Skip to content

Commit 030779f

Browse files
sudo-apt-abdullahsudo-apt-abdullah
committed
feat: smepmp
1 parent e79ff16 commit 030779f

File tree

3 files changed

+241
-83
lines changed

3 files changed

+241
-83
lines changed

‎spec/std/isa/csr/mseccfg.yaml‎

Lines changed: 89 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -11,15 +11,12 @@ address: 0x747
1111
writable: true
1212
priv_mode: M
1313
length: MXLEN
14-
description: Machine Security Configuration register is used for configuring various security mechanisms present on the hart and only accessible in Machine mode.
14+
description: Machine Security Configuration register is used for configuring various security mechanisms present on the hart.
1515
definedBy:
16-
allOf:
17-
- name: Sm
18-
version: ">=1.12"
19-
- name: Smepmp
20-
version: ">= 1.0.0"
16+
name: Smepmp
17+
version: ~> 1.0.0
2118
fields:
22-
MML:
19+
MMsL:
2320
location: 0
2421
description: |
2522
Machine Mode Lockdown (mseccfg.MML) enforces strong isolation between Machine Mode and lower-privilege modes. This is a _sticky bit_
@@ -91,29 +88,101 @@ fields:
9188
type: RW
9289
definedBy: Smepmp
9390
reset_value: UNDEFINED_LEGAL
94-
MMWP:
95-
location: 1
91+
MML:
92+
location: 0
93+
definedBy: Smepmp
9694
description: |
97-
Machine Mode Whitelist Policy (mseccfg.MMWP). This is a _sticky bit_ meaning that once set, it can only be reset on PMP Reset.
95+
Machine Mode Lockdown (mseccfg.MML) is a sticky bit, meaning that once set it cannot be unset until a PMP reset. When `mseccfg.MML` is set
96+
the system's behavior changes in the following way:
9897
99-
When 1 (set), it changes the default PMP policy for M-mode when accessing memory regions that do not have a matching PMP rule, to
100-
*denied* instead of *ignored*.
98+
a. The meaning of `pmpcfg.L` changes: Instead of marking a rule as locked and enforced in all modes, it now marks a rule as M-mode-only
99+
when set and S/U-mode-only when unset. The formerly reserved encoding of `pmpcfg.RW=01`, and the encoding `pmpcfg.LRWX=1111`, now encode
100+
a Shared-Region.
101101
102-
When set to 0, `mseccfg.MMWP` enables the default PMP behavior in Machine mode, meaning that M-mode can access any memory region
103-
even if it is not explicitly covered by a PMP rule.
102+
An M-mode-only rule is enforced on Machine mode and denied in Supervisor or User mode. It also remains locked so that any further
103+
modifications to its associated configuration or address registers are ignored until a PMP reset, unless `mseccfg.RLB` is set.
104104
105-
type: RW
105+
An S/U-mode-only rule is enforced on Supervisor and User modes and denied on Machine mode.
106+
107+
A Shared-Region rule is enforced on all modes, with restrictions depending on the `pmpcfg.L` and `pmpcfg.X` bits:
108+
109+
- A Shared-Region rule where `pmpcfg.L` is not set can be used for sharing data between M-mode and S/U-mode, so is not executable. M-mode
110+
has read/write access to that region, and S/U-mode has read access if `pmpcfg.X` is not set, or read/write access if `pmpcfg.X` is set.
111+
112+
- A Shared-Region rule where `pmpcfg.L` is set can be used for sharing code between M-mode and S/U-mode, so is not writable. Both M-mode and
113+
S/U-mode have execute access on the region, and M-mode also has read access if `pmpcfg.X` is set. The rule remains locked so that any further
114+
modifications to its associated configuration or address registers are ignored until a PMP reset, unless `mseccfg.RLB` is set.
115+
116+
- The encoding `pmpcfg.LRWX=1111` can be used for sharing data between M-mode and S/U mode, where both modes only have read-only access to the
117+
region. The rule remains locked so that any further modifications to its associated configuration or address registers are ignored until a PMP
118+
reset, unless `mseccfg.RLB` is set.
119+
120+
b. Adding a rule with executable privileges that either is M-mode-only or a locked Shared-Region is not possible and such pmpcfg writes are ignored,
121+
leaving pmpcfg unchanged. This restriction can be temporarily lifted by setting `mseccfg.RLB` e.g. during the boot process.
122+
123+
c. Executing code with Machine mode privileges is only possible from memory regions with a matching M-mode-only rule or a locked Shared-Region rule
124+
with executable privileges. Executing code from a region without a matching rule or with a matching S/U-mode-only rule is denied.
