target/riscv/pmp.c

   1 /*
   2  * QEMU RISC-V PMP (Physical Memory Protection)
   3  *
   4  * Author: Daire McNamara, daire.mcnamara@emdalo.com
   5  *         Ivan Griffin, ivan.griffin@emdalo.com
   6  *
   7  * This provides a RISC-V Physical Memory Protection implementation
   8  *
   9  * This program is free software; you can redistribute it and/or modify it
  10  * under the terms and conditions of the GNU General Public License,
  11  * version 2 or later, as published by the Free Software Foundation.
  12  *
  13  * This program is distributed in the hope it will be useful, but WITHOUT
  14  * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
  15  * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
  16  * more details.
  17  *
  18  * You should have received a copy of the GNU General Public License along with
  19  * this program.  If not, see <http://www.gnu.org/licenses/>.
  20  */
  21
  22 #include "qemu/osdep.h"
  23 #include "qemu/log.h"
  24 #include "qapi/error.h"
  25 #include "cpu.h"
  26 #include "trace.h"
  27 #include "exec/exec-all.h"
  28
  29 static void pmp_write_cfg(CPURISCVState *env, uint32_t addr_index,
  30     uint8_t val);
  31 static uint8_t pmp_read_cfg(CPURISCVState *env, uint32_t addr_index);
  32 static void pmp_update_rule(CPURISCVState *env, uint32_t pmp_index);
  33
  34 /*
  35  * Accessor method to extract address matching type 'a field' from cfg reg
  36  */
  37 static inline uint8_t pmp_get_a_field(uint8_t cfg)
  38 {
  39     uint8_t a = cfg >> 3;
  40     return a & 0x3;
  41 }
  42
  43 /*
  44  * Check whether a PMP is locked or not.
  45  */
  46 static inline int pmp_is_locked(CPURISCVState *env, uint32_t pmp_index)
  47 {
  48
  49     if (env->pmp_state.pmp[pmp_index].cfg_reg & PMP_LOCK) {
  50         return 1;
  51     }
  52
  53     /* Top PMP has no 'next' to check */
  54     if ((pmp_index + 1u) >= MAX_RISCV_PMPS) {
  55         return 0;
  56     }
  57
  58     return 0;
  59 }
  60
  61 /*
  62  * Count the number of active rules.
  63  */
  64 uint32_t pmp_get_num_rules(CPURISCVState *env)
  65 {
  66      return env->pmp_state.num_rules;
  67 }
  68
  69 /*
  70  * Accessor to get the cfg reg for a specific PMP/HART
  71  */
  72 static inline uint8_t pmp_read_cfg(CPURISCVState *env, uint32_t pmp_index)
  73 {
  74     if (pmp_index < MAX_RISCV_PMPS) {
  75         return env->pmp_state.pmp[pmp_index].cfg_reg;
  76     }
  77
  78     return 0;
  79 }
  80
  81
  82 /*
  83  * Accessor to set the cfg reg for a specific PMP/HART
  84  * Bounds checks and relevant lock bit.
