boot: bootutil: Add swap using offset algorithm

nordicjm · nordicjm · commit 4af731695066 · 2025-01-27T10:39:47.000Z
Adds a new variation of the swap using move mode, named swap using
offset, whereby instead of moving all the sectors in the primary
image, the sectors in the secondary image are offset instead. This
fastens image swapping time both for updates and reverts as each
sector in both slots is erased only once, which also reduces flash
wear, and uses less swap status bits to represent

Signed-off-by: Jamie McCrae &lt;jamie.mccrae@nordicsemi.no&gt;
diff --git a/boot/bootutil/include/bootutil/boot_status.h b/boot/bootutil/include/bootutil/boot_status.h
@@ -130,6 +130,7 @@ enum mcuboot_mode {
     MCUBOOT_MODE_RAM_LOAD,
     MCUBOOT_MODE_FIRMWARE_LOADER,
     MCUBOOT_MODE_SINGLE_SLOT_RAM_LOAD,
+    MCUBOOT_MODE_SWAP_USING_OFFSET,
 };
 
 enum mcuboot_signature_type {
diff --git a/boot/bootutil/include/bootutil/bootutil.h b/boot/bootutil/include/bootutil/bootutil.h
@@ -90,6 +90,8 @@ struct boot_loader_state;
 void boot_state_clear(struct boot_loader_state *state);
 fih_ret context_boot_go(struct boot_loader_state *state, struct boot_rsp *rsp);
 const struct image_max_size *boot_get_max_app_size(void);
+uint32_t boot_get_state_secondary_offset(struct boot_loader_state *state,
+                                         const struct flash_area *fap);
 
 #define SPLIT_GO_OK                 (0)
 #define SPLIT_GO_NON_MATCHING       (-1)
diff --git a/boot/bootutil/include/bootutil/bootutil_public.h b/boot/bootutil/include/bootutil/bootutil_public.h
@@ -85,7 +85,7 @@ extern "C" {
 
 #ifdef MCUBOOT_BOOT_MAX_ALIGN
 
-#if defined(MCUBOOT_SWAP_USING_MOVE) || defined(MCUBOOT_SWAP_USING_SCRATCH)
+#if defined(MCUBOOT_SWAP_USING_MOVE) || defined(MCUBOOT_SWAP_USING_SCRATCH) || defined(MCUBOOT_SWAP_USING_OFFSET)
 _Static_assert(MCUBOOT_BOOT_MAX_ALIGN >= 8 && MCUBOOT_BOOT_MAX_ALIGN <= 32,
                "Unsupported value for MCUBOOT_BOOT_MAX_ALIGN for SWAP upgrade modes");
 #endif
diff --git a/boot/bootutil/include/bootutil/caps.h b/boot/bootutil/include/bootutil/caps.h
@@ -53,6 +53,7 @@ uint32_t bootutil_get_caps(void);
 #define BOOTUTIL_CAP_DIRECT_XIP             (1<<17)
 #define BOOTUTIL_CAP_HW_ROLLBACK_PROT       (1<<18)
 #define BOOTUTIL_CAP_ECDSA_P384             (1<<19)
+#define BOOTUTIL_CAP_SWAP_USING_OFFSET      (1<<20)
 
 /*
  * Query the number of images this bootloader is configured for.  This
diff --git a/boot/bootutil/include/bootutil/image.h b/boot/bootutil/include/bootutil/image.h
@@ -211,6 +211,9 @@ struct image_tlv_iter {
     uint32_t prot_end;
     uint32_t tlv_off;
     uint32_t tlv_end;
+#if defined(MCUBOOT_SWAP_USING_OFFSET)
+    uint32_t start_off;
+#endif
 };
 
 int bootutil_tlv_iter_begin(struct image_tlv_iter *it,
diff --git a/boot/bootutil/src/boot_record.c b/boot/bootutil/src/boot_record.c
@@ -143,6 +143,9 @@ boot_save_boot_status(uint8_t sw_module,
     /* Manifest data is concatenated to the end of the image.
      * It is encoded in TLV format.
      */
+#if defined(MCUBOOT_SWAP_USING_OFFSET)
+    it.start_off = 0;
+#endif
 
