Multiboot: per-slot config profiles + restorable Main backup

App/driver/mb_flash.c

@@ -14,8 +14,10 @@
  */
 
 #include <stddef.h>
+#include <string.h>
 
 #include "driver/mb_flash.h"
+#include "driver/py25q16.h"
 
 #include "py32f0xx.h"
 
@@ -103,10 +105,14 @@ static void MB_PrepareInternalFlash(void)
 /* the linker stores in flash and the startup copies to RAM alongside .data.  */
 /* -------------------------------------------------------------------------- */
 
-/* Polled single-byte SPI2 transfer. always_inline keeps all code in .RamFunc.
- * The result is returned through out so timeout and received 0xFF remain
- * distinguishable. */
-__attribute__((always_inline)) static inline bool mb_ram_spi(uint8_t v, uint8_t *out)
+/* These primitives are called repeatedly while application flash is offline.
+ * Keep one copy of each in the copied RAM section: noinline/noclone prevents
+ * GCC from silently duplicating one back into MB_RamReflash. */
+#define MB_RAM_HELPER __attribute__((section(".RamFunc"), noinline, noclone, used))
+
+/* Polled single-byte SPI2 transfer. The result is returned through out so
+ * timeout and received 0xFF remain distinguishable. */
+MB_RAM_HELPER static bool mb_ram_spi(uint8_t v, uint8_t *out)
 {
     uint32_t timeout = MB_RAM_SPI_TIMEOUT;
     while (!(SPI2->SR & SPI_SR_TXE))
@@ -124,7 +130,7 @@ __attribute__((always_inline)) static inline bool mb_ram_spi(uint8_t v, uint8_t
     return true;
 }
 
-__attribute__((always_inline)) static inline bool mb_ram_flash_idle(void)
+MB_RAM_HELPER static bool mb_ram_flash_idle(void)
 {
     uint32_t timeout = MB_RAM_FLASH_TIMEOUT;
     while (FLASH->SR & FLASH_SR_BSY)
@@ -133,7 +139,7 @@ __attribute__((always_inline)) static inline bool mb_ram_flash_idle(void)
     return true;
 }
 
-__attribute__((always_inline, noreturn)) static inline void mb_ram_reset(void)
+MB_RAM_HELPER __attribute__((noreturn)) static void mb_ram_reset(void)
 {
     __DSB();
 
@@ -144,7 +150,7 @@ __attribute__((always_inline, noreturn)) static inline void mb_ram_reset(void)
 
 /* Minimal SPI1 LCD writer. A display timeout merely disables progress updates:
  * it must never abort or delay the safety-critical flash copy. */
-__attribute__((always_inline)) static inline bool mb_ram_lcd_spi(uint8_t v)
+MB_RAM_HELPER static bool mb_ram_lcd_spi(uint8_t v)
 {
     uint32_t timeout = MB_RAM_SPI_TIMEOUT;
     while (!(SPI1->SR & SPI_SR_TXE))
@@ -183,6 +189,35 @@ __attribute__((always_inline)) static inline bool mb_ram_progress_blit(const uin
     return ok != 0u;
 }
 
+/* Blank the whole LCD RAM (all 8 pages) right before the reset. The MCU reset
+ * leaves the display controller powered and still showing the "Restore slot N"
+ * screen; it stays visible through the next boot until ST7565_Init re-inits the
+ * panel. Wiping it here means the reboot window shows nothing instead of a
+ * stale restore screen. Best-effort: a display timeout just leaves it as-is. */
+__attribute__((always_inline)) static inline void mb_ram_lcd_clear(void)
+{
+    for (uint8_t page = 0; page < 8u; page++)
+    {
+        GPIOB->BRR = MB_LCD_CS_PIN;
+        GPIOA->BRR = MB_LCD_A0_PIN;             /* command */
+        if (!mb_ram_lcd_spi((uint8_t)(0xB0u | page)) ||  /* set page 0..7 */
+            !mb_ram_lcd_spi(0x10u) ||           /* column high nibble */
+            !mb_ram_lcd_spi(0x04u))             /* visible RAM starts at column 4 */
+        {
+            GPIOB->BSRR = MB_LCD_CS_PIN;
+            return;
+        }
+        GPIOA->BSRR = MB_LCD_A0_PIN;            /* data */
+        for (uint32_t i = 0; i < 128u; i++)
+            if (!mb_ram_lcd_spi(0x00u))
+            {
+                GPIOB->BSRR = MB_LCD_CS_PIN;
+                return;
+            }
+        GPIOB->BSRR = MB_LCD_CS_PIN;
+    }
+}
+
 __attribute__((section(".RamFunc"), noinline, used))
 static void MB_RamReflash(uint32_t intAddr, uint32_t extAddr, uint32_t imageSize,
                           uint8_t *progressLine)
@@ -332,6 +367,8 @@ static void MB_RamReflash(uint32_t intAddr, uint32_t extAddr, uint32_t imageSize
     }
 
