bootloader.c

Go to the documentation of this file.

/*
 * Copyright 2023 Morse Micro
 *
 * SPDX-License-Identifier: Apache-2.0
 */
 
#include <stdio.h>
#include <stdint.h>
#include <stdbool.h>
#include <string.h>
#include <endian.h>
#include <sys/unistd.h>
#include <sys/fcntl.h>
#include <sys/errno.h>
#include "sha256.h"
#include "mmhal_flash.h"
#include "mmconfig.h"
#include "mmhal.h"
#include "mmosal.h"
#include "puff.h"
#include "mbin.h"
 
 
#define MAX_UPDATE_ATTEMPTS     10
 
#define MAX_SEGMENT_SIZE        32768
 
enum bootloader_return_codes
{
    BOOTLOADER_OK = 0,
    BOOTLOADER_ERR_FILE_NOT_FOUND,
    BOOTLOADER_ERR_SIGNATURE_NOT_FOUND,
    BOOTLOADER_ERR_FILE_VERIFICATION_FAILED,
    BOOTLOADER_ERR_INVALID_FILE,
    BOOTLOADER_ERR_FILE_CORRUPT,
    BOOTLOADER_ERR_ERASE_FAILED,
    BOOTLOADER_ERR_PROGRAM_FAILED,
    BOOTLOADER_ERR_TOO_MANY_ATTEMPTS,
    BOOTLOADER_ERR_FILE_DECOMPRESSION,
};
 
extern uint8_t application_start;
 
extern uint8_t application_end;
 
static uint8_t segment_buffer[MAX_SEGMENT_SIZE];
 
static uint8_t deflate_buffer[MAX_SEGMENT_SIZE];
 
 
static void delay_ms(uint32_t approx_delay_ms)
{
    uint32_t i;
    for (i = 0; i < approx_delay_ms; i++)
    {
        uint32_t tick = mmosal_get_time_ticks();
        while (tick == mmosal_get_time_ticks())
        {
        }
    }
}
 
static void blink_error_code(int code)
{
    int ii;
    /* Flash error LED code times */
 
    for (ii = 0; ii < code; ii++)
    {
        mmhal_set_error_led(true);
        delay_ms(100);
        mmhal_set_error_led(false);
        delay_ms(100);
    }
}
 
static void update_failed(int code)
{
    /* Write error code to config store */
    mmconfig_write_int("BOOTLOADER_ERROR", code);
    while (true)
    {
        /* We repeatedly blink the error code here */
        blink_error_code(code);
        delay_ms(1000);
    }
}
 
static void erase_application_area(void)
{
    uint32_t block_address = (uint32_t) &application_start;
    uint32_t end_address = (uint32_t) &application_end;
 
    while (block_address < end_address)
    {
        /* Erase block */
        if (mmhal_flash_erase(block_address) != 0)
        {
            /* We had a failure erasing flash, try again */
            if (mmhal_flash_erase(block_address) != 0)
            {
                /* We had a second consecutive failure, give up as the flash is likely worn out */
                update_failed(BOOTLOADER_ERR_ERASE_FAILED);
            }
        }
 
        /*
         * No need to sanity check this as everything between @c application_start
         * and @c application_end should be in valid flash or the linker script is wrong.
         */
        block_address += mmhal_flash_getblocksize(block_address);
    }
}
 
 
static int read_segment_header(int fd, struct mbin_tlv_hdr *seg_hdr)
{
    struct mbin_tlv_hdr hdr_overlay;
 
    int ret = read(fd, &hdr_overlay, sizeof(hdr_overlay));
    if (ret != sizeof(hdr_overlay))
    {
        return BOOTLOADER_ERR_FILE_CORRUPT;
    }
 
    seg_hdr->type = le16toh(hdr_overlay.type);
    seg_hdr->len = le16toh(hdr_overlay.len);
 
    return BOOTLOADER_OK;
}
 
static int read_uint32(int fd, uint32_t *val)
{
    uint32_t tmp;
 
    int ret = read(fd, &tmp, sizeof(tmp));
    if (ret != sizeof(tmp))
    {
        return BOOTLOADER_ERR_FILE_CORRUPT;
    }
 
