Alan-Jowett / sonde / 24487242213

82%

push

github

fix(bpf): make spi_transfer verifiable with in-place buffer (ABI break) (#728)

* fix(bpf): make spi_transfer verifiable with in-place buffer model

Change spi_transfer (helper #4) from the unverifiable signature
  spi_transfer(handle, *tx, *rx, len)
to an in-place buffer model:
  spi_transfer(handle, *buf, len)

The buffer is read for transmit data, then overwritten with received
data.  This eliminates the verifier bug where the tx pointer had no
associated ConstSize bound — the Prevail verifier binds ConstSize to
the immediately preceding pointer only, so the old layout left tx
completely unchecked.

The new layout uses PtrToWritableMem + ConstSize (adjacent), which
the verifier can bounds-check correctly.

ABI-breaking change — all compiled BPF programs calling spi_transfer
must be recompiled.  No SPI sensors are deployed yet.

Changes:
- hal.rs: simplify Hal trait to spi_transfer(&mut self, handle, &mut buf)
- sonde_platform.rs: verifier registration PtrToWritableMem + ConstSize
- bpf_dispatch.rs: helper implementation + 3 updated tests
- sonde_helpers.h: C header updated
- esp_hal.rs, wake_cycle.rs, e2e harness.rs: Hal impls updated
- bpf-environment.md: spec updated with in-place semantics
- node-validation.md: T-N602 procedure updated

Closes #707

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Signed-off-by: Alan Jowett <alan.jowett@microsoft.com>

* fix(node): remove unused spi_echo field and prefix unused buf param

The in-place buffer model no longer needs the spi_echo flag (the mock
is a no-op since data is already in the buffer).  Prefix the buf
parameter with underscore to satisfy -D unused-variables.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Signed-off-by: Alan Jowett <alan.jowett@microsoft.com>

* fix(bpf): bump ABI version and add verifier prototype test

- Bump FIRMWARE_ABI_VERSION from 1 to 2 since spi_transfer signature
  changed (ABI-breaking). The gateway uses this to gate program... (continued)

34 of 37 new or added lines in 4 files covered. (91.89%)

23824 of 29659 relevant lines covered (80.33%)

184.06 hits per line