ra8_dfu_launch.c

Go to the documentation of this file.

 
#include "ra8_attributes.h"
#include "ra8_dfu.h"
#include "ra8_scb.h"
#ifdef RA8_ENABLE_ROOT_OF_TRUST
#include "ra8_dfu_antirollback.h"
#include "ra8_rot.h"
#endif
 
#ifdef RA8_ENABLE_ROOT_OF_TRUST
RA8_INTERNAL static bool internal_launch_authorized(uintptr_t src, uint32_t img_len)
{
  const ra8_rot_trailer_t* trailer = ra8_rot_trailer_after((const void*)src, img_len);
  if (ra8_rot_verify_image((const uint8_t*)src, img_len, trailer) != k_ra8_ok) {
    return false; /* DEFAULT-DENY: unauthenticated image */
  }
  if (ra8_rot_antirollback_verify(ra8_rot_antirollback_default_store(), trailer->img_version) !=
      k_ra8_ok) {
    return false; /* DEFAULT-DENY: downgrade, or an unreadable counter */
  }
  return true;
}
#endif /* RA8_ENABLE_ROOT_OF_TRUST */
 
void ra8_dfu_launch(uintptr_t src, uint32_t img_len, uint32_t entry)
{
  if (src == 0U) {
    return; /* nothing to copy */
  }
  if (!ra8_dfu_run_target_valid(entry, img_len)) {
    return; /* entry not the run base, or bad length -> caller drops to fallback */
  }
 
#ifdef RA8_ENABLE_ROOT_OF_TRUST
  /* Opt-in (see ra8_rot.h). With the flag OFF both gates are absent and the
   * launch proceeds on the CRC32 integrity check alone. */
  if (!internal_launch_authorized(src, img_len)) {
    return; /* DEFAULT-DENY -> caller's fallback path, nothing copied */
  }
#endif /* RA8_ENABLE_ROOT_OF_TRUST */
 
#ifndef RA8_OFF_TARGET
  const volatile uint32_t* s     = (const volatile uint32_t*)src;
  volatile uint32_t*       d     = (volatile uint32_t*)(uintptr_t)k_ra8_dfu_run_base;
  const uint32_t           words = img_len / (uint32_t)sizeof(uint32_t);
 
  __asm__ volatile("cpsid i" ::: "memory");
  /* Bounded by img_len (<= k_ra8_dfu_img_max via ra8_dfu_run_target_valid): a
   * statically bounded copy -- NASA Rule 2 compliant. */
  for (uint32_t i = 0U; i < words; ++i) {
    d[i] = s[i];
  }
  __asm__ volatile("dsb 0xF" ::: "memory"); /* image stores reach SRAM before fetch */
 
  const uint32_t initial_sp  = d[0];
  const uint32_t reset_entry = d[1];
 
  /* Point the Secure VTOR at the run base via the shared ra8_scb primitive,
   * then fence: the vector fetch on the coming branch must see the new base. */
  ra8_scb_set_vtor((uintptr_t)k_ra8_dfu_run_base);
  __asm__ volatile("dsb 0xF\n isb 0xF\n" ::: "memory");
  __asm__ volatile("msr msp, %0\n"
                   "bx %1\n"
                   :
                   : "r"(initial_sp), "r"(reset_entry)
                   : "memory");
  __builtin_unreachable();
#endif /* !RA8_OFF_TARGET */
}