Activity

appleflyer
  • Add basic SPI slave driver
  • Turn repo into a package which can be installed over pip and run with the command gscemu
Attachment
0
appleflyer
  • add new PINMUX component for crossbar between GPIOx_GPIOx and DIOxx pins, where GPIOx_GPIOx is internal and DIOxx is external pads.
  • attach strap configuration onto PINMUX DIOxx pads to configure SPI usage, and to lower battery plugged in signal for debug enabling features.
  • add new SWDP component although it doesn’t do anything
Attachment
Attachment
0
appleflyer
  • added new PinmuxDevice class. This basically emulates a full GPIO system, where you can attach components to pulldown/pullup to VCC/GND pads, and one PinmuxDevice can drive another PinmuxDevice. Pin contention, parallel resistance is all supported.
  • add GPIO with PinmuxDevice to detect changes within the PinmuxDevice internally as ARM core GPIOs for VCC/GND pinning, detect changes when a GPIO is connected to another PinmuxDevice.

e.g. an external pad could be labeled DIOA1, and a GPIO pad could be labeled GPIO0_GPIO0.
DIOA1 could then be set to drive GPIO0_GPIO0. Then, an external resistor could pull DIOA1 to VCC, and GPIO0_GPIO0 could trigger a rising edge interrupt or HIGH interrupt as it is “monitoring” DIOA1.

  • fix M3 interrupts where we get the caller to clear the interrupt too, and we shouldn’t rely on the NVIC to clear the interrupt for us.

emulator logs didnt really change though, because these were all internal

Attachment
0
appleflyer
  • fix a very critical issue within the emulator that caused interrupts to corrupt emulator state
  • do a lot of research on reimplementing GPIO/PINMUX, because it is a very complex and crucial system within the Cr50, although this is not done yet
  • add the KEYMGR AES engine for AES operations
  • handle the wfi instruction within the Cr50 so that the Cr50 does not infinitely loop around the IDLE thread, causing the host machine to also overheat as the emulator takes up 100% cpu usage :P
  • fix FLASH ERASE op bounds checking so that the ERASE op would not error out
  • add the TRNG engine within the Cr50 for random values!
  • fix issue where the flash was not 0xFF’ed on initialization.
  • add TPM endorsement certificates so that the TPM can actually initialize and the NVMEM within TPM2 works now.
Attachment
0
appleflyer
  • add the GPIO component for GPIO pins! This allows the Cr50 TPM thread to initialize properly.
  • fix ARM interrupts by using up to spec EXC_RETURN values that are loaded into LR.
  • do some module cleanup within the repo to allow for modular chip support in the future.
  • fix the TIMELS component to give valid values on the timer stopping.
  • add the USB component so we don’t wait forever for USB to initialize.
  • change ARM interrupt internal emulator context to allow for a larger variety of ways to trigger an interrupt and ways to handle an interrupt.
  • implement the new CRYPTO engine, which is a seperate CPU on the Cr50 used for accelerating large cryptography operations

overall, i have got really far into the boot process already! there are a few more things to be done, still needs to be looked over.
estimated time remaining to finishing from now around 10-20hours!!

Attachment
Attachment
Attachment
Attachment
0
appleflyer

continue advancing within the emulator boot, we now have a working console! FINALLY!!
all that is left is to finish implementing CRYPTO, GPIO/PINMUX components, SPI/I2C and everything should be working, but one of the major parts are done as the chip actually boots now

  • add UART input thread to capture input from stdin
  • add base CRYPTO component handler, we need to finish that.
  • refactor EXC_RETURN values, looks like the values were too close previously
Attachment
Attachment
0
appleflyer
  • write the armv7m cortex-m3 interrupt handler for ARM. I needed to implement interrupt handling behavior as stated in the Cortex-M specification. this required me to learn how the ARM interrupt system worked, and required me to learn arm assembly to a certain extent. I also had to pull request fixes to the qemu fork i was using, because there were some issues with it. see (https://github.com/unicorn-engine/unicorn/pull/2285, 1.5k forks, 8.7k stars)
  • write a lambda generator instead of hardcoding a lambda. this also took a long time to write as i had to learn about python internal variables and about using eval in python.
Attachment
Attachment
0
appleflyer
  • add many MANY components: UART, M3, FUSE, FLASH, GLOBALSEC, KEYMGR
  • refactor entire componenthandler regsystem after i already wrote the components(refactor from using MEM_IO hooks to mmio_map)
  • get us to boot from the BootROM -> RO -> RW(almost, last step to boot)
Attachment
Attachment
Attachment
Attachment
Attachment
Attachment
0
appleflyer
  • standardize component handlers
  • start implementing some basic features of some components
Attachment
0
appleflyer
  • load SP and PC from VTOR
  • write the UcMutex and FifoLoad objects for thread safety when handling the Uc object.
  • write loadfw functions
  • write the handler for component handling
  • add some mem_invalid and memio hooks
  • implement FUSE component support
Attachment
Attachment
Attachment
Attachment
0
appleflyer

make the base for the emulator, including init utils file, emulator file, some init utils, logger improvements, etc

Attachment
Attachment
Attachment
Attachment
0
appleflyer

make the initial logger for the emulator for debug/info/warning/fatal logs.

Attachment
0