Memory protection units (MPU) — preventing stack overflow, access faults: Worked examples

5.5.24 · D3 · Coding › Embedded Systems & Real-Time Software › Memory protection units (MPU) — preventing stack overflow, a

Yeh page MPU parent topic ko concrete numbers mein drill karti hai. Hum base addresses, RASR size fields, region-match winners, aur fault decisions haath se compute karenge — taaki koi bhi MPU register value kabhi magic jaisi na lage.

Kuch bhi compute karne se pehle, do symbols jo parent ne use kiye the lekin digit-by-digit kabhi spell out nahi kiye:

The scenario matrix

Har MPU question jo aap kabhi face karenge woh in cells mein se ek hogi. Neeche ke examples mein se har ek un cell(s) ke saath tagged hai jise woh cover karta hai.

Cell	Case class	Isme tricky kya hai
A	Ek size encode karo → `SIZE` field	$n - 1$ offset
B	Legal (aligned) base	low $n$ bits zero hone chahiye
C	Degenerate: misaligned base	hardware silently re-align kar deta hai
D	Zero / smallest region (32 B guard)	floor case, $2^{5}$
E	Limiting: whole-address-space region (4 GB)	ceiling case, $2^{32}$
F	Overlap — highest region number jeet ta hai	priority direction
G	Overlap backwards kiya gaya	guard silently ignore ho jaata hai
H	Access-type violation (write to RO, exec on XN, user on privileged)	permission vs. access-kind
I	Word problem: stack overflow catch, byte-exact	pehla fault kahan lagta hai
J	Exam twist: subregion disable ek hole banata hai	1/8th granularity

Example 1 — Teen region sizes encode karo (Cell A, D, E)

Forecast: padhne se pehle har SIZE value guess karo. (Hint: $SIZE = n - 1$ use karo.)

1 KB. $1 KB = 1024 = 2^{10}$ , toh $n = 10$ . Yeh step kyun? Size ko $2^{n}$ ke roop mein express karna hoga taaki $n$ read kar sakein. $SIZE = 10 - 1 = 9$ .
32 bytes. $32 = 2^{5}$ , toh $n = 5$ , sabse chota legal region. Yeh step kyun? Yeh floor case hai (Cell D) — aap SIZE=4 se neeche nahi ja sakte. $SIZE = 5 - 1 = 4$ .
4 GB. $4 GB = 2^{32}$ , toh $n = 32$ , poora 32-bit address space. Yeh step kyun? Ceiling case (Cell E) — ek region jo sab kuch cover karta hai. $SIZE = 32 - 1 = 31$ .

Verify: $S = 2^{SIZE + 1}$ se wapis decode karo: $2^{9 + 1} = 1024$ ✓, $2^{4 + 1} = 32$ ✓, $2^{31 + 1} = 2^{32} = 4294967296$ bytes $= 4$ GB ✓. Parent ke code ne 1 KB ke liye (9<<1) aur 32 B ke liye (4<<1) use kiya — match karta hai, aur <<1 isliye hai kyunki SIZE RASR ke bits 1–5 mein baith ta hai.

Example 2 — Kya yeh base is size ke liye legal hai? (Cell B, C)

Forecast: 64-byte region ke liye kitne low bits zero hone chahiye?

$64 = 2^{6}$ , toh $n = 6$ : base ke low 6 bits zero hone chahiye. Yeh step kyun? Alignment rule = "size $2^{n}$ hai ⇒ low $n$ bits zero karo."
Low 6 bits dekho (last hex digit aur ek half): mask hai $2^{6} - 1 = 63 = 0x3F$ .
- 0x...00 → 00 & 0x3F = 0 → legal (figure mein green).
- 0x...40 → 0x40 & 0x3F = 0 → legal ( $0 x 40 = 64$ jo 64 ka multiple hai).
- 0x...10 → 0x10 & 0x3F = 0x10 = 16 ≠ 0 → illegal (figure mein red).
Illegal ke liye hardware low 6 bits AND away karta hai: effective base $= 0x2000_0010 & \sim 0x3F = 0x2000_0000$ . Yeh step kyun? Yeh Cell C hai — woh silent shift jiske baare mein parent ne warn kiya tha. Aap socha ki aapne 0x10–0x50 protect kiya; actually aapne 0x00–0x40 protect kiya.

