OrgZephyr/zephyr
OrgZephyr
/
zephyr
mirror of https://github.com/zephyrproject-rtos/zephyr.git
1
0
Fork 0
Code Issues Releases Wiki Activity
zephyr/kernel/mem_domain.c

325 lines
8.1 KiB
C
Raw Normal View History

kernel: add memory domain APIs Add the following application-facing memory domain APIs: k_mem_domain_init() - to initialize a memory domain k_mem_domain_destroy() - to destroy a memory domain k_mem_domain_add_partition() - to add a partition into a domain k_mem_domain_remove_partition() - to remove a partition from a domain k_mem_domain_add_thread() - to add a thread into a domain k_mem_domain_remove_thread() - to remove a thread from a domain A memory domain would contain some number of memory partitions. A memory partition is a memory region (might be RAM, peripheral registers, flash...) with specific attributes (access permission, e.g. privileged read/write, unprivileged read-only, execute never...). Memory partitions would be defined by set of MPU regions or MMU tables underneath. A thread could only belong to a single memory domain any point in time but a memory domain could contain multiple threads. Threads in the same memory domain would have the same access permission to the memory partitions belong to the memory domain. The memory domain APIs are used by unprivileged threads to share data to the threads in the same memory and protect sensitive data from threads outside their domain. It is not only for improving the security but also useful for debugging (unexpected access would cause exception). Jira: ZEP-2281 Signed-off-by: Chunlin Han <chunlin.han@linaro.org>
2017-07-07 20:29:30 +08:00
/*
* Copyright (c) 2017 Linaro Limited
*
* SPDX-License-Identifier: Apache-2.0
*/
#include <init.h>
#include <kernel.h>
#include <kernel_structs.h>
kernel: include: rename nano_internal.h to kernel_internal.h Rename the nano_internal.h to kernel_internal.h and modify the header file name accordingly wherever it is used. Signed-off-by: Ramakrishna Pallala <ramakrishna.pallala@intel.com>
2018-01-31 12:41:47 +08:00
#include <kernel_internal.h>
cleanup: include/: move misc/__assert.h to sys/__assert.h move misc/__assert.h to sys/__assert.h and create a shim for backward-compatibility. No functional changes to the headers. A warning in the shim can be controlled with CONFIG_COMPAT_INCLUDES. Related to #16539 Signed-off-by: Anas Nashif <anas.nashif@intel.com>
2019-06-26 22:33:39 +08:00
#include <sys/__assert.h>
kernel: Using boolean types for boolean constants Make boolean expressions use boolean types. MISRA-C rule 14.4 Signed-off-by: Flavio Ceolin <flavio.ceolin@intel.com>
2018-09-19 03:32:27 +08:00
#include <stdbool.h>
kernel/mem_domain: Spinlockify Simple locking requirements here mean we can just use a single subsystem lock. Signed-off-by: Andy Ross <andrew.j.ross@intel.com>
2018-07-25 02:35:55 +08:00
#include <spinlock.h>
userspace: introduce default memory domain We make a policy change here: all threads are members of a memory domain, never NULL. We introduce a default memory domain for threads that haven't been assigned to or inherited another one. Primary motivation for this change is better MMU support, as one common configuration will be to maintain page tables at the memory domain level. Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2020-08-26 05:42:33 +08:00
#include <sys/libc-hooks.h>
kernel: add memory domain APIs Add the following application-facing memory domain APIs: k_mem_domain_init() - to initialize a memory domain k_mem_domain_destroy() - to destroy a memory domain k_mem_domain_add_partition() - to add a partition into a domain k_mem_domain_remove_partition() - to remove a partition from a domain k_mem_domain_add_thread() - to add a thread into a domain k_mem_domain_remove_thread() - to remove a thread from a domain A memory domain would contain some number of memory partitions. A memory partition is a memory region (might be RAM, peripheral registers, flash...) with specific attributes (access permission, e.g. privileged read/write, unprivileged read-only, execute never...). Memory partitions would be defined by set of MPU regions or MMU tables underneath. A thread could only belong to a single memory domain any point in time but a memory domain could contain multiple threads. Threads in the same memory domain would have the same access permission to the memory partitions belong to the memory domain. The memory domain APIs are used by unprivileged threads to share data to the threads in the same memory and protect sensitive data from threads outside their domain. It is not only for improving the security but also useful for debugging (unexpected access would cause exception). Jira: ZEP-2281 Signed-off-by: Chunlin Han <chunlin.han@linaro.org>
2017-07-07 20:29:30 +08:00
userspace: add optional member to memory domains Some systems may need to associate arch-specific data to a memory domain. Add a Kconfig and `arch` field for this, and a new arch API to initialize it. Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2020-08-20 04:11:47 +08:00
#define LOG_LEVEL CONFIG_KERNEL_LOG_LEVEL
#include <logging/log.h>
LOG_MODULE_DECLARE(os);
userspace: make mem domain lock non-static Strictly speaking, any access to a mem domain or its containing partitions should be serialized on this lock. Architecture code may need to grab this lock if it is using this data during, for example, context switches, especially if they support SMP as locking interrupts is not enough. Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2020-10-07 06:53:43 +08:00
struct k_spinlock z_mem_domain_lock;
zephyr: replace zephyr integer types with C99 types git grep -l 'u\(8\|16\|32\|64\)_t' | \ xargs sed -i "s/u\(8\|16\|32\|64\)_t/uint\1_t/g" git grep -l 's\(8\|16\|32\|64\)_t' | \ xargs sed -i "s/s\(8\|16\|32\|64\)_t/int\1_t/g" Signed-off-by: Kumar Gala <kumar.gala@linaro.org>
2020-05-28 00:26:57 +08:00
static uint8_t max_partitions;
kernel: add memory domain APIs Add the following application-facing memory domain APIs: k_mem_domain_init() - to initialize a memory domain k_mem_domain_destroy() - to destroy a memory domain k_mem_domain_add_partition() - to add a partition into a domain k_mem_domain_remove_partition() - to remove a partition from a domain k_mem_domain_add_thread() - to add a thread into a domain k_mem_domain_remove_thread() - to remove a thread from a domain A memory domain would contain some number of memory partitions. A memory partition is a memory region (might be RAM, peripheral registers, flash...) with specific attributes (access permission, e.g. privileged read/write, unprivileged read-only, execute never...). Memory partitions would be defined by set of MPU regions or MMU tables underneath. A thread could only belong to a single memory domain any point in time but a memory domain could contain multiple threads. Threads in the same memory domain would have the same access permission to the memory partitions belong to the memory domain. The memory domain APIs are used by unprivileged threads to share data to the threads in the same memory and protect sensitive data from threads outside their domain. It is not only for improving the security but also useful for debugging (unexpected access would cause exception). Jira: ZEP-2281 Signed-off-by: Chunlin Han <chunlin.han@linaro.org>
2017-07-07 20:29:30 +08:00
userspace: introduce default memory domain We make a policy change here: all threads are members of a memory domain, never NULL. We introduce a default memory domain for threads that haven't been assigned to or inherited another one. Primary motivation for this change is better MMU support, as one common configuration will be to maintain page tables at the memory domain level. Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2020-08-26 05:42:33 +08:00
struct k_mem_domain k_mem_domain_default;
userspace: cleanup mem domain assertions The memory domain APIs document that overlapping regions are not allowed, check for this unconditionally. Cleanup assertion error messages. Use __ASSERT_NO_MSG for blindingly obvious NULL checks. We now have a `check_add_partition()` function to perform all the necessary sanity checks on adding a partition to a domain. This returns true or false, which will help later when we implement #24609 Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2020-08-20 06:06:37 +08:00
#if __ASSERT_ON
static bool check_add_partition(struct k_mem_domain *domain,
struct k_mem_partition *part)
kernel: mem_domain: Check for overlapping regions when considering W^X Multiple partitions can be added to a domain, and if they overlap, they can have different attributes. The previous check would only check for W^X for individual partitions, and this is insufficient. Overlapping partitions could have W^X attributes, but in the end, a memory region would be writable and executable. The way this is performed is quite "heavyweight", as it is implemented in a O(n^2) operation. The number of partitions per domain is small on most devices, so this isn't an issue. CONFIG_EXECUTE_XOR_WRITE is still an optional feature. Signed-off-by: Leandro Pereira <leandro.pereira@intel.com>
2018-03-01 06:11:41 +08:00
{
userspace: cleanup mem domain assertions The memory domain APIs document that overlapping regions are not allowed, check for this unconditionally. Cleanup assertion error messages. Use __ASSERT_NO_MSG for blindingly obvious NULL checks. We now have a `check_add_partition()` function to perform all the necessary sanity checks on adding a partition to a domain. This returns true or false, which will help later when we implement #24609 Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2020-08-20 06:06:37 +08:00
int i;
uintptr_t pstart, pend, dstart, dend;
if (part == NULL) {
LOG_ERR("NULL k_mem_partition provided");
return false;
}
#ifdef CONFIG_EXECUTE_XOR_WRITE
/* Arches where execution cannot be disabled should always return
* false to this check
*/
if (K_MEM_PARTITION_IS_EXECUTABLE(part->attr) &&
K_MEM_PARTITION_IS_WRITABLE(part->attr)) {
LOG_ERR("partition is writable and executable <start %lx>",
part->start);
return false;
}
#endif
if (part->size == 0) {
LOG_ERR("zero sized partition at %p with base 0x%lx",
part, part->start);
kernel: mem_domain: Check for overlapping regions when considering W^X Multiple partitions can be added to a domain, and if they overlap, they can have different attributes. The previous check would only check for W^X for individual partitions, and this is insufficient. Overlapping partitions could have W^X attributes, but in the end, a memory region would be writable and executable. The way this is performed is quite "heavyweight", as it is implemented in a O(n^2) operation. The number of partitions per domain is small on most devices, so this isn't an issue. CONFIG_EXECUTE_XOR_WRITE is still an optional feature. Signed-off-by: Leandro Pereira <leandro.pereira@intel.com>
2018-03-01 06:11:41 +08:00
return false;
}
userspace: cleanup mem domain assertions The memory domain APIs document that overlapping regions are not allowed, check for this unconditionally. Cleanup assertion error messages. Use __ASSERT_NO_MSG for blindingly obvious NULL checks. We now have a `check_add_partition()` function to perform all the necessary sanity checks on adding a partition to a domain. This returns true or false, which will help later when we implement #24609 Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2020-08-20 06:06:37 +08:00
pstart = part->start;
pend = part->start + part->size;
if (pend <= pstart) {
LOG_ERR("invalid partition %p, wraparound detected. base 0x%lx size %zu",
part, part->start, part->size);
return false;
}
kernel: mem_domain: Check for overlapping regions when considering W^X Multiple partitions can be added to a domain, and if they overlap, they can have different attributes. The previous check would only check for W^X for individual partitions, and this is insufficient. Overlapping partitions could have W^X attributes, but in the end, a memory region would be writable and executable. The way this is performed is quite "heavyweight", as it is implemented in a O(n^2) operation. The number of partitions per domain is small on most devices, so this isn't an issue. CONFIG_EXECUTE_XOR_WRITE is still an optional feature. Signed-off-by: Leandro Pereira <leandro.pereira@intel.com>
2018-03-01 06:11:41 +08:00
userspace: cleanup mem domain assertions The memory domain APIs document that overlapping regions are not allowed, check for this unconditionally. Cleanup assertion error messages. Use __ASSERT_NO_MSG for blindingly obvious NULL checks. We now have a `check_add_partition()` function to perform all the necessary sanity checks on adding a partition to a domain. This returns true or false, which will help later when we implement #24609 Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2020-08-20 06:06:37 +08:00
/* Check that this partition doesn't overlap any existing ones already
* in the domain
*/
for (i = 0; i < domain->num_partitions; i++) {
struct k_mem_partition *dpart = &domain->partitions[i];
kernel: mem_domain: Check for overlapping regions when considering W^X Multiple partitions can be added to a domain, and if they overlap, they can have different attributes. The previous check would only check for W^X for individual partitions, and this is insufficient. Overlapping partitions could have W^X attributes, but in the end, a memory region would be writable and executable. The way this is performed is quite "heavyweight", as it is implemented in a O(n^2) operation. The number of partitions per domain is small on most devices, so this isn't an issue. CONFIG_EXECUTE_XOR_WRITE is still an optional feature. Signed-off-by: Leandro Pereira <leandro.pereira@intel.com>
2018-03-01 06:11:41 +08:00
userspace: cleanup mem domain assertions The memory domain APIs document that overlapping regions are not allowed, check for this unconditionally. Cleanup assertion error messages. Use __ASSERT_NO_MSG for blindingly obvious NULL checks. We now have a `check_add_partition()` function to perform all the necessary sanity checks on adding a partition to a domain. This returns true or false, which will help later when we implement #24609 Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2020-08-20 06:06:37 +08:00
if (dpart->size == 0) {
/* Unused slot */
kernel: mem_domain: Check for overlapping regions when considering W^X Multiple partitions can be added to a domain, and if they overlap, they can have different attributes. The previous check would only check for W^X for individual partitions, and this is insufficient. Overlapping partitions could have W^X attributes, but in the end, a memory region would be writable and executable. The way this is performed is quite "heavyweight", as it is implemented in a O(n^2) operation. The number of partitions per domain is small on most devices, so this isn't an issue. CONFIG_EXECUTE_XOR_WRITE is still an optional feature. Signed-off-by: Leandro Pereira <leandro.pereira@intel.com>
2018-03-01 06:11:41 +08:00
continue;
}
userspace: cleanup mem domain assertions The memory domain APIs document that overlapping regions are not allowed, check for this unconditionally. Cleanup assertion error messages. Use __ASSERT_NO_MSG for blindingly obvious NULL checks. We now have a `check_add_partition()` function to perform all the necessary sanity checks on adding a partition to a domain. This returns true or false, which will help later when we implement #24609 Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2020-08-20 06:06:37 +08:00
dstart = dpart->start;
dend = dstart + dpart->size;
kernel: mem_domain: Check for overlapping regions when considering W^X Multiple partitions can be added to a domain, and if they overlap, they can have different attributes. The previous check would only check for W^X for individual partitions, and this is insufficient. Overlapping partitions could have W^X attributes, but in the end, a memory region would be writable and executable. The way this is performed is quite "heavyweight", as it is implemented in a O(n^2) operation. The number of partitions per domain is small on most devices, so this isn't an issue. CONFIG_EXECUTE_XOR_WRITE is still an optional feature. Signed-off-by: Leandro Pereira <leandro.pereira@intel.com>
2018-03-01 06:11:41 +08:00
userspace: cleanup mem domain assertions The memory domain APIs document that overlapping regions are not allowed, check for this unconditionally. Cleanup assertion error messages. Use __ASSERT_NO_MSG for blindingly obvious NULL checks. We now have a `check_add_partition()` function to perform all the necessary sanity checks on adding a partition to a domain. This returns true or false, which will help later when we implement #24609 Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2020-08-20 06:06:37 +08:00
if (pend > dstart && dend > pstart) {
LOG_ERR("partition %p base %lx (size %zu) overlaps existing base %lx (size %zu)",
part, part->start, part->size,
dpart->start, dpart->size);
kernel: mem_domain: Check for overlapping regions when considering W^X Multiple partitions can be added to a domain, and if they overlap, they can have different attributes. The previous check would only check for W^X for individual partitions, and this is insufficient. Overlapping partitions could have W^X attributes, but in the end, a memory region would be writable and executable. The way this is performed is quite "heavyweight", as it is implemented in a O(n^2) operation. The number of partitions per domain is small on most devices, so this isn't an issue. CONFIG_EXECUTE_XOR_WRITE is still an optional feature. Signed-off-by: Leandro Pereira <leandro.pereira@intel.com>
2018-03-01 06:11:41 +08:00
return false;
}
}
kernel: Add option to ensure writable pages are not executable This adds CONFIG_EXECUTE_XOR_WRITE, which is enabled by default on systems that support controlling whether a page can contain executable code. This is also known as W^X[1]. Trying to add a memory domain with a page that is both executable and writable, either for supervisor mode threads, or for user mode threads, will result in a kernel panic. There are few cases where a writable page should also be executable (JIT compilers, which are most likely out of scope for Zephyr), so an option is provided to disable the check. Since the memory domain APIs are executed in supervisor mode, a determined person could bypass these checks with ease. This is seen more as a way to avoid people shooting themselves in the foot. [1] https://en.wikipedia.org/wiki/W%5EX Signed-off-by: Leandro Pereira <leandro.pereira@intel.com>
2017-10-18 08:01:48 +08:00
kernel: mem_domain: Check for overlapping regions when considering W^X Multiple partitions can be added to a domain, and if they overlap, they can have different attributes. The previous check would only check for W^X for individual partitions, and this is insufficient. Overlapping partitions could have W^X attributes, but in the end, a memory region would be writable and executable. The way this is performed is quite "heavyweight", as it is implemented in a O(n^2) operation. The number of partitions per domain is small on most devices, so this isn't an issue. CONFIG_EXECUTE_XOR_WRITE is still an optional feature. Signed-off-by: Leandro Pereira <leandro.pereira@intel.com>
2018-03-01 06:11:41 +08:00
return true;
}
kernel: mem_domain: centralize assertions Later this year I hope to overhaul the memory domain APIs, but at least for now let's at least consolidate these checks. Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2020-07-18 04:48:36 +08:00
#endif
zephyr: replace zephyr integer types with C99 types git grep -l 'u\(8\|16\|32\|64\)_t' | \ xargs sed -i "s/u\(8\|16\|32\|64\)_t/uint\1_t/g" git grep -l 's\(8\|16\|32\|64\)_t' | \ xargs sed -i "s/s\(8\|16\|32\|64\)_t/int\1_t/g" Signed-off-by: Kumar Gala <kumar.gala@linaro.org>
2020-05-28 00:26:57 +08:00
void k_mem_domain_init(struct k_mem_domain *domain, uint8_t num_parts,
