Support for Smepmp #652
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -10,6 +10,9 @@ priv_mode: M | |
| length: 32 | ||
| description: Machine Security Configuration | ||
| definedBy: | ||
| allOf: | ||
| - name: Sm | ||
| version: ">=1.12" | ||
| - name: Smepmp | ||
| version: ">= 1.0.0" | ||
|
There was a problem hiding this comment. I am not super sure about this. Obviously, we need machine mode to have Smepmp, but isn't that a relationship in-between the extensions rather than something this CSR should define? Likely @ThinkOpenly has a better view of this than me There was a problem hiding this comment. Yes, "Smepmp" only, please. There was a problem hiding this comment. Also, it's better to use the "compatible" operator for the version requirement here: - name: Smepmp
version: ~> 1.0.0That's equivalent to |
||
| fields: {} | ||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,57 @@ | ||
| # yaml-language-server: $schema=../../schemas/ext_schema.json | ||
|
|
||
| $schema: "ext_schema.json#" | ||
| kind: extension | ||
| name: Smepmp | ||
| type: privileged | ||
| long_name: Personal Physical Memory Protection (PMP) Enhancements for memory access and execution prevention on Machine mode | ||
|
There was a problem hiding this comment. Personal should be removed and I don't think there is a need to redefine There was a problem hiding this comment. Sorry, personal was added by mistake. Sure, I will update this. |
||
| versions: | ||
| - version: "1.0.0" | ||
| state: ratified | ||
| ratification_date: 2021-12 | ||
| contributors: | ||
| - name: Nick Kossifidis | ||
| - name: Joe Xie | ||
| - name: Bill Huffman | ||
| - name: Allen Baum | ||
| - name: Greg Favor | ||
| - name: Tariq Kurd | ||
| - name: Fumio Arakawa | ||
| - name: RISC-V TEE Task Group | ||
|
|
||
| description: | | ||
| Being able to access the memory of a process running at a high privileged execution mode, such as the | ||
|
There was a problem hiding this comment. Here, we should take much more of the spec rather just the introductory paragraph, right? If things like the threat model are not described here, they won't be anywhere else There was a problem hiding this comment. Sure, I will add everything from the spec. There was a problem hiding this comment. There are somethings which may be repetitions of the CSRs, but we definitely need more than this. Also, there is an image we should also add, can you add it? I am not sure what the process for that is There was a problem hiding this comment. Yeah, I was also thinking about the image and was not sure, whether we should add this or not. But, I will add that in the next commit and move/remove that after the review. There was a problem hiding this comment. I'm not sure if we already did add some image, it may be something not possible to do yet, but give it a try and let me know. If it needs some extra ruby code, I can help you. I don't think it is fully required to merge this PR since it is a bit out of your scope There was a problem hiding this comment. This gets in to the topic of what we are trying to describe in the extension YAML files. Two directions:
We have both intermixed right now in the data. This is a UDB SIG topic |
||
| Supervisor or Machine mode, from a lower privileged mode such as the User mode, introduces an obvious attack | ||
| vector since it allows for an attacker to perform privilege escalation, and tamper with the code and/or data of | ||
| that process. A less obvious attack vector exists when the reverse happens, in which case an attacker instead of | ||
| tampering with code and/or data that belong to a high-privileged process, can tamper with the memory of an | ||
| unprivileged / less-privileged process and trick the high-privileged process to use or execute it. | ||
| To prevent this attack vector, two mechanisms known as Supervisor Memory Access Prevention (SMAP) and | ||
| Supervisor Memory Execution Prevention (SMEP) were introduced in recent systems. The first one prevents the | ||
| OS from accessing the memory of an unprivileged process unless a specific code path is followed, and the second | ||
| one prevents the OS from executing the memory of an unprivileged process at all times. RISC-V already includes | ||
| support for SMAP, through the sstatus.SUM bit, and for SMEP by always denying execution of virtual memory | ||
| pages marked with the U bit, with Supervisor mode (OS) privileges, as mandated on the Privilege Spec. | ||
| [NOTE] | ||
| -- | ||
| Terms: | ||
| - *PMP Entry*: A pair of `pmpcfg[i]` / `pmpaddr[i]` registers. | ||
| - *PMP Rule*: The contents of a pmpcfg register and its associated pmpaddr register(s), | ||
| that encode a valid protected physical memory region, where `pmpcfg[i].A != OFF`, and | ||
| if `pmpcfg[i].A == TOR`, `pmpaddr[i-1] < pmpaddr[i]`. | ||
| - *Ignored*: Any permissions set by a matching PMP rule are ignored, and all accesses to | ||
| the requested address range are allowed. | ||
| - *Enforced*: Only access types configured in the PMP rule matching the requested address | ||
| range are allowed; failures will cause an access-fault exception. | ||
| - *Denied*: Any permissions set by a matching PMP rule are ignored, and no accesses to the | ||
| requested address range are allowed.; failures will cause an access-fault exception. | ||
| - *Locked*: A PMP rule/entry where the `pmpcfg.L` bit is set. | ||
| - *PMP reset*: A reset process where all PMP settings of the hart, including locked | ||
| rules/settings, are re-initialized to a set of safe defaults, before releasing the hart (back) | ||
| to the firmware / OS / application. | ||
|
Comment on lines
+40
to
+56
There was a problem hiding this comment. I think this is for the glossary, which @kersten1 is working on separately. There was a problem hiding this comment. okay, I will remove it. |
||
| -- | ||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Remove "and only accessible in Machine Mode", since it's redundant with the "priv_mode", above.