main.c

Go to the documentation of this file.

 
#include <stddef.h>
#include <stdint.h>
#include <string.h>
 
#include "ra8_board_ek_ra8d2.h"
#include "ra8_boot_entry.h"
#include "ra8_cgc.h"
#include "ra8_check.h"
#include "ra8_err.h"
#include "ra8_flash.h"
#include "ra8_ota.h"
#include "ra8_rsip.h"
#include "ra8_secure.h"
 
/* -------------------------------------------------------------------------- */
/* Tunables (no magic numbers -- every literal is a typed enum / const) */
/* -------------------------------------------------------------------------- */

typedef enum : uint32_t {
  k_app_uart_baud       = 115200U,     
  k_app_image_bytes     = 256U,        
  k_app_bank_size_bytes = 4096U,       
  k_app_report_delay    = 4000000U,    
  k_app_bootsel_magic   = 0xB007A8B1U, 
  k_app_demo_pubkey     = 0x0A8D2C0DU, 
} app_const_t;

typedef enum : uintptr_t {
  k_app_bank_addr = k_ra8_flash_extra_start, 
  k_app_bootsel_addr =
    k_ra8_flash_extra_start + 0x2000U, 
} app_mram_addr_t;

typedef enum : uint8_t {
  k_app_bank_a = 0U, 
  k_app_bank_b = 1U, 
} app_bank_t;

typedef enum : uint8_t {
  k_app_mram_block_bytes = 32U, 
  k_app_sig_bytes        = 32U, 
  k_app_rec_off_magic    = 0U,  
  k_app_rec_off_bank     = 4U,  
  k_app_rec_off_seq      = 5U,  
  k_app_octet_bits       = 8U,  
} app_size_t;

typedef enum : uint16_t {
  k_app_mrcfreq_mhz = 200U, 
  k_app_mrefreq_mhz = 100U, 
} app_flash_freq_t;

typedef enum : uint8_t {
  k_app_img_seed_mul  = 7U,    
  k_app_img_seed_add  = 3U,    
  k_app_sig_tag_base  = 0xA5U, 
  k_app_byte_all_ones = 0xFFU, 
} app_pattern_t;

typedef enum : uint8_t {
  k_app_outcome_committed     = 0U, 
  k_app_outcome_rolled_back   = 1U, 
  k_app_outcome_indeterminate = 2U, 
} app_outcome_t;

static const char* const s_tag = "ota_ab";
 
/* -------------------------------------------------------------------------- */
/* Local image source (stands in for a TLS download) */
/* -------------------------------------------------------------------------- */

typedef struct {
  const uint8_t* data; 
  uint32_t       len;  
  uint32_t       pos;  
} app_net_source_t;

static app_net_source_t s_net_source;

static ra8_rsip_sha256_ctx_t s_sha_ctx;

static uint32_t s_bootsel_seq = 0U;

static uint8_t s_image_good[k_app_image_bytes];

static uint8_t s_image_bad[k_app_image_bytes];

static uint8_t s_image_good_digest[k_ra8_ota_sha256_bytes];
 
/* -------------------------------------------------------------------------- */
/* Console helpers */
/* -------------------------------------------------------------------------- */

static size_t app_strlen(const char* text)
{
  size_t n = 0U;
  while (n < (size_t)k_app_bank_size_bytes) {
    if (text[n] == '\0') {
      break;
    }
    ++n;
  }
  return n;
}

static void app_print(const char* text)
{
  if (text == nullptr) {
    return;
  }
  (void)ra8_board_uart_console_write((const uint8_t*)text, app_strlen(text));
}
 
/* -------------------------------------------------------------------------- */
/* OTA net interface (local image source) */
/* -------------------------------------------------------------------------- */

static ra8_err_t app_net_open(void* ctx, const char* url, uint32_t* out_content_len)
{
  (void)url;
  RA8_CHECK_NULL_PTR(ctx, s_tag, "net.open ctx");
  RA8_CHECK_NULL_PTR(out_content_len, s_tag, "net.open out_len");
  app_net_source_t* src = (app_net_source_t*)ctx;
  src->pos              = 0U;
  *out_content_len      = src->len;
  return k_ra8_ok;
}

static ra8_err_t app_net_read(void* ctx, uint8_t* dst, uint32_t cap, uint32_t* out_len)
{
  RA8_CHECK_NULL_PTR(ctx, s_tag, "net.read ctx");
  RA8_CHECK_NULL_PTR(dst, s_tag, "net.read dst");
  RA8_CHECK_NULL_PTR(out_len, s_tag, "net.read out_len");
  app_net_source_t* src       = (app_net_source_t*)ctx;
  const uint32_t    remaining = src->len - src->pos;
  const uint32_t    n         = (remaining < cap) ? remaining : cap;
  if (n > 0U) {
    (void)memcpy(dst, &src->data[src->pos], n);
    src->pos += n;
  }
  *out_len = n;
  return k_ra8_ok;
}

/* cppcheck-suppress constParameterCallback ; ctx must stay non-const to match
 * the ra8_ota_net_iface_t.close function-pointer signature. */
static ra8_err_t app_net_close(void* ctx)
{
  RA8_CHECK_NULL_PTR(ctx, s_tag, "net.close ctx");
  return k_ra8_ok;
}
 
/* -------------------------------------------------------------------------- */
/* OTA crypto interface (real software SHA-256 + demo authenticity) */
/* -------------------------------------------------------------------------- */

static ra8_err_t app_sha_init(void* ctx)
{
  RA8_CHECK_NULL_PTR(ctx, s_tag, "sha.init ctx");
  return ra8_rsip_sha256_init((ra8_rsip_sha256_ctx_t*)ctx);
}

static ra8_err_t app_sha_update(void* ctx, const uint8_t* data, uint32_t len)
{
  RA8_CHECK_NULL_PTR(ctx, s_tag, "sha.update ctx");
  return ra8_rsip_sha256_update((ra8_rsip_sha256_ctx_t*)ctx, data, len);
}

static ra8_err_t app_sha_final(void* ctx, uint8_t out[k_ra8_ota_sha256_bytes])
{
  RA8_CHECK_NULL_PTR(ctx, s_tag, "sha.final ctx");
  RA8_CHECK_NULL_PTR(out, s_tag, "sha.final out");
  return ra8_rsip_sha256_final((ra8_rsip_sha256_ctx_t*)ctx, out);
}

static ra8_err_t app_ecdsa_verify(void*          ctx,
                                  uint32_t       pubkey,
                                  const uint8_t  bound[k_ra8_ota_sha256_bytes],
                                  const uint8_t* sig,
                                  uint32_t       sig_len)
{
  (void)ctx;
  (void)bound;
  RA8_CHECK_NULL_PTR(sig, s_tag, "ecdsa.sig");
  if ((pubkey != (uint32_t)k_app_demo_pubkey) || (sig_len != (uint32_t)k_app_sig_bytes)) {
    return k_ra8_err_hw_error;
  }
  return k_ra8_ok;
}
 
/* -------------------------------------------------------------------------- */
/* OTA flash interface (real extra-MRAM driver) */
/* -------------------------------------------------------------------------- */

static ra8_err_t app_flash_erase(void* ctx, uint32_t addr, uint32_t len)
{
  (void)ctx;
  for (uint32_t off = 0U; off < len; off += (uint32_t)k_app_mram_block_bytes) {
    const ra8_err_t e = ra8_flash_extra_mram_erase(addr + off);
    if (e != k_ra8_ok) {
      return e;
    }
  }
  return k_ra8_ok;
}

static ra8_err_t app_flash_program(void* ctx, uint32_t addr, const uint8_t* src, uint32_t len)
{
  (void)ctx;
  RA8_CHECK_NULL_PTR(src, s_tag, "flash.program src");
  for (uint32_t off = 0U; off < len; off += (uint32_t)k_app_mram_block_bytes) {
    const uint32_t remaining = len - off;
    const uint32_t n =
      (remaining < (uint32_t)k_app_mram_block_bytes) ? remaining : (uint32_t)k_app_mram_block_bytes;
    const ra8_err_t e = ra8_flash_extra_mram_write(addr + off, &src[off], n);
    if (e != k_ra8_ok) {
      return e;
    }
  }
  return k_ra8_ok;
}

static ra8_err_t app_flash_readback(void* ctx, uint32_t addr, uint8_t* dst, uint32_t len)
{
  (void)ctx;
  RA8_CHECK_NULL_PTR(dst, s_tag, "flash.readback dst");
  (void)memcpy(dst, (const void*)(uintptr_t)addr, (size_t)len);
  return k_ra8_ok;
}

static ra8_err_t app_write_bootsel(uint8_t bank)
{
  uint8_t rec[k_app_mram_block_bytes] = {};
  for (uint8_t i = 0U; i < (uint8_t)k_app_rec_off_bank; ++i) {
    rec[(uint8_t)k_app_rec_off_magic + i] =
      (uint8_t)((uint32_t)k_app_bootsel_magic >> ((uint32_t)i * (uint32_t)k_app_octet_bits));
  }
  rec[k_app_rec_off_bank] = bank;
  ++s_bootsel_seq;
  for (uint8_t i = 0U; i < (uint8_t)k_app_rec_off_bank; ++i) {
    rec[(uint8_t)k_app_rec_off_seq + i] =
      (uint8_t)(s_bootsel_seq >> ((uint32_t)i * (uint32_t)k_app_octet_bits));
  }
  const ra8_err_t e = ra8_flash_extra_mram_erase((uint32_t)k_app_bootsel_addr);
  if (e != k_ra8_ok) {
    return e;
  }
  return ra8_flash_extra_mram_write((uint32_t)k_app_bootsel_addr, rec, (uint32_t)sizeof rec);
}

static ra8_err_t app_flash_set_startup(void* ctx, uint8_t which_bank, bool persistent)
{
  (void)ctx;
  (void)persistent;
  return app_write_bootsel(which_bank);
}

static ra8_err_t app_read_bootsel(uint8_t* out_bank, bool* out_valid)
{
  RA8_CHECK_NULL_PTR(out_bank, s_tag, "bootsel out_bank");
  RA8_CHECK_NULL_PTR(out_valid, s_tag, "bootsel out_valid");
  const uint8_t* rec   = (const uint8_t*)(uintptr_t)k_app_bootsel_addr;
  uint32_t       magic = 0U;
  for (uint8_t i = 0U; i < (uint8_t)k_app_rec_off_bank; ++i) {
    magic |= ((uint32_t)rec[(uint8_t)k_app_rec_off_magic + i])
             << ((uint32_t)i * (uint32_t)k_app_octet_bits);
  }
  *out_valid = (magic == (uint32_t)k_app_bootsel_magic);
  *out_bank  = rec[k_app_rec_off_bank];
  return k_ra8_ok;
}
 
/* -------------------------------------------------------------------------- */
/* Pure A/B decision logic (unit-tested with MC/DC) */
/* -------------------------------------------------------------------------- */

static app_outcome_t app_ab_classify(ra8_err_t result, ra8_ota_state_t state)
{
  if ((result == k_ra8_ok) && (state == k_ra8_ota_state_done)) {
    return k_app_outcome_committed;
  }
  if ((result != k_ra8_ok) && (state == k_ra8_ota_state_error)) {
    return k_app_outcome_rolled_back;
  }
  return k_app_outcome_indeterminate;
}

static bool app_ab_ok(bool committed, bool rolled_back)
{
  return committed && rolled_back;
}
 
/* -------------------------------------------------------------------------- */
/* Scenario driver + manifest construction */
/* -------------------------------------------------------------------------- */

static void app_make_cfg(ra8_ota_cfg_t* cfg)
{
  (void)memset(cfg, 0, sizeof *cfg);
  (void)memcpy(cfg->manifest_url,
               "local://demo/manifest",
               app_strlen("local://demo/manifest") + 1U);
  cfg->pubkey_handle = (uint32_t)k_app_demo_pubkey;
 
  cfg->net.open  = app_net_open;
  cfg->net.read  = app_net_read;
  cfg->net.close = app_net_close;
  cfg->net.ctx   = &s_net_source;
 
  cfg->crypto.sha256_init   = app_sha_init;
  cfg->crypto.sha256_update = app_sha_update;
  cfg->crypto.sha256_final  = app_sha_final;
  cfg->crypto.ecdsa_verify  = app_ecdsa_verify;
  cfg->crypto.ctx           = &s_sha_ctx;
 
  cfg->flash.erase               = app_flash_erase;
  cfg->flash.program             = app_flash_program;
  cfg->flash.set_startup         = app_flash_set_startup;
  cfg->flash.readback            = app_flash_readback;
  cfg->flash.inactive_bank_addr  = (uint32_t)k_app_bank_addr;
  cfg->flash.bank_size_bytes     = (uint32_t)k_app_bank_size_bytes;
  cfg->flash.inactive_bank_index = (uint8_t)k_app_bank_b;
  cfg->flash.ctx                 = nullptr;
}

static void app_make_manifest(ra8_ota_manifest_t* m)
{
  (void)memset(m, 0, sizeof *m);
  (void)memcpy(m->version, "1.0.1", app_strlen("1.0.1") + 1U);
  (void)memcpy(m->image_url, "local://demo/app.bin", app_strlen("local://demo/app.bin") + 1U);
  m->image_size_bytes = (uint32_t)k_app_image_bytes;
  (void)memcpy(m->image_sha256, s_image_good_digest, sizeof m->image_sha256);
  /* Demo authenticity tag: a fixed full-width pattern the demo verifier
   * accepts. TODO(real ECDSA-P256): replace with a server ECDSA signature. */
  for (uint8_t i = 0U; i < (uint8_t)k_app_sig_bytes; ++i) {
    m->signature[i] = (uint8_t)((uint8_t)k_app_sig_tag_base ^ i);
  }
  m->signature_len = (uint16_t)k_app_sig_bytes;
}

static app_outcome_t
app_run_attempt(const uint8_t* source, const ra8_ota_manifest_t* m, uint8_t* out_bank)
{
  *out_bank = (uint8_t)k_app_bank_a;
  if (app_write_bootsel((uint8_t)k_app_bank_a) != k_ra8_ok) {
    return k_app_outcome_indeterminate;
  }
  s_net_source.data = source;
  s_net_source.len  = (uint32_t)k_app_image_bytes;
  s_net_source.pos  = 0U;
 
  ra8_ota_cfg_t cfg;
  app_make_cfg(&cfg);
  (void)ra8_ota_deinit();
  if (ra8_ota_init(&cfg) != k_ra8_ok) {
    return k_app_outcome_indeterminate;
  }
 
  ra8_err_t result = ra8_ota_download_to_inactive_bank(m);
  if (result == k_ra8_ok) {
    result = ra8_ota_verify_signature(m);
  }
  if (result == k_ra8_ok) {
    result = ra8_ota_commit_and_reboot();
  }
  const ra8_ota_state_t state = ra8_ota_get_state();
 
  bool valid = false;
  (void)app_read_bootsel(out_bank, &valid);
  (void)ra8_ota_deinit();
  return app_ab_classify(result, state);
}
 
/* -------------------------------------------------------------------------- */
/* Setup + banner */
/* -------------------------------------------------------------------------- */

static ra8_err_t app_stage_images(void)
{
  for (uint32_t i = 0U; i < (uint32_t)k_app_image_bytes; ++i) {
    s_image_good[i] = (uint8_t)(i * (uint32_t)k_app_img_seed_mul + (uint32_t)k_app_img_seed_add);
    s_image_bad[i]  = s_image_good[i];
  }
  /* Corrupt the rollback image so its re-hash cannot match the manifest digest
   * -- the "bad download" that must NOT be committed. */
  s_image_bad[0] = (uint8_t)(s_image_good[0] ^ (uint8_t)k_app_byte_all_ones);
  return ra8_rsip_sha256(s_image_good, (uint32_t)k_app_image_bytes, s_image_good_digest);
}

static ra8_err_t app_setup(void)
{
  if (ra8_cgc_init() != k_ra8_ok) {
    return k_ra8_err_hw_error;
  }
  if (ra8_board_uart_console_init((uint32_t)k_app_uart_baud) != k_ra8_ok) {
    return k_ra8_err_hw_error;
  }
  const ra8_flash_cfg_t fcfg = {
    .mrcfreq_mhz        = (uint16_t)k_app_mrcfreq_mhz,
    .mrefreq_mhz        = (uint8_t)k_app_mrefreq_mhz,
    .prefetch_en        = true,
    .ecc_encoder_enable = true,
    .ecc_decoder_enable = true,
  };
  return ra8_flash_init(&fcfg);
}

static void app_print_banner(bool staged, bool committed, bool rolled_back)
{
  app_print("ota_ab: stage=");
  app_print(staged ? "ok" : "fail");
  app_print(" commit=");
  app_print(committed ? "Y" : "N");
  app_print(" rollback=");
  app_print(rolled_back ? "Y" : "N");
  app_print(" ok=");
  app_print(app_ab_ok(committed, rolled_back) ? "Y" : "N");
  app_print("\r\n");
}

void main(void)
{
  if (app_setup() != k_ra8_ok) {
    /* NASA Rule 2 exemption: terminal panic spin on a fatal bring-up error. */
    while (true) {
    }
  }
 
  const bool staged = (app_stage_images() == k_ra8_ok);
 
  bool committed   = false;
  bool rolled_back = false;
  if (staged) {
    ra8_ota_manifest_t m;
    app_make_manifest(&m);
 
    uint8_t             bank_after = (uint8_t)k_app_bank_a;
    const app_outcome_t good       = app_run_attempt(s_image_good, &m, &bank_after);
    committed = (good == k_app_outcome_committed) && (bank_after == (uint8_t)k_app_bank_b);
 
    const app_outcome_t bad = app_run_attempt(s_image_bad, &m, &bank_after);
    rolled_back = (bad == k_app_outcome_rolled_back) && (bank_after == (uint8_t)k_app_bank_a);
  }
 
  (void)app_print("\r\nra8d2 ota_ab_orchestration (A/B stage/verify/commit/rollback)\r\n");
 
  /* NASA Rule 2 exemption: deliberate report loop; the verdict is latched, the
   * banner just repeats so a UART scrape reliably captures it. */
  while (true) {
    app_print_banner(staged, committed, rolled_back);
    for (volatile uint32_t d = 0U; d < (uint32_t)k_app_report_delay; ++d) {
      /* coarse inter-report busy delay (bounded). */
    }
  }
}