     FLASH->CR |= FLASH_CR_LOCK;
+    if (lcdEnabled)
+        mb_ram_lcd_clear();
     mb_ram_reset();
 
 fatal_reset:
@@ -644,7 +681,8 @@ uint8_t MB_SlotInfo(uint8_t slot, mb_slot_header_t *out_header)
 
 uint8_t MB_SlotErase(uint8_t slot)
 {
-    if (slot >= MB_SLOT_COUNT)
+    /* Slot 0 is the firmware-managed base backup: never erasable from the host. */
+    if (slot >= MB_SLOT_COUNT || slot == MB_SLOT_BACKUP)
         return MB_ERR_SLOT;
 
     const uint32_t base = MB_SLOT0_EXT_BASE + (uint32_t)slot * MB_SLOT_STRIDE;
@@ -660,7 +698,8 @@ uint8_t MB_SlotErase(uint8_t slot)
 
 uint8_t MB_SlotWrite(uint8_t slot, uint32_t offset, const uint8_t *data, uint32_t len)
 {
-    if (slot >= MB_SLOT_COUNT)
+    /* Slot 0 is the firmware-managed base backup: never writable from the host. */
+    if (slot >= MB_SLOT_COUNT || slot == MB_SLOT_BACKUP)
         return MB_ERR_SLOT;
     if (len == 0)
         return MB_OK;
@@ -676,3 +715,323 @@ uint8_t MB_SlotWrite(uint8_t slot, uint32_t offset, const uint8_t *data, uint32_
 