kernel: mem_domain: Use u8_t for number of partitions in struct During system initialization, the global static variable (to mem_domain.c) is initialized with the number of maximum partitions per domain. This variable is of u8_t type. Assertions throughout the code will check ranges and test for overflow by relying on implicit type conversion. Use an u8_t instead of u32_t to avoid doubts. Also, reorder the k_mem_partition struct to remove the alignment hole created by reducing sizeof(num_partitions). Signed-off-by: Leandro Pereira <leandro.pereira@intel.com>
2018-03-01 06:22:57 +08:00
struct k_mem_partition *parts[])
kernel: add memory domain APIs Add the following application-facing memory domain APIs: k_mem_domain_init() - to initialize a memory domain k_mem_domain_destroy() - to destroy a memory domain k_mem_domain_add_partition() - to add a partition into a domain k_mem_domain_remove_partition() - to remove a partition from a domain k_mem_domain_add_thread() - to add a thread into a domain k_mem_domain_remove_thread() - to remove a thread from a domain A memory domain would contain some number of memory partitions. A memory partition is a memory region (might be RAM, peripheral registers, flash...) with specific attributes (access permission, e.g. privileged read/write, unprivileged read-only, execute never...). Memory partitions would be defined by set of MPU regions or MMU tables underneath. A thread could only belong to a single memory domain any point in time but a memory domain could contain multiple threads. Threads in the same memory domain would have the same access permission to the memory partitions belong to the memory domain. The memory domain APIs are used by unprivileged threads to share data to the threads in the same memory and protect sensitive data from threads outside their domain. It is not only for improving the security but also useful for debugging (unexpected access would cause exception). Jira: ZEP-2281 Signed-off-by: Chunlin Han <chunlin.han@linaro.org>
2017-07-07 20:29:30 +08:00
{
kernel/mem_domain: Spinlockify Simple locking requirements here mean we can just use a single subsystem lock. Signed-off-by: Andy Ross <andrew.j.ross@intel.com>
2018-07-25 02:35:55 +08:00
k_spinlock_key_t key;
kernel: add memory domain APIs Add the following application-facing memory domain APIs: k_mem_domain_init() - to initialize a memory domain k_mem_domain_destroy() - to destroy a memory domain k_mem_domain_add_partition() - to add a partition into a domain k_mem_domain_remove_partition() - to remove a partition from a domain k_mem_domain_add_thread() - to add a thread into a domain k_mem_domain_remove_thread() - to remove a thread from a domain A memory domain would contain some number of memory partitions. A memory partition is a memory region (might be RAM, peripheral registers, flash...) with specific attributes (access permission, e.g. privileged read/write, unprivileged read-only, execute never...). Memory partitions would be defined by set of MPU regions or MMU tables underneath. A thread could only belong to a single memory domain any point in time but a memory domain could contain multiple threads. Threads in the same memory domain would have the same access permission to the memory partitions belong to the memory domain. The memory domain APIs are used by unprivileged threads to share data to the threads in the same memory and protect sensitive data from threads outside their domain. It is not only for improving the security but also useful for debugging (unexpected access would cause exception). Jira: ZEP-2281 Signed-off-by: Chunlin Han <chunlin.han@linaro.org>
2017-07-07 20:29:30 +08:00
userspace: cleanup mem domain assertions The memory domain APIs document that overlapping regions are not allowed, check for this unconditionally. Cleanup assertion error messages. Use __ASSERT_NO_MSG for blindingly obvious NULL checks. We now have a `check_add_partition()` function to perform all the necessary sanity checks on adding a partition to a domain. This returns true or false, which will help later when we implement #24609 Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2020-08-20 06:06:37 +08:00
__ASSERT_NO_MSG(domain != NULL);
__ASSERT(num_parts == 0U || parts != NULL,
"parts array is NULL and num_parts is nonzero");
__ASSERT(num_parts <= max_partitions,
"num_parts of %d exceeds maximum allowable partitions (%d)",
num_parts, max_partitions);
kernel: add memory domain APIs Add the following application-facing memory domain APIs: k_mem_domain_init() - to initialize a memory domain k_mem_domain_destroy() - to destroy a memory domain k_mem_domain_add_partition() - to add a partition into a domain k_mem_domain_remove_partition() - to remove a partition from a domain k_mem_domain_add_thread() - to add a thread into a domain k_mem_domain_remove_thread() - to remove a thread from a domain A memory domain would contain some number of memory partitions. A memory partition is a memory region (might be RAM, peripheral registers, flash...) with specific attributes (access permission, e.g. privileged read/write, unprivileged read-only, execute never...). Memory partitions would be defined by set of MPU regions or MMU tables underneath. A thread could only belong to a single memory domain any point in time but a memory domain could contain multiple threads. Threads in the same memory domain would have the same access permission to the memory partitions belong to the memory domain. The memory domain APIs are used by unprivileged threads to share data to the threads in the same memory and protect sensitive data from threads outside their domain. It is not only for improving the security but also useful for debugging (unexpected access would cause exception). Jira: ZEP-2281 Signed-off-by: Chunlin Han <chunlin.han@linaro.org>
2017-07-07 20:29:30 +08:00
userspace: make mem domain lock non-static Strictly speaking, any access to a mem domain or its containing partitions should be serialized on this lock. Architecture code may need to grab this lock if it is using this data during, for example, context switches, especially if they support SMP as locking interrupts is not enough. Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2020-10-07 06:53:43 +08:00
key = k_spin_lock(&z_mem_domain_lock);
kernel: add memory domain APIs Add the following application-facing memory domain APIs: k_mem_domain_init() - to initialize a memory domain k_mem_domain_destroy() - to destroy a memory domain k_mem_domain_add_partition() - to add a partition into a domain k_mem_domain_remove_partition() - to remove a partition from a domain k_mem_domain_add_thread() - to add a thread into a domain k_mem_domain_remove_thread() - to remove a thread from a domain A memory domain would contain some number of memory partitions. A memory partition is a memory region (might be RAM, peripheral registers, flash...) with specific attributes (access permission, e.g. privileged read/write, unprivileged read-only, execute never...). Memory partitions would be defined by set of MPU regions or MMU tables underneath. A thread could only belong to a single memory domain any point in time but a memory domain could contain multiple threads. Threads in the same memory domain would have the same access permission to the memory partitions belong to the memory domain. The memory domain APIs are used by unprivileged threads to share data to the threads in the same memory and protect sensitive data from threads outside their domain. It is not only for improving the security but also useful for debugging (unexpected access would cause exception). Jira: ZEP-2281 Signed-off-by: Chunlin Han <chunlin.han@linaro.org>
2017-07-07 20:29:30 +08:00
all: Add 'U' suffix when using unsigned variables Add a 'U' suffix to values when computing and comparing against unsigned variables. Signed-off-by: Patrik Flykt <patrik.flykt@intel.com>
2019-03-27 09:57:45 +08:00
domain->num_partitions = 0U;
coccicnelle: Ignore return of memset The return of memset is never checked. This patch explicitly ignore the return to avoid MISRA-C violations. The only directory excluded directory was ext/* since it contains only imported code. Signed-off-by: Flavio Ceolin <flavio.ceolin@intel.com>
2018-09-12 10:09:03 +08:00
(void)memset(domain->partitions, 0, sizeof(domain->partitions));
kernel: add memory domain APIs Add the following application-facing memory domain APIs: k_mem_domain_init() - to initialize a memory domain k_mem_domain_destroy() - to destroy a memory domain k_mem_domain_add_partition() - to add a partition into a domain k_mem_domain_remove_partition() - to remove a partition from a domain k_mem_domain_add_thread() - to add a thread into a domain k_mem_domain_remove_thread() - to remove a thread from a domain A memory domain would contain some number of memory partitions. A memory partition is a memory region (might be RAM, peripheral registers, flash...) with specific attributes (access permission, e.g. privileged read/write, unprivileged read-only, execute never...). Memory partitions would be defined by set of MPU regions or MMU tables underneath. A thread could only belong to a single memory domain any point in time but a memory domain could contain multiple threads. Threads in the same memory domain would have the same access permission to the memory partitions belong to the memory domain. The memory domain APIs are used by unprivileged threads to share data to the threads in the same memory and protect sensitive data from threads outside their domain. It is not only for improving the security but also useful for debugging (unexpected access would cause exception). Jira: ZEP-2281 Signed-off-by: Chunlin Han <chunlin.han@linaro.org>
2017-07-07 20:29:30 +08:00
sys_dlist_init(&domain->mem_domain_q);
userspace: add optional member to memory domains Some systems may need to associate arch-specific data to a memory domain. Add a Kconfig and `arch` field for this, and a new arch API to initialize it. Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2020-08-20 04:11:47 +08:00
#ifdef CONFIG_ARCH_MEM_DOMAIN_DATA
int ret = arch_mem_domain_init(domain);
/* TODO propagate return values, see #24609.
