[FL-2263] Flasher service & RAM exec (#1006)

* WIP on stripping fw
* Compact FW build - use RAM_EXEC=1 COMPACT=1 DEBUG=0
* Fixed uninitialized storage struct; small fixes to compact fw
* Flasher srv w/mocked flash ops
* Fixed typos & accomodated FFF changes
* Alternative fw startup branch
* Working load & jmp to RAM fw
* +manifest processing for stage loader; + crc verification for stage payload
* Fixed questionable code & potential leaks
* Lowered screen update rate; added radio stack update stubs; working dfu write
* Console EP with manifest & stage validation
* Added microtar lib; minor ui fixes for updater
* Removed microtar
* Removed mtar #2
* Added a better version of microtar
* TAR archive api; LFS backup & restore core
* Recursive backup/restore
* LFS worker thread
* Added system apps to loader - not visible in UI; full update process with restarts
* Typo fix
* Dropped BL & f6; tooling for updater WIP
* Minor py fixes
* Minor fixes to make it build after merge
* Ported flash workaround from BL + fixed visuals
* Minor cleanup
* Chmod + loader app search fix
* Python linter fix
* Removed usb stuff & float read support for staged loader == -10% of binary size
* Added backup/restore & update pb requests
* Added stub impl to RPC for backup/restore/update commands
* Reworked TAR to use borrowed Storage api; slightly reduced build size by removing `static string`; hidden update-related RPC behind defines
* Moved backup&restore to storage
* Fixed new message types
* Backup/restore/update RPC impl
* Moved furi_hal_crc to LL; minor fixes
* CRC HAL rework to LL
* Purging STM HAL
* Brought back minimal DFU boot mode (no gui); additional crc state checks
* Added splash screen, BROKEN usb function
* Clock init rework WIP
* Stripped graphics from DFU mode
* Temp fix for unused static fun
* WIP update picker - broken!
* Fixed UI
* Bumping version
* Fixed RTC setup
* Backup to update folder instead of ext root
* Removed unused scenes & more usb remnants from staged loader
* CI updates
* Fixed update bundle name
* Temporary restored USB handler
* Attempt to prevent .text corruption
* Comments on how I spent this Saturday
* Added update file icon
* Documentation updates
* Moved common code to lib folder
* Storage: more unit tests
* Storage: blocking dir open, differentiate file and dir when freed.
* Major refactoring; added input processing to updater to allow retrying on failures (not very useful prob). Added API for extraction of thread return value
* Removed re-init check for manifest
* Changed low-level path manipulation to toolbox/path.h; makefile cleanup; tiny fix in lint.py
* Increased update worker stack size
* Text fixes in backup CLI
* Displaying number of update stages to run; removed timeout in handling errors
* Bumping version
* Added thread cleanup for spawner thread
* Updated build targets to exclude firmware bundle from 'ALL'
* Fixed makefile for update_package; skipping VCP init for update mode (ugly)
* Switched github build from ALL to update_package
* Added +x for dist_update.sh
* Cli: add total heap size to "free" command
* Moved (RAM) suffix to build version instead of git commit no.
* DFU comment
* Some fixes suggested by clang-tidy
* Fixed recursive PREFIX macro
* Makefile: gather all new rules in updater namespace. FuriHal: rename bootloader to boot, isr safe delays
* Github: correct build target name in firmware build
* FuriHal: move target switch to boot
* Makefile: fix firmware flash
* Furi, FuriHal: move kernel start to furi, early init
* Drop bootloader related stuff
* Drop cube. Drop bootloader linker script.
* Renamed update_hl, moved constants to #defines
* Moved update-related boot mode to separate bitfield
* Reworked updater cli to single entry point; fixed crash on tar cleanup
* Added Python replacement for dist shell scripts
* Linter fixes for dist.py +x
* Fixes for environment suffix
* Dropped bash scripts
* Added dirty build flag to version structure & interfaces
* Version string escapes
* Fixed flag logic in dist.py; added support for App instances being imported and not terminating the whole program
* Fixed fw address in ReadMe.md
* Rpc: fix crash on double screen start
* Return back original boot behavior and fix jump to system bootloader
* Cleanup code, add error sequence for RTC
* Update firmware readme
* FuriHal: drop boot, restructure RTC registers usage and add header register check
* Furi goes first
* Toolchain: add ccache support
* Renamed update bundle dir

