target/riscv/pmp.c

   1 /*
   2  * QEMU RISC-V PMP (Physical Memory Protection)
   3  *
   4  * Author: Daire McNamara, daire.mcnamara@emdalo.com
   5  *         Ivan Griffin, ivan.griffin@emdalo.com
   6  *
   7  * This provides a RISC-V Physical Memory Protection implementation
   8  *
   9  * This program is free software; you can redistribute it and/or modify it
  10  * under the terms and conditions of the GNU General Public License,
  11  * version 2 or later, as published by the Free Software Foundation.
  12  *
  13  * This program is distributed in the hope it will be useful, but WITHOUT
  14  * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
  15  * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
  16  * more details.
  17  *
  18  * You should have received a copy of the GNU General Public License along with
  19  * this program.  If not, see <http://www.gnu.org/licenses/>.
  20  */
  21
  22 /*
  23  * PMP (Physical Memory Protection) is as-of-yet unused and needs testing.
  24  */
  25
  26 #include "qemu/osdep.h"
  27 #include "qemu/log.h"
  28 #include "qapi/error.h"
  29 #include "cpu.h"
  30 #include "trace.h"
  31 #include "exec/exec-all.h"
  32
  33 static void pmp_write_cfg(CPURISCVState *env, uint32_t addr_index,
  34     uint8_t val);
  35 static uint8_t pmp_read_cfg(CPURISCVState *env, uint32_t addr_index);
  36 static void pmp_update_rule(CPURISCVState *env, uint32_t pmp_index);
  37
  38 /*
  39  * Accessor method to extract address matching type 'a field' from cfg reg
  40  */
  41 static inline uint8_t pmp_get_a_field(uint8_t cfg)
  42 {
  43     uint8_t a = cfg >> 3;
  44     return a & 0x3;
  45 }
  46
  47 /*
  48  * Check whether a PMP is locked or not.
  49  */
  50 static inline int pmp_is_locked(CPURISCVState *env, uint32_t pmp_index)
  51 {
  52
  53     if (env->pmp_state.pmp[pmp_index].cfg_reg & PMP_LOCK) {
  54         return 1;
  55     }
  56
  57     /* Top PMP has no 'next' to check */
  58     if ((pmp_index + 1u) >= MAX_RISCV_PMPS) {
  59         return 0;
  60     }
  61
  62     /* In TOR mode, need to check the lock bit of the next pmp
  63      * (if there is a next)
  64      */
  65     const uint8_t a_field =
  66         pmp_get_a_field(env->pmp_state.pmp[pmp_index + 1].cfg_reg);
  67     if ((env->pmp_state.pmp[pmp_index + 1u].cfg_reg & PMP_LOCK) &&
  68          (PMP_AMATCH_TOR == a_field)) {
  69         return 1;
  70     }
  71
  72     return 0;
  73 }
  74
  75 /*
  76  * Count the number of active rules.
  77  */
  78 uint32_t pmp_get_num_rules(CPURISCVState *env)
  79 {
  80      return env->pmp_state.num_rules;
  81 }
  82
  83 /*
  84  * Accessor to get the cfg reg for a specific PMP/HART
  85  */
  86 static inline uint8_t pmp_read_cfg(CPURISCVState *env, uint32_t pmp_index)
  87 {
  88     if (pmp_index < MAX_RISCV_PMPS) {
  89         return env->pmp_state.pmp[pmp_index].cfg_reg;
  90     }
  91
  92     return 0;
  93 }
  94
  95
  96 /*
  97  * Accessor to set the cfg reg for a specific PMP/HART
  98  * Bounds checks and relevant lock bit.
  99  */
 100 static void pmp_write_cfg(CPURISCVState *env, uint32_t pmp_index, uint8_t val)
 101 {
 102     if (pmp_index < MAX_RISCV_PMPS) {
 103         if (!pmp_is_locked(env, pmp_index)) {
 104             env->pmp_state.pmp[pmp_index].cfg_reg = val;
 105             pmp_update_rule(env, pmp_index);
 106         } else {
 107             qemu_log_mask(LOG_GUEST_ERROR, "ignoring pmpcfg write - locked\n");
 108         }
 109     } else {
 110         qemu_log_mask(LOG_GUEST_ERROR,
 111                       "ignoring pmpcfg write - out of bounds\n");
 112     }
 113 }
 114
 115 static void pmp_decode_napot(target_ulong a, target_ulong *sa, target_ulong *ea)
 116 {
 117     /*
 118        aaaa...aaa0   8-byte NAPOT range
 119        aaaa...aa01   16-byte NAPOT range
 120        aaaa...a011   32-byte NAPOT range
 121        ...