  85  */
  86 static void pmp_write_cfg(CPURISCVState *env, uint32_t pmp_index, uint8_t val)
  87 {
  88     if (pmp_index < MAX_RISCV_PMPS) {
  89         bool locked = true;
  90
  91         if (riscv_feature(env, RISCV_FEATURE_EPMP)) {
  92             /* mseccfg.RLB is set */
  93             if (MSECCFG_RLB_ISSET(env)) {
  94                 locked = false;
  95             }
  96
  97             /* mseccfg.MML is not set */
  98             if (!MSECCFG_MML_ISSET(env) && !pmp_is_locked(env, pmp_index)) {
  99                 locked = false;
 100             }
 101
 102             /* mseccfg.MML is set */
 103             if (MSECCFG_MML_ISSET(env)) {
 104                 /* not adding execute bit */
 105                 if ((val & PMP_LOCK) != 0 && (val & PMP_EXEC) != PMP_EXEC) {
 106                     locked = false;
 107                 }
 108                 /* shared region and not adding X bit */
 109                 if ((val & PMP_LOCK) != PMP_LOCK &&
 110                     (val & 0x7) != (PMP_WRITE | PMP_EXEC)) {
 111                     locked = false;
 112                 }
 113             }
 114         } else {
 115             if (!pmp_is_locked(env, pmp_index)) {
 116                 locked = false;
 117             }
 118         }
 119
 120         if (locked) {
 121             qemu_log_mask(LOG_GUEST_ERROR, "ignoring pmpcfg write - locked\n");
 122         } else {
 123             env->pmp_state.pmp[pmp_index].cfg_reg = val;
 124             pmp_update_rule(env, pmp_index);
 125         }
 126     } else {
 127         qemu_log_mask(LOG_GUEST_ERROR,
 128                       "ignoring pmpcfg write - out of bounds\n");
 129     }
 130 }
 131
 132 static void pmp_decode_napot(target_ulong a, target_ulong *sa, target_ulong *ea)
 133 {
 134     /*
 135        aaaa...aaa0   8-byte NAPOT range
 136        aaaa...aa01   16-byte NAPOT range
 137        aaaa...a011   32-byte NAPOT range
 138        ...
 139        aa01...1111   2^XLEN-byte NAPOT range
 140        a011...1111   2^(XLEN+1)-byte NAPOT range
 141        0111...1111   2^(XLEN+2)-byte NAPOT range
 142        1111...1111   Reserved
 143     */
 144     a = (a << 2) | 0x3;
 145     *sa = a & (a + 1);
 146     *ea = a | (a + 1);
 147 }
 148
 149 void pmp_update_rule_addr(CPURISCVState *env, uint32_t pmp_index)
 150 {
 151     uint8_t this_cfg = env->pmp_state.pmp[pmp_index].cfg_reg;
 152     target_ulong this_addr = env->pmp_state.pmp[pmp_index].addr_reg;
 153     target_ulong prev_addr = 0u;
 154     target_ulong sa = 0u;
 155     target_ulong ea = 0u;
 156
 157     if (pmp_index >= 1u) {
 158         prev_addr = env->pmp_state.pmp[pmp_index - 1].addr_reg;
 159     }
 160
 161     switch (pmp_get_a_field(this_cfg)) {
 162     case PMP_AMATCH_OFF:
 163         sa = 0u;
 164         ea = -1;
 165         break;
 166
 167     case PMP_AMATCH_TOR:
 168         sa = prev_addr << 2; /* shift up from [xx:0] to [xx+2:2] */
 169         ea = (this_addr << 2) - 1u;
 170         break;
 171
 172     case PMP_AMATCH_NA4:
 173         sa = this_addr << 2; /* shift up from [xx:0] to [xx+2:2] */
 174         ea = (sa + 4u) - 1u;
 175         break;
 176
 177     case PMP_AMATCH_NAPOT:
 178         pmp_decode_napot(this_addr, &sa, &ea);
 179         break;
 180
 181     default:
 182         sa = 0u;
 183         ea = 0u;
 184         break;
 185     }
 186
 187     env->pmp_state.addr[pmp_index].sa = sa;
 188     env->pmp_state.addr[pmp_index].ea = ea;
 189 }
 190
 191 void pmp_update_rule_nums(CPURISCVState *env)
 192 {
 193     int i;
 194
 195     env->pmp_state.num_rules = 0;
 196     for (i = 0; i < MAX_RISCV_PMPS; i++) {
 197         const uint8_t a_field =
 198             pmp_get_a_field(env->pmp_state.pmp[i].cfg_reg);
 199         if (PMP_AMATCH_OFF != a_field) {
 200             env->pmp_state.num_rules++;
 201         }
 202     }
 203 }
 204
 205 /* Convert cfg/addr reg values here into simple 'sa' --> start address and 'ea'
 206  *   end address values.