Co-authored-by: DrZlo13 <who.just.the.doctor@gmail.com>
Co-authored-by: あく <alleteam@gmail.com>

lib/update_util/dfu_file.c

@@ -0,0 +1,183 @@
+#include "dfu_file.h"
+#include <furi_hal.h>
+
+#define VALID_WHOLE_FILE_CRC 0xFFFFFFFF
+#define DFU_SUFFIX_VERSION 0x011A
+#define DFU_DATA_BUFFER_MAX_LEN 512
+#define DFU_SIGNATURE "DfuSe"
+
+bool dfu_file_validate_crc(File* dfuf, const DfuPageTaskProgressCb progress_cb, void* context) {
+    if(!storage_file_is_open(dfuf) || !storage_file_seek(dfuf, 0, true)) {
+        return false;
+    }
+
+    furi_hal_crc_reset();
+
+    uint32_t file_crc = 0;
+
+    uint8_t* data_buffer = malloc(DFU_DATA_BUFFER_MAX_LEN);
+    uint16_t data_buffer_valid_len;
+
+    uint32_t file_size = storage_file_size(dfuf);
+
+    /* Feed file contents per sector into CRC calc */
+    furi_hal_crc_acquire(osWaitForever);
+    for(uint32_t fptr = 0; fptr < file_size;) {
+        data_buffer_valid_len = storage_file_read(dfuf, data_buffer, DFU_DATA_BUFFER_MAX_LEN);
+        if(data_buffer_valid_len == 0) {
+            break;
+        }
+        fptr += data_buffer_valid_len;
+
+        if((fptr % DFU_DATA_BUFFER_MAX_LEN == 0)) {
+            progress_cb(fptr * 100 / file_size, context);
+        }
+
+        file_crc = furi_hal_crc_feed(data_buffer, data_buffer_valid_len);
+    }
+    furi_hal_crc_reset();
+    free(data_buffer);
+
+    /* Last 4 bytes of DFU file = CRC of previous file contents, inverted
+     * If we calculate whole file CRC32, incl. embedded CRC,
+     * that should give us 0xFFFFFFFF 
+     */
+    return file_crc == VALID_WHOLE_FILE_CRC;
+}
+
+uint8_t dfu_file_validate_headers(File* dfuf, const DfuValidationParams* reference_params) {
+    furi_assert(reference_params);
+
+    DfuPrefix dfu_prefix = {0};
+    DfuSuffix dfu_suffix = {0};
+    uint16_t bytes_read = 0;
+
+    if(!storage_file_is_open(dfuf) || !storage_file_seek(dfuf, 0, true)) {
+        return 0;
+    }
+
+    const uint32_t dfu_suffix_offset = storage_file_size(dfuf) - sizeof(DfuSuffix);
+
+    bytes_read = storage_file_read(dfuf, &dfu_prefix, sizeof(DfuPrefix));
+    if(bytes_read != sizeof(DfuPrefix)) {
+        return 0;
+    }
+
+    if(memcmp(dfu_prefix.szSignature, DFU_SIGNATURE, sizeof(dfu_prefix.szSignature))) {
+        return 0;
+    }
+
+    if((dfu_prefix.bVersion != 1) || (dfu_prefix.DFUImageSize != dfu_suffix_offset)) {
+        return 0;
+    }
+
+    if(!storage_file_seek(dfuf, dfu_suffix_offset, true)) {
+        return 0;
+    }
+
+    bytes_read = storage_file_read(dfuf, &dfu_suffix, sizeof(DfuSuffix));
+    if(bytes_read != sizeof(DfuSuffix)) {
+        return 0;
+    }
+
+    if((dfu_suffix.bLength != sizeof(DfuSuffix)) || (dfu_suffix.bcdDFU != DFU_SUFFIX_VERSION)) {
+        return 0;
+    }
+    /* TODO: check DfuSignature?.. */
+
+    if((dfu_suffix.idVendor != reference_params->vendor) ||
+       (dfu_suffix.idProduct != reference_params->product) ||
+       (dfu_suffix.bcdDevice != reference_params->device)) {
+        return 0;
+    }
+
+    return dfu_prefix.bTargets;
+}
+
+/* Assumes file is open, valid and read pointer is set at the start of image data
+ */
+static DfuUpdateBlockResult dfu_file_perform_task_for_update_pages(
+    const DfuUpdateTask* task,
+    File* dfuf,
+    const ImageElementHeader* header) {
+    furi_assert(task);
+    furi_assert(header);
+    task->progress_cb(0, task->context);
+    const size_t FLASH_PAGE_SIZE = furi_hal_flash_get_page_size();
+    const size_t FLASH_PAGE_ALIGNMENT_MASK = FLASH_PAGE_SIZE - 1;
+    if((header->dwElementAddress & FLASH_PAGE_ALIGNMENT_MASK) != 0) {
+        /* start address is not aligned by page boundary -- we don't support that. Yet. */
+        return UpdateBlockResult_Failed;
+    }
+
+    if(task->address_cb && (!task->address_cb(header->dwElementAddress) ||
+                            !task->address_cb(header->dwElementAddress + header->dwElementSize))) {
+        storage_file_seek(dfuf, header->dwElementSize, false);
+        task->progress_cb(100, task->context);
+        return UpdateBlockResult_Skipped;
+    }
+
+    uint8_t* fw_block = malloc(FLASH_PAGE_SIZE);
+    uint16_t bytes_read = 0;
+    uint32_t element_offs = 0;
+
+    while(element_offs < header->dwElementSize) {
+        uint32_t n_bytes_to_read = FLASH_PAGE_SIZE;
+        if((element_offs + n_bytes_to_read) > header->dwElementSize) {
+            n_bytes_to_read = header->dwElementSize - element_offs;
+        }
+
+        bytes_read = storage_file_read(dfuf, fw_block, n_bytes_to_read);
+        if(bytes_read == 0) {
+            break;
+        }
+
+        int16_t i_page = furi_hal_flash_get_page_number(header->dwElementAddress + element_offs);
+        if(i_page < 0) {
+            break;
+        }
+
+        if(!task->task_cb(i_page, fw_block, bytes_read)) {
+            break;
+        }
+
+        element_offs += bytes_read;
+        task->progress_cb(element_offs * 100 / header->dwElementSize, task->context);
+    }
+
+    free(fw_block);
+    return (element_offs == header->dwElementSize) ? UpdateBlockResult_OK :
+                                                     UpdateBlockResult_Failed;
+}
+
+bool dfu_file_process_targets(const DfuUpdateTask* task, File* dfuf, const uint8_t n_targets) {
+    TargetPrefix target_prefix = {0};
+    ImageElementHeader image_element = {0};
+    uint16_t bytes_read = 0;
+
+    if(!storage_file_seek(dfuf, sizeof(DfuPrefix), true)) {
+        return UpdateBlockResult_Failed;
+    };
+
+    for(uint8_t i_target = 0; i_target < n_targets; ++i_target) {
+        bytes_read = storage_file_read(dfuf, &target_prefix, sizeof(TargetPrefix));
+        if(bytes_read != sizeof(TargetPrefix)) {
+            return UpdateBlockResult_Failed;
+        }
+
+        /* TODO: look into TargetPrefix and validate/filter?.. */
+        for(uint32_t i_element = 0; i_element < target_prefix.dwNbElements; ++i_element) {
+            bytes_read = storage_file_read(dfuf, &image_element, sizeof(ImageElementHeader));
+            if(bytes_read != sizeof(ImageElementHeader)) {
+                return UpdateBlockResult_Failed;
+            }
+
+            if(dfu_file_perform_task_for_update_pages(task, dfuf, &image_element) ==
+               UpdateBlockResult_Failed) {
+                return false;
+            }
+        }
+    }
+
+    return true;
+}

