Zephyr Project Requirements
Memory protection

SPDX-License-Identifier: Apache-2.0
ZEP-SRS-8-1
1. Memory Protection UID: ZEP-SRS-8-1 STATUS: Draft TYPE: Functional COMPONENT: Memory Protection RELATIONS (Parent): STATEMENT:

The Zephyr RTOS shall support memory protection features to isolate a thread's memory region.

 USER_STORY:

As a Zephyr RTOS user I want memory to be allocated and protected to my application threads preventing mistakenly access to foreign memory as far as the hardware allows.
ZEP-SRS-8-2
2. Granting access to kernel objects UID: ZEP-SRS-8-2 STATUS: Draft TYPE: Functional COMPONENT: Memory Protection RELATIONS (Parent): STATEMENT:

The Zephyr RTOS shall provide a mechanism to grant user threads access to kernel objects.

 USER_STORY:

As a Zephyr RTOS user I want, from the user space, under certain conditions, access to kernel objects.
ZEP-SRS-8-3
3. Separation between user and kernel threads for memory access UID: ZEP-SRS-8-3 STATUS: Draft TYPE: Functional COMPONENT: Memory Protection RELATIONS (Parent): STATEMENT:

The Zephyr RTOS shall be able to differentiate between user threads and kernel threads for memory access.

 USER_STORY:

As a Zephyr RTOS user I want, from the kernel space, unconditioned access to kernel objects.
ZEP-SRS-8-4
4. Safely handle unimplemented calls or invalid system calls UID: ZEP-SRS-8-4 STATUS: Draft TYPE: Functional COMPONENT: Memory Protection RELATIONS (Parent): STATEMENT:

The Zephyr RTOS shall have a defined behaviour when an invocation of an unimplemented system call is made.

 USER_STORY:

As a Zephyr RTOS user I want Zephyr OS to indicate any unimplemented system call by an appropriate error message.
ZEP-SRS-8-5
5. Response to invalid system call IDs UID: ZEP-SRS-8-5 STATUS: Draft TYPE: Functional COMPONENT: Memory Protection RELATIONS (Parent): STATEMENT:

The Zephyr RTOS shall have a defined behaviour when an invalid system call ID is used.

 USER_STORY:

As a Zephyr RTOS user I want Zephyr OS to indicate invalid system call by an appropriate error message.
ZEP-SRS-8-6
6. Prevent user threads creating higher priority threads UID: ZEP-SRS-8-6 STATUS: Draft TYPE: Functional COMPONENT: Memory Protection RELATIONS (Parent): STATEMENT:

The Zephyr RTOS shall prevent user threads from creating new threads that are higher priority than the caller.
ZEP-SRS-8-7
7. Revoking threads permissions on a kernel object UID: ZEP-SRS-8-7 STATUS: Draft TYPE: Functional COMPONENT: Memory Protection RELATIONS (Parent): STATEMENT:

The Zephyr RTOS shall support revoking permission to a kernel object. User mode threads may only revoke their own access to an object.

 USER_STORY:

As a Zephyr RTOS user I want to be protected against other user threads changing access to kernel objects of my thread.
ZEP-SRS-8-8
8. Prevent user threads creating supervisor threads UID: ZEP-SRS-8-8 STATUS: Draft TYPE: Functional COMPONENT: Memory Protection RELATIONS (Parent): STATEMENT:

The Zephyr RTOS shall prevent user threads from creating kernel threads.

 USER_STORY:

As a Zephyr RTOS user I want to be protected against user threads creating higher privileged kernel/supervisor threads.
ZEP-SRS-8-9
9. Reduced Privilege Level Threads UID: ZEP-SRS-8-9 STATUS: Draft TYPE: Functional COMPONENT: Memory Protection RELATIONS (Parent): STATEMENT:

The Zephyr RTOS shall allow the creation of threads that run in reduced privilege level.

 USER_STORY:

As a Zephyr RTOS user I want to be able to create lower privileged threads than my own.
ZEP-SRS-8-10
10. User Mode Threads Performing Privileged Operations UID: ZEP-SRS-8-10 STATUS: Draft TYPE: Functional COMPONENT: Memory Protection RELATIONS (Parent): STATEMENT:

The Zephyr RTOS shall provide system calls to allow user mode threads to perform privileged operations.

