ota.cpp

Go to the documentation of this file.

/*
 *  SatNOGS-COMMS MCU software
 *
 *  Copyright (C) 2025, Libre Space Foundation <http://libre.space>
 *
 *  This program is free software: you can redistribute it and/or modify
 *  it under the terms of the GNU General Public License as published by
 *  the Free Software Foundation, either version 3 of the License, or
 *  (at your option) any later version.
 *
 *  This program is distributed in the hope that it will be useful,
 *  but WITHOUT ANY WARRANTY; without even the implied warranty of
 *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 *  GNU General Public License for more details.
 *
 *  You should have received a copy of the GNU General Public License
 *  along with this program.  If not, see <http://www.gnu.org/licenses/>.
 *
 *  SPDX-License-Identifier: GNU General Public License v3.0 or later
 */
 
#include "ota.hpp"
#include "logger.hpp"
#include "storage.hpp"
#include <mbedtls/sha256.h>
#include <scoped_lock.hpp>
#include <startup.hpp>
#include <zephyr/dfu/flash_img.h>
#include <zephyr/dfu/mcuboot.h>
#include <zephyr/retention/blinfo.h>
#include <zephyr/retention/retention.h>
#include <zephyr/storage/flash_map.h>
#include <zephyr/storage/stream_flash.h>
 
namespace satnogs::comms
{
 
static const struct device *otamem_dev =
    DEVICE_DT_GET(DT_NODELABEL(ota_retention));
 
static etl::string<CONFIG_STORAGE_MAX_PATH_LEN> littlefs_path;
 
static mbedtls_sha256_context   sha256_ctx;
static uint8_t                  ota_buffer[CONFIG_OTA_BUFFER_SIZE];
static etl::string<64>          log_str;
static struct flash_img_context flash_ctx_littlefs;
static struct flash_img_context flash_ctx_slot0;
static struct flash_img_context flash_ctx_slot1;
 
static uint8_t slots_to_area[2] = {FIXED_PARTITION_ID(slot0_partition),
                                   FIXED_PARTITION_ID(slot1_partition)};
 
void
ota::reset_session(uint32_t id)
{
  scoped_lock lock(&m_mtx);
  if (id > CONFIG_OTA_MAX_SESSIONS - 1) {
    throw inval_session(__FILE__, __LINE__);
  }
  session s{};
  m_sessions[id] = s;
  update_retention(id);
}
 
void
ota::reset_sessions()
{
  for (uint32_t i = 0; i < CONFIG_OTA_MAX_SESSIONS; i++) {
    reset_session(i);
  }
}
 
bool
ota::get_session_info(uint8_t id, session &out) const
{
  scoped_lock lock(&m_mtx);
  if (id > CONFIG_OTA_MAX_SESSIONS - 1)
    return false;
  out = m_sessions[id];
  return true;
}
 
void
ota::start(const start_tlc &req, response_tlm &tlm)
{
  scoped_lock  lock(&m_mtx);
  response_tlm resp;
  uint32_t     idx   = 0;
  bool         found = false;
  /* Try to find a free session */
  for (uint32_t i = 0; i < CONFIG_OTA_MAX_SESSIONS; i++) {
    if (m_sessions[i].active == false || m_sessions[i].applied) {
      idx   = i;
      found = true;
      break;
    }
  }
  if (!found) {
    resp.s = status::NO_SESSIONS_LEFT;
    tlm    = resp;
    return;
  }
 
