target/riscv/pmp.c

   1 /*
   2  * QEMU RISC-V PMP (Physical Memory Protection)
   3  *
   4  * Author: Daire McNamara, daire.mcnamara@emdalo.com
   5  *         Ivan Griffin, ivan.griffin@emdalo.com
   6  *
   7  * This provides a RISC-V Physical Memory Protection implementation
   8  *
   9  * This program is free software; you can redistribute it and/or modify it
  10  * under the terms and conditions of the GNU General Public License,
  11  * version 2 or later, as published by the Free Software Foundation.
  12  *
  13  * This program is distributed in the hope it will be useful, but WITHOUT
  14  * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
  15  * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
  16  * more details.
  17  *
  18  * You should have received a copy of the GNU General Public License along with
  19  * this program.  If not, see <http://www.gnu.org/licenses/>.
  20  */
  21
  22 #include "qemu/osdep.h"
  23 #include "qemu/log.h"
  24 #include "qapi/error.h"
  25 #include "cpu.h"
  26 #include "trace.h"
  27 #include "exec/exec-all.h"
  28
  29 static void pmp_write_cfg(CPURISCVState *env, uint32_t addr_index,
  30                           uint8_t val);
  31 static uint8_t pmp_read_cfg(CPURISCVState *env, uint32_t addr_index);
  32 static void pmp_update_rule(CPURISCVState *env, uint32_t pmp_index);
  33
  34 /*
  35  * Accessor method to extract address matching type 'a field' from cfg reg
  36  */
  37 static inline uint8_t pmp_get_a_field(uint8_t cfg)
  38 {
  39     uint8_t a = cfg >> 3;
  40     return a & 0x3;
  41 }
  42
  43 /*
  44  * Check whether a PMP is locked or not.
  45  */
  46 static inline int pmp_is_locked(CPURISCVState *env, uint32_t pmp_index)
  47 {
  48
  49     if (env->pmp_state.pmp[pmp_index].cfg_reg & PMP_LOCK) {
  50         return 1;
  51     }
  52
  53     /* Top PMP has no 'next' to check */
  54     if ((pmp_index + 1u) >= MAX_RISCV_PMPS) {
  55         return 0;
  56     }
  57
  58     return 0;
  59 }
  60
  61 /*
  62  * Count the number of active rules.
  63  */
  64 uint32_t pmp_get_num_rules(CPURISCVState *env)
  65 {
  66      return env->pmp_state.num_rules;
  67 }
  68
  69 /*
  70  * Accessor to get the cfg reg for a specific PMP/HART
  71  */
  72 static inline uint8_t pmp_read_cfg(CPURISCVState *env, uint32_t pmp_index)
  73 {
  74     if (pmp_index < MAX_RISCV_PMPS) {
  75         return env->pmp_state.pmp[pmp_index].cfg_reg;
  76     }
  77
  78     return 0;
  79 }
  80
  81
  82 /*
  83  * Accessor to set the cfg reg for a specific PMP/HART
  84  * Bounds checks and relevant lock bit.
