cr50: add ability to include two identical RW sections in the EC image

A typical EC image includes two similar in their functionality
subsections, RO and RW. CR50 has a small RO subsection, all it does -
detects a proper RW image to run and starts it up. To provide for
reliable firmware updates, the CR50 image needs to include two RW
sections, while the code is running from one RW subsection, the other
one can be upgraded.

This patch adds the ability to generate two identical RW sections,
mapped half flash size apart, and include them into the resulting EC
image.

To keep things simple the previously existing RW section's name is not
being changed, while the new (identical) RW section is named RW_B.

Two configuration options need to be defined to enable building of the
new image type: CONFIG_RW_B to enable the feature and
CONFIG_RW_B_MEM_OFF to define where RW_B should be mapped into the
flash.

A new rule added to Makefile.rules allows to generate a different lds
file from the same source (core/cortex-m/ec.lds.S) by defining a
compile time variable to pick a different base address for the
rewritable section, when RW_B is built.

BRANCH=none
BUG=chromium:43025
TEST=as follows:
    - make buildall -j still succeeds
    - verified that regular CR50 image starts successfully

    - modified chip/g/loader/main.c to launch RW_B first, re-built and
      re-run the image, observed on the console:

vvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvv
  cr50 bootloader, 20151118_11218@80881, no USB, full crypto
  Valid image found at 0x00084000, jumping

  --- UART initialized after reboot ---
  [Reset cause: power-on]
  [Image: unknown, cr50_v1.1.4160-4c8a789-dirty 2015-12-07 18:54:27 vbendeb@eskimo.mtv.corp.google.com]
  [0.001148 Inits done]
  This FPGA image has no USB support
  Console is enabled; type HELP for help.
  > [0.002212 task 2 waiting for events...]
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

    (note that the image base address is 0x840000, which is RW_B).

Change-Id: Ia2f90d5e5b7a9f252ea3ecf3ff5babfad8a97444
Signed-off-by: Vadim Bendebury <vbendeb@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/316703
Commit-Ready: Nicolas Boichat <drinkcat@chromium.org>
Reviewed-by: Aseda Aboagye <aaboagye@chromium.org>
Reviewed-by: Randall Spangler <rspangler@chromium.org>

9 files changed, 41 insertions, 8 deletions

diff --git a/Makefile.rules b/Makefile.rules
index 425a5e84ef..1f776303ff 100644
--- a/Makefile.rules
+++ b/Makefile.rules
@@ -33,6 +33,7 @@ silent_err = $(if $(V),,2>/dev/null)
 
 # commands to build all targets
 cmd_lds = $(CPP) -P -C -MMD -MF $@.d -MT $@ $(CPPFLAGS) $< -o $@
+cmd_lds_b = $(cmd_lds) -DRW_B_LDS
 # Allow obj_to_bin to be overridden by board or chip specific commands
 cmd_obj_to_bin ?= $(OBJCOPY) --gap-fill=0xff -O binary $^ $(out)/$*.bin.tmp
 cmd_flat_to_obj = $(CC) -T $(out)/firmware_image.lds -nostdlib $(CPPFLAGS) \
@@ -186,6 +187,9 @@ $(out)/firmware_image.lds: common/firmware_image.lds.S
 $(out)/%.lds: core/$(CORE)/ec.lds.S
 	$(call quiet,lds,LDS    )
 
+$(out)/%_B.lds: core/$(CORE)/ec.lds.S
+	$(call quiet,lds_b,LDS_B  )
+
 $(out)/%.bin: $(out)/%.obj
 	$(call quiet,obj_to_bin,OBJCOPY)
 	$(if $(wildcard $(PEM)),$(call quiet,rsasign,SIGN   ),)
diff --git a/board/cr50/board.h b/board/cr50/board.h
index 0e53458dd3..0906927361 100644
--- a/board/cr50/board.h
+++ b/board/cr50/board.h
@@ -104,4 +104,5 @@ enum usb_strings {
  * TODO(vbendeb): remove this before finalizing the code.
  */
 #define CONFIG_DEBUG_STACK_OVERFLOW
+#define CONFIG_RW_B
 #endif /* __CROS_EC_BOARD_H */
diff --git a/board/cr50/build.mk b/board/cr50/build.mk
index a734411747..2e42b7b920 100644
--- a/board/cr50/build.mk
+++ b/board/cr50/build.mk
@@ -51,6 +51,7 @@ CFLAGS += -DUSER_MIN_HASH_STATE_SIZE=210
 # Add dependencies on that library
 $(out)/RO/ec.RO.elf: $(out)/tpm2/libtpm2.a
 $(out)/RW/ec.RW.elf: $(out)/tpm2/libtpm2.a
+$(out)/RW/ec.RW_B.elf: $(out)/tpm2/libtpm2.a
 
 # Force the external build each time, so it can look for changed sources.
 .PHONY: $(out)/tpm2/libtpm2.a
diff --git a/chip/g/build.mk b/chip/g/build.mk
index 4dc40cd556..7e06a2dbf7 100644
--- a/chip/g/build.mk
+++ b/chip/g/build.mk
@@ -68,4 +68,8 @@ endif
 $(out)/RO/ec.RO.flat: $(out)/util/signer
 $(out)/RW/ec.RW.flat: $(out)/util/signer
 
