Skip to content
Eliott65Sondewiki
Contents

Updates over the network

Changing firmware meant unplugging the Pico W and holding the BOOTSEL button. The wiring moved every time. Now the probe updates itself over the network, and recovers on its own if things go wrong.

On this page

Why

To compare two versions of the SWD, the Pico W had to be reflashed in BOOTSEL, so unplugged: the wiring moved, and the board was even switched off between two measurements. It was no longer just the firmware being compared. Hence the update over the network (OTA), in v0.5, then the boot loader, in v0.6.

Sending and checking

The e65s.py tool reads the firmware’s UF2 file and sends it on port 4442, in pieces, in order. The probe writes it into a reserve area of the flash, sector by sector, and reads back each sector. At the end, it reads the whole image back from flash and checks its CRC-32 and its vector table. A truncated or corrupted image, or one made for another microcontroller, is refused before touching the firmware in place.

The boot loader

The probe's flash layoutThe Pico W's 2 MiB of flash, since version 0.6.0. At the start, the 32 KiB boot loader, never updated over the network. Then the application, 504 KiB at most, at 0x008000. The reserve, at 0x100000, receives a new firmware; the backup, at 0x180000, keeps the old one. The last two sectors, at 0x1FE000 and 0x1FF000, hold the update state, written alternately.Pico W flash: 2 MiB0x000000boot loader, 32 KiBdecides at start-up; never updated over the network0x008000applicationthe probe's firmware, 504 KiB at most0x100000reservereceives the new firmware, checked before use0x180000backupcopy of the old firmware, to go back0x1FE000statetwo sectors written alternately, with a sequence numberA power cut at any moment is caught up at the next start-up.(not to scale)
The flash layout since v0.6.0: the boot loader at the start, the application, the reserve, the backup and two state sectors.

An image cannot decide on its own replacement: that choice must come from code that runs before it and that the update never touches. That is the boot loader, 32 KiB at the start of the flash (9 KiB used).

An update, seen by the boot loaderThe received firmware moves to the “to install” state; at start-up, the boot loader checks it and copies it over the application, which starts “on trial”. If the PC validates it within 2 minutes, it stays. After 3 start-ups without validation, the boot loader puts the backup back: the “restored” state. The watchdog stops an application that hangs.OTA receivedimage checkedto installreserve checkedon trial3 start-ups at mostvalidatedthe new one staysapplycopyvalidationrestoredthe old one is back3 trials without validationValidation: the PC must reach the probe within 2 minutes; 8 s watchdog.
An update, from reception to validation, or to the return to the old firmware.
  1. Apply: the application copies the firmware in place into the backup, writes the “to install” state, then restarts. It never erases its own code.
  2. Install: at start-up, the boot loader checks the reserve, copies it over the application, checks the result and moves to “on trial”.
  3. On trial: the boot loader counts a trial, arms the watchdog (8 s) and starts the application. It must be validated by the PC within 2 minutes; e65s.py does so as soon as the probe is back on the network.
  4. Going back: after 3 start-ups without validation, the boot loader puts the backup back. The probe returns to the old firmware, “restored” state.

On the probe

  • An update takes 18 s end to end; several in a row succeeded.
  • A broken image (looping from start-up) was started 3 times, stopped each time by the watchdog, then replaced by the old one: the probe came back on its own, in 52 s.
  • Not yet tried on the Pico W: an image that starts but is never validated (3 times 2 minutes). The case is covered by the benches on the PC.

The limits

  • The boot loader itself can only be updated through BOOTSEL.
  • Validation only proves the connection: an image that answers on the network but whose SWD is broken stays in place.
  • There is no authentication: anyone on the local network can flash the probe.

Sources in the repository : docs/adr/ADR-0004-mise-a-jour-par-le-reseau.md, docs/adr/ADR-0005-amorce-et-retour-arriere.md, docs/journal/05-mise-a-jour-par-le-reseau.md, docs/journal/07-amorce.md.