Upgrade from v3.6.0 to v4.1.0 for ESP32 - MCUBOOT with flash encryption

[Qtran1511]

Hi,

I have been working on a product using ESP32 with mcuboot loader - flash encryption, using version 3.6.0. This product has already been launched for a while and a lot of it are already on the field. Now, as part of maintaining and developing process, I wish to migrate from 3.6.0 to 4.1.0 so more features can be added, and some bug can be potentially fixed. The most important thing for this job is to make sure that those devices already deployed out there can be upgraded using mcuboot that was built on v3.6.0. I've played a around with the custom linker script to at least successfully compile the code, but when load it into ESP32, the boot loader doesn't happy with the firmware I have:

ets Jun  8 2016 00:22:57
rst:0x1 (POWERON_RESET),boot:0x12 (SPI_FAST_FLASH_BOOT)
configsip: 188777542, SPIWP:0xee
clk_drv:0x00,q_drv:0x00,d_drv:0x00,cs0_drv:0x00,hd_drv:0x00,wp_drv:0x00
mode:DIO, clock div:2
load:0x3fff9d40,len:11488
load:0x40078000,len:22084
ho 0 tail 12 room 4
load:0x40090000,len:18424
entry 0x4007d56c
[esp32] [INF] *** Booting MCUboot build v1.7.0-832-ga4eda30f ***
[esp32] [INF] [boot] chip revision: v1.0
[esp32] [INF] [boot.esp32] SPI Speed      : 40MHz
[esp32] [INF] [boot.esp32] SPI Mode       : DIO
[esp32] [INF] [boot.esp32] SPI Flash Size : 4MB
[esp32] [INF] [boot] Enabling RNG early entropy source...
[esp32] [INF] Primary image: magic=good, swap_type=0x1, copy_done=0x3, image_ok=0x1
[esp32] [INF] Scratch: magic=bad, swap_type=0x2, copy_done=0x2, image_ok=0x2
[esp32] [INF] Boot source: primary slot
[esp32] [ERR] Detected inconsistent status!
[esp32] [INF] Starting swap using scratch algorithm.
Fatal exception (28): LoadProhibited
epc1=0x400918bd, epc2=0x00000000, epc3=0x00000000, excvaddr=0x00000000, depc=0x00000000

This is my flash dts setup to ensure consistency between version:

&flash0 {
    status = "okay";
    write-block-size = <32>;
    partitions {
        compatible = "fixed-partitions";
        #address-cells = <1>;
        #size-cells = <1>;

        /* Reserve 60kB for the bootloader */
        boot_partition: partition@1000 {
            label = "mcuboot";
            reg = <0x1000 DT_SIZE_K(60)>;
            read-only;
        };

        /* Reserve 1024kB for the application in slot 0 */
        slot0_partition: partition@10000 {
            label = "image-0";
            reg = <0x10000 DT_SIZE_M(1)>;
        };

        /* Reserve 1024kB for the application in slot 1 */
        slot1_partition: partition@110000 {
            label = "image-1";
            reg = <0x110000 DT_SIZE_M(1)>;
        };

        /* Reserve 256kB for the scratch partition */
        scratch_partition: partition@210000 {
            label = "image-scratch";
            reg = <0x210000 DT_SIZE_K(256)>;
        };

        storage_partition: partition@250000 {
            label = "storage";
            reg = <0x250000 0x00150000>;
        };
    };
};

For the linker script, I took the default.ld from v4.2.0 to add dram1_0 section for noinit data so that I wouldn't run out of memory, tweak a bit as well to match the flash offset with v3.6.0:

/* User available SRAM memory segments */
procpu_iram0_end = USER_IRAM_END - APPCPU_SRAM_SIZE;
procpu_iram0_org = SRAM0_IRAM_START + SRAM0_CACHE_SIZE;
procpu_iram0_len = procpu_iram0_end - procpu_iram0_org;

procpu_dram0_end = SRAM2_DRAM_END;
procpu_dram0_org = SRAM2_DRAM_USER_START + CONFIG_ESP32_BT_RESERVE_DRAM;
procpu_dram0_len = SRAM2_DRAM_USER_SIZE - CONFIG_ESP32_BT_RESERVE_DRAM;

procpu_dram1_org = SRAM1_DRAM_USER_START;
procpu_dram1_len = SRAM1_USER_SIZE;

procpu_irom_org = ICACHE0_START;
procpu_irom_len = ICACHE0_SIZE;
procpu_drom_org = DCACHE0_START;
procpu_drom_len = DCACHE0_SIZE;

#ifdef CONFIG_ESP_SPIRAM
procpu_ext_ram_org = DCACHE1_START;
procpu_ext_ram_len = DCACHE1_SIZE;
#endif

/* Aliases */
#define FLASH_CODE_REGION irom0_0_seg
#define RODATA_REGION     drom0_0_seg
#define IRAM_REGION       iram0_0_seg
#define DRAM_REGION       dram0_0_seg
#define RAMABLE_REGION    dram0_0_seg

#define RAMABLE_REGION_2  dram1_0_seg

#define ROMABLE_REGION      FLASH

#undef GROUP_DATA_LINK_IN
#define GROUP_DATA_LINK_IN(vregion, lregion) > vregion AT > lregion

#undef GROUP_NOLOAD_LINK_IN
#define GROUP_NOLOAD_LINK_IN(vregion, lregion) > vregion

/* Flash segments (rodata and text) should be mapped in virtual address space by providing VMA.
 * Executing directly from LMA is not possible. */
#undef GROUP_ROM_LINK_IN
#define GROUP_ROM_LINK_IN(vregion, lregion) > RODATA_REGION AT > lregion

