Guard the STM32H7S GFXMMU window with an MPU region while the D-cache is on

Author: dgarske

docs/Targets.md

@@ -1937,6 +1937,23 @@ external memory loader all leave a working configuration behind, so a port
 that omits this appears to boot fine and only fails once power is actually
 removed.
 
+### GFXMMU window and the D-cache
+
+`0x25000000`-`0x25FFFFFF` holds the GFXMMU virtual buffers. With the GFXMMU
+clock off, which is the reset state, a read in that window never completes:
+no bus error is returned, the core stalls and the debugger can no longer
+halt it. The window is Normal memory in the default memory map, and a
+Cortex-M7 with the D-cache enabled may read Normal memory speculatively, so
+no code has to touch the window on purpose. `hal_init()` therefore sets one
+MPU region marking it no-access before enabling the D-cache.
+`hal_prepare_boot()` turns the caches and the MPU off again so the
+application starts from the reset state.
+
+An application that enables the D-cache needs the same protection: either a
+no-access MPU region over the window, or a no-access background region with
+only the memories in use and the peripheral range opened. The background
+region STM32CubeMX generates covers `0x60000000`-`0xDFFFFFFF` only.
+
 ### Bootloader self-update is off
 
 `RAM_CODE` is 0 in the example configuration. It would compile in the

hal/stm32h7s.c

@@ -276,6 +276,31 @@ void RAMFUNCTION hal_cache_invalidate(void)
     ISB();
 }
 
+/* Make the GFXMMU virtual-buffer window inaccessible while the D-cache is
+ * on. The window is Normal memory in the default map, the core may read
+ * Normal memory speculatively once the D-cache is enabled, and with the
+ * GFXMMU clock off such a read stalls the bus for good: no fault, and the
+ * debugger loses the core. A no-access region stops the read being issued. */
+static void mpu_guard_enable(void)
+{
+    MPU_CTRL = 0;
+    MPU_RNR = 0;
+    MPU_RBAR = GFXMMU_VBUF_BASE;
+    MPU_RASR = MPU_RASR_XN | MPU_RASR_SIZE_16MB | MPU_RASR_ENABLE;
+    MPU_CTRL = MPU_CTRL_PRIVDEFENA | MPU_CTRL_ENABLE;
+    DSB();
+    ISB();
+}
+
+static void mpu_guard_disable(void)
+{
+    MPU_CTRL = 0;
+    MPU_RNR = 0;
+    MPU_RASR = 0;
+    DSB();
+    ISB();
+}
+
 static void dcache_enable(void)
 {
     uint32_t sets, ways;
@@ -884,6 +909,7 @@ void hal_init(void)
     icache_enable();
     octospi_gpio_init();
     octospi_init();
+    mpu_guard_enable();
     dcache_enable();
 #ifdef DEBUG_UART
     uart_init();
@@ -905,6 +931,7 @@ void hal_prepare_boot(void)
     octospi_enable_mmap();
     dcache_disable();
     icache_disable();
+    mpu_guard_disable();
 }
 
 #endif /* !WOLFBOOT_UNIT_TEST_FLASH_ERASE */

hal/stm32h7s.h

@@ -454,6 +454,20 @@
 #define CCSIDR                  (*(volatile uint32_t *)(0xE000ED80UL))
 #define CSSELR                  (*(volatile uint32_t *)(0xE000ED84UL))
 
+#define MPU_CTRL                (*(volatile uint32_t *)(0xE000ED94UL))
+#define MPU_RNR                 (*(volatile uint32_t *)(0xE000ED98UL))
+#define MPU_RBAR                (*(volatile uint32_t *)(0xE000ED9CUL))
+#define MPU_RASR                (*(volatile uint32_t *)(0xE000EDA0UL))
+#define MPU_CTRL_ENABLE         (1 << 0)
+#define MPU_CTRL_PRIVDEFENA     (1 << 2)
+#define MPU_RASR_ENABLE         (1 << 0)
+#define MPU_RASR_SIZE_16MB      (23 << 1)
+#define MPU_RASR_XN             (1 << 28)
+
+/* GFXMMU virtual buffers 0..3. A read here never completes while the
+ * GFXMMU clock is off. */
+#define GFXMMU_VBUF_BASE        (0x25000000UL)
+
 #define CACHE_LINE_SIZE         32
 
 #endif /* _STM32H7S_DEF_INCLUDED */