     rc = bootutil_tlv_iter_begin(&it, hdr, fap, IMAGE_TLV_ANY, false);
     if (rc) {
@@ -249,6 +252,8 @@ int boot_save_shared_data(const struct image_header *hdr, const struct flash_are
     uint8_t mode = MCUBOOT_MODE_UPGRADE_ONLY;
 #elif defined(MCUBOOT_SWAP_USING_MOVE)
     uint8_t mode = MCUBOOT_MODE_SWAP_USING_MOVE;
+#elif defined(MCUBOOT_SWAP_USING_OFFSET)
+    uint8_t mode = MCUBOOT_MODE_SWAP_USING_OFFSET;
 #elif defined(MCUBOOT_DIRECT_XIP)
 #if defined(MCUBOOT_DIRECT_XIP_REVERT)
     uint8_t mode = MCUBOOT_MODE_DIRECT_XIP_WITH_REVERT;
diff --git a/boot/bootutil/src/bootutil_misc.c b/boot/bootutil/src/bootutil_misc.c
@@ -336,7 +336,7 @@ uint32_t bootutil_max_image_size(const struct flash_area *fap)
 #if defined(MCUBOOT_SWAP_USING_SCRATCH) || defined(MCUBOOT_SINGLE_APPLICATION_SLOT) || \
     defined(MCUBOOT_FIRMWARE_LOADER) || defined(MCUBOOT_SINGLE_APPLICATION_SLOT_RAM_LOAD)
     return boot_status_off(fap);
-#elif defined(MCUBOOT_SWAP_USING_MOVE)
+#elif defined(MCUBOOT_SWAP_USING_MOVE) || defined(MCUBOOT_SWAP_USING_OFFSET)
     struct flash_sector sector;
     /* get the last sector offset */
     int rc = flash_area_get_sector(fap, boot_status_off(fap), &sector);
@@ -361,6 +361,7 @@ uint32_t bootutil_max_image_size(const struct flash_area *fap)
  * the TLVs.
  */
 #if !defined(MCUBOOT_DIRECT_XIP) && \
+    !defined(MCUBOOT_SWAP_USING_OFFSET) && \
     (!defined(MCUBOOT_OVERWRITE_ONLY) || \
     defined(MCUBOOT_OVERWRITE_ONLY_FAST))
 int
diff --git a/boot/bootutil/src/bootutil_priv.h b/boot/bootutil/src/bootutil_priv.h
@@ -58,11 +58,12 @@ struct flash_area;
 
 #if (defined(MCUBOOT_OVERWRITE_ONLY) + \
      defined(MCUBOOT_SWAP_USING_MOVE) + \
+     defined(MCUBOOT_SWAP_USING_OFFSET) + \
      defined(MCUBOOT_DIRECT_XIP) + \
      defined(MCUBOOT_RAM_LOAD) + \
      defined(MCUBOOT_FIRMWARE_LOADER) + \
      defined(MCUBOOT_SWAP_USING_SCRATCH)) > 1
-#error "Please enable only one of MCUBOOT_OVERWRITE_ONLY, MCUBOOT_SWAP_USING_MOVE, MCUBOOT_DIRECT_XIP, MCUBOOT_RAM_LOAD or MCUBOOT_FIRMWARE_LOADER"
+#error "Please enable only one of MCUBOOT_OVERWRITE_ONLY, MCUBOOT_SWAP_USING_MOVE, MCUBOOT_SWAP_USING_OFFSET, MCUBOOT_DIRECT_XIP, MCUBOOT_RAM_LOAD or MCUBOOT_FIRMWARE_LOADER"
 #endif
 
 #if !defined(MCUBOOT_DIRECT_XIP) && \
@@ -72,15 +73,20 @@ struct flash_area;
 
