In embedded system firmware update for active image requires additional process to accomplish it. To save the cost and maximize the usage of non-volatile memory, the content of flash is not fully loaded into RAM, instead is used at runtime, so called MTD (Memory Technology Device) in Linux. Since MTD is in use and supposedly not to be changed arbitrarily unless disconnected from all tasks and not accessible further.
Here comes an example which BMC updates the active image itself under Linux console with AMI based firmware.
Copy Firmware to Target
wget <URL>/<firmware> -P /tmp # under BMC console in this case
Any methods which can copy file to target, says ftp, sftp, tftp, scp, rsync, ssh, nc, native or cloud files sharing.
Commands under Target Console
Ensure root privilege (option)
id
uid=0(root) gid=0(sysadmin) groups=0(sysadmin)
Identify firmware active image number (option)
method 1 (The booted image number is at the end of output line)
cat /proc/cmdline
root=/dev/mtdblock3 ro ip=none mem=496M console=ttyS4,115200 rootfstype=cramfs bigphysarea=8192 bootlogo=2b80040 imagebooted=1
method 2 (AMI IPMI OEM command to read the active image number)
ipmitool -H 127.0.0.1 -U admin -P admin raw 0x32 0x8f 7
1
Stop tasks which may interfere process as possible (not required for inactive image)
for i in ad av c d ext fl hd ipm l mc pa procp redf redisr rm rs sy ti ua up vm; do
for j in /etc/init.d/$i*; do [ -e $j ] && $j stop; done
done
killall udhcpc dhcp6c
Ignore tasks which are protected and can't be stopped, see if everything OK or not.
Build root filesystem in RAM and switch to it (not required for inactive image)
mkdir -p /tmp/rootfs/usr
cd /tmp/rootfs
cp -a /bin /sbin /lib /tmp .
cp -a /usr/bin /usr/sbin /usr/lib /usr/local usr
for i in dev sys var proc etc run; do mkdir -p $i; mount --rbind /$i $i; done
chroot /tmp/rootfs /bin/bash
Update firmware through MTD interface (tools may be diffrent on other platforms)
method 1 (flash_erase + dd)
flash_erase /dev/mtd0 0 1024 # 64KB/block, 1024*64KB=64MB, quicker than mtd_debug
dd if=/tmp/<firmware> of=/dev/mtd0 bs=1M seek=0
method 2 (mtd_debug)
f=/tmp/<firmware>
mtd_debug erase /dev/mtd0 0 0x4000000 # 3~5 mins or even longer, platform dependent
mtd_debug write /dev/mtd0 0 `stat -c%s $f` $f
In this case of 64MB firmware image size, 0x0000000 is the 1st image offset and 0x4000000 is the 2nd image offset.
Reboot
reboot # shutdown -rfn now
Booting from which image is determined by boot policy.
AMI IPMI OEM command can specify booting image number, example for image number 1: raw 0x32 0x8f 1 1.