 207  *   This function is called relatively infrequently whereas the check that
 208  *   an address is within a pmp rule is called often, so optimise that one
 209  */
 210 static void pmp_update_rule(CPURISCVState *env, uint32_t pmp_index)
 211 {
 212     pmp_update_rule_addr(env, pmp_index);
 213     pmp_update_rule_nums(env);
 214 }
 215
 216 static int pmp_is_in_range(CPURISCVState *env, int pmp_index, target_ulong addr)
 217 {
 218     int result = 0;
 219
 220     if ((addr >= env->pmp_state.addr[pmp_index].sa)
 221         && (addr <= env->pmp_state.addr[pmp_index].ea)) {
 222         result = 1;
 223     } else {
 224         result = 0;
 225     }
 226
 227     return result;
 228 }
 229
 230 /*
 231  * Check if the address has required RWX privs when no PMP entry is matched.
 232  */
 233 static bool pmp_hart_has_privs_default(CPURISCVState *env, target_ulong addr,
 234     target_ulong size, pmp_priv_t privs, pmp_priv_t *allowed_privs,
 235     target_ulong mode)
 236 {
 237     bool ret;
 238
 239     if (riscv_feature(env, RISCV_FEATURE_EPMP)) {
 240         if (MSECCFG_MMWP_ISSET(env)) {
 241             /*
 242              * The Machine Mode Whitelist Policy (mseccfg.MMWP) is set
 243              * so we default to deny all, even for M-mode.
 244              */
 245             *allowed_privs = 0;
 246             return false;
 247         } else if (MSECCFG_MML_ISSET(env)) {
 248             /*
 249              * The Machine Mode Lockdown (mseccfg.MML) bit is set
 250              * so we can only execute code in M-mode with an applicable
 251              * rule. Other modes are disabled.
 252              */
 253             if (mode == PRV_M && !(privs & PMP_EXEC)) {
 254                 ret = true;
 255                 *allowed_privs = PMP_READ | PMP_WRITE;
 256             } else {
 257                 ret = false;
 258                 *allowed_privs = 0;
 259             }
 260
 261             return ret;
 262         }
 263     }
 264
 265     if ((!riscv_feature(env, RISCV_FEATURE_PMP)) || (mode == PRV_M)) {
 266         /*
 267          * Privileged spec v1.10 states if HW doesn't implement any PMP entry
 268          * or no PMP entry matches an M-Mode access, the access succeeds.
 269          */
 270         ret = true;
 271         *allowed_privs = PMP_READ | PMP_WRITE | PMP_EXEC;
 272     } else {
 273         /*
 274          * Other modes are not allowed to succeed if they don't * match a rule,
 275          * but there are rules. We've checked for no rule earlier in this
 276          * function.
 277          */
 278         ret = false;
 279         *allowed_privs = 0;
 280     }
 281
 282     return ret;
 283 }
 284
 285
 286 /*
 287  * Public Interface
 288  */
 289
 290 /*
 291  * Check if the address has required RWX privs to complete desired operation
 292  */
 293 bool pmp_hart_has_privs(CPURISCVState *env, target_ulong addr,
 294     target_ulong size, pmp_priv_t privs, pmp_priv_t *allowed_privs,
 295     target_ulong mode)
 296 {
 297     int i = 0;
 298     int ret = -1;
 299     int pmp_size = 0;
 300     target_ulong s = 0;
 301     target_ulong e = 0;
 302
 303     /* Short cut if no rules */
 304     if (0 == pmp_get_num_rules(env)) {
 305         return pmp_hart_has_privs_default(env, addr, size, privs,
 306                                           allowed_privs, mode);
 307     }
 308
 309     if (size == 0) {
 310         if (riscv_feature(env, RISCV_FEATURE_MMU)) {
 311             /*
 312              * If size is unknown (0), assume that all bytes
 313              * from addr to the end of the page will be accessed.
