BREAKING: In an effort to simplify board initialization logic for NuttX,
NSH will no longer support architecture initialization. This will happen
during boot via the BOARD_LATE_INITIALIZE option. The boardctl command
BOARDIOC_INIT is also no longer available from user-space.
Quick fix:
Any application relying on BOARDIOC_INIT should now enable
BOARD_LATE_INITIALIZE to have initialization performed by the kernel in
advance of the application running. If control over initialization is
still necessary, BOARDIOC_FINALINIT should be implemented and used.
Boards relying on NSH for initialization should also enable
BOARD_LATE_INITIALIZE instead.
Signed-off-by: Matteo Golin <matteo.golin@gmail.com>
The header variable in nxboot_perform_update() is no longer
used after validate_image() was changed to take only the fd.
Signed-off-by: Neil Berkman <neil@xuku.com>
The comment previously stated CRC was not calculated before
boot. This is no longer accurate after adding full image CRC
validation in validate_image().
Signed-off-by: Neil Berkman <neil@xuku.com>
Two hardening fixes for nxboot power-loss resilience:
1. Add flash_partition_flush() calls between critical partition
operations in perform_update(). Without explicit flush barriers,
writes may remain buffered in RAM (e.g. via FTL rwbuffer) when
nxboot proceeds to the next phase. A power loss between phases
can leave the recovery image uncommitted while the staging
partition has already been consumed.
Flush points added:
- After copy_partition(primary, recovery) completes
- After copy_partition(update, primary) completes, before
erasing the staging first sector
2. Replace validate_image_header() with validate_image() in the
final primary validation path of nxboot_perform_update(). The
header-only check validates magic and platform identifier but
does not CRC-check the image body. After an interrupted update,
a corrupt primary with an intact header would pass this check
and be booted, resulting in a persistent boot failure.
Signed-off-by: Neil Berkman <neil@xuku.com>
Use PRIdOFF instead of %ld for off_t arguments in flash.c syslog
calls, fixing -Wformat errors when off_t is not long.
Change nxboot_progress parameter from enum progress_type_e to int
to avoid undefined behavior from va_start on a parameter that
undergoes default argument promotion (-Wvarargs).
Signed-off-by: Neil Berkman <neil@xuku.com>
Following steps led to incorrect behavior:
- upload update image
- restart device and perform the update
- upload the same update image again without confirming
This led to the unwanted confirm of the update image. This change
ensures the update image is not confirmed by uploading the same
image to the update slot. The correct behavior is to perform revert
to the last stable image if this occurs.
Signed-off-by: Michal Lenc <michallenc@seznam.cz>
This patch corrects a mathematical error in the progress reporting function which
caused incorrect percentage progress calculations.
Signed-off-by: Tim Hardisty <timh@jti.uk.com>
The previous logic MAX(info_from.blocksize, info_where.blocksize) was
incorrect. The most effective access with by writing the entire
size of the block, therefore just decide the size based on the
target page size.
Signed-off-by: Michal Lenc <michallenc@seznam.cz>
There is no need to use buffers in a bootloader. We expect a sequential
access, therefore we just need to erase the erase page before writing
to it for the first time, which is something FTL layer already takes
care of.
Signed-off-by: Michal Lenc <michallenc@seznam.cz>
Function nxboot_progress is located in nxboot_main.c, but this file
is not compiled when NXboot is used as a library to an existing
application and not as a bootloader. Therefore, the declaration of
nxboot_progress function should be dependent on NXBOOT_PROGRESS
config option.
Signed-off-by: Michal Lenc <michallenc@seznam.cz>
This adds Kconfig-enabled progress messages that are output to stdout.
It also adds Kconfig-enabled option to copy the validated and bootable image to RAM
Signed-off by: Tim Hardisty <timh@jti.uk.com>
This commit enhances the bootloader capabilities. The image's header
is extended with header version, size, platform identifier and
pointer to optional next header. CRC32 now includes part of
the header in its calculation as well.
The change also avoids having two different magics for image uploaded
over programmer and update image. Both these images have the same
magic and this magic is changed internally by the bootloader's logic.
The change is needed because image with standard magic is automatically
considered as a confirmed image (uploaded with programmer).
The current implementation avoids tails at all, therefore the user
application uploading the image does not have to erase the tail before
new upload. The image is considered as confirmed if it has standard
magic or its recovery is present. This means the bootloader has to
erase the header of the update image after the update is done (to
avoid update loop and to mark the image as unstable). This page is
written back during the confirmation.
This is a breaking change, but necessary for the future development
of the bootloader. The added header version field will allow to
add minor/major updates while keeping the backwards compatibility.
Signed-off-by: Michal Lenc <michallenc@seznam.cz>
Co-authored-by: Pavel Pisa <pisa@fel.cvut.cz>
Co-authored-by: Karel Koci <cynerd@email.cz>
Most tools used for compliance and SBOM generation use SPDX identifiers
This change brings us a step closer to an easy SBOM generation.
Signed-off-by: Alin Jerpelea <alin.jerpelea@sony.com>
API function nxboot_get_confirm was returning incorrect value if
primary image was flashed directly into the embedded flash (this
image does not have a tail, but is automatically considered as valid
and stable based on the header magic value).
Signed-off-by: Michal Lenc <michallenc@seznam.cz>
This commit adds NuttX based bootloader with the support for image
update and recovery if not confirmed. The algorithm utilizes three
flash partitions: primary (image runs from this area), secondary
and tertiary. Secondary and tertiary areas are used for update upload
and recovery.
The update is performed by simple copy from update area to primary
area with recovery being created in recovery area if not already present.
Once image is confirmed by the user, the image in update area is
confirmed as well, update area becomes recovery area and vice versa.
This means the recovery is always present (except for the first update)
and subsequent updates just copy image from update to primary. This
makes the update significantly faster and more considerable to flash
wear while keeping the recovery/revert possibility.
A header (aligned to flash's erase size) must be added to the beginning
of the image. Python script nximage.py can be used to prepend this
header to built binary. The algorithm also uses one erase page at the
end of a partition (partition, not image!) to store flags used to
indicate image confirm status and to detect update/recovery partitions.
Any program uploading update image to the update partition has to erase
this page for the boot to work correctly!
The algorithm implementation is based on a patch initially developed
for MCUboot project but rejected by the project's maintainers
https://github.com/mcu-tools/mcuboot/pull/1902
Signed-off-by: Michal Lenc <michallenc@seznam.cz>
