Skip to content

Commit 64ae64f

Browse files
pacucha42pacucha42
committed
fix(security): Fixed ESP32S2 memory protection check for Peri1 RTCSLOW interrupt
- fixes the issue found in #15359 - extends debug printouts in the related tests
1 parent 04133e0 commit 64ae64f

File tree

3 files changed

+23
-12
lines changed

3 files changed

+23
-12
lines changed

‎components/hal/esp32s2/include/hal/memprot_peri_ll.h‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* SPDX-FileCopyrightText: 2020-2022 Espressif Systems (Shanghai) CO LTD
2+
* SPDX-FileCopyrightText: 2020-2025 Espressif Systems (Shanghai) CO LTD
33
*
44
* SPDX-License-Identifier: Apache-2.0
55
*/
@@ -112,7 +112,7 @@ static inline intptr_t memprot_ll_peri1_rtcslow_get_fault_address(void)
112112

113113
static inline bool memprot_ll_peri1_rtcslow_is_intr_mine(void)
114114
{
115-
if (memprot_ll_dram0_is_assoc_intr()) {
115+
if (memprot_ll_peri1_is_assoc_intr()) {
116116
uint32_t faulting_address = (uint32_t)memprot_ll_peri1_rtcslow_get_fault_address();
117117
return faulting_address >= PERI1_RTCSLOW_ADDRESS_LOW && faulting_address <= PERI1_RTCSLOW_ADDRESS_HIGH;
118118
}
@@ -123,7 +123,7 @@ static inline memprot_hal_err_t memprot_ll_peri1_rtcslow_set_prot(uint32_t *spli
123123
{
124124
uint32_t addr = (uint32_t)split_addr;
125125

126-
//check corresponding range fit & aligment to 32bit boundaries
126+
//check corresponding range fit & alignment to 32bit boundaries
127127
if (addr < PERI1_RTCSLOW_ADDRESS_LOW || addr > PERI1_RTCSLOW_ADDRESS_HIGH) {
128128
return MEMP_HAL_ERR_SPLIT_ADDR_INVALID;
129129
}
@@ -281,7 +281,7 @@ static inline memprot_hal_err_t memprot_ll_peri2_rtcslow_0_set_prot(uint32_t *sp
281281
{
282282
uint32_t addr = (uint32_t)split_addr;
283283

284-
//check corresponding range fit & aligment to 32bit boundaries
284+
//check corresponding range fit & alignment to 32bit boundaries
285285
if (addr < PERI2_RTCSLOW_0_ADDRESS_LOW || addr > PERI2_RTCSLOW_0_ADDRESS_HIGH) {
286286
return MEMP_HAL_ERR_SPLIT_ADDR_INVALID;
287287
}
@@ -369,7 +369,7 @@ static inline memprot_hal_err_t memprot_ll_peri2_rtcslow_1_set_prot(uint32_t *sp
369369
{
370370
uint32_t addr = (uint32_t)split_addr;
371371

372-
//check corresponding range fit & aligment to 32bit boundaries
372+
//check corresponding range fit & alignment to 32bit boundaries
373373
if (addr < PERI2_RTCSLOW_1_ADDRESS_LOW || addr > PERI2_RTCSLOW_1_ADDRESS_HIGH) {
374374
return MEMP_HAL_ERR_SPLIT_ADDR_INVALID;
375375
}

‎tools/ci/check_copyright_ignore.txt‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -996,7 +996,6 @@ tools/test_apps/system/build_test/main/test_main.c
996996
tools/test_apps/system/cxx_no_except/main/main.cpp
997997
tools/test_apps/system/gdb_loadable_elf/main/hello_world_main.c
998998
tools/test_apps/system/longjmp_test/main/hello_world_main.c
999-
tools/test_apps/system/memprot/main/esp32s2/test_memprot_main.c
1000999
tools/test_apps/system/no_embedded_paths/check_for_file_paths.py
10011000
tools/test_apps/system/no_embedded_paths/main/test_no_embedded_paths_main.c
10021001
tools/test_apps/system/startup/main/test_startup_main.c

‎tools/test_apps/system/memprot/main/esp32s2/test_memprot_main.c‎

Lines changed: 18 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,18 @@
1-
/* MEMPROT IramDram testing code */
1+
/*
2+
* SPDX-FileCopyrightText: 2020-2025 Espressif Systems (Shanghai) CO LTD
3+
*
4+
* SPDX-License-Identifier: Apache-2.0
5+
*/
6+
27
#include <stdio.h>
38
#include <string.h>
49
#include "sdkconfig.h"
510
#include "esp_log.h"
611
#include "esp32s2/memprot.h"
712
#include "soc/soc.h"
813

14+
static const char *TAG = "memprot_test_ESP32S2";
15+
916
/*
1017
* ESP32S2 MEMORY PROTECTION MODULE TEST
1118
* =====================================
@@ -64,7 +71,6 @@
6471
* ********************************************************************************************
6572
*/
6673

