Add 0x0026a custom AES-128-CMAC secure bootloader, Week 11a notebook, and README links

0x0026a_custom-bootloader/bootloader/include/aes_cmac.h

@@ -0,0 +1,40 @@
+/**
+ * @file aes_cmac.h
+ * @brief AES-128-CMAC authentication tag helpers backed by Mbed TLS.
+ * @author Kevin Thomas
+ * @date 2026
+ *
+ * MIT License
+ * Copyright (c) 2026 Kevin Thomas
+ */
+
+#ifndef AES_CMAC_H
+#define AES_CMAC_H
+
+#include <stdint.h>
+#include <stddef.h>
+#include <stdbool.h>
+
+/** @brief AES block size in bytes. */
+#define AES_BLOCK_SIZE 16U
+
+/**
+ * @brief Compute an AES-128-CMAC tag over a memory region.
+ * @param key  Pointer to the 16-byte AES-128 key.
+ * @param data Pointer to the message bytes, which may live in XIP flash.
+ * @param len  Message length in bytes.
+ * @param tag  Output buffer that receives the 16-byte CMAC tag.
+ * @return int Zero on success, non-zero when the cipher is unavailable.
+ */
+int aes128_cmac(const uint8_t *key, const uint8_t *data, size_t len,
+                uint8_t *tag);
+
+/**
+ * @brief Compare two CMAC tags without short-circuiting on the first byte.
+ * @param a Pointer to the first tag.
+ * @param b Pointer to the second tag.
+ * @return bool True when the tags are byte-for-byte identical.
+ */
+bool cmac_tags_equal(const uint8_t *a, const uint8_t *b);
+
+#endif

0x0026a_custom-bootloader/bootloader/include/boot.h

@@ -0,0 +1,45 @@
+/**
+ * @file boot.h
+ * @brief Secure boot console and application handoff helpers.
+ * @author Kevin Thomas
+ * @date 2026
+ *
+ * MIT License
+ * Copyright (c) 2026 Kevin Thomas
+ */
+
+#ifndef BOOT_H
+#define BOOT_H
+
+#include "manifest.h"
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/**
+ * @brief Bring up the debug console and print the boot banner.
+ * @param void No parameters.
+ * @return void No return value.
+ */
+void boot_init(void);
+
+/**
+ * @brief Print a boot failure reason and idle forever.
+ * @param reason Null-terminated message describing the failure.
+ * @return void Does not return.
+ */
+void boot_halt(const char *reason);
+
+/**
+ * @brief Announce the verified image and jump to its reset vector.
+ * @param manifest Pointer to the validated manifest.
+ * @return void Does not return.
+ */
+void boot_launch(const fw_manifest_t *manifest);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif // BOOT_H

0x0026a_custom-bootloader/bootloader/include/flash_layout.h

@@ -0,0 +1,31 @@
+/**
+ * @file flash_layout.h
+ * @brief Flash partition map shared by the bootloader and the host signer.
+ * @author Kevin Thomas
+ * @date 2026
+ *
+ * MIT License
+ * Copyright (c) 2026 Kevin Thomas
+ */
+
+#ifndef FLASH_LAYOUT_H
+#define FLASH_LAYOUT_H
+
+#include <stdint.h>
+
+/** @brief Absolute base address of the bootloader image in XIP flash. */
+#define BOOTLOADER_BASE 0x10000000U
+
+/** @brief Absolute address of the one-sector firmware manifest. */
+#define FW_MANIFEST_BASE 0x1001F000U
+
+/** @brief Size in bytes of the flash sector holding the manifest. */
+#define FW_MANIFEST_SECTOR_SIZE 4096U
+
+/** @brief Absolute base address where the signed application runs. */
+#define APP_BASE 0x10020000U
+
+/** @brief Total XIP flash size in bytes on the RP2350 Pico 2 board. */
+#define FLASH_TOTAL_SIZE 0x200000U
+
+#endif

0x0026a_custom-bootloader/bootloader/include/image.h

@@ -0,0 +1,23 @@
+/**
+ * @file image.h
+ * @brief Control transfer into a freshly verified Cortex-M application.
+ * @author Kevin Thomas
+ * @date 2026
+ *
+ * MIT License
+ * Copyright (c) 2026 Kevin Thomas
+ */
+
+#ifndef IMAGE_H
+#define IMAGE_H
+
+#include <stdint.h>
+
+/**
+ * @brief Jump to an application whose vector table starts at a base address.
+ * @param vector_base Base address of the application vector table.
+ * @return void Does not return to the caller.
+ */
+void image_start(uint32_t vector_base);
+
+#endif

0x0026a_custom-bootloader/bootloader/include/manifest.h

@@ -0,0 +1,51 @@
+/**
+ * @file manifest.h
+ * @brief Firmware manifest stored in the flash sector before the application.
+ * @author Kevin Thomas
+ * @date 2026
+ *
+ * MIT License
+ * Copyright (c) 2026 Kevin Thomas
+ */
+
+#ifndef MANIFEST_H
+#define MANIFEST_H
+
+#include <stdint.h>
+#include <stdbool.h>
+
+/** @brief Little-endian magic at the head of a valid manifest ("WFLB"). */
+#define FW_MANIFEST_MAGIC 0x424C4657U
+
+/** @brief Current manifest structure revision. */
+#define FW_MANIFEST_VERSION 1U
+
+/** @brief Length in bytes of an AES-128-CMAC authentication tag. */
+#define FW_TAG_SIZE 16U
+
+#pragma pack(push, 1)
+/** @brief Fixed-layout record describing the signed application image. */
+typedef struct {
+    uint32_t magic;
+    uint32_t version;
+    uint32_t app_base;
+    uint32_t app_size;
+    uint8_t  tag[FW_TAG_SIZE];
+} fw_manifest_t;
+#pragma pack(pop)
+
+/**
+ * @brief Copy the manifest out of its fixed flash address.
+ * @param out Pointer to the manifest structure to populate.
+ * @return void No return value.
+ */
+void manifest_read(fw_manifest_t *out);
+
+/**
+ * @brief Report whether a manifest carries the expected magic and version.
+ * @param manifest Pointer to the manifest to inspect.
+ * @return bool True when the magic and version both match.
+ */
+bool manifest_is_valid(const fw_manifest_t *manifest);
+
+#endif

0x0026a_custom-bootloader/bootloader/include/verify.h

@@ -0,0 +1,32 @@
+/**
+ * @file verify.h
+ * @brief Firmware authenticity verification for the secure bootloader.
+ * @author Kevin Thomas
+ * @date 2026
+ *
+ * MIT License
+ * Copyright (c) 2026 Kevin Thomas
+ */
+
+#ifndef VERIFY_H
+#define VERIFY_H
+
+#include <stdbool.h>
+#include "manifest.h"
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/**
+ * @brief Recompute the CMAC over the application and compare it to the tag.
+ * @param manifest Pointer to the validated manifest.
+ * @return bool True when the tag matches, false otherwise.
+ */
+bool verify_manifest(const fw_manifest_t *manifest);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif // VERIFY_H