V1.00.22 + OTA tool bank-misselection fix (triple protection)

- firmware: version bump to V1.00.22 (0x00010016), no code change
- ble_ota_update.py: cur-bank detection now reads the full devinfo output
  and parses strictly (early break at the 'cur bank:' prefix could miss
  'APP2' and silently default to APP1 -> wrong payload selection, caught
  by the device bank_mismatch guard on hardware)
- new pre-flight check_blob_bank(): payload vector reset PC must land in
  the target bank before transferring (BLE and UART paths)
- UART path: post-reboot verification over the text CLI (bank+version),
  deterministic PASS/FAIL like the BLE path
- verified: UART OTA APP2->APP1 V1.00.22 full pass with auto-verify
- docs: dev log 45, AGENTS.md sync

AGENTS.md

@@ -5,14 +5,14 @@
 本仓库是 **mothercup（母乳杯）** 产品的完整代码仓库，包含三大部分：
 
 1. **设备固件** — 基于国民技术（Nations）**N32WB031 BLE SoC**（Cortex-M0，64MHz HSI，**板载硅片实测 256KB Flash**（0x01000000~0x0103FFFF，开发日志 §37），RAM 48KB+16KB）：
-   - **`mcm-ddc-ble/`** — 唯一活跃的应用固件工程（APP，链接在 APP1 bank `0x01008000`/112KB）。以 SDK rdtss 例程为蓝本，集成 FreeRTOS、UART CLI、BLE 自定义 GATT 服务（CLI 透传 / 设备信息查询 / BLE OTA 双 bank 直写升级）、bootsetting 与 APP_DATA 参数区结构化读写命令。当前版本 **V1.00.21**（`mcm-ddc-ble/inc/app_version.h`）。历史上曾有 `mcm-ddc-04/` 主工程，**已删除**，其功能已全部并入本工程。
+   - **`mcm-ddc-ble/`** — 唯一活跃的应用固件工程（APP，链接在 APP1 bank `0x01008000`/112KB）。以 SDK rdtss 例程为蓝本，集成 FreeRTOS、UART CLI、BLE 自定义 GATT 服务（CLI 透传 / 设备信息查询 / BLE OTA 双 bank 直写升级）、bootsetting 与 APP_DATA 参数区结构化读写命令。当前版本 **V1.00.22**（`mcm-ddc-ble/inc/app_version.h`）。历史上曾有 `mcm-ddc-04/` 主工程，**已删除**，其功能已全部并入本工程。
    - **`Boot/`** — 自写精简 bootloader（链接在 `0x01000000`/16KB）：校验 bootsetting 记录自身完整性（magic + 结构体 CRC32）后按 active bank 的 `start_address` 直接跳转；**不校验镜像 CRC（CRC 校验在 OTA 升级过程中完成）**；记录无效或地址越界回退 APP1。
 2. **手机 App `SmartAssiter/`** — uni-app **Vue3 + TypeScript** 工程（HBuilderX 项目管理，无 package.json），通过 BLE 连接设备：查看运行参数（温度/电压/转速等）、CLI 终端、OTA 升级页（当前停用，见下）。另有登录/注册/用户信息等云端业务页面。
 3. **PC 工具 `tools/`** — 整片烧录包制作/烧录脚本 + bleak 蓝牙测试客户端。
 
 关键文档：
 
-- `docs/开发日志.md` — 固件全程开发日志（44 节，含所有踩坑根因与设计决策，排查问题先查这里）
+- `docs/开发日志.md` — 固件全程开发日志（45 节，含所有踩坑根因与设计决策，排查问题先查这里）
 - `docs/ble_protocol.md` — CAIIC BLE 通信协议 V1.1（帧格式/GATT UUID/三类业务流程/维护命令/手机端开发指南）
 - `SmartAssiter/docs/修改记录_*.md` — App 侧每次改造的详细记录
 
@@ -95,7 +95,7 @@ mcm-ddc-ble/
 "D:\Keil_v5\UV4\UV4.exe" -b caiic_boot.uvprojx -j0 -o build.log    # Boot 增量构建
 ```
 
-要求保持 **0 Error(s), 0 Warning(s)**。当前基线（V1.00.21）：`Code=48872 RO-data=4980 RW-data=2076 ZI-data=29116`。
+要求保持 **0 Error(s), 0 Warning(s)**。当前基线（V1.00.22）：`Code=48872 RO-data=4980 RW-data=2076 ZI-data=29116`。
 
 **固件版本号约定（重要）**：每次修改固件代码必须递增 `mcm-ddc-ble/inc/app_version.h` 中的 `APP_FW_VERSION` 与 `APP_FW_VERSION_NUM`（格式 `0x00MMmmpp`，通常补丁位 +1），用于识别板上实际运行的固件；工程名与出包文件名保持不变。
 

Boot/MDK-ARM/build.log

@@ -9,4 +9,4 @@ Program Size: Code=1320 RO-data=680 RW-data=0 ZI-data=2104
 FromELF: creating hex file...
