zephyr: fix flash_area_to_sectors()
This fixes MCUB-39.
On Zephyr targets, flash_area_to_sectors() assumes that the flash
device's sector size is equal to the size of the scratch area.
That breaks swap and rollback when scratch size doesn't divide image
size, since the image flash areas will not be correctly configured.
This is a valid configuration supported by the rest of mcuboot.
The best way to fix this would be to get the flash layout from Zephyr,
but that's not possible yet.
Instead, provide a new FLASH_AREA_IMAGE_SECTOR_SIZE define from
target.h. This must be the sector size for these areas:
- FLASH_AREA_IMAGE_0
- FLASH_AREA_IMAGE_1
- FLASH_AREA_IMAGE_SCRATCH
Other areas on the device may have sizes different than
FLASH_AREA_IMAGE_SECTOR_SIZE.
This won't work on platforms where those areas have nonuniform sector
sizes, but we'll cross that bridge when we come to it. (At that point,
an upstream Zephyr change to the flash API really seems needed.)
Revert to the old/buggy behavior when FLASH_AREA_IMAGE_SECTOR_SIZE
isn't provided, but emit a warning. Additionally, touch up the logging
and error handling while we're here.
Signed-off-by: Marti Bolivar <marti.bolivar@linaro.org>
diff --git a/boot/zephyr/flash_map.c b/boot/zephyr/flash_map.c
index 431eacf..edb02ed 100644
--- a/boot/zephyr/flash_map.c
+++ b/boot/zephyr/flash_map.c
@@ -125,6 +125,11 @@
return slot + FLASH_AREA_IMAGE_0;
}
+#ifndef FLASH_AREA_IMAGE_SECTOR_SIZE
+#warning "Missing FLASH_AREA_IMAGE_SECTOR_SIZE; assuming scratch size instead"
+#define FLASH_AREA_IMAGE_SECTOR_SIZE FLASH_AREA_IMAGE_SCRATCH_SIZE
+#endif
+
/*
* Lookup the sector map for a given flash area. This should fill in
* `ret` with all of the sectors in the area. `*cnt` will be set to
@@ -136,8 +141,8 @@
uint32_t off;
uint32_t len;
uint32_t max_cnt = *cnt;
+ uint32_t rem_len;
- BOOT_LOG_DBG("lookup area %d", idx);
/*
* This simple layout has uniform slots, so just fill in the
* right one.
@@ -166,15 +171,30 @@
return -1;
}
+ BOOT_LOG_DBG("area %d: offset=0x%x, length=0x%x, sector size=0x%x",
+ idx, off, len, FLASH_AREA_IMAGE_SECTOR_SIZE);
+
+ rem_len = len;
*cnt = 0;
- while (len > 0 && *cnt < max_cnt) {
+ while (rem_len > 0 && *cnt < max_cnt) {
+ if (rem_len < FLASH_AREA_IMAGE_SECTOR_SIZE) {
+ BOOT_LOG_ERR("area %d size 0x%x not divisible by sector size 0x%x",
+ idx, len, FLASH_AREA_IMAGE_SECTOR_SIZE);
+ return -1;
+ }
+
ret[*cnt].fa_id = idx;
ret[*cnt].fa_device_id = 0;
ret[*cnt].pad16 = 0;
- ret[*cnt].fa_off = off + (FLASH_AREA_IMAGE_SCRATCH_SIZE * (*cnt));
- ret[*cnt].fa_size = FLASH_AREA_IMAGE_SCRATCH_SIZE;
+ ret[*cnt].fa_off = off + (FLASH_AREA_IMAGE_SECTOR_SIZE * (*cnt));
+ ret[*cnt].fa_size = FLASH_AREA_IMAGE_SECTOR_SIZE;
*cnt = *cnt + 1;
- len -= FLASH_AREA_IMAGE_SCRATCH_SIZE;
+ rem_len -= FLASH_AREA_IMAGE_SECTOR_SIZE;
+ }
+
+ if (*cnt >= max_cnt) {
+ BOOT_LOG_ERR("flash area %d sector count overflow", idx);
+ return -1;
}
return 0;