updatemgr: Automatic External Firmware Update & Ownership Transfer#362
Open
anthonychen1251 wants to merge 14 commits into
Conversation
Key modifications and fixes made during the port:
- Makes the driver explicitly enter "Global 4-byte" mode when flash size
>= 16 MB, which includes:
* Update the command config in `from_sfdp()` &
`from_sfdp_conservative()`.
* Explicitly enters the global 4-byte mode at the end of
initialization.
- Skips the support of DUAL / QUAD in `SpiTxnWidth`. Also, inits the
driver with non-conservative version for now.
- Moves `transfer_req_resp` from legacy SPI Host driver to SPI Flash
driver, as a helper method.
- Moves `check_valid_size` from legacy Flash trait to SPI Flash
driver, as a helper method.
- Adds `is_busy` helper method as what we did for `BlockingFlash` trait,
although we didn't implement this trait directly now.
- Wraps legacy `page_size` and `size` into a `geometry` method required
by `Flash` trait. Currently we hard-coded the erasable bitmap as 4KB
and 64KB, and we may parse them in the future.
- For `erase()` method, the `Flash` trait only accepts the size declared
in the erasable bitmap, but here we uses the legacy implementation
which will loop over the size to erase. However, we still only accepts
power of 2 as the erase size due to `Flash` trait's contract. Also
removes the original `erase_page()` method.
- Drops `FlashStreamingRead` support (as we mentioned in SPI Host
driver commit).
Mock SPI Device & Unit Test Refactoring:
- Ports the legacy `FakeSpiHost` to OpenPRoT, renaming it to `FakeSpiDevice`
under `drivers/mock/spi_device_fake.rs` and implementing standard
`embedded_hal::spi::SpiDevice` and `ErrorType` traits.
- Rewrites mock transmission logic to be stateless by removing `TxnState`,
supporting multi-buffer transaction execution and automatic TX/RX clock
log alignment and padding.
- Introduces `assert_all_expectations_met()` to strictly assert that all
preprogrammed SPI responses are executed, preventing silent test leaks.
- Adapts unit tests to new `PowerOf2Usize` API constraints:
* Erase lengths in mixed granularity and multiple page tests are changed
to powers of 2 (e.g., 144KB -> 128KB, 12KB -> 16KB).
* Obsolete `test_erase_zero_length` is removed as zero-length input is
prevented at compile time.
- Aligns mock expectations with Global 4-byte address mode: expected
opcodes are updated from 4-byte-specific ones (e.g. `OP_READ4B`) to
standard opcodes (e.g. `OP_READ`) with 4-byte address streams.
- Removes obsolete unit tests for prefetch, FIFO draining, and
Streaming Read.
Signed-off-by: Chia-Wei Liu <lchiawei@google.com>
- Update system.json5 to split the original flash_service into eflash_service and a new spi_flash_service. - Map the spi_host0 memory region (0x40300000) into the flash_server process. - Implement a wait_group in flash_server.rs to handle incoming requests for both eflash_service and spi_flash_service. - Initialize the SPI Host and SPI Flash driver in flash_server.rs, logging errors using zfmt diagnostics. - Update usbmgr to connect to the renamed eflash_service and initialize the new spi_flash_usb initiator. - Add spi_flash and spi_host dependencies to the flash_server target in BUILD.bazel. Signed-off-by: Anthony Chen <antchen@google.com>
- Increase DFU alt settings to 6 and register Alt 5 interface in usbmgr. - Pass the external spi_flash client from usbmgr to EarlgreyDfuHandler. - Update dnload() in EarlgreyDfuHandler to query SPI flash geometry, align erase requests using driver page size, and program blocks to external SPI flash. - Update upload() to read chunks from external SPI flash. - Update manifest() to bypass manifestation reboot for Alt 5 download. Signed-off-by: Anthony Chen <antchen@google.com>
Only send ZLP in DfuClass::poll if the total transfer size is less than the DFU wTransferSize (2048 bytes), avoiding a redundant ZLP when returning a full block. Signed-off-by: Anthony Chen <antchen@google.com>
- Implement host_usb_dfu_spi_flash.rs to download a payload to Alt 5
(SPI EEPROM 0) and upload it back for verification.
