flasher.cpp

Go to the documentation of this file.

//******************************************************************************
// Flash write/erase functions (TLC/T3x/T4x/TMM), LMEM cache functions for T3.6
//******************************************************************************
// WARNING:  you can destroy your MCU with flash erase or write!
// This code may or may not protect you from that.
//
// Original by Niels A. Moseley, 2015.
// Modifications for OTA updates by Jon Zeeff, Deb Hollenback
// Paul Stoffregen's T4.x flash routines from Teensy4 core added by Jon Zeeff
// Frank Boesing's T3.x flash routines adapted for OTA by Joe Pasquariello
// Largely adapted and rewritten for the Anabrid REDAC infrastructure by SvenK
// This code is released into the public domain.
//******************************************************************************
 
#include "protocol/transport.h"
 
 
#include <Arduino.h> // Serial, etc. (if used)
 
#include <malloc.h> // malloc(), free()
#include <stdint.h> // uint32_t, etc.
#include <string.h> // memset()
 
#include <cstring>
#include <imxrt.h> // SCB_AIRCR
#include <ota/flasher.h>
#include <utils/etl_base64.h>
#include <utils/logging.h>
#include <utils/reboot.h>
 
#include "QNEthernet.h"
#include "redac/calibration.h"
#include "utils/timer.h"
 
void flash_write(void *addr, const void *data, uint32_t len);
void flash_erase_sector(void *addr);
void flash_erase_32K_block(void *addr);
void flash_erase_64K_block(void *addr);
 
#define CPU_RESTART_VAL (0x5FA0004)
#define REBOOT (SCB_AIRCR = CPU_RESTART_VAL)
 
namespace loader {
 
// ── nanopb response helpers ───────────────────────────────────────────────
 
FASTRUN
static void make_ack(pb_UpdateResponse &res) {
  res.which_kind = pb_UpdateResponse_ack_tag;
  res.kind.ack.chunk_size = CHUNK_SIZE;
}
 
FASTRUN
static void make_success(pb_UpdateResponse &res) { res.which_kind = pb_UpdateResponse_success_tag; }
 
FASTRUN
static void make_failure(pb_UpdateResponse &res, const char *reason) {
  res.which_kind = pb_UpdateResponse_failure_tag;
  strncpy(res.kind.failure.reason, reason, sizeof(res.kind.failure.reason) - 1);
  res.kind.failure.reason[sizeof(res.kind.failure.reason) - 1] = '\0';
}
 
// ── State ─────────────────────────────────────────────────────────────────
 
FASTRUN
void Updater::reset_state() {
  m_active = false;
  m_expected_size = 0;
  memset(m_expected_hash.data(), 0, sizeof(m_expected_hash));
}
 
// ── Erase helper (runs from flash — staging is not the app slot) ──────────
 
FASTRUN
__attribute__((always_inline, unused))
static inline void flush(void *addr, uint32_t size)
{
  uint32_t location = (uint32_t)addr & 0xFFFFFFE0;
  uint32_t end_addr = (uint32_t)addr + size;
  asm volatile("": : :"memory");
  asm("dsb");
  do {
    SCB_CACHE_DCCIMVAC = location;
    location += 32;
  } while (location < end_addr);
  asm("dsb");
  asm("isb");
}
 
FASTRUN
void erase_region(uint8_t *base, uint32_t size) {
  uint32_t offset = 0;
  while (offset < size) {
    const uint32_t remaining = size - offset;
    auto *cur = base + offset;
    const uintptr_t addr = reinterpret_cast<uintptr_t>(cur);
 
    if (remaining >= BLOCK_64K && (addr % BLOCK_64K == 0)) {
      flash_erase_64K_block(cur);
      offset += BLOCK_64K;
    } else if (remaining >= BLOCK_32K && (addr % BLOCK_32K == 0)) {
      flash_erase_32K_block(cur);
      offset += BLOCK_32K;
    } else {
      flash_erase_sector(cur);
      offset += SECTOR_SIZE;
    }
  }
}
 
// ── SHA-256 verification ──────────────────────────────────────────────────
 
FASTRUN
bool Updater::verify_hash() const {
  auto *staging = reinterpret_cast<uint32_t *>(STAGING_START_ADDR);
  utils::sha256_t actual_hash;
  utils::hash_sha256((const uint8_t*)staging, m_expected_size, actual_hash.data());
  return actual_hash == m_expected_hash;
}
 