 After Build - User command #1: fromelf --bin --output=.\bin\caiic_boot.bin .\Objects\caiic_boot.axf
 ".\Objects\caiic_boot.axf" - 0 Error(s), 0 Warning(s).
-Build Time Elapsed:  00:00:01
+Build Time Elapsed:  00:00:00

docs/开发日志.md

@@ -1132,3 +1132,30 @@ UART OTA 首轮实测失败（"no OTA_RSP on UART"），排查过程与最终设
 全部自动重传恢复，END ack 正常，复位进 APP2 复核通过）；BLE OTA 回归
 PASS（APP1，30s）。基线：Code=48872 RO-data=4980 RW-data=2076
 ZI-data=29116。遗留：串口物理链路建议用户更换/重插，协议层已能自愈。
+
+## 45. OTA 工具选错 bank 事故与三重防护（2026-09-04，V1.00.22，工具侧修复）
+
+用户实测 V1.00.22 包时工具报 `FAIL: OTA_END rejected, status=6
+(bank_mismatch)`，但现场查询发现设备**已在运行 V1.00.22@APP2**、
+bootsetting 记录完整——即前一次运行其实已成功，这次 FAIL 是重复运行时
+的误选 bank 被设备防呆拦截。
+
+**根因（PC 工具 bug）**：`enter_ota_mode` 读 `devinfo` 时用
+"cur bank:" 前缀做读完标记，标记命中时 "APP2" 字样可能尚未到达，解析
+落入 `else bank=1` 分支——把运行在 APP2 的设备误判为 APP1，于是把
+APP2 链接的镜像发向 APP1 区。设备端 END 校验（向量表 Reset PC 必须落在
+目标 bank 内）正确拒绝（status=6），不变更 bootsetting、不复位——
+**防呆设计成功阻止了一次错刷**。
+
+**修复（ble_ota_update.py，三重防护）**：
+
+1. bank 探测改为读到提示符的完整输出 + 严格正则 `cur bank: APP([12])`，
+   读不到直接报错退出（删除"读不到就默认 APP1"的危险兜底）；
+2. **传输前预检** `check_blob_bank()`：载荷向量表 Reset PC 必须落在目标
+   bank 地址范围内，选错包在发送前即拒绝（BLE/UART 两通道都加）；
+3. UART 通道新增**复位后自动复核**（与 BLE 通道对齐）：END 后等重启、
+   重连 CLI 读 devinfo 比对 bank+版本，输出确定性的 PASS/FAIL，杜绝
+   "显示 FAIL 实际成功"的歧义。
+
+实测：修复后 UART OTA（APP2→APP1，V1.00.22）全程 PASS 并自动复核通过；
+顺带修复了误刷进 APP1 区的内容。固件无改动（仅版本号 V1.00.21→V1.00.22）。

mcm-ddc-ble/inc/app_version.h

@@ -9,12 +9,12 @@
 #define __APP_VERSION_H__
 
 #ifndef APP_FW_VERSION
-#define APP_FW_VERSION      "V1.00.21"
+#define APP_FW_VERSION      "V1.00.22"
 #endif
 
 /* Numeric form used by the BLE info query / OTA records: 0x00MMmmpp */
 #ifndef APP_FW_VERSION_NUM
-#define APP_FW_VERSION_NUM  0x00010015u
+#define APP_FW_VERSION_NUM  0x00010016u
 #endif
 
 #endif /* __APP_VERSION_H__ */

tools/ble_ota_update.py

@@ -27,6 +27,7 @@ with the new version (verified by a second CUR_BANK/FW_VERSION read).