-$(out)/%.hex: $(out)/%.flat
+%.hex: %.flat
+
+ifneq ($(CONFIG_RW_B),)
+$(out)/$(PROJECT).obj: $(out)/RW/ec.RW_B.flat
+endif
diff --git a/chip/g/config_chip.h b/chip/g/config_chip.h
index 3ce93389d0..ffe8b50f1e 100644
--- a/chip/g/config_chip.h
+++ b/chip/g/config_chip.h
@@ -65,10 +65,12 @@
 #define CONFIG_IRQ_COUNT (GC_INTERRUPTS_COUNT - 16)
 
 #undef CONFIG_RW_MEM_OFF
+#undef CONFIG_RW_SIZE
 
 /* Leaving 16K for the RO aka loader. */
 #define CONFIG_RW_MEM_OFF 0x4000
-
+#define CONFIG_RW_B_MEM_OFF (CONFIG_RW_MEM_OFF + (CONFIG_FLASH_SIZE>>1))
+#define CONFIG_RW_SIZE ((CONFIG_FLASH_SIZE>>1) - CONFIG_RW_MEM_OFF)
 #define CONFIG_CUSTOMIZED_RO
 #define CONFIG_EXTENSION_COMMAND 0xbaccd00a
 
diff --git a/common/firmware_image.S b/common/firmware_image.S
index 8a4fc7f9a2..1fa4f25f71 100644
--- a/common/firmware_image.S
+++ b/common/firmware_image.S
@@ -2,21 +2,23 @@
  * Use of this source code is governed by a BSD-style license that can be
  * found in the LICENSE file.
  *
- * Build the full image with up to 2 copies (Read only, Read write)
- * of the program
+ * Build the full image with up to three program components (one Read only,
+ * and one or two Read write).
  */
 
 #include "config.h"
 
-#define FW_FILE(builddir,proj,sect) builddir##/##sect##/##proj##.##sect##.flat
+#define FW_FILE(builddir,proj,sect,suffix) \
+	builddir##/##sect##/##proj##.##sect##suffix##.flat
 #define STRINGIFY0(name)  #name
 #define STRINGIFY(name)  STRINGIFY0(name)
-#define FW_IMAGE(sect) STRINGIFY(FW_FILE(FINAL_OUTDIR,PROJECT,sect))
+#define FW_IMAGE(sect,suffix) \
+	STRINGIFY(FW_FILE(FINAL_OUTDIR,PROJECT,sect,suffix))
 
 /* Read Only firmware */
 #ifdef CONFIG_FW_INCLUDE_RO
 .section .image.RO, "ax"
-.incbin FW_IMAGE(RO)
+.incbin FW_IMAGE(RO,)
 #endif
 
 /* Shared objects library */
@@ -27,4 +29,9 @@
 
 /* Read Write firmware */
 .section .image.RW, "ax"
-.incbin FW_IMAGE(RW)
+.incbin FW_IMAGE(RW,)
+
+#ifdef CONFIG_RW_B
+.section .image.RW_B, "ax"
+.incbin FW_IMAGE(RW,_B)
+#endif
diff --git a/common/firmware_image.lds.S b/common/firmware_image.lds.S
index 3104f41c64..1b846bd045 100644
--- a/common/firmware_image.lds.S
+++ b/common/firmware_image.lds.S
@@ -48,6 +48,11 @@ and RW images at different Flash offset */
 #endif
         *(.image.RW)
     } > FLASH =0xff
+#ifdef CONFIG_RW_B_MEM_OFF
+    .image.RW_B : AT(CONFIG_PROGRAM_MEMORY_BASE + CONFIG_RW_B_MEM_OFF) {
+        *(.image.RW_B)
+    } > FLASH =0xff
+#endif
     .padding : AT(CONFIG_PROGRAM_MEMORY_BASE + CONFIG_FLASH_SIZE - 1) {
         BYTE(0xff);
     } > FLASH =0xff
diff --git a/core/cortex-m/ec.lds.S b/core/cortex-m/ec.lds.S
index d32145d243..edd5308e93 100644
--- a/core/cortex-m/ec.lds.S
+++ b/core/cortex-m/ec.lds.S
@@ -5,7 +5,11 @@
 #include "config.h"
 #include "rsa.h"
 
+#ifdef RW_B_LDS
+#define FW_MEM_OFF_(section) CONFIG_##section##_B_MEM_OFF
+#else
 #define FW_MEM_OFF_(section) CONFIG_##section##_MEM_OFF
+#endif
 #define FW_MEM_OFF(section) (FW_MEM_OFF_(section))
 #define FW_OFF(section) (CONFIG_PROGRAM_MEMORY_BASE + FW_MEM_OFF(section))
 
diff --git a/include/config.h b/include/config.h
index 40db719b68..545d83d39e 100644
--- a/include/config.h
+++ b/include/config.h
@@ -850,6 +850,11 @@
 #undef CONFIG_RO_SIZE
 
 #undef CONFIG_RW_MEM_OFF
+/* Some targets include two RW sections in the image. */
+#undef CONFIG_RW_B
+/* This is the offset of the second RW section into the flash. */
+#undef CONFIG_RW_B_MEM_OFF
+
 /* Offset relative to CONFIG_EC_WRITABLE_STORAGE_OFF */
 #undef CONFIG_RW_STORAGE_OFF
 #undef CONFIG_RW_SIZE