OrgZephyr/zephyr
OrgZephyr
/
zephyr
mirror of https://github.com/zephyrproject-rtos/zephyr.git
1
0
Fork 0
Code Issues Releases Wiki Activity
zephyr/kernel/mem_domain.c

369 lines
8.5 KiB
C
Raw Normal View History

kernel: add memory domain APIs Add the following application-facing memory domain APIs: k_mem_domain_init() - to initialize a memory domain k_mem_domain_destroy() - to destroy a memory domain k_mem_domain_add_partition() - to add a partition into a domain k_mem_domain_remove_partition() - to remove a partition from a domain k_mem_domain_add_thread() - to add a thread into a domain k_mem_domain_remove_thread() - to remove a thread from a domain A memory domain would contain some number of memory partitions. A memory partition is a memory region (might be RAM, peripheral registers, flash...) with specific attributes (access permission, e.g. privileged read/write, unprivileged read-only, execute never...). Memory partitions would be defined by set of MPU regions or MMU tables underneath. A thread could only belong to a single memory domain any point in time but a memory domain could contain multiple threads. Threads in the same memory domain would have the same access permission to the memory partitions belong to the memory domain. The memory domain APIs are used by unprivileged threads to share data to the threads in the same memory and protect sensitive data from threads outside their domain. It is not only for improving the security but also useful for debugging (unexpected access would cause exception). Jira: ZEP-2281 Signed-off-by: Chunlin Han <chunlin.han@linaro.org>
2017-07-07 20:29:30 +08:00
/*
* Copyright (c) 2017 Linaro Limited
*
* SPDX-License-Identifier: Apache-2.0
*/
kernel: migrate includes to <zephyr/...> In order to bring consistency in-tree, migrate all kernel code to the new prefix <zephyr/...>. Note that the conversion has been scripted, refer to zephyrproject-rtos#45388 for more details. Signed-off-by: Gerard Marull-Paretas <gerard.marull@nordicsemi.no>
2022-05-06 17:04:23 +08:00
#include <zephyr/init.h>
#include <zephyr/kernel.h>
#include <zephyr/kernel_structs.h>
kernel: include: rename nano_internal.h to kernel_internal.h Rename the nano_internal.h to kernel_internal.h and modify the header file name accordingly wherever it is used. Signed-off-by: Ramakrishna Pallala <ramakrishna.pallala@intel.com>
2018-01-31 12:41:47 +08:00
#include <kernel_internal.h>
kernel: migrate includes to <zephyr/...> In order to bring consistency in-tree, migrate all kernel code to the new prefix <zephyr/...>. Note that the conversion has been scripted, refer to zephyrproject-rtos#45388 for more details. Signed-off-by: Gerard Marull-Paretas <gerard.marull@nordicsemi.no>
2022-05-06 17:04:23 +08:00
#include <zephyr/sys/__assert.h>
kernel: Using boolean types for boolean constants Make boolean expressions use boolean types. MISRA-C rule 14.4 Signed-off-by: Flavio Ceolin <flavio.ceolin@intel.com>
2018-09-19 03:32:27 +08:00
#include <stdbool.h>
kernel: migrate includes to <zephyr/...> In order to bring consistency in-tree, migrate all kernel code to the new prefix <zephyr/...>. Note that the conversion has been scripted, refer to zephyrproject-rtos#45388 for more details. Signed-off-by: Gerard Marull-Paretas <gerard.marull@nordicsemi.no>
2022-05-06 17:04:23 +08:00
#include <zephyr/spinlock.h>
#include <zephyr/sys/check.h>
#include <zephyr/sys/libc-hooks.h>
#include <zephyr/logging/log.h>
kernel: Cleanup logger setup in kernel files Most of kernel files where declaring os module without providing log level. Because of that default log level was used instead of CONFIG_KERNEL_LOG_LEVEL. Signed-off-by: Krzysztof Chruscinski <krzysztof.chruscinski@nordicsemi.no>
2020-11-27 02:32:34 +08:00
LOG_MODULE_DECLARE(os, CONFIG_KERNEL_LOG_LEVEL);
userspace: add optional member to memory domains Some systems may need to associate arch-specific data to a memory domain. Add a Kconfig and `arch` field for this, and a new arch API to initialize it. Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2020-08-20 04:11:47 +08:00
userspace: make mem domain lock non-static Strictly speaking, any access to a mem domain or its containing partitions should be serialized on this lock. Architecture code may need to grab this lock if it is using this data during, for example, context switches, especially if they support SMP as locking interrupts is not enough. Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2020-10-07 06:53:43 +08:00
struct k_spinlock z_mem_domain_lock;
zephyr: replace zephyr integer types with C99 types git grep -l 'u\(8\|16\|32\|64\)_t' | \ xargs sed -i "s/u\(8\|16\|32\|64\)_t/uint\1_t/g" git grep -l 's\(8\|16\|32\|64\)_t' | \ xargs sed -i "s/s\(8\|16\|32\|64\)_t/int\1_t/g" Signed-off-by: Kumar Gala <kumar.gala@linaro.org>
2020-05-28 00:26:57 +08:00
static uint8_t max_partitions;
kernel: add memory domain APIs Add the following application-facing memory domain APIs: k_mem_domain_init() - to initialize a memory domain k_mem_domain_destroy() - to destroy a memory domain k_mem_domain_add_partition() - to add a partition into a domain k_mem_domain_remove_partition() - to remove a partition from a domain k_mem_domain_add_thread() - to add a thread into a domain k_mem_domain_remove_thread() - to remove a thread from a domain A memory domain would contain some number of memory partitions. A memory partition is a memory region (might be RAM, peripheral registers, flash...) with specific attributes (access permission, e.g. privileged read/write, unprivileged read-only, execute never...). Memory partitions would be defined by set of MPU regions or MMU tables underneath. A thread could only belong to a single memory domain any point in time but a memory domain could contain multiple threads. Threads in the same memory domain would have the same access permission to the memory partitions belong to the memory domain. The memory domain APIs are used by unprivileged threads to share data to the threads in the same memory and protect sensitive data from threads outside their domain. It is not only for improving the security but also useful for debugging (unexpected access would cause exception). Jira: ZEP-2281 Signed-off-by: Chunlin Han <chunlin.han@linaro.org>
2017-07-07 20:29:30 +08:00
userspace: introduce default memory domain We make a policy change here: all threads are members of a memory domain, never NULL. We introduce a default memory domain for threads that haven't been assigned to or inherited another one. Primary motivation for this change is better MMU support, as one common configuration will be to maintain page tables at the memory domain level. Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2020-08-26 05:42:33 +08:00
struct k_mem_domain k_mem_domain_default;
userspace: cleanup mem domain assertions The memory domain APIs document that overlapping regions are not allowed, check for this unconditionally. Cleanup assertion error messages. Use __ASSERT_NO_MSG for blindingly obvious NULL checks. We now have a `check_add_partition()` function to perform all the necessary sanity checks on adding a partition to a domain. This returns true or false, which will help later when we implement #24609 Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2020-08-20 06:06:37 +08:00
static bool check_add_partition(struct k_mem_domain *domain,
struct k_mem_partition *part)
kernel: mem_domain: Check for overlapping regions when considering W^X Multiple partitions can be added to a domain, and if they overlap, they can have different attributes. The previous check would only check for W^X for individual partitions, and this is insufficient. Overlapping partitions could have W^X attributes, but in the end, a memory region would be writable and executable. The way this is performed is quite "heavyweight", as it is implemented in a O(n^2) operation. The number of partitions per domain is small on most devices, so this isn't an issue. CONFIG_EXECUTE_XOR_WRITE is still an optional feature. Signed-off-by: Leandro Pereira <leandro.pereira@intel.com>
2018-03-01 06:11:41 +08:00
{
userspace: cleanup mem domain assertions The memory domain APIs document that overlapping regions are not allowed, check for this unconditionally. Cleanup assertion error messages. Use __ASSERT_NO_MSG for blindingly obvious NULL checks. We now have a `check_add_partition()` function to perform all the necessary sanity checks on adding a partition to a domain. This returns true or false, which will help later when we implement #24609 Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2020-08-20 06:06:37 +08:00
int i;
uintptr_t pstart, pend, dstart, dend;
if (part == NULL) {
LOG_ERR("NULL k_mem_partition provided");
return false;
}
#ifdef CONFIG_EXECUTE_XOR_WRITE
/* Arches where execution cannot be disabled should always return
* false to this check
*/
if (K_MEM_PARTITION_IS_EXECUTABLE(part->attr) &&
K_MEM_PARTITION_IS_WRITABLE(part->attr)) {
LOG_ERR("partition is writable and executable <start %lx>",
part->start);
return false;
}
kernel: add closing comments to config endifs Add a closing comment to the endif with the configuration information to which the endif belongs too. To make the code more clearer if the configs need adaptions. Signed-off-by: Simon Hein <Shein@baumer.com>
2024-03-08 19:00:10 +08:00
#endif /* CONFIG_EXECUTE_XOR_WRITE */
userspace: cleanup mem domain assertions The memory domain APIs document that overlapping regions are not allowed, check for this unconditionally. Cleanup assertion error messages. Use __ASSERT_NO_MSG for blindingly obvious NULL checks. We now have a `check_add_partition()` function to perform all the necessary sanity checks on adding a partition to a domain. This returns true or false, which will help later when we implement #24609 Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2020-08-20 06:06:37 +08:00
kernel: Make both operands of operators of same essential type category Add a 'U' suffix to values when computing and comparing against unsigned variables and other related fixes of the same MISRA rule (10.4) Signed-off-by: Anas Nashif <anas.nashif@intel.com>
2021-03-29 22:03:49 +08:00
if (part->size == 0U) {
userspace: cleanup mem domain assertions The memory domain APIs document that overlapping regions are not allowed, check for this unconditionally. Cleanup assertion error messages. Use __ASSERT_NO_MSG for blindingly obvious NULL checks. We now have a `check_add_partition()` function to perform all the necessary sanity checks on adding a partition to a domain. This returns true or false, which will help later when we implement #24609 Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2020-08-20 06:06:37 +08:00
LOG_ERR("zero sized partition at %p with base 0x%lx",
part, part->start);
kernel: mem_domain: Check for overlapping regions when considering W^X Multiple partitions can be added to a domain, and if they overlap, they can have different attributes. The previous check would only check for W^X for individual partitions, and this is insufficient. Overlapping partitions could have W^X attributes, but in the end, a memory region would be writable and executable. The way this is performed is quite "heavyweight", as it is implemented in a O(n^2) operation. The number of partitions per domain is small on most devices, so this isn't an issue. CONFIG_EXECUTE_XOR_WRITE is still an optional feature. Signed-off-by: Leandro Pereira <leandro.pereira@intel.com>
2018-03-01 06:11:41 +08:00
return false;
}
userspace: cleanup mem domain assertions The memory domain APIs document that overlapping regions are not allowed, check for this unconditionally. Cleanup assertion error messages. Use __ASSERT_NO_MSG for blindingly obvious NULL checks. We now have a `check_add_partition()` function to perform all the necessary sanity checks on adding a partition to a domain. This returns true or false, which will help later when we implement #24609 Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2020-08-20 06:06:37 +08:00
pstart = part->start;
pend = part->start + part->size;
if (pend <= pstart) {
LOG_ERR("invalid partition %p, wraparound detected. base 0x%lx size %zu",
part, part->start, part->size);
return false;
}
kernel: mem_domain: Check for overlapping regions when considering W^X Multiple partitions can be added to a domain, and if they overlap, they can have different attributes. The previous check would only check for W^X for individual partitions, and this is insufficient. Overlapping partitions could have W^X attributes, but in the end, a memory region would be writable and executable. The way this is performed is quite "heavyweight", as it is implemented in a O(n^2) operation. The number of partitions per domain is small on most devices, so this isn't an issue. CONFIG_EXECUTE_XOR_WRITE is still an optional feature. Signed-off-by: Leandro Pereira <leandro.pereira@intel.com>
2018-03-01 06:11:41 +08:00
userspace: cleanup mem domain assertions The memory domain APIs document that overlapping regions are not allowed, check for this unconditionally. Cleanup assertion error messages. Use __ASSERT_NO_MSG for blindingly obvious NULL checks. We now have a `check_add_partition()` function to perform all the necessary sanity checks on adding a partition to a domain. This returns true or false, which will help later when we implement #24609 Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2020-08-20 06:06:37 +08:00