*
* Not using an assertion here as this is a memory allocation error
*/
if (ret != 0) {
LOG_ERR("architecture-specific initialization failed for domain %p with %d",
domain, ret);
k_panic();
}
#endif
userspace: fix k_mem_domain_init() The synchronous arch hook wasn't being invoked when k_mem_domain_init() was called with a partition list. This could result with regions not being programmed in the page tables as expected. Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2020-10-17 07:49:41 +08:00
if (num_parts != 0U) {
uint32_t i;
for (i = 0U; i < num_parts; i++) {
__ASSERT(check_add_partition(domain, parts[i]),
"invalid partition index %d (%p)",
i, parts[i]);
domain->partitions[i] = *parts[i];
domain->num_partitions++;
#ifdef CONFIG_ARCH_MEM_DOMAIN_SYNCHRONOUS_API
arch_mem_domain_partition_add(domain, i);
#endif
}
}
userspace: add optional member to memory domains Some systems may need to associate arch-specific data to a memory domain. Add a Kconfig and `arch` field for this, and a new arch API to initialize it. Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2020-08-20 04:11:47 +08:00
userspace: make mem domain lock non-static Strictly speaking, any access to a mem domain or its containing partitions should be serialized on this lock. Architecture code may need to grab this lock if it is using this data during, for example, context switches, especially if they support SMP as locking interrupts is not enough. Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2020-10-07 06:53:43 +08:00
k_spin_unlock(&z_mem_domain_lock, key);
kernel: add memory domain APIs Add the following application-facing memory domain APIs: k_mem_domain_init() - to initialize a memory domain k_mem_domain_destroy() - to destroy a memory domain k_mem_domain_add_partition() - to add a partition into a domain k_mem_domain_remove_partition() - to remove a partition from a domain k_mem_domain_add_thread() - to add a thread into a domain k_mem_domain_remove_thread() - to remove a thread from a domain A memory domain would contain some number of memory partitions. A memory partition is a memory region (might be RAM, peripheral registers, flash...) with specific attributes (access permission, e.g. privileged read/write, unprivileged read-only, execute never...). Memory partitions would be defined by set of MPU regions or MMU tables underneath. A thread could only belong to a single memory domain any point in time but a memory domain could contain multiple threads. Threads in the same memory domain would have the same access permission to the memory partitions belong to the memory domain. The memory domain APIs are used by unprivileged threads to share data to the threads in the same memory and protect sensitive data from threads outside their domain. It is not only for improving the security but also useful for debugging (unexpected access would cause exception). Jira: ZEP-2281 Signed-off-by: Chunlin Han <chunlin.han@linaro.org>
2017-07-07 20:29:30 +08:00
}
void k_mem_domain_add_partition(struct k_mem_domain *domain,
kernel: mem_domain: Check for overlapping regions when considering W^X Multiple partitions can be added to a domain, and if they overlap, they can have different attributes. The previous check would only check for W^X for individual partitions, and this is insufficient. Overlapping partitions could have W^X attributes, but in the end, a memory region would be writable and executable. The way this is performed is quite "heavyweight", as it is implemented in a O(n^2) operation. The number of partitions per domain is small on most devices, so this isn't an issue. CONFIG_EXECUTE_XOR_WRITE is still an optional feature. Signed-off-by: Leandro Pereira <leandro.pereira@intel.com>
2018-03-01 06:11:41 +08:00
struct k_mem_partition *part)
kernel: add memory domain APIs Add the following application-facing memory domain APIs: k_mem_domain_init() - to initialize a memory domain k_mem_domain_destroy() - to destroy a memory domain k_mem_domain_add_partition() - to add a partition into a domain k_mem_domain_remove_partition() - to remove a partition from a domain k_mem_domain_add_thread() - to add a thread into a domain k_mem_domain_remove_thread() - to remove a thread from a domain A memory domain would contain some number of memory partitions. A memory partition is a memory region (might be RAM, peripheral registers, flash...) with specific attributes (access permission, e.g. privileged read/write, unprivileged read-only, execute never...). Memory partitions would be defined by set of MPU regions or MMU tables underneath. A thread could only belong to a single memory domain any point in time but a memory domain could contain multiple threads. Threads in the same memory domain would have the same access permission to the memory partitions belong to the memory domain. The memory domain APIs are used by unprivileged threads to share data to the threads in the same memory and protect sensitive data from threads outside their domain. It is not only for improving the security but also useful for debugging (unexpected access would cause exception). Jira: ZEP-2281 Signed-off-by: Chunlin Han <chunlin.han@linaro.org>
2017-07-07 20:29:30 +08:00
{
int p_idx;
kernel/mem_domain: Spinlockify Simple locking requirements here mean we can just use a single subsystem lock. Signed-off-by: Andy Ross <andrew.j.ross@intel.com>
2018-07-25 02:35:55 +08:00
k_spinlock_key_t key;
kernel: add memory domain APIs Add the following application-facing memory domain APIs: k_mem_domain_init() - to initialize a memory domain k_mem_domain_destroy() - to destroy a memory domain k_mem_domain_add_partition() - to add a partition into a domain k_mem_domain_remove_partition() - to remove a partition from a domain k_mem_domain_add_thread() - to add a thread into a domain k_mem_domain_remove_thread() - to remove a thread from a domain A memory domain would contain some number of memory partitions. A memory partition is a memory region (might be RAM, peripheral registers, flash...) with specific attributes (access permission, e.g. privileged read/write, unprivileged read-only, execute never...). Memory partitions would be defined by set of MPU regions or MMU tables underneath. A thread could only belong to a single memory domain any point in time but a memory domain could contain multiple threads. Threads in the same memory domain would have the same access permission to the memory partitions belong to the memory domain. The memory domain APIs are used by unprivileged threads to share data to the threads in the same memory and protect sensitive data from threads outside their domain. It is not only for improving the security but also useful for debugging (unexpected access would cause exception). Jira: ZEP-2281 Signed-off-by: Chunlin Han <chunlin.han@linaro.org>
2017-07-07 20:29:30 +08:00
userspace: cleanup mem domain assertions The memory domain APIs document that overlapping regions are not allowed, check for this unconditionally. Cleanup assertion error messages. Use __ASSERT_NO_MSG for blindingly obvious NULL checks. We now have a `check_add_partition()` function to perform all the necessary sanity checks on adding a partition to a domain. This returns true or false, which will help later when we implement #24609 Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2020-08-20 06:06:37 +08:00
__ASSERT_NO_MSG(domain != NULL);
__ASSERT(check_add_partition(domain, part),
"invalid partition %p", part);
kernel: Add option to ensure writable pages are not executable This adds CONFIG_EXECUTE_XOR_WRITE, which is enabled by default on systems that support controlling whether a page can contain executable code. This is also known as W^X[1]. Trying to add a memory domain with a page that is both executable and writable, either for supervisor mode threads, or for user mode threads, will result in a kernel panic. There are few cases where a writable page should also be executable (JIT compilers, which are most likely out of scope for Zephyr), so an option is provided to disable the check. Since the memory domain APIs are executed in supervisor mode, a determined person could bypass these checks with ease. This is seen more as a way to avoid people shooting themselves in the foot. [1] https://en.wikipedia.org/wiki/W%5EX Signed-off-by: Leandro Pereira <leandro.pereira@intel.com>
2017-10-18 08:01:48 +08:00
userspace: make mem domain lock non-static Strictly speaking, any access to a mem domain or its containing partitions should be serialized on this lock. Architecture code may need to grab this lock if it is using this data during, for example, context switches, especially if they support SMP as locking interrupts is not enough. Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2020-10-07 06:53:43 +08:00
key = k_spin_lock(&z_mem_domain_lock);
kernel: add memory domain APIs Add the following application-facing memory domain APIs: k_mem_domain_init() - to initialize a memory domain k_mem_domain_destroy() - to destroy a memory domain k_mem_domain_add_partition() - to add a partition into a domain k_mem_domain_remove_partition() - to remove a partition from a domain k_mem_domain_add_thread() - to add a thread into a domain k_mem_domain_remove_thread() - to remove a thread from a domain A memory domain would contain some number of memory partitions. A memory partition is a memory region (might be RAM, peripheral registers, flash...) with specific attributes (access permission, e.g. privileged read/write, unprivileged read-only, execute never...). Memory partitions would be defined by set of MPU regions or MMU tables underneath. A thread could only belong to a single memory domain any point in time but a memory domain could contain multiple threads. Threads in the same memory domain would have the same access permission to the memory partitions belong to the memory domain. The memory domain APIs are used by unprivileged threads to share data to the threads in the same memory and protect sensitive data from threads outside their domain. It is not only for improving the security but also useful for debugging (unexpected access would cause exception). Jira: ZEP-2281 Signed-off-by: Chunlin Han <chunlin.han@linaro.org>
2017-07-07 20:29:30 +08:00
for (p_idx = 0; p_idx < max_partitions; p_idx++) {
/* A zero-sized partition denotes it's a free partition */
all: Add 'U' suffix when using unsigned variables Add a 'U' suffix to values when computing and comparing against unsigned variables. Signed-off-by: Patrik Flykt <patrik.flykt@intel.com>
2019-03-27 09:57:45 +08:00
if (domain->partitions[p_idx].size == 0U) {
kernel: add memory domain APIs Add the following application-facing memory domain APIs: k_mem_domain_init() - to initialize a memory domain k_mem_domain_destroy() - to destroy a memory domain k_mem_domain_add_partition() - to add a partition into a domain k_mem_domain_remove_partition() - to remove a partition from a domain k_mem_domain_add_thread() - to add a thread into a domain k_mem_domain_remove_thread() - to remove a thread from a domain A memory domain would contain some number of memory partitions. A memory partition is a memory region (might be RAM, peripheral registers, flash...) with specific attributes (access permission, e.g. privileged read/write, unprivileged read-only, execute never...). Memory partitions would be defined by set of MPU regions or MMU tables underneath. A thread could only belong to a single memory domain any point in time but a memory domain could contain multiple threads. Threads in the same memory domain would have the same access permission to the memory partitions belong to the memory domain. The memory domain APIs are used by unprivileged threads to share data to the threads in the same memory and protect sensitive data from threads outside their domain. It is not only for improving the security but also useful for debugging (unexpected access would cause exception). Jira: ZEP-2281 Signed-off-by: Chunlin Han <chunlin.han@linaro.org>