     return MB_OK;
 }
+
+/* -------------------------------------------------------------------------- */
+/* Per-profile settings banks.                                                */
+/*                                                                            */
+/* The banking offset itself lives in the flash driver (PY25Q16_SetProfileBase);*/
+/* here we only own the active-profile marker and the profile->base mapping.  */
+/* All external-flash only, never brick-critical.                             */
+/* -------------------------------------------------------------------------- */
+
+static uint32_t mb_crc32_bytes(const uint8_t *p, uint32_t len)
+{
+    uint32_t crc = 0xFFFFFFFFu;
+
+    for (uint32_t i = 0; i < len; i++)
+    {
+        crc ^= p[i];
+        for (int k = 0; k < 8; k++)
+            crc = (crc >> 1) ^ (0xEDB88320u & (0u - (crc & 1u)));
+    }
+    return crc ^ 0xFFFFFFFFu;
+}
+
+uint32_t MB_ProfileBase(uint8_t profile)
+{
+    if (profile == 0)
+        return 0;                    /* profile 0 = historical config region */
+    if (profile < MB_PROFILE_COUNT)
+        return MB_PROFILE1_EXT_BASE + (uint32_t)(profile - 1u) * MB_PROFILE_BANK_SIZE;
+    return 0;                        /* out of range -> safe default */
+}
+
+static mb_mark_status_t mb_read_profile_copy(uint32_t base, mb_profile_state_t *st)
+{
+    mb_spi_err = 0;
+    mb_ext_read(base, (uint8_t *)st, sizeof(*st));
+    if (mb_spi_err)                              return MB_MARK_IO;
+    if (st->magic == 0xFFFFFFFFu)                return MB_MARK_MISSING;
+    if (st->magic == MB_PROFILE_LEGACY_MAGIC)
+    {
+        /* FMP1 was { magic, index, ~index, reserved[2] }. Preserve its slot
+         * choice long enough for boot resolution to migrate it to FMP2. */
+        const uint8_t legacy_index = ((const uint8_t *)st)[4];
+        const uint8_t legacy_inv   = ((const uint8_t *)st)[5];
+        if ((uint8_t)~legacy_inv != legacy_index || legacy_index >= MB_PROFILE_COUNT)
+            return MB_MARK_CORRUPT;
+        memset(st, 0, sizeof(*st));
+        st->magic = MB_PROFILE_LEGACY_MAGIC;
+        st->index = legacy_index;
+        st->index_inv = legacy_inv;
+        return MB_MARK_LEGACY;
+    }
+    if (st->magic != MB_PROFILE_MAGIC)           return MB_MARK_CORRUPT;
+    if ((uint8_t)~st->index_inv != st->index)    return MB_MARK_CORRUPT;
+    if (st->index >= MB_PROFILE_COUNT)           return MB_MARK_CORRUPT;
+    if (st->image_size == 0u ||
+        st->image_size > MB_INT_APP_SIZE)         return MB_MARK_CORRUPT;
+    if (mb_crc32_bytes((const uint8_t *)st,
+                       sizeof(*st) - sizeof(st->state_crc32)) != st->state_crc32)
+                                                    return MB_MARK_CORRUPT;
+    return MB_MARK_VALID;
+}
+
+static bool mb_generation_newer(uint32_t a, uint32_t b)
+{
+    return (int32_t)(a - b) > 0;
+}
+
+static mb_mark_status_t mb_read_active_profile(mb_profile_state_t *state,
+                                                uint32_t *state_base)
+{
+    mb_profile_state_t a;
+    mb_profile_state_t b;
+    mb_mark_status_t sa = mb_read_profile_copy(MB_PROFILE_STATE_A_BASE, &a);
+    mb_mark_status_t sb = mb_read_profile_copy(MB_PROFILE_STATE_B_BASE, &b);
+
+    /* If either sector could not be read, it might contain the newest record.
+     * Do not silently select an older state and risk loading the wrong bank. */
+    if (sa == MB_MARK_IO || sb == MB_MARK_IO)
+        return MB_MARK_IO;
+
+    const mb_profile_state_t *chosen = NULL;
+    uint32_t chosen_base = 0;
+    if (sa == MB_MARK_VALID && sb == MB_MARK_VALID)
+    {
+        if (mb_generation_newer(b.generation, a.generation))
+        {
+            chosen = &b;
+            chosen_base = MB_PROFILE_STATE_B_BASE;
+        }
+        else
+        {
+            chosen = &a;
+            chosen_base = MB_PROFILE_STATE_A_BASE;
+        }
+    }
+    else if (sa == MB_MARK_VALID)
+    {
+        chosen = &a;
+        chosen_base = MB_PROFILE_STATE_A_BASE;
+    }
+    else if (sb == MB_MARK_VALID)
+    {
+        chosen = &b;
+        chosen_base = MB_PROFILE_STATE_B_BASE;
+    }
+
+    if (chosen)
+    {
+        if (state)
+            *state = *chosen;
+        if (state_base)
+            *state_base = chosen_base;
+        return MB_MARK_VALID;
+    }
+
+    /* A legacy record is usable for migration but has no firmware identity.
+     * Prefer A if both somehow exist; the next successful repair writes FMP2. */
+    if (sa == MB_MARK_LEGACY || sb == MB_MARK_LEGACY)
+    {
+        const bool use_b = sa != MB_MARK_LEGACY;
+        if (state)
+            *state = use_b ? b : a;
+        if (state_base)
+            *state_base = use_b ? MB_PROFILE_STATE_B_BASE : MB_PROFILE_STATE_A_BASE;
+        return MB_MARK_LEGACY;
+    }
+
+    return (sa == MB_MARK_MISSING && sb == MB_MARK_MISSING)
+             ? MB_MARK_MISSING : MB_MARK_CORRUPT;
+}
+
+mb_mark_status_t MB_ReadActiveProfile(mb_profile_state_t *state)
+{
+    return mb_read_active_profile(state, NULL);
+}
+
+uint8_t MB_GetActiveProfile(void)
+{
+    mb_profile_state_t st;
+    mb_mark_status_t status = MB_ReadActiveProfile(&st);
+    return (status == MB_MARK_VALID || status == MB_MARK_LEGACY) ? st.index : 0;
+}
+
+uint8_t MB_SetActiveProfile(uint8_t profile)
+{
+    mb_slot_header_t hdr;
+    mb_profile_state_t st;
+    mb_profile_state_t current;
+    uint32_t current_base = 0;
+
+    if (profile >= MB_PROFILE_COUNT)
+        return MB_ERR_SLOT;
+
+    uint8_t hdr_err = mb_read_header(profile, &hdr);
+    if (hdr_err != MB_OK)
+        return hdr_err;
+
+    mb_mark_status_t current_status = mb_read_active_profile(&current, &current_base);
+    if (current_status == MB_MARK_IO)
+        return MB_ERR_SPI;
+
+    memset(&st, 0, sizeof(st));
+    st.magic       = MB_PROFILE_MAGIC;
+    st.generation  = (current_status == MB_MARK_VALID) ? current.generation + 1u : 0u;
+    st.image_size  = hdr.image_size;
