Boot Sequence & Application Jump

/* Primary Bootloader startup: runs immediately after reset */
/* Must be fast: OEM requirement typically < 100 ms to first CAN/Ethernet frame */

#include 
#include "Pbl_Cfg.h"
#include "Flash_If.h"
#include "Wdg_If.h"

typedef enum {
    BOOT_REASON_POWER_ON   = 0x00u,
    BOOT_REASON_REPROG_REQ = 0x01u,  /* application set reprog flag */
    BOOT_REASON_APP_INVALID= 0x02u,  /* app CRC failed */
    BOOT_REASON_WDG_RESET  = 0x03u,  /* watchdog triggered */
    BOOT_REASON_SOFT_RESET = 0x04u,  /* ECUReset service */
} BootReason_t;

void PBL_Main(void)
{
    /* 1. Init minimal hardware: clocks, watchdog service, SRAM */
    Wdg_Init();
    Clock_Init();
    Ram_Init();     /* zero BSS, copy DATA section */

    Wdg_Trigger();  /* service WDG: startup must complete before WDG expires */

    /* 2. Read boot flags from NvM / dedicated flash sector */
    BootReason_t reason = BootFlags_Read();

    /* 3. Decision: reprogram or run application */
    if (reason == BOOT_REASON_REPROG_REQ) {
        BootFlags_Clear();              /* clear flag to avoid infinite reprog loop */
        PBL_EnterReprogrammingMode();   /* wait for UDS tester */
        /* never returns normally */
    }

    /* 4. Validate application */
    if (App_IsValid()) {
        Wdg_Trigger();
        PBL_JumpToApplication();        /* relocate vectors; jump */
        /* never returns */
    }

    /* 5. Application invalid: check for SBL (recovery) */
    if (Sbl_IsPresent() && Sbl_IsValid()) {
        PBL_JumpToSbl();
        /* never returns */
    }

    /* 6. Nothing to run: enter reprogramming mode and wait for tester */
    PBL_EnterReprogrammingMode();
}

#include 
#include "Crc.h"

/* Application validity: checked at every boot by PBL */
/* Typical: CRC-32 over application flash region, stored in app header */

typedef struct {
    uint32_t magic;          /* 0xA5A5A5A5: valid signature pattern */
    uint32_t version;        /* application SW version (BCD: 0x01040001 = 1.4.0.1) */
    uint32_t app_crc32;      /* CRC-32 over [APP_BASE+256 ... APP_END] */
    uint32_t app_length;     /* byte count of application */
    uint8_t  reserved[240];  /* pad to 256 bytes total */
} AppHeader_t;

#define APP_BASE        0x80020000u
#define APP_HEADER_ADDR ((const AppHeader_t *)APP_BASE)
#define APP_DATA_START  (APP_BASE + sizeof(AppHeader_t))
#define MAGIC_VALID     0xA5A5A5A5u

boolean App_IsValid(void)
{
    const AppHeader_t *hdr = APP_HEADER_ADDR;

    /* Check magic number */
    if (hdr->magic != MAGIC_VALID) {
        return FALSE;
    }

    /* Check application length is within bounds */
    if ((hdr->app_length == 0u) || (hdr->app_length > APP_MAX_SIZE)) {
        return FALSE;
    }

    /* Compute CRC-32 over application code */
    uint32_t computed_crc = Crc_CalculateCRC32(
        (const uint8_t *)APP_DATA_START,
        hdr->app_length,
        CRC32_INITIAL_VALUE,
        TRUE);

    return (boolean)(computed_crc == hdr->app_crc32);
}

/* Note: CRC calculation at boot adds latency: 256 kB @ 1 cycle/byte = ~1 ms at 300 MHz */
/* Alternative: store SHA-256 hash + verify with HSM (secure boot, covered later) */

/* Watchdog during boot: must be serviced throughout PBL execution */
/* PBL must complete its full startup + CRC check + jump within WDG timeout */

#define WDG_TIMEOUT_MS    100u   /* OEM typical: 100 ms boot window */

/* Critical: CRC check of large flash regions must not starve the WDG */
/* Solution: compute CRC in chunks; service WDG between chunks */

uint32_t App_CrcWithWdgService(const uint8_t *data, uint32_t len)
{
    uint32_t crc     = CRC32_INITIAL_VALUE;
    uint32_t chunk   = 4096u;   /* 4 kB chunks */
    uint32_t offset  = 0u;

    while (offset < len) {
        uint32_t to_process = (len - offset < chunk) ? (len - offset) : chunk;
        crc    = Crc_CalculateCRC32(&data[offset], to_process, crc, FALSE);
        offset += to_process;
        Wdg_Trigger();   /* service watchdog between chunks */
    }
    return Crc_CalculateCRC32(NULL, 0u, crc, TRUE);  /* finalise */
}

/* Alternative: use internal CRC hardware (Aurix FCE module) */
/* FCE can compute CRC-32 of 8 MB PFlash in < 1 ms — no WDG chunks needed */