lib/update_util/dfu_file.h

@@ -0,0 +1,40 @@
+#pragma once
+
+#include "dfu_headers.h"
+
+#include <stdbool.h>
+#include <storage/storage.h>
+
+typedef enum {
+    UpdateBlockResult_Unknown,
+    UpdateBlockResult_OK,
+    UpdateBlockResult_Skipped,
+    UpdateBlockResult_Failed
+} DfuUpdateBlockResult;
+
+typedef bool (
+    *DfuPageTaskCb)(const uint8_t i_page, const uint8_t* update_block, uint16_t update_block_len);
+typedef void (*DfuPageTaskProgressCb)(const uint8_t progress, void* context);
+typedef bool (*DfuAddressValidationCb)(const size_t address);
+
+typedef struct {
+    DfuPageTaskCb task_cb;
+    DfuPageTaskProgressCb progress_cb;
+    DfuAddressValidationCb address_cb;
+    void* context;
+} DfuUpdateTask;
+
+typedef struct {
+    uint16_t vendor;
+    uint16_t product;
+    uint16_t device;
+} DfuValidationParams;
+
+bool dfu_file_validate_crc(File* dfuf, const DfuPageTaskProgressCb progress_cb, void* context);
+
+/* Returns number of valid targets from file header
+ * If file is invalid, returns 0
+ */
+uint8_t dfu_file_validate_headers(File* dfuf, const DfuValidationParams* reference_params);
+
+bool dfu_file_process_targets(const DfuUpdateTask* task, File* dfuf, const uint8_t n_targets);

lib/update_util/dfu_headers.h

@@ -0,0 +1,41 @@
+#pragma once
+
+#include <stdint.h>
+
+#pragma pack(push, 1)
+
+typedef struct {
+    char szSignature[5];
+    uint8_t bVersion;
+    uint32_t DFUImageSize;
+    uint8_t bTargets;
+} DfuPrefix;
+
+typedef struct {
+    uint16_t bcdDevice;
+    uint16_t idProduct;
+    uint16_t idVendor;
+    uint16_t bcdDFU;
+    uint8_t ucDfuSignature_U;
+    uint8_t ucDfuSignature_F;
+    uint8_t ucDfuSignature_D;
+    uint8_t bLength;
+    uint32_t dwCRC;
+} DfuSuffix;
+
+typedef struct {
+    char szSignature[6];
+    uint8_t bAlternateSetting;
+    uint8_t bTargetNamed;
+    uint8_t _pad[3];
+    char szTargetName[255];
+    uint32_t dwTargetSize;
+    uint32_t dwNbElements;
+} TargetPrefix;
+
+typedef struct {
+    uint32_t dwElementAddress;
+    uint32_t dwElementSize;
+} ImageElementHeader;
+
+#pragma pack(pop)

lib/update_util/lfs_backup.c

@@ -0,0 +1,22 @@
+#include "lfs_backup.h"
+
+#include <toolbox/tar/tar_archive.h>
+
+#define LFS_BACKUP_DEFAULT_LOCATION "/ext/" LFS_BACKUP_DEFAULT_FILENAME
+
+bool lfs_backup_create(Storage* storage, const char* destination) {
+    const char* final_destination =
+        destination && strlen(destination) ? destination : LFS_BACKUP_DEFAULT_LOCATION;
+    return storage_int_backup(storage, final_destination) == FSE_OK;
+}
+
+bool lfs_backup_exists(Storage* storage, const char* source) {
+    const char* final_source = source && strlen(source) ? source : LFS_BACKUP_DEFAULT_LOCATION;
+    FileInfo fi;
+    return storage_common_stat(storage, final_source, &fi) == FSE_OK;
+}
+
+bool lfs_backup_unpack(Storage* storage, const char* source) {
+    const char* final_source = source && strlen(source) ? source : LFS_BACKUP_DEFAULT_LOCATION;
+    return storage_int_restore(storage, final_source) == FSE_OK;
+}