    *val = le32toh(tmp);
 
    return BOOTLOADER_OK;
}
 
static int load_and_flash_mbin(const char *fname, bool make_changes)
{
    struct mbin_tlv_hdr seg_hdr;
    uint32_t mbin_magic = 0;
    uint32_t load_address, load_size;
    unsigned long compressed_size, puffed_size;   // NOLINT(runtime/int) match puff API
    int ret;
    bool eof = false;
    bool modified = false;
 
    /* Open file */
    int fd = open(fname, O_RDONLY);
    if (fd < 0)
    {
        /* Could not open file */
        return BOOTLOADER_ERR_FILE_NOT_FOUND;
    }
 
    /* Verify MBIN magic */
    ret = read_segment_header(fd, &seg_hdr);
    if (ret != BOOTLOADER_OK)
    {
        ret = BOOTLOADER_ERR_FILE_CORRUPT;
        goto bailout;
    }
    if (seg_hdr.type != FIELD_TYPE_MAGIC)
    {
        ret = BOOTLOADER_ERR_INVALID_FILE;
        goto bailout;
    }
    if (seg_hdr.len != sizeof(mbin_magic))
    {
        ret = BOOTLOADER_ERR_FILE_CORRUPT;
        goto bailout;
    }
    ret = read_uint32(fd, &mbin_magic);
    if (MBIN_SW_MAGIC_NUMBER != mbin_magic)
    {
        ret = BOOTLOADER_ERR_INVALID_FILE;
        goto bailout;
    }
 
    /* Iterate through TLV headers */
    while (!eof)
    {
        ret = read_segment_header(fd, &seg_hdr);
        if (ret != BOOTLOADER_OK)
        {
            break;
        }
 
        switch (seg_hdr.type)
        {
        case FIELD_TYPE_SW_SEGMENT:
            ret = read_uint32(fd, &load_address);
            if (ret != BOOTLOADER_OK)
            {
                /* We had a failure reading MBIN, give up */
                goto bailout;
            }
 
            load_size = seg_hdr.len - sizeof(load_address);
            if (load_size > MAX_SEGMENT_SIZE)
            {
                /* We had a failure reading MBIN, give up */
                ret = BOOTLOADER_ERR_FILE_CORRUPT;
                goto bailout;
            }
 
            ret = read(fd, segment_buffer, load_size);
            if (ret != (int)load_size)
            {
                /* We had a failure reading MBIN, give up */
                ret = BOOTLOADER_ERR_FILE_CORRUPT;
                goto bailout;
            }
 
            /* Does the load address fall within the application area? */
            if ((load_address >= (uint32_t) &application_start) &&
                (load_address + load_size <= (uint32_t) &application_end))
            {
                modified = true;
                if (make_changes)
                {
                    ret = mmhal_flash_write(load_address, segment_buffer, load_size);
                    if (ret != 0)
                    {
                        /* We had a failure while flashing, give up as flash state is unknown */
                        ret = BOOTLOADER_ERR_PROGRAM_FAILED;
                        goto bailout;
                    }
                }
            }
            else
            {
                /* We attempted to write outside the valid area */
                ret = BOOTLOADER_ERR_INVALID_FILE;
                goto bailout;
            }
            break;
 
        case FIELD_TYPE_SW_SEGMENT_DEFLATED:
            ret = read_uint32(fd, &load_address);
            if (ret != BOOTLOADER_OK)
            {
                /* We had a failure reading MBIN, give up */
                goto bailout;
            }
 
            ret = read_uint32(fd, &load_size);
            if (ret != BOOTLOADER_OK)
            {
                /* We had a failure reading MBIN, give up */
                goto bailout;
            }
 
            if (load_size > MAX_SEGMENT_SIZE)
            {
                /* We had a failure reading MBIN, give up */
                ret = BOOTLOADER_ERR_FILE_CORRUPT;
                goto bailout;
            }
 
            compressed_size = seg_hdr.len - sizeof(load_address) - sizeof(load_size);
            if (compressed_size > MAX_SEGMENT_SIZE)
            {
                /* We had a failure reading MBIN, give up */
                ret = BOOTLOADER_ERR_FILE_CORRUPT;
                goto bailout;
            }
 
            ret = read(fd, deflate_buffer, compressed_size);
            if (ret != (int)compressed_size)
            {
                /* We had a failure reading MBIN, give up */
                ret = BOOTLOADER_ERR_FILE_CORRUPT;
                goto bailout;
            }
 