 
 import asyncio
 import os
+import re
 import struct
 import sys
 import time
@@ -191,11 +192,14 @@ class UartTransport:
         if not await self._resync_cli():
             print("warning: no CLI prompt on UART (check wiring/baud)")
         self.ser.write(b"devinfo\r")
-        text = await asyncio.to_thread(self._read_until, [b"cur bank:", self.PROMPT], 1.5)
+        # read the FULL output (until the prompt) - breaking at the "cur
-        bank = 0
+        # bank:" prefix can cut the line before APP1/APP2 arrives
-        for line in text.decode("ascii", "replace").splitlines():
+        text = await asyncio.to_thread(self._read_until, [self.PROMPT], 2.0)
-            if "cur bank:" in line:
+        m = re.search(rb"cur bank:\s*APP([12])", text)
-                bank = 2 if "APP2" in line else 1
+        if not m:
+            raise RuntimeError("could not read cur bank via CLI "
+                               "(got: %r)" % text[-120:])
+        bank = int(m.group(1))
         self.ser.write(b"ota\r")
         text = await asyncio.to_thread(self._read_until, [self.MARKER_ON], 2.0)
         if self.MARKER_ON not in text:
@@ -270,6 +274,21 @@ def fmt_ver(v):
     return "V%d.%02d.%02d" % (v >> 16, (v >> 8) & 0xFF, v & 0xFF)
 
 
+BANK_BASE = {1: 0x01008000, 2: 0x01024000}
+
+
+def check_blob_bank(blob, target):
+    """Pre-flight: the payload's vector-table reset PC must land inside the
+    target bank (the device re-checks this at OTA_END, but catching a bank
+    mis-selection here saves a whole transfer)."""
+    pc = struct.unpack_from("<I", blob, 4)[0]
+    base = BANK_BASE[target]
+    if not (base + 8 <= pc < base + len(blob)):
+        raise SystemExit("payload reset PC 0x%08X is not inside APP%d "
+                         "(0x%08X..0x%08X) - bank detection must be wrong, "
+                         "refusing" % (pc, target, base, base + len(blob)))
+
+
 def decode_tlv(data):
     items = {}
     i = 0
@@ -392,6 +411,7 @@ async def run_ble(pkg_path):
 
         target = 3 - cur_bank
         blob = banks[target]
+        check_blob_bank(blob, target)
         print("target bank: APP%d (%d bytes, crc32=0x%08X)"
               % (target, len(blob), crc32(blob)))
         if cur_ver == version:
@@ -439,16 +459,15 @@ async def run_uart(port, pkg_path):
           % (fmt_ver(version), len(banks[1]), len(banks[2])))
 
     transport = UartTransport(port)
+    try:
         cur_bank = await transport.enter_ota_mode()
-    if cur_bank in (1, 2):
+    except Exception as exc:
+        print("FAIL: %s" % exc)
+        return 1
     print("device: running APP%d" % cur_bank)
     target = 3 - cur_bank
-    else:
-        # no CUR_BANK readback; default to bank2 and let the device's
-        # bank_mismatch check reject a wrong guess (never bricks)
-        print("warning: could not read cur bank via CLI, guessing APP1")
-        target = 2
     blob = banks[target]
+    check_blob_bank(blob, target)
     print("target bank: APP%d (%d bytes, crc32=0x%08X)"
           % (target, len(blob), crc32(blob)))
 
@@ -458,9 +477,28 @@ async def run_uart(port, pkg_path):
         print("FAIL: %s" % exc)
         await transport.leave_ota_mode()   # ABORT: device returns to the CLI
         return 1
-    print("device resets into the new bank; rerun with the serial CLI "
+
-          "'devinfo' to confirm (cur bank / version).")
+    # The device resets after OTA_END; verify over the text CLI like the BLE
+    # path verifies over GATT - the reboot result is the real verdict.
+    print("waiting for reboot ...")