lib/update_util/lfs_backup.h

@@ -0,0 +1,18 @@
+#pragma once
+
+#include <stdbool.h>
+#include <storage/storage.h>
+
+#define LFS_BACKUP_DEFAULT_FILENAME "backup.tar"
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+bool lfs_backup_create(Storage* storage, const char* destination);
+bool lfs_backup_exists(Storage* storage, const char* source);
+bool lfs_backup_unpack(Storage* storage, const char* source);
+
+#ifdef __cplusplus
+}
+#endif

lib/update_util/update_manifest.c

@@ -0,0 +1,86 @@
+#include "update_manifest.h"
+
+#include <storage/storage.h>
+#include <flipper_format/flipper_format.h>
+#include <flipper_format/flipper_format_i.h>
+
+UpdateManifest* update_manifest_alloc() {
+    UpdateManifest* update_manifest = malloc(sizeof(UpdateManifest));
+    string_init(update_manifest->version);
+    string_init(update_manifest->firmware_dfu_image);
+    string_init(update_manifest->radio_image);
+    string_init(update_manifest->staged_loader_file);
+    update_manifest->target = 0;
+    update_manifest->valid = false;
+    return update_manifest;
+}
+
+void update_manifest_free(UpdateManifest* update_manifest) {
+    furi_assert(update_manifest);
+    string_clear(update_manifest->version);
+    string_clear(update_manifest->firmware_dfu_image);
+    string_clear(update_manifest->radio_image);
+    string_clear(update_manifest->staged_loader_file);
+    free(update_manifest);
+}
+
+static bool
+    update_manifest_init_from_ff(UpdateManifest* update_manifest, FlipperFormat* flipper_file) {
+    furi_assert(update_manifest);
+    furi_assert(flipper_file);
+
+    string_t filetype;
+    uint32_t version = 0;
+
+    // TODO: compare filetype?
+    string_init(filetype);
+    update_manifest->valid =
+        flipper_format_read_header(flipper_file, filetype, &version) &&
+        flipper_format_read_string(flipper_file, "Info", update_manifest->version) &&
+        flipper_format_read_uint32(flipper_file, "Target", &update_manifest->target, 1) &&
+        flipper_format_read_string(flipper_file, "Loader", update_manifest->staged_loader_file) &&
+        flipper_format_read_hex(
+            flipper_file,
+            "Loader CRC",
+            (uint8_t*)&update_manifest->staged_loader_crc,
+            sizeof(uint32_t));
+    string_clear(filetype);
+
+    /* Optional fields - we can have dfu, radio, or both */
+    flipper_format_read_string(flipper_file, "Firmware", update_manifest->firmware_dfu_image);
+    flipper_format_read_string(flipper_file, "Radio", update_manifest->radio_image);
+    flipper_format_read_hex(
+        flipper_file, "Radio address", (uint8_t*)&update_manifest->radio_address, sizeof(uint32_t));
+
+    return update_manifest->valid;
+}
+
+bool update_manifest_init(UpdateManifest* update_manifest, const char* manifest_filename) {
+    Storage* storage = furi_record_open("storage");
+    FlipperFormat* flipper_file = flipper_format_file_alloc(storage);
+    if(flipper_format_file_open_existing(flipper_file, manifest_filename)) {
+        update_manifest_init_from_ff(update_manifest, flipper_file);
+    }
+
+    flipper_format_free(flipper_file);
+    furi_record_close("storage");
+
+    return update_manifest->valid;
+}
+
+bool update_manifest_init_mem(
+    UpdateManifest* update_manifest,
+    const uint8_t* manifest_data,
+    const uint16_t length) {
+    FlipperFormat* flipper_file = flipper_format_string_alloc();
+    Stream* sstream = flipper_format_get_raw_stream(flipper_file);
+
+    stream_write(sstream, manifest_data, length);
+    stream_seek(sstream, 0, StreamOffsetFromStart);
+
+    update_manifest_init_from_ff(update_manifest, flipper_file);
+
+    flipper_format_free(flipper_file);
+
+    return update_manifest->valid;
+}

