]>
git.proxmox.com Git - mirror_qemu.git/blob - target/riscv/pmp.c
2 * QEMU RISC-V PMP (Physical Memory Protection)
4 * Author: Daire McNamara, daire.mcnamara@emdalo.com
5 * Ivan Griffin, ivan.griffin@emdalo.com
7 * This provides a RISC-V Physical Memory Protection implementation
9 * This program is free software; you can redistribute it and/or modify it
10 * under the terms and conditions of the GNU General Public License,
11 * version 2 or later, as published by the Free Software Foundation.
13 * This program is distributed in the hope it will be useful, but WITHOUT
14 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
15 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
18 * You should have received a copy of the GNU General Public License along with
19 * this program. If not, see <http://www.gnu.org/licenses/>.
22 #include "qemu/osdep.h"
24 #include "qapi/error.h"
27 #include "exec/exec-all.h"
29 static bool pmp_write_cfg(CPURISCVState
*env
, uint32_t addr_index
,
31 static uint8_t pmp_read_cfg(CPURISCVState
*env
, uint32_t addr_index
);
34 * Accessor method to extract address matching type 'a field' from cfg reg
36 static inline uint8_t pmp_get_a_field(uint8_t cfg
)
43 * Check whether a PMP is locked or not.
45 static inline int pmp_is_locked(CPURISCVState
*env
, uint32_t pmp_index
)
47 /* mseccfg.RLB is set */
48 if (MSECCFG_RLB_ISSET(env
)) {
52 if (env
->pmp_state
.pmp
[pmp_index
].cfg_reg
& PMP_LOCK
) {
56 /* Top PMP has no 'next' to check */
57 if ((pmp_index
+ 1u) >= MAX_RISCV_PMPS
) {
65 * Count the number of active rules.
67 uint32_t pmp_get_num_rules(CPURISCVState
*env
)
69 return env
->pmp_state
.num_rules
;
73 * Accessor to get the cfg reg for a specific PMP/HART
75 static inline uint8_t pmp_read_cfg(CPURISCVState
*env
, uint32_t pmp_index
)
77 if (pmp_index
< MAX_RISCV_PMPS
) {
78 return env
->pmp_state
.pmp
[pmp_index
].cfg_reg
;
86 * Accessor to set the cfg reg for a specific PMP/HART
87 * Bounds checks and relevant lock bit.
89 static bool pmp_write_cfg(CPURISCVState
*env
, uint32_t pmp_index
, uint8_t val
)
91 if (pmp_index
< MAX_RISCV_PMPS
) {
94 if (riscv_cpu_cfg(env
)->ext_smepmp
) {
95 /* mseccfg.RLB is set */
96 if (MSECCFG_RLB_ISSET(env
)) {
100 /* mseccfg.MML is not set */
101 if (!MSECCFG_MML_ISSET(env
) && !pmp_is_locked(env
, pmp_index
)) {
105 /* mseccfg.MML is set */
106 if (MSECCFG_MML_ISSET(env
)) {
107 /* not adding execute bit */
108 if ((val
& PMP_LOCK
) != 0 && (val
& PMP_EXEC
) != PMP_EXEC
) {
111 /* shared region and not adding X bit */
112 if ((val
& PMP_LOCK
) != PMP_LOCK
&&
113 (val
& 0x7) != (PMP_WRITE
| PMP_EXEC
)) {
118 if (!pmp_is_locked(env
, pmp_index
)) {
124 qemu_log_mask(LOG_GUEST_ERROR
, "ignoring pmpcfg write - locked\n");
125 } else if (env
->pmp_state
.pmp
[pmp_index
].cfg_reg
!= val
) {
126 /* If !mseccfg.MML then ignore writes with encoding RW=01 */
127 if ((val
& PMP_WRITE
) && !(val
& PMP_READ
) &&
128 !MSECCFG_MML_ISSET(env
)) {
129 val
&= ~(PMP_WRITE
| PMP_READ
);
131 env
->pmp_state
.pmp
[pmp_index
].cfg_reg
= val
;
132 pmp_update_rule_addr(env
, pmp_index
);
136 qemu_log_mask(LOG_GUEST_ERROR
,
137 "ignoring pmpcfg write - out of bounds\n");
143 void pmp_unlock_entries(CPURISCVState
*env
)
145 uint32_t pmp_num
= pmp_get_num_rules(env
);
148 for (i
= 0; i
< pmp_num
; i
++) {
149 env
->pmp_state
.pmp
[i
].cfg_reg
&= ~(PMP_LOCK
| PMP_AMATCH
);
153 static void pmp_decode_napot(target_ulong a
, target_ulong
*sa
,
157 * aaaa...aaa0 8-byte NAPOT range
158 * aaaa...aa01 16-byte NAPOT range
159 * aaaa...a011 32-byte NAPOT range
161 * aa01...1111 2^XLEN-byte NAPOT range
162 * a011...1111 2^(XLEN+1)-byte NAPOT range
163 * 0111...1111 2^(XLEN+2)-byte NAPOT range
164 * 1111...1111 Reserved
171 void pmp_update_rule_addr(CPURISCVState
*env
, uint32_t pmp_index
)
173 uint8_t this_cfg
= env
->pmp_state
.pmp
[pmp_index
].cfg_reg
;
174 target_ulong this_addr
= env
->pmp_state
.pmp
[pmp_index
].addr_reg
;
175 target_ulong prev_addr
= 0u;
176 target_ulong sa
= 0u;
177 target_ulong ea
= 0u;
179 if (pmp_index
>= 1u) {
180 prev_addr
= env
->pmp_state
.pmp
[pmp_index
- 1].addr_reg
;
183 switch (pmp_get_a_field(this_cfg
)) {
190 sa
= prev_addr
<< 2; /* shift up from [xx:0] to [xx+2:2] */
191 ea
= (this_addr
<< 2) - 1u;
198 sa
= this_addr
<< 2; /* shift up from [xx:0] to [xx+2:2] */
202 case PMP_AMATCH_NAPOT
:
203 pmp_decode_napot(this_addr
, &sa
, &ea
);
212 env
->pmp_state
.addr
[pmp_index
].sa
= sa
;
213 env
->pmp_state
.addr
[pmp_index
].ea
= ea
;
216 void pmp_update_rule_nums(CPURISCVState
*env
)
220 env
->pmp_state
.num_rules
= 0;
221 for (i
= 0; i
< MAX_RISCV_PMPS
; i
++) {
222 const uint8_t a_field
=
223 pmp_get_a_field(env
->pmp_state
.pmp
[i
].cfg_reg
);
224 if (PMP_AMATCH_OFF
!= a_field
) {
225 env
->pmp_state
.num_rules
++;
230 static int pmp_is_in_range(CPURISCVState
*env
, int pmp_index
,
235 if ((addr
>= env
->pmp_state
.addr
[pmp_index
].sa
) &&
236 (addr
<= env
->pmp_state
.addr
[pmp_index
].ea
)) {
246 * Check if the address has required RWX privs when no PMP entry is matched.
248 static bool pmp_hart_has_privs_default(CPURISCVState
*env
, pmp_priv_t privs
,
249 pmp_priv_t
*allowed_privs
,
254 if (MSECCFG_MMWP_ISSET(env
)) {
256 * The Machine Mode Whitelist Policy (mseccfg.MMWP) is set
257 * so we default to deny all, even for M-mode.
261 } else if (MSECCFG_MML_ISSET(env
)) {
263 * The Machine Mode Lockdown (mseccfg.MML) bit is set
264 * so we can only execute code in M-mode with an applicable
265 * rule. Other modes are disabled.
267 if (mode
== PRV_M
&& !(privs
& PMP_EXEC
)) {
269 *allowed_privs
= PMP_READ
| PMP_WRITE
;
278 if (!riscv_cpu_cfg(env
)->pmp
|| (mode
== PRV_M
)) {
280 * Privileged spec v1.10 states if HW doesn't implement any PMP entry
281 * or no PMP entry matches an M-Mode access, the access succeeds.