/* Check that this partition doesn't overlap any existing ones already
* in the domain
*/
for (i = 0; i < domain->num_partitions; i++) {
struct k_mem_partition *dpart = &domain->partitions[i];
kernel: mem_domain: Check for overlapping regions when considering W^X Multiple partitions can be added to a domain, and if they overlap, they can have different attributes. The previous check would only check for W^X for individual partitions, and this is insufficient. Overlapping partitions could have W^X attributes, but in the end, a memory region would be writable and executable. The way this is performed is quite "heavyweight", as it is implemented in a O(n^2) operation. The number of partitions per domain is small on most devices, so this isn't an issue. CONFIG_EXECUTE_XOR_WRITE is still an optional feature. Signed-off-by: Leandro Pereira <leandro.pereira@intel.com>
2018-03-01 06:11:41 +08:00
kernel: Make both operands of operators of same essential type category Add a 'U' suffix to values when computing and comparing against unsigned variables and other related fixes of the same MISRA rule (10.4) Signed-off-by: Anas Nashif <anas.nashif@intel.com>
2021-03-29 22:03:49 +08:00
if (dpart->size == 0U) {
userspace: cleanup mem domain assertions The memory domain APIs document that overlapping regions are not allowed, check for this unconditionally. Cleanup assertion error messages. Use __ASSERT_NO_MSG for blindingly obvious NULL checks. We now have a `check_add_partition()` function to perform all the necessary sanity checks on adding a partition to a domain. This returns true or false, which will help later when we implement #24609 Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2020-08-20 06:06:37 +08:00
/* Unused slot */
kernel: mem_domain: Check for overlapping regions when considering W^X Multiple partitions can be added to a domain, and if they overlap, they can have different attributes. The previous check would only check for W^X for individual partitions, and this is insufficient. Overlapping partitions could have W^X attributes, but in the end, a memory region would be writable and executable. The way this is performed is quite "heavyweight", as it is implemented in a O(n^2) operation. The number of partitions per domain is small on most devices, so this isn't an issue. CONFIG_EXECUTE_XOR_WRITE is still an optional feature. Signed-off-by: Leandro Pereira <leandro.pereira@intel.com>
2018-03-01 06:11:41 +08:00
continue;
}
userspace: cleanup mem domain assertions The memory domain APIs document that overlapping regions are not allowed, check for this unconditionally. Cleanup assertion error messages. Use __ASSERT_NO_MSG for blindingly obvious NULL checks. We now have a `check_add_partition()` function to perform all the necessary sanity checks on adding a partition to a domain. This returns true or false, which will help later when we implement #24609 Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2020-08-20 06:06:37 +08:00
dstart = dpart->start;
dend = dstart + dpart->size;
kernel: mem_domain: Check for overlapping regions when considering W^X Multiple partitions can be added to a domain, and if they overlap, they can have different attributes. The previous check would only check for W^X for individual partitions, and this is insufficient. Overlapping partitions could have W^X attributes, but in the end, a memory region would be writable and executable. The way this is performed is quite "heavyweight", as it is implemented in a O(n^2) operation. The number of partitions per domain is small on most devices, so this isn't an issue. CONFIG_EXECUTE_XOR_WRITE is still an optional feature. Signed-off-by: Leandro Pereira <leandro.pereira@intel.com>
2018-03-01 06:11:41 +08:00
userspace: cleanup mem domain assertions The memory domain APIs document that overlapping regions are not allowed, check for this unconditionally. Cleanup assertion error messages. Use __ASSERT_NO_MSG for blindingly obvious NULL checks. We now have a `check_add_partition()` function to perform all the necessary sanity checks on adding a partition to a domain. This returns true or false, which will help later when we implement #24609 Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2020-08-20 06:06:37 +08:00
if (pend > dstart && dend > pstart) {
LOG_ERR("partition %p base %lx (size %zu) overlaps existing base %lx (size %zu)",
part, part->start, part->size,
dpart->start, dpart->size);
kernel: mem_domain: Check for overlapping regions when considering W^X Multiple partitions can be added to a domain, and if they overlap, they can have different attributes. The previous check would only check for W^X for individual partitions, and this is insufficient. Overlapping partitions could have W^X attributes, but in the end, a memory region would be writable and executable. The way this is performed is quite "heavyweight", as it is implemented in a O(n^2) operation. The number of partitions per domain is small on most devices, so this isn't an issue. CONFIG_EXECUTE_XOR_WRITE is still an optional feature. Signed-off-by: Leandro Pereira <leandro.pereira@intel.com>
2018-03-01 06:11:41 +08:00
return false;
}
}
kernel: Add option to ensure writable pages are not executable This adds CONFIG_EXECUTE_XOR_WRITE, which is enabled by default on systems that support controlling whether a page can contain executable code. This is also known as W^X[1]. Trying to add a memory domain with a page that is both executable and writable, either for supervisor mode threads, or for user mode threads, will result in a kernel panic. There are few cases where a writable page should also be executable (JIT compilers, which are most likely out of scope for Zephyr), so an option is provided to disable the check. Since the memory domain APIs are executed in supervisor mode, a determined person could bypass these checks with ease. This is seen more as a way to avoid people shooting themselves in the foot. [1] https://en.wikipedia.org/wiki/W%5EX Signed-off-by: Leandro Pereira <leandro.pereira@intel.com>
2017-10-18 08:01:48 +08:00
kernel: mem_domain: Check for overlapping regions when considering W^X Multiple partitions can be added to a domain, and if they overlap, they can have different attributes. The previous check would only check for W^X for individual partitions, and this is insufficient. Overlapping partitions could have W^X attributes, but in the end, a memory region would be writable and executable. The way this is performed is quite "heavyweight", as it is implemented in a O(n^2) operation. The number of partitions per domain is small on most devices, so this isn't an issue. CONFIG_EXECUTE_XOR_WRITE is still an optional feature. Signed-off-by: Leandro Pereira <leandro.pereira@intel.com>
2018-03-01 06:11:41 +08:00
return true;
}
kernel: mem_domain: centralize assertions Later this year I hope to overhaul the memory domain APIs, but at least for now let's at least consolidate these checks. Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2020-07-18 04:48:36 +08:00
kernel: mem_domain: init function to return error values This changes k_mem_domain_init() to return error values instead of asserting when errors are encountered. This gives applications a chance to recover if needed. Signed-off-by: Daniel Leung <daniel.leung@intel.com>
2021-11-12 04:49:58 +08:00
int k_mem_domain_init(struct k_mem_domain *domain, uint8_t num_parts,
struct k_mem_partition *parts[])
kernel: add memory domain APIs Add the following application-facing memory domain APIs: k_mem_domain_init() - to initialize a memory domain k_mem_domain_destroy() - to destroy a memory domain k_mem_domain_add_partition() - to add a partition into a domain k_mem_domain_remove_partition() - to remove a partition from a domain k_mem_domain_add_thread() - to add a thread into a domain k_mem_domain_remove_thread() - to remove a thread from a domain A memory domain would contain some number of memory partitions. A memory partition is a memory region (might be RAM, peripheral registers, flash...) with specific attributes (access permission, e.g. privileged read/write, unprivileged read-only, execute never...). Memory partitions would be defined by set of MPU regions or MMU tables underneath. A thread could only belong to a single memory domain any point in time but a memory domain could contain multiple threads. Threads in the same memory domain would have the same access permission to the memory partitions belong to the memory domain. The memory domain APIs are used by unprivileged threads to share data to the threads in the same memory and protect sensitive data from threads outside their domain. It is not only for improving the security but also useful for debugging (unexpected access would cause exception). Jira: ZEP-2281 Signed-off-by: Chunlin Han <chunlin.han@linaro.org>
2017-07-07 20:29:30 +08:00
{
kernel/mem_domain: Spinlockify Simple locking requirements here mean we can just use a single subsystem lock. Signed-off-by: Andy Ross <andrew.j.ross@intel.com>
2018-07-25 02:35:55 +08:00
k_spinlock_key_t key;
kernel: mem_domain: init function to return error values This changes k_mem_domain_init() to return error values instead of asserting when errors are encountered. This gives applications a chance to recover if needed. Signed-off-by: Daniel Leung <daniel.leung@intel.com>
2021-11-12 04:49:58 +08:00
int ret = 0;
kernel: add memory domain APIs Add the following application-facing memory domain APIs: k_mem_domain_init() - to initialize a memory domain k_mem_domain_destroy() - to destroy a memory domain k_mem_domain_add_partition() - to add a partition into a domain k_mem_domain_remove_partition() - to remove a partition from a domain k_mem_domain_add_thread() - to add a thread into a domain k_mem_domain_remove_thread() - to remove a thread from a domain A memory domain would contain some number of memory partitions. A memory partition is a memory region (might be RAM, peripheral registers, flash...) with specific attributes (access permission, e.g. privileged read/write, unprivileged read-only, execute never...). Memory partitions would be defined by set of MPU regions or MMU tables underneath. A thread could only belong to a single memory domain any point in time but a memory domain could contain multiple threads. Threads in the same memory domain would have the same access permission to the memory partitions belong to the memory domain. The memory domain APIs are used by unprivileged threads to share data to the threads in the same memory and protect sensitive data from threads outside their domain. It is not only for improving the security but also useful for debugging (unexpected access would cause exception). Jira: ZEP-2281 Signed-off-by: Chunlin Han <chunlin.han@linaro.org>
2017-07-07 20:29:30 +08:00
kernel: mem_domain: init function to return error values This changes k_mem_domain_init() to return error values instead of asserting when errors are encountered. This gives applications a chance to recover if needed. Signed-off-by: Daniel Leung <daniel.leung@intel.com>
2021-11-12 04:49:58 +08:00
CHECKIF(domain == NULL) {
ret = -EINVAL;
goto out;
}
CHECKIF(!(num_parts == 0U || parts != NULL)) {
LOG_ERR("parts array is NULL and num_parts is nonzero");
ret = -EINVAL;
goto out;
}
CHECKIF(!(num_parts <= max_partitions)) {
LOG_ERR("num_parts of %d exceeds maximum allowable partitions (%d)",
num_parts, max_partitions);
ret = -EINVAL;
goto out;
}
kernel: add memory domain APIs Add the following application-facing memory domain APIs: k_mem_domain_init() - to initialize a memory domain k_mem_domain_destroy() - to destroy a memory domain k_mem_domain_add_partition() - to add a partition into a domain k_mem_domain_remove_partition() - to remove a partition from a domain k_mem_domain_add_thread() - to add a thread into a domain k_mem_domain_remove_thread() - to remove a thread from a domain A memory domain would contain some number of memory partitions. A memory partition is a memory region (might be RAM, peripheral registers, flash...) with specific attributes (access permission, e.g. privileged read/write, unprivileged read-only, execute never...). Memory partitions would be defined by set of MPU regions or MMU tables underneath. A thread could only belong to a single memory domain any point in time but a memory domain could contain multiple threads. Threads in the same memory domain would have the same access permission to the memory partitions belong to the memory domain. The memory domain APIs are used by unprivileged threads to share data to the threads in the same memory and protect sensitive data from threads outside their domain. It is not only for improving the security but also useful for debugging (unexpected access would cause exception). Jira: ZEP-2281 Signed-off-by: Chunlin Han <chunlin.han@linaro.org>
2017-07-07 20:29:30 +08:00
