Don't go through runtime initializers when there is no OTA command (earlephilhower#2697)

Leave that to the main app instead, so we don't reset peripherals twice.
* ota: fix copy error for riscv headers
* ota: initialize bootrom bit ops and add explanation

Author: afflux

.gitignore

@@ -3,5 +3,7 @@ system
 tools/dist
 docs/_build
 ota/build
+ota/build-rp2350
+ota/build-rp2350-riscv
 tools/libpico/build
 platform.local.txt

lib/rp2040/ota.o

@@ -63,6 +63,8 @@ target_compile_definitions(ota PUBLIC
         PICO_RP2040_B2_SUPPORTED=1
         PICO_PRINTF_SUPPORT_FLOAT=0
         PICO_PRINTF_SUPPORT_LONG_LONG=0
+        PICO_RUNTIME_INIT_AEABI_BIT_OPS=00090
+        PICO_RUNTIME_INIT_AEABI_MEM_OPS=00091
         LIB_PICO_PRINTF_NONE=1
         LFS_READONLY=1
         LFS_NO_DEBUG=1
@@ -112,5 +114,12 @@ target_link_libraries(ota
 add_custom_command(TARGET ota POST_BUILD
         COMMAND ../../system/${TUPLE}/bin/${TUPLE}-ld -r -A ${OBJARCH} -b binary -o ota.o ota.bin
         COMMAND ../../system/${TUPLE}/bin/${TUPLE}-objcopy --rename-section .data=.OTA ota.o ../../lib/${cpu}/ota.o
-        COMMAND cp ../ota_command.h ../../include/${cpu}/pico_base/pico/.
 )
+
+if(NOT ${cpu} MATCHES "rp2350-riscv$")
+        # riscv build uses the same include directories in lib/rp2350-riscv/platform_inc.txt
+        # so we don't copy in that case
+        add_custom_command(TARGET ota POST_BUILD
+                COMMAND cp ../ota_command.h ../../include/${cpu}/pico_base/pico/.
+        )
+endif()

lib/rp2350-riscv/ota.o

@@ -24,6 +24,7 @@
 #include <hardware/sync.h>
 #include <hardware/flash.h>
 #include <pico/time.h>
+#include <pico/runtime_init.h>
 #include <hardware/gpio.h>
 #include <hardware/uart.h>
 #include <hardware/watchdog.h>
@@ -54,26 +55,33 @@ void dumphex(uint32_t x) {
 }
 
 extern OTACmdPage _ota_cmd;
-void do_ota() {
+static uint32_t blockToErase;
+
+
+bool has_ota() {
     if (*__FS_START__ == *__FS_END__) {
-        return;
+        return false;
     }
     if (!lfsMount(*__FS_START__, 4096, *__FS_END__ - *__FS_START__)) {
-        uart_puts(uart0, "mount failed\n");
-        return;
+        return false;
     }
 
     // We are very naughty and record the last block read, since it should be the actual data block of the
     // OTA structure.  We'll erase it behind the scenes to avoid bringing in all of LittleFS write infra.
-    uint32_t blockToErase;
     if (!lfsReadOTA(&_ota_cmd, &blockToErase)) {
-        return;
+        return false;
     }
 
     if (memcmp(_ota_cmd.sign, "Pico OTA", 8)) {
-        return; // No signature
+        return false; // No signature
     }
 
+    return true;
+}
+
+
+
+void do_ota() {
     uint32_t crc = 0xffffffff;
     const uint8_t *data = (const uint8_t *)&_ota_cmd;
     for (uint32_t i = 0; i < offsetof(OTACmdPage, crc32); i++) {
@@ -159,31 +167,18 @@ void do_ota() {
 
     // Do a hard reset just in case the start up sequence is not the same
     watchdog_reboot(0, 0, 100);
+    while (true) {
+        tight_loop_contents();
+    }
 }
 
-
 #pragma GCC push_options
 #pragma GCC optimize("O0")
-int main(int a, char **b) {
-    (void) a;
-    (void) b;
-
-#ifdef DEBUG
-    uart_init(uart0, 115200);
-    gpio_set_function(0, GPIO_FUNC_UART);
-    gpio_set_function(1, GPIO_FUNC_UART);
-    uart_set_hw_flow(uart0, false, false);
-    uart_set_format(uart0, 8, 1, UART_PARITY_NONE);
-#endif
-
-    do_ota();
-
+__attribute__((noreturn))
+void boot_normal() {
 #ifdef __riscv
     extern void __mainapp();
     __mainapp();
-
-    // Should never get here!
-    return 0;
 #else
     // Reset the interrupt/etc. vectors to the real app.  Will be copied to RAM in app's runtime_init
     scb_hw->vtor = (uint32_t)0x10003000;
@@ -194,10 +189,43 @@ int main(int a, char **b) {
     register void (*fcn)(void) = (void (*)(void)) *(uint32_t *)0x10003004;
     sp = (uint32_t *)_sp;
     fcn();
+    (void)sp;
+#endif
+
+    __builtin_unreachable();
+}
+
+void check_ota() {
+    // this runs before the full runtime and hardware is initialized to prevent
+    // initialization happening again in the application. Care must be taken that
+    // no uninitialized peripheral or part of the runtime is used.
+    // If necessary, init routines can be moved before check_ota() by adjusting
+    // their PICO_RUNTIME_INIT_* in CMakeLists.txt.
+    // refer to this source for existing init routines:
+    // https://github.com/raspberrypi/pico-sdk/blob/2.1.0/src/rp2_common/pico_runtime_init/include/pico/runtime_init.h
+    if (!has_ota()) {
+        boot_normal();
+    }
+}
+PICO_RUNTIME_INIT_FUNC_RUNTIME(check_ota, "00099");
+
+int main(int a, char **b) {
+    (void) a;
+    (void) b;
 
-    // Should never get here!
-    return *sp;
+#ifdef DEBUG
+    uart_init(uart0, 115200);
+    gpio_set_function(0, GPIO_FUNC_UART);
+    gpio_set_function(1, GPIO_FUNC_UART);
+    uart_set_hw_flow(uart0, false, false);
+    uart_set_format(uart0, 8, 1, UART_PARITY_NONE);
 #endif
+
+    // if we arrive here, it looks like we have an OTA command in the LittleFS
+    do_ota();
+
+    // fallback to normal boot if do_ota() failed, e.g. due to CRC failure or corruption
+    boot_normal();
 }
 #pragma GCC pop_options