 314              */
 315             pmp_size = -(addr | TARGET_PAGE_MASK);
 316         } else {
 317             pmp_size = sizeof(target_ulong);
 318         }
 319     } else {
 320         pmp_size = size;
 321     }
 322
 323     /* 1.10 draft priv spec states there is an implicit order
 324          from low to high */
 325     for (i = 0; i < MAX_RISCV_PMPS; i++) {
 326         s = pmp_is_in_range(env, i, addr);
 327         e = pmp_is_in_range(env, i, addr + pmp_size - 1);
 328
 329         /* partially inside */
 330         if ((s + e) == 1) {
 331             qemu_log_mask(LOG_GUEST_ERROR,
 332                           "pmp violation - access is partially inside\n");
 333             ret = 0;
 334             break;
 335         }
 336
 337         /* fully inside */
 338         const uint8_t a_field =
 339             pmp_get_a_field(env->pmp_state.pmp[i].cfg_reg);
 340
 341         /*
 342          * Convert the PMP permissions to match the truth table in the
 343          * ePMP spec.
 344          */
 345         const uint8_t epmp_operation =
 346             ((env->pmp_state.pmp[i].cfg_reg & PMP_LOCK) >> 4) |
 347             ((env->pmp_state.pmp[i].cfg_reg & PMP_READ) << 2) |
 348             (env->pmp_state.pmp[i].cfg_reg & PMP_WRITE) |
 349             ((env->pmp_state.pmp[i].cfg_reg & PMP_EXEC) >> 2);
 350
 351         if (((s + e) == 2) && (PMP_AMATCH_OFF != a_field)) {
 352             /*
 353              * If the PMP entry is not off and the address is in range,
 354              * do the priv check
 355              */
 356             if (!MSECCFG_MML_ISSET(env)) {
 357                 /*
 358                  * If mseccfg.MML Bit is not set, do pmp priv check
 359                  * This will always apply to regular PMP.
 360                  */
 361                 *allowed_privs = PMP_READ | PMP_WRITE | PMP_EXEC;
 362                 if ((mode != PRV_M) || pmp_is_locked(env, i)) {
 363                     *allowed_privs &= env->pmp_state.pmp[i].cfg_reg;
 364                 }
 365             } else {
 366                 /*
 367                  * If mseccfg.MML Bit set, do the enhanced pmp priv check
 368                  */
 369                 if (mode == PRV_M) {
 370                     switch (epmp_operation) {
 371                     case 0:
 372                     case 1:
 373                     case 4:
 374                     case 5:
 375                     case 6:
 376                     case 7:
 377                     case 8:
 378                         *allowed_privs = 0;
 379                         break;
 380                     case 2:
 381                     case 3:
 382                     case 14:
 383                         *allowed_privs = PMP_READ | PMP_WRITE;
 384                         break;
 385                     case 9:
 386                     case 10:
 387                         *allowed_privs = PMP_EXEC;
 388                         break;
 389                     case 11:
 390                     case 13:
 391                         *allowed_privs = PMP_READ | PMP_EXEC;
 392                         break;
 393                     case 12:
 394                     case 15:
 395                         *allowed_privs = PMP_READ;
 396                         break;
 397                     default:
 398                         g_assert_not_reached();
 399                     }
 400                 } else {
 401                     switch (epmp_operation) {
 402                     case 0:
 403                     case 8:
 404                     case 9:
 405                     case 12:
 406                     case 13:
 407                     case 14:
 408                         *allowed_privs = 0;
