Offline Update Bundle for Zynq-7000
Sign, package and apply A/B firmware updates on disconnected boards from removable media.
- Runs out of the box: yes
- Tests: yes
- CI: yes
- Docs: yes
- Used in production: yes
Purpose#
A bundle format and installer for boards that never see a network. A build host assembles the root file system, kernel and bitstream into one archive, signs the manifest with an offline key and writes it to removable media. On the board, a small installer verifies the signature, writes the inactive slot and switches the boot slot.
The boot loader counts failed boots and falls back to the previous slot automatically, so a bad update returns the board to its last working image without a technician on site.
What you will learn#
- Lay out an A/B partition scheme with a boot counter in the boot loader environment
- Package an image, bitstream and manifest as one signed offline bundle
- Verify a bundle signature on the target before writing any partition
- Roll back automatically after a failed boot
Media#
Technologies & features#
Lessons learned#
- Worked
A boot counter stored in the boot loader environment made rollback deterministic: three failed boots, then the previous slot, with no userspace code involved.
- Didn’t work
Verifying the signature after writing the slot meant a tampered bundle still overwrote the inactive image. Verify first, then write.
- Decision
The bundle ships the full image instead of a delta. Deltas saved little on our small images and added a verification step we did not want to own.
- Limitation
A bundle larger than the spare slot cannot be installed; the installer rejects it up front instead of failing halfway.
Try it#
git clone https://git.example.internal/embedded-platforms/zynq-ab-update.git
cd zynq-ab-update
./tools/make-bundle.sh --target zc702 --slot B --key keys/dev-signing.pem
# copy out/bundle.tar to a USB stick, insert it, then on the board:
apply-update /media/usb0/bundle.tarThe development key in keys/ is for the simulator only; production keys never leave the signing host.
Commands come from the owner’s README. Credentials are never stored here.
Resources#
- Source repositoryGit ref release/2026.2git.example.internal/embedded-platforms/zynq-ab-update (opens in a new tab)
- Clone over SSH
git@git.example.internal:embedded-platforms/zynq-ab-update.git - Operator guidedocs.example.internal/embedded/offline-updates (opens in a new tab)
- CI pipelineci.example.internal/embedded-platforms/zynq-ab-update (opens in a new tab)