284 *allowed_privs
= PMP_READ
| PMP_WRITE
| PMP_EXEC
;
287 * Other modes are not allowed to succeed if they don't * match a rule,
288 * but there are rules. We've checked for no rule earlier in this
304 * Check if the address has required RWX privs to complete desired operation
305 * Return true if a pmp rule match or default match
306 * Return false if no match
308 bool pmp_hart_has_privs(CPURISCVState
*env
, target_ulong addr
,
309 target_ulong size
, pmp_priv_t privs
,
310 pmp_priv_t
*allowed_privs
, target_ulong mode
)
317 /* Short cut if no rules */
318 if (0 == pmp_get_num_rules(env
)) {
319 return pmp_hart_has_privs_default(env
, privs
, allowed_privs
, mode
);
323 if (riscv_cpu_cfg(env
)->mmu
) {
325 * If size is unknown (0), assume that all bytes
326 * from addr to the end of the page will be accessed.
328 pmp_size
= -(addr
| TARGET_PAGE_MASK
);
330 pmp_size
= sizeof(target_ulong
);
337 * 1.10 draft priv spec states there is an implicit order
340 for (i
= 0; i
< MAX_RISCV_PMPS
; i
++) {
341 s
= pmp_is_in_range(env
, i
, addr
);
342 e
= pmp_is_in_range(env
, i
, addr
+ pmp_size
- 1);
344 /* partially inside */
346 qemu_log_mask(LOG_GUEST_ERROR
,
347 "pmp violation - access is partially inside\n");
353 const uint8_t a_field
=
354 pmp_get_a_field(env
->pmp_state
.pmp
[i
].cfg_reg
);
357 * Convert the PMP permissions to match the truth table in the
360 const uint8_t smepmp_operation
=
361 ((env
->pmp_state
.pmp
[i
].cfg_reg
& PMP_LOCK
) >> 4) |
362 ((env
->pmp_state
.pmp
[i
].cfg_reg
& PMP_READ
) << 2) |
363 (env
->pmp_state
.pmp
[i
].cfg_reg
& PMP_WRITE
) |
364 ((env
->pmp_state
.pmp
[i
].cfg_reg
& PMP_EXEC
) >> 2);
366 if (((s
+ e
) == 2) && (PMP_AMATCH_OFF
!= a_field
)) {
368 * If the PMP entry is not off and the address is in range,
371 if (!MSECCFG_MML_ISSET(env
)) {
373 * If mseccfg.MML Bit is not set, do pmp priv check
374 * This will always apply to regular PMP.
376 *allowed_privs
= PMP_READ
| PMP_WRITE
| PMP_EXEC
;
377 if ((mode
!= PRV_M
) || pmp_is_locked(env
, i
)) {
378 *allowed_privs
&= env
->pmp_state
.pmp
[i
].cfg_reg
;
382 * If mseccfg.MML Bit set, do the enhanced pmp priv check
385 switch (smepmp_operation
) {
398 *allowed_privs
= PMP_READ
| PMP_WRITE
;
402 *allowed_privs
= PMP_EXEC
;
406 *allowed_privs
= PMP_READ
| PMP_EXEC
;
410 *allowed_privs
= PMP_READ
;
413 g_assert_not_reached();
416 switch (smepmp_operation
) {
428 *allowed_privs
= PMP_EXEC
;
433 *allowed_privs
= PMP_READ
;
437 *allowed_privs
= PMP_READ
| PMP_WRITE
;
440 *allowed_privs
= PMP_READ
| PMP_EXEC
;
443 *allowed_privs
= PMP_READ
| PMP_WRITE
| PMP_EXEC
;
446 g_assert_not_reached();
452 * If matching address range was found, the protection bits
453 * defined with PMP must be used. We shouldn't fallback on
454 * finding default privileges.
