target/riscv/pmp.c

   1 /*
   2  * QEMU RISC-V PMP (Physical Memory Protection)
   3  *
   4  * Author: Daire McNamara, daire.mcnamara@emdalo.com
   5  *         Ivan Griffin, ivan.griffin@emdalo.com
   6  *
   7  * This provides a RISC-V Physical Memory Protection implementation
   8  *
   9  * This program is free software; you can redistribute it and/or modify it
  10  * under the terms and conditions of the GNU General Public License,
  11  * version 2 or later, as published by the Free Software Foundation.
  12  *
  13  * This program is distributed in the hope it will be useful, but WITHOUT
  14  * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
  15  * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
  16  * more details.
  17  *
  18  * You should have received a copy of the GNU General Public License along with
  19  * this program.  If not, see <http://www.gnu.org/licenses/>.
  20  */
  21
  22 /*
  23  * PMP (Physical Memory Protection) is as-of-yet unused and needs testing.
  24  */
  25
  26 #include "qemu/osdep.h"
  27 #include "qemu/log.h"
  28 #include "qapi/error.h"
  29 #include "cpu.h"
  30 #include "trace.h"
  31 #include "exec/exec-all.h"
  32
  33 static void pmp_write_cfg(CPURISCVState *env, uint32_t addr_index,
  34     uint8_t val);
  35 static uint8_t pmp_read_cfg(CPURISCVState *env, uint32_t addr_index);
  36 static void pmp_update_rule(CPURISCVState *env, uint32_t pmp_index);
  37
  38 /*
  39  * Accessor method to extract address matching type 'a field' from cfg reg
  40  */
  41 static inline uint8_t pmp_get_a_field(uint8_t cfg)
  42 {
  43     uint8_t a = cfg >> 3;
  44     return a & 0x3;
  45 }
  46
  47 /*
  48  * Check whether a PMP is locked or not.
  49  */
  50 static inline int pmp_is_locked(CPURISCVState *env, uint32_t pmp_index)
  51 {
  52
  53     if (env->pmp_state.pmp[pmp_index].cfg_reg & PMP_LOCK) {
  54         return 1;
  55     }
  56
  57     /* Top PMP has no 'next' to check */
  58     if ((pmp_index + 1u) >= MAX_RISCV_PMPS) {
  59         return 0;
  60     }
  61
  62     return 0;
  63 }
  64
  65 /*
  66  * Count the number of active rules.
  67  */
  68 uint32_t pmp_get_num_rules(CPURISCVState *env)
  69 {
  70      return env->pmp_state.num_rules;
  71 }
  72
  73 /*
  74  * Accessor to get the cfg reg for a specific PMP/HART
  75  */
  76 static inline uint8_t pmp_read_cfg(CPURISCVState *env, uint32_t pmp_index)
  77 {
  78     if (pmp_index < MAX_RISCV_PMPS) {
  79         return env->pmp_state.pmp[pmp_index].cfg_reg;
  80     }
  81
  82     return 0;
  83 }
  84
  85
  86 /*
  87  * Accessor to set the cfg reg for a specific PMP/HART
  88  * Bounds checks and relevant lock bit.
  89  */
  90 static void pmp_write_cfg(CPURISCVState *env, uint32_t pmp_index, uint8_t val)
  91 {
  92     if (pmp_index < MAX_RISCV_PMPS) {
  93         bool locked = true;
  94
  95         if (riscv_feature(env, RISCV_FEATURE_EPMP)) {
  96             /* mseccfg.RLB is set */
  97             if (MSECCFG_RLB_ISSET(env)) {
  98                 locked = false;
  99             }
 100
 101             /* mseccfg.MML is not set */
 102             if (!MSECCFG_MML_ISSET(env) && !pmp_is_locked(env, pmp_index)) {
 103                 locked = false;
 104             }
 105
 106             /* mseccfg.MML is set */
 107             if (MSECCFG_MML_ISSET(env)) {
 108                 /* not adding execute bit */
 109                 if ((val & PMP_LOCK) != 0 && (val & PMP_EXEC) != PMP_EXEC) {
 110                     locked = false;
 111                 }
 112                 /* shared region and not adding X bit */
 113                 if ((val & PMP_LOCK) != PMP_LOCK &&
 114                     (val & 0x7) != (PMP_WRITE | PMP_EXEC)) {
 115                     locked = false;
 116                 }
 117             }
 118         } else {
 119             if (!pmp_is_locked(env, pmp_index)) {
 120                 locked = false;
 121             }
 122         }
 123
 124         if (locked) {
 125             qemu_log_mask(LOG_GUEST_ERROR, "ignoring pmpcfg write - locked\n");
 126         } else {
 127             env->pmp_state.pmp[pmp_index].cfg_reg = val;
 128             pmp_update_rule(env, pmp_index);
 129         }
 130     } else {
 131         qemu_log_mask(LOG_GUEST_ERROR,
 132                       "ignoring pmpcfg write - out of bounds\n");
 133     }
 134 }
 135
 136 static void pmp_decode_napot(target_ulong a, target_ulong *sa, target_ulong *ea)
 137 {
 138     /*
 139        aaaa...aaa0   8-byte NAPOT range
 140        aaaa...aa01   16-byte NAPOT range
 141        aaaa...a011   32-byte NAPOT range
 142        ...