  /*
   * Make some sanity checks. SatNOGS-COMMS uses the XIP method for the MCU.
   * Therefore, before any attempt to perform an OTA for the MCU, we should be
   * sure that we do not update the slot that the board currently operates
   *
   * NOTE: It seems that there is a naming conflict between the slot number
   * considered by the MCUBoot and the partition ID. MCUBoot uses the the slot 0
   * for the slot0_partition and slot 1 for the slot1_partition. However, the
   * partition IDs are not following the same convention. Therefore we need to
   * use the `slots_to_area` array to map the slot number to the partition ID.
   * `slots_to_area[0]` is the partition ID for slot 0 and `slots_to_area[1]` is
   * the partition ID for slot 1.
   *
   * NOTE 2: flash_img_get_upload_slot() has a lame implementation and for sure
   * is not suitable for XIP setups. DO NOT USE IT!
   */
  auto &log = logger::get_instance();
 
  switch (req.dst) {
  case subsys::MCU_SLOT0:
  case subsys::MCU_SLOT1:
  case subsys::MCU_LITTLEFS: {
    if (!boot_is_img_confirmed()) {
      resp.s = status::CURRENT_IMG_NOT_CONFIRMED;
      tlm    = resp;
      return;
    }
  } break;
  default:
    break;
  }
 
  switch (req.dst) {
  case subsys::MCU_SLOT0:
  case subsys::MCU_SLOT1: {
    uint8_t active_slot = boot_fetch_active_slot();
    if (active_slot == slots_to_area[req.dst == subsys::MCU_SLOT0 ? 0 : 1]) {
      log_str.clear();
      etl::string_stream stream(log_str);
      stream << "Active slot (" << active_slot << ") cannot be updated";
      log.log(log_str);
      resp.s = status::INVALID_SLOT;
      tlm    = resp;
      return;
    }
    int ret = flash_img_init_id(
        req.dst == subsys::MCU_SLOT0 ? &flash_ctx_slot0 : &flash_ctx_slot1,
        slots_to_area[req.dst == subsys::MCU_SLOT0 ? 0 : 1]);
    if (ret) {
      log_str.clear();
      etl::string_stream stream(log_str);
      stream << "flash_img_init_id() error " << ret;
      log.log(log_str);
      resp.s = status::INTERNAL_ERROR;
      tlm    = resp;
      return;
    }
  } break;
  case subsys::FPGA_WIC:
    break;
  case subsys::MCU_LITTLEFS:
  case subsys::FPGA_LITTLEFS: {
    auto &storage = storage::get_instance();
    /*
     * Make sure that the directory for the firmwares exists. If it is already
     * created, mkdir() does not produce any error
     */
    littlefs_path.clear();
    littlefs_path.append(req.dst == subsys::MCU_LITTLEFS ? LITTLEFS_MCU_DIR
                                                         : LITTLEFS_FPGA_DIR);
    storage.mkdir(littlefs_path);
 
    /*
     * If the destination is a file at the littleFS storage, delete any file
     * that may have the same name, leftover from a previous OTA session
     */
 
    littlefs_path.clear();
    etl::string_stream stream(littlefs_path);
    stream << (req.dst == subsys::MCU_LITTLEFS ? LITTLEFS_MCU_DIR
                                               : LITTLEFS_FPGA_DIR)
           << req.name;
    try {
 
      storage.rm(littlefs_path);
    } catch (const storage::delete_file_exception &e) {
    }
 
  } break;
  default:
    log.log("Invalid OTA subsystem");
    resp.s = status::INVALID_DST;
    tlm    = resp;
    return;
  }
 
  m_sessions[idx]        = session{};
  m_sessions[idx].active = true;
  std::copy_n(req.sha256, 32, m_sessions[idx].sha256);
  m_sessions[idx].total_size  = req.size;
  m_sessions[idx].name        = req.name;
  m_sessions[idx].destination = req.dst;
  m_sessions[idx].slot        = req.slot;
  tlm.s                       = status::OK;
  tlm.ack                     = 0;
  tlm.session                 = idx;
  update_retention(idx);
}
 
void
ota::recv(const data_tlc &tlc, response_tlm &tlm)
{
  scoped_lock lock(&m_mtx);
  tlm.session = tlc.session;
 
  /* Perform all sanity checks first */
  if (tlc.session > CONFIG_OTA_MAX_SESSIONS - 1) {
    tlm.s = status::INVALID_SESSION;
    return;
  }
 
  auto &ctx = m_sessions[tlc.session];
  if (ctx.active == false) {
    tlm.s = status::INVALID_SESSION;
    return;
  }
 