 USER_STORY:

As a Zephyr RTOS user I want to be able to perform privileged operations in the kernel mode through a well defined interface.
ZEP-SRS-8-11
11. User mode handling of detected stack overflow UID: ZEP-SRS-8-11 STATUS: Draft TYPE: Functional COMPONENT: Memory Protection RELATIONS (Parent): STATEMENT:

The Zephyr RTOS shall support a defined mechanism for user mode handling a of detected stack overflow.

 USER_STORY:

As a Zephyr RTOS user I want, when a stack overflow is detected, to be able to implement a graceful, application defined handling of the exception.
ZEP-SRS-8-12
12. Stack Overflow Detection UID: ZEP-SRS-8-12 STATUS: Draft TYPE: Functional COMPONENT: Memory Protection RELATIONS (Parent): STATEMENT:

The Zephyr RTOS shall support detection of stack overflows.

 USER_STORY:

As a Zephyr RTOS user I want to get an indication when a stack overflow occurs at least during debugging / the development phase, and for safety applications also in a release version of my application.
ZEP-SRS-8-13
13. Boot Time Memory Access Policy UID: ZEP-SRS-8-13 STATUS: Draft TYPE: Functional COMPONENT: Memory Protection RELATIONS (Parent): STATEMENT:

The Zephyr RTOS shall support configurable access to memory during boot time.
ZEP-SRS-8-14
14. System Call Handler Functions UID: ZEP-SRS-8-14 STATUS: Draft TYPE: Functional COMPONENT: Memory Protection RELATIONS (Parent): STATEMENT:

The Zephyr RTOS shall provide helper functions for system call handler functions to validate the inputs passed in from user mode before invoking the implementation function to protect the kernel.

 USER_STORY:

As a Zephyr RTOS user I want Zepyhr OS to validate system call parameters passed from the user mode to the kernel mode to avoid crashes and undefined behaviour.
ZEP-SRS-8-15
15. System Call C strings in user mode UID: ZEP-SRS-8-15 STATUS: Draft TYPE: Functional COMPONENT: Memory Protection RELATIONS (Parent): STATEMENT:

The Zephyr RTOS shall support system calls to be able to safely accept C strings passed in from user mode.

 USER_STORY:

As a Zephyr RTOS user I want Zepyhr OS to validate system call string type parameters passed from the user mode to the kernel mode to avoid crashes and undefined behaviour.

e.g.

  • verify the string length is smaller or equal to the syscalls defined max.
  • verify that the length type does not overflow when allocating one more byte ???
ZEP-SRS-8-16
16. Tracking kernel objects in used by user mode threads UID: ZEP-SRS-8-16 STATUS: Draft TYPE: Functional COMPONENT: Memory Protection RELATIONS (Parent): STATEMENT:

The Zephyr RTOS shall track kernel objects that are used by user mode threads.

Note: this means Zephyr shall track the resources used by the user mode thread (associate this with a user story).
ZEP-SRS-8-17
17. Granting threads access to specific memory UID: ZEP-SRS-8-17 STATUS: Draft TYPE: Functional COMPONENT: Memory Protection RELATIONS (Parent): STATEMENT:

The Zephyr RTOS shall have an interface to request access to specific memory after initial allocation.

 USER_STORY:

As a Zephyr RTOS user I want to be able to request read-only or read-write access to a dedicated memory area/pool during runtime.
ZEP-SRS-8-18
18. Assigning memory pools to act as a thread resource pool UID: ZEP-SRS-8-18 STATUS: Draft TYPE: Functional COMPONENT: Memory Protection RELATIONS (Parent): STATEMENT:

The Zephyr RTOS shall support assigning a memory pool to act as that thread's resource pool.

 USER_STORY:

As a Zephyr RTOS user I want to be able, during runtime from the kernel, to request a memory area/pool which is exclusively available to the requesting thread protected against access from other threads.