 143        aa01...1111   2^XLEN-byte NAPOT range
 144        a011...1111   2^(XLEN+1)-byte NAPOT range
 145        0111...1111   2^(XLEN+2)-byte NAPOT range
 146        1111...1111   Reserved
 147     */
 148     if (a == -1) {
 149         *sa = 0u;
 150         *ea = -1;
 151         return;
 152     } else {
 153         target_ulong t1 = ctz64(~a);
 154         target_ulong base = (a & ~(((target_ulong)1 << t1) - 1)) << 2;
 155         target_ulong range = ((target_ulong)1 << (t1 + 3)) - 1;
 156         *sa = base;
 157         *ea = base + range;
 158     }
 159 }
 160
 161 void pmp_update_rule_addr(CPURISCVState *env, uint32_t pmp_index)
 162 {
 163     uint8_t this_cfg = env->pmp_state.pmp[pmp_index].cfg_reg;
 164     target_ulong this_addr = env->pmp_state.pmp[pmp_index].addr_reg;
 165     target_ulong prev_addr = 0u;
 166     target_ulong sa = 0u;
 167     target_ulong ea = 0u;
 168
 169     if (pmp_index >= 1u) {
 170         prev_addr = env->pmp_state.pmp[pmp_index - 1].addr_reg;
 171     }
 172
 173     switch (pmp_get_a_field(this_cfg)) {
 174     case PMP_AMATCH_OFF:
 175         sa = 0u;
 176         ea = -1;
 177         break;
 178
 179     case PMP_AMATCH_TOR:
 180         sa = prev_addr << 2; /* shift up from [xx:0] to [xx+2:2] */
 181         ea = (this_addr << 2) - 1u;
 182         break;
 183
 184     case PMP_AMATCH_NA4:
 185         sa = this_addr << 2; /* shift up from [xx:0] to [xx+2:2] */
 186         ea = (sa + 4u) - 1u;
 187         break;
 188
 189     case PMP_AMATCH_NAPOT:
 190         pmp_decode_napot(this_addr, &sa, &ea);
 191         break;
 192
 193     default:
 194         sa = 0u;
 195         ea = 0u;
 196         break;
 197     }
 198
 199     env->pmp_state.addr[pmp_index].sa = sa;
 200     env->pmp_state.addr[pmp_index].ea = ea;
 201 }
 202
 203 void pmp_update_rule_nums(CPURISCVState *env)
 204 {
 205     int i;
 206
 207     env->pmp_state.num_rules = 0;
 208     for (i = 0; i < MAX_RISCV_PMPS; i++) {
 209         const uint8_t a_field =
 210             pmp_get_a_field(env->pmp_state.pmp[i].cfg_reg);
 211         if (PMP_AMATCH_OFF != a_field) {
 212             env->pmp_state.num_rules++;
 213         }
 214     }
 215 }
 216
 217 /* Convert cfg/addr reg values here into simple 'sa' --> start address and 'ea'
 218  *   end address values.
 219  *   This function is called relatively infrequently whereas the check that
 220  *   an address is within a pmp rule is called often, so optimise that one
 221  */
 222 static void pmp_update_rule(CPURISCVState *env, uint32_t pmp_index)
 223 {
 224     pmp_update_rule_addr(env, pmp_index);
 225     pmp_update_rule_nums(env);
 226 }
 227
 228 static int pmp_is_in_range(CPURISCVState *env, int pmp_index, target_ulong addr)
 229 {
 230     int result = 0;
 231
 232     if ((addr >= env->pmp_state.addr[pmp_index].sa)
 233         && (addr <= env->pmp_state.addr[pmp_index].ea)) {
 234         result = 1;
 235     } else {
 236         result = 0;
 237     }
 238
 239     return result;
 240 }
 241
 242 /*
 243  * Check if the address has required RWX privs when no PMP entry is matched.