67-
6874
/* !!!IMPORTANT!!!
6975
* a0 needs to be saved/restored manually (not clobbered) to avoid return address corruption
7076
* caused by ASM block handling
@@ -107,7 +113,6 @@ static uint8_t RTC_SLOW_ATTR rtcslow_dummy_buffer[2 * SRAM_TEST_BUFFER_SIZE] = {
107113
* testing regions and splitting address scheme
108114
*
109115
*/
110-
111116
static uint32_t *test_memprot_dram0_rtcfast_get_min_split_addr(void)
112117
{
113118
return (uint32_t *)(rtcfast_dummy_buffer + sizeof(rtcfast_dummy_buffer) / 2);
@@ -186,7 +191,6 @@ static uint32_t *test_memprot_addr_high(mem_type_prot_t mem_type)
186191
}
187192
}
188193

189-
190194
static uint32_t *test_memprot_get_split_addr(mem_type_prot_t mem_type)
191195
{
192196
switch (mem_type) {
@@ -209,7 +213,6 @@ static uint32_t *test_memprot_get_split_addr(mem_type_prot_t mem_type)
209213
}
210214
}
211215

212-
213216
/*
214217
* testing setup of the memory-protection module
215218
*/
@@ -274,7 +277,7 @@ static void test_memprot_set_prot(uint32_t *mem_type_mask, bool use_panic_handle
274277
esp_memprot_set_prot_peri2(MEMPROT_PERI2_RTCSLOW_1, test_memprot_peri2_rtcslow_1_get_min_split_addr(), WR_LOW_DIS, RD_LOW_DIS, EX_LOW_DIS, WR_HIGH_DIS, RD_HIGH_DIS, EX_HIGH_DIS);
275278
}
276279

277-
//reenable protection (bus based)
280+
//re-enable protection (bus based)
278281
if (use_iram0) {
279282
esp_memprot_intr_ena(MEMPROT_IRAM0_SRAM, true);
280283
}
@@ -355,9 +358,11 @@ static void test_memprot_read(mem_type_prot_t mem_type)
355358
bool write_perm_low, write_perm_high, read_perm_low, read_perm_high;
356359
esp_memprot_get_perm_write(mem_type, &write_perm_low, &write_perm_high);
357360
esp_memprot_get_perm_read(mem_type, &read_perm_low, &read_perm_high);
361+
ESP_EARLY_LOGD(TAG, "TEST_READ (low: r=%u w=%u, high: r=%u w=%u):", read_perm_low, write_perm_low, read_perm_high, write_perm_high);
358362

359363
volatile uint32_t *ptr_low = test_memprot_addr_low(mem_type);
360364
volatile uint32_t *ptr_high = test_memprot_addr_high(mem_type);
365+
ESP_EARLY_LOGD(TAG, "[test_addr_low=0x%08X test_addr_high=0x%08X]", ptr_low, ptr_high);
361366

362367
//temporarily allow WRITE for setting the test values
363368
esp_memprot_set_write_perm(mem_type, true, true);
@@ -397,12 +402,14 @@ static void test_memprot_write(mem_type_prot_t mem_type)
397402
bool write_perm_low, write_perm_high, read_perm_low, read_perm_high;
398403
esp_memprot_get_perm_write(mem_type, &write_perm_low, &write_perm_high);
399404
esp_memprot_get_perm_read(mem_type, &read_perm_low, &read_perm_high);
405+
ESP_EARLY_LOGD(TAG, "TEST_WRITE (low: r=%u w=%u, high: r=%u w=%u):", read_perm_low, write_perm_low, read_perm_high, write_perm_high);
400406

401407
//temporarily allow READ operation
402408
esp_memprot_set_read_perm(mem_type, true, true);
403409

404410
volatile uint32_t *ptr_low = test_memprot_addr_low(mem_type);
405411
volatile uint32_t *ptr_high = test_memprot_addr_high(mem_type);
412+
ESP_EARLY_LOGD(TAG, "[test_addr_low=0x%08X test_addr_high=0x%08X]", ptr_low, ptr_high);
406413

407414
//perform WRITE in low region
408415
const uint32_t test_val = 10;
@@ -447,8 +454,13 @@ static void test_memprot_exec(mem_type_prot_t mem_type)
447454
bool exec_perm_low, exec_perm_high;
448455
esp_memprot_get_perm_exec(mem_type, &exec_perm_low, &exec_perm_high);
449456

457+
bool read_perm_low, read_perm_high;
458+
esp_memprot_get_perm_read(mem_type, &read_perm_low, &read_perm_high);
459+
ESP_EARLY_LOGD(TAG, "TEST_EXEC (low: r=%u w=%u x=%u, high: r=%u w=%u x=%u):", read_perm_low, write_perm_low, exec_perm_low, read_perm_high, write_perm_high, exec_perm_high);
460+
450461
volatile uint32_t *fnc_ptr_low = test_memprot_addr_low(mem_type);
451462
volatile uint32_t *fnc_ptr_high = test_memprot_addr_high(mem_type);
463+
ESP_EARLY_LOGD(TAG, "[test_addr_low=0x%08X test_addr_high=0x%08X]", fnc_ptr_low, fnc_ptr_high);
452464

453465
//enable WRITE permission for both segments
454466
esp_memprot_set_write_perm(mem_type, true, true);

0 commit comments

Comments
 (0)