  85  */
  86 static void pmp_write_cfg(CPURISCVState *env, uint32_t pmp_index, uint8_t val)
  87 {
  88     if (pmp_index < MAX_RISCV_PMPS) {
  89         bool locked = true;
  90
  91         if (riscv_cpu_cfg(env)->epmp) {
  92             /* mseccfg.RLB is set */
  93             if (MSECCFG_RLB_ISSET(env)) {
  94                 locked = false;
  95             }
  96
  97             /* mseccfg.MML is not set */
  98             if (!MSECCFG_MML_ISSET(env) && !pmp_is_locked(env, pmp_index)) {
  99                 locked = false;
 100             }
 101
 102             /* mseccfg.MML is set */
 103             if (MSECCFG_MML_ISSET(env)) {
 104                 /* not adding execute bit */
 105                 if ((val & PMP_LOCK) != 0 && (val & PMP_EXEC) != PMP_EXEC) {
 106                     locked = false;
 107                 }
 108                 /* shared region and not adding X bit */
 109                 if ((val & PMP_LOCK) != PMP_LOCK &&
 110                     (val & 0x7) != (PMP_WRITE | PMP_EXEC)) {
 111                     locked = false;
 112                 }
 113             }
 114         } else {
 115             if (!pmp_is_locked(env, pmp_index)) {
 116                 locked = false;
 117             }
 118         }
 119
 120         if (locked) {
 121             qemu_log_mask(LOG_GUEST_ERROR, "ignoring pmpcfg write - locked\n");
 122         } else {
 123             env->pmp_state.pmp[pmp_index].cfg_reg = val;
 124             pmp_update_rule(env, pmp_index);
 125         }
 126     } else {
 127         qemu_log_mask(LOG_GUEST_ERROR,
 128                       "ignoring pmpcfg write - out of bounds\n");
 129     }
 130 }
 131
 132 static void pmp_decode_napot(target_ulong a, target_ulong *sa, target_ulong *ea)
 133 {
 134     /*
 135      * aaaa...aaa0   8-byte NAPOT range
 136      * aaaa...aa01   16-byte NAPOT range
 137      * aaaa...a011   32-byte NAPOT range
 138      * ...
 139      * aa01...1111   2^XLEN-byte NAPOT range
 140      * a011...1111   2^(XLEN+1)-byte NAPOT range
 141      * 0111...1111   2^(XLEN+2)-byte NAPOT range
 142      * 1111...1111   Reserved
 143      */
 144     a = (a << 2) | 0x3;
 145     *sa = a & (a + 1);
 146     *ea = a | (a + 1);
 147 }
 148
 149 void pmp_update_rule_addr(CPURISCVState *env, uint32_t pmp_index)
 150 {
 151     uint8_t this_cfg = env->pmp_state.pmp[pmp_index].cfg_reg;
 152     target_ulong this_addr = env->pmp_state.pmp[pmp_index].addr_reg;
 153     target_ulong prev_addr = 0u;
 154     target_ulong sa = 0u;
 155     target_ulong ea = 0u;
 156
 157     if (pmp_index >= 1u) {
 158         prev_addr = env->pmp_state.pmp[pmp_index - 1].addr_reg;
 159     }
 160
 161     switch (pmp_get_a_field(this_cfg)) {
 162     case PMP_AMATCH_OFF:
 163         sa = 0u;
 164         ea = -1;
 165         break;
 166
 167     case PMP_AMATCH_TOR:
 168         sa = prev_addr << 2; /* shift up from [xx:0] to [xx+2:2] */
 169         ea = (this_addr << 2) - 1u;
 170         if (sa > ea) {
 171             sa = ea = 0u;
 172         }
 173         break;
 174
 175     case PMP_AMATCH_NA4:
 176         sa = this_addr << 2; /* shift up from [xx:0] to [xx+2:2] */
 177         ea = (sa + 4u) - 1u;
 178         break;
 179
 180     case PMP_AMATCH_NAPOT:
 181         pmp_decode_napot(this_addr, &sa, &ea);
 182         break;
 183
 184     default:
 185         sa = 0u;
 186         ea = 0u;
 187         break;
 188     }
 189
 190     env->pmp_state.addr[pmp_index].sa = sa;
 191     env->pmp_state.addr[pmp_index].ea = ea;
 192 }
 193
 194 void pmp_update_rule_nums(CPURISCVState *env)
 195 {
 196     int i;
 197
 198     env->pmp_state.num_rules = 0;
 199     for (i = 0; i < MAX_RISCV_PMPS; i++) {
 200         const uint8_t a_field =
 201             pmp_get_a_field(env->pmp_state.pmp[i].cfg_reg);
 202         if (PMP_AMATCH_OFF != a_field) {
 203             env->pmp_state.num_rules++;
 204         }
 205     }
 206 }
 207
 208 /*
 209  * Convert cfg/addr reg values here into simple 'sa' --> start address and 'ea'
 210  *   end address values.
