Add MPU protections

decoder/src/hardware.zig

@@ -7,17 +7,26 @@ const msdk = @import("msdk");
 pub fn mpu() void {
     msdk.ARM_MPU_Disable();
 
+    // Make SRAM non-executable
     msdk.ARM_MPU_SetRegion(
-        msdk.ARM_MPU_RBAR(0, 0x1000_0000), // to 0x1008_0000 (512KiB)
-        // Allow execution, read-only
-        msdk.ARM_MPU_RASR(0, msdk.ARM_MPU_AP_RO, msdk.ARM_MPU_ACCESS_ORDERED, 0, 0, 0, 0b00000000, msdk.ARM_MPU_REGION_SIZE_512KB),
+        msdk.ARM_MPU_RBAR(0, 0x20000000),
+        msdk.ARM_MPU_RASR(1, msdk.ARM_MPU_AP_FULL, msdk.ARM_MPU_ACCESS_ORDERED, 0, 0, 0, 0b00000000, msdk.ARM_MPU_REGION_SIZE_1MB),
     );
     msdk.ARM_MPU_Enable(msdk.MPU_CTRL_HFNMIENA_Msk | msdk.MPU_CTRL_PRIVDEFENA_Msk);
+
+    // Except for this region which must be executable
+    msdk.ARM_MPU_SetRegion(
+        msdk.ARM_MPU_RBAR(1, 0x20000000),
+        msdk.ARM_MPU_RASR(0, msdk.ARM_MPU_AP_FULL, msdk.ARM_MPU_ACCESS_ORDERED, 0, 0, 0, 0b10000000, msdk.ARM_MPU_REGION_SIZE_4KB),
+    );
+    msdk.ARM_MPU_Enable(msdk.MPU_CTRL_HFNMIENA_Msk | msdk.MPU_CTRL_PRIVDEFENA_Msk);
+
+    // Make FLASH read only
     msdk.ARM_MPU_SetRegion(
-        msdk.ARM_MPU_RBAR(1, 0x2000_0000), // to 0x2002_0000 (128KB)
-        // No-execute, read-write
-        msdk.ARM_MPU_RASR(1, msdk.ARM_MPU_AP_FULL, msdk.ARM_MPU_ACCESS_ORDERED, 0, 0, 0, 0b00000000, msdk.ARM_MPU_REGION_SIZE_128KB),
+        msdk.ARM_MPU_RBAR(2, 0x10000000),
+        msdk.ARM_MPU_RASR(0, msdk.ARM_MPU_AP_RO, msdk.ARM_MPU_ACCESS_ORDERED, 0, 0, 0, 0b00000000, msdk.ARM_MPU_REGION_SIZE_256KB),
     );
+
     msdk.ARM_MPU_Enable(msdk.MPU_CTRL_HFNMIENA_Msk | msdk.MPU_CTRL_PRIVDEFENA_Msk);
 }
 

decoder/src/main.zig

@@ -61,6 +61,8 @@ fn run() !void {
     try uart.init();
     try flash.init();
 
+    hardware.mpu();
+
     // Turn on the green LED to indicate we are successfully processing
     msdk.LED_On(msdk.LED2);