userspace: make mem domain lock non-static Strictly speaking, any access to a mem domain or its containing partitions should be serialized on this lock. Architecture code may need to grab this lock if it is using this data during, for example, context switches, especially if they support SMP as locking interrupts is not enough. Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2020-10-07 06:53:43 +08:00
key = k_spin_lock(&z_mem_domain_lock);
kernel: add memory domain APIs Add the following application-facing memory domain APIs: k_mem_domain_init() - to initialize a memory domain k_mem_domain_destroy() - to destroy a memory domain k_mem_domain_add_partition() - to add a partition into a domain k_mem_domain_remove_partition() - to remove a partition from a domain k_mem_domain_add_thread() - to add a thread into a domain k_mem_domain_remove_thread() - to remove a thread from a domain A memory domain would contain some number of memory partitions. A memory partition is a memory region (might be RAM, peripheral registers, flash...) with specific attributes (access permission, e.g. privileged read/write, unprivileged read-only, execute never...). Memory partitions would be defined by set of MPU regions or MMU tables underneath. A thread could only belong to a single memory domain any point in time but a memory domain could contain multiple threads. Threads in the same memory domain would have the same access permission to the memory partitions belong to the memory domain. The memory domain APIs are used by unprivileged threads to share data to the threads in the same memory and protect sensitive data from threads outside their domain. It is not only for improving the security but also useful for debugging (unexpected access would cause exception). Jira: ZEP-2281 Signed-off-by: Chunlin Han <chunlin.han@linaro.org>
2017-07-07 20:29:30 +08:00
all: Add 'U' suffix when using unsigned variables Add a 'U' suffix to values when computing and comparing against unsigned variables. Signed-off-by: Patrik Flykt <patrik.flykt@intel.com>
2019-03-27 09:57:45 +08:00
domain->num_partitions = 0U;
coccicnelle: Ignore return of memset The return of memset is never checked. This patch explicitly ignore the return to avoid MISRA-C violations. The only directory excluded directory was ext/* since it contains only imported code. Signed-off-by: Flavio Ceolin <flavio.ceolin@intel.com>
2018-09-12 10:09:03 +08:00
(void)memset(domain->partitions, 0, sizeof(domain->partitions));
kernel: add memory domain APIs Add the following application-facing memory domain APIs: k_mem_domain_init() - to initialize a memory domain k_mem_domain_destroy() - to destroy a memory domain k_mem_domain_add_partition() - to add a partition into a domain k_mem_domain_remove_partition() - to remove a partition from a domain k_mem_domain_add_thread() - to add a thread into a domain k_mem_domain_remove_thread() - to remove a thread from a domain A memory domain would contain some number of memory partitions. A memory partition is a memory region (might be RAM, peripheral registers, flash...) with specific attributes (access permission, e.g. privileged read/write, unprivileged read-only, execute never...). Memory partitions would be defined by set of MPU regions or MMU tables underneath. A thread could only belong to a single memory domain any point in time but a memory domain could contain multiple threads. Threads in the same memory domain would have the same access permission to the memory partitions belong to the memory domain. The memory domain APIs are used by unprivileged threads to share data to the threads in the same memory and protect sensitive data from threads outside their domain. It is not only for improving the security but also useful for debugging (unexpected access would cause exception). Jira: ZEP-2281 Signed-off-by: Chunlin Han <chunlin.han@linaro.org>
2017-07-07 20:29:30 +08:00
sys_dlist_init(&domain->mem_domain_q);
userspace: add optional member to memory domains Some systems may need to associate arch-specific data to a memory domain. Add a Kconfig and `arch` field for this, and a new arch API to initialize it. Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2020-08-20 04:11:47 +08:00
#ifdef CONFIG_ARCH_MEM_DOMAIN_DATA
kernel: mem_domain: init function to return error values This changes k_mem_domain_init() to return error values instead of asserting when errors are encountered. This gives applications a chance to recover if needed. Signed-off-by: Daniel Leung <daniel.leung@intel.com>
2021-11-12 04:49:58 +08:00
ret = arch_mem_domain_init(domain);
userspace: add optional member to memory domains Some systems may need to associate arch-specific data to a memory domain. Add a Kconfig and `arch` field for this, and a new arch API to initialize it. Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2020-08-20 04:11:47 +08:00
if (ret != 0) {
LOG_ERR("architecture-specific initialization failed for domain %p with %d",
domain, ret);
kernel: mem_domain: init function to return error values This changes k_mem_domain_init() to return error values instead of asserting when errors are encountered. This gives applications a chance to recover if needed. Signed-off-by: Daniel Leung <daniel.leung@intel.com>
2021-11-12 04:49:58 +08:00
ret = -ENOMEM;
goto unlock_out;
userspace: add optional member to memory domains Some systems may need to associate arch-specific data to a memory domain. Add a Kconfig and `arch` field for this, and a new arch API to initialize it. Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2020-08-20 04:11:47 +08:00
}
kernel: add closing comments to config endifs Add a closing comment to the endif with the configuration information to which the endif belongs too. To make the code more clearer if the configs need adaptions. Signed-off-by: Simon Hein <Shein@baumer.com>
2024-03-08 19:00:10 +08:00
#endif /* CONFIG_ARCH_MEM_DOMAIN_DATA */
userspace: fix k_mem_domain_init() The synchronous arch hook wasn't being invoked when k_mem_domain_init() was called with a partition list. This could result with regions not being programmed in the page tables as expected. Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2020-10-17 07:49:41 +08:00
if (num_parts != 0U) {
uint32_t i;
for (i = 0U; i < num_parts; i++) {
kernel: mem_domain: init function to return error values This changes k_mem_domain_init() to return error values instead of asserting when errors are encountered. This gives applications a chance to recover if needed. Signed-off-by: Daniel Leung <daniel.leung@intel.com>
2021-11-12 04:49:58 +08:00
CHECKIF(!check_add_partition(domain, parts[i])) {
LOG_ERR("invalid partition index %d (%p)",
i, parts[i]);
ret = -EINVAL;
goto unlock_out;
}
userspace: fix k_mem_domain_init() The synchronous arch hook wasn't being invoked when k_mem_domain_init() was called with a partition list. This could result with regions not being programmed in the page tables as expected. Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2020-10-17 07:49:41 +08:00
domain->partitions[i] = *parts[i];
domain->num_partitions++;
#ifdef CONFIG_ARCH_MEM_DOMAIN_SYNCHRONOUS_API
kernel: mem_domain: k_mem_domain_add_thread to return errors This updates k_mem_domain_add_thread() to return errors so the application has a chance to recover. Signed-off-by: Daniel Leung <daniel.leung@intel.com>
2021-11-13 08:10:10 +08:00
int ret2 = arch_mem_domain_partition_add(domain, i);
ARG_UNUSED(ret2);
CHECKIF(ret2 != 0) {
ret = ret2;
}
kernel: add closing comments to config endifs Add a closing comment to the endif with the configuration information to which the endif belongs too. To make the code more clearer if the configs need adaptions. Signed-off-by: Simon Hein <Shein@baumer.com>
2024-03-08 19:00:10 +08:00
#endif /* CONFIG_ARCH_MEM_DOMAIN_SYNCHRONOUS_API */
userspace: fix k_mem_domain_init() The synchronous arch hook wasn't being invoked when k_mem_domain_init() was called with a partition list. This could result with regions not being programmed in the page tables as expected. Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2020-10-17 07:49:41 +08:00
}
}
userspace: add optional member to memory domains Some systems may need to associate arch-specific data to a memory domain. Add a Kconfig and `arch` field for this, and a new arch API to initialize it. Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2020-08-20 04:11:47 +08:00
kernel: mem_domain: init function to return error values This changes k_mem_domain_init() to return error values instead of asserting when errors are encountered. This gives applications a chance to recover if needed. Signed-off-by: Daniel Leung <daniel.leung@intel.com>
2021-11-12 04:49:58 +08:00
unlock_out:
userspace: make mem domain lock non-static Strictly speaking, any access to a mem domain or its containing partitions should be serialized on this lock. Architecture code may need to grab this lock if it is using this data during, for example, context switches, especially if they support SMP as locking interrupts is not enough. Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2020-10-07 06:53:43 +08:00
k_spin_unlock(&z_mem_domain_lock, key);
kernel: mem_domain: init function to return error values This changes k_mem_domain_init() to return error values instead of asserting when errors are encountered. This gives applications a chance to recover if needed. Signed-off-by: Daniel Leung <daniel.leung@intel.com>
2021-11-12 04:49:58 +08:00
out:
return ret;
kernel: add memory domain APIs Add the following application-facing memory domain APIs: k_mem_domain_init() - to initialize a memory domain k_mem_domain_destroy() - to destroy a memory domain k_mem_domain_add_partition() - to add a partition into a domain k_mem_domain_remove_partition() - to remove a partition from a domain k_mem_domain_add_thread() - to add a thread into a domain k_mem_domain_remove_thread() - to remove a thread from a domain A memory domain would contain some number of memory partitions. A memory partition is a memory region (might be RAM, peripheral registers, flash...) with specific attributes (access permission, e.g. privileged read/write, unprivileged read-only, execute never...). Memory partitions would be defined by set of MPU regions or MMU tables underneath. A thread could only belong to a single memory domain any point in time but a memory domain could contain multiple threads. Threads in the same memory domain would have the same access permission to the memory partitions belong to the memory domain. The memory domain APIs are used by unprivileged threads to share data to the threads in the same memory and protect sensitive data from threads outside their domain. It is not only for improving the security but also useful for debugging (unexpected access would cause exception). Jira: ZEP-2281 Signed-off-by: Chunlin Han <chunlin.han@linaro.org>
2017-07-07 20:29:30 +08:00
}
kernel: mem_domain: add/remove partition funcs to return errors This changes both k_mem_domain_add_partition() and k_mem_domain_remove_partition() to return errors instead of asserting when errors are encountered. This gives the application chance to recover. The arch_mem_domain_parition_add()/_remove() will be modified later together with all the other arch_mem_domain_*() changes since the architecture code for partition addition and removal functions usually cannot be separately changed. Signed-off-by: Daniel Leung <daniel.leung@intel.com>
2021-11-11 03:11:00 +08:00
int k_mem_domain_add_partition(struct k_mem_domain *domain,
struct k_mem_partition *part)
kernel: add memory domain APIs Add the following application-facing memory domain APIs: k_mem_domain_init() - to initialize a memory domain k_mem_domain_destroy() - to destroy a memory domain k_mem_domain_add_partition() - to add a partition into a domain k_mem_domain_remove_partition() - to remove a partition from a domain k_mem_domain_add_thread() - to add a thread into a domain k_mem_domain_remove_thread() - to remove a thread from a domain A memory domain would contain some number of memory partitions. A memory partition is a memory region (might be RAM, peripheral registers, flash...) with specific attributes (access permission, e.g. privileged read/write, unprivileged read-only, execute never...). Memory partitions would be defined by set of MPU regions or MMU tables underneath. A thread could only belong to a single memory domain any point in time but a memory domain could contain multiple threads. Threads in the same memory domain would have the same access permission to the memory partitions belong to the memory domain. The memory domain APIs are used by unprivileged threads to share data to the threads in the same memory and protect sensitive data from threads outside their domain. It is not only for improving the security but also useful for debugging (unexpected access would cause exception). Jira: ZEP-2281 Signed-off-by: Chunlin Han <chunlin.han@linaro.org>
2017-07-07 20:29:30 +08:00
{
int p_idx;
kernel/mem_domain: Spinlockify Simple locking requirements here mean we can just use a single subsystem lock. Signed-off-by: Andy Ross <andrew.j.ross@intel.com>
2018-07-25 02:35:55 +08:00
k_spinlock_key_t key;