 211  *   This function is called relatively infrequently whereas the check that
 212  *   an address is within a pmp rule is called often, so optimise that one
 213  */
 214 static void pmp_update_rule(CPURISCVState *env, uint32_t pmp_index)
 215 {
 216     pmp_update_rule_addr(env, pmp_index);
 217     pmp_update_rule_nums(env);
 218 }
 219
 220 static int pmp_is_in_range(CPURISCVState *env, int pmp_index, target_ulong addr)
 221 {
 222     int result = 0;
 223
 224     if ((addr >= env->pmp_state.addr[pmp_index].sa) &&
 225         (addr <= env->pmp_state.addr[pmp_index].ea)) {
 226         result = 1;
 227     } else {
 228         result = 0;
 229     }
 230
 231     return result;
 232 }
 233
 234 /*
 235  * Check if the address has required RWX privs when no PMP entry is matched.
 236  */
 237 static bool pmp_hart_has_privs_default(CPURISCVState *env, target_ulong addr,
 238                                        target_ulong size, pmp_priv_t privs,
 239                                        pmp_priv_t *allowed_privs,
 240                                        target_ulong mode)
 241 {
 242     bool ret;
 243
 244     if (riscv_cpu_cfg(env)->epmp) {
 245         if (MSECCFG_MMWP_ISSET(env)) {
 246             /*
 247              * The Machine Mode Whitelist Policy (mseccfg.MMWP) is set
 248              * so we default to deny all, even for M-mode.
 249              */
 250             *allowed_privs = 0;
 251             return false;
 252         } else if (MSECCFG_MML_ISSET(env)) {
 253             /*
 254              * The Machine Mode Lockdown (mseccfg.MML) bit is set
 255              * so we can only execute code in M-mode with an applicable
 256              * rule. Other modes are disabled.
 257              */
 258             if (mode == PRV_M && !(privs & PMP_EXEC)) {
 259                 ret = true;
 260                 *allowed_privs = PMP_READ | PMP_WRITE;
 261             } else {
 262                 ret = false;
 263                 *allowed_privs = 0;
 264             }
 265
 266             return ret;
 267         }
 268     }
 269
 270     if (!riscv_cpu_cfg(env)->pmp || (mode == PRV_M)) {
 271         /*
 272          * Privileged spec v1.10 states if HW doesn't implement any PMP entry
 273          * or no PMP entry matches an M-Mode access, the access succeeds.
 274          */
 275         ret = true;
 276         *allowed_privs = PMP_READ | PMP_WRITE | PMP_EXEC;
 277     } else {
 278         /*
 279          * Other modes are not allowed to succeed if they don't * match a rule,
 280          * but there are rules. We've checked for no rule earlier in this
 281          * function.
 282          */
 283         ret = false;
 284         *allowed_privs = 0;
 285     }
 286
 287     return ret;
 288 }
 289
 290
 291 /*
 292  * Public Interface
 293  */
 294
 295 /*
 296  * Check if the address has required RWX privs to complete desired operation
 297  * Return PMP rule index if a pmp rule match
 298  * Return MAX_RISCV_PMPS if default match
 299  * Return negtive value if no match
 300  */
 301 int pmp_hart_has_privs(CPURISCVState *env, target_ulong addr,
 302                        target_ulong size, pmp_priv_t privs,
 303                        pmp_priv_t *allowed_privs, target_ulong mode)
 304 {
 305     int i = 0;
 306     int ret = -1;
 307     int pmp_size = 0;
 308     target_ulong s = 0;
 309     target_ulong e = 0;
 310
 311     /* Short cut if no rules */
 312     if (0 == pmp_get_num_rules(env)) {
 313         if (pmp_hart_has_privs_default(env, addr, size, privs,
 314                                        allowed_privs, mode)) {
 315             ret = MAX_RISCV_PMPS;
 316         }
 317     }
 318
 319     if (size == 0) {
 320         if (riscv_cpu_cfg(env)->mmu) {
 321             /*
 322              * If size is unknown (0), assume that all bytes
 323              * from addr to the end of the page will be accessed.
