Over-the-air Updates

The N6OTA library installs a new application image into the inactive one of two flash slots, reboots into it on trial, and reverts automatically if the new image does not confirm itself. The application never writes flash; it stages the image in PSRAM and the bootloader performs the write. The mechanism requires bootloader version 2.1.0 or later.

#Sequence

#include <N6OTA.h>
#include <n6_ota_http.h>
#include <MayaW476.h>

#define FW_VERSION 1

void checkForUpdate() {
  n6_ota_manifest_t m;
  if (n6_ota_http_manifest(HOST, PORT, "/firmware/manifest.txt", &m) != N6_OTA_HTTP_OK) return;
  if (m.version <= FW_VERSION) return;

  if (n6_ota_http_stage(HOST, PORT, &m, on_progress) == N6_OTA_HTTP_OK) {
    n6_ota_apply();                 // resets; the bootloader installs the image
  }
}

void setup() {
  n6_ota_confirm();                 // this build works; make it permanent
}

1. The sketch fetches a manifest from a web server and compares its version to its own.
2. If newer, the sketch downloads the _Trusted.bin into PSRAM with a CRC check.
3. n6_ota_apply() marks the staged image pending and resets.
4. The bootloader writes the image to the inactive slot, verifies it, and boots it on trial with a bounded number of attempts.
5. The new image calls n6_ota_confirm() once it has demonstrated that it works. An image that never confirms is reverted.

A power loss at any point leaves either the old image or the new one intact.

#Server

The server holds two static files: a key=value manifest naming the version, size, CRC32 and path of the image, and the _Trusted.bin from the build. Any web server serving a directory suffices for testing.

#Transport independence

n6_ota_begin(size, version), n6_ota_write(data, len) and n6_ota_end(crc32) accept image bytes from any source. n6_ota_http.h is an optional helper for HTTP over the WiFi library. LTE or bytes from a USB host can feed the same three calls.

#State

n6_ota_get_state() reports the running slot, whether the running image is on trial, whether an image is staged in PSRAM, and the result of the last bootloader apply. The bootloader cannot print, so it leaves four CRC values in backup registers: the CRC the header claimed, the CRC it read from PSRAM twice, and the CRC it read back from flash. These distinguish a corrupt download from a bad flash write. n6_ota_fsbl_supported() reports whether the installed bootloader supports the mechanism.

#Example

The OtaOverWiFi example, under File > Examples > N6OTA, joins a network and checks a manifest on a timer. Typing s, c or a on the serial console prints the state, checks for an update, or applies a staged one. The OtaSelfStage example exercises the slot mechanism without a network.

#Security

Images are integrity checked by CRC and are not cryptographically signed. Any host that can answer as the update server can install firmware on the board. The mechanism is suitable for development on a trusted network and is not suitable for deployment as shipped. This limitation is recorded in the core's SECURITY.md.

#Confirmation

n6_ota_confirm() should be called only after the new image has verified that it functions, not unconditionally at the start of setup(). An image that boots and immediately fails must not be able to confirm itself.