Add support for UICR.ERASEPROTECT configuration, which blocks ERASEALL
operations to prevent bulk erasure of protected memory.
This introduces a Kconfig option GEN_UICR_ERASEPROTECT that enables
blocking of ERASEALL operations on NVR0, preserving UICR settings even
if an attacker attempts a full-chip erase.
This is a critical security feature for production devices. When enabled
together with UICR.LOCK, it becomes impossible to modify the UICR in
any way, establishing a permanent device protection scheme. Due to this
irreversibility, it should only be enabled during the final stages of
production.
When enabled, the gen_uicr.py script sets UICR.ERASEPROTECT to
0xFFFFFFFF, which prevents the ERASEALL command from affecting the
NVR0 page.
Signed-off-by: Sebastian Bøe <sebastian.boe@nordicsemi.no>
Add support for UICR.LOCK configuration, which locks the entire UICR
configuration in NVR0 to prevent unauthorized modifications.
This introduces a Kconfig option GEN_UICR_LOCK that enables locking
of the UICR. Once locked, the UICR can only be modified by performing
an ERASEALL operation.
This is a critical security feature for production devices, typically
enabled alongside UICR.APPROTECT, UICR.PROTECTEDMEM, and
UICR.ERASEPROTECT to establish a complete device protection scheme.
When enabled, the gen_uicr.py script sets UICR.LOCK to 0xFFFFFFFF,
which configures the NVR0 page as read-only and enforces integrity
checks on the UICR content.
Signed-off-by: Sebastian Bøe <sebastian.boe@nordicsemi.no>
Add support for UICR.SECONDARY.PROTECTEDMEM configuration, which enables
configuration of the protected memory region for secondary firmware.
This introduces Kconfig options for configuring:
- GEN_UICR_SECONDARY_PROTECTEDMEM - Enable/disable protected memory
for secondary firmware
- GEN_UICR_SECONDARY_PROTECTEDMEM_SIZE_BYTES - Size of the protected
memory region in bytes
The implementation validates that the configured size is divisible by
4096 bytes (4 KiB) as required by the hardware, and converts it to
4 KiB units when writing to UICR.SECONDARY.PROTECTEDMEM.SIZE4KB.
Signed-off-by: Sebastian Bøe <sebastian.boe@nordicsemi.no>
Add support for UICR.SECONDARY.TRIGGER configuration, which enables
automatic booting of secondary firmware based on specific reset reasons.
This introduces Kconfig options for configuring:
- UICR.SECONDARY.TRIGGER.ENABLE - Enable/disable automatic triggers
- UICR.SECONDARY.TRIGGER.RESETREAS - Bitmask of reset reasons that
trigger secondary firmware boot
Individual Kconfig options are provided for each reset reason:
- APPLICATIONWDT0/1 - Application core watchdog timeouts
- APPLICATIONLOCKUP - Application core CPU lockup
- RADIOCOREWDT0/1 - Radio core watchdog timeouts
- RADIOCORELOCKUP - Radio core CPU lockup
Signed-off-by: Sebastian Bøe <sebastian.boe@nordicsemi.no>
Add support for UICR.WDTSTART.
UICR.WDTSTART configures the automatic start of a local watchdog timer
before the application core is booted. This provides early system
protection ensuring that the system can recover from early boot
failures.
Signed-off-by: Sebastian Bøe <sebastian.boe@nordicsemi.no>
Fix an issue where it was not possible to use a console port for
receiving data when the console port was added after receiving was
already requested
Signed-off-by: Max Meidinger <mmeidinger@internships.antmicro.com>
Introduce `z_riscv_pmp_write_config` to abstract writing to pmpcfg
registers. This function handles the differing register layouts and slot
counts between RV32 and RV64 architectures, writing to the appropriate
pmpcfg0, pmpcfg1, pmpcfg2, or pmpcfg3 CSRs as needed based on
CONFIG_PMP_SLOTS.
Signed-off-by: Firas Sammoura <fsammoura@google.com>
This reverts commit 2654845b93.
The conf file embedded within the snippet are setting sample
specific Kconfig, making its usage impossible with other
application.
Remove the snippet and introduce instead board specific
config & overlay including venc file_suffix in order to allow
future addition of other encoders available on the same
board.
