Firmware OTA Upgrade

static volatile bool g_ota_confirmed;
static volatile int g_ota_channel;

static void on_ota_confirmed(int channel, void *user_data)
{
    (void)user_data;
    g_ota_confirmed = true;   /* Only signal briefly; do not block the MQTT process thread */
    g_ota_channel = channel;
}

iot_client_config_t cfg = {
    /* ... */
    .ota_confirm_callback = on_ota_confirmed,
    .ota_confirm_user_data = NULL,
};

iot_ota_upgrade_info_t info = {0};
if (!g_ota_confirmed) {
    /* Wait for the confirmation signal */
}

int rc = iot_ota_check_upgrade(client, g_ota_channel, &info);
if (rc == OPRT_OK && info.has_upgrade) {
    rc = iot_ota_report_status(client, info.channel, OTA_STATUS_UPGRADING);
    /* Download, run iot_ota_verify_* verification, and perform platform OTA flashing
       on an application thread */
}
iot_ota_upgrade_info_free(client, &info);

typedef struct {
    bool  has_upgrade;   // Whether the cloud has an upgrade
    char *version;       // Target version number
    char *url;           // Firmware download URL (prefer cdnUrl, fall back to httpsUrl)
    long  file_size;     // Firmware size in bytes
    int   channel;       // Firmware channel (0 = main MCU)
    char *md5;           // MD5 digest (may be NULL)
    char *hmac;          // HMAC digest (may be NULL)
} iot_ota_upgrade_info_t;

typedef enum {
    OTA_STATUS_IDLE      = 0,  // Default; no upgrade required
    OTA_STATUS_READY     = 1,  // Device is ready (upgrade task has been delivered)
    OTA_STATUS_UPGRADING = 2,  // Upgrade in progress (before download/flashing)
    OTA_STATUS_COMPLETE  = 3,  // Upgrade succeeded (report before restarting)
    OTA_STATUS_ERROR     = 4,  // Upgrade failed / error occurred
} iot_ota_status_t;

iot_ota_verify_ctx_t *ctx = NULL;
int rc = iot_ota_verify_init(iot, &info, &ctx);
if (rc != OPRT_OK && rc != OPRT_NOT_SUPPORTED) {
    /* Invalid digest format, out of memory, etc. — abort the upgrade and report OTA_STATUS_ERROR */
    return -1;
}
/* rc == OPRT_NOT_SUPPORTED: the cloud provided no digest field, ctx remains NULL,
 * so skip verification (the application decides whether to proceed) */

while ((n = read_firmware_chunk(buf)) > 0) {
    if (ctx != NULL && iot_ota_verify_update(ctx, buf, n) != OPRT_OK) {
        iot_ota_verify_abort(ctx);
        return -1;
    }
    flash_write(buf, n);                  /* Exactly the same data fed to the verifier */
}

if (ctx != NULL) {
    rc = iot_ota_verify_finish(ctx);      /* Frees ctx internally */
    if (rc != OPRT_OK) {
        /* OPRT_OTA_VERIFY_FAILED: firmware was tampered with/corrupted — abort and report OTA_STATUS_ERROR */
        return -1;
    }
}

#include "iot_client.h"
#include "iot_ota.h"
#include "esp_app_desc.h"
#include "esp_crt_bundle.h"

const esp_app_desc_t *desc = esp_app_get_description();

iot_client_config_t iot_cfg = {
    .devid      = DEFAULT_DEVID,
    .secret_key = DEFAULT_SECRET_KEY,
    .local_key  = DEFAULT_LOCAL_KEY,
    .region     = DEFAULT_REGION,
    .env        = DEFAULT_ENV,
    /* Disable automatic connection: use only ATOP HTTP, without MQTT */
    .mqtt_disable_auto_connect = true,
    /* Application firmware version: automatically reported during init for cloud OTA
       comparison (NULL uses the SDK default) */
    .sw_ver     = desc->version,
    /* Public CA certificate bundle: required by ATOP HTTPS
       (version reporting/upgrade queries/status reporting) */
    .cert_bundle_attach = (tls_cert_bundle_attach_fn)esp_crt_bundle_attach,
};

