From 175dd50ba2a2a6c8d033a9fd4e91f4823f9e210a Mon Sep 17 00:00:00 2001 From: Luke Hoersten Date: Sat, 20 Jun 2026 13:03:23 -0500 Subject: firmware: OTA firmware updates via POST /firmware + rollback Streams the raw .bin to the inactive ota_0/ota_1 slot via esp_ota_*, flips otadata, replies 200, reboots after 500 ms. Single-shot guarded by atomic_flag (409 on concurrent). CONFIG_BOOTLOADER_APP_ROLLBACK_ENABLE armed: new images boot pending-verify and ota_arm_healthy_timer marks them valid after 30 s of healthy uptime; otherwise the bootloader reverts on next reset. /state gains ota_state. --- main/ota.h | 14 ++++++++++++++ 1 file changed, 14 insertions(+) create mode 100644 main/ota.h (limited to 'main/ota.h') diff --git a/main/ota.h b/main/ota.h new file mode 100644 index 0000000..a6f7c9b --- /dev/null +++ b/main/ota.h @@ -0,0 +1,14 @@ +#pragma once + +#include "esp_err.h" + +// Arms a 30 s one-shot timer; on fire, if the running image is in +// PENDING_VERIFY, calls esp_ota_mark_app_valid_cancel_rollback() so the +// bootloader stops considering this image revertible. Safe to call when +// rollback is disabled or when the image is already marked valid — both +// are no-ops. Call once from app_main after http_api_start. +void ota_arm_healthy_timer(void); + +// Returns a short tag for the running image's OTA state, suitable for +// /state JSON. Never NULL. +const char *ota_running_state_str(void); -- cgit v1.2.3