Commit Graph

37 Commits

Author SHA1 Message Date
6c93309df4 Remove the Flash trait 2023-04-04 21:18:41 +02:00
25577e0eaf Assert active and dfu have same erase size and copy in smaller chunks
The copy from active to dfu (and vice versa) is now done in smaller portions depending on aligned_buf, which now does not need to be erase_size big.
2023-04-04 21:09:30 +02:00
9242ad89d4 Remove magic buffer argument from prepare_boot
and use the aligned page buffer instead
2023-04-04 20:25:55 +02:00
3ede5667d4 Merge #1324 #1327
1324: Add MCO support for L4 and F4 families r=Dirbaio a=m-dupont

Add MCO support for L4 and F4 as already done in F7. 

When the 'HSI' source is selected as MCO source, 'HSI' is activated (`set_hsion(true)`) . This is done to operate the MCO in case 'MSI' is chosen as the clock source for the CPU. The same applies to PLL, etc.

1327: Avoid write before erase r=Dirbaio a=rmja

This introduces an additional marker to the state partition right after the magic which indicates whether the current progress is valid or not. Validation in tests that we never write without an erase is added.

There is currently a FIXME in the FirmwareUpdater. Let me know if we should take the erase value as a parameter. I opened a feature request in embedded-storage to get this value in the trait. Before this, the assumption about ERASE_VALUE=0xFF was the same.

I have made some thoughts about whether this is a breaking change between the app and firmware, i.e. whether adding the "Progress valid" field is breaking. My conclusion is that it is not a breaking change. For the case where an app uses this new FirmwareUpdater together with an old bootloader, what it now does, is that it:

1. Writes the progress valid field to all zeros. This field is not known in the old bootloader, so it actually writes a "current progress" index.
2. The entire state partition is erased - effectively removing any trace of 1.
3. Set magic

This should be compatible.


Co-authored-by: Mathieu Dupont <mdupont@cppm.in2p3.fr>
Co-authored-by: Rasmus Melchior Jacobsen <rmja@laesoe.org>
2023-04-04 14:59:10 +00:00
803c09c300 Expose read/write/erase on partition 2023-04-04 12:50:53 +02:00
5e19fb6fb9 Fix compile error when verification is enabled 2023-04-04 12:36:50 +02:00
c38eb9660b Merge remote-tracking branch 'upstream/master' into avoid-write-before-erase 2023-04-04 12:29:24 +02:00
df3a1e1b9d Avoid write to not-erased magic
This introduces an additional marker to the state partition right after the magic which indicates whether the current progress is valid or not. Validation in tests that we never write without an erase is added.