  /*  Perform simple sequence number management */
  if (tlc.seq != ctx.ack) {
    tlm.s   = status::INVALID_SEQ;
    tlm.ack = ctx.ack;
    return;
  }
 
  switch (ctx.destination) {
  case subsys::MCU_SLOT0:
  case subsys::MCU_SLOT1:
  case subsys::MCU_LITTLEFS: {
    if (!boot_is_img_confirmed()) {
      tlm.s   = status::CURRENT_IMG_NOT_CONFIRMED;
      tlm.ack = ctx.ack;
      return;
    }
  } break;
  default:
    break;
  }
 
  /* Copy data and progress */
  auto res = status::OK;
  switch (ctx.destination) {
  case subsys::MCU_SLOT0:
  case subsys::MCU_SLOT1:
    res = write_slot(ctx, tlc);
    break;
  case subsys::FPGA_WIC:
    res = write_wic(ctx, tlc);
    break;
  case subsys::MCU_LITTLEFS:
    res = write_littlefs(true, ctx, tlc);
    break;
  case subsys::FPGA_LITTLEFS:
    res = write_littlefs(false, ctx, tlc);
    break;
  default:
    tlm.s   = status::INVALID_DST;
    tlm.ack = ctx.ack;
    return;
  }
 
  tlm.s   = res;
  tlm.ack = ctx.ack;
  update_retention(tlc.session);
}
 
void
ota::finalize(const fin_tlc &tlc, response_tlm &tlm, int wdgid)
{
  scoped_lock lock(&m_mtx);
  tlm.session = tlc.session;
  tlm.ack     = 0;
 
  /* Perform all sanity checks first */
  if (tlc.session > CONFIG_OTA_MAX_SESSIONS - 1) {
    tlm.s = status::INVALID_SESSION;
    return;
  }
 
  auto &ctx = m_sessions[tlc.session];
  if (ctx.active == false) {
    tlm.s = status::INVALID_SESSION;
    return;
  }
 
  tlm.ack = ctx.ack;
  if (ctx.ack != ctx.total_size) {
    tlm.s = status::INVALID_STATE;
    return;
  }
 
  if (sha256_check(ctx, wdgid) == false) {
    tlm.s = status::INVALID_HASH;
    return;
  }
 
  tlm.s = status::OK;
 
  /* Apply the update asynchronously */
  switch (ctx.destination) {
  case subsys::MCU_SLOT0:
  case subsys::MCU_SLOT1: {
    if (!boot_is_img_confirmed()) {
      tlm.s   = status::CURRENT_IMG_NOT_CONFIRMED;
      tlm.ack = ctx.ack;
      return;
    }
    finalize_mcu(ctx, tlm);
  } break;
  case subsys::MCU_LITTLEFS: {
    if (!boot_is_img_confirmed()) {
      tlm.s   = status::CURRENT_IMG_NOT_CONFIRMED;
      tlm.ack = ctx.ack;
      return;
    }
    finalize_littlefs_to_mcu(ctx, tlm);
  } break;
  default:
    break;
  }
}

void
ota::confirm_image()
{
  boot_write_img_confirmed();
}
 
ota::ota()
{
  static_assert(sizeof(session) * CONFIG_OTA_MAX_SESSIONS <
                OTA_RETENTION_MEM_SIZE);
  k_mutex_init(&m_mtx);
 