125+
126+
d. If mseccfg.MML is not set, the combination of `pmpcfg.RW=01` remains reserved for future standard use.
127+
128+
The truth table when the `mseccfg.MML` is set:
129+
130+
[cols="4*^.^1,2*^.^3", separator="!", %autowidth, options="header"]
131+
!====
132+
4+^! Bits on _pmpcfg_ register 2+^! Result
133+
! L ! R ! W ! X ! M Mode ! S/U Mode
134+
135+
! 0 ! 0 ! 0 ! 0 2+^! Inaccessible region (Access Exception)
136+
! 0 ! 0 ! 0 ! 1 ! Access Exception ! Execute-only region
137+
! 0 ! 0 ! 1 ! 0 2+^! Shared data region: Read/write on M mode, Read-only on S/U mode
138+
! 0 ! 0 ! 1 ! 1 2+^! Shared data region: Read/write for both M and S/U mode
139+
! 0 ! 1 ! 0 ! 0 ! Access Exception ! Read-only region
140+
! 0 ! 1 ! 0 ! 1 ! Access Exception ! Read/Execute region
141+
! 0 ! 1 ! 1 ! 0 ! Access Exception ! Read/Write region
142+
! 0 ! 1 ! 1 ! 1 ! Access Exception ! Read/Write/Execute region
143+
! 1 ! 0 ! 0 ! 0 2+^! Locked inaccessible region* (Access Exception)
144+
! 1 ! 0 ! 0 ! 1 ! Locked Execute-only region* ! Access Exception
145+
! 1 ! 0 ! 1 ! 0 2+^! Locked Shared code region: Execute only on both M and S/U mode.*
146+
! 1 ! 0 ! 1 ! 1 2+^! Locked Shared code region: Execute only on S/U mode, read/execute on M mode.*
147+
! 1 ! 1 ! 0 ! 0 ! Locked Read-only region* ! Access Exception
148+
! 1 ! 1 ! 0 ! 1 ! Locked Read/Execute region* ! Access Exception
149+
! 1 ! 1 ! 1 ! 0 ! Locked Read/Write region* ! Access Exception
150+
! 1 ! 1 ! 1 ! 1 2+^! Locked Shared data region: Read only on both M and S/U mode.*
151+
!====
152+
153+
*Locked rules cannot be removed or modified until a PMP reset, unless mseccfg.RLB is set.
154+
type(): |
155+
if (MSECCFG_MML_TYPE == "read-only-0" || MSECCFG_MML_TYPE == "read-only-1") {
156+
return CsrFieldType::RO;
157+
} else if (MSECCFG_MML_TYPE == "sticky") {
158+
return CsrFieldType::RW-R; // restricted: 0→1 allowed, 1→0 not allowed
159+
}
160+
sw_write(csr_value): return csr_value.MML | CSR[mseccfg].MML;
161+
reset_value: UNDEFINED_LEGAL
162+
MMWP:
163+
location: 1
106164
definedBy: Smepmp
165+
description: |
166+
Machine-Mode Allowlist Policy (mseccfg.MMWP) is a sticky bit, meaning that once set it cannot be unset until a PMP reset. When set it
167+
changes the default PMP policy for M-mode when accessing memory regions that don't have a matching PMP rule, to denied instead of ignored.
168+
type(): |
169+
if (MSECCFG_MML_TYPE == "read-only-0" || MSECCFG_MML_TYPE == "read-only-1") {
170+
return CsrFieldType::RO;
171+
} else if (MSECCFG_MML_TYPE == "sticky") {
172+
return CsrFieldType::RW-R; // restricted: 0→1 allowed, 1→0 not allowed
173+
}
174+
sw_write(csr_value): return csr_value.MMWP | CSR[mseccfg].MMWP;
107175
reset_value: UNDEFINED_LEGAL
108176
RLB:
109177
location: 2
110178
description: |
111-
Rule Locking Bypass (mseccfg.RLB). This field can be set to 1 and once it is set back to 0, then it cannot be changed until the PMP Reset.
179+
Rule Locking Bypass (mseccfg.RLB) bit has the following functionality:
112180
113-
When 1, locked PMP rules may be removed/modified and locked PMP enteries may be edited.
181+
a. When `mseccfg.RLB` is 1 locked PMP rules may be removed/modified and locked PMP entries may be edited.
114182
115-
When 0, with `pmpcfg.L=1` in any rule or entry (including disabled enteries), then mseccfg.RLB
116-
remains 0 and any further modifications to mseccfg.RLB are ignored until a PMP reset.
117-
type: RW
183+
b. When `mseccfg.RLB` is 0 and `pmpcfg.L` is 1 in any rule or entry (including disabled entries), then
184+
remains 0 and any further modifications to `mseccfg.RLB` are ignored until a PMP reset.
185+
type(): |
186+
return MUTABLE_MSECCFG_RLB ? CsrFieldType::RW : CsrFieldType:RO;
118187
definedBy: Smepmp
119188
reset_value: UNDEFINED_LEGAL

‎spec/std/isa/csr/mseccfgh.yaml‎

Lines changed: 4 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -12,11 +12,9 @@ address: 0x757
1212
writable: true
1313
priv_mode: M
1414
length: 32
15-
description: Machine Security Configuration
15+
description: |
16+
The `mseccfgh` is a 32-bit read/write register that aliases bits 63:32 of `mseccfg`.
1617
definedBy:
17-
allOf:
18-
- name: Sm
19-
version: ">=1.12"
20-
- name: Smepmp
21-
version: ">= 1.0.0"
18+
name: Smepmp
19+
version: ~> 1.0.0
2220
fields: {}

0 commit comments

Comments
 (0)