Verify: general fix base = addr & ~(size-1): $0x2000_0010 & \sim 63 = 0x2000_0000$ ✓. Aur 0x40 = 64 exactly $1 \times$ size hai, toh region (b) 0x40–0x80 cover karta hai, adjacent aur clean.

Example 3 — 32-byte guard band, byte-exact (Cell D, I, word problem)

Forecast: stack 0x2000_0400 ke paas se shuru hota hai aur neeche grow karta hai. Tripwire kahan hai?

Guard region: base 0x2000_0000, size $2^{5} = 32$ , toh yeh 0x2000_0000 – 0x2000_0020 cover karta hai. Yeh step kyun? $B + S = 0x2000_0000 + 0x20 = 0x2000_0020$ ; half-open interval ka matlab hai 0x2000_0020 khud guard ke bahar hai.
Stack pointer 0x2000_0400 se shuru hota hai aur neeche march karta hai: ...0x3FC, 0x3F8, .... Har push ek lower address par write karta hai. Yeh step kyun? ARM par stacks lower addresses ki taraf grow karti hain — growth direction decide karta hai ki guard kis end ko protect karta hai.
Guard ke andar pehla write = pehla address $< 0x2000_0020$ . Aakhri safe byte hai 0x2000_0020; pehla fault byte hai 0x2000_001F (neeche ka byte). Yeh step kyun? Yeh tripwire hai: Cell I — byte-exact overflow detection. Parent ka guard jeet ta hai kyunki yeh higher-numbered region hai (Region 1 vs Region 0).
Fault par, MMFAR offending address latch karta hai, toh aapka MemManage_Handler() 0x2000_001F read karta hai aur exactly jaanta hai ki kaun sa task overran (Cell H, permission = no-access).

Verify: app ko kitna stack milta hai? $0x2000_0400 - 0x2000_0020 = 0x3E0 = 992$ bytes usable, $1024 - 32 = 992$ ✓. 2048-byte array clearly 992 mein fit nahi ho sakti → fault guaranteed ✓.

Example 4 — Overlap: kaun sa region jeet ta hai? (Cell F)

Forecast: dono regions 0x2000_0010 cover karte hain. Winner guess karo.

Region 0 0x0000 – 0x0400 cover karta hai: kya 0x0010 andar hai? $0 \leq 16 < 1024$ → haan, match karta hai.
Region 1 0x0000 – 0x0020 cover karta hai: kya 0x0010 andar hai? $0 \leq 16 < 32$ → haan, match karta hai. Yeh step kyun? Dono match karte hain, toh priority decide karta hai.
ARM rule: highest-numbered matching region jeet ta hai → Region 1 jeet ta hai → no access → fault. Yeh step kyun? Yeh exactly parent ka guard trick hai (Cell F): restrictive rule higher slot mein baith ta hai.

Verify: address 0x2000_0300 (guard ke bahar, stack ke andar): sirf Region 0 match karta hai → RW → write allowed ✓. Toh guard 0x00–0x20 protect karta hai aur 0x20–0x400 writable chhod deta hai — sahi 32-byte fence.

Example 5 — Wahi overlap, ulta numbered (Cell G)

Forecast: kya numbers swap karne se kuch badla?

Dono regions abhi bhi 0x2000_0010 match karte hain (same intervals jaise Example 4 mein).
Highest-numbered matching region = Region 1 = broad RW stack → jeet ta hai. Yeh step kyun? Priority number follow karta hai, intent nahi. Cell G — classic silent bug.
Result: write allowed hai. Guard completely ignore ho jaata hai. Overflows undetected rehte hain → silent corruption wapis aa jaata hai.

Verify: Example 4 se contrast karo — identical addresses, opposite outcome, purely isliye kyunki winning region "no access" se "RW" mein flip ho gaya. Yaad karne wala rule: restrictive region ka number higher hona chahiye. ✓ (Consistency: Example 4 ne fault kiya, yeh wala pass ho gaya; sirf region index badla tha.)

Example 6 — Permission vs. access-kind table (Cell H)

Forecast: RO = read-only, XN = execute-never. Kaun teen fault karte hain?