kernel: mem_domain: add/remove partition funcs to return errors This changes both k_mem_domain_add_partition() and k_mem_domain_remove_partition() to return errors instead of asserting when errors are encountered. This gives the application chance to recover. The arch_mem_domain_parition_add()/_remove() will be modified later together with all the other arch_mem_domain_*() changes since the architecture code for partition addition and removal functions usually cannot be separately changed. Signed-off-by: Daniel Leung <daniel.leung@intel.com>
2021-11-11 03:11:00 +08:00
int ret = 0;
kernel: add memory domain APIs Add the following application-facing memory domain APIs: k_mem_domain_init() - to initialize a memory domain k_mem_domain_destroy() - to destroy a memory domain k_mem_domain_add_partition() - to add a partition into a domain k_mem_domain_remove_partition() - to remove a partition from a domain k_mem_domain_add_thread() - to add a thread into a domain k_mem_domain_remove_thread() - to remove a thread from a domain A memory domain would contain some number of memory partitions. A memory partition is a memory region (might be RAM, peripheral registers, flash...) with specific attributes (access permission, e.g. privileged read/write, unprivileged read-only, execute never...). Memory partitions would be defined by set of MPU regions or MMU tables underneath. A thread could only belong to a single memory domain any point in time but a memory domain could contain multiple threads. Threads in the same memory domain would have the same access permission to the memory partitions belong to the memory domain. The memory domain APIs are used by unprivileged threads to share data to the threads in the same memory and protect sensitive data from threads outside their domain. It is not only for improving the security but also useful for debugging (unexpected access would cause exception). Jira: ZEP-2281 Signed-off-by: Chunlin Han <chunlin.han@linaro.org>
2017-07-07 20:29:30 +08:00
kernel: mem_domain: add/remove partition funcs to return errors This changes both k_mem_domain_add_partition() and k_mem_domain_remove_partition() to return errors instead of asserting when errors are encountered. This gives the application chance to recover. The arch_mem_domain_parition_add()/_remove() will be modified later together with all the other arch_mem_domain_*() changes since the architecture code for partition addition and removal functions usually cannot be separately changed. Signed-off-by: Daniel Leung <daniel.leung@intel.com>
2021-11-11 03:11:00 +08:00
CHECKIF(domain == NULL) {
ret = -EINVAL;
goto out;
}
CHECKIF(!check_add_partition(domain, part)) {
LOG_ERR("invalid partition %p", part);
ret = -EINVAL;
goto out;
}
kernel: Add option to ensure writable pages are not executable This adds CONFIG_EXECUTE_XOR_WRITE, which is enabled by default on systems that support controlling whether a page can contain executable code. This is also known as W^X[1]. Trying to add a memory domain with a page that is both executable and writable, either for supervisor mode threads, or for user mode threads, will result in a kernel panic. There are few cases where a writable page should also be executable (JIT compilers, which are most likely out of scope for Zephyr), so an option is provided to disable the check. Since the memory domain APIs are executed in supervisor mode, a determined person could bypass these checks with ease. This is seen more as a way to avoid people shooting themselves in the foot. [1] https://en.wikipedia.org/wiki/W%5EX Signed-off-by: Leandro Pereira <leandro.pereira@intel.com>
2017-10-18 08:01:48 +08:00
userspace: make mem domain lock non-static Strictly speaking, any access to a mem domain or its containing partitions should be serialized on this lock. Architecture code may need to grab this lock if it is using this data during, for example, context switches, especially if they support SMP as locking interrupts is not enough. Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2020-10-07 06:53:43 +08:00
key = k_spin_lock(&z_mem_domain_lock);
kernel: add memory domain APIs Add the following application-facing memory domain APIs: k_mem_domain_init() - to initialize a memory domain k_mem_domain_destroy() - to destroy a memory domain k_mem_domain_add_partition() - to add a partition into a domain k_mem_domain_remove_partition() - to remove a partition from a domain k_mem_domain_add_thread() - to add a thread into a domain k_mem_domain_remove_thread() - to remove a thread from a domain A memory domain would contain some number of memory partitions. A memory partition is a memory region (might be RAM, peripheral registers, flash...) with specific attributes (access permission, e.g. privileged read/write, unprivileged read-only, execute never...). Memory partitions would be defined by set of MPU regions or MMU tables underneath. A thread could only belong to a single memory domain any point in time but a memory domain could contain multiple threads. Threads in the same memory domain would have the same access permission to the memory partitions belong to the memory domain. The memory domain APIs are used by unprivileged threads to share data to the threads in the same memory and protect sensitive data from threads outside their domain. It is not only for improving the security but also useful for debugging (unexpected access would cause exception). Jira: ZEP-2281 Signed-off-by: Chunlin Han <chunlin.han@linaro.org>
2017-07-07 20:29:30 +08:00
for (p_idx = 0; p_idx < max_partitions; p_idx++) {
/* A zero-sized partition denotes it's a free partition */
all: Add 'U' suffix when using unsigned variables Add a 'U' suffix to values when computing and comparing against unsigned variables. Signed-off-by: Patrik Flykt <patrik.flykt@intel.com>
2019-03-27 09:57:45 +08:00
if (domain->partitions[p_idx].size == 0U) {
kernel: add memory domain APIs Add the following application-facing memory domain APIs: k_mem_domain_init() - to initialize a memory domain k_mem_domain_destroy() - to destroy a memory domain k_mem_domain_add_partition() - to add a partition into a domain k_mem_domain_remove_partition() - to remove a partition from a domain k_mem_domain_add_thread() - to add a thread into a domain k_mem_domain_remove_thread() - to remove a thread from a domain A memory domain would contain some number of memory partitions. A memory partition is a memory region (might be RAM, peripheral registers, flash...) with specific attributes (access permission, e.g. privileged read/write, unprivileged read-only, execute never...). Memory partitions would be defined by set of MPU regions or MMU tables underneath. A thread could only belong to a single memory domain any point in time but a memory domain could contain multiple threads. Threads in the same memory domain would have the same access permission to the memory partitions belong to the memory domain. The memory domain APIs are used by unprivileged threads to share data to the threads in the same memory and protect sensitive data from threads outside their domain. It is not only for improving the security but also useful for debugging (unexpected access would cause exception). Jira: ZEP-2281 Signed-off-by: Chunlin Han <chunlin.han@linaro.org>
2017-07-07 20:29:30 +08:00
break;
}
}
kernel: mem_domain: add/remove partition funcs to return errors This changes both k_mem_domain_add_partition() and k_mem_domain_remove_partition() to return errors instead of asserting when errors are encountered. This gives the application chance to recover. The arch_mem_domain_parition_add()/_remove() will be modified later together with all the other arch_mem_domain_*() changes since the architecture code for partition addition and removal functions usually cannot be separately changed. Signed-off-by: Daniel Leung <daniel.leung@intel.com>
2021-11-11 03:11:00 +08:00
CHECKIF(!(p_idx < max_partitions)) {
LOG_ERR("no free partition slots available");
ret = -ENOSPC;
goto unlock_out;
}
kernel: add memory domain APIs Add the following application-facing memory domain APIs: k_mem_domain_init() - to initialize a memory domain k_mem_domain_destroy() - to destroy a memory domain k_mem_domain_add_partition() - to add a partition into a domain k_mem_domain_remove_partition() - to remove a partition from a domain k_mem_domain_add_thread() - to add a thread into a domain k_mem_domain_remove_thread() - to remove a thread from a domain A memory domain would contain some number of memory partitions. A memory partition is a memory region (might be RAM, peripheral registers, flash...) with specific attributes (access permission, e.g. privileged read/write, unprivileged read-only, execute never...). Memory partitions would be defined by set of MPU regions or MMU tables underneath. A thread could only belong to a single memory domain any point in time but a memory domain could contain multiple threads. Threads in the same memory domain would have the same access permission to the memory partitions belong to the memory domain. The memory domain APIs are used by unprivileged threads to share data to the threads in the same memory and protect sensitive data from threads outside their domain. It is not only for improving the security but also useful for debugging (unexpected access would cause exception). Jira: ZEP-2281 Signed-off-by: Chunlin Han <chunlin.han@linaro.org>
2017-07-07 20:29:30 +08:00
userspace: add debug logs to mem domain code Useful when debugging stuff. Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2020-08-26 07:47:44 +08:00
LOG_DBG("add partition base %lx size %zu to domain %p\n",
part->start, part->size, domain);
kernel: add memory domain APIs Add the following application-facing memory domain APIs: k_mem_domain_init() - to initialize a memory domain k_mem_domain_destroy() - to destroy a memory domain k_mem_domain_add_partition() - to add a partition into a domain k_mem_domain_remove_partition() - to remove a partition from a domain k_mem_domain_add_thread() - to add a thread into a domain k_mem_domain_remove_thread() - to remove a thread from a domain A memory domain would contain some number of memory partitions. A memory partition is a memory region (might be RAM, peripheral registers, flash...) with specific attributes (access permission, e.g. privileged read/write, unprivileged read-only, execute never...). Memory partitions would be defined by set of MPU regions or MMU tables underneath. A thread could only belong to a single memory domain any point in time but a memory domain could contain multiple threads. Threads in the same memory domain would have the same access permission to the memory partitions belong to the memory domain. The memory domain APIs are used by unprivileged threads to share data to the threads in the same memory and protect sensitive data from threads outside their domain. It is not only for improving the security but also useful for debugging (unexpected access would cause exception). Jira: ZEP-2281 Signed-off-by: Chunlin Han <chunlin.han@linaro.org>
2017-07-07 20:29:30 +08:00
domain->partitions[p_idx].start = part->start;
domain->partitions[p_idx].size = part->size;
domain->partitions[p_idx].attr = part->attr;
domain->num_partitions++;
kernel: add CONFIG_ARCH_MEM_DOMAIN_SYNCHRONOUS_API Saves us a few bytes of program text on arches that don't need these implemented, currently all uniprocessor MPU-based systems. Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2020-08-26 08:02:38 +08:00
#ifdef CONFIG_ARCH_MEM_DOMAIN_SYNCHRONOUS_API
kernel: mem_domain: k_mem_domain_add_thread to return errors This updates k_mem_domain_add_thread() to return errors so the application has a chance to recover. Signed-off-by: Daniel Leung <daniel.leung@intel.com>
2021-11-13 08:10:10 +08:00
ret = arch_mem_domain_partition_add(domain, p_idx);
kernel: add closing comments to config endifs Add a closing comment to the endif with the configuration information to which the endif belongs too. To make the code more clearer if the configs need adaptions. Signed-off-by: Simon Hein <Shein@baumer.com>
2024-03-08 19:00:10 +08:00
#endif /* CONFIG_ARCH_MEM_DOMAIN_SYNCHRONOUS_API */
kernel: mem_domain: add/remove partition funcs to return errors This changes both k_mem_domain_add_partition() and k_mem_domain_remove_partition() to return errors instead of asserting when errors are encountered. This gives the application chance to recover. The arch_mem_domain_parition_add()/_remove() will be modified later together with all the other arch_mem_domain_*() changes since the architecture code for partition addition and removal functions usually cannot be separately changed. Signed-off-by: Daniel Leung <daniel.leung@intel.com>
2021-11-11 03:11:00 +08:00
unlock_out:
userspace: make mem domain lock non-static Strictly speaking, any access to a mem domain or its containing partitions should be serialized on this lock. Architecture code may need to grab this lock if it is using this data during, for example, context switches, especially if they support SMP as locking interrupts is not enough. Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2020-10-07 06:53:43 +08:00
k_spin_unlock(&z_mem_domain_lock, key);