 244  */
 245 static bool pmp_hart_has_privs_default(CPURISCVState *env, target_ulong addr,
 246     target_ulong size, pmp_priv_t privs, pmp_priv_t *allowed_privs,
 247     target_ulong mode)
 248 {
 249     bool ret;
 250
 251     if (riscv_feature(env, RISCV_FEATURE_EPMP)) {
 252         if (MSECCFG_MMWP_ISSET(env)) {
 253             /*
 254              * The Machine Mode Whitelist Policy (mseccfg.MMWP) is set
 255              * so we default to deny all, even for M-mode.
 256              */
 257             *allowed_privs = 0;
 258             return false;
 259         } else if (MSECCFG_MML_ISSET(env)) {
 260             /*
 261              * The Machine Mode Lockdown (mseccfg.MML) bit is set
 262              * so we can only execute code in M-mode with an applicable
 263              * rule. Other modes are disabled.
 264              */
 265             if (mode == PRV_M && !(privs & PMP_EXEC)) {
 266                 ret = true;
 267                 *allowed_privs = PMP_READ | PMP_WRITE;
 268             } else {
 269                 ret = false;
 270                 *allowed_privs = 0;
 271             }
 272
 273             return ret;
 274         }
 275     }
 276
 277     if ((!riscv_feature(env, RISCV_FEATURE_PMP)) || (mode == PRV_M)) {
 278         /*
 279          * Privileged spec v1.10 states if HW doesn't implement any PMP entry
 280          * or no PMP entry matches an M-Mode access, the access succeeds.
 281          */
 282         ret = true;
 283         *allowed_privs = PMP_READ | PMP_WRITE | PMP_EXEC;
 284     } else {
 285         /*
 286          * Other modes are not allowed to succeed if they don't * match a rule,
 287          * but there are rules. We've checked for no rule earlier in this
 288          * function.
 289          */
 290         ret = false;
 291         *allowed_privs = 0;
 292     }
 293
 294     return ret;
 295 }
 296
 297
 298 /*
 299  * Public Interface
 300  */
 301
 302 /*
 303  * Check if the address has required RWX privs to complete desired operation
 304  */
 305 bool pmp_hart_has_privs(CPURISCVState *env, target_ulong addr,
 306     target_ulong size, pmp_priv_t privs, pmp_priv_t *allowed_privs,
 307     target_ulong mode)
 308 {
 309     int i = 0;
 310     int ret = -1;
 311     int pmp_size = 0;
 312     target_ulong s = 0;
 313     target_ulong e = 0;
 314
 315     /* Short cut if no rules */
 316     if (0 == pmp_get_num_rules(env)) {
 317         return pmp_hart_has_privs_default(env, addr, size, privs,
 318                                           allowed_privs, mode);
 319     }
 320
 321     if (size == 0) {
 322         if (riscv_feature(env, RISCV_FEATURE_MMU)) {
 323             /*
 324              * If size is unknown (0), assume that all bytes
 325              * from addr to the end of the page will be accessed.
 326              */
 327             pmp_size = -(addr | TARGET_PAGE_MASK);
 328         } else {
 329             pmp_size = sizeof(target_ulong);
 330         }
 331     } else {
 332         pmp_size = size;
 333     }
 334
 335     /* 1.10 draft priv spec states there is an implicit order
 336          from low to high */
 337     for (i = 0; i < MAX_RISCV_PMPS; i++) {
 338         s = pmp_is_in_range(env, i, addr);
 339         e = pmp_is_in_range(env, i, addr + pmp_size - 1);
 340
 341         /* partially inside */
 342         if ((s + e) == 1) {
 343             qemu_log_mask(LOG_GUEST_ERROR,
 344                           "pmp violation - access is partially inside\n");
 345             ret = 0;
 346             break;
 347         }
 348
 349         /* fully inside */
 350         const uint8_t a_field =
 351             pmp_get_a_field(env->pmp_state.pmp[i].cfg_reg);
 352
 353         /*
 354          * Convert the PMP permissions to match the truth table in the
 355          * ePMP spec.