2017-07-07 20:29:30 +08:00
break;
}
}
userspace: cleanup mem domain assertions The memory domain APIs document that overlapping regions are not allowed, check for this unconditionally. Cleanup assertion error messages. Use __ASSERT_NO_MSG for blindingly obvious NULL checks. We now have a `check_add_partition()` function to perform all the necessary sanity checks on adding a partition to a domain. This returns true or false, which will help later when we implement #24609 Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2020-08-20 06:06:37 +08:00
__ASSERT(p_idx < max_partitions,
"no free partition slots available");
kernel: add memory domain APIs Add the following application-facing memory domain APIs: k_mem_domain_init() - to initialize a memory domain k_mem_domain_destroy() - to destroy a memory domain k_mem_domain_add_partition() - to add a partition into a domain k_mem_domain_remove_partition() - to remove a partition from a domain k_mem_domain_add_thread() - to add a thread into a domain k_mem_domain_remove_thread() - to remove a thread from a domain A memory domain would contain some number of memory partitions. A memory partition is a memory region (might be RAM, peripheral registers, flash...) with specific attributes (access permission, e.g. privileged read/write, unprivileged read-only, execute never...). Memory partitions would be defined by set of MPU regions or MMU tables underneath. A thread could only belong to a single memory domain any point in time but a memory domain could contain multiple threads. Threads in the same memory domain would have the same access permission to the memory partitions belong to the memory domain. The memory domain APIs are used by unprivileged threads to share data to the threads in the same memory and protect sensitive data from threads outside their domain. It is not only for improving the security but also useful for debugging (unexpected access would cause exception). Jira: ZEP-2281 Signed-off-by: Chunlin Han <chunlin.han@linaro.org>
2017-07-07 20:29:30 +08:00
userspace: add debug logs to mem domain code Useful when debugging stuff. Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2020-08-26 07:47:44 +08:00
LOG_DBG("add partition base %lx size %zu to domain %p\n",
part->start, part->size, domain);
kernel: add memory domain APIs Add the following application-facing memory domain APIs: k_mem_domain_init() - to initialize a memory domain k_mem_domain_destroy() - to destroy a memory domain k_mem_domain_add_partition() - to add a partition into a domain k_mem_domain_remove_partition() - to remove a partition from a domain k_mem_domain_add_thread() - to add a thread into a domain k_mem_domain_remove_thread() - to remove a thread from a domain A memory domain would contain some number of memory partitions. A memory partition is a memory region (might be RAM, peripheral registers, flash...) with specific attributes (access permission, e.g. privileged read/write, unprivileged read-only, execute never...). Memory partitions would be defined by set of MPU regions or MMU tables underneath. A thread could only belong to a single memory domain any point in time but a memory domain could contain multiple threads. Threads in the same memory domain would have the same access permission to the memory partitions belong to the memory domain. The memory domain APIs are used by unprivileged threads to share data to the threads in the same memory and protect sensitive data from threads outside their domain. It is not only for improving the security but also useful for debugging (unexpected access would cause exception). Jira: ZEP-2281 Signed-off-by: Chunlin Han <chunlin.han@linaro.org>
2017-07-07 20:29:30 +08:00
domain->partitions[p_idx].start = part->start;
domain->partitions[p_idx].size = part->size;
domain->partitions[p_idx].attr = part->attr;
domain->num_partitions++;
kernel: add CONFIG_ARCH_MEM_DOMAIN_SYNCHRONOUS_API Saves us a few bytes of program text on arches that don't need these implemented, currently all uniprocessor MPU-based systems. Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2020-08-26 08:02:38 +08:00
#ifdef CONFIG_ARCH_MEM_DOMAIN_SYNCHRONOUS_API
kernel: rename z_arch_ to arch_ Promote the private z_arch_* namespace, which specifies the interface between the core kernel and the architecture code, to a new top-level namespace named arch_*. This allows our documentation generation to create online documentation for this set of interfaces, and this set of interfaces is worth treating in a more formal way anyway. Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2019-11-08 04:43:29 +08:00
arch_mem_domain_partition_add(domain, p_idx);
kernel: add CONFIG_ARCH_MEM_DOMAIN_SYNCHRONOUS_API Saves us a few bytes of program text on arches that don't need these implemented, currently all uniprocessor MPU-based systems. Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2020-08-26 08:02:38 +08:00
#endif
userspace: make mem domain lock non-static Strictly speaking, any access to a mem domain or its containing partitions should be serialized on this lock. Architecture code may need to grab this lock if it is using this data during, for example, context switches, especially if they support SMP as locking interrupts is not enough. Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2020-10-07 06:53:43 +08:00
k_spin_unlock(&z_mem_domain_lock, key);
kernel: add memory domain APIs Add the following application-facing memory domain APIs: k_mem_domain_init() - to initialize a memory domain k_mem_domain_destroy() - to destroy a memory domain k_mem_domain_add_partition() - to add a partition into a domain k_mem_domain_remove_partition() - to remove a partition from a domain k_mem_domain_add_thread() - to add a thread into a domain k_mem_domain_remove_thread() - to remove a thread from a domain A memory domain would contain some number of memory partitions. A memory partition is a memory region (might be RAM, peripheral registers, flash...) with specific attributes (access permission, e.g. privileged read/write, unprivileged read-only, execute never...). Memory partitions would be defined by set of MPU regions or MMU tables underneath. A thread could only belong to a single memory domain any point in time but a memory domain could contain multiple threads. Threads in the same memory domain would have the same access permission to the memory partitions belong to the memory domain. The memory domain APIs are used by unprivileged threads to share data to the threads in the same memory and protect sensitive data from threads outside their domain. It is not only for improving the security but also useful for debugging (unexpected access would cause exception). Jira: ZEP-2281 Signed-off-by: Chunlin Han <chunlin.han@linaro.org>
2017-07-07 20:29:30 +08:00
}
void k_mem_domain_remove_partition(struct k_mem_domain *domain,
struct k_mem_partition *part)
{
int p_idx;
kernel/mem_domain: Spinlockify Simple locking requirements here mean we can just use a single subsystem lock. Signed-off-by: Andy Ross <andrew.j.ross@intel.com>
2018-07-25 02:35:55 +08:00
k_spinlock_key_t key;
kernel: add memory domain APIs Add the following application-facing memory domain APIs: k_mem_domain_init() - to initialize a memory domain k_mem_domain_destroy() - to destroy a memory domain k_mem_domain_add_partition() - to add a partition into a domain k_mem_domain_remove_partition() - to remove a partition from a domain k_mem_domain_add_thread() - to add a thread into a domain k_mem_domain_remove_thread() - to remove a thread from a domain A memory domain would contain some number of memory partitions. A memory partition is a memory region (might be RAM, peripheral registers, flash...) with specific attributes (access permission, e.g. privileged read/write, unprivileged read-only, execute never...). Memory partitions would be defined by set of MPU regions or MMU tables underneath. A thread could only belong to a single memory domain any point in time but a memory domain could contain multiple threads. Threads in the same memory domain would have the same access permission to the memory partitions belong to the memory domain. The memory domain APIs are used by unprivileged threads to share data to the threads in the same memory and protect sensitive data from threads outside their domain. It is not only for improving the security but also useful for debugging (unexpected access would cause exception). Jira: ZEP-2281 Signed-off-by: Chunlin Han <chunlin.han@linaro.org>
2017-07-07 20:29:30 +08:00
userspace: cleanup mem domain assertions The memory domain APIs document that overlapping regions are not allowed, check for this unconditionally. Cleanup assertion error messages. Use __ASSERT_NO_MSG for blindingly obvious NULL checks. We now have a `check_add_partition()` function to perform all the necessary sanity checks on adding a partition to a domain. This returns true or false, which will help later when we implement #24609 Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2020-08-20 06:06:37 +08:00
__ASSERT_NO_MSG(domain != NULL);
__ASSERT_NO_MSG(part != NULL);
kernel: add memory domain APIs Add the following application-facing memory domain APIs: k_mem_domain_init() - to initialize a memory domain k_mem_domain_destroy() - to destroy a memory domain k_mem_domain_add_partition() - to add a partition into a domain k_mem_domain_remove_partition() - to remove a partition from a domain k_mem_domain_add_thread() - to add a thread into a domain k_mem_domain_remove_thread() - to remove a thread from a domain A memory domain would contain some number of memory partitions. A memory partition is a memory region (might be RAM, peripheral registers, flash...) with specific attributes (access permission, e.g. privileged read/write, unprivileged read-only, execute never...). Memory partitions would be defined by set of MPU regions or MMU tables underneath. A thread could only belong to a single memory domain any point in time but a memory domain could contain multiple threads. Threads in the same memory domain would have the same access permission to the memory partitions belong to the memory domain. The memory domain APIs are used by unprivileged threads to share data to the threads in the same memory and protect sensitive data from threads outside their domain. It is not only for improving the security but also useful for debugging (unexpected access would cause exception). Jira: ZEP-2281 Signed-off-by: Chunlin Han <chunlin.han@linaro.org>
2017-07-07 20:29:30 +08:00
userspace: make mem domain lock non-static Strictly speaking, any access to a mem domain or its containing partitions should be serialized on this lock. Architecture code may need to grab this lock if it is using this data during, for example, context switches, especially if they support SMP as locking interrupts is not enough. Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2020-10-07 06:53:43 +08:00
key = k_spin_lock(&z_mem_domain_lock);
