Updates: crash-loop handling and pending-update record

[chrysh]

When we flash a new image and it verifies, you activate it immediately. What happens if it boots into a crash loop? I'd expect: boot the new image once, watch it actually come up, and only then commit to it — and if we lose power in the middle of an update, something written to flash has to remember where we were. Where does that live?

cc @FerralCoder @rusty1968

[FerralCoder]

First, when to activate is a policy decision, so it will not necessarily be immediate.

When writing to a flash partition:

1. We never write to the active partition. If there is a power failure during update, the update can simply be restarted from be beginning after boot. This would be the responsibility of the outside entity that is driving the PLDM Type 5 update process. Since we did not touch the active partition, the device should be able to boot just as it was before.
2. Once writing of the update completes successfully, we mark the updated partition as active.
3. When the device next boots up, we must monitor the boot flow.

• If we detect successful boot, update the inactive redundant partitions to match
• if we detect boot failed:
  • put the device back into reset
  • enter recovery flow
    • find a valid inactive partition and and mark active
    • allow device to boot again
    • update the failed partition with the working copy again