 324              */
 325             pmp_size = -(addr | TARGET_PAGE_MASK);
 326         } else {
 327             pmp_size = sizeof(target_ulong);
 328         }
 329     } else {
 330         pmp_size = size;
 331     }
 332
 333     /*
 334      * 1.10 draft priv spec states there is an implicit order
 335      * from low to high
 336      */
 337     for (i = 0; i < MAX_RISCV_PMPS; i++) {
 338         s = pmp_is_in_range(env, i, addr);
 339         e = pmp_is_in_range(env, i, addr + pmp_size - 1);
 340
 341         /* partially inside */
 342         if ((s + e) == 1) {
 343             qemu_log_mask(LOG_GUEST_ERROR,
 344                           "pmp violation - access is partially inside\n");
 345             ret = -1;
 346             break;
 347         }
 348
 349         /* fully inside */
 350         const uint8_t a_field =
 351             pmp_get_a_field(env->pmp_state.pmp[i].cfg_reg);
 352
 353         /*
 354          * Convert the PMP permissions to match the truth table in the
 355          * ePMP spec.
 356          */
 357         const uint8_t epmp_operation =
 358             ((env->pmp_state.pmp[i].cfg_reg & PMP_LOCK) >> 4) |
 359             ((env->pmp_state.pmp[i].cfg_reg & PMP_READ) << 2) |
 360             (env->pmp_state.pmp[i].cfg_reg & PMP_WRITE) |
 361             ((env->pmp_state.pmp[i].cfg_reg & PMP_EXEC) >> 2);
 362
 363         if (((s + e) == 2) && (PMP_AMATCH_OFF != a_field)) {
 364             /*
 365              * If the PMP entry is not off and the address is in range,
 366              * do the priv check
 367              */
 368             if (!MSECCFG_MML_ISSET(env)) {
 369                 /*
 370                  * If mseccfg.MML Bit is not set, do pmp priv check
 371                  * This will always apply to regular PMP.
 372                  */
 373                 *allowed_privs = PMP_READ | PMP_WRITE | PMP_EXEC;
 374                 if ((mode != PRV_M) || pmp_is_locked(env, i)) {
 375                     *allowed_privs &= env->pmp_state.pmp[i].cfg_reg;
 376                 }
 377             } else {
 378                 /*
 379                  * If mseccfg.MML Bit set, do the enhanced pmp priv check
 380                  */
 381                 if (mode == PRV_M) {
 382                     switch (epmp_operation) {
 383                     case 0:
 384                     case 1:
 385                     case 4:
 386                     case 5:
 387                     case 6:
 388                     case 7:
 389                     case 8:
 390                         *allowed_privs = 0;
 391                         break;
 392                     case 2:
 393                     case 3:
 394                     case 14:
 395                         *allowed_privs = PMP_READ | PMP_WRITE;
 396                         break;
 397                     case 9:
 398                     case 10:
 399                         *allowed_privs = PMP_EXEC;
 400                         break;
 401                     case 11:
 402                     case 13:
 403                         *allowed_privs = PMP_READ | PMP_EXEC;
 404                         break;
 405                     case 12:
 406                     case 15:
 407                         *allowed_privs = PMP_READ;
 408                         break;
 409                     default:
 410                         g_assert_not_reached();
 411                     }
 412                 } else {
 413                     switch (epmp_operation) {
 414                     case 0:
 415                     case 8:
 416                     case 9:
 417                     case 12:
 418                     case 13:
 419                     case 14:
 420                         *allowed_privs = 0;
 421                         break;
 422                     case 1:
 423                     case 10:
 424                     case 11:
 425                         *allowed_privs = PMP_EXEC;
 426                         break;
 427                     case 2:
 428                     case 4:
 429                     case 15:
 430                         *allowed_privs = PMP_READ;
 431                         break;
 432                     case 3:
 433                     case 6:
 434                         *allowed_privs = PMP_READ | PMP_WRITE;
 435                         break;
 436                     case 5:
 437                         *allowed_privs = PMP_READ | PMP_EXEC;
 438                         break;
 439                     case 7:
 440                         *allowed_privs = PMP_READ | PMP_WRITE | PMP_EXEC;
 441                         break;
 442                     default:
 443                         g_assert_not_reached();
 444                     }
 445                 }
 446             }
 447
 448             /*
 449              * If matching address range was found, the protection bits
 450              * defined with PMP must be used. We shouldn't fallback on
 451              * finding default privileges.