456 return (privs
& *allowed_privs
) == privs
;
460 /* No rule matched */
461 return pmp_hart_has_privs_default(env
, privs
, allowed_privs
, mode
);
465 * Handle a write to a pmpcfg CSR
467 void pmpcfg_csr_write(CPURISCVState
*env
, uint32_t reg_index
,
472 int pmpcfg_nums
= 2 << riscv_cpu_mxl(env
);
473 bool modified
= false;
475 trace_pmpcfg_csr_write(env
->mhartid
, reg_index
, val
);
477 for (i
= 0; i
< pmpcfg_nums
; i
++) {
478 cfg_val
= (val
>> 8 * i
) & 0xff;
479 modified
|= pmp_write_cfg(env
, (reg_index
* 4) + i
, cfg_val
);
482 /* If PMP permission of any addr has been changed, flush TLB pages. */
484 pmp_update_rule_nums(env
);
485 tlb_flush(env_cpu(env
));
491 * Handle a read from a pmpcfg CSR
493 target_ulong
pmpcfg_csr_read(CPURISCVState
*env
, uint32_t reg_index
)
496 target_ulong cfg_val
= 0;
497 target_ulong val
= 0;
498 int pmpcfg_nums
= 2 << riscv_cpu_mxl(env
);
500 for (i
= 0; i
< pmpcfg_nums
; i
++) {
501 val
= pmp_read_cfg(env
, (reg_index
* 4) + i
);
502 cfg_val
|= (val
<< (i
* 8));
504 trace_pmpcfg_csr_read(env
->mhartid
, reg_index
, cfg_val
);
511 * Handle a write to a pmpaddr CSR
513 void pmpaddr_csr_write(CPURISCVState
*env
, uint32_t addr_index
,
516 trace_pmpaddr_csr_write(env
->mhartid
, addr_index
, val
);
517 bool is_next_cfg_tor
= false;
519 if (addr_index
< MAX_RISCV_PMPS
) {
521 * In TOR mode, need to check the lock bit of the next pmp
522 * (if there is a next).
524 if (addr_index
+ 1 < MAX_RISCV_PMPS
) {
525 uint8_t pmp_cfg
= env
->pmp_state
.pmp
[addr_index
+ 1].cfg_reg
;
526 is_next_cfg_tor
= PMP_AMATCH_TOR
== pmp_get_a_field(pmp_cfg
);
528 if (pmp_cfg
& PMP_LOCK
&& is_next_cfg_tor
) {
529 qemu_log_mask(LOG_GUEST_ERROR
,
530 "ignoring pmpaddr write - pmpcfg + 1 locked\n");
535 if (!pmp_is_locked(env
, addr_index
)) {
536 if (env
->pmp_state
.pmp
[addr_index
].addr_reg
!= val
) {
537 env
->pmp_state
.pmp
[addr_index
].addr_reg
= val
;
538 pmp_update_rule_addr(env
, addr_index
);
539 if (is_next_cfg_tor
) {
540 pmp_update_rule_addr(env
, addr_index
+ 1);
542 tlb_flush(env_cpu(env
));
545 qemu_log_mask(LOG_GUEST_ERROR
,
546 "ignoring pmpaddr write - locked\n");
549 qemu_log_mask(LOG_GUEST_ERROR
,
550 "ignoring pmpaddr write - out of bounds\n");
556 * Handle a read from a pmpaddr CSR
558 target_ulong
pmpaddr_csr_read(CPURISCVState
*env
, uint32_t addr_index
)
560 target_ulong val
= 0;
562 if (addr_index
< MAX_RISCV_PMPS
) {
563 val
= env
->pmp_state
.pmp
[addr_index
].addr_reg
;
564 trace_pmpaddr_csr_read(env
->mhartid
, addr_index
, val
);
566 qemu_log_mask(LOG_GUEST_ERROR
,
567 "ignoring pmpaddr read - out of bounds\n");
574 * Handle a write to a mseccfg CSR
576 void mseccfg_csr_write(CPURISCVState
*env
, target_ulong val
)
580 trace_mseccfg_csr_write(env
->mhartid
, val
);
582 /* RLB cannot be enabled if it's already 0 and if any regions are locked */
583 if (!MSECCFG_RLB_ISSET(env
)) {
584 for (i
= 0; i
< MAX_RISCV_PMPS
; i
++) {
585 if (pmp_is_locked(env
, i
)) {
592 if (riscv_cpu_cfg(env
)->ext_smepmp
) {
594 val
|= (env
->mseccfg
& (MSECCFG_MMWP
| MSECCFG_MML
));
595 if ((val
^ env
->mseccfg
) & (MSECCFG_MMWP
| MSECCFG_MML
)) {
596 tlb_flush(env_cpu(env
));
599 val
&= ~(MSECCFG_MMWP
| MSECCFG_MML
| MSECCFG_RLB
);
606 * Handle a read from a mseccfg CSR
608 target_ulong
mseccfg_csr_read(CPURISCVState
*env
)
610 trace_mseccfg_csr_read(env
->mhartid
, env
->mseccfg
);
615 * Calculate the TLB size.