 356          */
 357         const uint8_t epmp_operation =
 358             ((env->pmp_state.pmp[i].cfg_reg & PMP_LOCK) >> 4) |
 359             ((env->pmp_state.pmp[i].cfg_reg & PMP_READ) << 2) |
 360             (env->pmp_state.pmp[i].cfg_reg & PMP_WRITE) |
 361             ((env->pmp_state.pmp[i].cfg_reg & PMP_EXEC) >> 2);
 362
 363         if (((s + e) == 2) && (PMP_AMATCH_OFF != a_field)) {
 364             /*
 365              * If the PMP entry is not off and the address is in range,
 366              * do the priv check
 367              */
 368             if (!MSECCFG_MML_ISSET(env)) {
 369                 /*
 370                  * If mseccfg.MML Bit is not set, do pmp priv check
 371                  * This will always apply to regular PMP.
 372                  */
 373                 *allowed_privs = PMP_READ | PMP_WRITE | PMP_EXEC;
 374                 if ((mode != PRV_M) || pmp_is_locked(env, i)) {
 375                     *allowed_privs &= env->pmp_state.pmp[i].cfg_reg;
 376                 }
 377             } else {
 378                 /*
 379                  * If mseccfg.MML Bit set, do the enhanced pmp priv check
 380                  */
 381                 if (mode == PRV_M) {
 382                     switch (epmp_operation) {
 383                     case 0:
 384                     case 1:
 385                     case 4:
 386                     case 5:
 387                     case 6:
 388                     case 7:
 389                     case 8:
 390                         *allowed_privs = 0;
 391                         break;
 392                     case 2:
 393                     case 3:
 394                     case 14:
 395                         *allowed_privs = PMP_READ | PMP_WRITE;
 396                         break;
 397                     case 9:
 398                     case 10:
 399                         *allowed_privs = PMP_EXEC;
 400                         break;
 401                     case 11:
 402                     case 13:
 403                         *allowed_privs = PMP_READ | PMP_EXEC;
 404                         break;
 405                     case 12:
 406                     case 15:
 407                         *allowed_privs = PMP_READ;
 408                         break;
 409                     }
 410                 } else {
 411                     switch (epmp_operation) {
 412                     case 0:
 413                     case 8:
 414                     case 9:
 415                     case 12:
 416                     case 13:
 417                     case 14:
 418                         *allowed_privs = 0;
 419                         break;
 420                     case 1:
 421                     case 10:
 422                     case 11:
 423                         *allowed_privs = PMP_EXEC;
 424                         break;
 425                     case 2:
 426                     case 4:
 427                     case 15:
 428                         *allowed_privs = PMP_READ;
 429                         break;
 430                     case 3:
 431                     case 6:
 432                         *allowed_privs = PMP_READ | PMP_WRITE;
 433                         break;
 434                     case 5:
 435                         *allowed_privs = PMP_READ | PMP_EXEC;
 436                         break;
 437                     case 7:
 438                         *allowed_privs = PMP_READ | PMP_WRITE | PMP_EXEC;
 439                         break;
 440                     }
 441                 }
 442             }
 443
 444             ret = ((privs & *allowed_privs) == privs);
 445             break;
 446         }
 447     }
 448
 449     /* No rule matched */
 450     if (ret == -1) {
 451         return pmp_hart_has_privs_default(env, addr, size, privs,
 452                                           allowed_privs, mode);
 453     }
 454
 455     return ret == 1 ? true : false;
 456 }
 457
 458 /*
 459  * Handle a write to a pmpcfg CSP
 460  */
 461 void pmpcfg_csr_write(CPURISCVState *env, uint32_t reg_index,
 462     target_ulong val)
 463 {
 464     int i;
 465     uint8_t cfg_val;
 466
 467     trace_pmpcfg_csr_write(env->mhartid, reg_index, val);
 468
 469     if ((reg_index & 1) && (sizeof(target_ulong) == 8)) {
 470         qemu_log_mask(LOG_GUEST_ERROR,
 471                       "ignoring pmpcfg write - incorrect address\n");
 472         return;
 473     }
 474
 475     for (i = 0; i < sizeof(target_ulong); i++) {
 476         cfg_val = (val >> 8 * i)  & 0xff;
 477         pmp_write_cfg(env, (reg_index * 4) + i, cfg_val);
 478     }
 479
 480     /* If PMP permission of any addr has been changed, flush TLB pages. */
 481     tlb_flush(env_cpu(env));
 482 }
 483
 484
 485 /*
 486  * Handle a read from a pmpcfg CSP
 487  */
 488 target_ulong pmpcfg_csr_read(CPURISCVState *env, uint32_t reg_index)
 489 {
 490     int i;
 491     target_ulong cfg_val = 0;
 492     target_ulong val = 0;
 493
 494     for (i = 0; i < sizeof(target_ulong); i++) {
 495         val = pmp_read_cfg(env, (reg_index * 4) + i);
 496         cfg_val |= (val << (i * 8));
 497     }
 498     trace_pmpcfg_csr_read(env->mhartid, reg_index, cfg_val);
 499
 500     return cfg_val;
 501 }
 502
 503
 504 /*
 505  * Handle a write to a pmpaddr CSP
 506  */
 507 void pmpaddr_csr_write(CPURISCVState *env, uint32_t addr_index,
 508     target_ulong val)
 509 {
 510     trace_pmpaddr_csr_write(env->mhartid, addr_index, val);
 511
 512     if (addr_index < MAX_RISCV_PMPS) {
 513         /*
 514          * In TOR mode, need to check the lock bit of the next pmp
 515          * (if there is a next).