+    st.image_crc32 = hdr.image_crc32;
+    st.index       = profile;
+    st.index_inv   = (uint8_t)~profile;
+    st.state_crc32 = mb_crc32_bytes((const uint8_t *)&st,
+                                    sizeof(st) - sizeof(st.state_crc32));
+
+    const uint32_t target_base = ((current_status == MB_MARK_VALID ||
+                                   current_status == MB_MARK_LEGACY) &&
+                                  current_base == MB_PROFILE_STATE_A_BASE)
+                                   ? MB_PROFILE_STATE_B_BASE
+                                   : MB_PROFILE_STATE_A_BASE;
+
+    mb_spi_err = 0;
+    mb_spi_polled_mode();
+    if (!mb_ext_sector_erase(target_base))
+        return MB_ERR_SPI;
+    if (!mb_ext_program(target_base, (const uint8_t *)&st, sizeof(st)))
+        return MB_ERR_SPI;
+
+    /* Verify the new copy directly. The previous valid sector has not been
+     * touched, so any failure here remains power-loss safe. */
+    mb_profile_state_t chk;
+    mb_mark_status_t chk_status = mb_read_profile_copy(target_base, &chk);
+    if (chk_status == MB_MARK_IO)                    return MB_ERR_SPI;
+    if (chk_status != MB_MARK_VALID ||
+        memcmp(&chk, &st, sizeof(st)) != 0)           return MB_ERR_CRC;
+
+    return MB_OK;
+}
+
+uint8_t MB_ProfileErase(uint8_t profile)
+{
+    /* Profile 0 (the base config) is not resettable from the host: reset it by
+     * factory-resetting the running base firmware instead. Profiles 1..N live
+     * in their own 64 KiB banks, clear of the shared calibration at 0x010000. */
+    if (profile == 0 || profile >= MB_PROFILE_COUNT)
+        return MB_ERR_SLOT;
+
+    const uint32_t base = MB_ProfileBase(profile);
+
+    /* Invalidate before the first raw erase so an early failure cannot leave a
+     * cache entry referring to a sector that was already erased. */
+    PY25Q16_InvalidateCache();
+
+    mb_spi_err = 0;
+    mb_spi_polled_mode();
+    for (uint32_t off = 0; off < MB_PROFILE_BANK_SIZE; off += MB_EXT_SECTOR)
+        if (!mb_ext_sector_erase(base + off))
+            return MB_ERR_SPI;
+
+    return MB_OK;
+}
+
+/* -------------------------------------------------------------------------- */
+/* Slot 0 self-backup (base firmware).                                        */
+/* -------------------------------------------------------------------------- */
+
+/* Bounded copy of a NUL-terminated string into a fixed field, zero-padded. */
+static void mb_copy_str(char *dst, uint8_t cap, const char *src)
+{
+    uint8_t n = 0;
+    while (n + 1u < cap && src[n])
+    {
+        dst[n] = src[n];
+        n++;
+    }
+    while (n < cap)
+        dst[n++] = 0;
+}
+
+/* CRC-32 (zlib) of the internal application flash, which is memory-mapped so
+ * no SPI is involved. Same polynomial as the external slot CRC. */
+static uint32_t mb_int_image_crc32(uint32_t len)
+{
+    const uint8_t *p = (const uint8_t *)MB_INT_APP_BASE;
+    return mb_crc32_bytes(p, len);
+}
+
+static bool mb_internal_matches(uint32_t image_size, uint32_t image_crc32)
+{
+    return mb_int_image_crc32(image_size) == image_crc32;
+}
+
+mb_fw_match_t MB_InternalMatchesSlot(uint8_t slot)
+{
+    mb_slot_header_t hdr;
+    uint8_t err = mb_read_header(slot, &hdr);
+
+    if (err == MB_ERR_SPI)
+        return MB_FW_IO;         /* couldn't read the header: never conclude mismatch */
+    if (err != MB_OK)
+        return MB_FW_MISMATCH;   /* no valid header: definitely not this firmware */
+
+    return mb_internal_matches(hdr.image_size, hdr.image_crc32)
+             ? MB_FW_MATCH : MB_FW_MISMATCH;
+}
+
+bool MB_InternalMatchesProfile(const mb_profile_state_t *state)
+{
+    if (!state || state->image_size == 0u || state->image_size > MB_INT_APP_SIZE)
+        return false;
+    return mb_internal_matches(state->image_size, state->image_crc32);
+}
+
+uint8_t MB_BackupInternalToSlot0(mb_progress_fn progress)
+{
+    const uint8_t *img  = (const uint8_t *)MB_INT_APP_BASE;
+    const uint32_t size = MB_INT_APP_SIZE;
+    const uint32_t base = MB_SLOT0_EXT_BASE + (uint32_t)MB_SLOT_BACKUP * MB_SLOT_STRIDE;
+
+    mb_spi_err = 0;
+    mb_spi_polled_mode();
+
+    /* Erase the header sector + image area (rounded up to 4 KiB sectors). */
+    for (uint32_t off = 0; off < MB_SLOT_IMG_OFFSET + size; off += MB_EXT_SECTOR)
+        if (!mb_ext_sector_erase(base + off))
+            return MB_ERR_SPI;
+
+    /* Program the whole internal application region verbatim, in chunks,
+     * reporting progress. It is an exact copy of what executes, so restoring
+     * it later reproduces the running firmware bit-for-bit. */
+    for (uint32_t done = 0; done < size; )
+    {
+        uint32_t n = (size - done < MB_EXT_SECTOR) ? (size - done) : MB_EXT_SECTOR;
+        if (!mb_ext_program(base + MB_SLOT_IMG_OFFSET + done, img + done, n))
+            return MB_ERR_SPI;
+        done += n;
+        if (progress)
+            progress(done, size);
+    }
+
+    /* Validate the stored image before committing its header. Until that final
+     * header write the slot remains invalid, so a failed CRC or interrupted
+     * backup is guaranteed to retry at the next boot. */
+    const uint32_t image_crc = mb_int_image_crc32(size);
+    uint32_t ext_crc = mb_ext_image_crc32(base + MB_SLOT_IMG_OFFSET, size);
+    if (mb_spi_err)                return MB_ERR_SPI;
+    if (ext_crc != image_crc)      return MB_ERR_CRC;
+
+    /* Write the COMMITTED header only after the external image verified. */
+    mb_slot_header_t hdr;
+    memset(&hdr, 0, sizeof(hdr));
+    hdr.magic       = MB_SLOT_MAGIC;
+    hdr.hdr_version = MB_HDR_VERSION;
+    hdr.flags       = MB_FLAG_COMMITTED;
+    hdr.image_size  = size;
+    hdr.image_crc32 = image_crc;
+    mb_copy_str(hdr.name, MB_NAME_LEN, EDITION_STRING);
+    mb_copy_str(hdr.fw_version, MB_VERSION_LEN, VERSION_STRING_2);
+
+    if (!mb_ext_program(base, (const uint8_t *)&hdr, sizeof(hdr)))
+        return MB_ERR_SPI;
+
+    return MB_OK;
+}

App/driver/mb_flash.h

@@ -43,11 +43,15 @@
 #define MB_INT_APP_SIZE     0x0001D800u   /* 118 KiB */
 
 /* External SPI flash slot layout (see docs/multiboot-design.md).
- * Each 128 KiB slot = one header sector (4 KiB) followed by the image. */
+ * Each 128 KiB slot = one header sector (4 KiB) followed by the image.
+ * Slot 0 is the firmware-managed BACKUP of the normally-flashed firmware
+ * (written by MB_BackupInternalToSlot0, protected from host writes); slots
+ * 1..4 are the user slots managed from UV Studio. */
 #define MB_SLOT_STRIDE      0x00020000u   /* 128 KiB per slot            */
 #define MB_SLOT_IMG_OFFSET  0x00001000u   /* image starts after header sector */
-#define MB_SLOT0_EXT_BASE   0x00020000u   /* slot 0 header base           */
-#define MB_SLOT_COUNT       4u
+#define MB_SLOT0_EXT_BASE   0x00020000u   /* slot 0 (backup) header base  */
+#define MB_SLOT_COUNT       5u            /* slot 0 backup + slots 1..4   */
+#define MB_SLOT_BACKUP      0u            /* slot 0 = firmware base backup */
 
 /* Slot header (stored at the slot base, first 4 KiB sector). 64 bytes. */
 #define MB_SLOT_MAGIC       0x31424D46u   /* "FMB1" */
@@ -104,4 +108,125 @@ uint8_t MB_SlotInfo(uint8_t slot, mb_slot_header_t *out_header);
 uint8_t MB_SlotErase(uint8_t slot);
 uint8_t MB_SlotWrite(uint8_t slot, uint32_t offset, const uint8_t *data, uint32_t len);
 
+/* -------------------------------------------------------------------------- */
+/* Per-profile settings banks.                                                */
+/*                                                                            */
+/* Each firmware slot gets its own copy of the user configuration (memory     */
+/* channels, names, VFOs, settings) so switching firmware no longer shares -  */
+/* or silently clobbers - settings between editions. The banking itself is a  */
+/* single address offset applied in the flash driver (see                     */
+/* PY25Q16_SetProfileBase); everything below PY25Q16_PROFILE_SHARED_FROM      */
+/* (0x010000, the calibration boundary) is per-profile, everything at/above   */
+/* stays shared. Slot N is bound to profile N. Profile 0 (slot 0 = base       */
+/* backup) reuses the historical config region at 0x000000 - no migration.    */
+/*                                                                            */
+/* External SPI flash (PY25Q16, 2 MiB) map:                                   */
+/*   0x000000  profile 0 config  (channels/settings)  ] per-profile           */
+/*   0x010000  calibration (512 B)                     ] shared               */
+/*   0x011000  boot logo (4 KiB)                       ] shared               */
+/*   0x020000  slot 0 firmware  (BACKUP, 128 KiB)      ] firmware-managed      */
+/*   0x040000  slot 1 firmware  (128 KiB)              ]                       */
+/*   0x060000  slot 2 firmware                         ] user (UV Studio)      */
+/*   0x080000  slot 3 firmware                         ]                       */
+/*   0x0A0000  slot 4 firmware                         ]                       */
+/*   0x0C0000  profile 1 config  (64 KiB)              ]                       */
+/*   0x0D0000  profile 2 config  (64 KiB)              ] per-profile           */
+/*   0x0E0000  profile 3 config  (64 KiB)              ]                       */
+/*   0x0F0000  profile 4 config  (64 KiB)              ]                       */
+/*   0x100000  multiboot state A (4 KiB marker)        ] shared               */
+/*   0x101000  multiboot state B (4 KiB marker)        ] redundant            */
+/*   0x102000  -- free ~888 KiB --                                            */
+/*   0x1E0000  RX/TX log (32 KiB)                       ] shared               */
+/*                                                                            */
+/* Banks are 64 KiB for headroom; the live config footprint is ~44 KiB (max   */
+/* physical config address 0x00A170). Keep the profile banks past the last    */
+/* slot if MB_SLOT_COUNT ever grows.                                          */
+
+#define MB_PROFILE_COUNT        MB_SLOT_COUNT     /* one profile per slot (0..4) */
+#define MB_PROFILE_BANK_SIZE    0x00010000u       /* 64 KiB per config bank      */
+#define MB_PROFILE1_EXT_BASE    0x000C0000u       /* profiles 1..4, right after slot 4 */
+#define MB_PROFILE_STATE_A_BASE 0x00100000u       /* redundant marker sector A */
+#define MB_PROFILE_STATE_B_BASE 0x00101000u       /* redundant marker sector B */
+
+/* Active-profile marker: two alternating external-flash sectors, never banked,
+ * outside the EEPROM logical map. A new record is verified in the inactive
+ * sector before it supersedes the previous one, so a power loss always leaves
+ * at least one usable state. The expected firmware identity is stored here as
+ * well: boot resolution never depends on the slot header remaining readable. */
+#define MB_PROFILE_LEGACY_MAGIC 0x31504D46u       /* "FMP1" (single 8-byte record) */
+#define MB_PROFILE_MAGIC        0x32504D46u       /* "FMP2" (redundant identity record) */
+typedef struct __attribute__((packed)) {
+    uint32_t magic;        /* MB_PROFILE_MAGIC                         */
+    uint32_t generation;   /* monotonically increasing record version */
+    uint32_t image_size;   /* expected internal image size             */
+    uint32_t image_crc32;  /* expected internal image CRC-32            */
+    uint8_t  index;        /* active profile 0..MB_PROFILE_COUNT-1     */
+    uint8_t  index_inv;    /* ~index, quick integrity check            */
+    uint8_t  reserved[2];  /* fixed zero for deterministic state CRC   */
+    uint32_t state_crc32;  /* CRC-32 over all preceding fields          */
+} mb_profile_state_t;
+
+/* External-flash base of a profile's config bank. Profile 0 -> 0 (historical
+ * region, identity map); profiles 1..N -> past the slots. Out-of-range -> 0. */
+uint32_t MB_ProfileBase(uint8_t profile);
+
+/* Result of reading the active-profile marker. A boot must treat these very
+ * differently: MISSING = fresh radio (adopting the running firmware as Main is
+ * fine); IO / CORRUPT = uncertain (must NOT overwrite Main). */
+typedef enum {
+    MB_MARK_VALID = 0,   /* read OK, well-formed; *state populated       */
+    MB_MARK_LEGACY,      /* valid FMP1 index; identity not stored        */
+    MB_MARK_MISSING,     /* read OK but both sectors erased            */
+    MB_MARK_CORRUPT,     /* read OK but magic/integrity bad            */
+    MB_MARK_IO,          /* could not be read (SPI error)              */
+} mb_mark_status_t;
+
+/* Read the newest valid active-profile marker, distinguishing the states above. */
+mb_mark_status_t MB_ReadActiveProfile(mb_profile_state_t *state);
+
+/* Convenience wrapper for non-critical callers (e.g. cursor pre-selection):
+ * the valid index, or 0 for anything not cleanly VALID. */
+uint8_t MB_GetActiveProfile(void);
+
+/* Write the active-profile marker into the inactive redundant sector and read it
+ * back to confirm it landed. The previous valid record is kept intact. The slot
+ * header supplies the expected internal firmware identity. */
+uint8_t MB_SetActiveProfile(uint8_t profile);
+
+/* Erase a profile's whole config bank (host "Reset config" for a user slot):
+ * the next boot on that slot reads 0xFF and re-seeds factory defaults. Profile 0
+ * (the base) is refused - reset it by factory-resetting the base firmware.
+ * External flash only, never brick-critical. */
+uint8_t MB_ProfileErase(uint8_t profile);
+
+/* -------------------------------------------------------------------------- */
+/* Slot 0 self-backup (base firmware).                                        */
+/* -------------------------------------------------------------------------- */
+
+/* Progress callback for the (slow) slot-0 self-backup; may be NULL. */
+typedef void (*mb_progress_fn)(uint32_t done, uint32_t total);
+
+/* Does the running internal firmware carry the DECLARED identity of `slot`
+ * (CRC32 over image_size == the slot header's image_crc32)? This checks the
+ * header's claim, not the stored image itself (that is validated once, right
+ * after a backup). IO is reported separately so a transient SPI error is never
+ * mistaken for a mismatch - which would wrongly trigger a self-backup over Main. */
+typedef enum {
+    MB_FW_MATCH = 0,   /* internal carries this slot's declared identity */
+    MB_FW_MISMATCH,    /* reliably not this slot (or slot has no header)  */
+    MB_FW_IO,          /* slot header unreadable: uncertain               */
+} mb_fw_match_t;
+
+mb_fw_match_t MB_InternalMatchesSlot(uint8_t slot);
+
+/* Compare internal flash with the identity stored in a validated marker. */
+bool MB_InternalMatchesProfile(const mb_profile_state_t *state);
+
+/* Back up the running internal firmware into slot 0 (erase + full image +
+ * COMMITTED header, name=edition, version) and validate the stored image by a
+ * full external CRC read-back. External flash only, never brick-critical; a
+ * failure (SPI or CRC) leaves the slot uncommitted and does not advance the
+ * marker, so boot resolution retries it. progress may be NULL. */
+uint8_t MB_BackupInternalToSlot0(mb_progress_fn progress);
+
 #endif /* DRIVER_MB_FLASH_H */

App/driver/py25q16.c

@@ -47,6 +47,30 @@ static uint8_t SectorCache[SECTOR_SIZE];
 static uint8_t BlackHole[4] __attribute__((aligned(4)));
 static volatile bool TC_Flag;
 
+#ifdef ENABLE_FEAT_F4HWN_MULTIBOOT
+/* Active settings-profile base (see py25q16.h). 0 = profile 0 / historical
+ * config region, i.e. an identity mapping. */
+static uint32_t ProfileBase = 0;
+
+void PY25Q16_SetProfileBase(uint32_t Base)
+{
+    ProfileBase = Base;
+}
+
+/* Redirect config-region accesses (addr < boundary) into the active bank.
+ * Calibration/logo/slots/marker (addr >= boundary) are returned unchanged.
+ * ProfileBase is sector-aligned, so alignment done by callers is preserved. */
+static inline uint32_t ProfileMap(uint32_t Address)
+{
+    return (Address < PY25Q16_PROFILE_SHARED_FROM) ? (Address + ProfileBase) : Address;
+}
+#else
+static inline uint32_t ProfileMap(uint32_t Address)
+{
+    return Address;
+}
+#endif
+
 static inline void CS_Assert()
 {
     GPIO_ResetOutputPin(CS_PIN);
@@ -222,6 +246,7 @@ static void WriteEnable();
 static void SectorErase(uint32_t Addr);
 static void SectorProgram(uint32_t Addr, const uint8_t *Buf, uint32_t Size);
 static void PageProgram(uint32_t Addr, const uint8_t *Buf, uint32_t Size);
+static void ReadBufferRaw(uint32_t Address, void *pBuffer, uint32_t Size);
 
 void PY25Q16_Init()
 {
@@ -229,7 +254,7 @@ void PY25Q16_Init()
     SPI_Init();
 }
 
-void PY25Q16_ReadBuffer(uint32_t Address, void *pBuffer, uint32_t Size)
+static void ReadBufferRaw(uint32_t Address, void *pBuffer, uint32_t Size)
 {
     MBMARK("RD cmd");          // about to assert CS + send read command
     CS_Assert();
@@ -259,6 +284,11 @@ void PY25Q16_ReadBuffer(uint32_t Address, void *pBuffer, uint32_t Size)
     CS_Release();
 }
 
+void PY25Q16_ReadBuffer(uint32_t Address, void *pBuffer, uint32_t Size)
+{
+    ReadBufferRaw(ProfileMap(Address), pBuffer, Size);
+}
+
 // Like PY25Q16_ReadBuffer, but waits for the flash to be idle first (WIP=0),
 // exactly as PY25Q16_WriteBuffer does before its internal reads. A standalone
 // read issued while the chip is still busy from a prior program/erase never
@@ -273,6 +303,8 @@ void PY25Q16_ReadBufferSafe(uint32_t Address, void *pBuffer, uint32_t Size)
 
 void PY25Q16_WriteBuffer(uint32_t Address, const void *pBuffer, uint32_t Size, bool Append)
 {
+    Address = ProfileMap(Address);   /* map once; internal reads use *Raw below */
+
 #ifdef DEBUG
     printf("spi flash write: %06x %ld %d\n", Address, Size, Append);
 #endif
@@ -298,7 +330,9 @@ void PY25Q16_WriteBuffer(uint32_t Address, const void *pBuffer, uint32_t Size, b
 
         if (SecAddr != SectorCacheAddr)
         {
-            PY25Q16_ReadBuffer(SecAddr, SectorCache, SECTOR_SIZE);
+            /* SecAddr is already in mapped space (Address was mapped above), so
+             * read raw to avoid mapping a second time. */
+            ReadBufferRaw(SecAddr, SectorCache, SECTOR_SIZE);
             SectorCacheAddr = SecAddr;
         }
 
@@ -358,6 +392,7 @@ void PY25Q16_WriteBuffer(uint32_t Address, const void *pBuffer, uint32_t Size, b
 
 void PY25Q16_SectorErase(uint32_t Address)
 {
+    Address = ProfileMap(Address);
     Address -= (Address % SECTOR_SIZE);
     SectorErase(Address);
     if (SectorCacheAddr == Address)
@@ -366,6 +401,13 @@ void PY25Q16_SectorErase(uint32_t Address)
     }
 }
 
+void PY25Q16_InvalidateCache(void)
+{
+    /* Same "no sector cached" sentinel as the initial value: the next write
+     * re-reads its sector from flash instead of trusting SectorCache. */
+    SectorCacheAddr = 0x1000000;
+}
+
 static inline void WriteAddr(uint32_t Addr)
 {
     SPI_WriteByte(0xff & (Addr >> 16));

App/driver/py25q16.h

@@ -26,4 +26,33 @@ void PY25Q16_ReadBufferSafe(uint32_t Address, void *pBuffer, uint32_t Size);
 void PY25Q16_WriteBuffer(uint32_t Address, const void *pBuffer, uint32_t Size, bool Append);
 void PY25Q16_SectorErase(uint32_t Address);
 
+/* Drop the internal single-sector write cache. Call after erasing/programming
+ * flash behind the driver's back (e.g. the raw multiboot slot/profile ops) so a
+ * later write cannot skip or resurrect data based on a stale cached sector. */
+void PY25Q16_InvalidateCache(void);
+
+#ifdef ENABLE_FEAT_F4HWN_MULTIBOOT
+/*
+ * Multiboot per-profile config banking.
+ *
+ * Each firmware slot owns a private copy of the user configuration (memory
+ * channels, names, VFOs, settings). A non-zero profile base transparently
+ * shifts every flash access BELOW PY25Q16_PROFILE_SHARED_FROM into the active
+ * profile's bank; calibration, boot logo, firmware slots and the multiboot
+ * marker all live at/above that boundary and stay shared across every profile.
+ *
+ * This is the single choke point: both the EEPROM emulation (eeprom_compat.c)
+ * and the firmware's direct config reads/writes (settings.c) end up here, so
+ * one offset covers them all - no per-call-site patching.
+ *
+ * Set once at boot, before any settings read, from
+ *   PY25Q16_SetProfileBase(MB_ProfileBase(MB_BootResolveProfile()));
+ * and never changed again during a session (the profile only changes through a
+ * reflash + reset), so the banking itself never needs a cache flush. Raw profile
+ * erases behind the driver explicitly call PY25Q16_InvalidateCache().
+ */
+#define PY25Q16_PROFILE_SHARED_FROM  0x00010000u   /* calibration boundary (see flash map) */
+void PY25Q16_SetProfileBase(uint32_t Base);
+#endif
+
 #endif