 409                         break;
 410                     case 1:
 411                     case 10:
 412                     case 11:
 413                         *allowed_privs = PMP_EXEC;
 414                         break;
 415                     case 2:
 416                     case 4:
 417                     case 15:
 418                         *allowed_privs = PMP_READ;
 419                         break;
 420                     case 3:
 421                     case 6:
 422                         *allowed_privs = PMP_READ | PMP_WRITE;
 423                         break;
 424                     case 5:
 425                         *allowed_privs = PMP_READ | PMP_EXEC;
 426                         break;
 427                     case 7:
 428                         *allowed_privs = PMP_READ | PMP_WRITE | PMP_EXEC;
 429                         break;
 430                     default:
 431                         g_assert_not_reached();
 432                     }
 433                 }
 434             }
 435
 436             ret = ((privs & *allowed_privs) == privs);
 437             break;
 438         }
 439     }
 440
 441     /* No rule matched */
 442     if (ret == -1) {
 443         return pmp_hart_has_privs_default(env, addr, size, privs,
 444                                           allowed_privs, mode);
 445     }
 446
 447     return ret == 1 ? true : false;
 448 }
 449
 450 /*
 451  * Handle a write to a pmpcfg CSR
 452  */
 453 void pmpcfg_csr_write(CPURISCVState *env, uint32_t reg_index,
 454     target_ulong val)
 455 {
 456     int i;
 457     uint8_t cfg_val;
 458     int pmpcfg_nums = 2 << riscv_cpu_mxl(env);
 459
 460     trace_pmpcfg_csr_write(env->mhartid, reg_index, val);
 461
 462     for (i = 0; i < pmpcfg_nums; i++) {
 463         cfg_val = (val >> 8 * i)  & 0xff;
 464         pmp_write_cfg(env, (reg_index * 4) + i, cfg_val);
 465     }
 466
 467     /* If PMP permission of any addr has been changed, flush TLB pages. */
 468     tlb_flush(env_cpu(env));
 469 }
 470
 471
 472 /*
 473  * Handle a read from a pmpcfg CSR
 474  */
 475 target_ulong pmpcfg_csr_read(CPURISCVState *env, uint32_t reg_index)
 476 {
 477     int i;
 478     target_ulong cfg_val = 0;
 479     target_ulong val = 0;
 480     int pmpcfg_nums = 2 << riscv_cpu_mxl(env);
 481
 482     for (i = 0; i < pmpcfg_nums; i++) {
 483         val = pmp_read_cfg(env, (reg_index * 4) + i);
 484         cfg_val |= (val << (i * 8));
 485     }
 486     trace_pmpcfg_csr_read(env->mhartid, reg_index, cfg_val);
 487
 488     return cfg_val;
 489 }
 490
 491
 492 /*
 493  * Handle a write to a pmpaddr CSR
 494  */
 495 void pmpaddr_csr_write(CPURISCVState *env, uint32_t addr_index,
 496     target_ulong val)
 497 {
 498     trace_pmpaddr_csr_write(env->mhartid, addr_index, val);
 499
 500     if (addr_index < MAX_RISCV_PMPS) {
 501         /*
 502          * In TOR mode, need to check the lock bit of the next pmp
 503          * (if there is a next).
 504          */
 505         if (addr_index + 1 < MAX_RISCV_PMPS) {
 506             uint8_t pmp_cfg = env->pmp_state.pmp[addr_index + 1].cfg_reg;
 507
 508             if (pmp_cfg & PMP_LOCK &&
 509                 PMP_AMATCH_TOR == pmp_get_a_field(pmp_cfg)) {
 510                 qemu_log_mask(LOG_GUEST_ERROR,
 511                               "ignoring pmpaddr write - pmpcfg + 1 locked\n");
 512                 return;
 513             }
 514         }
 515
 516         if (!pmp_is_locked(env, addr_index)) {
 517             env->pmp_state.pmp[addr_index].addr_reg = val;
 518             pmp_update_rule(env, addr_index);
 519         } else {
 520             qemu_log_mask(LOG_GUEST_ERROR,