kernel: mem_domain: add/remove partition funcs to return errors This changes both k_mem_domain_add_partition() and k_mem_domain_remove_partition() to return errors instead of asserting when errors are encountered. This gives the application chance to recover. The arch_mem_domain_parition_add()/_remove() will be modified later together with all the other arch_mem_domain_*() changes since the architecture code for partition addition and removal functions usually cannot be separately changed. Signed-off-by: Daniel Leung <daniel.leung@intel.com>
2021-11-11 03:11:00 +08:00
out:
return ret;
kernel: add memory domain APIs Add the following application-facing memory domain APIs: k_mem_domain_init() - to initialize a memory domain k_mem_domain_destroy() - to destroy a memory domain k_mem_domain_add_partition() - to add a partition into a domain k_mem_domain_remove_partition() - to remove a partition from a domain k_mem_domain_add_thread() - to add a thread into a domain k_mem_domain_remove_thread() - to remove a thread from a domain A memory domain would contain some number of memory partitions. A memory partition is a memory region (might be RAM, peripheral registers, flash...) with specific attributes (access permission, e.g. privileged read/write, unprivileged read-only, execute never...). Memory partitions would be defined by set of MPU regions or MMU tables underneath. A thread could only belong to a single memory domain any point in time but a memory domain could contain multiple threads. Threads in the same memory domain would have the same access permission to the memory partitions belong to the memory domain. The memory domain APIs are used by unprivileged threads to share data to the threads in the same memory and protect sensitive data from threads outside their domain. It is not only for improving the security but also useful for debugging (unexpected access would cause exception). Jira: ZEP-2281 Signed-off-by: Chunlin Han <chunlin.han@linaro.org>
2017-07-07 20:29:30 +08:00
}
kernel: mem_domain: add/remove partition funcs to return errors This changes both k_mem_domain_add_partition() and k_mem_domain_remove_partition() to return errors instead of asserting when errors are encountered. This gives the application chance to recover. The arch_mem_domain_parition_add()/_remove() will be modified later together with all the other arch_mem_domain_*() changes since the architecture code for partition addition and removal functions usually cannot be separately changed. Signed-off-by: Daniel Leung <daniel.leung@intel.com>
2021-11-11 03:11:00 +08:00
int k_mem_domain_remove_partition(struct k_mem_domain *domain,
kernel: add memory domain APIs Add the following application-facing memory domain APIs: k_mem_domain_init() - to initialize a memory domain k_mem_domain_destroy() - to destroy a memory domain k_mem_domain_add_partition() - to add a partition into a domain k_mem_domain_remove_partition() - to remove a partition from a domain k_mem_domain_add_thread() - to add a thread into a domain k_mem_domain_remove_thread() - to remove a thread from a domain A memory domain would contain some number of memory partitions. A memory partition is a memory region (might be RAM, peripheral registers, flash...) with specific attributes (access permission, e.g. privileged read/write, unprivileged read-only, execute never...). Memory partitions would be defined by set of MPU regions or MMU tables underneath. A thread could only belong to a single memory domain any point in time but a memory domain could contain multiple threads. Threads in the same memory domain would have the same access permission to the memory partitions belong to the memory domain. The memory domain APIs are used by unprivileged threads to share data to the threads in the same memory and protect sensitive data from threads outside their domain. It is not only for improving the security but also useful for debugging (unexpected access would cause exception). Jira: ZEP-2281 Signed-off-by: Chunlin Han <chunlin.han@linaro.org>
2017-07-07 20:29:30 +08:00
struct k_mem_partition *part)
{
int p_idx;
kernel/mem_domain: Spinlockify Simple locking requirements here mean we can just use a single subsystem lock. Signed-off-by: Andy Ross <andrew.j.ross@intel.com>
2018-07-25 02:35:55 +08:00
k_spinlock_key_t key;
kernel: mem_domain: add/remove partition funcs to return errors This changes both k_mem_domain_add_partition() and k_mem_domain_remove_partition() to return errors instead of asserting when errors are encountered. This gives the application chance to recover. The arch_mem_domain_parition_add()/_remove() will be modified later together with all the other arch_mem_domain_*() changes since the architecture code for partition addition and removal functions usually cannot be separately changed. Signed-off-by: Daniel Leung <daniel.leung@intel.com>
2021-11-11 03:11:00 +08:00
int ret = 0;
kernel: add memory domain APIs Add the following application-facing memory domain APIs: k_mem_domain_init() - to initialize a memory domain k_mem_domain_destroy() - to destroy a memory domain k_mem_domain_add_partition() - to add a partition into a domain k_mem_domain_remove_partition() - to remove a partition from a domain k_mem_domain_add_thread() - to add a thread into a domain k_mem_domain_remove_thread() - to remove a thread from a domain A memory domain would contain some number of memory partitions. A memory partition is a memory region (might be RAM, peripheral registers, flash...) with specific attributes (access permission, e.g. privileged read/write, unprivileged read-only, execute never...). Memory partitions would be defined by set of MPU regions or MMU tables underneath. A thread could only belong to a single memory domain any point in time but a memory domain could contain multiple threads. Threads in the same memory domain would have the same access permission to the memory partitions belong to the memory domain. The memory domain APIs are used by unprivileged threads to share data to the threads in the same memory and protect sensitive data from threads outside their domain. It is not only for improving the security but also useful for debugging (unexpected access would cause exception). Jira: ZEP-2281 Signed-off-by: Chunlin Han <chunlin.han@linaro.org>
2017-07-07 20:29:30 +08:00
kernel: mem_domain: add/remove partition funcs to return errors This changes both k_mem_domain_add_partition() and k_mem_domain_remove_partition() to return errors instead of asserting when errors are encountered. This gives the application chance to recover. The arch_mem_domain_parition_add()/_remove() will be modified later together with all the other arch_mem_domain_*() changes since the architecture code for partition addition and removal functions usually cannot be separately changed. Signed-off-by: Daniel Leung <daniel.leung@intel.com>
2021-11-11 03:11:00 +08:00
CHECKIF((domain == NULL) || (part == NULL)) {
ret = -EINVAL;
goto out;
}
kernel: add memory domain APIs Add the following application-facing memory domain APIs: k_mem_domain_init() - to initialize a memory domain k_mem_domain_destroy() - to destroy a memory domain k_mem_domain_add_partition() - to add a partition into a domain k_mem_domain_remove_partition() - to remove a partition from a domain k_mem_domain_add_thread() - to add a thread into a domain k_mem_domain_remove_thread() - to remove a thread from a domain A memory domain would contain some number of memory partitions. A memory partition is a memory region (might be RAM, peripheral registers, flash...) with specific attributes (access permission, e.g. privileged read/write, unprivileged read-only, execute never...). Memory partitions would be defined by set of MPU regions or MMU tables underneath. A thread could only belong to a single memory domain any point in time but a memory domain could contain multiple threads. Threads in the same memory domain would have the same access permission to the memory partitions belong to the memory domain. The memory domain APIs are used by unprivileged threads to share data to the threads in the same memory and protect sensitive data from threads outside their domain. It is not only for improving the security but also useful for debugging (unexpected access would cause exception). Jira: ZEP-2281 Signed-off-by: Chunlin Han <chunlin.han@linaro.org>
2017-07-07 20:29:30 +08:00
userspace: make mem domain lock non-static Strictly speaking, any access to a mem domain or its containing partitions should be serialized on this lock. Architecture code may need to grab this lock if it is using this data during, for example, context switches, especially if they support SMP as locking interrupts is not enough. Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2020-10-07 06:53:43 +08:00
key = k_spin_lock(&z_mem_domain_lock);
kernel: add memory domain APIs Add the following application-facing memory domain APIs: k_mem_domain_init() - to initialize a memory domain k_mem_domain_destroy() - to destroy a memory domain k_mem_domain_add_partition() - to add a partition into a domain k_mem_domain_remove_partition() - to remove a partition from a domain k_mem_domain_add_thread() - to add a thread into a domain k_mem_domain_remove_thread() - to remove a thread from a domain A memory domain would contain some number of memory partitions. A memory partition is a memory region (might be RAM, peripheral registers, flash...) with specific attributes (access permission, e.g. privileged read/write, unprivileged read-only, execute never...). Memory partitions would be defined by set of MPU regions or MMU tables underneath. A thread could only belong to a single memory domain any point in time but a memory domain could contain multiple threads. Threads in the same memory domain would have the same access permission to the memory partitions belong to the memory domain. The memory domain APIs are used by unprivileged threads to share data to the threads in the same memory and protect sensitive data from threads outside their domain. It is not only for improving the security but also useful for debugging (unexpected access would cause exception). Jira: ZEP-2281 Signed-off-by: Chunlin Han <chunlin.han@linaro.org>
2017-07-07 20:29:30 +08:00
/* find a partition that matches the given start and size */
for (p_idx = 0; p_idx < max_partitions; p_idx++) {
if (domain->partitions[p_idx].start == part->start &&
domain->partitions[p_idx].size == part->size) {
break;
}
}
kernel: mem_domain: add/remove partition funcs to return errors This changes both k_mem_domain_add_partition() and k_mem_domain_remove_partition() to return errors instead of asserting when errors are encountered. This gives the application chance to recover. The arch_mem_domain_parition_add()/_remove() will be modified later together with all the other arch_mem_domain_*() changes since the architecture code for partition addition and removal functions usually cannot be separately changed. Signed-off-by: Daniel Leung <daniel.leung@intel.com>
2021-11-11 03:11:00 +08:00
CHECKIF(!(p_idx < max_partitions)) {
LOG_ERR("no matching partition found");
ret = -ENOENT;
goto unlock_out;
}
kernel: add memory domain APIs Add the following application-facing memory domain APIs: k_mem_domain_init() - to initialize a memory domain k_mem_domain_destroy() - to destroy a memory domain k_mem_domain_add_partition() - to add a partition into a domain k_mem_domain_remove_partition() - to remove a partition from a domain k_mem_domain_add_thread() - to add a thread into a domain k_mem_domain_remove_thread() - to remove a thread from a domain A memory domain would contain some number of memory partitions. A memory partition is a memory region (might be RAM, peripheral registers, flash...) with specific attributes (access permission, e.g. privileged read/write, unprivileged read-only, execute never...). Memory partitions would be defined by set of MPU regions or MMU tables underneath. A thread could only belong to a single memory domain any point in time but a memory domain could contain multiple threads. Threads in the same memory domain would have the same access permission to the memory partitions belong to the memory domain. The memory domain APIs are used by unprivileged threads to share data to the threads in the same memory and protect sensitive data from threads outside their domain. It is not only for improving the security but also useful for debugging (unexpected access would cause exception). Jira: ZEP-2281 Signed-off-by: Chunlin Han <chunlin.han@linaro.org>
2017-07-07 20:29:30 +08:00
userspace: add debug logs to mem domain code Useful when debugging stuff. Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2020-08-26 07:47:44 +08:00
LOG_DBG("remove partition base %lx size %zu from domain %p\n",
part->start, part->size, domain);
kernel: add CONFIG_ARCH_MEM_DOMAIN_SYNCHRONOUS_API Saves us a few bytes of program text on arches that don't need these implemented, currently all uniprocessor MPU-based systems. Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2020-08-26 08:02:38 +08:00
#ifdef CONFIG_ARCH_MEM_DOMAIN_SYNCHRONOUS_API
kernel: mem_domain: k_mem_domain_add_thread to return errors This updates k_mem_domain_add_thread() to return errors so the application has a chance to recover. Signed-off-by: Daniel Leung <daniel.leung@intel.com>