There is currently a FIXME in the FirmwareUpdater. Let me know if we should take the erase value as a parameter. I opened a feature request in embedded-storage to get this value in the trait. Before this, the assumption about ERASE_VALUE=0xFF was the same.
2023-04-04 07:18:29 +02:00
7c11d85e1e Move MemFlash to separate module and add verify_erased_before_write verification 2023-04-03 15:33:20 +02:00
b1e2195b49 Remove FirmwareWriter
FirmwareWriter currently has a "max-write-size" parameter, but this is a limitation that should be handled by chunking inside the NorFlash driver, and not "up here" in user code. In case that the driver (e.g. qspi driver) is unaware of any max-write limitations, one could simply add an intermediate NorFlash adapter providing the chunk'ing capability.
2023-04-03 14:50:41 +02:00
d9d6fd6d70 Add erase and wipe tests 2023-03-31 10:28:47 +02:00
42931b51f2 Let bootloader partition have read/write/erase operations
This change should not have any breaking changes.
2023-03-31 10:18:19 +02:00
373760a56b Split bootloader implementation into multiple files 2023-03-31 08:05:37 +02:00
b1bc034a7e Merge branch 'emb-storage-async-0p4' of https://github.com/Grus-BV/embassy into emb-storage-async-0p4 2023-03-07 23:35:56 +01:00
6bf8d090a1 Merge branch 'emb-storage-async-0p4' of https://github.com/Grus-BV/embassy into emb-storage-async-0p4 2023-03-07 23:21:19 +01:00
935633c90b Merge upstream 2023-03-07 23:16:54 +01:00
bc0cb43307 Bump embedded-storage-async to 0.4 2023-03-06 22:16:36 +01:00
b0529bc943 Support codesigning in the firmware updater
This commit provides a method to verify that firmware has been signed with a private key given its public key. The implementation uses ed25519-dalek as the signature verifier. An "ed25519" feature is required to enable the functionality. When disabled (the default), calling the firmware updater's verify method will return a failure.
2023-01-12 13:30:58 +11:00
89821846d7 fix: add required metadata for embassy-boot 2022-11-25 11:43:12 +01:00
0b2d6996e8 Fix ascii table in BootLoader doc comment
Signed-off-by: Daniel Bevenius <daniel.bevenius@gmail.com>
2022-10-29 15:16:09 +02:00
6fa74b0c02 make prepare_update async 2022-09-26 10:36:21 +02:00
b2a327a858 Add get_state helpers to allow self-testing before calling mark_booted 2022-09-26 06:53:40 +02:00
7f16b1cd23 Add blocking API to FirmwareUpdater, and allow for a split prepare/write api 2022-09-26 06:01:18 +02:00
897b72c872 Update Rust nightly.
Removes feature(generic_associated_types)
2022-09-22 16:38:14 +02:00
b418c0e4d6 Take into account size of revert index
Fixes a bug in the partition assertions that ensures that the state
page(s) have enough space for 2x active partition range.

Add unit test to verify that panic is observed.
2022-09-20 14:04:57 +02:00
d0fe654c82 Remove BootFlash borrow
Compiler will infer a different lifetime for BootFlash than for the
borrowed flash, which makes it require more type annotations than if it
was just owning the type. Since it doesn't really matter if it owns or
borrows in practical use, change it to own so that it simplifies usage.
2022-09-20 09:54:37 +02:00
3aa0c13ba5 Fix a few clippy warnings 2022-09-02 08:42:42 +02:00
3ca7314476 Remove generic const expressions from embassy-boot
* Remove the need for generic const expressions and use buffers provided in the flash config.
* Extend embedded-storage traits to simplify generics.
* Document all public APIs
* Add toplevel README
* Expose AlignedBuffer type for convenience.
* Update examples
2022-09-02 08:25:36 +02:00
3dc26bbe39 simplify set_magic 2022-06-30 14:56:40 +02:00
a8703b7598 Run rustfmt. 2022-06-12 22:22:31 +02:00
bd237a1f96 Allow using separate page sizes for state and dfu
* Less generics on bootloader. Keep PAGE_SIZE as a common multiple of
DFU and ACTIVE page sizes.
* Document restriction
* Add unit tests for different page sizes
2022-04-28 10:38:25 +02:00
da61611f8f Add bootloader to CI 2022-04-27 15:17:18 +02:00
484e0acc63 Add stm32 flash + bootloader support
* Add flash drivers for L0, L1, L4, WB and WL. Not tested for WB, but
should be similar to WL.
* Add embassy-boot-stm32 for bootloading on STM32.
* Add flash examples and bootloader examples
* Update stm32-data
2022-04-27 15:17:18 +02:00
2afff617f6 Support multiple flash instances in embassy-boot
* Add FlashProvider and FlashConfig traits to define flash
characteristics
* Use traits in bootloader to retrieve flash handles and for
copying data between flash instances
* Add convenience implementations for using a single flash instance.
2022-04-19 20:07:06 +02:00
b0a53610ba Avoid writing bootloader flash if not needed 2022-03-31 15:23:06 +02:00
73012ed40e Fix potential unaligned write
Reduce log level
2022-03-22 14:43:17 +01:00
ed2a87a262 Add embassy-boot
Embassy-boot is a simple bootloader that works together with an
application to provide firmware update capabilities with a minimal risk.

The bootloader consists of a platform-independent part, which implements
the swap algorithm, and a platform-dependent part (currently only for
nRF) that provides addition functionality such as watchdog timers
softdevice support.
2022-02-09 10:50:29 +01:00