lib/update_util/update_manifest.h

@@ -0,0 +1,40 @@
+#pragma once
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#include <stdint.h>
+#include <stdbool.h>
+#include <m-string.h>
+
+/* Paths don't include /ext -- because at startup SD card is mounted as root */
+#define UPDATE_DIR_DEFAULT_REL_PATH "/update"
+#define UPDATE_MANIFEST_DEFAULT_NAME "update.fuf"
+#define UPDATE_MAINFEST_DEFAULT_PATH UPDATE_DIR_DEFAULT_REL_PATH "/" UPDATE_MANIFEST_DEFAULT_NAME
+
+typedef struct {
+    string_t version;
+    uint32_t target;
+    string_t staged_loader_file;
+    uint32_t staged_loader_crc;
+    string_t firmware_dfu_image;
+    string_t radio_image;
+    uint32_t radio_address;
+    bool valid;
+} UpdateManifest;
+
+UpdateManifest* update_manifest_alloc();
+
+void update_manifest_free(UpdateManifest* update_manifest);
+
+bool update_manifest_init(UpdateManifest* update_manifest, const char* manifest_filename);
+
+bool update_manifest_init_mem(
+    UpdateManifest* update_manifest,
+    const uint8_t* manifest_data,
+    const uint16_t length);
+
+#ifdef __cplusplus
+}
+#endif

