Both PSRAM layouts were mapped as a single RWX window, so everything in external
RAM - the heap included - was executable.
PSRAM used as data only is now RW, and under XIP-from-PSRAM it is split per
section as ESP32-P4 does: .text RX, .rodata read-only, and the MMU-page
alignment gaps and the reclaimed heap RW, so neither is executable.
Both describe the layout that esp_psram_init() produces, and the entries are
locked, so - again as on ESP32-P4 - they are only narrowed when
CONFIG_SPIRAM_PRE_CONFIGURE_MEMORY_PROTECTION says that layout applies. Without
it the application owns the region and PSRAM stays RWX.
The per-section entries cost one PMP entry more than the 16 available, so the CPU
subsystem and peripheral windows are chained as TOR entries, taking one entry
instead of three.
soc.h is corrected against the S31 bus address map: the peripheral window base
was 1 MB too low, and the LP peripheral top, derived from a register base plus a
size rather than from the map, was 16 KB short. SOC_NON_CACHEABLE_OFFSET_FLASH
is added.
The bootloader locks PMA entries on core 0 only (PMA is per-hart), so
core 1 applies its PMA configuration with effective writes. Executing
that from flash momentarily makes the flash aperture non-cacheable
while reprogramming its entry, which executes ciphertext with flash
encryption enabled (illegal instruction -> CPU lockup).
Run esp_cpu_configure_invalid_regions() from IRAM: it reprograms the PMA
entry that keeps the flash aperture cacheable, so an instruction fetched
from flash inside the reprogramming window bypasses the cache and, with
flash encryption enabled, executes ciphertext (illegal instruction ->
CPU lockup).
Also move the PSRAM PMA entry to index 7 so that the application layout
matches the entry earlier bootloaders programmed and locked, keeping the
full layout effective under such bootloaders.
Freezing PMP entry indices as a bootloader<->application ABI (pmp_layout.h)
is only needed on targets where an already-shipped bootloader locks PMP
entries (C5, C6, C61, H2, P4). No such bootloader has ever shipped for
ESP32-S31 and, per the v6.2 PMP ownership policy, the bootloader never
configures or locks any PMP entry on this target - so there is no ABI to
freeze. Program all entries by plain index (as on ESP32-H4/H21) and state
that the application-owned layout is not an ABI.
Validate linked RISC-V executables when
CONFIG_COMPILER_ENABLE_RISCV_ZCMP is enabled on affected chips.
Disassemble each function and reject mstatus.MIE clears that lack an
earlier mintthresh write of 0xff.
Handle csrrci, csrrw, and register-mask csrrc patterns while ignoring
csrrs. Add build-only coverage for valid and invalid sequences with
CMake v1 and v2.
Stop the hardware stack guard before switching stacks during restart,
and keep ZCMP disabled for TEE test apps that still require the
workaround.
Jiang Jiang Jian
harshal.patil
Mahavir Jain
nilesh.kale
morris
Marius Vikhammer
Fu Hanxi
Roland Dobai
Armando (Dou Yiwen)
hebinglin
wuzhenghui
Ashish Sharma
Ma Jing Jing
luweike
wanckl
Alexey Lapshin
sibeibei
cjin
yanzihan@espressif.com
Li Shuai