goto done;
769 }
770
771 bytes_copied += chunk_sz;
772 }
773
774 rc = 0;
775
776done:
777 flash_area_close(fap_src);
778 flash_area_close(fap_dst);
779 return rc;
780}
781
782/**
783 * Swaps the contents of two flash regions within the two image slots.
784 *
785 * @param idx The index of the first sector in the range of
786 * sectors being swapped.
787 * @param sz The number of bytes to swap.
788 * @param bs The current boot status. This struct gets
789 * updated according to the outcome.
790 *
791 * @return 0 on success; nonzero on failure.
792 */
793static int
794boot_swap_sectors(int idx, uint32_t sz, struct boot_status *bs)
795{
796 uint32_t copy_sz;
797 uint32_t img_off;
798 int rc;
799
800 /* Calculate offset from start of image area. */
801 img_off = boot_data.imgs[0].sectors[idx].fa_off -
802 boot_data.imgs[0].sectors[0].fa_off;
803
804 if (bs->state == 0) {
805 rc = boot_erase_sector(FLASH_AREA_IMAGE_SCRATCH, 0, sz);
806 if (rc != 0) {
807 return rc;
808 }
809
810 rc = boot_copy_sector(FLASH_AREA_IMAGE_1, FLASH_AREA_IMAGE_SCRATCH,
811 img_off, 0, sz);
812 if (rc != 0) {
813 return rc;
814 }
815
816 bs->state = 1;
817 (void)boot_write_status(bs);
818 }
819 if (bs->state == 1) {
820 rc = boot_erase_sector(FLASH_AREA_IMAGE_1, img_off, sz);
821 if (rc != 0) {
822 return rc;
823 }
824
825 copy_sz = sz;
826 if (boot_data.imgs[0].sectors[idx].fa_off + sz >=
827 boot_data.imgs[1].sectors[0].fa_off) {
828
829 /* This is the end of the area. Don't copy the image state into
830 * slot 1.
831 */
832 copy_sz -= boot_trailer_sz(boot_data.write_sz);
833 }
834
835 rc = boot_copy_sector(FLASH_AREA_IMAGE_0, FLASH_AREA_IMAGE_1,
836 img_off, img_off, copy_sz);
837 if (rc != 0) {
838 return rc;
839 }
840
841 bs->state = 2;
842 (void)boot_write_status(bs);
843 }
844 if (bs->state == 2) {
845 rc = boot_erase_sector(FLASH_AREA_IMAGE_0, img_off, sz);
846 if (rc != 0) {
847 return rc;
848 }
849
850 rc = boot_copy_sector(FLASH_AREA_IMAGE_SCRATCH, FLASH_AREA_IMAGE_0,
851 0, img_off, sz);
852 if (rc != 0) {
853 return rc;
854 }
855
856 bs->idx++;
857 bs->state = 0;
858 (void)boot_write_status(bs);
859 }
860
861 return 0;
862}
863
864/**
865 * Swaps the two images in flash. If a prior copy operation was interrupted
866 * by a system reset, this function completes that operation.
867 *
868 * @param bs The current boot status. This function reads
869 * this struct to determine if it is resuming
870 * an interrupted swap operation. This
871 * function writes the updated status to this
872 * function on return.
873 *
874 * @return 0 on success; nonzero on failure.
875 */
876static int
877boot_copy_image(struct boot_status *bs)
878{
879 uint32_t sz;
880 int first_sector_idx;
881 int last_sector_idx;
882 int swap_idx;
883
884 swap_idx = 0;
Christopher Collins0ff3c6c2016-12-21 12:04:17 -0800885 last_sector_idx = boot_data.imgs[0].num_sectors - 1;
Christopher Collins92ea77f2016-12-12 15:59:26 -0800886 while (last_sector_idx >= 0) {
887 sz = boot_copy_sz(last_sector_idx, &first_sector_idx);
888 if (swap_idx >= bs->idx) {
889 boot_swap_sectors(first_sector_idx, sz, bs);
890 }
891
892 last_sector_idx = first_sector_idx - 1;
893 swap_idx++;
894 }
895
896 return 0;
897}
898
899/**
900 * Marks a test image in slot 0 as fully copied.
901 */
902static int
903boot_finalize_test_swap(void)
904{
905 const struct flash_area *fap;
906 int rc;
907
908 rc = flash_area_open(FLASH_AREA_IMAGE_0, &fap);
909 if (rc != 0) {
910 return BOOT_EFLASH;
911 }
912
913 rc = boot_write_copy_done(fap);
914 if (rc != 0) {
915 return rc;
916 }
917
918 return 0;
919}
920
921/**
922 * Marks a reverted image in slot 0 as confirmed. This is necessary to ensure
923 * the status bytes from the image revert operation don't get processed on a
924 * subsequent boot.