 122        aa01...1111   2^XLEN-byte NAPOT range
 123        a011...1111   2^(XLEN+1)-byte NAPOT range
 124        0111...1111   2^(XLEN+2)-byte NAPOT range
 125        1111...1111   Reserved
 126     */
 127     if (a == -1) {
 128         *sa = 0u;
 129         *ea = -1;
 130         return;
 131     } else {
 132         target_ulong t1 = ctz64(~a);
 133         target_ulong base = (a & ~(((target_ulong)1 << t1) - 1)) << 2;
 134         target_ulong range = ((target_ulong)1 << (t1 + 3)) - 1;
 135         *sa = base;
 136         *ea = base + range;
 137     }
 138 }
 139
 140 void pmp_update_rule_addr(CPURISCVState *env, uint32_t pmp_index)
 141 {
 142     uint8_t this_cfg = env->pmp_state.pmp[pmp_index].cfg_reg;
 143     target_ulong this_addr = env->pmp_state.pmp[pmp_index].addr_reg;
 144     target_ulong prev_addr = 0u;
 145     target_ulong sa = 0u;
 146     target_ulong ea = 0u;
 147
 148     if (pmp_index >= 1u) {
 149         prev_addr = env->pmp_state.pmp[pmp_index - 1].addr_reg;
 150     }
 151
 152     switch (pmp_get_a_field(this_cfg)) {
 153     case PMP_AMATCH_OFF:
 154         sa = 0u;
 155         ea = -1;
 156         break;
 157
 158     case PMP_AMATCH_TOR:
 159         sa = prev_addr << 2; /* shift up from [xx:0] to [xx+2:2] */
 160         ea = (this_addr << 2) - 1u;
 161         break;
 162
 163     case PMP_AMATCH_NA4:
 164         sa = this_addr << 2; /* shift up from [xx:0] to [xx+2:2] */
 165         ea = (sa + 4u) - 1u;
 166         break;
 167
 168     case PMP_AMATCH_NAPOT:
 169         pmp_decode_napot(this_addr, &sa, &ea);
 170         break;
 171
 172     default:
 173         sa = 0u;
 174         ea = 0u;
 175         break;
 176     }
 177
 178     env->pmp_state.addr[pmp_index].sa = sa;
 179     env->pmp_state.addr[pmp_index].ea = ea;
 180 }
 181
 182 void pmp_update_rule_nums(CPURISCVState *env)
 183 {
 184     int i;
 185
 186     env->pmp_state.num_rules = 0;
 187     for (i = 0; i < MAX_RISCV_PMPS; i++) {
 188         const uint8_t a_field =
 189             pmp_get_a_field(env->pmp_state.pmp[i].cfg_reg);
 190         if (PMP_AMATCH_OFF != a_field) {
 191             env->pmp_state.num_rules++;
 192         }
 193     }
 194 }
 195
 196 /* Convert cfg/addr reg values here into simple 'sa' --> start address and 'ea'
 197  *   end address values.
 198  *   This function is called relatively infrequently whereas the check that
 199  *   an address is within a pmp rule is called often, so optimise that one
 200  */
 201 static void pmp_update_rule(CPURISCVState *env, uint32_t pmp_index)
 202 {
 203     pmp_update_rule_addr(env, pmp_index);
 204     pmp_update_rule_nums(env);
 205 }
 206
 207 static int pmp_is_in_range(CPURISCVState *env, int pmp_index, target_ulong addr)
 208 {
 209     int result = 0;
 210
 211     if ((addr >= env->pmp_state.addr[pmp_index].sa)
 212         && (addr <= env->pmp_state.addr[pmp_index].ea)) {
 213         result = 1;
 214     } else {
 215         result = 0;
 216     }
 217
 218     return result;
 219 }
 220
 221 /*
 222  * Check if the address has required RWX privs when no PMP entry is matched.
 223  */
 224 static bool pmp_hart_has_privs_default(CPURISCVState *env, target_ulong addr,
 225     target_ulong size, pmp_priv_t privs, pmp_priv_t *allowed_privs,
 226     target_ulong mode)
 227 {
 228     bool ret;
 229
 230     if ((!riscv_feature(env, RISCV_FEATURE_PMP)) || (mode == PRV_M)) {
 231         /*
 232          * Privileged spec v1.10 states if HW doesn't implement any PMP entry
 233          * or no PMP entry matches an M-Mode access, the access succeeds.