 #if !defined(MCUBOOT_OVERWRITE_ONLY) && \
     !defined(MCUBOOT_SWAP_USING_MOVE) && \
+    !defined(MCUBOOT_SWAP_USING_OFFSET) && \
     !defined(MCUBOOT_DIRECT_XIP) && \
     !defined(MCUBOOT_RAM_LOAD) && \
     !defined(MCUBOOT_SINGLE_APPLICATION_SLOT) && \
     !defined(MCUBOOT_FIRMWARE_LOADER)
 #define MCUBOOT_SWAP_USING_SCRATCH 1
 #endif
 
+#if defined(MCUBOOT_SWAP_USING_OFFSET)
+#define BOOT_STATUS_OP_SWAP     1
+#else
 #define BOOT_STATUS_OP_MOVE     1
 #define BOOT_STATUS_OP_SWAP     2
+#endif
 
 /*
  * Maintain state of copy progress.
@@ -196,6 +202,9 @@ _Static_assert(sizeof(boot_img_magic) == BOOT_MAGIC_SZ, "Invalid size for image
 #define BOOT_STATUS_MOVE_STATE_COUNT    1
 #define BOOT_STATUS_SWAP_STATE_COUNT    2
 #define BOOT_STATUS_STATE_COUNT         (BOOT_STATUS_MOVE_STATE_COUNT + BOOT_STATUS_SWAP_STATE_COUNT)
+#elif MCUBOOT_SWAP_USING_OFFSET
+#define BOOT_STATUS_SWAP_STATE_COUNT    2
+#define BOOT_STATUS_STATE_COUNT         BOOT_STATUS_SWAP_STATE_COUNT
 #else
 #define BOOT_STATUS_STATE_COUNT         3
 #endif
@@ -241,6 +250,13 @@ struct boot_loader_state {
     uint8_t swap_type[BOOT_IMAGE_NUMBER];
     uint32_t write_sz;
 
+#if defined(MCUBOOT_SWAP_USING_OFFSET)
+    uint32_t secondary_offset[BOOT_IMAGE_NUMBER];
+#if defined(MCUBOOT_BOOTSTRAP)
+    bool bootstrap_secondary_offset_set[BOOT_IMAGE_NUMBER];
+#endif
+#endif
+
 #if defined(MCUBOOT_ENC_IMAGES)
     struct enc_key_data enc[BOOT_IMAGE_NUMBER][BOOT_NUM_SLOTS];
 #endif
@@ -307,10 +323,17 @@ int boot_slots_compatible(struct boot_loader_state *state);
 uint32_t boot_status_internal_off(const struct boot_status *bs, int elem_sz);
 int boot_read_image_header(struct boot_loader_state *state, int slot,
                            struct image_header *out_hdr, struct boot_status *bs);
+#if defined(MCUBOOT_SWAP_USING_OFFSET) && defined(MCUBOOT_ENC_IMAGES)
+int boot_copy_region(struct boot_loader_state *state,
+                     const struct flash_area *fap_src,
+                     const struct flash_area *fap_dst,
+                     uint32_t off_src, uint32_t off_dst, uint32_t sz, uint32_t sector_off);
+#else
 int boot_copy_region(struct boot_loader_state *state,
                      const struct flash_area *fap_src,
                      const struct flash_area *fap_dst,
                      uint32_t off_src, uint32_t off_dst, uint32_t sz);
+#endif
 int boot_erase_region(const struct flash_area *fap, uint32_t off, uint32_t sz);
 bool boot_status_is_reset(const struct boot_status *bs);
 
diff --git a/boot/bootutil/src/bootutil_public.c b/boot/bootutil/src/bootutil_public.c
@@ -4,7 +4,7 @@
  * Copyright (c) 2017-2019 Linaro LTD
  * Copyright (c) 2016-2019 JUUL Labs
  * Copyright (c) 2019-2023 Arm Limited
- * Copyright (c) 2020-2023 Nordic Semiconductor ASA
+ * Copyright (c) 2020-2025 Nordic Semiconductor ASA
  *
  * Original license:
  *
@@ -84,6 +84,9 @@ struct boot_swap_table {
     uint8_t image_ok_primary_slot;
     uint8_t image_ok_secondary_slot;
     uint8_t copy_done_primary_slot;
+#if defined(MCUBOOT_SWAP_USING_OFFSET)
+    uint8_t copy_done_secondary_slot;
+#endif
 
     uint8_t swap_type;
 };
@@ -100,12 +103,26 @@ struct boot_swap_table {
  * the bootloader, as in starting/finishing a swap operation.
  */
 static const struct boot_swap_table boot_swap_tables[] = {
+#if defined(MCUBOOT_SWAP_USING_OFFSET)
+    {
+        .magic_primary_slot =       BOOT_MAGIC_ANY,
+        .magic_secondary_slot =     BOOT_MAGIC_GOOD,
+        .image_ok_primary_slot =    BOOT_FLAG_ANY,
+        .image_ok_secondary_slot =  BOOT_FLAG_UNSET,
+        .copy_done_primary_slot =   BOOT_FLAG_ANY,
+        .copy_done_secondary_slot = BOOT_FLAG_SET,
+        .swap_type =                BOOT_SWAP_TYPE_REVERT,
+    },
+#endif
     {
         .magic_primary_slot =       BOOT_MAGIC_ANY,
         .magic_secondary_slot =     BOOT_MAGIC_GOOD,
         .image_ok_primary_slot =    BOOT_FLAG_ANY,
         .image_ok_secondary_slot =  BOOT_FLAG_UNSET,
         .copy_done_primary_slot =   BOOT_FLAG_ANY,
+#if defined(MCUBOOT_SWAP_USING_OFFSET)
+        .copy_done_secondary_slot = BOOT_FLAG_ANY,
+#endif
         .swap_type =                BOOT_SWAP_TYPE_TEST,
     },
     {
@@ -114,6 +131,9 @@ static const struct boot_swap_table boot_swap_tables[] = {
         .image_ok_primary_slot =    BOOT_FLAG_ANY,
         .image_ok_secondary_slot =  BOOT_FLAG_SET,
         .copy_done_primary_slot =   BOOT_FLAG_ANY,
+#if defined(MCUBOOT_SWAP_USING_OFFSET)
+        .copy_done_secondary_slot = BOOT_FLAG_ANY,
+#endif
         .swap_type =                BOOT_SWAP_TYPE_PERM,
     },
     {
@@ -122,6 +142,9 @@ static const struct boot_swap_table boot_swap_tables[] = {
         .image_ok_primary_slot =    BOOT_FLAG_UNSET,
         .image_ok_secondary_slot =  BOOT_FLAG_ANY,
         .copy_done_primary_slot =   BOOT_FLAG_SET,
+#if defined(MCUBOOT_SWAP_USING_OFFSET)
+        .copy_done_secondary_slot = BOOT_FLAG_ANY,
+#endif
         .swap_type =                BOOT_SWAP_TYPE_REVERT,
     },
 };
@@ -439,7 +462,12 @@ boot_swap_type_multi(int image_index)
             (table->image_ok_secondary_slot == BOOT_FLAG_ANY ||
                 table->image_ok_secondary_slot == secondary_slot.image_ok) &&
             (table->copy_done_primary_slot == BOOT_FLAG_ANY  ||
-                table->copy_done_primary_slot == primary_slot.copy_done)) {
+                table->copy_done_primary_slot == primary_slot.copy_done)
+#if defined(MCUBOOT_SWAP_USING_OFFSET)
+            && (table->copy_done_secondary_slot == BOOT_FLAG_ANY  ||
+                table->copy_done_secondary_slot == secondary_slot.copy_done)
+#endif
+            ) {
             BOOT_LOG_INF("Image index: %d, Swap type: %s", image_index,
                          table->swap_type == BOOT_SWAP_TYPE_TEST   ? "test"   :
                          table->swap_type == BOOT_SWAP_TYPE_PERM   ? "perm"   :
diff --git a/boot/bootutil/src/caps.c b/boot/bootutil/src/caps.c
@@ -45,6 +45,8 @@ uint32_t bootutil_get_caps(void)
     res |= BOOTUTIL_CAP_OVERWRITE_UPGRADE;
 #elif defined(MCUBOOT_SWAP_USING_MOVE)
     res |= BOOTUTIL_CAP_SWAP_USING_MOVE;
+#elif defined(MCUBOOT_SWAP_USING_OFFSET)
+    res |= BOOTUTIL_CAP_SWAP_USING_OFFSET;
 #else
     res |= BOOTUTIL_CAP_SWAP_USING_SCRATCH;
 #endif
diff --git a/boot/bootutil/src/encrypted.c b/boot/bootutil/src/encrypted.c
@@ -655,6 +655,10 @@ boot_enc_load(struct boot_loader_state *state, int slot,
     /* Initialize the AES context */
     boot_enc_init(enc_state, slot);
 