 452              */
 453             ret = i;
 454             break;
 455         }
 456     }
 457
 458     /* No rule matched */
 459     if (ret == -1) {
 460         if (pmp_hart_has_privs_default(env, addr, size, privs,
 461                                        allowed_privs, mode)) {
 462             ret = MAX_RISCV_PMPS;
 463         }
 464     }
 465
 466     return ret;
 467 }
 468
 469 /*
 470  * Handle a write to a pmpcfg CSR
 471  */
 472 void pmpcfg_csr_write(CPURISCVState *env, uint32_t reg_index,
 473                       target_ulong val)
 474 {
 475     int i;
 476     uint8_t cfg_val;
 477     int pmpcfg_nums = 2 << riscv_cpu_mxl(env);
 478
 479     trace_pmpcfg_csr_write(env->mhartid, reg_index, val);
 480
 481     for (i = 0; i < pmpcfg_nums; i++) {
 482         cfg_val = (val >> 8 * i)  & 0xff;
 483         pmp_write_cfg(env, (reg_index * 4) + i, cfg_val);
 484     }
 485
 486     /* If PMP permission of any addr has been changed, flush TLB pages. */
 487     tlb_flush(env_cpu(env));
 488 }
 489
 490
 491 /*
 492  * Handle a read from a pmpcfg CSR
 493  */
 494 target_ulong pmpcfg_csr_read(CPURISCVState *env, uint32_t reg_index)
 495 {
 496     int i;
 497     target_ulong cfg_val = 0;
 498     target_ulong val = 0;
 499     int pmpcfg_nums = 2 << riscv_cpu_mxl(env);
 500
 501     for (i = 0; i < pmpcfg_nums; i++) {
 502         val = pmp_read_cfg(env, (reg_index * 4) + i);
 503         cfg_val |= (val << (i * 8));
 504     }
 505     trace_pmpcfg_csr_read(env->mhartid, reg_index, cfg_val);
 506
 507     return cfg_val;
 508 }
 509
 510
 511 /*
 512  * Handle a write to a pmpaddr CSR
 513  */
 514 void pmpaddr_csr_write(CPURISCVState *env, uint32_t addr_index,
 515                        target_ulong val)
 516 {
 517     trace_pmpaddr_csr_write(env->mhartid, addr_index, val);
 518
 519     if (addr_index < MAX_RISCV_PMPS) {
 520         /*
 521          * In TOR mode, need to check the lock bit of the next pmp
 522          * (if there is a next).