lib/update_util/update_operation.c

@@ -0,0 +1,207 @@
+#include "update_operation.h"
+
+#include "update_manifest.h"
+
+#include <furi.h>
+#include <furi_hal.h>
+#include <m-string.h>
+#include <loader/loader.h>
+#include <lib/toolbox/path.h>
+
+static const char* UPDATE_ROOT_DIR = "/ext" UPDATE_DIR_DEFAULT_REL_PATH;
+static const char* UPDATE_PREFIX = "/ext" UPDATE_DIR_DEFAULT_REL_PATH "/";
+static const char* UPDATE_SUFFIX = "/" UPDATE_MANIFEST_DEFAULT_NAME;
+static const uint32_t MAX_DIR_NAME_LEN = 250;
+
+static const char* update_prepare_result_descr[] = {
+    [UpdatePrepareResultOK] = "OK",
+    [UpdatePrepareResultManifestPathInvalid] = "Invalid manifest name or location",
+    [UpdatePrepareResultManifestFolderNotFound] = "Update folder not found",
+    [UpdatePrepareResultManifestInvalid] = "Invalid manifest data",
+    [UpdatePrepareResultStageMissing] = "Missing Stage2 loader",
+    [UpdatePrepareResultStageIntegrityError] = "Corrupted Stage2 loader",
+};
+
+const char* update_operation_describe_preparation_result(const UpdatePrepareResult value) {
+    if(value >= COUNT_OF(update_prepare_result_descr)) {
+        return "...";
+    } else {
+        return update_prepare_result_descr[value];
+    }
+}
+
+bool update_operation_get_package_dir_name(const char* full_path, string_t out_manifest_dir) {
+    bool path_ok = false;
+    string_t full_path_str;
+    string_init_set(full_path_str, full_path);
+    string_reset(out_manifest_dir);
+    bool start_end_ok = string_start_with_str_p(full_path_str, UPDATE_PREFIX) &&
+                        string_end_with_str_p(full_path_str, UPDATE_SUFFIX);
+    int16_t dir_name_len =
+        strlen(full_path) - strlen(UPDATE_PREFIX) - strlen(UPDATE_MANIFEST_DEFAULT_NAME) - 1;
+    if(dir_name_len == -1) {
+        path_ok = true;
+    } else if(start_end_ok && (dir_name_len > 0)) {
+        string_set_n(out_manifest_dir, full_path_str, strlen(UPDATE_PREFIX), dir_name_len);
+        path_ok = true;
+        if(string_search_char(out_manifest_dir, '/') != STRING_FAILURE) {
+            string_reset(out_manifest_dir);
+            path_ok = false;
+        }
+    }
+    string_clear(full_path_str);
+    return path_ok;
+}
+
+int32_t update_operation_get_package_index(Storage* storage, const char* update_package_dir) {
+    furi_assert(storage);
+    furi_assert(update_package_dir);
+
+    if(strlen(update_package_dir) == 0) {
+        return 0;
+    }
+
+    bool found = false;
+    int32_t index = 0;
+    File* dir = storage_file_alloc(storage);
+    FileInfo fi = {0};
+    char* name_buffer = malloc(MAX_DIR_NAME_LEN);
+    do {
+        if(!storage_dir_open(dir, UPDATE_ROOT_DIR)) {
+            break;
+        }
+
+        while(storage_dir_read(dir, &fi, name_buffer, MAX_DIR_NAME_LEN)) {
+            index++;
+            if(strcmp(name_buffer, update_package_dir)) {
+                continue;
+            } else {
+                found = true;
+                break;
+            }
+        }
+    } while(false);
+
+    free(name_buffer);
+    storage_file_free(dir);
+
+    return found ? index : -1;
+}
+
+bool update_operation_get_current_package_path(Storage* storage, string_t out_path) {
+    uint32_t update_index = furi_hal_rtc_get_register(FuriHalRtcRegisterUpdateFolderFSIndex);
+    string_set_str(out_path, UPDATE_ROOT_DIR);
+    if(update_index == 0) {
+        return true;
+    }
+
+    bool found = false;
+    uint32_t iter_index = 0;
+    File* dir = storage_file_alloc(storage);