925 */
926static int
927boot_finalize_revert_swap(void)
928{
929 const struct flash_area *fap;
930 struct boot_swap_state state_slot0;
931 int rc;
932
933 rc = flash_area_open(FLASH_AREA_IMAGE_0, &fap);
934 if (rc != 0) {
935 return BOOT_EFLASH;
936 }
937
938 rc = boot_read_swap_state(fap, &state_slot0);
939 if (rc != 0) {
940 return BOOT_EFLASH;
941 }
942
943 if (state_slot0.magic == BOOT_MAGIC_UNSET) {
944 rc = boot_write_magic(fap);
945 if (rc != 0) {
946 return rc;
947 }
948 }
949
950 if (state_slot0.copy_done == 0xff) {
951 rc = boot_write_copy_done(fap);
952 if (rc != 0) {
953 return rc;
954 }
955 }
956
957 if (state_slot0.image_ok == 0xff) {
958 rc = boot_write_image_ok(fap);
959 if (rc != 0) {
960 return rc;
961 }
962 }
963
964 return 0;
965}
966
967/**
Christopher Collins0ff3c6c2016-12-21 12:04:17 -0800968 * Performs an image swap if one is required.
969 *
970 * @param out_swap_type On success, the type of swap performed gets
971 * written here.
972 *
973 * @return 0 on success; nonzero on failure.
974 */
975static int
976boot_swap_if_needed(int *out_swap_type)
977{
978 struct boot_status bs;
979 int swap_type;
980 int rc;
981
982 /* Determine if we rebooted in the middle of an image swap
983 * operation.
984 */
985 rc = boot_read_status(&bs);
986 if (rc != 0) {
987 return rc;
988 }
989
990 /* If a partial swap was detected, complete it. */
991 if (bs.idx != 0 || bs.state != 0) {
992 rc = boot_copy_image(&bs);
993 assert(rc == 0);
994
995 /* Extrapolate the type of the partial swap. We need this
996 * information to know how to mark the swap complete in flash.
997 */
998 swap_type = boot_previous_swap_type();
999 } else {
1000 swap_type = boot_validated_swap_type();
1001 switch (swap_type) {
1002 case BOOT_SWAP_TYPE_TEST:
Christopher Collinsfd7eb5c2016-12-21 13:46:08 -08001003 case BOOT_SWAP_TYPE_PERM:
Christopher Collins0ff3c6c2016-12-21 12:04:17 -08001004 case BOOT_SWAP_TYPE_REVERT:
1005 rc = boot_copy_image(&bs);
1006 assert(rc == 0);
1007 break;
1008 }
1009 }
1010
1011 *out_swap_type = swap_type;
1012 return 0;
1013}
1014
1015/**
Christopher Collins92ea77f2016-12-12 15:59:26 -08001016 * Prepares the booting process. This function moves images around in flash as
1017 * appropriate, and tells you what address to boot from.
1018 *
1019 * @param rsp On success, indicates how booting should occur.
1020 *
1021 * @return 0 on success; nonzero on failure.
1022 */
1023int
1024boot_go(struct boot_rsp *rsp)
1025{
Christopher Collins92ea77f2016-12-12 15:59:26 -08001026 int swap_type;
1027 int slot;
1028 int rc;
1029
1030 /* The array of slot sectors are defined here (as opposed to file scope) so
1031 * that they don't get allocated for non-boot-loader apps. This is
1032 * necessary because the gcc option "-fdata-sections" doesn't seem to have
Christopher Collins0ff3c6c2016-12-21 12:04:17 -08001033 * any effect in older gcc versions (e.g., 4.8.4).
Christopher Collins92ea77f2016-12-12 15:59:26 -08001034 */
1035 static struct flash_area slot0_sectors[BOOT_MAX_IMG_SECTORS];
1036 static struct flash_area slot1_sectors[BOOT_MAX_IMG_SECTORS];
1037 boot_data.imgs[0].sectors = slot0_sectors;
1038 boot_data.imgs[1].sectors = slot1_sectors;
1039
1040 /* Determine the sector layout of the image slots and scratch area. */
1041 rc = boot_read_sectors();
1042 if (rc != 0) {
1043 return rc;
1044 }
1045
1046 /* Attempt to read an image header from each slot. */
1047 rc = boot_read_image_headers();
1048 if (rc != 0) {
1049 return rc;
1050 }
1051
Christopher Collins0ff3c6c2016-12-21 12:04:17 -08001052 /* If the image slots aren't compatible, no swap is possible. Just boot
1053 * into slot 0.
