boot: bootutil: Do not panic on unreadable primary slot trailer - #2805
boot: bootutil: Do not panic on unreadable primary slot trailer#2805fbnors wants to merge 1 commit into
Conversation
boot_swap_type_multi() returns BOOT_SWAP_TYPE_PANIC whenever the swap state of the primary slot cannot be read. On devices whose flash controller reports a read error for pages that have never been programmed, this happens as soon as part of the primary trailer is still erased, which permanently blocks both booting and firmware recovery. In overwrite-only mode the bootloader never resumes an interrupted swap from the primary trailer and never sets its copy_done flag, so no entry of boot_swap_tables can match on the primary state. An unreachable primary trailer is therefore treated as empty there, the same way an unreachable secondary slot already is. The swap based modes keep returning BOOT_SWAP_TYPE_PANIC, because they do need the primary trailer to resume a swap safely. Signed-off-by: Fabian Otto <fabian.otto@rohde-schwarz.com>
As it should
Sounds like a problem with the flash controller then, this isn't a problem of MCUboot |
The change only affects the OVERWRITE_ONLY mode. In that mode, MCUboot does not resume an interrupted update from the primary trailer. Treating an unreadable primary trailer as empty is equivalent to how an unreadable secondary slot is already handled today.
In my case, the issue happened with the NXP LPC55 flash. The Zephyr driver already maps fully erased pages to 0xFF (see zephyr#24429). But it can still return BOOT_EFLASH if the trailer page is partially written or otherwise unreadable, e.g. because of a real ECC error.
Returning BOOT_SWAP_TYPE_PANIC aborts inside |
2 participants
boot_swap_type_multi() returns BOOT_SWAP_TYPE_PANIC whenever the swap state of the primary slot cannot be read. On devices whose flash controller reports a read error for pages that have never been programmed, this happens as soon as part of the primary trailer is still erased, which permanently blocks both booting and firmware recovery.
In overwrite-only mode the bootloader never resumes an interrupted swap from the primary trailer and never sets its copy_done flag, so no entry of boot_swap_tables can match on the primary state. An unreachable primary trailer is therefore treated as empty there, the same way an unreachable secondary slot already is. The swap based modes keep returning BOOT_SWAP_TYPE_PANIC, because they do need the primary trailer to resume a swap safely.