firmware: add owner OTA research code (held)

Draft
GI
15h ago
+3119-0

Requested by David

What changed and why

Adds the owner-OTA research code and the recovery-link research note, moved out of #24354. Everyday users must eventually be able to install personal firmware without a jig, and this code explores that path. It existed only in a scratch worktree until now.

Held, do not merge. It has known defects, listed below. Nothing builds it or ships it, and it changes no firmware behavior.

Product invariants affected

None. Nothing under omi/firmware/research/ is compiled into firmware.

How it was verified

Not re-verified on this branch. It only moves these files onto current main, unchanged from the commits reviewed on #24354. Earlier host-demo results are not claimed here. Nothing was run on hardware, and no release claim is made.

Open findings to fix before this can leave draft

Reported by Cubic on #24354 against this code and not yet fixed or checked:

  • research/owner_ota/target_adapter/bus_epoch/boot_epoch.h:10 (P1): This API does not enforce the boot-only ledger boundary it promises: any trusted caller can pass an application or reference cv1_flash, and the reservation then mutates that journal.
  • research/owner_ota/host/demo.c:280 (P1): This can erase the currently active confirmed artifact after an interrupted reference promotion.
  • research/owner_ota/shared/secure_image.c:125 (P1): cv1_image_admit calls cv1_image_forget on out before establishing that out is initialized, so first-use admission can call an indeterminate release callback.
  • research/owner_ota/target_adapter/bus_epoch/CMakeLists.txt:7 (P2): Enabling CV1_RESEARCH_COMPILE_BUS_EPOCH alone cannot link because this target omits its adapter and journal dependencies.
  • research/owner_ota/target_adapter/bus_epoch/README.md:111 (P2): This claims successful ARM compile/link verification that was not performed for this PR.
  • research/owner_ota/host/fixtures.py:27 (P2): The placement check reserves no space for the appended variant bytes, so a payload at the allowed maximum produces over-cap B/C fixtures and makes the host workflow fail.
  • research/owner_ota/host/test_workflow.py:20 (P2): required omits unhealthy_confirmation_rejected, the report stage for the simulated FAULT confirmation path.
  • research/owner_ota/target_adapter/storage_adapter.c:84 (P2): A failed multi-chunk read leaves previously copied bytes in dst, violating the adapter’s all-destination-invalidation contract and allowing stale/partial data to remain observable after an error.
  • research/owner_ota/shared/psa_adapter.c:40 (P2): This adapter stores a PSA operation in an object that is not declared as a psa_hash_operation_t, so the casts invoke undefined behavior under strict-aliasing builds and can become invalid when the PSA implementation changes its alignment or representation.
  • research/owner_ota/target_adapter/zephyr_storage.c:1 (P2): This source is never compiled by any repository build, so its claimed NCS/Zephyr compile checks and static assertions are not exercised.
  • research/owner_ota/target_adapter/test_adapter.c:1 (P2): This host contract test is not wired into any build or test runner, so its assertions never execute in the repository’s documented path.
  • research/owner_ota/target_adapter/test_adapter.c:61 (P2): The ownership-loss coverage only tests loss after the I/O callback.
  • research/owner_ota/target_adapter/test_adapter.c:55 (P2): This partial-I/O check does not verify the documented destination-invalidation contract.
  • research/owner_ota/host/run.py:26 (P2): A relative --cc path fails because command changes to the generated output directory before the compiler path is resolved.
  • research/owner_ota/shared/secure_image.c:18 (P2): cv1_image_forget destroys the release callback, context, and lease after a failed release, making a still-held source lease unreleasable.
  • research/owner_ota/target_adapter/bus_epoch/zephyr_bus.c:36 (P2): The SD branch uses the wrong disk-access identifier for the OMI board, so every sector-zero request will fail under the normal SDMMC registration.
  • research/owner_ota/shared/secure_store.c:210 (P2): This copy leaves stale bytes from a previously larger personal image whenever the new image is smaller.
  • research/owner_ota/target_adapter/bus_epoch/secure_bus.c:74 (P2): An old cv1_bus_nor_io callback can regain access after bus reinitialization because it reads the new mutable b->epoch.
  • docs/ota-recovery-link-research.md:26 (P3): The loaded-byte arithmetic is off by 12 bytes: 245252B minus 136160B is 109092B, not 109080B.
  • research/owner_ota/target_adapter/bus_epoch/zephyr_bus.c:14 (P3): These assertions do not actually enforce the P0.11/P1.11 binding stated in their messages.

Tests

None added here. Two of the findings above are that the existing tests aren't wired into any runner.

UI evidence

UI-Evidence: none -- firmware research code and docs only

🤖 Generated with Claude Code