pkg/xipfs: add MPU memory isolation to file execution #21760
Conversation
GGuche-2XS-Univ-Lille
requested review from
kaspar030 and
bergzand
as code owners
github-actions
bot
added
Platform: ARM
crasbe
added
Type: enhancement
|
Where can I look at the code of examples/advanced/xipfs/dumper.fae? |
|
@Teufelchen1 Sorry for the delay. You can find the source of the memory dumper here. It comes with the tools for building : the sources are compiled to an elf file, which is processed in order to build a fae file. For more details on the tools and process, please go to the XIPFS Format repository |
There was a problem hiding this comment.
I don't really like the modifications to the common Cortex-M files to be honest.
This is pretty application specific and does not really belong here.
I acknowledge that currently there are no provisions to change the mem_manage handler or add cases to the SVC dispatcher, but I'm afraid that this is not a good way yet.
|
@crasbe XIPFS is designed for ARM platforms with addressable flash memory and ARMv7-M MPU. As such, we don't target any board specifically but more a family of boards sharing these features. Furthermore, we need to customize the memory fault handler :
We also need to add svc cases :
We would have liked to come with a better proposal, satisfying all of us, but to the best of our knowledge, we need at least these two modifications to make the MPU memory isolation work for the targeted platforms. |
Contribution description
The xipfs filesystem is able to perform in-place execution.
The aim of this PR is to add hardware MPU-based memory isolation to the xipfs' execution capability.
With it, an executable fae file is run in non-privileged mode and can only access to its legitimate memory areas, thanks to MPU regions definitions of TEXT, DATA and STACK segments.
TEXT is read-only, but DATA and STACK are read-write.
This generic hardware approach can handle all executables, with almost zero time overhead.
MPU regions identifiers have been chosen with respect to RIOT's MPU safe guard and MPU no exec functionalities.
This feature should be available for all platforms with an ARM cpu and an ARMv7-M MPU, but has been only tested on QORVO DWM1001 for now.
Testing procedure
For this board, a memory dumper is provided in xipfs' example to illustrate simple/safe memory dumps of legit/non-legit ram/rom.
On a sidenote, illegitimate RAM address has been chosen to be equal to 0x20000020, because the first 32 bytes of the RAM are in read-only MPU stack guard region.
In safe execution mode, the dumper would display the 32 bytes starting at 0x20000000 before the MPU detects an illegal access, which could lead to deceptive conclusions.