+    await asyncio.sleep(3.0)
+    transport.ser.reset_input_buffer()
+    transport.ser.write(b"\r")
+    await asyncio.to_thread(transport._read_until, [UartTransport.PROMPT], 2.0)
+    transport.ser.write(b"devinfo\r")
+    text = await asyncio.to_thread(transport._read_until,
+                                   [UartTransport.PROMPT], 2.0)
+    mb = re.search(rb"cur bank:\s*APP([12])", text)
+    mv = re.search(rb"firmware:\s*\S+\s*\(0x([0-9A-Fa-f]{8})\)", text)
+    new_bank = int(mb.group(1)) if mb else 0
+    new_ver = int(mv.group(1), 16) if mv else -1
+    if new_bank == target and new_ver == version:
+        print("PASS: now running APP%d, firmware %s" % (new_bank, fmt_ver(new_ver)))
         return 0
+    print("FAIL: after reboot running APP%d, firmware %s (expected APP%d, %s)"
+          % (new_bank, fmt_ver(new_ver) if new_ver >= 0 else "?",
+             target, fmt_ver(version)))
+    return 1
 
 
 def main():

tools/out/caiic_ble_dual.hex

@@ -125,8 +125,8 @@
 :1007B000096A012211430322920611627047000068
 :1007C000D00700010040002038080000D4040001D8
 :1040000011C011CA010000000080000170D800003A
-:10401000948E597115000100004002019CD90000E6
+:1040100071E15B2916000100004002019CD90000FB
-:0C40200074EDAEDA150001006719A92448
+:0C4020009182AC82160001005D92C8D2B3
 :106000007ADA12CA01000000F4010000000000006A
 :106010000000000000000000000000000000000080
 :106020000000000000000000000000000000000070
@@ -784,8 +784,8 @@
 :10A8A000854203D134A003F037FB03E029463AA0E8
 :10A8B00003F0CCFA09F002FA7D21C900FDF762FC31
 :10A8C000014639A003F0C2FA08F0F2FD01463AA0B1
-:10A8D00003F0BCFAF8BD00001500010056312E301F
+:10A8D00003F0BCFAF8BD00001600010056312E301E
-:10A8E000302E3231000000006669726D776172654A
+:10A8E000302E3232000000006669726D7761726549
 :10A8F0003A202573202830782530386C58290D0AE5
 :10A90000000000006375722062616E6B3A20415056
 :10A910005025750D0A000000FF7F00006368697014
@@ -871,7 +871,7 @@
 :10AE1000756520666C75736865640D0A0000000036
 :10AE200010B506A108A003F011F80DA003F074F806
 :10AE30001948016819A003F009F810BD56312E30E9
-:10AE4000302E3231000000006669726D77617265E4
+:10AE4000302E3232000000006669726D77617265E3
 :10AE50002076657273696F6E3A2025730D0A0000C3
 :10AE60006D636D2D6464632D626C653A20424C45C0
 :10AE700028726474737329202B20467265655254BE
@@ -2069,7 +2069,7 @@
 :10F8F000F0BD13E0FDF73AFB1049884201D1022028
 :10F9000000E00120694608740120009004AB224603
 :10F910000799069800F014F809B0F0BD079809B0EF
-:10F92000F0BD0000FFFF00001500010000080240CC
+:10F92000F0BD0000FFFF00001600010000080240CB
 :10F9300094470020FF7F00000000204100400201AA
 :10F9400030B4029C42540546491C88B22C54401CD9
 :10F95000002180B2002C07D95A5C2A54401C491C53
@@ -2130,7 +2130,7 @@
 :10FCC0003D3D3D3D3D3D3D3D3D0A0000206D636DA8
 :10FCD0002D6464632D626C653A20424C45202B20D4
 :10FCE0004672656552544F53202B20434C490A00FD
-:10FCF00056312E30302E323100000000204669721D
+:10FCF00056312E30302E323200000000204669721C
 :10FD00006D776172652076657273696F6E202573F9
 :10FD10000A000000004000202053797374656D4391
 :10FD20006F7265436C6F636B203D20256C752048B6
@@ -4268,7 +4268,7 @@
 :1069D00034A003F037FB03E029463AA003F0CCFAD9
 :1069E00009F002FA7D21C900FDF7CCFB014639A070
 :1069F00003F0C2FA08F0F2FD01463AA003F0BCFA37
-:106A0000F8BD00001500010056312E30302E323115
+:106A0000F8BD00001600010056312E30302E323213
 :106A1000000000006669726D776172653A20257327
 :106A2000202830782530386C58290D0A00000000E5
 :106A30006375722062616E6B3A2041505025750D6E
@@ -4354,7 +4354,7 @@
 :106F300020384E312C207278207175657565206679
 :106F40006C75736865640D0A0000000010B506A139
 :106F500008A003F011F80DA003F074F819480168B7
-:106F600019A003F009F810BD56312E30302E323101
+:106F600019A003F009F810BD56312E30302E323200
 :106F7000000000006669726D776172652076657247
 :106F800073696F6E3A2025730D0A00006D636D2DD5
 :106F90006464632D626C653A20424C4528726474C7