/* Make sure new sections have consistent alignment between input and output sections */
#undef SECTION_DATA_PROLOGUE
#define SECTION_DATA_PROLOGUE(name, options, align) name options : ALIGN_WITH_INPUT

#undef SECTION_PROLOGUE
#define SECTION_PROLOGUE SECTION_DATA_PROLOGUE

MEMORY
{
#ifdef CONFIG_BOOTLOADER_MCUBOOT
  mcuboot_hdr (R): org = 0x0,  len = 0x20
  metadata (R):    org = 0x20, len = 0x20
  FLASH (R):       org = 0x40, len = FLASH_SIZE - 0x40
#else
  /* Make safety margin in the FLASH memory size so the
   * (esp_img_header + (n*esp_seg_headers)) would fit
   */
  FLASH (R):       org = 0x0,  len = FLASH_SIZE - 0x100
#endif /* CONFIG_BOOTLOADER_MCUBOOT */

  iram0_0_seg(RX): org = procpu_iram0_org, len = procpu_iram0_len
  dram0_0_seg(RW): org = procpu_dram0_org, len = procpu_dram0_len
  dram1_0_seg(RW): org = procpu_dram1_org, len = procpu_dram1_len

  irom0_0_seg(RX): org = procpu_irom_org, len = procpu_irom_len
  drom0_0_seg(R):  org = procpu_drom_org, len = procpu_drom_len

  rtc_iram_seg(RWX): org = 0x400c0000, len = 0x2000
  rtc_slow_seg(RW):  org = 0x50000000, len = 0x2000 - CONFIG_RESERVE_RTC_MEM
  rtc_data_seg(RW):  org = 0x3ff80000, len = 0x2000

  /* We reduced the size of rtc_slow_seg by CONFIG_RESERVE_RTC_MEM value.
   *  It reserves the amount of RTC slow memory that we use for this memory segment.
   *  This segment is intended for keeping rtc timer data (s_rtc_timer_retain_mem, see esp_clk.c files).
   *  The aim of this is to keep data that will not be moved around and have a fixed address.
   *  org = 0x50000000 + 0x2000 - CONFIG_RESERVE_RTC_MEM
   */
#if (CONFIG_RESERVE_RTC_MEM > 0)
  rtc_slow_reserved_seg(RW): org = 0x50000000 + 0x2000 - CONFIG_RESERVE_RTC_MEM,
                             len = CONFIG_RESERVE_RTC_MEM
#endif

#ifdef CONFIG_ESP_SPIRAM
  ext_ram_seg(RW): org = procpu_ext_ram_org, len = procpu_ext_ram_len
#endif /* CONFIG_ESP_SPIRAM */

#ifdef CONFIG_GEN_ISR_TABLES
  IDT_LIST(RW): org = 0x3ebfe010, len = 0x2000
#endif /* CONFIG_GEN_ISR_TABLES */
}

/*  Default entry point:  */
ENTRY(CONFIG_KERNEL_ENTRY)

_rom_store_table = 0;

PROVIDE(_memmap_vecbase_reset = 0x40000450);
PROVIDE(_memmap_reset_vector = 0x40000400);

/* Heap size calculations for PROCPU is also valid for AMP scenario */
_heap_sentry = SRAM2_DRAM_END;
_libc_heap_size = _heap_sentry - _end;

SECTIONS
{
#ifdef CONFIG_BOOTLOADER_MCUBOOT
  /* Reserve space for MCUboot header in the binary */
  .mcuboot_header :
  {
    QUAD(0x0)
    QUAD(0x0)
    QUAD(0x0)
    QUAD(0x0)
  } > mcuboot_hdr
  .metadata :
  {
    /* 0. Magic byte for load header */
    LONG(0xace637d3)

    /* 1. Application entry point address */
    KEEP(*(.entry_addr))

    /* IRAM load:
     * 2. Destination address (VMA) for IRAM region
     * 3. Flash offset (LMA) for start of IRAM region
     * 4. Size of IRAM region
     */
    LONG(ADDR(.iram0.vectors))
    LONG(LOADADDR(.iram0.vectors))
    LONG(LOADADDR(.iram0.text) + SIZEOF(.iram0.text) - LOADADDR(.iram0.vectors))

    /* DRAM load:
     * 5. Destination address (VMA) for DRAM region
     * 6. Flash offset (LMA) for start of DRAM region
     * 7. Size of DRAM region
     */
    LONG(ADDR(.dram0.data))
    LONG(LOADADDR(.dram0.data))
    LONG(LOADADDR(.dram0.end) + SIZEOF(.dram0.end) - LOADADDR(.dram0.data))
  } > metadata
#endif /* CONFIG_BOOTLOADER_MCUBOOT */

I'm seeking some advice here to see if there is any solution or workaround for this. Building a new mcuboot probably a better option but of course cannot overwrite bootloader for those devices on the field.

[rftafas]

Users found a big bug on MCUboot and Flash Encryption and a solution is under way.
mcu-tools/mcuboot#2320

Also, upgrading from pre-4.0 releases to 4.x releases is indeed difficult. There were lots of fixes and optimizations. If you are using Flash Encryption, than besides the changes you also get to deal with the bug to be fixed by the PR above. And if you are using a device that was self encrypted, you cannot overwrite the bootloader with normal flash command and cable. It will brick the device.

The only alternative I see is by using something similar to the esp-self-reflasher to re-write the current MCUboot with a new one. Be aware that the self reflashing method unfortunately creates a small window (less than 10 seconds) where power cannot be turned off.

[sylvioalves]

@Qtran1511 Were you able to move on with this? What is the current status?