espressif:esp32: Add multi image support

Changes on configuration and flash area organization for supporting
multi image and implementation for booting on different processors
on esp32

Signed-off-by: Almir Okato <almir.okato@espressif.com>

Author: almir-okato

boot/espressif/bootloader.conf

@@ -3,13 +3,33 @@
 # SPDX-License-Identifier: Apache-2.0
 
 CONFIG_ESP_BOOTLOADER_SIZE=0xF000
-CONFIG_ESP_APPLICATION_PRIMARY_START_ADDRESS=0x10000
+CONFIG_ESP_IMAGE0_PRIMARY_START_ADDRESS=0x10000
 CONFIG_ESP_APPLICATION_SIZE=0x100000
-CONFIG_ESP_APPLICATION_SECONDARY_START_ADDRESS=0x110000
+CONFIG_ESP_IMAGE0_SECONDARY_START_ADDRESS=0x110000
 CONFIG_ESP_MCUBOOT_WDT_ENABLE=y
 CONFIG_ESP_SCRATCH_OFFSET=0x210000
 CONFIG_ESP_SCRATCH_SIZE=0x40000
 
+# Enables multi image, if it is not defined, it is assumed
+# only one updatable image
+# CONFIG_ESP_IMAGE_NUMBER=2
+
+# Enables multi image boot on independent processors
+# (main host OS is not responsible for booting the second image)
+# Use only with CONFIG_ESP_IMAGE_NUMBER=2
+# CONFIG_ESP_MULTI_PROCESSOR_BOOT=y
+
+# Example of values to be used when multi image is enabled
+# Notice that the OS layer and update agent must be aware
+# of these regions
+# CONFIG_ESP_APPLICATION_SIZE=0x50000
+# CONFIG_ESP_IMAGE0_PRIMARY_START_ADDRESS=0x10000
+# CONFIG_ESP_IMAGE0_SECONDARY_START_ADDRESS=0x60000
+# CONFIG_ESP_IMAGE1_PRIMARY_START_ADDRESS=0xB0000
+# CONFIG_ESP_IMAGE1_SECONDARY_START_ADDRESS=0x100000
+# CONFIG_ESP_SCRATCH_OFFSET=0x150000
+# CONFIG_ESP_SCRATCH_SIZE=0x40000
+
 # CONFIG_ESP_SIGN_EC256=y
 # CONFIG_ESP_SIGN_ED25519=n
 # CONFIG_ESP_SIGN_RSA=n

boot/espressif/hal/CMakeLists.txt

@@ -56,6 +56,7 @@ set(hal_srcs
     ${src_dir}/flash_encrypt.c
     ${src_dir}/${MCUBOOT_TARGET}/bootloader_init.c
     ${esp_idf_dir}/components/hal/mpu_hal.c
+    ${esp_idf_dir}/components/hal/soc_hal.c
     ${esp_idf_dir}/components/bootloader_support/src/bootloader_common_loader.c
     ${esp_idf_dir}/components/bootloader_support/src/bootloader_console_loader.c
     ${esp_idf_dir}/components/bootloader_support/src/bootloader_flash.c

boot/espressif/hal/include/app_cpu_start.h

@@ -0,0 +1,11 @@
+/*
+ * Copyright (c) 2022 Espressif Systems (Shanghai) Co., Ltd.
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+#pragma once
+
+#include <stdint.h>
+
+void appcpu_start(uint32_t entry_addr);

boot/espressif/hal/include/esp32/esp32.cmake

@@ -10,6 +10,12 @@ list(APPEND hal_srcs
     ${esp_idf_dir}/components/efuse/src/esp_efuse_api_key_esp32.c
     )
 
+if (DEFINED CONFIG_ESP_MULTI_PROCESSOR_BOOT)
+    list(APPEND hal_srcs
+        ${src_dir}/${MCUBOOT_TARGET}/app_cpu_start.c
+        )
+endif()
+
 list(APPEND LINKER_SCRIPTS
     -T${esp_idf_dir}/components/esp_rom/${MCUBOOT_TARGET}/ld/${MCUBOOT_TARGET}.rom.newlib-funcs.ld
     -T${esp_idf_dir}/components/esp_rom/${MCUBOOT_TARGET}/ld/${MCUBOOT_TARGET}.rom.eco3.ld

boot/espressif/hal/include/mcuboot_config/mcuboot_config.h

@@ -98,7 +98,11 @@
 
 /* Default number of separately updateable images; change in case of
  * multiple images. */
+#if defined(CONFIG_ESP_IMAGE_NUMBER)
+#define MCUBOOT_IMAGE_NUMBER CONFIG_ESP_IMAGE_NUMBER
+#else
 #define MCUBOOT_IMAGE_NUMBER 1
+#endif
 
 /*
  * Logging

boot/espressif/hal/src/esp32/app_cpu_start.c

@@ -0,0 +1,38 @@
+/*
+ * SPDX-FileCopyrightText: 2022 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+#include "app_cpu_start.h"
+
+#include "soc/dport_reg.h"
+#include "soc/gpio_periph.h"
+#include "soc/rtc_periph.h"
+#include "soc/rtc_cntl_reg.h"
+#include "esp32/rom/cache.h"
+#include "esp32/rom/uart.h"
+#include "esp_cpu.h"
+#include "esp_log.h"
+
+static const char *TAG = "app_cpu_start";
+
+void appcpu_start(uint32_t entry_addr)
+{
+    ESP_LOGI(TAG, "Starting APPCPU");
+
+    Cache_Flush(1);
+    Cache_Read_Enable(1);
+
+    esp_cpu_unstall(1);
+
+    DPORT_SET_PERI_REG_MASK(DPORT_APPCPU_CTRL_B_REG, DPORT_APPCPU_CLKGATE_EN);
+    DPORT_CLEAR_PERI_REG_MASK(DPORT_APPCPU_CTRL_C_REG, DPORT_APPCPU_RUNSTALL);
+    DPORT_SET_PERI_REG_MASK(DPORT_APPCPU_CTRL_A_REG, DPORT_APPCPU_RESETTING);
+    DPORT_CLEAR_PERI_REG_MASK(DPORT_APPCPU_CTRL_A_REG, DPORT_APPCPU_RESETTING);
+
+    ets_set_appcpu_boot_addr(entry_addr);
+    ets_delay_us(10000);
+    uart_tx_wait_idle(0);
+    ESP_LOGI(TAG, "APPCPU start sequence complete");
+}

boot/espressif/hal/src/flash_encrypt.c

@@ -234,7 +234,7 @@ static esp_err_t encrypt_flash_contents(uint32_t flash_crypt_cnt, bool flash_cry
      * This will need changes when implementing multi-slot support
      */
     ESP_LOGI(TAG, "Encrypting remaining flash...");
-    uint32_t region_addr = CONFIG_ESP_APPLICATION_SECONDARY_START_ADDRESS;
+    uint32_t region_addr = CONFIG_ESP_IMAGE0_SECONDARY_START_ADDRESS;
     size_t region_size = CONFIG_ESP_APPLICATION_SIZE;
     err = esp_flash_encrypt_region(region_addr, region_size);
     if (err != ESP_OK) {
@@ -247,6 +247,21 @@ static esp_err_t encrypt_flash_contents(uint32_t flash_crypt_cnt, bool flash_cry
         return err;
     }
 
+#if defined(CONFIG_ESP_IMAGE_NUMBER) && (CONFIG_ESP_IMAGE_NUMBER == 2)
+    region_addr = CONFIG_ESP_IMAGE1_PRIMARY_START_ADDRESS;
+    region_size = CONFIG_ESP_APPLICATION_SIZE;
+    err = esp_flash_encrypt_region(region_addr, region_size);
+    if (err != ESP_OK) {
+        return err;
+    }
+    region_addr = CONFIG_ESP_IMAGE1_SECONDARY_START_ADDRESS;
+    region_size = CONFIG_ESP_APPLICATION_SIZE;
+    err = esp_flash_encrypt_region(region_addr, region_size);
+    if (err != ESP_OK) {
+        return err;
+    }
+#endif
+
 #ifdef CONFIG_SECURE_FLASH_ENCRYPTION_MODE_RELEASE
     // Go straight to max, permanently enabled
     ESP_LOGI(TAG, "Setting CRYPT_CNT for permanent encryption");
@@ -309,20 +324,20 @@ static esp_err_t encrypt_primary_slot(void)
     /* Check if the slot is plaintext or encrypted, 0x20 offset is for skipping
      * MCUboot header
      */
-    err = bootloader_flash_read(CONFIG_ESP_APPLICATION_PRIMARY_START_ADDRESS + 0x20,
+    err = bootloader_flash_read(CONFIG_ESP_IMAGE0_PRIMARY_START_ADDRESS + 0x20,
                                 &img_header, sizeof(esp_image_load_header_t), true);
     if (err != ESP_OK) {
         ESP_LOGE(TAG, "Failed to read slot img header");
         return err;
     } else {
-        err = verify_img_header(CONFIG_ESP_APPLICATION_PRIMARY_START_ADDRESS,
+        err = verify_img_header(CONFIG_ESP_IMAGE0_PRIMARY_START_ADDRESS,
                                 &img_header, true);
     }
 
     if (err == ESP_OK) {
         ESP_LOGI(TAG, "Encrypting primary slot...");
 
-        err = esp_flash_encrypt_region(CONFIG_ESP_APPLICATION_PRIMARY_START_ADDRESS,
+        err = esp_flash_encrypt_region(CONFIG_ESP_IMAGE0_PRIMARY_START_ADDRESS,
                                        CONFIG_ESP_APPLICATION_SIZE);
         if (err != ESP_OK) {
             ESP_LOGE(TAG, "Failed to encrypt slot in place: 0x%x", err);

boot/espressif/include/esp_loader.h

@@ -6,4 +6,4 @@
 
 #pragma once
 
-void esp_app_image_load(int slot, unsigned int hdr_offset);
+void esp_app_image_load(int image_index, int slot, unsigned int hdr_offset, unsigned int *entry_addr);

boot/espressif/include/sysflash/sysflash.h

@@ -4,6 +4,10 @@
  * SPDX-License-Identifier: Apache-2.0
  */
 
+#pragma once
+
+#include <mcuboot_config/mcuboot_config.h>
+
 //! A user-defined identifier for different storage mediums
 //! (i.e internal flash, external NOR flash, eMMC, etc)
 #define FLASH_DEVICE_INTERNAL_FLASH 0
@@ -12,14 +16,35 @@
 //! there is not slot
 #define FLASH_SLOT_DOES_NOT_EXIST 255
 
-//! NB: MCUboot expects this define to exist but it's only used
-//! if MCUBOOT_SWAP_USING_SCRATCH=1 is set
-#define FLASH_AREA_IMAGE_SCRATCH FLASH_SLOT_DOES_NOT_EXIST
-
 //! The slot we will use to track the bootloader allocation
 #define FLASH_AREA_BOOTLOADER 0
 