+#if defined(MCUBOOT_SWAP_USING_OFFSET)
+    it.start_off = boot_get_state_secondary_offset(state, fap);
+#endif
+
     rc = bootutil_tlv_iter_begin(&it, hdr, fap, EXPECTED_ENC_TLV, false);
     if (rc) {
         return -1;
diff --git a/boot/bootutil/src/image_validate.c b/boot/bootutil/src/image_validate.c
@@ -84,6 +84,9 @@ bootutil_img_hash(struct boot_loader_state *state,
     struct enc_key_data *enc_state;
     int image_index;
 #endif
+#if defined(MCUBOOT_SWAP_USING_OFFSET)
+    uint32_t sector_off = 0;
+#endif
 
 #if (BOOT_IMAGE_NUMBER == 1) || !defined(MCUBOOT_ENC_IMAGES) || \
     defined(MCUBOOT_RAM_LOAD)
@@ -117,6 +120,13 @@ bootutil_img_hash(struct boot_loader_state *state,
     }
 #endif
 
+#if defined(MCUBOOT_SWAP_USING_OFFSET)
+    /* For swap using offset mode, the image starts in the second sector of the upgrade slot, so
+     * apply the offset when this is needed
+     */
+    sector_off = boot_get_state_secondary_offset(state, fap);
+#endif
+
     bootutil_sha_init(&sha_ctx);
 
     /* in some cases (split image) the hash is seeded with data from
@@ -162,7 +172,11 @@ bootutil_img_hash(struct boot_loader_state *state,
             blk_sz = tlv_off - off;
         }
 #endif
+#if defined(MCUBOOT_SWAP_USING_OFFSET)
+        rc = flash_area_read(fap, off + sector_off, tmp_buf, blk_sz);
+#else
         rc = flash_area_read(fap, off, tmp_buf, blk_sz);
+#endif
         if (rc) {
             bootutil_sha_drop(&sha_ctx);
             return rc;
@@ -350,6 +364,10 @@ bootutil_get_img_security_cnt(struct boot_loader_state *state, int slot,
         return BOOT_EBADIMAGE;
     }
 
+#if defined(MCUBOOT_SWAP_USING_OFFSET)
+    it.start_off = boot_get_state_secondary_offset(state, fap);
+#endif
+
     rc = bootutil_tlv_iter_begin(&it, boot_img_hdr(state, slot), fap, IMAGE_TLV_SEC_CNT, true);
     if (rc) {
         return rc;
@@ -508,6 +526,10 @@ bootutil_img_validate(struct boot_loader_state *state,
     }
 #endif
 
+#if defined(MCUBOOT_SWAP_USING_OFFSET)
+    it.start_off = boot_get_state_secondary_offset(state, fap);
+#endif
+
     rc = bootutil_tlv_iter_begin(&it, hdr, fap, IMAGE_TLV_ANY, false);
     if (rc) {
         goto out;
diff --git a/boot/bootutil/src/loader.c b/boot/bootutil/src/loader.c
diff --git a/boot/bootutil/src/swap_misc.c b/boot/bootutil/src/swap_misc.c
diff --git a/boot/bootutil/src/swap_offset.c b/boot/bootutil/src/swap_offset.c
diff --git a/boot/bootutil/src/swap_priv.h b/boot/bootutil/src/swap_priv.h
diff --git a/boot/bootutil/src/swap_scratch.c b/boot/bootutil/src/swap_scratch.c
diff --git a/boot/bootutil/src/tlv.c b/boot/bootutil/src/tlv.c