kernel: add memory domain APIs Add the following application-facing memory domain APIs: k_mem_domain_init() - to initialize a memory domain k_mem_domain_destroy() - to destroy a memory domain k_mem_domain_add_partition() - to add a partition into a domain k_mem_domain_remove_partition() - to remove a partition from a domain k_mem_domain_add_thread() - to add a thread into a domain k_mem_domain_remove_thread() - to remove a thread from a domain A memory domain would contain some number of memory partitions. A memory partition is a memory region (might be RAM, peripheral registers, flash...) with specific attributes (access permission, e.g. privileged read/write, unprivileged read-only, execute never...). Memory partitions would be defined by set of MPU regions or MMU tables underneath. A thread could only belong to a single memory domain any point in time but a memory domain could contain multiple threads. Threads in the same memory domain would have the same access permission to the memory partitions belong to the memory domain. The memory domain APIs are used by unprivileged threads to share data to the threads in the same memory and protect sensitive data from threads outside their domain. It is not only for improving the security but also useful for debugging (unexpected access would cause exception). Jira: ZEP-2281 Signed-off-by: Chunlin Han <chunlin.han@linaro.org>
2017-07-07 20:29:30 +08:00
/* find a partition that matches the given start and size */
for (p_idx = 0; p_idx < max_partitions; p_idx++) {
if (domain->partitions[p_idx].start == part->start &&
domain->partitions[p_idx].size == part->size) {
break;
}
}
userspace: clarify memory domain assertions Some text added to help explain what is going on. Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2019-03-02 10:12:49 +08:00
__ASSERT(p_idx < max_partitions, "no matching partition found");
kernel: add memory domain APIs Add the following application-facing memory domain APIs: k_mem_domain_init() - to initialize a memory domain k_mem_domain_destroy() - to destroy a memory domain k_mem_domain_add_partition() - to add a partition into a domain k_mem_domain_remove_partition() - to remove a partition from a domain k_mem_domain_add_thread() - to add a thread into a domain k_mem_domain_remove_thread() - to remove a thread from a domain A memory domain would contain some number of memory partitions. A memory partition is a memory region (might be RAM, peripheral registers, flash...) with specific attributes (access permission, e.g. privileged read/write, unprivileged read-only, execute never...). Memory partitions would be defined by set of MPU regions or MMU tables underneath. A thread could only belong to a single memory domain any point in time but a memory domain could contain multiple threads. Threads in the same memory domain would have the same access permission to the memory partitions belong to the memory domain. The memory domain APIs are used by unprivileged threads to share data to the threads in the same memory and protect sensitive data from threads outside their domain. It is not only for improving the security but also useful for debugging (unexpected access would cause exception). Jira: ZEP-2281 Signed-off-by: Chunlin Han <chunlin.han@linaro.org>
2017-07-07 20:29:30 +08:00
userspace: add debug logs to mem domain code Useful when debugging stuff. Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2020-08-26 07:47:44 +08:00
LOG_DBG("remove partition base %lx size %zu from domain %p\n",
part->start, part->size, domain);
kernel: add CONFIG_ARCH_MEM_DOMAIN_SYNCHRONOUS_API Saves us a few bytes of program text on arches that don't need these implemented, currently all uniprocessor MPU-based systems. Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2020-08-26 08:02:38 +08:00
#ifdef CONFIG_ARCH_MEM_DOMAIN_SYNCHRONOUS_API
kernel: rename z_arch_ to arch_ Promote the private z_arch_* namespace, which specifies the interface between the core kernel and the architecture code, to a new top-level namespace named arch_*. This allows our documentation generation to create online documentation for this set of interfaces, and this set of interfaces is worth treating in a more formal way anyway. Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2019-11-08 04:43:29 +08:00
arch_mem_domain_partition_remove(domain, p_idx);
kernel: add CONFIG_ARCH_MEM_DOMAIN_SYNCHRONOUS_API Saves us a few bytes of program text on arches that don't need these implemented, currently all uniprocessor MPU-based systems. Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2020-08-26 08:02:38 +08:00
#endif
kernel: Arch specific memory domain APIs added Added arch specific calls to handle memory domain destroy and removal of partition. GH-3852 Signed-off-by: Adithya Baglody <adithya.nagaraj.baglody@intel.com>
2017-10-09 14:07:31 +08:00
kernel: mem_domain: remove redundant clearing of mem_partition fields When a memory partition is removed, it is not required to clear the start and attr fields, since a free partition is only indicated by a zero size field. This commit removes the un-necessary clearing of start and attr fields. Signed-off-by: Ioannis Glaropoulos <Ioannis.Glaropoulos@nordicsemi.no>
2018-12-03 21:21:54 +08:00
/* A zero-sized partition denotes it's a free partition */
all: Add 'U' suffix when using unsigned variables Add a 'U' suffix to values when computing and comparing against unsigned variables. Signed-off-by: Patrik Flykt <patrik.flykt@intel.com>
2019-03-27 09:57:45 +08:00
domain->partitions[p_idx].size = 0U;
kernel: add memory domain APIs Add the following application-facing memory domain APIs: k_mem_domain_init() - to initialize a memory domain k_mem_domain_destroy() - to destroy a memory domain k_mem_domain_add_partition() - to add a partition into a domain k_mem_domain_remove_partition() - to remove a partition from a domain k_mem_domain_add_thread() - to add a thread into a domain k_mem_domain_remove_thread() - to remove a thread from a domain A memory domain would contain some number of memory partitions. A memory partition is a memory region (might be RAM, peripheral registers, flash...) with specific attributes (access permission, e.g. privileged read/write, unprivileged read-only, execute never...). Memory partitions would be defined by set of MPU regions or MMU tables underneath. A thread could only belong to a single memory domain any point in time but a memory domain could contain multiple threads. Threads in the same memory domain would have the same access permission to the memory partitions belong to the memory domain. The memory domain APIs are used by unprivileged threads to share data to the threads in the same memory and protect sensitive data from threads outside their domain. It is not only for improving the security but also useful for debugging (unexpected access would cause exception). Jira: ZEP-2281 Signed-off-by: Chunlin Han <chunlin.han@linaro.org>
2017-07-07 20:29:30 +08:00
domain->num_partitions--;
userspace: make mem domain lock non-static Strictly speaking, any access to a mem domain or its containing partitions should be serialized on this lock. Architecture code may need to grab this lock if it is using this data during, for example, context switches, especially if they support SMP as locking interrupts is not enough. Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2020-10-07 06:53:43 +08:00
k_spin_unlock(&z_mem_domain_lock, key);
kernel: add memory domain APIs Add the following application-facing memory domain APIs: k_mem_domain_init() - to initialize a memory domain k_mem_domain_destroy() - to destroy a memory domain k_mem_domain_add_partition() - to add a partition into a domain k_mem_domain_remove_partition() - to remove a partition from a domain k_mem_domain_add_thread() - to add a thread into a domain k_mem_domain_remove_thread() - to remove a thread from a domain A memory domain would contain some number of memory partitions. A memory partition is a memory region (might be RAM, peripheral registers, flash...) with specific attributes (access permission, e.g. privileged read/write, unprivileged read-only, execute never...). Memory partitions would be defined by set of MPU regions or MMU tables underneath. A thread could only belong to a single memory domain any point in time but a memory domain could contain multiple threads. Threads in the same memory domain would have the same access permission to the memory partitions belong to the memory domain. The memory domain APIs are used by unprivileged threads to share data to the threads in the same memory and protect sensitive data from threads outside their domain. It is not only for improving the security but also useful for debugging (unexpected access would cause exception). Jira: ZEP-2281 Signed-off-by: Chunlin Han <chunlin.han@linaro.org>
2017-07-07 20:29:30 +08:00
}
userspace: remove threads from domain on abort When threads exited we were leaving dangling references to them in the domain's mem_domain_q. z_thread_single_abort() now calls into the memory domain code via z_mem_domain_exit_thread() to take it off. The thread setup code now invokes z_mem_domain_init_thread(), avoiding extra checks in k_mem_domain_add_thread(), we know the object isn't currently a member of a doamin. Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2020-10-07 04:39:29 +08:00
static void add_thread_locked(struct k_mem_domain *domain,
k_tid_t thread)
kernel: add memory domain APIs Add the following application-facing memory domain APIs: k_mem_domain_init() - to initialize a memory domain k_mem_domain_destroy() - to destroy a memory domain k_mem_domain_add_partition() - to add a partition into a domain k_mem_domain_remove_partition() - to remove a partition from a domain k_mem_domain_add_thread() - to add a thread into a domain k_mem_domain_remove_thread() - to remove a thread from a domain A memory domain would contain some number of memory partitions. A memory partition is a memory region (might be RAM, peripheral registers, flash...) with specific attributes (access permission, e.g. privileged read/write, unprivileged read-only, execute never...). Memory partitions would be defined by set of MPU regions or MMU tables underneath. A thread could only belong to a single memory domain any point in time but a memory domain could contain multiple threads. Threads in the same memory domain would have the same access permission to the memory partitions belong to the memory domain. The memory domain APIs are used by unprivileged threads to share data to the threads in the same memory and protect sensitive data from threads outside their domain. It is not only for improving the security but also useful for debugging (unexpected access would cause exception). Jira: ZEP-2281 Signed-off-by: Chunlin Han <chunlin.han@linaro.org>
2017-07-07 20:29:30 +08:00
{
userspace: cleanup mem domain assertions The memory domain APIs document that overlapping regions are not allowed, check for this unconditionally. Cleanup assertion error messages. Use __ASSERT_NO_MSG for blindingly obvious NULL checks. We now have a `check_add_partition()` function to perform all the necessary sanity checks on adding a partition to a domain. This returns true or false, which will help later when we implement #24609 Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2020-08-20 06:06:37 +08:00