- Add host_usb_dfu_spi_flash to target dependencies and define
dfu_spi_flash_hyper{310,340}_test target in BUILD.bazel.
Signed-off-by: Anthony Chen <antchen@google.com>
Move the DFU/A-B staging slot tracking helper `FwUpdate` from `target/earlgrey/util/dfu.rs` to a standalone library target `target/earlgrey/util/fw_update.rs`. This decouples the firmware slot tracking logic from specific sysmgr updater server implementations, allowing it to be reused directly by other userspace processes (such as the new `updatemgr` transport process). Signed-off-by: Anthony Chen <antchen@google.com>
Introduce the new `updatemgr` process under `target/earlgrey/firmware/transport/updatemgr.rs` to handle external firmware update scanning. - Implement the external firmware bundle scanner (`scan_firmware_bundle` and `try_read_bundle_at`) in `util/fw_update.rs` using the `RandomRead` trait to locate valid `ROM_EXT` and `APPLICATION` manifests on the external flash. - If any error occurs during the update attempt (such as dependencies not yet running, flash connection errors, or read/write timeouts), log the error status as `UpdateAttemptFailed`, sleep for one second, and retry. Signed-off-by: Anthony Chen <antchen@google.com>
Implement EFLASH page-by-page erasing and programming logic (`flash_write_partition`) in `updatemgr.rs` to flash valid ROM_EXT and APPLICATION images from the external flash reader. Signed-off-by: Anthony Chen <antchen@google.com>
Support scanning for the Owner Transfer Blob (OWTB) extension within the APPLICATION manifest on external SPI flash. - Add the `scan_owner_block` helper function in `updatemgr.rs` to scan for the `OWTB` extension header and return the start offset of the Owner block. - Define the `ManifestExtTableEntry` array structure in `util/manifest.rs` to correctly parse manifest extension headers. Signed-off-by: Anthony Chen <antchen@google.com>
Implement `flash_owner_block` helper in `updatemgr.rs` to write the scanned Owner Block to Owner Info Page 1. Signed-off-by: Anthony Chen <antchen@google.com>
…I flash tests In the transport_firmware, `updatemgr` continuously scans the external SPI flash for updates while `usbmgr` handles USB DFU read/write requests . Operating both processes concurrently can cause interference and race conditions on the external flash. To isolate DFU SPI EEPROM operations during testing, add a dedicated `eeprom_programmer_firmware` target that runs a subset of transport processes without `updatemgr`. Signed-off-by: Anthony Chen <antchen@google.com>
…ore DFU tests Set the default target in DFU owner transfer and firmware update tests to `eeprom_programmer_firmware` to invalidate external EEPROM0 prior to running the test payload. Signed-off-by: Anthony Chen <antchen@google.com>
Add end-to-end tests for `updatemgr` covering both ownership transfer and pure firmware update scenarios via external SPI flash. The full end-to-end update flow: 1. Initial Setup: Target starts up running `eeprom_programmer_firmware` 2. Flash External EEPROM0: Host uses DFU Alt 5 (`DFU_ALT_SPI_EEPROM0`) exposed by the programmer firmware to flash the update payload (`ROM_EXT` + app) into external flash. 3. Update Internal Firmware: Host switches to DFU Alt 0 (`DFU_ALT_FIRMWARE`) and downloads signed `transport_firmware` into internal eflash, triggering manifestation and reboot. 4. Telemetry Verification: `transport_firmware` boots up, detects the payload on external EEPROM0, processes owner transfer / firmware update, and outputs success telemetry over UART. Signed-off-by: Anthony Chen <antchen@google.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR introduces the
updatemgrservice, enabling automatic background scanning of external SPI flash for new firmware images (ROM_EXT + APPLICATION) and Owner Transfer Blobs (OWTB), page-by-page internal eflash programming, owner page reprogramming, a dedicated eeprom_programmer firmware target, and end-to-end integration tests.Note: this depends on #347 and #361 Only review the last 8 commits.