Enable PMP for memory isolation #32

HeatCrab · 2025-10-29T05:55:21Z

This PR implements PMP (Physical Memory Protection) support for RISC-V to enable hardware-enforced memory isolation in Linmo, addressing #30.

Currently Phase 1 (infrastructure) is complete. This branch will continue development through the remaining phases. Phase 1 adds the foundational structures and declarations: PMP hardware layer in arch/riscv with CSR definitions and region management structures, architecture-independent memory abstractions (flex pages, address spaces, memory pools), kernel memory pool declarations from linker symbols, and TCB extension for address space linkage.

The actual PMP operations including region configuration, CSR manipulation, and context switching integration are not yet implemented.

TOR mode is used for its flexibility with arbitrary address ranges without alignment constraints, simplifying region management for task stacks of varying sizes. Priority-based eviction allows the system to manage competing demands when the 16 hardware regions are exhausted, ensuring critical kernel and stack regions remain protected while allowing temporary mappings to be reclaimed as needed.

Summary by cubic

Enables RISC-V PMP for hardware memory isolation (#30). Uses TOR mode with boot-time kernel protection, trap-time flexpage loading, per-task context switching, and U-mode kernel stack isolation via mscratch; unrecoverable access faults terminate the task instead of panicking.

New Features
- PMP CSR and numeric accessors; TOR-mode region set/disable/lock/read and access checks with shadow state.
- Kernel memory pools from linker symbols: text RX; data/bss RW (no execute).
- Flexpages and memory spaces with on-demand load/evict and victim selection; TCB linked to a memory space.
- U-mode kernel stack isolation via mscratch (ISR frame includes SP); trap handler is nested-trap safe and performs load/evict on access faults with task termination on unrecoverable faults; context switch swaps task regions.

^{Written for commit e34fac0. Summary will update on new commits.}

include/sys/task.h

jserv

Use unified "flexpage" notation.

include/sys/memprot.h

kernel/memprot.c

HeatCrab · 2025-10-31T13:26:42Z

Use unified "flexpage" notation.

Got it! Thanks for the correction and the L4 X.2 reference.
I've fixed all occurrences to use "flexpage" notation.

HeatCrab · 2025-11-22T09:18:17Z

Rebase the latest 'main' branch to resolve rtsched issues.

Finished. And I removed the M-mode fault-handling commits, as they are not aligned with the upcoming work.
Next, I plan to start U-mode support (#19) on a new branch, and then circle back to complete the PMP development and apply any adjustments that may be needed after the U-mode integration.

arch/riscv/pmp.c

Documentation/pmp-memory-protection.md

arch/riscv/pmp.c

Establish the complete PMP infrastructure to support hardware-enforced memory isolation. This implementation spans the driver layer, hardware abstraction, and region lifecycle management. Introduce `flexpages` to represent contiguous physical regions with protection attributes, and `memory_spaces` to group them into per-task protection domains. These abstractions decouple high-level memory policies from low-level hardware constraints. Address the RISC-V immediate value limitation for CSR instructions by implementing a runtime-indexed access mechanism. A switch-case dispatch system maps dynamic indices to static `pmpcfg` and `pmpaddr` instructions, enabling iterative configuration of PMP entries. All regions use TOR (Top-of-Range) mode to support arbitrary address alignment. Implement a driver stack that maintains a centralized shadow configuration to mirror hardware state. This serves as the single source of truth for PMP operations, supporting atomic updates and dynamic region allocation. The region management API handles the validation, locking, and eviction of entries, while kernel memory pools are automatically secured at boot using linker symbols (Text: RX, Data: RW).

Memory protection requires dynamic reconfiguration when switching between tasks. Each task receives a dedicated memory space with its stack registered as a protected flexpage. During context switches, the scheduler evicts the outgoing task's regions from hardware slots and loads the incoming task's regions, while kernel regions remain locked across all transitions. Kernel text, data, and BSS regions are configured at boot and protected from eviction. User mode tasks operate in isolated memory domains where they cannot access kernel memory or other tasks' stacks. Nested trap handling is required for correct U-mode operation. When a user mode syscall triggers a yield, the resulting nested trap must not corrupt the outer trap's context. Trap nesting depth tracking ensures only the outermost trap performs context switch restoration, and yield from trap context invokes the scheduler directly without additional trap nesting. A test validates mixed-privilege context switching by spawning M-mode and U-mode tasks that continuously yield, verifying correct operation across privilege boundaries.

Hardware PMP entries are limited resources, restricting the number of simultaneous memory mappings. Additionally, unrecoverable access faults currently panic the kernel, which compromises system availability during multitasking. Address the hardware implementation limit by loading memory regions dynamically. When a task accesses a valid region not present in hardware, the fault handler evicts a lower-priority entry to map the required flexpage on demand. This decouples the number of task memory regions from the physical PMP slot count. Improve system stability by terminating tasks that trigger unrecoverable faults. Instead of halting the entire system, the fault handler marks the task as a zombie and signals the scheduler to maximize resource reclamation. This ensures that isolation violations affect only the faulting process.