  if (retention_is_valid(otamem_dev)) {
    /* Get the number of stored sessions and the hash ID od the session class.
     *  If  any of them is different, previous firmware used a different
     * configuration. If this is the case, we cannot do much. Just reset
     * everything.
     */
    uint32_t n = 0;
    retention_read(otamem_dev, 0, reinterpret_cast<uint8_t *>(&n),
                   sizeof(uint32_t));
    uint32_t hash = 0;
    retention_read(otamem_dev, sizeof(uint32_t),
                   reinterpret_cast<uint8_t *>(&hash), sizeof(uint32_t));
    if (n != CONFIG_OTA_MAX_SESSIONS || hash != session::HASH) {
      reset_retention();
    } else {
      /* Restore everything from the retention memory */
      for (uint32_t i = 0; i < CONFIG_OTA_MAX_SESSIONS; i++) {
        session s{};
        retention_read(otamem_dev, 2 * sizeof(uint32_t) + i * sizeof(s),
                       reinterpret_cast<uint8_t *>(&s), sizeof(s));
        /*
         * Retrieving an etl::string with low level access needs special care
         * https://www.etlcpp.com/string.html
         */
        s.name.repair();
        m_sessions[i] = s;
        /* Slot 0 and 1 do not support recovering from reboot. This has to do
         * mainly with the flash_img_init_id() which has to be called at the
         * start of an OTA session.
         * But if a power cycle has occurred, it is not possible to continue a
         * previously running session */
        if (m_sessions[i].destination == subsys::MCU_SLOT0 ||
            m_sessions[i].destination == subsys::MCU_SLOT1) {
          reset_session(i);
        }
      }
    }
  } else {
    reset_retention();
  }
}

void
ota::reset_retention()
{
  retention_clear(otamem_dev);
  /* Apply number of possible sessions */
  uint32_t x = CONFIG_OTA_MAX_SESSIONS;
  retention_write(otamem_dev, 0, reinterpret_cast<const uint8_t *>(&x),
                  sizeof(uint32_t));
  /* Apply session class hash */
  x = session::HASH;
  retention_write(otamem_dev, sizeof(uint32_t),
                  reinterpret_cast<const uint8_t *>(&x), sizeof(uint32_t));
 
  /* Apply default inactive sessions*/
  for (uint32_t i = 0; i < CONFIG_OTA_MAX_SESSIONS; i++) {
    session s{};
    retention_write(otamem_dev, 2 * sizeof(uint32_t) + i * sizeof(s),
                    reinterpret_cast<const uint8_t *>(&s), sizeof(s));
  }
}
 
void
ota::update_retention(uint32_t idx)
{
  retention_write(otamem_dev, 2 * sizeof(uint32_t) + idx * sizeof(session),
                  reinterpret_cast<const uint8_t *>(&m_sessions[idx]),
                  sizeof(session));
}
 
ota::status
ota::write_slot(session &s, const data_tlc &tlc)
{
  auto &log = logger::get_instance();
  /* A bit pedantic but better safe than sorry */
  uint8_t active_slot = boot_fetch_active_slot();
  if (active_slot ==
      slots_to_area[s.destination == subsys::MCU_SLOT0 ? 0 : 1]) {
    log_str.clear();
    etl::string_stream stream(log_str);
    stream << "Cannot write to active slot " << active_slot;
    log.log(log_str);
    return status::INVALID_SLOT;
  }
 
  switch (s.destination) {
  case subsys::MCU_SLOT0:
    flash_img_buffered_write(&flash_ctx_slot0, tlc.data, tlc.len, false);
    break;
  case subsys::MCU_SLOT1:
    flash_img_buffered_write(&flash_ctx_slot1, tlc.data, tlc.len, false);
    break;
    /* In case of invalid destination do not advance the ack*/
  default:
    log.log("Invalid destination. Only MCU_SLOT0 and MCU_SLOT1 are "
            "allowed");
    return status::INVALID_SLOT;
  }
  s.ack += tlc.len;
  return status::OK;
}
 
ota::status
ota::write_wic(session &s, const data_tlc &tlc)
{
  uint32_t ncopy = tlc.len;
  if (s.ack + tlc.len > s.total_size) {
    ncopy = s.ack + tlc.len - s.total_size;
  }
 
  auto    &storage = storage::get_instance();
  uint32_t written =
      storage.write_raw(tlc.data, s.ack / storage::SECTOR_SIZE, ncopy);
 
