BlackMark
546b1589a3
'W' handed the loader a whole page with no ack inside it and sp_spm handed any wire byte to SPMCSR, so a dropped byte re-aligned the stream and page data arrived where commands belong. That is how a page-address byte became BLBSET|SELFPRGEN on the tempmon board and programmed its lock bits. The first answer was to refuse that one command. It was the wrong shape twice over: it forbade a lock-bit write the owner may want, and it left every other command decided by bytes nobody checked. v9 checks them instead. One header for every command — opcode, selector, address, count, seal — folded and compared before the command is decoded, and *answered* before any payload moves: '+' accepts, 0xd4 (the ack inverted) refuses and nothing happened. An ack cannot do this job; it reports a command that has already run. It is smaller than v8 everywhere: 1284P 506→480, m8 498→480, 328P 484→468, t13A 474→460. The seal costs 14 bytes; bit opcodes in place of the letters pay for it twice over, since a letter costs a compare and a branch where a bit costs a skip. Both guards go — the lock-bit refusal because the seal covers it, the running-slot write guard because what it defended against was a wire fault naming an address and a wire fault can no longer name one. That one is a real trade: a host bug aimed at the running slot now lands. It buys a resident copy that can write its own slot, which is the only self-update route on a chip whose boot section *is* the slot. Two things the tests caught, both introduced here. Removing the invalid-opcode arm made every byte a command, so the knock stopped being harmless against a loader already in session and ate the five bytes behind it — identify moves to bit 5, which both 'p' and 'b' carry, so the knock is inert again and version discovery still works before the version is known. And the SPM value rides the count field because a data byte would arrive after the seal was checked. pbselfwrite and pbglitch are the new gates, both red-green: the same erase of the running page refused unsealed and performed sealed, and every header byte damaged after sealing refused where the identical damage before sealing is obeyed. Both judge by the simulator's flash, not the loader's opinion of it. pbreloc and pbrehome lose their write-guard probes, which is what those two gates replace. Defeating the seal in the loader turns seven tests red. 37 of 37 chips green with the exhaustive size matrix; README protocol section and every size row rewritten. pbhw gains an adversarial --seal-rounds sweep for the bench. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
96 lines
3.9 KiB
Python
96 lines
3.9 KiB
Python
#!/usr/bin/env python3
|
|
"""Position-independence acceptance test: the identical binary, flashed one
|
|
slot below the resident, must serve the complete command set from there. The
|
|
info block must come back byte-identical, and the staged copy must be able to
|
|
rewrite the resident verbatim — which is the whole of what relocation is for.
|
|
|
|
Usage: pbreloc.py <device_bin> <pureboot_elf> <mcu> <hz> <base_hex> <page>
|
|
<baud> <tool_py> <workdir>
|
|
"""
|
|
|
|
import os
|
|
import subprocess
|
|
import sys
|
|
|
|
|
|
def fail(message):
|
|
print(f"FAIL: {message}")
|
|
sys.exit(1)
|
|
|
|
|
|
def main():
|
|
device_bin, elf, mcu, hz, base_hex, page, baud, tool, workdir = sys.argv[1:]
|
|
base, page, baud = int(base_hex, 0), int(page), int(baud)
|
|
stage = None # derived from the device's own info (slot-sized) below
|
|
sys.path.insert(0, os.path.dirname(os.path.abspath(tool)))
|
|
sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
|
|
import pbsim
|
|
import pureboot as pb
|
|
|
|
os.makedirs(workdir, exist_ok=True)
|
|
objcopy = os.environ.get("PB_OBJCOPY", "avr-objcopy")
|
|
image_path = os.path.join(workdir, "pureboot.bin")
|
|
subprocess.run([objcopy, "-O", "binary", elf, image_path], check=True)
|
|
image = open(image_path, "rb").read()
|
|
|
|
device = pbsim.Device(device_bin, elf, mcu, hz, base_hex, page, baud, os.path.join(workdir, "dump.bin"))
|
|
try:
|
|
port = pb.Port(device.pty, baud)
|
|
loader = pb.Loader(port)
|
|
info = loader.connect(25)
|
|
if info.base != base:
|
|
fail(f"info reports base {info.base:#06x}")
|
|
resident_info = info.raw
|
|
|
|
# Install the staging copy exactly as the update flow would.
|
|
stage = info.stage
|
|
staged = pb.staging_content(image, info)
|
|
pb.write_differing(loader, stage, staged)
|
|
|
|
# Enter it; from here on, every command runs in the relocated copy.
|
|
staged_info = loader.enter_copy(stage, 25)
|
|
if staged_info.raw != resident_info:
|
|
fail(f"staged info {staged_info.raw.hex()} != resident info {resident_info.hex()}")
|
|
|
|
# 'R' from the staged copy already proved itself in the install
|
|
# verify; 'F' must answer 4 bytes (values are unmodeled in simavr).
|
|
if len(loader.read_fuses()) != 4:
|
|
fail("fuse read from the staged copy")
|
|
|
|
# EEPROM round-trip through the staged copy.
|
|
pattern = bytes(range(0x50, 0x60))
|
|
loader.write_eeprom(0, pattern)
|
|
if loader.read_eeprom(0, len(pattern)) != pattern:
|
|
fail("EEPROM round-trip through the staged copy")
|
|
|
|
# The resident slot, written from the copy standing beside it — the
|
|
# whole point of relocating. pureboot 9 dropped the running-slot guard
|
|
# that used to sit behind this, so the probe that used to accompany it
|
|
# (aim a write at the copy's *own* slot and watch it be refused) is
|
|
# gone with it: there is nothing to refuse now, and a copy that erases
|
|
# the page it is executing from does not come back to report it.
|
|
# pbselfwrite.py gates that direction on a device it is allowed to
|
|
# destroy.
|
|
marker = bytes((i * 3) & 0xFF for i in range(page))
|
|
loader.write_page(base, marker)
|
|
if loader.read_flash(base, page) != marker:
|
|
loader.write_page(base, marker)
|
|
if loader.read_flash(base, page) != marker:
|
|
fail("the staged copy could not write the resident slot, even on retry")
|
|
|
|
# Restore the resident image through the staged copy, then 'J' back
|
|
# into it and prove it lives.
|
|
resident = image + b"\xff" * (pb.SLOT - len(image))
|
|
pb.write_differing(loader, base, resident)
|
|
back_info = loader.enter_copy(base, 25)
|
|
if back_info.raw != resident_info:
|
|
fail("the restored resident does not serve its info block")
|
|
port.close()
|
|
finally:
|
|
device.stop()
|
|
print("pbreloc: the relocated copy serves the full command set")
|
|
|
|
|
|
if __name__ == "__main__":
|
|
main()
|