Skip to content

bootutil: Increase minimum flash write #1217

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
d3zd3z merged 7 commits into from
Dec 16, 2021
Merged

bootutil: Increase minimum flash write #1217

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
007dcee
bootutil: Allow larger minimum flash write
kjassmann-renesas Feb 3, 2021
ea198a6
bootutil: Remove arbitrary limit on BOOT_MAX_IMG_SECTORS
kjassmann-renesas Feb 17, 2021
f368283
bootutil: Define new magic for the updated image trailer layout
gustavonihei Nov 22, 2021
351ba83
bootutil: Support trailers larger than sector size for swap scratch
gustavonihei Nov 30, 2021
080c373
flash_map: Increase minimum supported write align via flash_area_align
gustavonihei Nov 24, 2021
ab29e10
sim: Fit unit tests to larger write align values
gustavonihei Nov 25, 2021
d7f1c4d
docs: Update Image Trailer documentation according to latest changes
gustavonihei Nov 22, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 11 additions & 10 deletions .github/workflows/sim.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,21 +14,22 @@ jobs:
features:
- "sig-ecdsa,sig-ecdsa-mbedtls,sig-ed25519,enc-kw,bootstrap"
- "sig-rsa,sig-rsa3072,overwrite-only,validate-primary-slot,swap-move"
- "enc-rsa"
- "enc-aes256-rsa"
- "enc-ec256"
- "enc-aes256-ec256"
- "enc-x25519"
- "enc-aes256-x25519"
- "sig-rsa overwrite-only large-write,sig-ecdsa overwrite-only large-write,sig-ecdsa-mbedtls overwrite-only large-write,multiimage overwrite-only large-write"
- "enc-rsa,enc-rsa max-align-32"
- "enc-aes256-rsa,enc-aes256-rsa max-align-32"
- "enc-ec256,enc-ec256 max-align-32"
- "enc-aes256-ec256,enc-aes256-ec256 max-align-32"
- "enc-x25519,enc-x25519 max-align-32"
- "enc-aes256-x25519,enc-aes256-x25519 max-align-32"
- "sig-rsa overwrite-only,sig-ecdsa overwrite-only,sig-ecdsa-mbedtls overwrite-only,multiimage overwrite-only"
- "sig-rsa validate-primary-slot,sig-ecdsa validate-primary-slot,sig-ecdsa-mbedtls validate-primary-slot,sig-rsa multiimage validate-primary-slot"
- "enc-kw overwrite-only large-write,enc-rsa overwrite-only large-write"
- "enc-aes256-kw overwrite-only large-write,enc-rsa overwrite-only large-write"
- "enc-kw overwrite-only,enc-kw overwrite-only max-align-32"
- "enc-rsa overwrite-only,enc-rsa overwrite-only max-align-32"
- "enc-aes256-kw overwrite-only,enc-aes256-kw overwrite-only max-align-32"
- "sig-rsa enc-rsa validate-primary-slot,swap-move enc-rsa sig-rsa validate-primary-slot bootstrap"
- "sig-rsa enc-kw validate-primary-slot bootstrap,sig-ed25519 enc-x25519 validate-primary-slot"
- "sig-ecdsa enc-kw validate-primary-slot"
- "sig-ecdsa-mbedtls enc-kw validate-primary-slot"
- "sig-rsa validate-primary-slot overwrite-only large-write"
- "sig-rsa validate-primary-slot overwrite-only,sig-rsa validate-primary-slot overwrite-only max-align-32"
- "sig-ecdsa enc-ec256 validate-primary-slot"
- "sig-ecdsa-mbedtls enc-ec256-mbedtls validate-primary-slot"
- "sig-ecdsa-mbedtls enc-aes256-ec256 validate-primary-slot"
Expand Down
5 changes: 4 additions & 1 deletion boot/bootutil/include/bootutil/bootutil.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -71,7 +71,10 @@ struct image_trailer {
uint8_t pad2[BOOT_MAX_ALIGN - 1];
uint8_t image_ok;
uint8_t pad3[BOOT_MAX_ALIGN - 1];
uint8_t magic[16];
#if BOOT_MAX_ALIGN > BOOT_MAGIC_SZ
uint8_t pad4[BOOT_MAGIC_ALIGN_SIZE - BOOT_MAGIC_SZ];
#endif
uint8_t magic[BOOT_MAGIC_SZ];
};