 523          */
 524         if (addr_index + 1 < MAX_RISCV_PMPS) {
 525             uint8_t pmp_cfg = env->pmp_state.pmp[addr_index + 1].cfg_reg;
 526
 527             if (pmp_cfg & PMP_LOCK &&
 528                 PMP_AMATCH_TOR == pmp_get_a_field(pmp_cfg)) {
 529                 qemu_log_mask(LOG_GUEST_ERROR,
 530                               "ignoring pmpaddr write - pmpcfg + 1 locked\n");
 531                 return;
 532             }
 533         }
 534
 535         if (!pmp_is_locked(env, addr_index)) {
 536             env->pmp_state.pmp[addr_index].addr_reg = val;
 537             pmp_update_rule(env, addr_index);
 538         } else {
 539             qemu_log_mask(LOG_GUEST_ERROR,
 540                           "ignoring pmpaddr write - locked\n");
 541         }
 542     } else {
 543         qemu_log_mask(LOG_GUEST_ERROR,
 544                       "ignoring pmpaddr write - out of bounds\n");
 545     }
 546 }
 547
 548
 549 /*
 550  * Handle a read from a pmpaddr CSR
 551  */
 552 target_ulong pmpaddr_csr_read(CPURISCVState *env, uint32_t addr_index)
 553 {
 554     target_ulong val = 0;
 555
 556     if (addr_index < MAX_RISCV_PMPS) {
 557         val = env->pmp_state.pmp[addr_index].addr_reg;
 558         trace_pmpaddr_csr_read(env->mhartid, addr_index, val);
 559     } else {
 560         qemu_log_mask(LOG_GUEST_ERROR,
 561                       "ignoring pmpaddr read - out of bounds\n");
 562     }
 563
 564     return val;
 565 }
 566
 567 /*
 568  * Handle a write to a mseccfg CSR
 569  */
 570 void mseccfg_csr_write(CPURISCVState *env, target_ulong val)
 571 {
 572     int i;
 573
 574     trace_mseccfg_csr_write(env->mhartid, val);
 575
 576     /* RLB cannot be enabled if it's already 0 and if any regions are locked */
 577     if (!MSECCFG_RLB_ISSET(env)) {
 578         for (i = 0; i < MAX_RISCV_PMPS; i++) {
 579             if (pmp_is_locked(env, i)) {
 580                 val &= ~MSECCFG_RLB;
 581                 break;
 582             }
 583         }
 584     }
 585
 586     /* Sticky bits */
 587     val |= (env->mseccfg & (MSECCFG_MMWP | MSECCFG_MML));
 588
 589     env->mseccfg = val;
 590 }
 591
 592 /*
 593  * Handle a read from a mseccfg CSR
 594  */
 595 target_ulong mseccfg_csr_read(CPURISCVState *env)
 596 {
 597     trace_mseccfg_csr_read(env->mhartid, env->mseccfg);
 598     return env->mseccfg;
 599 }
 600
 601 /*
 602  * Calculate the TLB size if the start address or the end address of
 603  * PMP entry is presented in the TLB page.
 604  */
 605 target_ulong pmp_get_tlb_size(CPURISCVState *env, int pmp_index,
 606                               target_ulong tlb_sa, target_ulong tlb_ea)
 607 {
 608     target_ulong pmp_sa = env->pmp_state.addr[pmp_index].sa;
 609     target_ulong pmp_ea = env->pmp_state.addr[pmp_index].ea;
 610
 611     if (pmp_sa <= tlb_sa && pmp_ea >= tlb_ea) {
 612         return TARGET_PAGE_SIZE;
 613     } else {
 614         /*
 615          * At this point we have a tlb_size that is the smallest possible size
 616          * That fits within a TARGET_PAGE_SIZE and the PMP region.
 617          *
 618          * If the size is less then TARGET_PAGE_SIZE we drop the size to 1.
 619          * This means the result isn't cached in the TLB and is only used for
 620          * a single translation.
 621          */
 622         return 1;
 623     }
 624 }
 625
 626 /*
 627  * Convert PMP privilege to TLB page privilege.
 628  */
 629 int pmp_priv_to_page_prot(pmp_priv_t pmp_priv)
 630 {
 631     int prot = 0;
 632
 633     if (pmp_priv & PMP_READ) {
 634         prot |= PAGE_READ;
 635     }
 636     if (pmp_priv & PMP_WRITE) {
 637         prot |= PAGE_WRITE;
 638     }
 639     if (pmp_priv & PMP_EXEC) {
 640         prot |= PAGE_EXEC;
 641     }
 642
 643     return prot;
 644 }