@@ -5553,7 +5553,7 @@
 :10BA2000FDF73AFB1049884201D1022000E00120D5
 :10BA3000694608740120009004AB224607990698D5
 :10BA400000F014F809B0F0BD079809B0F0BD00008F
-:10BA5000FFFF00001500010000080240944700208D
+:10BA5000FFFF00001600010000080240944700208C
 :10BA6000FF7F0000000020410040020130B4029C32
 :10BA700042540546491C88B22C54401C002180B217
 :10BA8000002C07D95A5C2A54401C491CC9B280B208
@@ -5614,7 +5614,7 @@
 :10BDF0003D3D3D3D3D0A0000206D636D2D64646353
 :10BE00002D626C653A20424C45202B2046726565B8
 :10BE100052544F53202B20434C490A0056312E30A8
-:10BE2000302E323100000000204669726D77617259
+:10BE2000302E323200000000204669726D77617258
 :10BE3000652076657273696F6E2025730A000000B5
 :10BE4000004000202053797374656D436F72654321
 :10BE50006C6F636B203D20256C7520487A0A0000CA

tools/out/caiic_ble_dual_ota.json

@@ -2,6 +2,6 @@
   "file": "caiic_ble_dual_ota.bin",
   "target_bank": 1,
   "size": 55408,
-  "crc32": "0x71598E94",
+  "crc32": "0x295BE171",
-  "version": 65557
+  "version": 65558
 }

tools/out/caiic_ble_dual_ota_app2.json

@@ -2,6 +2,6 @@
   "file": "caiic_ble_dual_ota_app2.bin",
   "target_bank": 2,
   "size": 55708,
-  "crc32": "0xDAAEED74",
+  "crc32": "0x82AC8291",
-  "version": 65557
+  "version": 65558
 }

tools/out/mothercup_ble_prod.hex

@@ -125,8 +125,8 @@
 :1007B000096A012211430322920611627047000068
 :1007C000D00700010040002038080000D4040001D8
 :1040000011C011CA010000000080000170D800003A
-:10401000948E59711500010000000000000000009E
+:1040100071E15B29160001000000000000000000B3
-:0C4020000000000000000000A6BF8F1B85
+:0C40200000000000000000007AA93E0C27
 :10800000D8B90020698100017181000139B10001F6
 :108010000000000000000000000000000000000060
 :10802000000000000000000000000000FDB400019E
@@ -780,8 +780,8 @@
 :10A8A000854203D134A003F037FB03E029463AA0E8
 :10A8B00003F0CCFA09F002FA7D21C900FDF762FC31
 :10A8C000014639A003F0C2FA08F0F2FD01463AA0B1
-:10A8D00003F0BCFAF8BD00001500010056312E301F
+:10A8D00003F0BCFAF8BD00001600010056312E301E
-:10A8E000302E3231000000006669726D776172654A
+:10A8E000302E3232000000006669726D7761726549
 :10A8F0003A202573202830782530386C58290D0AE5
 :10A90000000000006375722062616E6B3A20415056
 :10A910005025750D0A000000FF7F00006368697014
@@ -867,7 +867,7 @@
 :10AE1000756520666C75736865640D0A0000000036
 :10AE200010B506A108A003F011F80DA003F074F806
 :10AE30001948016819A003F009F810BD56312E30E9
-:10AE4000302E3231000000006669726D77617265E4
+:10AE4000302E3232000000006669726D77617265E3
 :10AE50002076657273696F6E3A2025730D0A0000C3
 :10AE60006D636D2D6464632D626C653A20424C45C0
 :10AE700028726474737329202B20467265655254BE
@@ -2065,7 +2065,7 @@
 :10F8F000F0BD13E0FDF73AFB1049884201D1022028
 :10F9000000E00120694608740120009004AB224603
 :10F910000799069800F014F809B0F0BD079809B0EF
-:10F92000F0BD0000FFFF00001500010000080240CC
+:10F92000F0BD0000FFFF00001600010000080240CB
 :10F9300094470020FF7F00000000204100400201AA
 :10F9400030B4029C42540546491C88B22C54401CD9
 :10F95000002180B2002C07D95A5C2A54401C491C53
@@ -2126,7 +2126,7 @@
 :10FCC0003D3D3D3D3D3D3D3D3D0A0000206D636DA8
 :10FCD0002D6464632D626C653A20424C45202B20D4
 :10FCE0004672656552544F53202B20434C490A00FD
-:10FCF00056312E30302E323100000000204669721D
+:10FCF00056312E30302E323200000000204669721C
 :10FD00006D776172652076657273696F6E202573F9
 :10FD10000A000000004000202053797374656D4391
 :10FD20006F7265436C6F636B203D20256C752048B6

tools/out/mothercup_ble_prod_ota.json

@@ -2,6 +2,6 @@
   "file": "mothercup_ble_prod_ota.bin",
   "target_bank": 1,
   "size": 55408,
-  "crc32": "0x71598E94",
+  "crc32": "0x295BE171",
-  "version": 65557
+  "version": 65558
 }

tools/out/mothercup_ble_prod_ota_app2.json

@@ -2,6 +2,6 @@
   "file": "mothercup_ble_prod_ota_app2.bin",
   "target_bank": 2,
   "size": 55708,
-  "crc32": "0xDAAEED74",
+  "crc32": "0x82AC8291",
-  "version": 65557
+  "version": 65558
 }