ra8_dfu_antirollback.c

Go to the documentation of this file.

 
#include "ra8_dfu_antirollback.h"
 
#ifdef RA8_ENABLE_ROOT_OF_TRUST
 
#include <string.h>
 
#include "ra8_attributes.h"
#include "ra8_check.h"
#include "ra8_flash_core.h"
#include "ra8_flash_regs.h"

typedef enum : uint32_t {
  k_ra8_rot_ar_erased = 0xFFFFFFFFU, 
} ra8_rot_ar_nv_t;
 
#ifdef RA8_OFF_TARGET
static uint32_t s_fake_ar_counter = (uint32_t)k_ra8_rot_ar_erased;
#endif

static const char* s_tag = "ROLLBACK";
 
ra8_err_t ra8_rot_antirollback_check(uint32_t image_version, uint32_t stored_min_version)
{
  /* Downgrade: a strictly older image carries since-patched defects -- deny. */
  if (image_version < stored_min_version) {
    ra8_log_error(s_tag, "anti-rollback: image version below stored minimum");
    return k_ra8_err_validation_failed;
  }
  /* Newer or equal: not a downgrade -- accept. */
  return k_ra8_ok;
}
 
#ifndef RA8_OFF_TARGET
volatile bool g_ra8_rot_ar_probing = false;

volatile bool g_ra8_rot_ar_faulted = false;

typedef enum : uint32_t {
  k_ra8_ar_cfsr_addr    = 0xE000ED28U, 
  k_ra8_ar_thumb_hw_msk = 0x0000F800U, 
  k_ra8_ar_thumb32_min  = 0x0000E800U, 
} ra8_ar_probe_reg_t;
 
bool ra8_rot_antirollback_on_probe_fault(uint32_t* exc_frame)
{
  if (exc_frame == nullptr || !g_ra8_rot_ar_probing) {
    return false;
  }
  g_ra8_rot_ar_probing = false;
  g_ra8_rot_ar_faulted = true;
  /* Advance the stacked PC past the faulting load so the exception return resumes
   * at the next instruction. The basic exception frame is
   * [R0 R1 R2 R3 R12 LR PC xPSR]; index 6 is the stacked PC. A Thumb instruction
   * is 32-bit iff its first halfword's bits [15:11] are >= 0b11101. */
  const uint16_t instr = *(const volatile uint16_t*)(uintptr_t)exc_frame[6];
  exc_frame[6] +=
    ((instr & (uint16_t)k_ra8_ar_thumb_hw_msk) >= (uint16_t)k_ra8_ar_thumb32_min) ? 4U : 2U;
  /* W1C-clear the sticky Configurable Fault Status so this deliberate fault does
   * not shadow a later real one. Reading the live value and writing it back is
   * a real read-modify-write on the device: every bit that reads as 1 is
   * written as 1, which clears it (write-1-to-clear semantics). */
  volatile uint32_t* const cfsr        = (volatile uint32_t*)(uintptr_t)k_ra8_ar_cfsr_addr;
  const uint32_t           cfsr_sticky = *cfsr;
  *cfsr                                = cfsr_sticky;
  __asm__ volatile("dsb 0xF\n isb 0xF\n" ::: "memory");
  return true;
}

RA8_INTERNAL static uint32_t internal_probe_counter(bool* out_blank)
{
  g_ra8_rot_ar_faulted = false;
  g_ra8_rot_ar_probing = true;
  __asm__ volatile("dsb 0xF\n isb 0xF\n" ::: "memory");
  const volatile uint32_t raw = *(const volatile uint32_t*)(uintptr_t)k_ra8_flash_extra_start;
  __asm__ volatile("dsb 0xF\n isb 0xF\n" ::: "memory");
  g_ra8_rot_ar_probing = false;
  *out_blank           = g_ra8_rot_ar_faulted;
  return g_ra8_rot_ar_faulted ? (uint32_t)k_ra8_rot_ar_erased : raw;
}
#endif /* !RA8_OFF_TARGET */