616 * It's possible that PMP regions only cover partial of the TLB page, and
617 * this may split the page into regions with different permissions.
618 * For example if PMP0 is (0x80000008~0x8000000F, R) and PMP1 is (0x80000000
619 * ~0x80000FFF, RWX), then region 0x80000008~0x8000000F has R permission, and
620 * the other regions in this page have RWX permissions.
621 * A write access to 0x80000000 will match PMP1. However we cannot cache the
622 * translation result in the TLB since this will make the write access to
623 * 0x80000008 bypass the check of PMP0.
624 * To avoid this we return a size of 1 (which means no caching) if the PMP
625 * region only covers partial of the TLB page.
627 target_ulong
pmp_get_tlb_size(CPURISCVState
*env
, target_ulong addr
)
631 target_ulong tlb_sa
= addr
& ~(TARGET_PAGE_SIZE
- 1);
632 target_ulong tlb_ea
= tlb_sa
+ TARGET_PAGE_SIZE
- 1;
636 * If PMP is not supported or there are no PMP rules, the TLB page will not
637 * be split into regions with different permissions by PMP so we set the
638 * size to TARGET_PAGE_SIZE.
640 if (!riscv_cpu_cfg(env
)->pmp
|| !pmp_get_num_rules(env
)) {
641 return TARGET_PAGE_SIZE
;
644 for (i
= 0; i
< MAX_RISCV_PMPS
; i
++) {
645 if (pmp_get_a_field(env
->pmp_state
.pmp
[i
].cfg_reg
) == PMP_AMATCH_OFF
) {
649 pmp_sa
= env
->pmp_state
.addr
[i
].sa
;
650 pmp_ea
= env
->pmp_state
.addr
[i
].ea
;
653 * Only the first PMP entry that covers (whole or partial of) the TLB
654 * page really matters:
655 * If it covers the whole TLB page, set the size to TARGET_PAGE_SIZE,
656 * since the following PMP entries have lower priority and will not
657 * affect the permissions of the page.
658 * If it only covers partial of the TLB page, set the size to 1 since
659 * the allowed permissions of the region may be different from other
660 * region of the page.
662 if (pmp_sa
<= tlb_sa
&& pmp_ea
>= tlb_ea
) {
663 return TARGET_PAGE_SIZE
;
664 } else if ((pmp_sa
>= tlb_sa
&& pmp_sa
<= tlb_ea
) ||
665 (pmp_ea
>= tlb_sa
&& pmp_ea
<= tlb_ea
)) {
671 * If no PMP entry matches the TLB page, the TLB page will also not be
672 * split into regions with different permissions by PMP so we set the size
673 * to TARGET_PAGE_SIZE.
675 return TARGET_PAGE_SIZE
;
679 * Convert PMP privilege to TLB page privilege.
681 int pmp_priv_to_page_prot(pmp_priv_t pmp_priv
)
685 if (pmp_priv
& PMP_READ
) {
688 if (pmp_priv
& PMP_WRITE
) {
691 if (pmp_priv
& PMP_EXEC
) {