/* you must have pre-allocated all the entries within this structure */
Expand Down
27 changes: 20 additions & 7 deletions boot/bootutil/include/bootutil/bootutil_public.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -47,6 +47,14 @@
extern "C" {
#endif

#ifndef ALIGN_UP
#define ALIGN_UP(num, align) (((num) + ((align) - 1)) & ~((align) - 1))
#endif

#ifndef ALIGN_DOWN
#define ALIGN_DOWN(num, align) ((num) & ~((align) - 1))
#endif

/** Attempt to boot the contents of the primary slot. */
#define BOOT_SWAP_TYPE_NONE 1

Expand All @@ -71,7 +79,19 @@ extern "C" {
/** Swapping encountered an unrecoverable error */
#define BOOT_SWAP_TYPE_PANIC 0xff

#define BOOT_MAGIC_SZ 16

#ifdef MCUBOOT_BOOT_MAX_ALIGN

_Static_assert(MCUBOOT_BOOT_MAX_ALIGN >= 8 && MCUBOOT_BOOT_MAX_ALIGN <= 32,
"Unsupported value for MCUBOOT_BOOT_MAX_ALIGN");

#define BOOT_MAX_ALIGN MCUBOOT_BOOT_MAX_ALIGN
#define BOOT_MAGIC_ALIGN_SIZE ALIGN_UP(BOOT_MAGIC_SZ, BOOT_MAX_ALIGN)
#else
#define BOOT_MAX_ALIGN 8
#define BOOT_MAGIC_ALIGN_SIZE BOOT_MAGIC_SZ
#endif

#define BOOT_MAGIC_GOOD 1
#define BOOT_MAGIC_BAD 2
Expand All @@ -87,8 +107,6 @@ extern "C" {
#define BOOT_FLAG_UNSET 3
#define BOOT_FLAG_ANY 4 /* NOTE: control only, not dependent on sector */

#define BOOT_MAGIC_SZ (sizeof boot_img_magic)

#define BOOT_EFLASH 1
#define BOOT_EFILE 2
#define BOOT_EBADIMAGE 3
Expand Down Expand Up @@ -248,11 +266,6 @@ int
boot_read_swap_state(const struct flash_area *fa,
struct boot_swap_state *state);

#define BOOT_MAGIC_ARR_SZ \
(sizeof boot_img_magic / sizeof boot_img_magic[0])

extern const uint32_t boot_img_magic[4];

#ifdef __cplusplus
}
#endif
Expand Down
5 changes: 1 addition & 4 deletions boot/bootutil/include/bootutil/enc_key.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,10 +38,7 @@
extern "C" {
#endif

#define BOOT_ENC_KEY_SIZE_BITS (BOOT_ENC_KEY_SIZE * 8)

#define BOOT_ENC_TLV_ALIGN_SIZE \
((((BOOT_ENC_TLV_SIZE - 1) / BOOT_MAX_ALIGN) + 1) * BOOT_MAX_ALIGN)
#define BOOT_ENC_TLV_ALIGN_SIZE ALIGN_UP(BOOT_ENC_TLV_SIZE, BOOT_MAX_ALIGN)

struct enc_key_data {
uint8_t valid;
Expand Down
8 changes: 7 additions & 1 deletion boot/bootutil/include/bootutil/enc_key_public.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,14 +32,20 @@
extern "C" {
#endif

#ifndef ALIGN_UP
#define ALIGN_UP(num, align) (((num) + ((align) - 1)) & ~((align) - 1))
#endif

#ifdef MCUBOOT_AES_256
#define BOOT_ENC_KEY_SIZE 32
#else
#define BOOT_ENC_KEY_SIZE 16
#endif

#define BOOT_ENC_KEY_ALIGN_SIZE ALIGN_UP(BOOT_ENC_KEY_SIZE, BOOT_MAX_ALIGN)

#define TLV_ENC_RSA_SZ 256
#define TLV_ENC_KW_SZ BOOT_ENC_KEY_SIZE + 8
#define TLV_ENC_KW_SZ (BOOT_ENC_KEY_SIZE + 8)
#define TLV_ENC_EC256_SZ (65 + 32 + BOOT_ENC_KEY_SIZE)
#define TLV_ENC_X25519_SZ (32 + 32 + BOOT_ENC_KEY_SIZE)

