Mirrors/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2026-09-22 13:01:16 +03:00
Code Issues Packages Projects Releases Wiki Activity

feat(app_update): Add auto-confirmation of OTA updates

Browse Source 
Enable rollback auto-confirmation by default
This commit is contained in:
Konstantin Kondrashov
2026-07-08 20:25:05 +03:00
committed by Konstantin Kondrashov
parent dce5812654
commit de1e5035b5
27 changed files with 351 additions and 70 deletions
Download Patch File Download Diff File Expand all files Collapse all files

53
components/bootloader/Kconfig.app_rollback
View File

@@ -1,20 +1,51 @@
menu "Application Rollback"
config BOOTLOADER_APP_ROLLBACK_ENABLE
bool "Enable app rollback support"
default n
config BOOTLOADER_APP_ROLLBACK
bool "Enable application rollback"
default y
help
After updating the app, the bootloader runs a new app with the "ESP_OTA_IMG_PENDING_VERIFY" state set.
This state prevents the re-run of this app. After the first boot of the new app in the user code, the
function should be called to confirm the operability of the app or vice versa about its non-operability.
If the app is working, then it is marked as valid. Otherwise, it is marked as not valid and rolls back to
the previous working app. A reboot is performed, and the app is booted before the software update.
Note: If during the first boot a new app the power goes out or the WDT works, then roll back will happen.
Rollback is possible only between the apps with the same security versions.
After an OTA update, the bootloader starts the new application in the
ESP_OTA_IMG_PENDING_VERIFY state. If the application resets, crashes, or
loses power before being confirmed valid, the bootloader marks it as
aborted on the next boot and selects the previously working application
instead.
Disabling this option removes the automatic recovery path after a
failed OTA update: a failed update can leave the device with an
unbootable application.
choice BOOTLOADER_APP_ROLLBACK_CONFIRM_MODE
prompt "Rollback confirmation checkpoint"
depends on BOOTLOADER_APP_ROLLBACK
default BOOTLOADER_APP_ROLLBACK_CONFIRM_ON_STARTUP
config BOOTLOADER_APP_ROLLBACK_CONFIRM_ON_STARTUP
bool "Confirm app automatically during system startup"
help
The application is marked valid near the end of system startup,
immediately before app_main is called. Reaching app_main is treated
as a successful boot; this confirms IDF startup completed but does
not verify application-specific functionality.
Since the state is already ESP_OTA_IMG_VALID by the time app_main
runs, application code cannot use esp_ota_get_state_partition() to
detect the first boot of a new application.
config BOOTLOADER_APP_ROLLBACK_CONFIRM_BY_APP
bool "Application decides the confirmation checkpoint"
help
The application must confirm itself valid during its first boot by
calling esp_ota_mark_app_valid_cancel_rollback(), or reject the
update with esp_ota_mark_app_invalid_rollback_and_reboot(). If
neither is called before a reset, the bootloader marks the app as
aborted and rolls back to the previous working application.
Rollback is possible only between apps with the same security version.
endchoice
config BOOTLOADER_APP_ANTI_ROLLBACK
bool "Enable app anti-rollback support"
depends on BOOTLOADER_APP_ROLLBACK_ENABLE
depends on BOOTLOADER_APP_ROLLBACK_CONFIRM_BY_APP
default n
help
This option prevents rollback to previous firmware/application image with lower security version.

3
components/bootloader/sdkconfig.rename
View File

@@ -9,7 +9,8 @@ CONFIG_LOG_BOOTLOADER_LEVEL_INFO CONFIG_BOOTLOADER_LO
CONFIG_LOG_BOOTLOADER_LEVEL_DEBUG CONFIG_BOOTLOADER_LOG_LEVEL_DEBUG
CONFIG_LOG_BOOTLOADER_LEVEL_VERBOSE CONFIG_BOOTLOADER_LOG_LEVEL_VERBOSE
CONFIG_APP_ROLLBACK_ENABLE CONFIG_BOOTLOADER_APP_ROLLBACK_ENABLE
CONFIG_APP_ROLLBACK_ENABLE CONFIG_BOOTLOADER_APP_ROLLBACK_CONFIRM_BY_APP
CONFIG_BOOTLOADER_APP_ROLLBACK_ENABLE CONFIG_BOOTLOADER_APP_ROLLBACK_CONFIRM_BY_APP
CONFIG_APP_ANTI_ROLLBACK CONFIG_BOOTLOADER_APP_ANTI_ROLLBACK
CONFIG_APP_SECURE_VERSION CONFIG_BOOTLOADER_APP_SECURE_VERSION
CONFIG_APP_SECURE_VERSION_SIZE_EFUSE_FIELD CONFIG_BOOTLOADER_APP_SEC_VER_SIZE_EFUSE_FIELD