183 uint32_t stored_min_version);
218 uint32_t image_version);
const ra8_rot_antirollback_store_t * ra8_rot_antirollback_default_store(void)
Return the non-faking default store (reports "not provisioned").
ra8_err_t ra8_rot_antirollback_verify(const ra8_rot_antirollback_store_t *store, uint32_t image_version)
Read the stored minimum, apply the policy, and commit on accept.
bool ra8_rot_antirollback_on_probe_fault(uint32_t *exc_frame)
Recover a fault-tolerant counter probe from the app fault handler.
ra8_err_t(* ra8_rot_antirollback_read_fn_t)(uint32_t *out_min_version)
Read the stored highest-accepted image version (DI seam).
ra8_err_t(* ra8_rot_antirollback_commit_fn_t)(uint32_t new_version)
Durably advance the stored highest-accepted image version (DI seam).
ra8_err_t ra8_rot_antirollback_check(uint32_t image_version, uint32_t stored_min_version)
Pure downgrade policy: accept iff the image is not older than stored.
Error Code Definitions for ra8-firmware.
ra8_err_codes_t ra8_err_t
Canonical error-return type used by every ra8-firmware API.
Dependency-injection vtable for the non-volatile version counter.
ra8_rot_antirollback_read_fn_t read
Read stored highest-accepted version.
ra8_rot_antirollback_commit_fn_t commit
Persist the newly-accepted version.