__ASSERT_NO_MSG(domain != NULL);
__ASSERT_NO_MSG(thread != NULL);
kernel: add memory domain APIs Add the following application-facing memory domain APIs: k_mem_domain_init() - to initialize a memory domain k_mem_domain_destroy() - to destroy a memory domain k_mem_domain_add_partition() - to add a partition into a domain k_mem_domain_remove_partition() - to remove a partition from a domain k_mem_domain_add_thread() - to add a thread into a domain k_mem_domain_remove_thread() - to remove a thread from a domain A memory domain would contain some number of memory partitions. A memory partition is a memory region (might be RAM, peripheral registers, flash...) with specific attributes (access permission, e.g. privileged read/write, unprivileged read-only, execute never...). Memory partitions would be defined by set of MPU regions or MMU tables underneath. A thread could only belong to a single memory domain any point in time but a memory domain could contain multiple threads. Threads in the same memory domain would have the same access permission to the memory partitions belong to the memory domain. The memory domain APIs are used by unprivileged threads to share data to the threads in the same memory and protect sensitive data from threads outside their domain. It is not only for improving the security but also useful for debugging (unexpected access would cause exception). Jira: ZEP-2281 Signed-off-by: Chunlin Han <chunlin.han@linaro.org>
2017-07-07 20:29:30 +08:00
userspace: add debug logs to mem domain code Useful when debugging stuff. Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2020-08-26 07:47:44 +08:00
LOG_DBG("add thread %p to domain %p\n", thread, domain);
kernel: add memory domain APIs Add the following application-facing memory domain APIs: k_mem_domain_init() - to initialize a memory domain k_mem_domain_destroy() - to destroy a memory domain k_mem_domain_add_partition() - to add a partition into a domain k_mem_domain_remove_partition() - to remove a partition from a domain k_mem_domain_add_thread() - to add a thread into a domain k_mem_domain_remove_thread() - to remove a thread from a domain A memory domain would contain some number of memory partitions. A memory partition is a memory region (might be RAM, peripheral registers, flash...) with specific attributes (access permission, e.g. privileged read/write, unprivileged read-only, execute never...). Memory partitions would be defined by set of MPU regions or MMU tables underneath. A thread could only belong to a single memory domain any point in time but a memory domain could contain multiple threads. Threads in the same memory domain would have the same access permission to the memory partitions belong to the memory domain. The memory domain APIs are used by unprivileged threads to share data to the threads in the same memory and protect sensitive data from threads outside their domain. It is not only for improving the security but also useful for debugging (unexpected access would cause exception). Jira: ZEP-2281 Signed-off-by: Chunlin Han <chunlin.han@linaro.org>
2017-07-07 20:29:30 +08:00
sys_dlist_append(&domain->mem_domain_q,
&thread->mem_domain_info.mem_domain_q_node);
thread->mem_domain_info.mem_domain = domain;
kernel: add CONFIG_ARCH_MEM_DOMAIN_SYNCHRONOUS_API Saves us a few bytes of program text on arches that don't need these implemented, currently all uniprocessor MPU-based systems. Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2020-08-26 08:02:38 +08:00
#ifdef CONFIG_ARCH_MEM_DOMAIN_SYNCHRONOUS_API
kernel: rename z_arch_ to arch_ Promote the private z_arch_* namespace, which specifies the interface between the core kernel and the architecture code, to a new top-level namespace named arch_*. This allows our documentation generation to create online documentation for this set of interfaces, and this set of interfaces is worth treating in a more formal way anyway. Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2019-11-08 04:43:29 +08:00
arch_mem_domain_thread_add(thread);
kernel: add CONFIG_ARCH_MEM_DOMAIN_SYNCHRONOUS_API Saves us a few bytes of program text on arches that don't need these implemented, currently all uniprocessor MPU-based systems. Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2020-08-26 08:02:38 +08:00
#endif
userspace: remove threads from domain on abort When threads exited we were leaving dangling references to them in the domain's mem_domain_q. z_thread_single_abort() now calls into the memory domain code via z_mem_domain_exit_thread() to take it off. The thread setup code now invokes z_mem_domain_init_thread(), avoiding extra checks in k_mem_domain_add_thread(), we know the object isn't currently a member of a doamin. Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2020-10-07 04:39:29 +08:00
}
static void remove_thread_locked(struct k_thread *thread)
{
__ASSERT_NO_MSG(thread != NULL);
LOG_DBG("remove thread %p from memory domain %p\n",
thread, thread->mem_domain_info.mem_domain);
sys_dlist_remove(&thread->mem_domain_info.mem_domain_q_node);
kernel: mem_domain: Add to current thread should configure immediately. when a current thread is added to a memory domain the pages/sections must be configured immediately. A problem occurs when we add a thread to current and then drop down to usermode. In such a case memory domain will become active the next time a swap occurs. Signed-off-by: Adithya Baglody <adithya.nagaraj.baglody@intel.com>
2017-12-06 19:18:28 +08:00
userspace: remove threads from domain on abort When threads exited we were leaving dangling references to them in the domain's mem_domain_q. z_thread_single_abort() now calls into the memory domain code via z_mem_domain_exit_thread() to take it off. The thread setup code now invokes z_mem_domain_init_thread(), avoiding extra checks in k_mem_domain_add_thread(), we know the object isn't currently a member of a doamin. Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2020-10-07 04:39:29 +08:00
#ifdef CONFIG_ARCH_MEM_DOMAIN_SYNCHRONOUS_API
arch_mem_domain_thread_remove(thread);
#endif
}
/* Called from thread object initialization */
void z_mem_domain_init_thread(struct k_thread *thread)
{
userspace: make mem domain lock non-static Strictly speaking, any access to a mem domain or its containing partitions should be serialized on this lock. Architecture code may need to grab this lock if it is using this data during, for example, context switches, especially if they support SMP as locking interrupts is not enough. Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2020-10-07 06:53:43 +08:00
k_spinlock_key_t key = k_spin_lock(&z_mem_domain_lock);
userspace: remove threads from domain on abort When threads exited we were leaving dangling references to them in the domain's mem_domain_q. z_thread_single_abort() now calls into the memory domain code via z_mem_domain_exit_thread() to take it off. The thread setup code now invokes z_mem_domain_init_thread(), avoiding extra checks in k_mem_domain_add_thread(), we know the object isn't currently a member of a doamin. Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2020-10-07 04:39:29 +08:00
/* New threads inherit memory domain configuration from parent */
add_thread_locked(_current->mem_domain_info.mem_domain, thread);
userspace: make mem domain lock non-static Strictly speaking, any access to a mem domain or its containing partitions should be serialized on this lock. Architecture code may need to grab this lock if it is using this data during, for example, context switches, especially if they support SMP as locking interrupts is not enough. Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2020-10-07 06:53:43 +08:00
k_spin_unlock(&z_mem_domain_lock, key);
userspace: remove threads from domain on abort When threads exited we were leaving dangling references to them in the domain's mem_domain_q. z_thread_single_abort() now calls into the memory domain code via z_mem_domain_exit_thread() to take it off. The thread setup code now invokes z_mem_domain_init_thread(), avoiding extra checks in k_mem_domain_add_thread(), we know the object isn't currently a member of a doamin. Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2020-10-07 04:39:29 +08:00
}
/* Called when thread aborts during teardown tasks. sched_spinlock is held */
void z_mem_domain_exit_thread(struct k_thread *thread)
{
userspace: make mem domain lock non-static Strictly speaking, any access to a mem domain or its containing partitions should be serialized on this lock. Architecture code may need to grab this lock if it is using this data during, for example, context switches, especially if they support SMP as locking interrupts is not enough. Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2020-10-07 06:53:43 +08:00
k_spinlock_key_t key = k_spin_lock(&z_mem_domain_lock);
userspace: remove threads from domain on abort When threads exited we were leaving dangling references to them in the domain's mem_domain_q. z_thread_single_abort() now calls into the memory domain code via z_mem_domain_exit_thread() to take it off. The thread setup code now invokes z_mem_domain_init_thread(), avoiding extra checks in k_mem_domain_add_thread(), we know the object isn't currently a member of a doamin. Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2020-10-07 04:39:29 +08:00
remove_thread_locked(thread);
userspace: make mem domain lock non-static Strictly speaking, any access to a mem domain or its containing partitions should be serialized on this lock. Architecture code may need to grab this lock if it is using this data during, for example, context switches, especially if they support SMP as locking interrupts is not enough. Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2020-10-07 06:53:43 +08:00
k_spin_unlock(&z_mem_domain_lock, key);
userspace: remove threads from domain on abort When threads exited we were leaving dangling references to them in the domain's mem_domain_q. z_thread_single_abort() now calls into the memory domain code via z_mem_domain_exit_thread() to take it off. The thread setup code now invokes z_mem_domain_init_thread(), avoiding extra checks in k_mem_domain_add_thread(), we know the object isn't currently a member of a doamin. Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2020-10-07 04:39:29 +08:00
}
void k_mem_domain_add_thread(struct k_mem_domain *domain, k_tid_t thread)
{
k_spinlock_key_t key;
userspace: make mem domain lock non-static Strictly speaking, any access to a mem domain or its containing partitions should be serialized on this lock. Architecture code may need to grab this lock if it is using this data during, for example, context switches, especially if they support SMP as locking interrupts is not enough. Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2020-10-07 06:53:43 +08:00
key = k_spin_lock(&z_mem_domain_lock);
userspace: do nothing if added to same domain If we call k_mem_domain_add_thread() to a memory domain the thread already belongs to, do nothing. Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2020-10-21 04:26:19 +08:00
if (thread->mem_domain_info.mem_domain != domain) {
remove_thread_locked(thread);
add_thread_locked(domain, thread);
}
userspace: make mem domain lock non-static Strictly speaking, any access to a mem domain or its containing partitions should be serialized on this lock. Architecture code may need to grab this lock if it is using this data during, for example, context switches, especially if they support SMP as locking interrupts is not enough. Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2020-10-07 06:53:43 +08:00
k_spin_unlock(&z_mem_domain_lock, key);
