Enable PMP for memory isolation

[HeatCrab]

This PR implements PMP (Physical Memory Protection) support for RISC-V to enable hardware-enforced memory isolation in Linmo, addressing #30.

Currently Phase 1 (infrastructure) is complete. This branch will continue development through the remaining phases. Phase 1 adds the foundational structures and declarations: PMP hardware layer in arch/riscv with CSR definitions and region management structures, architecture-independent memory abstractions (flex pages, address spaces, memory pools), kernel memory pool declarations from linker symbols, and TCB extension for address space linkage.

The actual PMP operations including region configuration, CSR manipulation, and context switching integration are not yet implemented.

TOR mode is used for its flexibility with arbitrary address ranges without alignment constraints, simplifying region management for task stacks of varying sizes. Priority-based eviction allows the system to manage competing demands when the 16 hardware regions are exhausted, ensuring critical kernel and stack regions remain protected while allowing temporary mappings to be reclaimed as needed.

---

Summary by cubic

Enables RISC-V PMP for hardware memory isolation (#30). Uses TOR mode with boot-time kernel protection, trap-time flexpage loading, per-task context switching, and U-mode kernel stack isolation via mscratch; unrecoverable access faults terminate the task instead of panicking.

• New Features
  • PMP CSR and numeric accessors; TOR-mode region set/disable/lock/read and access checks with shadow state.
  • Kernel memory pools from linker symbols: text RX; data/bss RW (no execute); heap/stack RW (no execute).
  • Flexpages and memory spaces with on-demand load/evict and victim selection; TCB linked to a memory space.
  • U-mode kernel stack isolation via mscratch (ISR frame includes SP); trap handler is nested-trap safe and performs load/evict on access faults with task termination on unrecoverable faults; context switch swaps task regions.

^{Written for commit c78a3f3. Summary will update on new commits.}

[jserv]

Use unified "flexpage" notation.

[HeatCrab]

Use unified "flexpage" notation.

Got it! Thanks for the correction and the L4 X.2 reference.
I've fixed all occurrences to use "flexpage" notation.

[HeatCrab]

Rebase the latest 'main' branch to resolve rtsched issues.

Finished. And I removed the M-mode fault-handling commits, as they are not aligned with the upcoming work.
Next, I plan to start U-mode support (#19) on a new branch, and then circle back to complete the PMP development and apply any adjustments that may be needed after the U-mode integration.

[cubic-dev-ai]

6 issues found across 25 files

Prompt for AI agents (all issues)

Check if these issues are valid — if so, understand the root cause of each and fix them.


<file name="arch/riscv/pmp.c">

<violation number="1" location="arch/riscv/pmp.c:427">
P1: Integer overflow in access check: `addr + size` can wrap around, potentially bypassing PMP security checks. Validate that `addr + size` does not overflow before computing the end address.</violation>

<violation number="2" location="arch/riscv/pmp.c:636">
P1: `next_region_idx` is never incremented after use, causing subsequent fault handlers to overwrite the same PMP region repeatedly instead of using new slots.</violation>

<violation number="3" location="arch/riscv/pmp.c:644">
P0: Use-after-invalidation bug: `victim->pmp_id` is used after `pmp_evict_fpage()` sets it to `PMP_INVALID_REGION`. Save the region index before eviction.</violation>
</file>

<file name="kernel/task.c">

<violation number="1" location="kernel/task.c:385">
P2: Memory leak: `tcb->mspace` is not destroyed in the kernel_stack allocation error path. Since this is inside a `user_mode` block, `mspace` was already created earlier and should be freed.</violation>
</file>

<file name="kernel/syscall.c">

<violation number="1" location="kernel/syscall.c:400">
P1: Holding NOSCHED_ENTER for the entire user-controlled string makes sys_tputs vulnerable to denial of service; a malicious U-mode task can pass an unterminated or extremely long string and block the scheduler indefinitely.</violation>
</file>

<file name="Documentation/hal-riscv-context-switch.md">

<violation number="1" location="Documentation/hal-riscv-context-switch.md:168">
P3: Documentation claims the U-mode SP is set to the user stack top, but the code still subtracts the 256-byte guard zone; update the comment to describe the actual value so stack sizing guidance is correct.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

[jserv]

Use 'git rebase -i' to rework commits, resolving known issues.

[HeatCrab]

Use 'git rebase -i' to rework commits, resolving known issues.

All known issues have been resolved, and the rebase is complete.

[jserv]

All known issues have been resolved, and the rebase is complete.

Too many commits. Lower the counts while maintaining atomic changes in each commit.

[HeatCrab]

Too many commits. Lower the counts while maintaining atomic changes in each commit.

The branch is now reduced to 8 commits (without PR #62) while preserving atomic changes.