 234          */
 235         ret = true;
 236         *allowed_privs = PMP_READ | PMP_WRITE | PMP_EXEC;
 237     } else {
 238         /*
 239          * Other modes are not allowed to succeed if they don't * match a rule,
 240          * but there are rules. We've checked for no rule earlier in this
 241          * function.
 242          */
 243         ret = false;
 244         *allowed_privs = 0;
 245     }
 246
 247     return ret;
 248 }
 249
 250
 251 /*
 252  * Public Interface
 253  */
 254
 255 /*
 256  * Check if the address has required RWX privs to complete desired operation
 257  */
 258 bool pmp_hart_has_privs(CPURISCVState *env, target_ulong addr,
 259     target_ulong size, pmp_priv_t privs, pmp_priv_t *allowed_privs,
 260     target_ulong mode)
 261 {
 262     int i = 0;
 263     int ret = -1;
 264     int pmp_size = 0;
 265     target_ulong s = 0;
 266     target_ulong e = 0;
 267
 268     /* Short cut if no rules */
 269     if (0 == pmp_get_num_rules(env)) {
 270         return pmp_hart_has_privs_default(env, addr, size, privs,
 271                                           allowed_privs, mode);
 272     }
 273
 274     if (size == 0) {
 275         if (riscv_feature(env, RISCV_FEATURE_MMU)) {
 276             /*
 277              * If size is unknown (0), assume that all bytes
 278              * from addr to the end of the page will be accessed.
 279              */
 280             pmp_size = -(addr | TARGET_PAGE_MASK);
 281         } else {
 282             pmp_size = sizeof(target_ulong);
 283         }
 284     } else {
 285         pmp_size = size;
 286     }
 287
 288     /* 1.10 draft priv spec states there is an implicit order
 289          from low to high */
 290     for (i = 0; i < MAX_RISCV_PMPS; i++) {
 291         s = pmp_is_in_range(env, i, addr);
 292         e = pmp_is_in_range(env, i, addr + pmp_size - 1);
 293
 294         /* partially inside */
 295         if ((s + e) == 1) {
 296             qemu_log_mask(LOG_GUEST_ERROR,
 297                           "pmp violation - access is partially inside\n");
 298             ret = 0;
 299             break;
 300         }
 301
 302         /* fully inside */
 303         const uint8_t a_field =
 304             pmp_get_a_field(env->pmp_state.pmp[i].cfg_reg);
 305
 306         /*
 307          * If the PMP entry is not off and the address is in range, do the priv
 308          * check
 309          */
 310         if (((s + e) == 2) && (PMP_AMATCH_OFF != a_field)) {
 311             *allowed_privs = PMP_READ | PMP_WRITE | PMP_EXEC;
 312             if ((mode != PRV_M) || pmp_is_locked(env, i)) {
 313                 *allowed_privs &= env->pmp_state.pmp[i].cfg_reg;
 314             }
 315
 316             ret = ((privs & *allowed_privs) == privs);
 317             break;
 318         }
 319     }
 320
 321     /* No rule matched */
 322     if (ret == -1) {
 323         return pmp_hart_has_privs_default(env, addr, size, privs,
 324                                           allowed_privs, mode);
 325     }
 326
 327     return ret == 1 ? true : false;
 328 }
 329
 330 /*
 331  * Handle a write to a pmpcfg CSP
 332  */
 333 void pmpcfg_csr_write(CPURISCVState *env, uint32_t reg_index,
 334     target_ulong val)
 335 {
 336     int i;
 337     uint8_t cfg_val;
 338
 339     trace_pmpcfg_csr_write(env->mhartid, reg_index, val);
 340
 341     if ((reg_index & 1) && (sizeof(target_ulong) == 8)) {
 342         qemu_log_mask(LOG_GUEST_ERROR,
 343                       "ignoring pmpcfg write - incorrect address\n");
 344         return;
 345     }
 346
 347     for (i = 0; i < sizeof(target_ulong); i++) {
 348         cfg_val = (val >> 8 * i)  & 0xff;
 349         pmp_write_cfg(env, (reg_index * 4) + i, cfg_val);
 350     }
 351
 352     /* If PMP permission of any addr has been changed, flush TLB pages. */