            /* Decompress the segment */
            puffed_size = load_size;
            puff(segment_buffer, &puffed_size, deflate_buffer, &compressed_size);
            if (puffed_size != load_size)
            {
                /* We had a failure decompressing, give up */
                ret = BOOTLOADER_ERR_FILE_DECOMPRESSION;
                goto bailout;
            }
 
            /* Does the load address fall within the application area? */
            if ((load_address >= (uint32_t) &application_start) &&
                (load_address + load_size <= (uint32_t) &application_end))
            {
                modified = true;
                if (make_changes)
                {
                    ret = mmhal_flash_write(load_address, segment_buffer, load_size);
                    if (ret!= 0)
                    {
                        /* We had a failure while flashing, give up as flash state is unknown */
                        ret = BOOTLOADER_ERR_PROGRAM_FAILED;
                        goto bailout;
                    }
                }
            }
            else
            {
                /* We attempted to write outside the valid area */
                ret = BOOTLOADER_ERR_INVALID_FILE;
                goto bailout;
            }
            break;
 
        case FIELD_TYPE_EOF_WITH_SIGNATURE:
            /* We validate this signature in the application and generate the
             * simplified IMAGE_SIGNATURE hash in config store for the bootloader.
             * So the bootloader just treats this as an EOF. */
        case FIELD_TYPE_EOF:
            eof = true;
            break;
 
        /* Skip these fields since they are not used for the software update process */
        case FIELD_TYPE_FW_SEGMENT:
        case FIELD_TYPE_FW_SEGMENT_DEFLATED:
        case FIELD_TYPE_FW_TLV_BCF_ADDR:
        case FIELD_TYPE_BCF_BOARD_CONFIG:
        case FIELD_TYPE_BCF_REGDOM:
            if (seg_hdr.len > MAX_SEGMENT_SIZE)
            {
                /* We had a failure reading MBIN, give up */
                ret = BOOTLOADER_ERR_FILE_CORRUPT;
                goto bailout;
            }
             /* Skip over */
            ret = read(fd, segment_buffer, seg_hdr.len);
            if (ret != seg_hdr.len)
            {
                /* We had an error reading the file */
                ret = BOOTLOADER_ERR_FILE_CORRUPT;
                goto bailout;
            }
            break;
 
        case FIELD_TYPE_MAGIC:
        default:
            /* These are unexpected */
            ret = BOOTLOADER_ERR_FILE_CORRUPT;
            goto bailout;
        }
    }
 
    if (!eof)
    {
        /* File ended unexpectedly */
        ret = BOOTLOADER_ERR_FILE_CORRUPT;
        goto bailout;
    }
 
    if (!modified)
    {
        /* No attempts were made to write to the application region of flash. */
        /* Maybe this file was meant for another device? */
        ret = BOOTLOADER_ERR_INVALID_FILE;
        goto bailout;
    }
 
    ret = BOOTLOADER_OK;
bailout:
    close(fd);
    return ret;
}
 
static int verify_signature(const char *fname)
{
    /* Stub to compute memory usage of sha256 */
    BYTE data[64];
    BYTE hash[32];
    SHA256_CTX ctx;
    sha256_init(&ctx);
 
    BYTE compare[32];
    if (mmconfig_read_bytes("IMAGE_SIGNATURE", compare, sizeof(compare), 0) != sizeof(compare))
    {
        /* Error reading hash, bail */
        return BOOTLOADER_ERR_SIGNATURE_NOT_FOUND;
    }
 
