main.c

Go to the documentation of this file.

 
#include <stdint.h>
 
#include "ra8_attributes.h"
#include "ra8_board_ek_ra8d2.h"
#include "ra8_boot_entry.h"
#include "ra8_cgc.h"
#include "ra8_err.h"
#include "ra8_isr.h"
#include "ra8_mpu.h"
#include "ra8_time.h"

typedef enum : uint16_t {
  k_thumb_hi5_shift     = 11U,   
  k_thumb_hi5_mask      = 0x1FU, 
  k_thumb2_prefix_11101 = 0x1DU, 
  k_thumb2_prefix_11110 = 0x1EU, 
  k_thumb2_prefix_11111 = 0x1FU, 
} thumb_decode_t;
 
typedef enum : uint32_t {
  k_mpu_simple_region_size = 32U,         
  k_mpu_simple_mair0_word  = 0x000000FFU, 
} mpu_simple_region_t;

typedef enum : uint8_t {
  k_mpu_simple_attr_normal_wb = 0xFFU, 
  k_mpu_simple_probe_byte     = 0x42U, 
} mpu_simple_attr_t;

typedef enum : uint32_t {
  k_mpu_simple_period_ms = 1000U,   
  k_mpu_simple_baud      = 115200U, 
} mpu_simple_timing_t;

typedef enum : uint8_t {
  k_mpu_simple_frame_pc_idx = 6U, 
} mpu_simple_frame_t;

[[gnu::aligned(32)]] static uint8_t s_ro_buffer[k_mpu_simple_region_size] = {};

static volatile uint8_t s_fault_pending = 0U;

volatile uint32_t g_mpu_simple_match = 0U;

volatile uint32_t g_mpu_simple_fault_count = 0U;

RA8_INTERNAL static void internal_mpu_simple_panic_halt(void)
{
  while (1) {
    __asm__ volatile("wfi");
  }
}

static const ra8_mpu_region_t s_regions[] = {
  {
    .base       = (uintptr_t)s_ro_buffer,
    .size       = (uint32_t)k_mpu_simple_region_size,
    .priv       = k_ra8_mpu_perm_ro,
    .unpriv     = k_ra8_mpu_perm_ro,
    .executable = false,
    .shareable  = k_ra8_mpu_share_inner,
    .attr_idx   = k_ra8_mpu_attr_idx_0,
  },
};

static const ra8_mpu_cfg_t s_cfg = {
  .regions      = s_regions,
  .region_count = 1U,
  .mair0        = (uint32_t)k_mpu_simple_mair0_word,
  .mair1        = 0U,
  .privdefena   = true,
  .hfnmiena     = false,
};

RA8_INTERNAL static void internal_mpu_simple_setup_or_halt(void)
{
  uint32_t cpuclk0_hz = 0U;
  if (ra8_cgc_init() != k_ra8_ok) {
    internal_mpu_simple_panic_halt();
  }
  if (ra8_cgc_get_clock_hz(k_ra8_clock_id_cpuclk0, &cpuclk0_hz) != k_ra8_ok) {
    internal_mpu_simple_panic_halt();
  }
  if (ra8_time_init(cpuclk0_hz) != k_ra8_ok) {
    internal_mpu_simple_panic_halt();
  }
  if (ra8_board_uart_console_init((uint32_t)k_mpu_simple_baud) != k_ra8_ok) {
    internal_mpu_simple_panic_halt();
  }
  if (ra8_board_led_init(k_ra8_board_led1) != k_ra8_ok) {
    internal_mpu_simple_panic_halt();
  }
  if (ra8_board_led_init(k_ra8_board_led2) != k_ra8_ok) {
    internal_mpu_simple_panic_halt();
  }
  if (ra8_board_led_init(k_ra8_board_led3) != k_ra8_ok) {
    internal_mpu_simple_panic_halt();
  }
}

[[nodiscard]] RA8_INTERNAL static ra8_err_t internal_mpu_simple_probe(void)
{
  s_ro_buffer[0] = (uint8_t)k_mpu_simple_probe_byte;
  if (s_ro_buffer[0] == (uint8_t)k_mpu_simple_probe_byte) {
    return k_ra8_ok;
  }
  return k_ra8_err_hw_error;
}
 