2021-11-13 08:10:10 +08:00
ret = arch_mem_domain_partition_remove(domain, p_idx);
kernel: add closing comments to config endifs Add a closing comment to the endif with the configuration information to which the endif belongs too. To make the code more clearer if the configs need adaptions. Signed-off-by: Simon Hein <Shein@baumer.com>
2024-03-08 19:00:10 +08:00
#endif /* CONFIG_ARCH_MEM_DOMAIN_SYNCHRONOUS_API */
kernel: Arch specific memory domain APIs added Added arch specific calls to handle memory domain destroy and removal of partition. GH-3852 Signed-off-by: Adithya Baglody <adithya.nagaraj.baglody@intel.com>
2017-10-09 14:07:31 +08:00
kernel: mem_domain: remove redundant clearing of mem_partition fields When a memory partition is removed, it is not required to clear the start and attr fields, since a free partition is only indicated by a zero size field. This commit removes the un-necessary clearing of start and attr fields. Signed-off-by: Ioannis Glaropoulos <Ioannis.Glaropoulos@nordicsemi.no>
2018-12-03 21:21:54 +08:00
/* A zero-sized partition denotes it's a free partition */
all: Add 'U' suffix when using unsigned variables Add a 'U' suffix to values when computing and comparing against unsigned variables. Signed-off-by: Patrik Flykt <patrik.flykt@intel.com>
2019-03-27 09:57:45 +08:00
domain->partitions[p_idx].size = 0U;
kernel: add memory domain APIs Add the following application-facing memory domain APIs: k_mem_domain_init() - to initialize a memory domain k_mem_domain_destroy() - to destroy a memory domain k_mem_domain_add_partition() - to add a partition into a domain k_mem_domain_remove_partition() - to remove a partition from a domain k_mem_domain_add_thread() - to add a thread into a domain k_mem_domain_remove_thread() - to remove a thread from a domain A memory domain would contain some number of memory partitions. A memory partition is a memory region (might be RAM, peripheral registers, flash...) with specific attributes (access permission, e.g. privileged read/write, unprivileged read-only, execute never...). Memory partitions would be defined by set of MPU regions or MMU tables underneath. A thread could only belong to a single memory domain any point in time but a memory domain could contain multiple threads. Threads in the same memory domain would have the same access permission to the memory partitions belong to the memory domain. The memory domain APIs are used by unprivileged threads to share data to the threads in the same memory and protect sensitive data from threads outside their domain. It is not only for improving the security but also useful for debugging (unexpected access would cause exception). Jira: ZEP-2281 Signed-off-by: Chunlin Han <chunlin.han@linaro.org>
2017-07-07 20:29:30 +08:00
domain->num_partitions--;
kernel: mem_domain: add/remove partition funcs to return errors This changes both k_mem_domain_add_partition() and k_mem_domain_remove_partition() to return errors instead of asserting when errors are encountered. This gives the application chance to recover. The arch_mem_domain_parition_add()/_remove() will be modified later together with all the other arch_mem_domain_*() changes since the architecture code for partition addition and removal functions usually cannot be separately changed. Signed-off-by: Daniel Leung <daniel.leung@intel.com>
2021-11-11 03:11:00 +08:00
unlock_out:
userspace: make mem domain lock non-static Strictly speaking, any access to a mem domain or its containing partitions should be serialized on this lock. Architecture code may need to grab this lock if it is using this data during, for example, context switches, especially if they support SMP as locking interrupts is not enough. Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2020-10-07 06:53:43 +08:00
k_spin_unlock(&z_mem_domain_lock, key);
kernel: mem_domain: add/remove partition funcs to return errors This changes both k_mem_domain_add_partition() and k_mem_domain_remove_partition() to return errors instead of asserting when errors are encountered. This gives the application chance to recover. The arch_mem_domain_parition_add()/_remove() will be modified later together with all the other arch_mem_domain_*() changes since the architecture code for partition addition and removal functions usually cannot be separately changed. Signed-off-by: Daniel Leung <daniel.leung@intel.com>
2021-11-11 03:11:00 +08:00
out:
return ret;
kernel: add memory domain APIs Add the following application-facing memory domain APIs: k_mem_domain_init() - to initialize a memory domain k_mem_domain_destroy() - to destroy a memory domain k_mem_domain_add_partition() - to add a partition into a domain k_mem_domain_remove_partition() - to remove a partition from a domain k_mem_domain_add_thread() - to add a thread into a domain k_mem_domain_remove_thread() - to remove a thread from a domain A memory domain would contain some number of memory partitions. A memory partition is a memory region (might be RAM, peripheral registers, flash...) with specific attributes (access permission, e.g. privileged read/write, unprivileged read-only, execute never...). Memory partitions would be defined by set of MPU regions or MMU tables underneath. A thread could only belong to a single memory domain any point in time but a memory domain could contain multiple threads. Threads in the same memory domain would have the same access permission to the memory partitions belong to the memory domain. The memory domain APIs are used by unprivileged threads to share data to the threads in the same memory and protect sensitive data from threads outside their domain. It is not only for improving the security but also useful for debugging (unexpected access would cause exception). Jira: ZEP-2281 Signed-off-by: Chunlin Han <chunlin.han@linaro.org>
2017-07-07 20:29:30 +08:00
}
kernel: mem_domain: k_mem_domain_add_thread to return errors This updates k_mem_domain_add_thread() to return errors so the application has a chance to recover. Signed-off-by: Daniel Leung <daniel.leung@intel.com>
2021-11-13 08:10:10 +08:00
static int add_thread_locked(struct k_mem_domain *domain,
k_tid_t thread)
kernel: add memory domain APIs Add the following application-facing memory domain APIs: k_mem_domain_init() - to initialize a memory domain k_mem_domain_destroy() - to destroy a memory domain k_mem_domain_add_partition() - to add a partition into a domain k_mem_domain_remove_partition() - to remove a partition from a domain k_mem_domain_add_thread() - to add a thread into a domain k_mem_domain_remove_thread() - to remove a thread from a domain A memory domain would contain some number of memory partitions. A memory partition is a memory region (might be RAM, peripheral registers, flash...) with specific attributes (access permission, e.g. privileged read/write, unprivileged read-only, execute never...). Memory partitions would be defined by set of MPU regions or MMU tables underneath. A thread could only belong to a single memory domain any point in time but a memory domain could contain multiple threads. Threads in the same memory domain would have the same access permission to the memory partitions belong to the memory domain. The memory domain APIs are used by unprivileged threads to share data to the threads in the same memory and protect sensitive data from threads outside their domain. It is not only for improving the security but also useful for debugging (unexpected access would cause exception). Jira: ZEP-2281 Signed-off-by: Chunlin Han <chunlin.han@linaro.org>
2017-07-07 20:29:30 +08:00
{
kernel: mem_domain: k_mem_domain_add_thread to return errors This updates k_mem_domain_add_thread() to return errors so the application has a chance to recover. Signed-off-by: Daniel Leung <daniel.leung@intel.com>
2021-11-13 08:10:10 +08:00
int ret = 0;
userspace: cleanup mem domain assertions The memory domain APIs document that overlapping regions are not allowed, check for this unconditionally. Cleanup assertion error messages. Use __ASSERT_NO_MSG for blindingly obvious NULL checks. We now have a `check_add_partition()` function to perform all the necessary sanity checks on adding a partition to a domain. This returns true or false, which will help later when we implement #24609 Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2020-08-20 06:06:37 +08:00
__ASSERT_NO_MSG(domain != NULL);
__ASSERT_NO_MSG(thread != NULL);
kernel: add memory domain APIs Add the following application-facing memory domain APIs: k_mem_domain_init() - to initialize a memory domain k_mem_domain_destroy() - to destroy a memory domain k_mem_domain_add_partition() - to add a partition into a domain k_mem_domain_remove_partition() - to remove a partition from a domain k_mem_domain_add_thread() - to add a thread into a domain k_mem_domain_remove_thread() - to remove a thread from a domain A memory domain would contain some number of memory partitions. A memory partition is a memory region (might be RAM, peripheral registers, flash...) with specific attributes (access permission, e.g. privileged read/write, unprivileged read-only, execute never...). Memory partitions would be defined by set of MPU regions or MMU tables underneath. A thread could only belong to a single memory domain any point in time but a memory domain could contain multiple threads. Threads in the same memory domain would have the same access permission to the memory partitions belong to the memory domain. The memory domain APIs are used by unprivileged threads to share data to the threads in the same memory and protect sensitive data from threads outside their domain. It is not only for improving the security but also useful for debugging (unexpected access would cause exception). Jira: ZEP-2281 Signed-off-by: Chunlin Han <chunlin.han@linaro.org>
2017-07-07 20:29:30 +08:00
userspace: add debug logs to mem domain code Useful when debugging stuff. Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2020-08-26 07:47:44 +08:00
LOG_DBG("add thread %p to domain %p\n", thread, domain);
kernel: add memory domain APIs Add the following application-facing memory domain APIs: k_mem_domain_init() - to initialize a memory domain k_mem_domain_destroy() - to destroy a memory domain k_mem_domain_add_partition() - to add a partition into a domain k_mem_domain_remove_partition() - to remove a partition from a domain k_mem_domain_add_thread() - to add a thread into a domain k_mem_domain_remove_thread() - to remove a thread from a domain A memory domain would contain some number of memory partitions. A memory partition is a memory region (might be RAM, peripheral registers, flash...) with specific attributes (access permission, e.g. privileged read/write, unprivileged read-only, execute never...). Memory partitions would be defined by set of MPU regions or MMU tables underneath. A thread could only belong to a single memory domain any point in time but a memory domain could contain multiple threads. Threads in the same memory domain would have the same access permission to the memory partitions belong to the memory domain. The memory domain APIs are used by unprivileged threads to share data to the threads in the same memory and protect sensitive data from threads outside their domain. It is not only for improving the security but also useful for debugging (unexpected access would cause exception). Jira: ZEP-2281 Signed-off-by: Chunlin Han <chunlin.han@linaro.org>
2017-07-07 20:29:30 +08:00
sys_dlist_append(&domain->mem_domain_q,
&thread->mem_domain_info.mem_domain_q_node);
thread->mem_domain_info.mem_domain = domain;
kernel: add CONFIG_ARCH_MEM_DOMAIN_SYNCHRONOUS_API Saves us a few bytes of program text on arches that don't need these implemented, currently all uniprocessor MPU-based systems. Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2020-08-26 08:02:38 +08:00
#ifdef CONFIG_ARCH_MEM_DOMAIN_SYNCHRONOUS_API
kernel: mem_domain: k_mem_domain_add_thread to return errors This updates k_mem_domain_add_thread() to return errors so the application has a chance to recover. Signed-off-by: Daniel Leung <daniel.leung@intel.com>
2021-11-13 08:10:10 +08:00
ret = arch_mem_domain_thread_add(thread);
kernel: add closing comments to config endifs Add a closing comment to the endif with the configuration information to which the endif belongs too. To make the code more clearer if the configs need adaptions. Signed-off-by: Simon Hein <Shein@baumer.com>
2024-03-08 19:00:10 +08:00
#endif /* CONFIG_ARCH_MEM_DOMAIN_SYNCHRONOUS_API */
kernel: mem_domain: k_mem_domain_add_thread to return errors This updates k_mem_domain_add_thread() to return errors so the application has a chance to recover. Signed-off-by: Daniel Leung <daniel.leung@intel.com>
2021-11-13 08:10:10 +08:00
return ret;
userspace: remove threads from domain on abort When threads exited we were leaving dangling references to them in the domain's mem_domain_q. z_thread_single_abort() now calls into the memory domain code via z_mem_domain_exit_thread() to take it off. The thread setup code now invokes z_mem_domain_init_thread(), avoiding extra checks in k_mem_domain_add_thread(), we know the object isn't currently a member of a doamin. Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2020-10-07 04:39:29 +08:00
