Merge branch 'fix/pmp_drom_mask_read_only_v5.5' into 'release/v5.5'

fix(cpu_region_protect): set DROM mask PMP entry to read-only (v5.5)

See merge request espressif/esp-idf!47577
This commit is contained in:
Jiang Jiang Jian
2026-05-22 16:29:53 +08:00
5 changed files with 54 additions and 1 deletions

View File

@@ -137,7 +137,7 @@ void esp_cpu_configure_region_protection(void)
if ((drom_start & (SOC_CPU_PMP_REGION_GRANULARITY - 1)) == 0) {
PMP_ENTRY_SET(1, SOC_IROM_MASK_LOW, NONE);
PMP_ENTRY_SET(2, drom_start, PMP_TOR | RX);
PMP_ENTRY_SET(3, SOC_DROM_MASK_HIGH, PMP_TOR | RW);
PMP_ENTRY_SET(3, SOC_DROM_MASK_HIGH, PMP_TOR | R);
} else {
const uint32_t pmpaddr1 = PMPADDR_NAPOT(SOC_IROM_MASK_LOW, SOC_IROM_MASK_HIGH);
PMP_ENTRY_SET(1, pmpaddr1, PMP_NAPOT | RX);

View File

@@ -63,6 +63,12 @@ void test_spiram_xip_irom_alignment_reg_execute_violation(void);
void test_spiram_xip_drom_alignment_reg_execute_violation(void);
void test_irom_mask_reg_write_violation(void);
#ifdef SOC_DROM_MASK_HIGH
void test_drom_mask_reg_write_violation(void);
#endif
void test_drom_reg_write_violation(void);
void test_drom_reg_execute_violation(void);

View File

@@ -188,6 +188,10 @@ void app_main(void)
#if CONFIG_ESP_SYSTEM_PMP_IDRAM_SPLIT
HANDLE_TEST(test_name, test_irom_reg_write_violation);
HANDLE_TEST(test_name, test_irom_mask_reg_write_violation);
#ifdef SOC_DROM_MASK_HIGH
HANDLE_TEST(test_name, test_drom_mask_reg_write_violation);
#endif
HANDLE_TEST(test_name, test_drom_reg_write_violation);
HANDLE_TEST(test_name, test_drom_reg_execute_violation);

View File

@@ -299,6 +299,23 @@ void test_irom_reg_write_violation(void)
*test_addr = RND_VAL;
}
void test_irom_mask_reg_write_violation(void)
{
uint32_t *test_addr = (uint32_t *)(SOC_IROM_MASK_LOW + 0x04);
printf("ROM (IROM Mask): Write operation | Address: %p\n", test_addr);
*test_addr = RND_VAL;
}
#ifdef SOC_DROM_MASK_HIGH
void test_drom_mask_reg_write_violation(void)
{
uint32_t *test_addr = (uint32_t *)(SOC_DROM_MASK_HIGH - 0x04);
printf("ROM (DROM Mask): Write operation | Address: %p\n", test_addr);
*test_addr = RND_VAL;
}
#endif
void test_drom_reg_write_violation(void)
{
uint32_t *test_addr = (uint32_t *)((uint32_t)(foo_buf));

View File

@@ -1114,6 +1114,32 @@ def drom_reg_write_violation(dut: PanicTestDut, test_func_name: str) -> None:
dut.expect_cpu_reset()
def irom_mask_reg_write_violation(dut: PanicTestDut, test_func_name: str) -> None:
dut.run_test_func(test_func_name)
dut.expect_gme('Store access fault')
dut.expect_reg_dump(0)
dut.expect_cpu_reset()
@pytest.mark.generic
@idf_parametrize('config, target', CONFIGS_MEMPROT_FLASH_IDROM, indirect=['config', 'target'])
def test_irom_mask_reg_write_violation(dut: PanicTestDut, test_func_name: str) -> None:
irom_mask_reg_write_violation(dut, test_func_name)
def drom_mask_reg_write_violation(dut: PanicTestDut, test_func_name: str) -> None:
dut.run_test_func(test_func_name)
dut.expect_gme('Store access fault')
dut.expect_reg_dump(0)
dut.expect_cpu_reset()
@pytest.mark.generic
@idf_parametrize('config, target', CONFIGS_MEMPROT_FLASH_IDROM, indirect=['config', 'target'])
def test_drom_mask_reg_write_violation(dut: PanicTestDut, test_func_name: str) -> None:
drom_mask_reg_write_violation(dut, test_func_name)
@pytest.mark.generic
@idf_parametrize('config, target', CONFIGS_MEMPROT_FLASH_IDROM, indirect=['config', 'target'])
def test_drom_reg_write_violation(dut: PanicTestDut, test_func_name: str) -> None: