Attempt a basic PC range check as part of hubris.validate

humility-core/src/hubris.rs

@@ -2080,34 +2080,27 @@ impl HubrisArchive {
         // To validate that what we're running on the target matches what
         // we have in the archive, we are going to check the image ID, an
         // identifer created for this purpose.
-        let addr = self.imageid.0;
-        let nbytes = self.imageid.1.len();
-        assert!(nbytes > 0);
-
-        let mut id = vec![0; nbytes];
-        core.read_8(addr, &mut id[0..nbytes]).with_context(|| {
-            format!("failed to read image ID at 0x{:x}; board mismatch?", addr)
-        })?;
-
-        let deltas = id
-            .iter()
-            .zip(self.imageid.1.iter())
-            .filter(|&(lhs, rhs)| lhs != rhs)
-            .count();
-
-        if deltas > 0 || id.len() != self.imageid.1.len() {
+        let id = self.read_image_id_from_flash(core)?;
+        if id != self.imageid.1 {
             bail!(
                     "image ID in archive ({:x?}) does not equal \
                     ID at 0x{:x} ({:x?})",
                     self.imageid.1, self.imageid.0, id,
                 );
         }
 
-        if criteria == HubrisValidate::ArchiveMatch {
+        if self.task_dump().is_some() {
             return Ok(());
+        } else {
+            core.halt()?;
+            if let Ok((false, pc)) = self.is_pc_within_archive(core) {
+                bail!("image ID matches but PC at 0x{pc:x} is not part of any \
+                       module. This is likely an incorrect A/B archive.");
+            }
+            core.run()?;
         }
 
-        if self.task_dump().is_some() {
+        if criteria == HubrisValidate::ArchiveMatch {
             return Ok(());
         }
 
@@ -2170,6 +2163,34 @@ impl HubrisArchive {
         );
     }
 
+    pub fn read_image_id_from_flash(
+        &self,
+        core: &mut dyn crate::core::Core,
+    ) -> Result<Vec<u8>> {
+        let addr = self.imageid.0;
+        let nbytes = self.imageid.1.len();
+        assert!(nbytes > 0);
+
+        let mut id = vec![0; nbytes];
+        core.read_8(addr, &mut id[0..nbytes]).with_context(|| {
+            format!("failed to read image ID at 0x{:x}; board mismatch?", addr)
+        })?;
+        Ok(id)
+    }
+
+    /// The core must be halted before this is called
+    pub fn is_pc_within_archive(
+        &self,
+        core: &mut dyn crate::core::Core
+    ) -> Result<(bool, u32)> {
+        let pc = core.read_reg(ARMRegister::PC)?;
+        if self.instr_mod(pc).is_none() {
+            Ok((false, pc))
+        } else {
+            Ok((true, pc))
+        }
+    }
+
     pub fn verify(
         &self,
         core: &mut dyn crate::core::Core,

humility-flash/src/lib.rs

@@ -5,10 +5,11 @@
 //! Functions to check flash state and reprogram a processor
 #![warn(missing_docs)]
 
+use anyhow::anyhow;
 use humility::{
     core::Core,
-    hubris::{HubrisArchive, HubrisValidate},
-    log::{Logger, info},
+    hubris::{HubrisArchive},
+    log::{Logger, info, warn},
 };
 use humility_auxflash::{AuxFlashHandler, AuxFlashWriter};
 use humility_probes_core::ProbeCore;
@@ -92,11 +93,30 @@ pub fn get_image_state(
 ) -> Result<ImageStateResult, ImageStateError> {
     core.halt().map_err(ImageStateError::HaltFailed)?;
 
+    if let Ok((false, pc)) = hubris.is_pc_within_archive(core) {
+        warn!(log, "PC at 0x{pc:x} is not part of any module. Maybe you're \
+                    flashing an A image while a B image is running, or vice \
+                    versa?");
+    }
+
     // First pass: check only the image ID
-    if let Err(e) = hubris.validate(core, HubrisValidate::ArchiveMatch) {
-        return Ok(ImageStateResult::DoesNotMatch(
-            ImageStateMismatch::FlashArchiveMismatch(e),
-        ));
+    match hubris.read_image_id_from_flash(core) {
+        Err(e) => {
+            return Ok(ImageStateResult::DoesNotMatch(
+                ImageStateMismatch::FlashArchiveMismatch(e),
+            ));
+        }
+        Ok(id) if id != hubris.image_id() => {
+            return Ok(ImageStateResult::DoesNotMatch(
+                ImageStateMismatch::FlashArchiveMismatch(anyhow!(
+                    "image ID in archive ({:x?}) does not equal \
+                         image ID of target ({:x?})",
+                    hubris.image_id(),
+                    id,
+                )),
+            ));
+        }
+        _ => (),
     }
 
     // More rigorous checks if requested