 353     tlb_flush(env_cpu(env));
 354 }
 355
 356
 357 /*
 358  * Handle a read from a pmpcfg CSP
 359  */
 360 target_ulong pmpcfg_csr_read(CPURISCVState *env, uint32_t reg_index)
 361 {
 362     int i;
 363     target_ulong cfg_val = 0;
 364     target_ulong val = 0;
 365
 366     for (i = 0; i < sizeof(target_ulong); i++) {
 367         val = pmp_read_cfg(env, (reg_index * 4) + i);
 368         cfg_val |= (val << (i * 8));
 369     }
 370     trace_pmpcfg_csr_read(env->mhartid, reg_index, cfg_val);
 371
 372     return cfg_val;
 373 }
 374
 375
 376 /*
 377  * Handle a write to a pmpaddr CSP
 378  */
 379 void pmpaddr_csr_write(CPURISCVState *env, uint32_t addr_index,
 380     target_ulong val)
 381 {
 382     trace_pmpaddr_csr_write(env->mhartid, addr_index, val);
 383     if (addr_index < MAX_RISCV_PMPS) {
 384         if (!pmp_is_locked(env, addr_index)) {
 385             env->pmp_state.pmp[addr_index].addr_reg = val;
 386             pmp_update_rule(env, addr_index);
 387         } else {
 388             qemu_log_mask(LOG_GUEST_ERROR,
 389                           "ignoring pmpaddr write - locked\n");
 390         }
 391     } else {
 392         qemu_log_mask(LOG_GUEST_ERROR,
 393                       "ignoring pmpaddr write - out of bounds\n");
 394     }
 395 }
 396
 397
 398 /*
 399  * Handle a read from a pmpaddr CSP
 400  */
 401 target_ulong pmpaddr_csr_read(CPURISCVState *env, uint32_t addr_index)
 402 {
 403     target_ulong val = 0;
 404
 405     if (addr_index < MAX_RISCV_PMPS) {
 406         val = env->pmp_state.pmp[addr_index].addr_reg;
 407         trace_pmpaddr_csr_read(env->mhartid, addr_index, val);
 408     } else {
 409         qemu_log_mask(LOG_GUEST_ERROR,
 410                       "ignoring pmpaddr read - out of bounds\n");
 411     }
 412
 413     return val;
 414 }
 415
 416 /*
 417  * Calculate the TLB size if the start address or the end address of
 418  * PMP entry is presented in thie TLB page.
 419  */
 420 static target_ulong pmp_get_tlb_size(CPURISCVState *env, int pmp_index,
 421                                      target_ulong tlb_sa, target_ulong tlb_ea)
 422 {
 423     target_ulong pmp_sa = env->pmp_state.addr[pmp_index].sa;
 424     target_ulong pmp_ea = env->pmp_state.addr[pmp_index].ea;
 425
 426     if (pmp_sa >= tlb_sa && pmp_ea <= tlb_ea) {
 427         return pmp_ea - pmp_sa + 1;
 428     }
 429
 430     if (pmp_sa >= tlb_sa && pmp_sa <= tlb_ea && pmp_ea >= tlb_ea) {
 431         return tlb_ea - pmp_sa + 1;
 432     }
 433
 434     if (pmp_ea <= tlb_ea && pmp_ea >= tlb_sa && pmp_sa <= tlb_sa) {
 435         return pmp_ea - tlb_sa + 1;
 436     }
 437
 438     return 0;
 439 }
 440
 441 /*
 442  * Check is there a PMP entry which range covers this page. If so,
 443  * try to find the minimum granularity for the TLB size.
 444  */
 445 bool pmp_is_range_in_tlb(CPURISCVState *env, hwaddr tlb_sa,
 446                          target_ulong *tlb_size)
 447 {
 448     int i;
 449     target_ulong val;
 450     target_ulong tlb_ea = (tlb_sa + TARGET_PAGE_SIZE - 1);
 451
 452     for (i = 0; i < MAX_RISCV_PMPS; i++) {
 453         val = pmp_get_tlb_size(env, i, tlb_sa, tlb_ea);
 454         if (val) {
 455             if (*tlb_size == 0 || *tlb_size > val) {
 456                 *tlb_size = val;
 457             }
 458         }
 459     }
 460
 461     if (*tlb_size != 0) {
 462         return true;
 463     }
 464
 465     return false;
 466 }
 467
 468 /*
 469  * Convert PMP privilege to TLB page privilege.
 470  */
 471 int pmp_priv_to_page_prot(pmp_priv_t pmp_priv)
 472 {
 473     int prot = 0;
 474
 475     if (pmp_priv & PMP_READ) {
 476         prot |= PAGE_READ;
 477     }
 478     if (pmp_priv & PMP_WRITE) {
 479         prot |= PAGE_WRITE;
 480     }
 481     if (pmp_priv & PMP_EXEC) {
 482         prot |= PAGE_EXEC;
 483     }
 484
 485     return prot;
 486 }