Struct KernelProtectionPMP

pub struct KernelProtectionPMP<const AVAILABLE_ENTRIES: usize>;

A RISC-V PMP implementation which supports machine-mode (kernel) memory protection, with a fixed number of “kernel regions” (such as .text, flash, RAM and MMIO).

This implementation will configure the PMP in the following way:

|-------+-----------------------------------------+-------+---+-------|
| ENTRY | REGION / ADDR                           | MODE  | L | PERMS |
|-------+-----------------------------------------+-------+---+-------|
|     0 | /                                     \ | OFF   |   |       |
|     1 | \ Userspace TOR region #0             / | TOR   |   | ????? |
|       |                                         |       |   |       |
|     2 | /                                     \ | OFF   |   |       |
|     3 | \ Userspace TOR region #1             / | TOR   |   | ????? |
|       |                                         |       |   |       |
| 4 ... | /                                     \ |       |   |       |
| n - 8 | \ Userspace TOR region #x             / |       |   |       |
|       |                                         |       |   |       |
| n - 7 | "Deny-all" user-mode rule (all memory)  | NAPOT |   | ----- |
|       |                                         |       |   |       |
| n - 6 | --------------------------------------- | OFF   | X | ----- |
| n - 5 | Kernel .text section                    | TOR   | X | R/X   |
|       |                                         |       |   |       |
| n - 4 | FLASH (spanning kernel & apps)          | NAPOT | X | R     |
|       |                                         |       |   |       |
| n - 3 | RAM (spanning kernel & apps)            | NAPOT | X | R/W   |
|       |                                         |       |   |       |
| n - 2 | MMIO                                    | NAPOT | X | R/W   |
|       |                                         |       |   |       |
| n - 1 | "Deny-all" machine-mode    (all memory) | NAPOT | X | ----- |
|-------+-----------------------------------------+-------+---+-------|

This implementation does not use any mseccfg protection bits (ePMP functionality). To protect machine-mode (kernel) memory regions, regions must be marked as locked. However, locked regions apply to both user- and machine-mode. Thus, region n - 7 serves as a “deny-all” user-mode rule, which prohibits all accesses not explicitly allowed through rules < n - 7. Kernel memory is made accessible underneath this “deny-all” region, which does not apply to machine-mode.

This PMP implementation supports the TORUserPMP interface with MPU_REGIONS <= ((AVAILABLE_ENTRIES - 7) / 2), to leave sufficient space for the “deny-all” and kernel regions. This constraint is enforced through the KernelProtectionPMP::CONST_ASSERT_CHECK associated constant, which MUST be evaluated by the consumer of the TORUserPMP trait (usually the PMPUserMPU implementation).

Implementations

impl<const AVAILABLE_ENTRIES: usize> KernelProtectionPMP<AVAILABLE_ENTRIES>

pub unsafe fn new( flash: FlashRegion, ram: RAMRegion, mmio: MMIORegion, kernel_text: KernelTextRegion, ) -> Result<Self, ()>

Trait Implementations

impl<const AVAILABLE_ENTRIES: usize> Display for KernelProtectionPMP<AVAILABLE_ENTRIES>

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<const AVAILABLE_ENTRIES: usize, const MPU_REGIONS: usize> TORUserPMP<MPU_REGIONS> for KernelProtectionPMP<AVAILABLE_ENTRIES>

const CONST_ASSERT_CHECK: ()

Ensure that the MPU_REGIONS (starting at entry, and occupying two entries per region) don’t overflow the available entires, excluding the 7 entires used for implementing the kernel memory protection.

fn available_regions(&self) -> usize

The number of TOR regions currently available for userspace memory protection. Within [0; MAX_REGIONS].

fn configure_pmp( &self, regions: &[(TORUserPMPCFG, *const u8, *const u8); MPU_REGIONS], ) -> Result<(), ()>

Configure the user-mode memory protection.

fn enable_user_pmp(&self) -> Result<(), ()>

Enable the user-mode memory protection.

fn disable_user_pmp(&self)

Disable the user-mode memory protection.