kernel: add memory domain APIs Add the following application-facing memory domain APIs: k_mem_domain_init() - to initialize a memory domain k_mem_domain_destroy() - to destroy a memory domain k_mem_domain_add_partition() - to add a partition into a domain k_mem_domain_remove_partition() - to remove a partition from a domain k_mem_domain_add_thread() - to add a thread into a domain k_mem_domain_remove_thread() - to remove a thread from a domain A memory domain would contain some number of memory partitions. A memory partition is a memory region (might be RAM, peripheral registers, flash...) with specific attributes (access permission, e.g. privileged read/write, unprivileged read-only, execute never...). Memory partitions would be defined by set of MPU regions or MMU tables underneath. A thread could only belong to a single memory domain any point in time but a memory domain could contain multiple threads. Threads in the same memory domain would have the same access permission to the memory partitions belong to the memory domain. The memory domain APIs are used by unprivileged threads to share data to the threads in the same memory and protect sensitive data from threads outside their domain. It is not only for improving the security but also useful for debugging (unexpected access would cause exception). Jira: ZEP-2281 Signed-off-by: Chunlin Han <chunlin.han@linaro.org>
2017-07-07 20:29:30 +08:00
}
void k_mem_domain_remove_thread(k_tid_t thread)
{
userspace: introduce default memory domain We make a policy change here: all threads are members of a memory domain, never NULL. We introduce a default memory domain for threads that haven't been assigned to or inherited another one. Primary motivation for this change is better MMU support, as one common configuration will be to maintain page tables at the memory domain level. Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2020-08-26 05:42:33 +08:00
k_mem_domain_add_thread(&k_mem_domain_default, thread);
kernel: add memory domain APIs Add the following application-facing memory domain APIs: k_mem_domain_init() - to initialize a memory domain k_mem_domain_destroy() - to destroy a memory domain k_mem_domain_add_partition() - to add a partition into a domain k_mem_domain_remove_partition() - to remove a partition from a domain k_mem_domain_add_thread() - to add a thread into a domain k_mem_domain_remove_thread() - to remove a thread from a domain A memory domain would contain some number of memory partitions. A memory partition is a memory region (might be RAM, peripheral registers, flash...) with specific attributes (access permission, e.g. privileged read/write, unprivileged read-only, execute never...). Memory partitions would be defined by set of MPU regions or MMU tables underneath. A thread could only belong to a single memory domain any point in time but a memory domain could contain multiple threads. Threads in the same memory domain would have the same access permission to the memory partitions belong to the memory domain. The memory domain APIs are used by unprivileged threads to share data to the threads in the same memory and protect sensitive data from threads outside their domain. It is not only for improving the security but also useful for debugging (unexpected access would cause exception). Jira: ZEP-2281 Signed-off-by: Chunlin Han <chunlin.han@linaro.org>
2017-07-07 20:29:30 +08:00
}
userspace: fix k_mem_domain_destroy() This deprecated API won't be removed for one more release, ensure it doesn't put the kernel into a bad state as it currently sets all the member thread domain assignment to NULL which is not what we want. Have it reassign all member threads to the default domain. Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2020-10-07 06:02:04 +08:00
void k_mem_domain_destroy(struct k_mem_domain *domain)
{
k_spinlock_key_t key;
sys_dnode_t *node, *next_node;
__ASSERT_NO_MSG(domain != NULL);
__ASSERT(domain != &k_mem_domain_default,
"cannot destroy default domain");
userspace: make mem domain lock non-static Strictly speaking, any access to a mem domain or its containing partitions should be serialized on this lock. Architecture code may need to grab this lock if it is using this data during, for example, context switches, especially if they support SMP as locking interrupts is not enough. Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2020-10-07 06:53:43 +08:00
key = k_spin_lock(&z_mem_domain_lock);
userspace: fix k_mem_domain_destroy() This deprecated API won't be removed for one more release, ensure it doesn't put the kernel into a bad state as it currently sets all the member thread domain assignment to NULL which is not what we want. Have it reassign all member threads to the default domain. Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2020-10-07 06:02:04 +08:00
#ifdef CONFIG_ARCH_MEM_DOMAIN_SYNCHRONOUS_API
arch_mem_domain_destroy(domain);
#endif
SYS_DLIST_FOR_EACH_NODE_SAFE(&domain->mem_domain_q, node, next_node) {
struct k_thread *thread =
CONTAINER_OF(node, struct k_thread, mem_domain_info);
remove_thread_locked(thread);
add_thread_locked(&k_mem_domain_default, thread);
}
userspace: make mem domain lock non-static Strictly speaking, any access to a mem domain or its containing partitions should be serialized on this lock. Architecture code may need to grab this lock if it is using this data during, for example, context switches, especially if they support SMP as locking interrupts is not enough. Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2020-10-07 06:53:43 +08:00
k_spin_unlock(&z_mem_domain_lock, key);
userspace: fix k_mem_domain_destroy() This deprecated API won't be removed for one more release, ensure it doesn't put the kernel into a bad state as it currently sets all the member thread domain assignment to NULL which is not what we want. Have it reassign all member threads to the default domain. Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2020-10-07 06:02:04 +08:00
}
device: Const-ify all device driver instance pointers Now that device_api attribute is unmodified at runtime, as well as all the other attributes, it is possible to switch all device driver instance to be constant. A coccinelle rule is used for this: @r_const_dev_1 disable optional_qualifier @ @@ -struct device * +const struct device * @r_const_dev_2 disable optional_qualifier @ @@ -struct device * const +const struct device * Fixes #27399 Signed-off-by: Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com>
2020-05-01 02:33:38 +08:00
static int init_mem_domain_module(const struct device *arg)
kernel: add memory domain APIs Add the following application-facing memory domain APIs: k_mem_domain_init() - to initialize a memory domain k_mem_domain_destroy() - to destroy a memory domain k_mem_domain_add_partition() - to add a partition into a domain k_mem_domain_remove_partition() - to remove a partition from a domain k_mem_domain_add_thread() - to add a thread into a domain k_mem_domain_remove_thread() - to remove a thread from a domain A memory domain would contain some number of memory partitions. A memory partition is a memory region (might be RAM, peripheral registers, flash...) with specific attributes (access permission, e.g. privileged read/write, unprivileged read-only, execute never...). Memory partitions would be defined by set of MPU regions or MMU tables underneath. A thread could only belong to a single memory domain any point in time but a memory domain could contain multiple threads. Threads in the same memory domain would have the same access permission to the memory partitions belong to the memory domain. The memory domain APIs are used by unprivileged threads to share data to the threads in the same memory and protect sensitive data from threads outside their domain. It is not only for improving the security but also useful for debugging (unexpected access would cause exception). Jira: ZEP-2281 Signed-off-by: Chunlin Han <chunlin.han@linaro.org>
2017-07-07 20:29:30 +08:00
{
ARG_UNUSED(arg);
kernel: rename z_arch_ to arch_ Promote the private z_arch_* namespace, which specifies the interface between the core kernel and the architecture code, to a new top-level namespace named arch_*. This allows our documentation generation to create online documentation for this set of interfaces, and this set of interfaces is worth treating in a more formal way anyway. Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2019-11-08 04:43:29 +08:00
max_partitions = arch_mem_domain_max_partitions_get();
kernel: add memory domain APIs Add the following application-facing memory domain APIs: k_mem_domain_init() - to initialize a memory domain k_mem_domain_destroy() - to destroy a memory domain k_mem_domain_add_partition() - to add a partition into a domain k_mem_domain_remove_partition() - to remove a partition from a domain k_mem_domain_add_thread() - to add a thread into a domain k_mem_domain_remove_thread() - to remove a thread from a domain A memory domain would contain some number of memory partitions. A memory partition is a memory region (might be RAM, peripheral registers, flash...) with specific attributes (access permission, e.g. privileged read/write, unprivileged read-only, execute never...). Memory partitions would be defined by set of MPU regions or MMU tables underneath. A thread could only belong to a single memory domain any point in time but a memory domain could contain multiple threads. Threads in the same memory domain would have the same access permission to the memory partitions belong to the memory domain. The memory domain APIs are used by unprivileged threads to share data to the threads in the same memory and protect sensitive data from threads outside their domain. It is not only for improving the security but also useful for debugging (unexpected access would cause exception). Jira: ZEP-2281 Signed-off-by: Chunlin Han <chunlin.han@linaro.org>
2017-07-07 20:29:30 +08:00
/*
* max_partitions must be less than or equal to
* CONFIG_MAX_DOMAIN_PARTITIONS, or would encounter array index
* out of bounds error.
*/
__ASSERT(max_partitions <= CONFIG_MAX_DOMAIN_PARTITIONS, "");
userspace: introduce default memory domain We make a policy change here: all threads are members of a memory domain, never NULL. We introduce a default memory domain for threads that haven't been assigned to or inherited another one. Primary motivation for this change is better MMU support, as one common configuration will be to maintain page tables at the memory domain level. Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2020-08-26 05:42:33 +08:00
k_mem_domain_init(&k_mem_domain_default, 0, NULL);
#ifdef Z_LIBC_PARTITION_EXISTS
k_mem_domain_add_partition(&k_mem_domain_default, &z_libc_partition);
#endif /* Z_LIBC_PARTITION_EXISTS */
kernel: add memory domain APIs Add the following application-facing memory domain APIs: k_mem_domain_init() - to initialize a memory domain k_mem_domain_destroy() - to destroy a memory domain k_mem_domain_add_partition() - to add a partition into a domain k_mem_domain_remove_partition() - to remove a partition from a domain k_mem_domain_add_thread() - to add a thread into a domain k_mem_domain_remove_thread() - to remove a thread from a domain A memory domain would contain some number of memory partitions. A memory partition is a memory region (might be RAM, peripheral registers, flash...) with specific attributes (access permission, e.g. privileged read/write, unprivileged read-only, execute never...). Memory partitions would be defined by set of MPU regions or MMU tables underneath. A thread could only belong to a single memory domain any point in time but a memory domain could contain multiple threads. Threads in the same memory domain would have the same access permission to the memory partitions belong to the memory domain. The memory domain APIs are used by unprivileged threads to share data to the threads in the same memory and protect sensitive data from threads outside their domain. It is not only for improving the security but also useful for debugging (unexpected access would cause exception). Jira: ZEP-2281 Signed-off-by: Chunlin Han <chunlin.han@linaro.org>
2017-07-07 20:29:30 +08:00
return 0;
}
SYS_INIT(init_mem_domain_module, PRE_KERNEL_1,
CONFIG_KERNEL_INIT_PRIORITY_DEFAULT);