This device supports
Firmware-Over-The-Air (FOTA) updates using a Flash bank-swapping mechanism. The FOTA
process is managed and controlled using the Flash Controller BANKMAP register and
the BANKMGMT sector in each bank. Figure 10-5 shows an example of how banks are swapped.
When bank swap is active, all sectors
of a Flash bank are swapped, including the SECCFG and BANKMGMT sectors.
The FOTA concept is designed to enable
programming of inactive Flash banks while the application continues to run from the
active banks without interruption. The update process is comprised of the following
steps:
- Image Creation and
Deployment: The user creates an application update image. This image can
be transferred into the device using a Flash kernel, over a communications
interface such as CAN or UART. The update image is typically delivered in
chunks, since the RAM available is not large enough to hold an entire Flash
image. For security, the update image can be authenticated using cryptographic
methods such as a digital signature algorithm.
- Installation Phase: The
Flash kernel downloads Flash chunks, authenticates them, and programs them into
the Flash update region (FRI-3). This phase consists of three steps:
- Erase the inactive banks
by addressing the update region with a Flash erase command.
- Download,
authenticate/decrypt and program updated firmware into the Flash update
region.
- Issue Flash API command
to update BANKMGMT sector of inactive banks to be active and newer than
the currently active banks. The Flash API commands are executed in the
following order:
- (CPU1 only)
Program inactive bank's BANKMODE to the expected/new BANKMODE
value. Note that changing the BANKMODE during a firmware update
is possible.
- Program the
inactive bank's BANK_UPDATE_CTR to be one less than the active
bank's BANK_UPDATE_CTR.
- Program the
inactive bank's BANK_STATUS to 0x55555555_55555555.
- Activation Phase: The
update manager waits for the application to reach a safe state (or brings the
application to a safe state), then issues a full device reset (XRSn). A reset
can be issued by software running in LINK2 by writing to the
DEV_CFG_REGS.SIMRESET register. During device startup, the boot ROM reevaluates
the BANKMGMT sectors, and configures BANKMAP to reflect the new update. After a
timeout period, the FOTA manager requests the active firmware revision from the
device. If the expected new version is not returned, the FOTA manager re-issues
the update command, since the update has not completed successfully.
- (Optional) Rollback: If desired, the user can return to the most recent
(currently inactive) application firmware version. The rollback service erases
and reprograms the current inactive BANKMGMT sector to be active and have a
newer update counter value than the current active sector. This allows a
rollback to the previous firmware version without having to re-download from an
external interface. The rollback steps are executed in the following order:
- Authenticate the code in
the inactive bank to confirm the code's validity and integrity.
- Erase the inactive bank's
BANKMGMT sector.
- (CPU1 only) Program
inactive bank's BANKMODE to the correct BANKMODE value.
- Program the inactive
bank's BANK_UPDATE_CTR to one less than the active bank's
BANK_UPDATE_CTR.
- Program the inactive
bank's BANK_STATUS to 0x55555555_55555555.
- After bringing the
application to a safe state, issue a device XRSn reset to activate the
old firmware image.
- (Optional) Anti-Rollback:
To prevent any possibility of a rollback to the previous firmware version,
invalidate the old firmware image completely by erasing the inactive bank's MAIN
sectors.