[ROM_EXT] Leave unverified flash region locked

[siemen11]

The ROM_EXT calls epmp_clear_lock_bits before the jump to BL0. Leave the unverified part of flash locked throughout this jump.

[sasdf]

I would expect to leave all the lock bit (e.g. for regions like RAM / MMIO), and let the OwnerSw's M-mode to reconfigure, which will protect also the M-mode early boot code on the OwnerSw side.

But LGTM if we want to change the behavior incrementally.

[siemen11]

I would expect to leave all the lock bit (e.g. for regions like RAM / MMIO), and let the OwnerSw's M-mode to reconfigure, which will protect also the M-mode early boot code on the OwnerSw side.

But LGTM if we want to change the behavior incrementally.

Thanks @sasdf, that makes the change a bit nicer

[sasdf]

Thanks, I'll try with our ownersw tomorrow to test its compatibility.

[vsukhoml]

Instead of deleting epmp_clear_lock_bits() entirely:

• Disable Entry 11 (Stack Guard) before jumping to OwnerSw (OwnerSw has its own stack).
• Clear lock bits on Entries 0..11, but preserve the lock bit on Entry 12 (pmpcfg3 byte 0).

--- a/sw/device/silicon_creator/rom_ext/rom_ext.c
+++ b/sw/device/silicon_creator/rom_ext/rom_ext.c
@@ -304,6 +304,11 @@ static rom_error_t rom_ext_boot(boot_data_t *boot_data, boot_log_t *boot_log,
   SEC_MMIO_WRITE_INCREMENT(kFlashCtrlSecMmioCreatorInfoPagesLockdown +
                            kOtpSecMmioCreatorSwCfgLockDown);
 
+  // Disable the ROM_EXT stack guard; OwnerSw manages its own stack.
+  epmp_clear(11);
+
+  // Clear lock bits on entries 0..11 only (pmpcfg0..2).
+  // Keep Entry 12 (physical flash) locked (L=1, RO) in pmpcfg3 to prevent
+  // M-mode execution on the inactive slot via fault injection on line 380.
+  CSR_CLEAR_BITS(CSR_REG_PMPCFG0, 0x80808080);
+  CSR_CLEAR_BITS(CSR_REG_PMPCFG1, 0x80808080);
+  CSR_CLEAR_BITS(CSR_REG_PMPCFG2, 0x80808080);
+
   // Configure address translation, compute the epmp regions and the entry
   // point for the virtual address in case the address translation is enabled.

[siemen11]

Thanks for the help Vadim! I updated the commit already to reflect this. We can then test further to see whether this fits the bill

[vsukhoml]

Let ROM_EXT only lock Entry 12 (physical flash) and disable Entry 11 (stack guard), while clearing lock bits on Entries 0..11. This fixes the vulnerability immediately and does not break existing deployed OwnerSw images.