updatemgr: Automatic External Firmware Update & Ownership Transfer - #362
Merged
Conversation
anthonychen1251
force-pushed
the
external-flash-fw-update-transport-with-dedicated-programmer
branch
8 times, most recently
from
July 27, 2026 18:05
1d71ccc to
dbc9bbb
Compare
anthonychen1251
force-pushed
the
external-flash-fw-update-transport-with-dedicated-programmer
branch
2 times, most recently
from
July 27, 2026 20:53
a92bab5 to
b356271
Compare
cfrantz
reviewed
Jul 27, 2026
anthonychen1251
force-pushed
the
external-flash-fw-update-transport-with-dedicated-programmer
branch
2 times, most recently
from
July 28, 2026 00:40
a25fdc3 to
53c7196
Compare
cfrantz
reviewed
Jul 28, 2026
anthonychen1251
force-pushed
the
external-flash-fw-update-transport-with-dedicated-programmer
branch
2 times, most recently
from
July 28, 2026 16:53
e38259f to
32d3c69
Compare
anthonychen1251
marked this pull request as draft
July 28, 2026 17:21
anthonychen1251
force-pushed
the
external-flash-fw-update-transport-with-dedicated-programmer
branch
2 times, most recently
from
July 28, 2026 18:45
04d6103 to
8436df1
Compare
anthonychen1251
marked this pull request as ready for review
July 28, 2026 18:47
Author
|
Rebased and added a new commit for enhancing the |
cfrantz
approved these changes
Jul 28, 2026
Collaborator
I think you'll need to rebase and resolve conflicts one more time before you can submit. |
Move the DFU/A-B staging slot tracking helper `FwUpdate` from `target/earlgrey/util/dfu.rs` to a standalone library target `target/earlgrey/util/fw_update.rs`. This decouples the firmware slot tracking logic from specific sysmgr updater server implementations, allowing it to be reused directly by other userspace processes (such as the new `updatemgr` transport process). Signed-off-by: Anthony Chen <antchen@google.com>
Introduce the new `updatemgr` process under `target/earlgrey/firmware/transport/updatemgr.rs` to handle external firmware update scanning. - Implement the external firmware bundle scanner (`scan_firmware_bundle` and `try_read_bundle_at`) in `util/fw_update.rs`. - Fixed 64KiB outer step size for scanning external flash. - Support standalone Application manifests at 64KiB-aligned offsets without requiring a ROM_EXT image. - Accept ROM_EXT sizes up to 128KiB (allowing ROM_EXT size upgrades). - Dynamically start Application scanning at max(rom_ext_len, 64KiB) aligned to 8KiB step boundaries up to 128KiB. Signed-off-by: Anthony Chen <antchen@google.com>
Implement EFLASH page-by-page erasing and programming logic (`flash_write_partition`) in `updatemgr.rs` to flash valid ROM_EXT and APPLICATION images from the external flash reader. Signed-off-by: Anthony Chen <antchen@google.com>
Implement `flash_owner_block` helper in `updatemgr.rs` to write the scanned Owner Block to Owner Info Page 1. Signed-off-by: Anthony Chen <antchen@google.com>
…I flash tests In the transport_firmware, `updatemgr` continuously scans the external SPI flash for updates while `usbmgr` handles USB DFU read/write requests . Operating both processes concurrently can cause interference and race conditions on the external flash. To isolate DFU SPI EEPROM operations during testing, add a dedicated `eeprom_programmer_firmware` target that runs a subset of transport processes without `updatemgr`. Signed-off-by: Anthony Chen <antchen@google.com>
…ore DFU tests Set the default target in DFU owner transfer and firmware update tests to `eeprom_programmer_firmware` to invalidate external EEPROM0 prior to running the test payload. Signed-off-by: Anthony Chen <antchen@google.com>
Add end-to-end tests for `updatemgr` covering both ownership transfer
and pure firmware update scenarios via external SPI flash.
The full end-to-end update flow:
1. Initial Setup: Target starts up running `eeprom_programmer_firmware`
2. Flash External EEPROM0: Host uses DFU Alt 4 (`DFU_ALT_SPI_EEPROM0`)
exposed by the programmer firmware to flash the update payload
(`ROM_EXT` + app) into external flash.
- Non-standalone mode: Assembles ROM_EXT at offset 0 and Application
at `manifest_base_address`.
- Standalone mode: Flashes only the Application image at offset 0.
3. Bootstrap Transport FW: Host boostraps the device with the
`transport_firmware`.
4. Telemetry Verification: `transport_firmware` boots up, detects the
payload on external EEPROM0, processes owner transfer / firmware
update, and outputs success telemetry over UART.
Signed-off-by: Anthony Chen <antchen@google.com>
To thoroughly verify firmware update behavior under different active slot conditions, enhance `host_eeprom_owner_transfer` host test harness and Bazel target generator to support assembling and bootstrapping `transport_firmware` with all 4 slot combinations for ROM_EXT and Application (AA, AB, BA, BB). Signed-off-by: Anthony Chen <antchen@google.com>
anthonychen1251
force-pushed
the
external-flash-fw-update-transport-with-dedicated-programmer
branch
from
July 28, 2026 20:22
8436df1 to
6bde982
Compare
Author
Done |
anthonychen1251
deleted the
external-flash-fw-update-transport-with-dedicated-programmer
branch
July 29, 2026 00:06
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR introduces the
updatemgrservice, enabling automatic background scanning of external SPI flash for new firmware images (ROM_EXT + APPLICATION) and Owner Transfer Blobs (OWTB), page-by-page internal eflash programming, owner page reprogramming, a dedicated eeprom_programmer firmware target, and end-to-end integration tests.Note: this depends on #347 and #361 Only review the last 8 commits.