#ifndef RA8_OFF_TARGET
/* Non-static + used: the inline assembly in MemManage_Handler
 * references this symbol by name, so it must survive LTO and the
 * dead-code stripper. */
RA8_INTERNAL [[gnu::used]] static void internal_mpu_simple_fault_recover(uint32_t* frame);
RA8_INTERNAL [[gnu::used]] static void internal_mpu_simple_fault_recover(uint32_t* frame)
{
  /* Advance the stacked PC past the faulting store. The compiler
   * emits ``strb r3, [r2]`` for the probe, which is 16 bits on
   * Thumb-1 / 32 bits on Thumb-2 depending on register allocation.
   * Reading the half-word at the stacked PC tells us which one we
   * landed on: low 5 bits 0b11101/0b11110/0b11111 mark a 32-bit
   * encoding (Armv8-M ARM A6.3.1 "Thumb instruction set encoding"),
   * everything else is 16-bit. */
  const uint16_t* insn         = (const uint16_t*)frame[k_mpu_simple_frame_pc_idx];
  const uint16_t  first_halfwd = *insn;
  const uint16_t  hi5          = (uint16_t)((first_halfwd >> k_thumb_hi5_shift) & k_thumb_hi5_mask);
  const bool is_thumb2_32b     = (hi5 == k_thumb2_prefix_11101) || (hi5 == k_thumb2_prefix_11110) ||
                                 (hi5 == k_thumb2_prefix_11111);
  frame[k_mpu_simple_frame_pc_idx] += (is_thumb2_32b ? 4U : 2U);
 
  /* NOTE: we deliberately do NOT clear the MemManage half-word of
   * CFSR. The HIL alive-mode probe runs with HIL_FAULT_EXPECTED=1
   * and explicitly REQUIRES a non-zero CFSR at probe time to prove
   * the configurable fault actually fired (the failure mode the
   * flag guards against is "app booted, looped, but never tripped
   * the MPU because the partition was misconfigured"). Leaving the
   * MMFSR bits latched gives the probe both proofs: CFSR != 0 says
   * the fault fired, and the running CycleCnt + match-counter +
   * UART banner say recovery succeeded. The bits self-clear on the
   * next chip reset; firmware never reads CFSR. */
  g_mpu_simple_fault_count += 1U;
  s_fault_pending = 1U;
}
 
[[gnu::naked]] void MemManage_Handler(void);
void                MemManage_Handler(void)
{
  __asm__ volatile("tst   lr, #4                          \n"
                   "ite   eq                              \n"
                   "mrseq r0, msp                         \n"
                   "mrsne r0, psp                         \n"
                   "push  {lr}                            \n"
                   "bl    internal_mpu_simple_fault_recover        \n"
                   "pop   {lr}                            \n"
                   "bx    lr                              \n");
}
#endif /* !RA8_OFF_TARGET */

static const uint8_t s_mpu_simple_banner[] = "mpu: fault handled, recovered\r\n";

RA8_INTERNAL static void internal_mpu_simple_emit_banner(void)
{
  (void)ra8_board_uart_console_write(s_mpu_simple_banner, sizeof(s_mpu_simple_banner) - 1U);
}
 
void main(void)
{
  internal_mpu_simple_setup_or_halt();
  ra8_isr_globals_enable();
 
  if (ra8_mpu_configure(&s_cfg) != k_ra8_ok) {
    internal_mpu_simple_panic_halt();
  }
 
  /* Probe drives the deliberate fault. On silicon the recovering
   * handler advances the stacked PC past the offending store and
   * resumes here; the readback then sees the original 0x00 (handler
   * skipped the write that would have written 0x42), so the probe
   * returns k_ra8_err_hw_error. On the host fake the store just
   * succeeds and the probe returns k_ra8_ok. */
  if (internal_mpu_simple_probe() == k_ra8_ok) {
    /* Host path: MPU did not arm (or fake). Latch LED3 as a
     * diagnostic but keep the main loop spinning so the HIL probe
     * sees forward progress. */
    (void)ra8_board_led_on(k_ra8_board_led3);
  } else {
    (void)ra8_board_led_on(k_ra8_board_led1);
  }
 
  while (1) {
    if (s_fault_pending != 0U) {
      s_fault_pending = 0U;
      internal_mpu_simple_emit_banner();
    }
    g_mpu_simple_match += 1U;
    (void)ra8_board_led_toggle(k_ra8_board_led1);
    ra8_delay_ms((uint32_t)k_mpu_simple_period_ms);
  }
  internal_mpu_simple_panic_halt();
}