}
kernel: mem_domain: k_mem_domain_add_thread to return errors This updates k_mem_domain_add_thread() to return errors so the application has a chance to recover. Signed-off-by: Daniel Leung <daniel.leung@intel.com>
2021-11-13 08:10:10 +08:00
static int remove_thread_locked(struct k_thread *thread)
userspace: remove threads from domain on abort When threads exited we were leaving dangling references to them in the domain's mem_domain_q. z_thread_single_abort() now calls into the memory domain code via z_mem_domain_exit_thread() to take it off. The thread setup code now invokes z_mem_domain_init_thread(), avoiding extra checks in k_mem_domain_add_thread(), we know the object isn't currently a member of a doamin. Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2020-10-07 04:39:29 +08:00
{
kernel: mem_domain: k_mem_domain_add_thread to return errors This updates k_mem_domain_add_thread() to return errors so the application has a chance to recover. Signed-off-by: Daniel Leung <daniel.leung@intel.com>
2021-11-13 08:10:10 +08:00
int ret = 0;
userspace: remove threads from domain on abort When threads exited we were leaving dangling references to them in the domain's mem_domain_q. z_thread_single_abort() now calls into the memory domain code via z_mem_domain_exit_thread() to take it off. The thread setup code now invokes z_mem_domain_init_thread(), avoiding extra checks in k_mem_domain_add_thread(), we know the object isn't currently a member of a doamin. Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2020-10-07 04:39:29 +08:00
__ASSERT_NO_MSG(thread != NULL);
LOG_DBG("remove thread %p from memory domain %p\n",
thread, thread->mem_domain_info.mem_domain);
sys_dlist_remove(&thread->mem_domain_info.mem_domain_q_node);
kernel: mem_domain: Add to current thread should configure immediately. when a current thread is added to a memory domain the pages/sections must be configured immediately. A problem occurs when we add a thread to current and then drop down to usermode. In such a case memory domain will become active the next time a swap occurs. Signed-off-by: Adithya Baglody <adithya.nagaraj.baglody@intel.com>
2017-12-06 19:18:28 +08:00
userspace: remove threads from domain on abort When threads exited we were leaving dangling references to them in the domain's mem_domain_q. z_thread_single_abort() now calls into the memory domain code via z_mem_domain_exit_thread() to take it off. The thread setup code now invokes z_mem_domain_init_thread(), avoiding extra checks in k_mem_domain_add_thread(), we know the object isn't currently a member of a doamin. Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2020-10-07 04:39:29 +08:00
#ifdef CONFIG_ARCH_MEM_DOMAIN_SYNCHRONOUS_API
kernel: mem_domain: k_mem_domain_add_thread to return errors This updates k_mem_domain_add_thread() to return errors so the application has a chance to recover. Signed-off-by: Daniel Leung <daniel.leung@intel.com>
2021-11-13 08:10:10 +08:00
ret = arch_mem_domain_thread_remove(thread);
kernel: add closing comments to config endifs Add a closing comment to the endif with the configuration information to which the endif belongs too. To make the code more clearer if the configs need adaptions. Signed-off-by: Simon Hein <Shein@baumer.com>
2024-03-08 19:00:10 +08:00
#endif /* CONFIG_ARCH_MEM_DOMAIN_SYNCHRONOUS_API */
kernel: mem_domain: k_mem_domain_add_thread to return errors This updates k_mem_domain_add_thread() to return errors so the application has a chance to recover. Signed-off-by: Daniel Leung <daniel.leung@intel.com>
2021-11-13 08:10:10 +08:00
return ret;
userspace: remove threads from domain on abort When threads exited we were leaving dangling references to them in the domain's mem_domain_q. z_thread_single_abort() now calls into the memory domain code via z_mem_domain_exit_thread() to take it off. The thread setup code now invokes z_mem_domain_init_thread(), avoiding extra checks in k_mem_domain_add_thread(), we know the object isn't currently a member of a doamin. Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2020-10-07 04:39:29 +08:00
}
/* Called from thread object initialization */
void z_mem_domain_init_thread(struct k_thread *thread)
{
kernel: mem_domain: k_mem_domain_add_thread to return errors This updates k_mem_domain_add_thread() to return errors so the application has a chance to recover. Signed-off-by: Daniel Leung <daniel.leung@intel.com>
2021-11-13 08:10:10 +08:00
int ret;
userspace: make mem domain lock non-static Strictly speaking, any access to a mem domain or its containing partitions should be serialized on this lock. Architecture code may need to grab this lock if it is using this data during, for example, context switches, especially if they support SMP as locking interrupts is not enough. Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2020-10-07 06:53:43 +08:00
k_spinlock_key_t key = k_spin_lock(&z_mem_domain_lock);
userspace: remove threads from domain on abort When threads exited we were leaving dangling references to them in the domain's mem_domain_q. z_thread_single_abort() now calls into the memory domain code via z_mem_domain_exit_thread() to take it off. The thread setup code now invokes z_mem_domain_init_thread(), avoiding extra checks in k_mem_domain_add_thread(), we know the object isn't currently a member of a doamin. Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2020-10-07 04:39:29 +08:00
/* New threads inherit memory domain configuration from parent */
kernel: mem_domain: k_mem_domain_add_thread to return errors This updates k_mem_domain_add_thread() to return errors so the application has a chance to recover. Signed-off-by: Daniel Leung <daniel.leung@intel.com>
2021-11-13 08:10:10 +08:00
ret = add_thread_locked(_current->mem_domain_info.mem_domain, thread);
__ASSERT_NO_MSG(ret == 0);
ARG_UNUSED(ret);
userspace: make mem domain lock non-static Strictly speaking, any access to a mem domain or its containing partitions should be serialized on this lock. Architecture code may need to grab this lock if it is using this data during, for example, context switches, especially if they support SMP as locking interrupts is not enough. Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2020-10-07 06:53:43 +08:00
k_spin_unlock(&z_mem_domain_lock, key);
userspace: remove threads from domain on abort When threads exited we were leaving dangling references to them in the domain's mem_domain_q. z_thread_single_abort() now calls into the memory domain code via z_mem_domain_exit_thread() to take it off. The thread setup code now invokes z_mem_domain_init_thread(), avoiding extra checks in k_mem_domain_add_thread(), we know the object isn't currently a member of a doamin. Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2020-10-07 04:39:29 +08:00
}
kernel: rename scheduler spinlock variable and make it private rename sched_spinlock to _sched_spinglock to maintain it is privacy and to avoid any misuse. Signed-off-by: Anas Nashif <anas.nashif@intel.com>
2024-03-07 04:59:36 +08:00
/* Called when thread aborts during teardown tasks. _sched_spinlock is held */
userspace: remove threads from domain on abort When threads exited we were leaving dangling references to them in the domain's mem_domain_q. z_thread_single_abort() now calls into the memory domain code via z_mem_domain_exit_thread() to take it off. The thread setup code now invokes z_mem_domain_init_thread(), avoiding extra checks in k_mem_domain_add_thread(), we know the object isn't currently a member of a doamin. Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2020-10-07 04:39:29 +08:00
void z_mem_domain_exit_thread(struct k_thread *thread)
{
kernel: mem_domain: k_mem_domain_add_thread to return errors This updates k_mem_domain_add_thread() to return errors so the application has a chance to recover. Signed-off-by: Daniel Leung <daniel.leung@intel.com>
2021-11-13 08:10:10 +08:00
int ret;
userspace: make mem domain lock non-static Strictly speaking, any access to a mem domain or its containing partitions should be serialized on this lock. Architecture code may need to grab this lock if it is using this data during, for example, context switches, especially if they support SMP as locking interrupts is not enough. Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2020-10-07 06:53:43 +08:00
k_spinlock_key_t key = k_spin_lock(&z_mem_domain_lock);
kernel: mem_domain: k_mem_domain_add_thread to return errors This updates k_mem_domain_add_thread() to return errors so the application has a chance to recover. Signed-off-by: Daniel Leung <daniel.leung@intel.com>
2021-11-13 08:10:10 +08:00
ret = remove_thread_locked(thread);
__ASSERT_NO_MSG(ret == 0);
ARG_UNUSED(ret);
userspace: make mem domain lock non-static Strictly speaking, any access to a mem domain or its containing partitions should be serialized on this lock. Architecture code may need to grab this lock if it is using this data during, for example, context switches, especially if they support SMP as locking interrupts is not enough. Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2020-10-07 06:53:43 +08:00
k_spin_unlock(&z_mem_domain_lock, key);
userspace: remove threads from domain on abort When threads exited we were leaving dangling references to them in the domain's mem_domain_q. z_thread_single_abort() now calls into the memory domain code via z_mem_domain_exit_thread() to take it off. The thread setup code now invokes z_mem_domain_init_thread(), avoiding extra checks in k_mem_domain_add_thread(), we know the object isn't currently a member of a doamin. Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2020-10-07 04:39:29 +08:00
}
kernel: mem_domain: k_mem_domain_add_thread to return errors This updates k_mem_domain_add_thread() to return errors so the application has a chance to recover. Signed-off-by: Daniel Leung <daniel.leung@intel.com>
2021-11-13 08:10:10 +08:00
int k_mem_domain_add_thread(struct k_mem_domain *domain, k_tid_t thread)
userspace: remove threads from domain on abort When threads exited we were leaving dangling references to them in the domain's mem_domain_q. z_thread_single_abort() now calls into the memory domain code via z_mem_domain_exit_thread() to take it off. The thread setup code now invokes z_mem_domain_init_thread(), avoiding extra checks in k_mem_domain_add_thread(), we know the object isn't currently a member of a doamin. Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2020-10-07 04:39:29 +08:00
{
kernel: mem_domain: k_mem_domain_add_thread to return errors This updates k_mem_domain_add_thread() to return errors so the application has a chance to recover. Signed-off-by: Daniel Leung <daniel.leung@intel.com>
2021-11-13 08:10:10 +08:00
int ret = 0;
userspace: remove threads from domain on abort When threads exited we were leaving dangling references to them in the domain's mem_domain_q. z_thread_single_abort() now calls into the memory domain code via z_mem_domain_exit_thread() to take it off. The thread setup code now invokes z_mem_domain_init_thread(), avoiding extra checks in k_mem_domain_add_thread(), we know the object isn't currently a member of a doamin. Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2020-10-07 04:39:29 +08:00
k_spinlock_key_t key;
userspace: make mem domain lock non-static Strictly speaking, any access to a mem domain or its containing partitions should be serialized on this lock. Architecture code may need to grab this lock if it is using this data during, for example, context switches, especially if they support SMP as locking interrupts is not enough. Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2020-10-07 06:53:43 +08:00
key = k_spin_lock(&z_mem_domain_lock);
userspace: do nothing if added to same domain If we call k_mem_domain_add_thread() to a memory domain the thread already belongs to, do nothing. Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2020-10-21 04:26:19 +08:00
if (thread->mem_domain_info.mem_domain != domain) {
kernel: mem_domain: k_mem_domain_add_thread to return errors This updates k_mem_domain_add_thread() to return errors so the application has a chance to recover. Signed-off-by: Daniel Leung <daniel.leung@intel.com>
2021-11-13 08:10:10 +08:00
ret = remove_thread_locked(thread);
if (ret == 0) {
ret = add_thread_locked(domain, thread);
}
userspace: do nothing if added to same domain If we call k_mem_domain_add_thread() to a memory domain the thread already belongs to, do nothing. Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2020-10-21 04:26:19 +08:00
}
userspace: make mem domain lock non-static Strictly speaking, any access to a mem domain or its containing partitions should be serialized on this lock. Architecture code may need to grab this lock if it is using this data during, for example, context switches, especially if they support SMP as locking interrupts is not enough. Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2020-10-07 06:53:43 +08:00
k_spin_unlock(&z_mem_domain_lock, key);
kernel: mem_domain: k_mem_domain_add_thread to return errors This updates k_mem_domain_add_thread() to return errors so the application has a chance to recover. Signed-off-by: Daniel Leung <daniel.leung@intel.com>