(i) read — RO reads allow karta hai → pass.
(ii) write — RO writes forbid karta hai → fault. Kyun? Access kind (write) ko AP bits ke against check kiya jaata hai.
(iii) execute — XN ka matlab "execute-never" hai; yahan instruction fetch → fault. Kyun? Yeh shellcode defense hai: even agar data corrupt ho jaaye, aap ise run nahi kar sakte.
(iv) privileged write — abhi bhi RO hai. Read-only matlab sabke liye read-only; privilege sirf "unprivileged-allowed" axis ko gate karta hai, RW axis ko nahi → fault. Yeh step kyun? Do independent axes: RW vs RO aur privileged vs user. Inhe mix mat karo.

Verify: faults ki count = 4 mein se 3 (sirf read pass hota hai). Cross-check karo ki privilege axis orthogonal hai: ek privileged read bhi pass hoga (RO privilege se regardless reads allow karta hai).

Example 7 — Peripheral protection, bada region (Cell E, H)

Forecast: $512$ MB $= 2^{?}$ .

$512 MB = 512 \times 2^{20} = 2^{9} \times 2^{20} = 2^{29}$ , toh $n = 29$ . Yeh step kyun? $n$ read off karo taaki SIZE mil sake.
$SIZE = 29 - 1 = 28$ (parent ke code ne (28<<1) use kiya ✓).
Alignment: ek $2^{29}$ region ko base ke low 29 bits zero chahiye. $0x4000_0000 = 2^{30}$ , low 29 bits zero hain → aligned ✓. Yeh step kyun? Region par trust karne se pehle confirm karo.
Ek user task jo *UART_TXREG = data karta hai (unprivileged mode se write) privileged-only rule hit karta hai → fault (Cell H).

Verify: kya region block ke top tak actually pahunchta hai? $B + S = 0x4000_0000 + 2^{29} = 0x4000_0000 + 0x2000_0000 = 0x6000_0000$ , yaani 0x5FFF_FFFF inclusive tak cover karta hai ✓. Exactly peripheral window.

Example 8 — Subregion disable ek hole banata hai (Cell J, exam twist)

Forecast: 1 KB ko 8 equal subregions mein split karo — har ek kitna bada hai?

Har region ≥ 256 B 8 equal subregions mein split hoti hai. $1 KB /8 = 128$ bytes each. Yeh step kyun? Subregion granularity hamesha region ka exactly ek-aathwan hoti hai.
8 subregions, low→high: SR0 0x000–0x080, SR1 0x080–0x100, … SR7 0x380–0x400. Yeh step kyun? SR0 lowest addresses hai = bottom = jahan ek downward stack overflow hota hai.
SR0 ko disable karne ke liye, 8-bit SRD ka bit 0 set karo: $SRD = 0b0000_0001 = 1$ . Yeh step kyun? Har SRD bit ek subregion se map hota hai; set bit ka matlab "yeh eighth off / no access hai."
Hole hai 0x2000_0000 – 0x2000_0080 (128 bytes) — ek guard band bina doosre region ki zaroorat ke. Yeh step kyun? Exam twist (Cell J): parent ne hint diya tha ki aap subregion disable ek alag higher-numbered guard region ki jagah use kar sakte hain.

Verify: hole size $= 0x80 = 128 = 1024/8$ ✓. SRD value $= 1$ exactly ek subregion disable karta hai. Agar aap top eighth (SR7) chahte the, toh bit 7 set karte: $SRD = 0b1000_0000 = 128$ ✓.

Recall Quick self-test

Ek 256-byte region ko base ke kitne low bits zero chahiye? ::: $8$ (kyunki $256 = 2^{8}$ ). 4 KB region ke liye SIZE field kya hai? ::: $n = 12$ , toh $SIZE = 11$ . Do regions overlap karte hain; restrictive wala Region 3 hai, broad wala Region 5. Overlapping address par kaun jeet ta hai? ::: Region 5 (higher number) — restrictive wala ignore ho jaata hai; yeh ek bug hai. 1 KB stack par 32 B guard ke baad usable stack bytes kitne? ::: $992$ bytes. XN region par kaun sa access fault karta hai? ::: ek instruction fetch / execute usse.

Related: RTOS task switching har task ke liye MPU regions reprogram karta hai; Memory faults and exception handling cover karta hai ki MemManage_Handler() MMFAR ke saath kya karta hai; Memory-mapped IO isliye hai kyun peripherals ko privileged-only regions chahiye.