  s.ack += written;
  return status::OK;
}
 
ota::status
ota::write_littlefs(bool mcu, session &s, const data_tlc &tlc)
{
  uint32_t ncopy = tlc.len;
  if (s.ack + tlc.len > s.total_size) {
    ncopy = s.ack + tlc.len - s.total_size;
  }
 
  littlefs_path.clear();
  etl::string_stream stream(littlefs_path);
  stream << (mcu ? LITTLEFS_MCU_DIR : LITTLEFS_FPGA_DIR) << s.name;
 
  auto &storage = storage::get_instance();
  int   ret     = storage.write(littlefs_path, tlc.data, ncopy);
  if (ret < 0) {
    return status::INTERNAL_ERROR;
  }
 
  uint32_t written = static_cast<uint32_t>(ret);
  s.ack += written;
  return status::OK;
}

bool
ota::sha256_check(const session &s, int wdgid)
{
  switch (s.destination) {
  case subsys::MCU_SLOT0:
  case subsys::MCU_SLOT1:
    return sha256_mcu(s);
  case subsys::FPGA_WIC:
    return sha256_fpga_wic(s, wdgid);
  case subsys::MCU_LITTLEFS:
  case subsys::FPGA_LITTLEFS: {
    littlefs_path.clear();
    etl::string_stream stream(littlefs_path);
    stream << (s.destination == subsys::MCU_LITTLEFS ? LITTLEFS_MCU_DIR
                                                     : LITTLEFS_FPGA_DIR)
           << s.name;
    return sha256_littlefs(s, littlefs_path, wdgid);
  }
  default:
    return false;
  }
}
 
bool
ota::sha256_littlefs(const session &s, const etl::istring &path, int wdgid)
{
  auto ts = k_uptime_seconds();
  mbedtls_sha256_init(&sha256_ctx);
  mbedtls_sha256_starts(&sha256_ctx, 0);
  auto          &storage = storage::get_instance();
  const uint32_t iters   = s.total_size / CONFIG_OTA_BUFFER_SIZE;
  storage::file  f(path);
  for (uint32_t i = 0; i < iters; i++) {
    /*
     * Reset every 1 second the task watchdog and let other threads to do
     * their job
     */
    auto now = k_uptime_seconds();
    if (now - ts > 1) {
      task_wdt_feed(wdgid);
      k_msleep(1);
      ts = now;
    }
    storage.read(f, ota_buffer, CONFIG_OTA_BUFFER_SIZE);
    mbedtls_sha256_update(&sha256_ctx, ota_buffer, CONFIG_OTA_BUFFER_SIZE);
  }
 
  if (s.total_size % CONFIG_OTA_BUFFER_SIZE) {
    storage.read(f, ota_buffer, s.total_size % CONFIG_OTA_BUFFER_SIZE);
    mbedtls_sha256_update(&sha256_ctx, ota_buffer,
                          s.total_size % CONFIG_OTA_BUFFER_SIZE);
  }
  mbedtls_sha256_finish(&sha256_ctx, ota_buffer);
  mbedtls_sha256_free(&sha256_ctx);
  return std::equal(s.sha256, s.sha256 + 32, ota_buffer);
}
 
bool
ota::sha256_fpga_wic(const session &s, int wdgid)
{
  auto ts = k_uptime_seconds();
  mbedtls_sha256_init(&sha256_ctx);
  mbedtls_sha256_starts(&sha256_ctx, 0);
  auto          &storage  = storage::get_instance();
  const uint32_t nsectors = s.total_size / storage::SECTOR_SIZE;
  for (uint32_t i = 0; i < nsectors; i++) {
    /*
     * Reset every 1 second the task watchdog and let other threads to do
     * their job
     */
    auto now = k_uptime_seconds();
    if (now - ts > 1) {
      task_wdt_feed(wdgid);
      k_msleep(1);
      ts = now;
    }
    storage.read_raw(ota_buffer, i, 1);
    mbedtls_sha256_update(&sha256_ctx, ota_buffer, storage::SECTOR_SIZE);
  }
 