-//! A mapping to primary and secondary/upgrade slot
-//! given an image_index. We'll plan to use
-#define FLASH_AREA_IMAGE_PRIMARY(i) ((i == 0) ? 1 : 255)
-#define FLASH_AREA_IMAGE_SECONDARY(i) ((i == 0) ? 2 : 255)
+#define FLASH_AREA_IMAGE_0_PRIMARY 1
+#define FLASH_AREA_IMAGE_0_SECONDARY 2
+#define FLASH_AREA_IMAGE_SCRATCH 3
+#define FLASH_AREA_IMAGE_1_PRIMARY 4
+#define FLASH_AREA_IMAGE_1_SECONDARY 5
+
+#if (MCUBOOT_IMAGE_NUMBER == 1)
+#define FLASH_AREA_IMAGE_PRIMARY(x)    (((x) == 0) ?          \
+                                         FLASH_AREA_IMAGE_0_PRIMARY : \
+                                         FLASH_SLOT_DOES_NOT_EXIST)
+#define FLASH_AREA_IMAGE_SECONDARY(x)  (((x) == 0) ?          \
+                                         FLASH_AREA_IMAGE_0_SECONDARY : \
+                                         FLASH_SLOT_DOES_NOT_EXIST)
+
+#elif (MCUBOOT_IMAGE_NUMBER == 2)
+#define FLASH_AREA_IMAGE_PRIMARY(x)    (((x) == 0) ?          \
+                                         FLASH_AREA_IMAGE_0_PRIMARY : \
+                                        ((x) == 1) ?          \
+                                         FLASH_AREA_IMAGE_1_PRIMARY : \
+                                         FLASH_SLOT_DOES_NOT_EXIST)
+#define FLASH_AREA_IMAGE_SECONDARY(x)  (((x) == 0) ?          \
+                                         FLASH_AREA_IMAGE_0_SECONDARY : \
+                                        ((x) == 1) ?          \
+                                         FLASH_AREA_IMAGE_1_SECONDARY : \
+                                         FLASH_SLOT_DOES_NOT_EXIST)
+
+#else
+#warning "Image slot and flash area mapping is not defined"
+#endif

boot/espressif/main.c

@@ -22,21 +22,74 @@
 #ifdef CONFIG_SECURE_FLASH_ENC_ENABLED
 #include "esp_flash_encrypt.h"
 #endif
+#ifdef CONFIG_ESP_MULTI_PROCESSOR_BOOT
+#include "app_cpu_start.h"
+#endif
 
 #include "esp_loader.h"
 #include "os/os_malloc.h"
 
+#define IMAGE_INDEX_0   0
+#define IMAGE_INDEX_1   1
+
+#define PRIMARY_SLOT    0
+#define SECONDARY_SLOT  1
+
 #ifdef CONFIG_SECURE_BOOT
 extern esp_err_t check_and_generate_secure_boot_keys(void);
 #endif
 
 void do_boot(struct boot_rsp *rsp)
 {
+    unsigned int entry_addr;
     BOOT_LOG_INF("br_image_off = 0x%x", rsp->br_image_off);
     BOOT_LOG_INF("ih_hdr_size = 0x%x", rsp->br_hdr->ih_hdr_size);
-    int slot = (rsp->br_image_off == CONFIG_ESP_APPLICATION_PRIMARY_START_ADDRESS) ? 0 : 1;
-    esp_app_image_load(slot, rsp->br_hdr->ih_hdr_size);
+    int slot = (rsp->br_image_off == CONFIG_ESP_IMAGE0_PRIMARY_START_ADDRESS) ? PRIMARY_SLOT : SECONDARY_SLOT;
+    esp_app_image_load(IMAGE_INDEX_0, slot, rsp->br_hdr->ih_hdr_size, &entry_addr);
+    ((void (*)(void))entry_addr)(); /* Call to application entry address should not return */
+    FIH_PANIC; /* It should not get here */
+}
+
+#ifdef CONFIG_ESP_MULTI_PROCESSOR_BOOT
+int read_image_header(uint32_t img_index, uint32_t slot, struct image_header *img_header)
+{
+    const struct flash_area *fap;
+    int area_id;
+    int rc = 0;
+
+    area_id = flash_area_id_from_multi_image_slot(img_index, slot);
+    rc = flash_area_open(area_id, &fap);
+    if (rc != 0) {
+        rc = BOOT_EFLASH;
+        goto done;
+    }
+
+    if (flash_area_read(fap, 0, img_header, sizeof(struct image_header))) {
+        rc = BOOT_EFLASH;
+        goto done;
+    }
+
+    BOOT_LOG_INF("Image offset = 0x%x", fap->fa_off);
+    BOOT_LOG_INF("Image header size = 0x%x", img_header->ih_hdr_size);
+
+done:
+    flash_area_close(fap);
+    return rc;
+}
+
+void do_boot_appcpu(uint32_t img_index, uint32_t slot)
+{
+    unsigned int entry_addr;
+    struct image_header img_header;
+
+    if (read_image_header(img_index, slot, &img_header) != 0) {
+        FIH_PANIC;
+    }
+
+    esp_app_image_load(img_index, slot, img_header.ih_hdr_size, &entry_addr);
+    appcpu_start(entry_addr);
 }
+#endif
 