2021-11-13 08:10:10 +08:00
return ret;
kernel: add memory domain APIs Add the following application-facing memory domain APIs: k_mem_domain_init() - to initialize a memory domain k_mem_domain_destroy() - to destroy a memory domain k_mem_domain_add_partition() - to add a partition into a domain k_mem_domain_remove_partition() - to remove a partition from a domain k_mem_domain_add_thread() - to add a thread into a domain k_mem_domain_remove_thread() - to remove a thread from a domain A memory domain would contain some number of memory partitions. A memory partition is a memory region (might be RAM, peripheral registers, flash...) with specific attributes (access permission, e.g. privileged read/write, unprivileged read-only, execute never...). Memory partitions would be defined by set of MPU regions or MMU tables underneath. A thread could only belong to a single memory domain any point in time but a memory domain could contain multiple threads. Threads in the same memory domain would have the same access permission to the memory partitions belong to the memory domain. The memory domain APIs are used by unprivileged threads to share data to the threads in the same memory and protect sensitive data from threads outside their domain. It is not only for improving the security but also useful for debugging (unexpected access would cause exception). Jira: ZEP-2281 Signed-off-by: Chunlin Han <chunlin.han@linaro.org>
2017-07-07 20:29:30 +08:00
}
init: remove the need for a dummy device pointer in SYS_INIT functions The init infrastructure, found in `init.h`, is currently used by: - `SYS_INIT`: to call functions before `main` - `DEVICE_*`: to initialize devices They are all sorted according to an initialization level + a priority. `SYS_INIT` calls are really orthogonal to devices, however, the required function signature requires a `const struct device *dev` as a first argument. The only reason for that is because the same init machinery is used by devices, so we have something like: ```c struct init_entry { int (*init)(const struct device *dev); /* only set by DEVICE_*, otherwise NULL */ const struct device *dev; } ``` As a result, we end up with such weird/ugly pattern: ```c static int my_init(const struct device *dev) { /* always NULL! add ARG_UNUSED to avoid compiler warning */ ARG_UNUSED(dev); ... } ``` This is really a result of poor internals isolation. This patch proposes a to make init entries more flexible so that they can accept sytem initialization calls like this: ```c static int my_init(void) { ... } ``` This is achieved using a union: ```c union init_function { /* for SYS_INIT, used when init_entry.dev == NULL */ int (*sys)(void); /* for DEVICE*, used when init_entry.dev != NULL */ int (*dev)(const struct device *dev); }; struct init_entry { /* stores init function (either for SYS_INIT or DEVICE*) union init_function init_fn; /* stores device pointer for DEVICE*, NULL for SYS_INIT. Allows * to know which union entry to call. */ const struct device *dev; } ``` This solution **does not increase ROM usage**, and allows to offer clean public APIs for both SYS_INIT and DEVICE*. Note that however, init machinery keeps a coupling with devices. **NOTE**: This is a breaking change! All `SYS_INIT` functions will need to be converted to the new signature. See the script offered in the following commit. Signed-off-by: Gerard Marull-Paretas <gerard.marull@nordicsemi.no> init: convert SYS_INIT functions to the new signature Conversion scripted using scripts/utils/migrate_sys_init.py. Signed-off-by: Gerard Marull-Paretas <gerard.marull@nordicsemi.no> manifest: update projects for SYS_INIT changes Update modules with updated SYS_INIT calls: - hal_ti - lvgl - sof - TraceRecorderSource Signed-off-by: Gerard Marull-Paretas <gerard.marull@nordicsemi.no> tests: devicetree: devices: adjust test Adjust test according to the recently introduced SYS_INIT infrastructure. Signed-off-by: Gerard Marull-Paretas <gerard.marull@nordicsemi.no> tests: kernel: threads: adjust SYS_INIT call Adjust to the new signature: int (*init_fn)(void); Signed-off-by: Gerard Marull-Paretas <gerard.marull@nordicsemi.no>
2022-10-19 15:33:44 +08:00
static int init_mem_domain_module(void)
kernel: add memory domain APIs Add the following application-facing memory domain APIs: k_mem_domain_init() - to initialize a memory domain k_mem_domain_destroy() - to destroy a memory domain k_mem_domain_add_partition() - to add a partition into a domain k_mem_domain_remove_partition() - to remove a partition from a domain k_mem_domain_add_thread() - to add a thread into a domain k_mem_domain_remove_thread() - to remove a thread from a domain A memory domain would contain some number of memory partitions. A memory partition is a memory region (might be RAM, peripheral registers, flash...) with specific attributes (access permission, e.g. privileged read/write, unprivileged read-only, execute never...). Memory partitions would be defined by set of MPU regions or MMU tables underneath. A thread could only belong to a single memory domain any point in time but a memory domain could contain multiple threads. Threads in the same memory domain would have the same access permission to the memory partitions belong to the memory domain. The memory domain APIs are used by unprivileged threads to share data to the threads in the same memory and protect sensitive data from threads outside their domain. It is not only for improving the security but also useful for debugging (unexpected access would cause exception). Jira: ZEP-2281 Signed-off-by: Chunlin Han <chunlin.han@linaro.org>
2017-07-07 20:29:30 +08:00
{
kernel: mem_domain: init function to return error values This changes k_mem_domain_init() to return error values instead of asserting when errors are encountered. This gives applications a chance to recover if needed. Signed-off-by: Daniel Leung <daniel.leung@intel.com>
2021-11-12 04:49:58 +08:00
int ret;
ARG_UNUSED(ret);
kernel: add memory domain APIs Add the following application-facing memory domain APIs: k_mem_domain_init() - to initialize a memory domain k_mem_domain_destroy() - to destroy a memory domain k_mem_domain_add_partition() - to add a partition into a domain k_mem_domain_remove_partition() - to remove a partition from a domain k_mem_domain_add_thread() - to add a thread into a domain k_mem_domain_remove_thread() - to remove a thread from a domain A memory domain would contain some number of memory partitions. A memory partition is a memory region (might be RAM, peripheral registers, flash...) with specific attributes (access permission, e.g. privileged read/write, unprivileged read-only, execute never...). Memory partitions would be defined by set of MPU regions or MMU tables underneath. A thread could only belong to a single memory domain any point in time but a memory domain could contain multiple threads. Threads in the same memory domain would have the same access permission to the memory partitions belong to the memory domain. The memory domain APIs are used by unprivileged threads to share data to the threads in the same memory and protect sensitive data from threads outside their domain. It is not only for improving the security but also useful for debugging (unexpected access would cause exception). Jira: ZEP-2281 Signed-off-by: Chunlin Han <chunlin.han@linaro.org>
2017-07-07 20:29:30 +08:00
kernel: rename z_arch_ to arch_ Promote the private z_arch_* namespace, which specifies the interface between the core kernel and the architecture code, to a new top-level namespace named arch_*. This allows our documentation generation to create online documentation for this set of interfaces, and this set of interfaces is worth treating in a more formal way anyway. Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2019-11-08 04:43:29 +08:00
max_partitions = arch_mem_domain_max_partitions_get();
kernel: add memory domain APIs Add the following application-facing memory domain APIs: k_mem_domain_init() - to initialize a memory domain k_mem_domain_destroy() - to destroy a memory domain k_mem_domain_add_partition() - to add a partition into a domain k_mem_domain_remove_partition() - to remove a partition from a domain k_mem_domain_add_thread() - to add a thread into a domain k_mem_domain_remove_thread() - to remove a thread from a domain A memory domain would contain some number of memory partitions. A memory partition is a memory region (might be RAM, peripheral registers, flash...) with specific attributes (access permission, e.g. privileged read/write, unprivileged read-only, execute never...). Memory partitions would be defined by set of MPU regions or MMU tables underneath. A thread could only belong to a single memory domain any point in time but a memory domain could contain multiple threads. Threads in the same memory domain would have the same access permission to the memory partitions belong to the memory domain. The memory domain APIs are used by unprivileged threads to share data to the threads in the same memory and protect sensitive data from threads outside their domain. It is not only for improving the security but also useful for debugging (unexpected access would cause exception). Jira: ZEP-2281 Signed-off-by: Chunlin Han <chunlin.han@linaro.org>
2017-07-07 20:29:30 +08:00
/*
* max_partitions must be less than or equal to
* CONFIG_MAX_DOMAIN_PARTITIONS, or would encounter array index
* out of bounds error.
*/
__ASSERT(max_partitions <= CONFIG_MAX_DOMAIN_PARTITIONS, "");
kernel: mem_domain: init function to return error values This changes k_mem_domain_init() to return error values instead of asserting when errors are encountered. This gives applications a chance to recover if needed. Signed-off-by: Daniel Leung <daniel.leung@intel.com>
2021-11-12 04:49:58 +08:00
ret = k_mem_domain_init(&k_mem_domain_default, 0, NULL);
__ASSERT(ret == 0, "failed to init default mem domain");
userspace: introduce default memory domain We make a policy change here: all threads are members of a memory domain, never NULL. We introduce a default memory domain for threads that haven't been assigned to or inherited another one. Primary motivation for this change is better MMU support, as one common configuration will be to maintain page tables at the memory domain level. Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2020-08-26 05:42:33 +08:00
#ifdef Z_LIBC_PARTITION_EXISTS
kernel: mem_domain: add/remove partition funcs to return errors This changes both k_mem_domain_add_partition() and k_mem_domain_remove_partition() to return errors instead of asserting when errors are encountered. This gives the application chance to recover. The arch_mem_domain_parition_add()/_remove() will be modified later together with all the other arch_mem_domain_*() changes since the architecture code for partition addition and removal functions usually cannot be separately changed. Signed-off-by: Daniel Leung <daniel.leung@intel.com>
2021-11-11 03:11:00 +08:00
ret = k_mem_domain_add_partition(&k_mem_domain_default,
&z_libc_partition);
__ASSERT(ret == 0, "failed to add default libc mem partition");
userspace: introduce default memory domain We make a policy change here: all threads are members of a memory domain, never NULL. We introduce a default memory domain for threads that haven't been assigned to or inherited another one. Primary motivation for this change is better MMU support, as one common configuration will be to maintain page tables at the memory domain level. Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2020-08-26 05:42:33 +08:00
#endif /* Z_LIBC_PARTITION_EXISTS */
kernel: add memory domain APIs Add the following application-facing memory domain APIs: k_mem_domain_init() - to initialize a memory domain k_mem_domain_destroy() - to destroy a memory domain k_mem_domain_add_partition() - to add a partition into a domain k_mem_domain_remove_partition() - to remove a partition from a domain k_mem_domain_add_thread() - to add a thread into a domain k_mem_domain_remove_thread() - to remove a thread from a domain A memory domain would contain some number of memory partitions. A memory partition is a memory region (might be RAM, peripheral registers, flash...) with specific attributes (access permission, e.g. privileged read/write, unprivileged read-only, execute never...). Memory partitions would be defined by set of MPU regions or MMU tables underneath. A thread could only belong to a single memory domain any point in time but a memory domain could contain multiple threads. Threads in the same memory domain would have the same access permission to the memory partitions belong to the memory domain. The memory domain APIs are used by unprivileged threads to share data to the threads in the same memory and protect sensitive data from threads outside their domain. It is not only for improving the security but also useful for debugging (unexpected access would cause exception). Jira: ZEP-2281 Signed-off-by: Chunlin Han <chunlin.han@linaro.org>
2017-07-07 20:29:30 +08:00
return 0;
}
SYS_INIT(init_mem_domain_module, PRE_KERNEL_1,
CONFIG_KERNEL_INIT_PRIORITY_DEFAULT);