Expand Down
35 changes: 19 additions & 16 deletions boot/bootutil/src/bootutil_misc.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -46,11 +46,6 @@ BOOT_LOG_MODULE_DECLARE(mcuboot);
/* Currently only used by imgmgr */
int boot_current_slot;

extern const uint32_t boot_img_magic[];

#define BOOT_MAGIC_ARR_SZ \
(sizeof boot_img_magic / sizeof boot_img_magic[0])

/**
* @brief Determine if the data at two memory addresses is equal
*
Expand Down Expand Up @@ -108,12 +103,12 @@ boot_trailer_info_sz(void)
# if MCUBOOT_SWAP_SAVE_ENCTLV
BOOT_ENC_TLV_ALIGN_SIZE * 2 +
# else
BOOT_ENC_KEY_SIZE * 2 +
BOOT_ENC_KEY_ALIGN_SIZE * 2 +
# endif
#endif
/* swap_type + copy_done + image_ok + swap_size */
BOOT_MAX_ALIGN * 4 +
BOOT_MAGIC_SZ
BOOT_MAGIC_ALIGN_SIZE
);
}

Expand Down Expand Up @@ -172,7 +167,7 @@ uint32_t
boot_status_off(const struct flash_area *fap)
{
uint32_t off_from_end;
uint8_t elem_sz;
uint32_t elem_sz;

elem_sz = flash_area_align(fap);

Expand All @@ -190,6 +185,15 @@ boot_status_off(const struct flash_area *fap)
return flash_area_get_size(fap) - off_from_end;
}

static int
boot_magic_decode(const uint8_t *magic)
{
if (memcmp(magic, BOOT_IMG_MAGIC, BOOT_MAGIC_SZ) == 0) {
return BOOT_MAGIC_GOOD;
}
return BOOT_MAGIC_BAD;
}

static inline uint32_t
boot_magic_off(const struct flash_area *fap)
{
Expand All @@ -199,7 +203,7 @@ boot_magic_off(const struct flash_area *fap)
static inline uint32_t
boot_image_ok_off(const struct flash_area *fap)
{
return boot_magic_off(fap) - BOOT_MAX_ALIGN;
return ALIGN_DOWN(boot_magic_off(fap) - BOOT_MAX_ALIGN, BOOT_MAX_ALIGN);
}

static inline uint32_t
Expand All @@ -219,10 +223,9 @@ static inline uint32_t
boot_enc_key_off(const struct flash_area *fap, uint8_t slot)
{
#if MCUBOOT_SWAP_SAVE_ENCTLV
return boot_swap_size_off(fap) - ((slot + 1) *
((((BOOT_ENC_TLV_SIZE - 1) / BOOT_MAX_ALIGN) + 1) * BOOT_MAX_ALIGN));
return boot_swap_size_off(fap) - ((slot + 1) * BOOT_ENC_TLV_ALIGN_SIZE);
#else
return boot_swap_size_off(fap) - ((slot + 1) * BOOT_ENC_KEY_SIZE);
return boot_swap_size_off(fap) - ((slot + 1) * BOOT_ENC_KEY_ALIGN_SIZE);
#endif
}
#endif
Expand All @@ -239,7 +242,7 @@ boot_enc_key_off(const struct flash_area *fap, uint8_t slot)
static int
boot_find_status(int image_index, const struct flash_area **fap)
{
uint32_t magic[BOOT_MAGIC_ARR_SZ];
uint8_t magic[BOOT_MAGIC_SZ];
uint32_t off;
uint8_t areas[2] = {
#if MCUBOOT_SWAP_USING_SCRATCH
Expand Down Expand Up @@ -272,7 +275,7 @@ boot_find_status(int image_index, const struct flash_area **fap)
return rc;
}

if (memcmp(magic, boot_img_magic, BOOT_MAGIC_SZ) == 0) {
if (BOOT_MAGIC_GOOD == boot_magic_decode(magic)) {
return 0;
}