1054 */
1055 if (boot_slots_compatible()) {
1056 rc = boot_swap_if_needed(&swap_type);
1057 if (rc != 0) {
1058 return rc;
Christopher Collins92ea77f2016-12-12 15:59:26 -08001059 }
Christopher Collins0ff3c6c2016-12-21 12:04:17 -08001060 } else {
1061 swap_type = BOOT_SWAP_TYPE_NONE;
Christopher Collins92ea77f2016-12-12 15:59:26 -08001062 }
1063
1064 switch (swap_type) {
1065 case BOOT_SWAP_TYPE_NONE:
David Brownd930ec62016-12-14 07:59:48 -07001066#ifdef BOOTUTIL_VALIDATE_SLOT0
1067 rc = boot_validate_slot(0);
1068 if (rc != 0) {
1069 return BOOT_EBADIMAGE;
1070 }
1071#endif
Christopher Collins92ea77f2016-12-12 15:59:26 -08001072 slot = 0;
1073 break;
1074
1075 case BOOT_SWAP_TYPE_TEST:
Christopher Collinsfd7eb5c2016-12-21 13:46:08 -08001076 case BOOT_SWAP_TYPE_PERM:
Christopher Collins92ea77f2016-12-12 15:59:26 -08001077 slot = 1;
1078 boot_finalize_test_swap();
1079 break;
1080
1081 case BOOT_SWAP_TYPE_REVERT:
1082 slot = 1;
1083 boot_finalize_revert_swap();
1084 break;
1085
1086 case BOOT_SWAP_TYPE_FAIL:
1087 /* The image in slot 1 was invalid and is now erased. Ensure we don't
1088 * try to boot into it again on the next reboot. Do this by pretending
1089 * we just reverted back to slot 0.
1090 */
1091 slot = 0;
1092 boot_finalize_revert_swap();
1093 break;
1094
1095 default:
1096 assert(0);
1097 slot = 0;
1098 break;
1099 }
1100
1101 /* Always boot from the primary slot. */
1102 rsp->br_flash_id = boot_data.imgs[0].sectors[0].fa_device_id;
1103 rsp->br_image_addr = boot_data.imgs[0].sectors[0].fa_off;
1104 rsp->br_hdr = &boot_data.imgs[slot].hdr;
1105
1106 return 0;
1107}
1108
1109int
1110split_go(int loader_slot, int split_slot, void **entry)
1111{
1112 const struct flash_area *loader_fap;
1113 const struct flash_area *app_fap;
1114 struct flash_area *sectors;
Christopher Collins034a6202017-01-11 12:19:37 -08001115 uintptr_t entry_val;
Christopher Collins92ea77f2016-12-12 15:59:26 -08001116 int loader_flash_id;
1117 int app_flash_id;
1118 int rc;
1119
1120 app_fap = NULL;
1121 loader_fap = NULL;
1122
1123 sectors = malloc(BOOT_MAX_IMG_SECTORS * 2 * sizeof *sectors);
1124 if (sectors == NULL) {
1125 rc = SPLIT_GO_ERR;
1126 goto done;
1127 }
1128 boot_data.imgs[0].sectors = sectors + 0;
1129 boot_data.imgs[1].sectors = sectors + BOOT_MAX_IMG_SECTORS;
1130
1131 /* Determine the sector layout of the image slots and scratch area. */
1132 rc = boot_read_sectors();
1133 if (rc != 0) {
1134 rc = SPLIT_GO_ERR;
1135 goto done;
1136 }
1137
1138 rc = boot_read_image_headers();
1139 if (rc != 0) {
1140 goto done;
1141 }
1142
1143 app_flash_id = flash_area_id_from_image_slot(split_slot);
1144 rc = flash_area_open(app_flash_id, &app_fap);
1145 if (rc != 0) {
1146 rc = BOOT_EFLASH;
1147 goto done;
1148 }
1149
1150 loader_flash_id = flash_area_id_from_image_slot(loader_slot);
1151 rc = flash_area_open(loader_flash_id, &loader_fap);
1152 if (rc != 0) {
1153 rc = BOOT_EFLASH;
1154 goto done;
1155 }
1156
1157 /* Don't check the bootable image flag because we could really call a
1158 * bootable or non-bootable image. Just validate that the image check
1159 * passes which is distinct from the normal check.
1160 */
1161 rc = split_image_check(&boot_data.imgs[split_slot].hdr,
1162 app_fap,
1163 &boot_data.imgs[loader_slot].hdr,
1164 loader_fap);
1165 if (rc != 0) {
1166 rc = SPLIT_GO_NON_MATCHING;
1167 goto done;
1168 }
1169
1170 entry_val = boot_data.imgs[split_slot].sectors[0].fa_off +
1171 boot_data.imgs[split_slot].hdr.ih_hdr_size;
Christopher Collins034a6202017-01-11 12:19:37 -08001172 *entry = (void *) entry_val;
Christopher Collins92ea77f2016-12-12 15:59:26 -08001173 rc = SPLIT_GO_OK;
1174
1175done:
1176 free(sectors);
1177 flash_area_close(app_fap);
1178 flash_area_close(loader_fap);
1179 return rc;
1180}