Boot: Use overwrite-only mode for image upgrade
- The swapping image upgrade is a two-step process (by default). First
it performs a "test" upgrade and boots the new image. Then the image can
mark itself as "OK" at runtime by setting the image_ok flag in the
flash. When this happens, the swap is made "permanent" and mcuboot will
then still choose to run it during the next boot. Currently TF-M does
not set the image_ok flag, therefore the bootloader will always perform
a "revert" (swap the images back) during the next boot. For this reason,
this patch sets the overwrite-only mode as the default image upgrade
strategy. However, this strategy does not provide the opportunity to
restore the previous image if the device crashes with the new firmware.
- Update secure boot documentation.
- Fix format specifier error in overwrite-only code.
- Fix the bootloader output message by reorganizing the
preprocessor directives in case of non-swapping firmware upgrade.
Change-Id: Ida1c7c7fc198e393e79d178269826cbfa052395d
Signed-off-by: David Vincze <david.vincze@arm.com>
diff --git a/bl2/ext/mcuboot/bootutil/src/loader.c b/bl2/ext/mcuboot/bootutil/src/loader.c
index b787d32..42459c3 100644
--- a/bl2/ext/mcuboot/bootutil/src/loader.c
+++ b/bl2/ext/mcuboot/bootutil/src/loader.c
@@ -1090,7 +1090,7 @@
size += this_size;
}
- BOOT_LOG_INF("Copying slot 1 to slot 0: 0x%lx bytes", size);
+ BOOT_LOG_INF("Copying slot 1 to slot 0: 0x%zx bytes", size);
rc = boot_copy_sector(FLASH_AREA_IMAGE_1, FLASH_AREA_IMAGE_0,
0, 0, size);
@@ -1778,9 +1778,11 @@
BOOT_LOG_INF("Booting image from SRAM at address 0x%"PRIx32"",
newest_image_header->ih_load_addr);
} else {
+#endif /* MCUBOOT_RAM_LOADING */
BOOT_LOG_INF("Booting image from slot %d", slot);
+#ifdef MCUBOOT_RAM_LOADING
}
- #endif /* MCUBOOT_RAM_LOADING */
+#endif
rsp->br_hdr = newest_image_header;
rsp->br_image_off = boot_img_slot_off(&boot_data, slot);