Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

PoC: Raise privilege if executing in ROM #258

Draft
wants to merge 7 commits into
base: pc_based_access_control_spi_2
Choose a base branch
from
Draft

PoC: Raise privilege if executing in ROM #258

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
42e375a
FPGA: Add SPI access control logic
secworks Jun 24, 2024
6c0fc26
fpga: Add testcase for SPI access control
secworks Jul 9, 2024
3a98f03
fpga: Include SPI master during linting
secworks Jul 9, 2024
3f67e77
(fpga) Start adding support for new control of FW and appo mode.
secworks Aug 28, 2024
23348d3
(fpga) Debug build and sim target.
secworks Aug 28, 2024
ad18c33
(fw) Enable FW mode at start.
secworks Aug 28, 2024
fd357a2
(fpga) Add API register for syscall trampoline address.
secworks Aug 28, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions hw/application_fpga/Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -199,6 +199,7 @@ LINT_FLAGS = +1364-2005ext+ --lint-only \
lint: $(FPGA_SRC) $(VERILOG_SRCS) $(ICE40_SIM_CELLS)
$(LINT) $(LINT_FLAGS) \
-DBRAM_FW_SIZE=$(BRAM_FW_SIZE) \
-DINCLUDE_SPI_MASTER \
-DFIRMWARE_HEX=\"$(P)/firmware.hex\" \
-DUDS_HEX=\"$(P)/data/uds.hex\" \
-DUDI_HEX=\"$(P)/data/udi.hex\" \
Expand Down
202 changes: 155 additions & 47 deletions hw/application_fpga/core/tk1/rtl/tk1.v
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -80,6 +80,7 @@ module tk1(
localparam ADDR_APP_SIZE = 8'h0d;

localparam ADDR_BLAKE2S = 8'h10;
localparam ADDR_SYSCALL = 8'h12;

localparam ADDR_CDI_FIRST = 8'h20;
localparam ADDR_CDI_LAST = 8'h27;
Expand All @@ -100,6 +101,7 @@ module tk1(
localparam ADDR_SPI_EN = 8'h80;
localparam ADDR_SPI_XFER = 8'h81;
localparam ADDR_SPI_DATA = 8'h82;
localparam ADDR_SPI_CMD = 8'h83;
`endif // INCLUDE_SPI_MASTER

localparam TK1_NAME0 = 32'h746B3120; // "tk1 "
Expand All @@ -109,15 +111,19 @@ module tk1(
localparam FW_RAM_FIRST = 32'hd0000000;
localparam FW_RAM_LAST = 32'hd00007ff;

localparam ROM_PREFIX = 2'h0;


//----------------------------------------------------------------
// Registers including update variables and write enable.
//----------------------------------------------------------------
reg [31 : 0] cdi_mem [0 : 7];
reg cdi_mem_we;

reg switch_app_reg;
reg switch_app_we;
reg fw_app_mode_reg;
reg fw_app_mode_new;
reg fw_app_mode_we;
reg fw_app_mode_rst;

reg [2 : 0] led_reg;
reg led_we;
Expand All @@ -138,6 +144,9 @@ module tk1(
reg [31 : 0] blake2s_addr_reg;
reg blake2s_addr_we;

reg [31 : 0] syscall_addr_reg;
reg syscall_addr_we;

reg [23 : 0] cpu_trap_ctr_reg;
reg [23 : 0] cpu_trap_ctr_new;
reg [2 : 0] cpu_trap_led_reg;
Expand All @@ -163,6 +172,16 @@ module tk1(
reg force_trap_set;


`ifdef INCLUDE_SPI_MASTER
reg spi_access_ctrl_reg;
reg spi_access_ctrl_new;
reg spi_access_ctrl_we;

reg [31 : 0] spi_cmd_addr_reg;
reg spi_cmd_addr_we;
`endif // INCLUDE_SPI_MASTER


//----------------------------------------------------------------
// Wires.
//----------------------------------------------------------------
Expand Down Expand Up @@ -192,7 +211,7 @@ module tk1(
assign read_data = tmp_read_data;
assign ready = tmp_ready;

assign fw_app_mode = switch_app_reg;
assign fw_app_mode = fw_app_mode_reg;

assign force_trap = force_trap_reg;