    /* Open file */
    int fd = open(fname, O_RDONLY);
    if (fd < 0)
    {
        /* Could not open file */
        return BOOTLOADER_ERR_FILE_NOT_FOUND;
    }
 
    int bytesread;
    do
    {
        bytesread = read(fd, data, sizeof(data));
        if (bytesread <= 0)
        {
            /* break out on error */
            break;
        }
        sha256_update(&ctx, data, bytesread);
    } while (bytesread == sizeof(data));
 
    sha256_final(&ctx, hash);
    close(fd);
 
    if (memcmp(hash, compare, sizeof(hash)) != 0)
    {
        /* Verification failed */
        return BOOTLOADER_ERR_FILE_VERIFICATION_FAILED;
    }
    return BOOTLOADER_OK;
}
 
static void check_update()
{
    static char update_path[128];
 
    /* Check if UPDATE_IMAGE is set in config store */
    int ret = mmconfig_read_string("UPDATE_IMAGE", update_path, sizeof(update_path));
    if (ret <= 0)
    {
        /* Could not find UPDATE_IMAGE, bail to application, this is the normal use case */
        return;
    }
 
    ret = verify_signature(update_path);
    if (ret != 0)
    {
        /* Signature check failed, bail to application */
        mmconfig_write_int("BOOTLOADER_ERROR", ret);
        blink_error_code(ret);
        return;
    }
 
    /* Do a dry run to ensure MBIN file is ok */
    ret = load_and_flash_mbin(update_path, false);
    if (ret != BOOTLOADER_OK)
    {
        /* Update failed early, write error code and bail to application */
        mmconfig_write_int("BOOTLOADER_ERROR", ret);
        blink_error_code(ret);
        return;
    }
 
    /* MBIN looks good, increment update attempts */
    int update_attempts = 0;
    mmconfig_read_int("UPDATE_ATTEMPTS", &update_attempts);
    if (update_attempts >= MAX_UPDATE_ATTEMPTS)
    {
        /* We tried too many times, give up */
        update_failed(BOOTLOADER_ERR_TOO_MANY_ATTEMPTS);
    }
    mmconfig_write_int("UPDATE_ATTEMPTS", ++update_attempts);
 
    /* No turning back, any failures past this point are critical */
    erase_application_area();
 
    /* Start the flashing process for real */
    ret = load_and_flash_mbin(update_path, true);
    if (ret != BOOTLOADER_OK)
    {
        /* We failed once, so erase and try again */
        erase_application_area();
        ret = load_and_flash_mbin(update_path, true);
        if (ret != BOOTLOADER_OK)
        {
            /* We failed a second time, situation is unrecoverable, give up */
            update_failed(ret);
        }
    }
 
    /* We successfully did an update, so cleanup and reboot now */
    mmconfig_delete_key("UPDATE_IMAGE");
    mmconfig_delete_key("UPDATE_ATTEMPTS");
    mmconfig_delete_key("IMAGE_SIGNATURE");
    mmconfig_delete_key("BOOTLOADER_ERROR");
    mmhal_reset();
}
 
int main(void)
{
    /* This writes the bootloader version into config store for applicatiopn to read.
     * Note: This function returns without writing anything if the key is already present
     * and has the same value - so no need to worry about flash wear and tear. */
    mmconfig_write_string("BOOTLOADER_VERSION", BOOTLOADER_VERSION);
 
    /* Check for updates */
    check_update();
 
    /* Jump to application. The address to jump to is the second entry
     * in the vector table located at the start of application area.
     * Note: we ignore the first entry (Stack pointer) as this is usually the same
     * for the bootloader and set to end of RAM - requires messy assembly to change. */
    uint32_t go_address = (*((volatile uint32_t*) (((uint32_t)&application_start) + 4)));
    void (*jump_to_app)(void) = (void (*)(void)) go_address;
 
    /* No updates found, jump to application */
    jump_to_app();
 
    /* We should not get here */
    MMOSAL_ASSERT(false);
}