// ── RAM-resident commit: erase app slot, copy staging → app, reboot ───────
//
// CRITICAL: This function must live in RAM. It erases the flash region it
// was loaded from (APP_START_ADDR), so any XIP fetch of its code would fault.
// The linker script must place .ramfunc in DTCM (0x2000_0000).
//
 
FASTRUN
void flash_write_32(uint32_t *dst, const uint32_t *src, uint32_t size){
  for (auto idx = 0; idx < size / 4; ++idx) {
    alignas(4) uint32_t value = src[idx];
    flash_write(dst + idx, &value, 4);
  }
}
 
FASTRUN
void flash_copy(uint32_t *dst, const uint32_t *src, uint32_t size){
  erase_region((uint8_t*)dst, size);
  flash_write_32(dst, src, size);
}
 
 
// ══════════════════════════════════════════════════════════════════════════
// Public API
// ══════════════════════════════════════════════════════════════════════════
 
// begin — validate size, erase staging, store metadata, ack chunk size
FASTRUN
void Updater::begin(const pb_UpdateBegin &req, pb_UpdateResponse &res) {
  if (m_active) {
    // Implicitly abort previous session
    reset_state();
  }
 
  // ── Validate size ────────────────────────────────────────────────────
  if (req.size == 0 || req.size > MAX_FW_SIZE)
    return make_failure(res, "firmware size out of range");
 
  if (req.hash.size != 32)
    return make_failure(res, "invalid hash length");
 
  m_expected_size = static_cast<uint32_t>(req.size);
 
  // ── Erase staging area ───────────────────────────────────────────────
  // This is safe: staging is a different flash region from the running app.
  auto *staging = reinterpret_cast<uint8_t *>(STAGING_START_ADDR);
  // Round up to next full sector boundary for clean erase
  __disable_irq();
  erase_region(staging, m_expected_size);
  __enable_irq();
 
  // ── Store hash ──────────────────────────────────────────────
  memcpy(m_expected_hash.data(), req.hash.bytes, 32);
  m_active = true;
 
  LOGV("BEGIN UPLOAD of %d bytes", m_expected_size);
  make_ack(res);
}
 
// write — validate and write one chunk to staging area
FASTRUN
void Updater::write(const pb_UpdateWrite &req, pb_UpdateResponse &res) {
  if (!m_active)
    return make_failure(res, "upload not active");
 
  auto offset = static_cast<size_t>(req.offset);
  size_t data_len = req.data.size;
  auto src = req.data.bytes;
 
  // ── Validate chunk ───────────────────────────────────────────────────
  if (data_len == 0)
    return make_failure(res, "empty chunk size");
 
  if (offset + data_len > m_expected_size)
    return make_failure(res, "chunk exceeds declared firmware size");
 
  std::memcpy(m_buffer, src, data_len);
 
  // ── Write to staging ─────────────────────────────────────────────────
  auto *src_buffer = reinterpret_cast<uint32_t *>(m_buffer);
  auto *dst = reinterpret_cast<uint32_t *>(STAGING_START_ADDR + offset);
 
  __disable_irq();
  flash_write_32(dst, src_buffer, data_len);
  __enable_irq();
 
  make_success(res);
}
 
// end — verify hash, then commit staging → app and reboot
FASTRUN
void Updater::commit(const pb_UpdateCommit & /*req*/, pb_UpdateResponse &res, const std::function<void()> &&success) {
  if (!m_active)
    return make_failure(res, "upload not active");
 
  // ── Verify SHA-256 over staged firmware ──────────────────────────────
  if (!verify_hash())
    return make_failure(res, "hash mismatch");
 
  success();
  __disable_irq();
  auto *app = reinterpret_cast<uint32_t *>(APP_START_ADDR);
  auto *staging = reinterpret_cast<uint32_t *>(STAGING_START_ADDR);
  flash_copy(app, staging, m_expected_size);
  REBOOT;
  for (;;) {
  }
}
 
// abort — discard staged data, reset state
FASTRUN
void Updater::abort(const pb_UpdateAbort & /*req*/, pb_UpdateResponse &res) {
  if (!m_active)
    return make_failure(res, "upload not active");
 
  reset_state();
  make_success(res);
}
 
// abort — discard staged data, reset state
FASTRUN
void Updater::verify(const pb_UpdateVerify & /*req*/, pb_UpdateResponse &res) {
  if (!m_active)
    return make_failure(res, "upload not active");
 
  if (verify_hash()) {
    make_success(res);
  }else {
    make_failure(res, "hash mismatch");
  }
}
 
} // namespace loader