RA8_INTERNAL static ra8_err_t internal_default_store_read(uint32_t* out_min_version)
{
  RA8_CHECK_NULL_PTR(out_min_version, s_tag, "out_min_version");
#ifdef RA8_OFF_TARGET
  const uint32_t raw = s_fake_ar_counter;
#else
  bool           blank = false;
  const uint32_t raw   = internal_probe_counter(&blank);
#endif
  *out_min_version = (raw == (uint32_t)k_ra8_rot_ar_erased) ? 0U : raw;
  return k_ra8_ok;
}

RA8_INTERNAL static ra8_err_t internal_default_store_commit(uint32_t new_version)
{
#ifdef RA8_OFF_TARGET
  const uint32_t raw   = s_fake_ar_counter;
  const bool     blank = false;
#else
  bool           blank = false;
  const uint32_t raw   = internal_probe_counter(&blank);
#endif
  const uint32_t stored = (raw == (uint32_t)k_ra8_rot_ar_erased) ? 0U : raw;
  if (new_version <= stored) {
    return k_ra8_ok; /* already at or above the floor -- nothing to persist */
  }
#ifdef RA8_OFF_TARGET
  (void)blank;
  s_fake_ar_counter = new_version;
  return k_ra8_ok;
#else
  uint8_t le[sizeof(uint32_t)] = {};
  (void)memcpy(le, &new_version, sizeof(le)); /* both toolchains little-endian */
  const ra8_err_t wr =
    ra8_flash_extra_mram_write((uint32_t)k_ra8_flash_extra_start, le, (uint32_t)sizeof(le));
  /* #315 bench-proved on silicon that a virgin extra-MRAM page CAN be programmed at
   * runtime write-first (no prior read) and reads back byte-exact with valid ECC, so
   * the commit programs the counter directly and returns the write result. The
   * earlier "#194: the read leaves the controller unable to program a fresh word"
   * claim was an artifact of the phantom 0x27000000 window (corrected by #397). The
   * ``blank`` leg is retained defensively -- it is not expected on the corrected
   * window (a virgin read returns 0xFFFFFFFF without faulting, so ``blank`` stays
   * false) -- and lets a signature-authenticated fresh device launch its first
   * authentic image without a persisted floor. On a real write error the commit
   * default-denies the launch. */
  return blank ? k_ra8_ok : wr;
#endif
}

static const ra8_rot_antirollback_store_t s_default_store = {
  .read   = internal_default_store_read,
  .commit = internal_default_store_commit,
};
 
ra8_err_t ra8_rot_antirollback_verify(const ra8_rot_antirollback_store_t* store,
                                      uint32_t                            image_version)
{
  RA8_CHECK_NULL_PTR(store, s_tag, "store");
  RA8_CHECK_NULL_PTR(store->read, s_tag, "store->read");
  RA8_CHECK_NULL_PTR(store->commit, s_tag, "store->commit");
 
  /* Read the stored highest-accepted version. A read fault is DEFAULT-DENY. */
  uint32_t        stored_min = 0U;
  const ra8_err_t read_err   = store->read(&stored_min);
  RA8_RETURN_ON_ERROR(read_err, s_tag, "anti-rollback: stored-version read failed");
 
  /* Apply the pure downgrade policy. A downgrade returns validation_failed. */
  const ra8_err_t policy_err = ra8_rot_antirollback_check(image_version, stored_min);
  RA8_RETURN_ON_ERROR(policy_err, s_tag, "anti-rollback: downgrade rejected");
 
  /* Accepted: advance the durable counter. A commit fault is DEFAULT-DENY. */
  const ra8_err_t commit_err = store->commit(image_version);
  RA8_RETURN_ON_ERROR(commit_err, s_tag, "anti-rollback: counter commit failed");
 
  return k_ra8_ok;
}
 
const ra8_rot_antirollback_store_t* ra8_rot_antirollback_default_store(void)
{
  return &s_default_store;
}
 
#endif /* RA8_ENABLE_ROOT_OF_TRUST */