Signed-off-by: Alain Volmat <alain.volmat@foss.st.com>
Make the STM32 VENC driver depends on the VIDEO_ENCODER_H264
in order to be compiled only if VIDEO_ENCODER_H264 is
enabled by an application.
Signed-off-by: Alain Volmat <alain.volmat@foss.st.com>
Add video subsystem related Kconfig in order to allow an
application to enable encoder support.
This is useful for platforms having several video devices
available as well as several video encoders, since it allows
to only compile / enable part of those devices depending on
their kind.
Signed-off-by: Alain Volmat <alain.volmat@foss.st.com>
The stm32n6570_dk device-tree describing the hardware available
on this board, the Video ENCoder (VENC) status should be enabled,
and its usage should be enabled or not based on the
sample / application configuration.
Signed-off-by: Alain Volmat <alain.volmat@foss.st.com>
Match the behavior of other Adafruit boards by including the
zephyr_i2c label to allow the use of JST SH I2C shields.
Signed-off-by: Lena Voytek <lena@voytek.dev>
This adds a few tests to test switching between threads where
they are under different memory domains. This is mainly to test
if permissions are set correctly during context switch.
By default the new tests are disabled and must be explicitly
enabled. This is due to some architectures requiring some config
changes (for example, x86 needing more reserved memory domains,
and ARM64 needing more translation tables). To avoid causing
mass CI failures, only enable platforms that have been tested,
for now.
Signed-off-by: Daniel Leung <daniel.leung@intel.com>
The priv_stack_ptr for reading and writing tests was not set
correctly on Xtensa, and was always 0. Test would pass since
the NULL page should always generate access faults on most
Xtensa platforms. However, those tests are supposed to test
reading and writing to the privilege stack. So fix that by
populating the priv_stack_ptr correctly.
Signed-off-by: Daniel Leung <daniel.leung@intel.com>
arch_mem_map() takes in some flags to describe the to-be mapped
memory regions' permissions and cache status. When the flags are
translated, they become attributes in PTEs. So for functions
being called by arch_mem_map() and beyond, rename flags to
attrs to better describe its purpose.
Signed-off-by: Daniel Leung <daniel.leung@intel.com>
In functions which manipulate both L1 and L2 tables, make
the variable names obvious by prefixing them with l1_ or l2_.
This is mainly done to avoid confusion when reading through
those functions.
Signed-off-by: Daniel Leung <daniel.leung@intel.com>
The assert error messages when l2_page_table_map() fails are not
correct. It returns false when it cannot allocate new L2 table,
and it is not able the address having already mapped. So correct
the error message.
Signed-off-by: Daniel Leung <daniel.leung@intel.com>
This is simply done to conserve code space in the vector text
areas. These vector text areas are very small and we should
only put code that is absolutely necessary for interrupt and
exception entrance. The saving of PS into the thread struct
can be deferred a bit. So do that.
Signed-off-by: Daniel Leung <daniel.leung@intel.com>
xtensa_asm2_s.h is not exactly a C header. Rename it to
xtensa_asm2.inc.S to clearly state that it is has assembly
code in it as its main purpose is to declare assembly macros.
This is being done to keep checkpatch.pl from treating it as
C file and complaining about non-C syntax.
Signed-off-by: Daniel Leung <daniel.leung@intel.com>
This moves the block of FPU and HIFI registers in the Base Save
Area (BSA), used during interrupts and exceptions, to the end of
the block. This is done to minimize code usage in the vector
text section. During interrupt entrance, the code stores a small
set of registers first before jumping to the long handler. When
the offset to these registers from the beginning of BSA is small
enough, the compiler will emit S32I.N instead of S32I. This
saves us one byte per store (2 vs 3 bytes). This is mainly done
to avoid overflowing the vector text area.
Signed-off-by: Daniel Leung <daniel.leung@intel.com>
This adds a function to handle DTLB multihit exception when
userspace is enabled, as this exception may be raised due to
the same page being able to accessed by both kernel and user
threads. The auto-refill DTLBs may contain entries for same
page, one for kernel and one for user under some situations.
We need to invalidate those existing DTLB entries so that
hardware can reload from the page table.
This is an alternative to the kconfig invalidating DTLBs on
every swap: CONFIG_XTENSA_MMU_FLUSH_AUTOREFILL_DTLBS_ON_SWAP.