/* The default PAL reads application-synchronized libc UTC. Share it with
   other SDK modules. */
const pal_t *pal = tai_pal_freertos();
/* iot_init(pal) must be called before iot_client_init; otherwise iot_client_init returns NULL */
if (iot_init(pal) != OPRT_OK) {
    return;
}

iot_client_t *iot = iot_client_init(&iot_cfg);

/* Check for an upgrade (the cloud compares against sw_ver reported during init;
   there is no need to pass the version number again) */
iot_ota_upgrade_info_t info = {0};
int rc = iot_ota_check_upgrade(iot, 0, &info);
if (rc == OPRT_OK && info.has_upgrade) {
    ESP_LOGI(TAG, "upgrade -> %s  url=%s  size=%ld",
             info.version, info.url, info.file_size);
}

/* Report "upgrading" before the download */
iot_ota_report_status(iot, 0, OTA_STATUS_UPGRADING);

/* Use esp_http_client to download info.url, calling esp_ota_write and digest
   verification for each block */
esp_err_t err = download_and_flash(iot, &info);
iot_ota_upgrade_info_free(iot, &info);

if (err != ESP_OK) {
    iot_ota_report_status(iot, 0, OTA_STATUS_ERROR);
    return;
}

/* Report "complete" after success, then restart */
iot_ota_report_status(iot, 0, OTA_STATUS_COMPLETE);
esp_restart();

static esp_err_t download_and_flash(iot_client_t *iot,
                                    const iot_ota_upgrade_info_t *info)
{
    const esp_partition_t *part = esp_ota_get_next_update_partition(NULL);

    /* Digest verification context (returns OPRT_NOT_SUPPORTED and leaves verify NULL
       when the cloud provides neither md5 nor hmac) */
    iot_ota_verify_ctx_t *verify = NULL;
    int vrc = iot_ota_verify_init(iot, info, &verify);
    if (vrc != OPRT_OK && vrc != OPRT_NOT_SUPPORTED) {
        ESP_LOGE(TAG, "iot_ota_verify_init failed: %d", vrc);
        return ESP_FAIL;   /* The verifier could not be created — do not install this firmware */
    }

    esp_http_client_config_t http_cfg = {
        .url              = info->url,
        .timeout_ms       = 30000,
        .buffer_size      = 4096,
        .crt_bundle_attach = esp_crt_bundle_attach,  /* Public CA bundle */
    };
    /* ... open / fetch headers / check for 200; every failure path must call
       iot_ota_verify_abort(verify) ... */

    esp_ota_handle_t handle;
    esp_ota_begin(part, OTA_WITH_SEQUENTIAL_WRITES, &handle);

    while ((n = esp_http_client_read(client, buf, sizeof(buf))) > 0) {
        if (verify != NULL) {
            iot_ota_verify_update(verify, (const uint8_t *)buf, n);  /* Same data being written */
        }
        esp_ota_write(handle, buf, n);                               /* Write block by block */
    }

    /* Verify the cloud-provided digest before switching partitions;
       call esp_ota_abort to discard the image on a mismatch */
    if (verify != NULL) {
        vrc = iot_ota_verify_finish(verify);   /* Frees verify internally */
        if (vrc != OPRT_OK) {
            ESP_LOGE(TAG, "Firmware digest mismatch (rc=%d)", vrc);
            esp_ota_abort(handle);
            return ESP_FAIL;
        }
    }

    esp_ota_end(handle);
    esp_ota_set_boot_partition(part);    /* Switch the boot partition */
    return ESP_OK;
}

static void mark_current_valid(void)
{
    const esp_partition_t *running = esp_ota_get_running_partition();
    esp_ota_img_states_t state;
    if (esp_ota_get_state_partition(running, &state) == ESP_OK
        && state == ESP_OTA_IMG_PENDING_VERIFY) {
        esp_ota_mark_app_valid_cancel_rollback();
    }
}