Skip to content

bootutil: boot_validate_slot incorrectly identifies location of reset vector #2473

@de-nordic

Description

@de-nordic

The boot_validate_slot allows to verify whether an image in secondary slot can really boot from primary slot, by checking whether reset vector of that secondary slot stored image is within range of primary slot.
The feature is enabled with MCUBOOT_VERIFY_IMG_ADDRESS MCUboot config, and works only when MCUBOOT_IMAGE_NUMBER > 1, so more then one image is enabled, and there is no encryption enabled - as it requires reading secondary slot image after header.

Issue number 1:
Reset vector offset from header is not calculated correctly as the offset of course will not be size of reset vector pointer, but rather of something that precedes it

uint32_t reset_addr = secondary_hdr->ih_hdr_size + sizeof(reset_value);

Issue number 2
The code reading reset vector is expecting the certain layout of a binary, that can be assured by ARM_CORTEX_M , where reset vector indeed is placed at uint32_t size offset from header, but on other devices and arm devices that may not be a case:

mcuboot/boot/zephyr/main.c

Lines 135 to 148 in aed3fb9

struct arm_vector_table {
#ifdef CONFIG_CPU_CORTEX_M
uint32_t msp;
uint32_t reset;
#else
uint32_t reset;
uint32_t undef_instruction;
uint32_t svc;
uint32_t abort_prefetch;
uint32_t abort_data;
uint32_t reserved;
uint32_t irq;
uint32_t fiq;
#endif

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions