42static const char*
const s_tag =
"ra8_ota";
48typedef enum : uint32_t {
78 return (c >= lo) && (c <= hi);
99 uint32_t state_downloading_val,
102 return (state != state_idle_val) && (state != state_downloading_val);
268 const char* p =
strstr(json, key);
277 const char* q =
strchr(p,
'"');
281 const uint32_t n = (uint32_t)(q - p);
318 const char* p =
strstr(json, key);
325 if (*p ==
':' || *p ==
' ' || *p ==
'"') {
335 if ((c <
'0') || (c >
'9')) {
371 if ((c >=
'0') && (c <=
'9')) {
372 return (uint8_t)(c -
'0');
374 if ((c >=
'a') && (c <=
'f')) {
409 const uint32_t in_len = (uint32_t)
strlen(in);
414 if (bytes > out_cap) {
417 for (uint32_t i = 0U; i < bytes; ++i) {
508 (void)
memset(out, 0,
sizeof *out);
static const char * s_tag
Logging / check tag.
Annotation-attribute framework macros for ra8-firmware.
#define RA8_PRIV
Module-private helper: shared across TUs but only inside one library.
#define RA8_INTERNAL
Marker that a function is intended to be static (file-local).
Validation and Error-Checking Macros for ra8-firmware.
#define RA8_CHECK_NULL_PTR(ptr, tag, message)
Reject nullptr pointer, returning k_ra8_err_null_ptr.
Error Code Definitions for ra8-firmware.
@ k_ra8_err_invalid_arg
Invalid function argument.
@ k_ra8_ok
Success – operation completed with all postconditions satisfied.
@ k_ra8_err_invalid_size
Invalid size parameter (too large, too small, or misaligned).
ra8_err_codes_t ra8_err_t
Canonical error-return type used by every ra8-firmware API.
void * memset(void *dst, int value, size_t n)
Fill memory with a constant byte value.
size_t strlen(const char *s)
Calculate string length.
void * memcpy(void *dst, const void *src, size_t n)
Copy memory area between non-overlapping regions.
char * strstr(const char *haystack, const char *needle)
Locate substring in string.
char * strchr(const char *s, int c)
Locate first occurrence of character in string.
Phase-5 OTA firmware-update orchestration for the RA8D2.
@ k_ra8_ota_url_max_bytes
NUL-terminated URL upper bound.
@ k_ra8_ota_sha256_bytes
SHA-256 digest length.
@ k_ra8_ota_version_str_bytes
NUL-terminated version string.
@ k_ra8_ota_max_image_bytes
512 KiB upper bound per bank.
@ k_ra8_ota_signature_max_bytes
ECDSA-P256 ASN.1 sig upper bound.
Test-access surface for ra8_ota internal helpers (MC/DC).
ra8_ota_internal_const_t
Internal numeric constants used by JSON / hex helpers.
@ k_ra8_ota_hex_chars_per_byte
Two hex chars per encoded byte.
@ k_ra8_ota_hex_nibble_shift
Shift for high nibble in a byte.
@ k_ra8_ota_hex_invalid_nibble
Sentinel for invalid hex nibble.
@ k_ra8_ota_u32_decimal_base
Base for decimal parsing.
@ k_ra8_ota_hex_alpha_offset
Offset added for 'a'..'f'/'A'..'F'.
@ k_ra8_ota_json_skip_max
Max JSON whitespace/quote skip.
@ k_ra8_ota_hex_buf_bytes
Capacity of stack hex buffer.
@ k_ra8_ota_u32_decimal_digits
Max decimal digits in a uint32.
static uint8_t internal_hex_nibble(char c)
Decode a single hex nibble.
bool priv_ota_char_in_range(char c, char lo, char hi)
Pure char-in-range predicate – see header for full contract.
static ra8_err_t internal_validate_cfg_flash(const ra8_ota_cfg_t *cfg)
Validate the flash function-pointer block of cfg.
static ra8_err_t internal_validate_cfg_crypto(const ra8_ota_cfg_t *cfg)
Validate the crypto function-pointer block of cfg.
ra8_err_t priv_ota_manifest_decode(const char *json, ra8_ota_manifest_t *out)
Decode every field of a JSON manifest into an ra8_ota_manifest_t.
static ra8_err_t internal_validate_cfg_net(const ra8_ota_cfg_t *cfg)
Validate the network function-pointer block of cfg.
ra8_err_t priv_ota_validate_cfg(const ra8_ota_cfg_t *cfg)
Validate the entire OTA configuration descriptor.
static ra8_err_t internal_manifest_decode_crypto(const char *json, ra8_ota_manifest_t *out)
Pull the sha256 + signature hex blobs out of a JSON manifest.
ra8_err_t priv_ota_json_u32(const char *json, const char *key, uint32_t *out_v)
Parse a decimal "key": NNN field out of a JSON-ish buffer.
bool priv_ota_download_state_invalid(uint32_t state_idle_val, uint32_t state_downloading_val, uint32_t state)
Pure download-state-invalid predicate – see header for full contract.
static uint32_t internal_hex_decode(const char *in, uint8_t *out, uint32_t out_cap)
Decode a hex string into bytes.
static ra8_err_t internal_json_str(const char *json, const char *key, char *dst, uint32_t cap)
Locate "key" inside a JSON-ish buffer and copy its string value (assumes minimal, well-formed manifes...
Initialisation descriptor for ra8_ota_init.
ra8_ota_crypto_iface_t crypto
Crypto interface (must be fully populated).
char manifest_url[k_ra8_ota_url_max_bytes]
HTTPS URL of the manifest JSON.
ra8_ota_flash_iface_t flash
Flash backend (must be fully populated).
ra8_ota_net_iface_t net
Network HTTPS interface (must be fully populated).
ra8_err_t(* ecdsa_verify)(void *ctx, uint32_t pubkey_handle, const uint8_t digest[k_ra8_ota_sha256_bytes], const uint8_t *sig, uint32_t sig_len)
Verify sig is a valid ECDSA signature over digest using the public key referenced by pubkey_handle.
ra8_err_t(* sha256_final)(void *ctx, uint8_t out[k_ra8_ota_sha256_bytes])
Finalise and write the 32-byte digest to out.
ra8_err_t(* sha256_update)(void *ctx, const uint8_t *data, uint32_t len)
Feed bytes to the running SHA-256 hash.
ra8_err_t(* sha256_init)(void *ctx)
Begin a SHA-256 streaming hash.
ra8_err_t(* program)(void *ctx, uint32_t addr, const uint8_t *src, uint32_t len)
Program len bytes at addr (must be 32-byte aligned).
ra8_err_t(* set_startup)(void *ctx, uint8_t which_bank, bool persistent)
Pick the bank to boot from at the next reset.
uint32_t bank_size_bytes
Size of one bank in bytes.
ra8_err_t(* erase)(void *ctx, uint32_t addr, uint32_t len)
Erase len bytes starting at addr in the inactive bank.
ra8_err_t(* readback)(void *ctx, uint32_t addr, uint8_t *dst, uint32_t len)
Read back len bytes (used by verification re-hash).
Decoded representation of the server manifest.
uint8_t image_sha256[k_ra8_ota_sha256_bytes]
Expected digest.
uint16_t signature_len
Bytes used in signature.
char image_url[k_ra8_ota_url_max_bytes]
HTTPS URL of the image blob.
uint8_t signature[k_ra8_ota_signature_max_bytes]
ECDSA signature over digest.
uint32_t image_size_bytes
Image size on the wire.
char version[k_ra8_ota_version_str_bytes]
Firmware version string.
ra8_err_t(* close)(void *ctx)
Tear the streaming GET down.
ra8_err_t(* open)(void *ctx, const char *url, uint32_t *out_content_len)
Begin a streaming GET against url.
ra8_err_t(* read)(void *ctx, uint8_t *dst, uint32_t cap, uint32_t *out_len)
Read up to cap bytes from the open session.