Lecture: security monitors on RISC-V

Read

3.6, Physical Memory Protection of the RISC-V privileged ISA manual
Developing security monitors on RISC-V.

Question

Alice is developing a security monitor, which runs in M-mode and resides within the physical address range [0x80000000, 0x80200000). Alice wants to prevent an OS kernel running in S-mode from accessing the code/data of the security monitor. Describe a plan using PMP to achieve this goal. Be specific about the number and types of PMP regions.

Question

Provide a list of questions you would like to discuss in class.

overview

goals
- firmware wants to protect itself from the OS kernel
- systems with only M/U: similar to an OS with memory segmentation
- enclaves: protect applications from a malicious OS (more on this next week in Keystone)
CSRs
- 16 PMP regions (the number may vary in hardware)
- priorities: which to match first?
- PMP configuration registers: pmpcfg0 and pmpcfg2 on RV64
- PMP address registers: pmpaddr0–pmpaddr15
many plans
- use PMP only: TOR/NAPOT
- combine with page tables
- trade-offs in flexibility: the number of PMP regions, contiguous memory, etc.