Provides comprehensive documentation covering memory abstraction, context switching, and fault handling for the PMP implementation. The test application validates three core isolation guarantees. Tasks verify stack integrity across context switches using guard values. Destructive tests validate kernel memory protection and inter-task isolation by attempting unauthorized accesses that trigger fault handling and task termination. CI scripts are modified to recognize expected output results. Synchronization timing in mutex tests is adjusted to accommodate context switch overhead from PMP configuration.

jserv · 2026-01-31T19:30:49Z

Thank @HeatCrab for contributing!

jserv reviewed Oct 29, 2025

View reviewed changes

include/sys/task.h Outdated Show resolved Hide resolved

HeatCrab force-pushed the pmp/memory-isolation branch from d2552a5 to 319ba96 Compare October 29, 2025 06:32

HeatCrab mentioned this pull request Oct 29, 2025

mutex and semaphore tests timeout or fail to build #34

Closed

jserv reviewed Oct 31, 2025

View reviewed changes

include/sys/memprot.h Outdated Show resolved Hide resolved

kernel/memprot.c Outdated Show resolved Hide resolved

HeatCrab force-pushed the pmp/memory-isolation branch from e264a35 to 4a62d5b Compare October 31, 2025 13:25

HeatCrab force-pushed the pmp/memory-isolation branch 5 times, most recently from 109259d to f6c3912 Compare November 6, 2025 09:16

HeatCrab force-pushed the pmp/memory-isolation branch 2 times, most recently from 2644558 to 1bb5fcf Compare November 16, 2025 13:18

This comment was marked as outdated.

Sign in to view

HeatCrab force-pushed the pmp/memory-isolation branch 6 times, most recently from 904e972 to ed800fc Compare November 21, 2025 12:38

This comment was marked as outdated.

Sign in to view

This comment was marked as resolved.

Sign in to view

HeatCrab force-pushed the pmp/memory-isolation branch 6 times, most recently from 0d55f21 to 865a5d6 Compare November 22, 2025 08:36

HeatCrab force-pushed the pmp/memory-isolation branch from 865a5d6 to 7e3992e Compare December 11, 2025 08:51

HeatCrab force-pushed the pmp/memory-isolation branch 5 times, most recently from f1422f7 to 5fa0716 Compare January 30, 2026 06:45

This comment was marked as resolved.

Sign in to view

HeatCrab force-pushed the pmp/memory-isolation branch from 5fa0716 to 337fdb6 Compare January 30, 2026 07:38

This comment was marked as resolved.

Sign in to view

jserv reviewed Jan 30, 2026

View reviewed changes

arch/riscv/pmp.c Show resolved Hide resolved

jserv reviewed Jan 30, 2026

View reviewed changes

arch/riscv/pmp.c Outdated Show resolved Hide resolved

jserv reviewed Jan 30, 2026

View reviewed changes

Documentation/pmp-memory-protection.md Show resolved Hide resolved

jserv reviewed Jan 30, 2026

View reviewed changes

arch/riscv/pmp.c Outdated Show resolved Hide resolved

This comment was marked as resolved.

Sign in to view

jserv requested a review from visitorckw January 30, 2026 12:33

HeatCrab force-pushed the pmp/memory-isolation branch from 337fdb6 to 18841ee Compare January 31, 2026 09:38

sysprog21 deleted a comment from cubic-dev-ai bot Jan 31, 2026

This comment was marked as resolved.

Sign in to view

HeatCrab force-pushed the pmp/memory-isolation branch from 18841ee to 7b02e82 Compare January 31, 2026 14:27

HeatCrab force-pushed the pmp/memory-isolation branch from 7b02e82 to 18485e7 Compare January 31, 2026 14:38

HeatCrab added 2 commits January 31, 2026 23:37

HeatCrab force-pushed the pmp/memory-isolation branch from 18485e7 to e34fac0 Compare January 31, 2026 16:52

jserv merged commit d21ba4d into sysprog21:main Jan 31, 2026
6 checks passed

HeatCrab deleted the pmp/memory-isolation branch February 1, 2026 04:46

HeatCrab mentioned this pull request Feb 1, 2026

Enable PMP for memory isolation #30

Closed

25 tasks

Enable PMP for memory isolation #32

Enable PMP for memory isolation #32

Uh oh!

Conversation

HeatCrab commented Oct 29, 2025 • edited by cubic-dev-ai bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by cubic

Uh oh!

Uh oh!

jserv left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

HeatCrab commented Oct 31, 2025

Uh oh!

This comment was marked as outdated.

Uh oh!

This comment was marked as outdated.

This comment was marked as resolved.

Uh oh!

HeatCrab commented Nov 22, 2025

Uh oh!

This comment was marked as resolved.

Uh oh!

This comment was marked as resolved.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

This comment was marked as resolved.

Uh oh!

This comment was marked as resolved.

Uh oh!

This comment was marked as resolved.

Uh oh!

Uh oh!

jserv commented Jan 31, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

HeatCrab commented Oct 29, 2025 •

edited by cubic-dev-ai bot

Loading