Expand Down Expand Up @@ -327,7 +330,7 @@ boot_read_enc_key(int image_index, uint8_t slot, struct boot_status *bs)
}
}
#else
rc = flash_area_read(fap, off, bs->enckey[slot], BOOT_ENC_KEY_SIZE);
rc = flash_area_read(fap, off, bs->enckey[slot], BOOT_ENC_KEY_ALIGN_SIZE);
#endif
flash_area_close(fap);
}
Expand Down Expand Up @@ -375,7 +378,7 @@ boot_write_enc_key(const struct flash_area *fap, uint8_t slot,
#if MCUBOOT_SWAP_SAVE_ENCTLV
rc = flash_area_write(fap, off, bs->enctlv[slot], BOOT_ENC_TLV_ALIGN_SIZE);
#else
rc = flash_area_write(fap, off, bs->enckey[slot], BOOT_ENC_KEY_SIZE);
rc = flash_area_write(fap, off, bs->enckey[slot], BOOT_ENC_KEY_ALIGN_SIZE);
#endif
if (rc != 0) {
return BOOT_EFLASH;
Expand Down
52 changes: 36 additions & 16 deletions boot/bootutil/src/bootutil_priv.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -82,7 +82,7 @@ struct boot_status {
uint8_t swap_type; /* The type of swap in effect */
uint32_t swap_size; /* Total size of swapped image */
#ifdef MCUBOOT_ENC_IMAGES
uint8_t enckey[BOOT_NUM_SLOTS][BOOT_ENC_KEY_SIZE];
uint8_t enckey[BOOT_NUM_SLOTS][BOOT_ENC_KEY_ALIGN_SIZE];
#if MCUBOOT_SWAP_SAVE_ENCTLV
uint8_t enctlv[BOOT_NUM_SLOTS][BOOT_ENC_TLV_ALIGN_SIZE];
#endif
Expand All @@ -109,16 +109,28 @@ struct boot_status {
* | Encryption key 0 (16 octets) [*] |
* | |
* +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
* | 0xff padding as needed |
* | (BOOT_MAX_ALIGN minus 16 octets from Encryption key 0) [*] |
* +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
* | Encryption key 1 (16 octets) [*] |
* | |
* +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
* | 0xff padding as needed |
* | (BOOT_MAX_ALIGN minus 16 octets from Encryption key 1) [*] |
* +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
* | Swap size (4 octets) |
* +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
* | Swap info | 0xff padding (7 octets) |
* | 0xff padding as needed |
* | (BOOT_MAX_ALIGN minus 4 octets from Swap size) |
* +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
* | Swap info | 0xff padding (BOOT_MAX_ALIGN minus 1 octet) |
* +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
* | Copy done | 0xff padding (7 octets) |
* | Copy done | 0xff padding (BOOT_MAX_ALIGN minus 1 octet) |
* +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
* | Image OK | 0xff padding (7 octets) |
* | Image OK | 0xff padding (BOOT_MAX_ALIGN minus 1 octet) |
* +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
* | 0xff padding as needed |
* | (BOOT_MAX_ALIGN minus 16 octets from MAGIC) |
* +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
* | MAGIC (16 octets) |
* | |
Expand All @@ -128,7 +140,26 @@ struct boot_status {
* (`MCUBOOT_ENC_IMAGES`).
*/

extern const uint32_t boot_img_magic[4];
union boot_img_magic_t
{
struct {
uint16_t align;
uint8_t magic[14];
};
uint8_t val[16];
};

extern const union boot_img_magic_t boot_img_magic;

#define BOOT_IMG_MAGIC (boot_img_magic.val)

#if BOOT_MAX_ALIGN == 8
#define BOOT_IMG_ALIGN (BOOT_MAX_ALIGN)
#else
#define BOOT_IMG_ALIGN (boot_img_magic.align)
#endif

_Static_assert(sizeof(boot_img_magic) == BOOT_MAGIC_SZ, "Invalid size for image magic");

#if !defined(MCUBOOT_DIRECT_XIP) && !defined(MCUBOOT_RAM_LOAD)
#define ARE_SLOTS_EQUIVALENT() 0
Expand All @@ -150,17 +181,6 @@ extern const uint32_t boot_img_magic[4];
(hdr)->ih_ver.iv_revision, \
(hdr)->ih_ver.iv_build_num)

/*
* The current flashmap API does not check the amount of space allocated when
* loading sector data from the flash device, allowing for smaller counts here
* would most surely incur in overruns.
*
* TODO: make flashmap API receive the current sector array size.
*/
#if BOOT_MAX_IMG_SECTORS < 32
#error "Too few sectors, please increase BOOT_MAX_IMG_SECTORS to at least 32"
#endif

#if MCUBOOT_SWAP_USING_MOVE
#define BOOT_STATUS_MOVE_STATE_COUNT 1
#define BOOT_STATUS_SWAP_STATE_COUNT 2
Expand Down
Loading