emu_mpu.c

Go to the documentation of this file.

 
#include "emu_mpu.h"
 
#include "emu_engine.h"
#include "emu_exc.h"

typedef enum : uint32_t {
  k_mpu_ctrl_enable_bit  = 1U << 0U,    
  k_mpu_rbar_ap_ro_bit   = 1U << 2U,    
  k_mpu_rlar_en_bit      = 1U << 0U,    
  k_mpu_addr_mask        = 0xFFFFFFE0U, 
  k_mpu_region_low_mask  = 0x1FU,       
  k_mpu_rnr_mask         = 0x7U,        
  k_mpu_max_regions      = 8U,          
  k_cfsr_mmfsr_daccviol  = 1U << 1U,    
  k_cfsr_mmfsr_mmarvalid = 1U << 7U,    
} mpu_field_t;

typedef struct {
  uint32_t base;  
  uint32_t limit; 
  bool     ro;    
  bool     en;    
} mpu_region_t;
 
static mpu_region_t s_mpu_region[k_mpu_max_regions];  
static bool         s_mpu_enabled;                    
static uc_hook      s_mpu_ro_hook[k_mpu_max_regions]; 
static uint32_t     s_mpu_ro_hook_n;                  
static bool         s_mpu_fault;                      
static uint32_t     s_mpu_fault_pc;                   
static uint32_t     s_mpu_fault_addr;                 

RA8_INTERNAL static void internal_on_mpu_ro_write(uc_engine*  uc,
                                                  uc_mem_type type,
                                                  uint64_t    addr,
                                                  int         size,
                                                  int64_t     value,
                                                  void*       user)
{
  (void)type;
  (void)size;
  (void)value;
  (void)user;
  if (s_mpu_fault) {
    return; /* one pending fault is enough; the run loop takes it next */
  }
  s_mpu_fault      = true;
  s_mpu_fault_addr = (uint32_t)addr;
  s_mpu_fault_pc   = reg_get(uc, UC_ARM_REG_PC);
  (void)uc_emu_stop(uc);
}

RA8_INTERNAL static void internal_mpu_install_ro_hooks(uc_engine* uc)
{
  s_mpu_ro_hook_n = 0U;
  for (uint32_t i = 0U; i < (uint32_t)k_mpu_max_regions; i++) {
    if (!s_mpu_region[i].en || !s_mpu_region[i].ro) {
      continue;
    }
    (void)uc_hook_add(uc,
                      &s_mpu_ro_hook[s_mpu_ro_hook_n],
                      UC_HOOK_MEM_WRITE,
                      (void*)internal_on_mpu_ro_write,
                      nullptr,
                      (uint64_t)s_mpu_region[i].base,
                      (uint64_t)s_mpu_region[i].limit);
    s_mpu_ro_hook_n++;
  }
}

RA8_INTERNAL static void internal_mpu_remove_ro_hooks(uc_engine* uc)
{
  for (uint32_t i = 0U; i < s_mpu_ro_hook_n; i++) {
    (void)uc_hook_del(uc, s_mpu_ro_hook[i]);
  }
  s_mpu_ro_hook_n = 0U;
}

RA8_INTERNAL static void internal_on_mpu_rlar_write(uc_engine*  uc,
                                                    uc_mem_type type,
                                                    uint64_t    addr,
                                                    int         size,
                                                    int64_t     value,
                                                    void*       user)
{
  (void)type;
  (void)addr;
  (void)size;
  (void)user;
  const uint32_t rnr      = rd32(uc, (uint64_t)k_mpu_rnr) & (uint32_t)k_mpu_rnr_mask;
  const uint32_t rbar     = rd32(uc, (uint64_t)k_mpu_rbar);
  const uint32_t rlar     = (uint32_t)value;
  s_mpu_region[rnr].base  = rbar & (uint32_t)k_mpu_addr_mask;
  s_mpu_region[rnr].limit = (rlar & (uint32_t)k_mpu_addr_mask) | (uint32_t)k_mpu_region_low_mask;
  s_mpu_region[rnr].ro    = (rbar & (uint32_t)k_mpu_rbar_ap_ro_bit) != 0U;
  s_mpu_region[rnr].en    = (rlar & (uint32_t)k_mpu_rlar_en_bit) != 0U;
}

RA8_INTERNAL static void internal_on_mpu_ctrl_write(uc_engine*  uc,
                                                    uc_mem_type type,
                                                    uint64_t    addr,
                                                    int         size,
                                                    int64_t     value,
                                                    void*       user)
{
  (void)type;
  (void)addr;
  (void)size;
  (void)user;
  const bool enable = ((uint32_t)value & (uint32_t)k_mpu_ctrl_enable_bit) != 0U;
  if (enable && !s_mpu_enabled) {
    internal_mpu_install_ro_hooks(uc);
    s_mpu_enabled = true;
  } else if (!enable && s_mpu_enabled) {
    internal_mpu_remove_ro_hooks(uc);
    s_mpu_enabled = false;
  }
}

void mpu_synth_memmanage(uc_engine* uc, uint32_t vtor_base)
{
  const uint32_t cfsr = rd32(uc, (uint64_t)k_scb_cfsr) | (uint32_t)k_cfsr_mmfsr_daccviol |
                        (uint32_t)k_cfsr_mmfsr_mmarvalid;
  wr32(uc, (uint64_t)k_scb_cfsr, cfsr);
  wr32(uc, (uint64_t)k_scb_mmfar, s_mpu_fault_addr);
  (void)uc_reg_write(uc, UC_ARM_REG_PC, &s_mpu_fault_pc);
  const uint32_t handler = exc_vector(uc, vtor_base, (uint32_t)k_exc_memmanage);
  if (handler != 0U) {
    exc_enter(uc, (uint32_t)k_exc_memmanage, handler);
  }
}

void emu_mpu_install(uc_engine* uc)
{
  /* Armv8-M MPU enforcement: capture each region at its RLAR write, then arm /
   * disarm read-only-region write traps on MPU_CTRL.ENABLE edges. Inert unless
   * the firmware programs and enables the MPU (mpu_partition_simple); a trapped
   * store synthesises MemManage in the run loop (see internal_on_mpu_ro_write). */
  static uc_hook s_h_mpu_rlar;
  static uc_hook s_h_mpu_ctrl;
  (void)uc_hook_add(uc,
                    &s_h_mpu_rlar,
                    UC_HOOK_MEM_WRITE,
                    (void*)internal_on_mpu_rlar_write,
                    nullptr,
                    (uint64_t)k_mpu_rlar,
                    (uint64_t)k_mpu_rlar + 3U);
  (void)uc_hook_add(uc,
                    &s_h_mpu_ctrl,
                    UC_HOOK_MEM_WRITE,
                    (void*)internal_on_mpu_ctrl_write,
                    nullptr,
                    (uint64_t)k_mpu_ctrl,
                    (uint64_t)k_mpu_ctrl + 3U);
}

bool emu_mpu_fault_pending(void)
{
  return s_mpu_fault;
}

void emu_mpu_clear_fault(void)
{
  s_mpu_fault = false;
}