Although this does not have extra processing per context
switching, exception handling itself has a high cost. So
care needs to be taken on whether to enable that kconfig.
Signed-off-by: Daniel Leung <daniel.leung@intel.com>
When a page can be accessed by both kernel and user threads,
the autofill DTLB may contain an entry for kernel thread.
This will result in load/store ring exception when it is
accessed by user thread later. In this case, we need to
invalidate all associated TLBs related to kernel access so
hardware can reload the page table the correct permission
for user thread.
Signed-off-by: Daniel Leung <daniel.leung@intel.com>
This saves the EXCCAUSE and EXCVADDR into BSA during exception.
These will then be used during exception handling. The reason
for doing this instead of reading from both registers during
exception handing is that another exception will override
the value in these register (e.g. DTLB miss). When returning to
the previous exception handler, these register no longer
contains the original exception cause and address. We need to
save it so that we are actually handling the orignal exception.
Coredump also now uses the EXCCAUSE and EXCVADDR from BSA
instead of reading the registers.
Signed-off-by: Daniel Leung <daniel.leung@intel.com>
The software bits inside PTE are used to store original PTE
attributes and ring value, and those bits are used to
restore PTE to previous state.
This modifies reset_region() to properly restore attributes
and ring value when resetting memory regions to the same as
when the system boots.
Signed-off-by: Daniel Leung <daniel.leung@intel.com>
- Add support MRAM node on Renesas SoC dts layer for RA8P1, RA8T2
- Move the MRAM and SRAM resource defination to SoC dts layer
Signed-off-by: Khoa Nguyen <khoa.nguyen.xh@renesas.com>
When using the eSPI peripheral channel for HOST_CMD,
the STS0 bit indicates that EC is busy.
To reflect this properly,
STS0 should only be set when there is actual input data to process.
This avoids falsely signaling a busy state when there is no data.
Signed-off-by: Elmo Lan <elmo_lan@realtek.com>
Invalid header length and cause an integer overflow in
bt_br_acl_recv leading to undesired behavior.
Signed-off-by: Flavio Ceolin <flavio@hubblenetwork.com>
The `sched_yield()` function was originally included to facilitate the of
POSIX_REALTIME and POSIX_THREADS_EXT Option Groups in Issue 5.
It was then marked as part of the _POSIX_PROCESS_SCHEDULING Option in
Issue 6, but then was not clearly marked as part of the
POSIX_THREADS(_BASE) Option Group until Issue 7.
Moving it to `pthread.c` (and making it a function with regular
linkage rather than inline) ensures that it will be available with the
`POSIX_THREADS` Option Group.
For more information, please see `POSIX_THREADS_BASE` in
https://pubs.opengroup.org/onlinepubs/9699919799/xrat/\
V4_subprofiles.html and
https://pubs.opengroup.org/onlinepubs/9799919799/xrat/\
V4_subprofiles.html
Signed-off-by: Chris Friedt <cfriedt@tenstorrent.com>
Instantiate NRF_PLATFORM_LUMOS for all nrf lumos product,
Add NRF_SKIP_CLOCK_CONFIG kconfig to be a general kconfig
in nordic soc Kconfig, so that it can be used by other
lumos product.
Signed-off-by: Travis Lam <travis.lam@nordicsemi.no>
Don't wait indefinitely on registers instead do a timeout and
restore to the IDLE state. Further fixes an issue that errnwarn
mask got shared by multiple instances of i3c
Signed-off-by: Peter van der Perk <peter.vanderperk@nxp.com>
Changes the link close upon success to use the `prov_link_close` helper
function instead of doing it manually, as minor cleanup.
Signed-off-by: Ludvig Jordet <ludvig.jordet@nordicsemi.no>
According to MshPrt 5.4.4, The Provisioner, upon receiving the
Provisioning Failed PDU, shall assume that the provisioning failed and
immediately disconnect the provisioning bearer.
Signed-off-by: Ludvig Jordet <ludvig.jordet@nordicsemi.no>
Remove myself from this area. I'm not working with this anymore and I
don't really have the bandwidth to properly review significant changes.
Signed-off-by: Tomi Fontanilles <tomi.fontanilles@nordicsemi.no>
stream_flash_ctx is opaque so actually ensure that Doxygen treat all its
fields as hidden from the public documentation.
Signed-off-by: Benjamin Cabé <benjamin@zephyrproject.org>
