after updating a piece of FLASH memory, there is an inherent
cache coherence issue. This is because the write happens through
a side channel that is outside of the memory model of the system:
writes happen through a CSR that feed data to pages of FLASH.
Reads happen through direct-mapped memory regions that are unaware
of write mutations.
Thus, after writing a page of memory, if you try to access it,
sometimes you'll read the old cached value instead of the new
updated value.
This patch introduces a mandatory dcache flush after every
FLASH write, so that any cached FLASH regions are re-fetched.
this tries to catch the cases that:
- user tried to run the backup without first running "prepare backup..."
- the USB connection is a little flakey and returning bum data
We can only inspect the plaintext portions of the header, which contains
things like protocol version numbers, time stamps, and language codes.
We use the timestamp validation heavily because it's the only field that
isn't almost always going to be a 0 or 1 when correct, which are highly
likely to be reported anyways if there's a problem with the USB link.
This does assume the user sets the time correctly on the device
doing the backup, and on the Precursor itself.
verification is sort of pointless, because:
The Cargo.toml file is parsed and reformatted by the packaging tool to normalize its contents.
Thus, the Cargo.toml file of the downloaded version never matches the Cargo.toml file that's actually used.
Unfortunately, there doesn't seem to be an easy way to check the equivalence of two Cargo.toml files,
except for recursively and deeply parsing through and comparing all the possibile keys and values of
the abstract key/value tree. This is a much bigger project than I'm prepared to figure out today.
As a hack, we compare to the Cargo.toml.orig file. Which is...kind of OK, but really, this opens us
up to attacks where someone just has to replace a version on a package or even just swap out an
entire package for a malicious one by just using package name re-assignment which is a thing that
the format supports. In other words, all this checking is kind of pointless because it's super-easy
to swap out key crates for whole other crates and have it go undetected.