  if (s.total_size % storage::SECTOR_SIZE) {
    storage.read_raw(ota_buffer, nsectors, 1);
    mbedtls_sha256_update(&sha256_ctx, ota_buffer,
                          s.total_size % storage::SECTOR_SIZE);
  }
  mbedtls_sha256_finish(&sha256_ctx, ota_buffer);
  mbedtls_sha256_free(&sha256_ctx);
  return std::equal(s.sha256, s.sha256 + 32, ota_buffer);
}
 
bool
ota::sha256_mcu(const session &s)
{
  struct flash_img_check check;
  check.clen  = s.total_size;
  check.match = s.sha256;
  /*
   * Flush any outstanding bytes. Note that we use the ota_buffer as a dummy
   * buffer. After that check the integrity of the image and proceed with the
   * update
   */
  int ret = 0;
  if (s.slot == 0) {
    flash_img_buffered_write(&flash_ctx_slot0, ota_buffer, 0, true);
    ret = flash_img_check(&flash_ctx_slot0, &check, slots_to_area[0]);
  } else {
    flash_img_buffered_write(&flash_ctx_slot1, ota_buffer, 0, true);
    ret = flash_img_check(&flash_ctx_slot1, &check, slots_to_area[1]);
  }
  return ret == 0;
}
 
bool
ota::finalize_littlefs_to_mcu(session &s, response_tlm &tlm)
{
  auto &log = logger::get_instance();
  if (s.slot > 1) {
    log_str.clear();
    etl::string_stream stream(log_str);
    stream << "Invalid slot number " << s.slot;
    log.log(log_str);
    tlm.s = status::INVALID_SLOT;
    return false;
  }
 
  /*
   * Check the current slot and the target one. Obviously, the should not be
   * the same
   */
  uint8_t curr_slot = boot_fetch_active_slot();
  if (curr_slot == slots_to_area[s.slot]) {
    log_str.clear();
    etl::string_stream stream(log_str);
    stream << "Active slot and update slot is the same (" << s.slot << ")";
    log.log(log_str);
    tlm.s = status::INVALID_SLOT;
    return false;
  }
 
  int ret = flash_img_init_id(&flash_ctx_littlefs, slots_to_area[s.slot]);
  if (ret) {
    log_str.clear();
    etl::string_stream stream(log_str);
    stream << "flash_img_init_id() error " << ret;
    log.log(log_str);
    tlm.s = status::INTERNAL_ERROR;
    return false;
  }
 
  littlefs_path.clear();
  etl::string_stream stream(littlefs_path);
  stream << LITTLEFS_MCU_DIR << s.name;
  storage::file  f(littlefs_path);
  const uint32_t iters   = s.total_size / CONFIG_IMG_BLOCK_BUF_SIZE;
  auto          &storage = storage::get_instance();
  for (uint32_t i = 0; i < iters; i++) {
    storage.read(f, ota_buffer, CONFIG_IMG_BLOCK_BUF_SIZE);
    flash_img_buffered_write(&flash_ctx_littlefs, ota_buffer,
                             CONFIG_IMG_BLOCK_BUF_SIZE, false);
  }
  storage.read(f, ota_buffer, s.total_size % CONFIG_IMG_BLOCK_BUF_SIZE);
  flash_img_buffered_write(&flash_ctx_littlefs, ota_buffer,
                           s.total_size % CONFIG_IMG_BLOCK_BUF_SIZE, true);
 
  boot_request_upgrade(BOOT_UPGRADE_TEST);
  k_msleep(2000);
  sys_reboot(SYS_REBOOT_COLD);
  tlm.s = status::OK;
  return true;
}
 
bool
ota::finalize_mcu(session &s, response_tlm &tlm)
{
  /* sha256_mcu() has already done the buffer flush */
  int ret = boot_request_upgrade(BOOT_UPGRADE_TEST);
  if (ret == 0) {
    s.applied = true;
  }
  sys_reboot(SYS_REBOOT_COLD);
  return ret == 0;
}
 
} // namespace satnogs::comms