Expand Down Expand Up @@ -259,32 +278,38 @@ module tk1(
always @ (posedge clk)
begin : reg_update
if (!reset_n) begin
switch_app_reg <= 1'h0;
led_reg <= 3'h6;
gpio1_reg <= 2'h0;
gpio2_reg <= 2'h0;
gpio3_reg <= 1'h0;
gpio4_reg <= 1'h0;
app_start_reg <= 32'h0;
app_size_reg <= 32'h0;
blake2s_addr_reg <= 32'h0;
cdi_mem[0] <= 32'h0;
cdi_mem[1] <= 32'h0;
cdi_mem[2] <= 32'h0;
cdi_mem[3] <= 32'h0;
cdi_mem[4] <= 32'h0;
cdi_mem[5] <= 32'h0;
cdi_mem[6] <= 32'h0;
cdi_mem[7] <= 32'h0;
cpu_trap_ctr_reg <= 24'h0;
cpu_trap_led_reg <= 3'h0;
cpu_mon_en_reg <= 1'h0;
cpu_mon_first_reg <= 32'h0;
cpu_mon_last_reg <= 32'h0;
ram_addr_rand_reg <= 15'h0;
ram_data_rand_reg <= 32'h0;
force_trap_reg <= 1'h0;
system_reset_reg <= 1'h0;
fw_app_mode_reg <= 1'h1;
led_reg <= 3'h6;
gpio1_reg <= 2'h0;
gpio2_reg <= 2'h0;
gpio3_reg <= 1'h0;
gpio4_reg <= 1'h0;
app_start_reg <= 32'h0;
app_size_reg <= 32'h0;
blake2s_addr_reg <= 32'h0;
syscall_addr_reg <= 32'h0;
cdi_mem[0] <= 32'h0;
cdi_mem[1] <= 32'h0;
cdi_mem[2] <= 32'h0;
cdi_mem[3] <= 32'h0;
cdi_mem[4] <= 32'h0;
cdi_mem[5] <= 32'h0;
cdi_mem[6] <= 32'h0;
cdi_mem[7] <= 32'h0;
cpu_trap_ctr_reg <= 24'h0;
cpu_trap_led_reg <= 3'h0;
cpu_mon_en_reg <= 1'h0;
cpu_mon_first_reg <= 32'h0;
cpu_mon_last_reg <= 32'h0;
ram_addr_rand_reg <= 15'h0;
ram_data_rand_reg <= 32'h0;
force_trap_reg <= 1'h0;
system_reset_reg <= 1'h0;

`ifdef INCLUDE_SPI_MASTER
spi_cmd_addr_reg <= 32'h0;
spi_access_ctrl_reg <= 1'h0;
`endif // INCLUDE_SPI_MASTER
end

else begin
Expand All @@ -298,8 +323,16 @@ module tk1(
gpio2_reg[0] <= gpio2;
gpio2_reg[1] <= gpio2_reg[0];

if (switch_app_we) begin
switch_app_reg <= 1'h1;
// When not in FW mode, Disable things that are
// explitly enabled.
if (!fw_app_mode) begin
`ifdef INCLUDE_SPI_MASTER
spi_access_ctrl_reg <= 1'h0;
`endif // INCLUDE_SPI_MASTER
end

if (fw_app_mode_we) begin
fw_app_mode_reg <= fw_app_mode_new;
end

if (led_we) begin
Expand All @@ -326,6 +359,10 @@ module tk1(
blake2s_addr_reg <= write_data;
end

if (syscall_addr_we) begin
syscall_addr_reg <= write_data;
end

if (cdi_mem_we) begin
cdi_mem[address[2 : 0]] <= write_data;
end
Expand Down Expand Up @@ -357,6 +394,17 @@ module tk1(
if (force_trap_set) begin
force_trap_reg <= 1'h1;
end

`ifdef INCLUDE_SPI_MASTER
if (spi_cmd_addr_we) begin
spi_cmd_addr_reg <= write_data;
end

if (spi_access_ctrl_we) begin
spi_access_ctrl_reg <= write_data[0];
end
`endif // INCLUDE_SPI_MASTER

end
end // reg_update

Expand Down Expand Up @@ -424,12 +472,43 @@ module tk1(
end


//----------------------------------------------------------------
// fw_app_mode_ctrl
//
// Logic that implements the switch between FW mode and App
// mode. The FW mode can explicitly be enabled via API, but only if
// the instruction writing to the API comes from the ROM.
//
// As soon as an instruction is executed from RAM, the mode is
// switched to App mode. This means that after reset the device is
// in App mode, and will be set to App mode when the FW starts
// the loaded app.
// ----------------------------------------------------------------
always @*
begin : fw_app_mode_ctrl
fw_app_mode_new = 1'h0;
fw_app_mode_we = 1'h0;

if (cpu_valid & cpu_instr) begin
if (cpu_addr[31 : 30] == ROM_PREFIX) begin
if (fw_app_mode_rst) begin
fw_app_mode_new = 1'h0;
fw_app_mode_we = 1'h1;
end
end
else begin
fw_app_mode_new = 1'h1;
fw_app_mode_new = 1'h1;
Comment on lines +500 to +501
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

fw_app_mode_new set twice.

end
end
end


//----------------------------------------------------------------
// api
//----------------------------------------------------------------
always @*
begin : api
switch_app_we = 1'h0;
led_we = 1'h0;
gpio3_we = 1'h0;
gpio4_we = 1'h0;
Expand All @@ -445,23 +524,26 @@ module tk1(
cpu_mon_first_we = 1'h0;
cpu_mon_last_we = 1'h0;
cpu_mon_en_we = 1'h0;
fw_app_mode_rst = 1'h0;
tmp_read_data = 32'h0;
tmp_ready = 1'h0;

`ifdef INCLUDE_SPI_MASTER
spi_cmd_addr_we = 1'h0;
spi_enable_vld = 1'h0;
spi_start = 1'h0;
spi_tx_data_vld = 1'h0;

spi_enable = write_data[0];
spi_tx_data = write_data[7 : 0];
spi_enable = write_data[0] & spi_access_ctrl_reg;
spi_tx_data = write_data[7 : 0] & {8{spi_access_ctrl_reg}};

`endif // INCLUDE_SPI_MASTER

if (cs) begin
tmp_ready = 1'h1;
if (we) begin
if (address == ADDR_SWITCH_APP) begin
switch_app_we = 1'h1;
fw_app_mode_rst = 1'h1;
end

if (address == ADDR_LED) begin
Expand All @@ -474,13 +556,13 @@ module tk1(
end

if (address == ADDR_APP_START) begin
if (!switch_app_reg) begin
if (!fw_app_mode_reg) begin
app_start_we = 1'h1;
end
end

if (address == ADDR_APP_SIZE) begin
if (!switch_app_reg) begin
if (!fw_app_mode_reg) begin
app_size_we = 1'h1;
end
end
Expand All @@ -490,25 +572,31 @@ module tk1(
end

if (address == ADDR_BLAKE2S) begin
if (!switch_app_reg) begin
if (!fw_app_mode_reg) begin
blake2s_addr_we = 1'h1;
end
end

if (address == ADDR_SYSCALL) begin
if (!fw_app_mode_reg) begin
syscall_addr_we = 1'h1;
end
end

if ((address >= ADDR_CDI_FIRST) && (address <= ADDR_CDI_LAST)) begin
if (!switch_app_reg) begin
if (!fw_app_mode_reg) begin
cdi_mem_we = 1'h1;
end
end

if (address == ADDR_RAM_ADDR_RAND) begin
if (!switch_app_reg) begin
if (!fw_app_mode_reg) begin
ram_addr_rand_we = 1'h1;
end
end

if (address == ADDR_RAM_DATA_RAND) begin
if (!switch_app_reg) begin
if (!fw_app_mode_reg) begin
ram_data_rand_we = 1'h1;
end
end
Expand All @@ -531,15 +619,23 @@ module tk1(

`ifdef INCLUDE_SPI_MASTER
if (address == ADDR_SPI_EN) begin
spi_enable_vld = 1'h1;
if (!fw_app_mode_reg) begin
spi_access_ctrl_we = 1'h1;
end
end

if (address == ADDR_SPI_XFER) begin
spi_start = 1'h1;
spi_start = spi_access_ctrl_reg;
end

if (address == ADDR_SPI_DATA) begin
spi_tx_data_vld = 1'h1;
spi_tx_data_vld = spi_access_ctrl_reg;
end

if (address == ADDR_SPI_CMD) begin
if (!fw_app_mode_reg) begin
spi_cmd_addr_we = 1'h1;
end
end
`endif // INCLUDE_SPI_MASTER

Expand All @@ -558,7 +654,7 @@ module tk1(
end

if (address == ADDR_SWITCH_APP) begin
tmp_read_data = {32{switch_app_reg}};
tmp_read_data[0] = fw_app_mode_reg;
end

if (address == ADDR_LED) begin
Expand All @@ -582,24 +678,36 @@ module tk1(
tmp_read_data = blake2s_addr_reg;
end

if (address == ADDR_SYSCALL) begin
tmp_read_data = syscall_addr_reg;
end

if ((address >= ADDR_CDI_FIRST) && (address <= ADDR_CDI_LAST)) begin
tmp_read_data = cdi_mem[address[2 : 0]];
end

if ((address >= ADDR_UDI_FIRST) && (address <= ADDR_UDI_LAST)) begin
if (!switch_app_reg) begin
if (!fw_app_mode_reg) begin
tmp_read_data = udi_rdata;
end
end

`ifdef INCLUDE_SPI_MASTER
if (address == ADDR_SPI_XFER) begin
if (spi_access_ctrl_reg) begin
tmp_read_data[0] = spi_ready;
end
end

if (address == ADDR_SPI_DATA) begin
tmp_read_data[7 : 0] = spi_rx_data;
if (spi_access_ctrl_reg) begin
tmp_read_data[7 : 0] = spi_rx_data;
end
end

if (address == ADDR_SPI_CMD) begin
tmp_read_data = spi_cmd_addr_reg;
end
`endif // INCLUDE_SPI_MASTER

end
Expand Down
Loading