+    FileInfo fi = {0};
+    char* name_buffer = malloc(MAX_DIR_NAME_LEN);
+    do {
+        if(!storage_dir_open(dir, UPDATE_ROOT_DIR)) {
+            break;
+        }
+
+        while(storage_dir_read(dir, &fi, name_buffer, MAX_DIR_NAME_LEN)) {
+            if(++iter_index == update_index) {
+                found = true;
+                path_append(out_path, name_buffer);
+                break;
+            }
+        }
+    } while(false);
+
+    free(name_buffer);
+    storage_file_free(dir);
+    if(!found) {
+        string_reset(out_path);
+    }
+
+    return found;
+}
+
+UpdatePrepareResult update_operation_prepare(const char* manifest_file_path) {
+    string_t update_folder;
+    string_init(update_folder);
+    if(!update_operation_get_package_dir_name(manifest_file_path, update_folder)) {
+        string_clear(update_folder);
+        return UpdatePrepareResultManifestPathInvalid;
+    }
+
+    Storage* storage = furi_record_open("storage");
+    int32_t update_index =
+        update_operation_get_package_index(storage, string_get_cstr(update_folder));
+    string_clear(update_folder);
+
+    if(update_index < 0) {
+        furi_record_close("storage");
+        return UpdatePrepareResultManifestFolderNotFound;
+    }
+
+    string_t update_dir_path;
+    string_init(update_dir_path);
+    path_extract_dirname(manifest_file_path, update_dir_path);
+
+    UpdatePrepareResult result = UpdatePrepareResultManifestInvalid;
+    UpdateManifest* manifest = update_manifest_alloc();
+    if(update_manifest_init(manifest, manifest_file_path)) {
+        result = UpdatePrepareResultStageMissing;
+        File* file = storage_file_alloc(storage);
+
+        string_t stage_path;
+        string_init(stage_path);
+        path_extract_dirname(manifest_file_path, stage_path);
+        path_append(stage_path, string_get_cstr(manifest->staged_loader_file));
+
+        const uint16_t READ_BLOCK = 0x1000;
+        uint8_t* read_buffer = malloc(READ_BLOCK);
+        uint32_t crc = 0;
+        do {
+            if(!storage_file_open(
+                   file, string_get_cstr(stage_path), FSAM_READ, FSOM_OPEN_EXISTING)) {
+                break;
+            }
+
+            result = UpdatePrepareResultStageIntegrityError;
+            furi_hal_crc_acquire(osWaitForever);
+
+            uint16_t bytes_read = 0;
+            do {
+                bytes_read = storage_file_read(file, read_buffer, READ_BLOCK);
+                crc = furi_hal_crc_feed(read_buffer, bytes_read);
+            } while(bytes_read == READ_BLOCK);
+
+            furi_hal_crc_reset();
+        } while(false);
+
+        string_clear(stage_path);
+        free(read_buffer);
+        storage_file_free(file);
+
+        if(crc == manifest->staged_loader_crc) {
+            furi_hal_rtc_set_boot_mode(FuriHalRtcBootModePreUpdate);
+            update_operation_persist_package_index(update_index);
+            result = UpdatePrepareResultOK;
+        }
+    }
+    furi_record_close("storage");
+    update_manifest_free(manifest);
+
+    return result;
+}
+
+bool update_operation_is_armed() {
+    return furi_hal_rtc_get_boot_mode() == FuriHalRtcBootModePreUpdate;
+}
+
+void update_operation_disarm() {
+    furi_hal_rtc_set_boot_mode(FuriHalRtcBootModeNormal);
+    furi_hal_rtc_set_register(FuriHalRtcRegisterUpdateFolderFSIndex, 0);
+}
+
+void update_operation_persist_package_index(uint32_t index) {
+    furi_hal_rtc_set_register(FuriHalRtcRegisterUpdateFolderFSIndex, index);
+}