 521                           "ignoring pmpaddr write - locked\n");
 522         }
 523     } else {
 524         qemu_log_mask(LOG_GUEST_ERROR,
 525                       "ignoring pmpaddr write - out of bounds\n");
 526     }
 527 }
 528
 529
 530 /*
 531  * Handle a read from a pmpaddr CSR
 532  */
 533 target_ulong pmpaddr_csr_read(CPURISCVState *env, uint32_t addr_index)
 534 {
 535     target_ulong val = 0;
 536
 537     if (addr_index < MAX_RISCV_PMPS) {
 538         val = env->pmp_state.pmp[addr_index].addr_reg;
 539         trace_pmpaddr_csr_read(env->mhartid, addr_index, val);
 540     } else {
 541         qemu_log_mask(LOG_GUEST_ERROR,
 542                       "ignoring pmpaddr read - out of bounds\n");
 543     }
 544
 545     return val;
 546 }
 547
 548 /*
 549  * Handle a write to a mseccfg CSR
 550  */
 551 void mseccfg_csr_write(CPURISCVState *env, target_ulong val)
 552 {
 553     int i;
 554
 555     trace_mseccfg_csr_write(env->mhartid, val);
 556
 557     /* RLB cannot be enabled if it's already 0 and if any regions are locked */
 558     if (!MSECCFG_RLB_ISSET(env)) {
 559         for (i = 0; i < MAX_RISCV_PMPS; i++) {
 560             if (pmp_is_locked(env, i)) {
 561                 val &= ~MSECCFG_RLB;
 562                 break;
 563             }
 564         }
 565     }
 566
 567     /* Sticky bits */
 568     val |= (env->mseccfg & (MSECCFG_MMWP | MSECCFG_MML));
 569
 570     env->mseccfg = val;
 571 }
 572
 573 /*
 574  * Handle a read from a mseccfg CSR
 575  */
 576 target_ulong mseccfg_csr_read(CPURISCVState *env)
 577 {
 578     trace_mseccfg_csr_read(env->mhartid, env->mseccfg);
 579     return env->mseccfg;
 580 }
 581
 582 /*
 583  * Calculate the TLB size if the start address or the end address of
 584  * PMP entry is presented in the TLB page.
 585  */
 586 static target_ulong pmp_get_tlb_size(CPURISCVState *env, int pmp_index,
 587                                      target_ulong tlb_sa, target_ulong tlb_ea)
 588 {
 589     target_ulong pmp_sa = env->pmp_state.addr[pmp_index].sa;
 590     target_ulong pmp_ea = env->pmp_state.addr[pmp_index].ea;
 591
 592     if (pmp_sa >= tlb_sa && pmp_ea <= tlb_ea) {
 593         return pmp_ea - pmp_sa + 1;
 594     }
 595
 596     if (pmp_sa >= tlb_sa && pmp_sa <= tlb_ea && pmp_ea >= tlb_ea) {
 597         return tlb_ea - pmp_sa + 1;
 598     }
 599
 600     if (pmp_ea <= tlb_ea && pmp_ea >= tlb_sa && pmp_sa <= tlb_sa) {
 601         return pmp_ea - tlb_sa + 1;
 602     }
 603
 604     return 0;
 605 }
 606
 607 /*
 608  * Check is there a PMP entry which range covers this page. If so,
 609  * try to find the minimum granularity for the TLB size.
 610  */
 611 bool pmp_is_range_in_tlb(CPURISCVState *env, hwaddr tlb_sa,
 612                          target_ulong *tlb_size)
 613 {
 614     int i;
 615     target_ulong val;
 616     target_ulong tlb_ea = (tlb_sa + TARGET_PAGE_SIZE - 1);
 617
 618     for (i = 0; i < MAX_RISCV_PMPS; i++) {
 619         val = pmp_get_tlb_size(env, i, tlb_sa, tlb_ea);
 620         if (val) {
 621             if (*tlb_size == 0 || *tlb_size > val) {
 622                 *tlb_size = val;
 623             }
 624         }
 625     }
 626
 627     if (*tlb_size != 0) {
 628         return true;
 629     }
 630
 631     return false;
 632 }
 633
 634 /*
 635  * Convert PMP privilege to TLB page privilege.
 636  */
 637 int pmp_priv_to_page_prot(pmp_priv_t pmp_priv)
 638 {
 639     int prot = 0;
 640
 641     if (pmp_priv & PMP_READ) {
 642         prot |= PAGE_READ;
 643     }
 644     if (pmp_priv & PMP_WRITE) {
 645         prot |= PAGE_WRITE;
 646     }
 647     if (pmp_priv & PMP_EXEC) {
 648         prot |= PAGE_EXEC;
 649     }
 650
 651     return prot;
 652 }