[rom_ext] Update the ROM_EXT ePMP configuration #20862
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
To provide owner applications with a more flexible memory protection configuration, I have re-arranged the ePMP settings. Notably: - The lockouts are moved to regions 0 & 1 to have the highest priority. - The full FLASH/MMIO/RAM windows have been moved to the end to allow finer grained controls to be applied in the middle entries. - The ROM_EXT region is moved and unlocked so owners can reclaim the ROM_EXT entries for their own use. - The owner code regions are left unlocked so owners can select their own preferred arrangement. We jump to owner code with MML=0, allowing the owner to reconfigure the unlocked entries. The owner should set MML=1 if they need machine/user mode isolation. Signed-off-by: Chris Frantz <[email protected]>
moidx
approved these changes
Jan 18, 2024
| CSR_CLEAR_BITS(CSR_REG_PMPCFG0, 0xff << 8); | ||
| CSR_SET_BITS(CSR_REG_PMPCFG0, (kEpmpModeTor | kEpmpPermLockedReadExecute) | ||
| << 8); | ||
| #define EPMP_SET(cfg_reg, addr_reg, mask, cfg, addr) \ |
There was a problem hiding this comment.
The following may be enough to complete hardening for this given that in rom_ext_epmp_set() epmp_state is updated separately.
#define EPMP_SET(entry, cfg_reg, addr_reg, mask, cfg, addr) \
...
HARDENED_CHECK_EQ(entry, cfg_reg); \
...| epmp_perm_t perm) { | ||
| uint32_t start = region.start >> 2; | ||
| uint32_t end = ((region.end + 3u) & ~3u) >> 2; | ||
| rom_ext_epmp_set(entry, kEpmpModeOff, start); |
There was a problem hiding this comment.
Something that may help to harden this to have a separate mechanism to update epmp_state. It becomes turtles all the way down, which is part of the reason why sec_mmio uses macros to update the counters. Okay to skip this comment, but maybe we should add a note saying that we are planning to harden this later.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
To provide owner applications with a more flexible memory protection configuration, I have re-arranged the ePMP settings.
Notably:
We jump to owner code with MML=0, allowing the owner to reconfigure the unlocked entries. The owner should set MML=1 if they need machine/user mode isolation.