 int main()
 {
@@ -97,8 +150,10 @@ int main()
      *   2) MCUboot validates the application images and prepares the booting process.
      */
 
+    /* MCUboot's boot_go validates and checks all images for update and returns
+     * the load information for booting the main image
+     */
     FIH_CALL(boot_go, fih_rc, &rsp);
-
     if (fih_not_eq(fih_rc, FIH_SUCCESS)) {
         BOOT_LOG_ERR("Unable to find bootable image");
 #ifdef CONFIG_SECURE_BOOT
@@ -165,6 +220,13 @@ int main()
     BOOT_LOG_INF("Disabling RNG early entropy source...");
     bootloader_random_disable();
 
+#ifdef CONFIG_ESP_MULTI_PROCESSOR_BOOT
+    /* Multi image independent boot
+     * Boot on the second processor happens before the image0 boot
+     */
+    do_boot_appcpu(IMAGE_INDEX_1, PRIMARY_SLOT);
+#endif
+
     do_boot(&rsp);
 
     while(1);

boot/espressif/port/esp_loader.c

@@ -27,7 +27,6 @@
 #include "esp_loader.h"
 #include "flash_map_backend/flash_map_backend.h"
 
-
 static int load_segment(const struct flash_area *fap, uint32_t data_addr, uint32_t data_len, uint32_t load_addr)
 {
     const uint32_t *data = (const uint32_t *)bootloader_mmap((fap->fa_off + data_addr), data_len);
@@ -40,18 +39,20 @@ static int load_segment(const struct flash_area *fap, uint32_t data_addr, uint32
     return 0;
 }
 
-void esp_app_image_load(int slot, unsigned int hdr_offset)
+void esp_app_image_load(int image_index, int slot, unsigned int hdr_offset, unsigned int *entry_addr)
 {
     const struct flash_area *fap;
     int area_id;
     int rc;
 
-    area_id = flash_area_id_from_image_slot(slot);
+    area_id = flash_area_id_from_multi_image_slot(image_index, slot);
     rc = flash_area_open(area_id, &fap);
     if (rc != 0) {
         BOOT_LOG_ERR("%s: flash_area_open failed with %d", __func__, rc);
     }
 
+    BOOT_LOG_INF("Loading image %d - slot %d from flash, area id: %d", image_index, slot, area_id);
+
     const uint32_t *data = (const uint32_t *)bootloader_mmap((fap->fa_off + hdr_offset), sizeof(esp_image_load_header_t));
     esp_image_load_header_t load_header = {0};
     memcpy((void *)&load_header, data, sizeof(esp_image_load_header_t));
@@ -85,7 +86,7 @@ void esp_app_image_load(int slot, unsigned int hdr_offset)
 
     BOOT_LOG_INF("start=0x%x", load_header.entry_addr);
     uart_tx_wait_idle(0);
-    void *start = (void *) load_header.entry_addr;
-    ((void (*)(void))start)(); /* Call to application entry address should not return */
-    FIH_PANIC;
+
+    assert(entry_addr != NULL);
+    *entry_addr = load_header.entry_addr;
 }