lib/update_util/update_operation.h

@@ -0,0 +1,72 @@
+#pragma once
+
+#include <stdbool.h>
+#include <m-string.h>
+#include <storage/storage.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/* 
+ * Checks if supplied full manifest path is valid
+ * @param full_path Full path to manifest file. Must be named UPDATE_MANIFEST_DEFAULT_NAME
+ * @param out_manifest_dir Directory to apply update from, if supplied path is valid. 
+ *   May be empty if update is in root update directory
+ * @return bool if supplied path is valid and out_manifest_dir contains dir to apply
+ */
+bool update_operation_get_package_dir_name(const char* full_path, string_t out_manifest_dir);
+
+typedef enum {
+    UpdatePrepareResultOK,
+    UpdatePrepareResultManifestPathInvalid,
+    UpdatePrepareResultManifestFolderNotFound,
+    UpdatePrepareResultManifestInvalid,
+    UpdatePrepareResultStageMissing,
+    UpdatePrepareResultStageIntegrityError,
+} UpdatePrepareResult;
+
+const char* update_operation_describe_preparation_result(const UpdatePrepareResult value);
+
+/* 
+ * Validates next stage and sets up registers to apply update after restart
+ * @param manifest_dir_path Full path to manifest for update to apply 
+ * @return UpdatePrepareResult validation & arm result
+ */
+UpdatePrepareResult update_operation_prepare(const char* manifest_file_path);
+
+/* 
+ * Gets update package index to pass in RTC registers
+ * @param storage Storage API
+ * @param update_package_dir Package directory name
+ * @return int32_t <0 - error, >= 0 - update index value
+ */
+int32_t update_operation_get_package_index(Storage* storage, const char* update_package_dir);
+
+/* 
+ * Gets filesystem path for current update package
+ * @param storage Storage API
+ * @param out_path Path to directory with manifest & related files. Must be initialized
+ * @return true if path was restored successfully
+ */
+bool update_operation_get_current_package_path(Storage* storage, string_t out_path);
+
+/* 
+ * Stores given update index in RTC registers
+ * @param index Value to store
+ */
+void update_operation_persist_package_index(uint32_t index);
+
+/* 
+ * Sets up update operation to be performed on reset
+ */
+bool update_operation_is_armed();
+
+/* 
+ * Cancels pending update operation
+ */
+void update_operation_disarm();
+
+#ifdef __cplusplus
+}
+#endif