 516          */
 517         if (addr_index + 1 < MAX_RISCV_PMPS) {
 518             uint8_t pmp_cfg = env->pmp_state.pmp[addr_index + 1].cfg_reg;
 519
 520             if (pmp_cfg & PMP_LOCK &&
 521                 PMP_AMATCH_TOR == pmp_get_a_field(pmp_cfg)) {
 522                 qemu_log_mask(LOG_GUEST_ERROR,
 523                               "ignoring pmpaddr write - pmpcfg + 1 locked\n");
 524                 return;
 525             }
 526         }
 527
 528         if (!pmp_is_locked(env, addr_index)) {
 529             env->pmp_state.pmp[addr_index].addr_reg = val;
 530             pmp_update_rule(env, addr_index);
 531         } else {
 532             qemu_log_mask(LOG_GUEST_ERROR,
 533                           "ignoring pmpaddr write - locked\n");
 534         }
 535     } else {
 536         qemu_log_mask(LOG_GUEST_ERROR,
 537                       "ignoring pmpaddr write - out of bounds\n");
 538     }
 539 }
 540
 541
 542 /*
 543  * Handle a read from a pmpaddr CSP
 544  */
 545 target_ulong pmpaddr_csr_read(CPURISCVState *env, uint32_t addr_index)
 546 {
 547     target_ulong val = 0;
 548
 549     if (addr_index < MAX_RISCV_PMPS) {
 550         val = env->pmp_state.pmp[addr_index].addr_reg;
 551         trace_pmpaddr_csr_read(env->mhartid, addr_index, val);
 552     } else {
 553         qemu_log_mask(LOG_GUEST_ERROR,
 554                       "ignoring pmpaddr read - out of bounds\n");
 555     }
 556
 557     return val;
 558 }
 559
 560 /*
 561  * Handle a write to a mseccfg CSR
 562  */
 563 void mseccfg_csr_write(CPURISCVState *env, target_ulong val)
 564 {
 565     int i;
 566
 567     trace_mseccfg_csr_write(env->mhartid, val);
 568
 569     /* RLB cannot be enabled if it's already 0 and if any regions are locked */
 570     if (!MSECCFG_RLB_ISSET(env)) {
 571         for (i = 0; i < MAX_RISCV_PMPS; i++) {
 572             if (pmp_is_locked(env, i)) {
 573                 val &= ~MSECCFG_RLB;
 574                 break;
 575             }
 576         }
 577     }
 578
 579     /* Sticky bits */
 580     val |= (env->mseccfg & (MSECCFG_MMWP | MSECCFG_MML));
 581
 582     env->mseccfg = val;
 583 }
 584
 585 /*
 586  * Handle a read from a mseccfg CSR
 587  */
 588 target_ulong mseccfg_csr_read(CPURISCVState *env)
 589 {
 590     trace_mseccfg_csr_read(env->mhartid, env->mseccfg);
 591     return env->mseccfg;
 592 }
 593
 594 /*
 595  * Calculate the TLB size if the start address or the end address of
 596  * PMP entry is presented in thie TLB page.
 597  */
 598 static target_ulong pmp_get_tlb_size(CPURISCVState *env, int pmp_index,
 599                                      target_ulong tlb_sa, target_ulong tlb_ea)
 600 {
 601     target_ulong pmp_sa = env->pmp_state.addr[pmp_index].sa;
 602     target_ulong pmp_ea = env->pmp_state.addr[pmp_index].ea;
 603
 604     if (pmp_sa >= tlb_sa && pmp_ea <= tlb_ea) {
 605         return pmp_ea - pmp_sa + 1;
 606     }
 607
 608     if (pmp_sa >= tlb_sa && pmp_sa <= tlb_ea && pmp_ea >= tlb_ea) {
 609         return tlb_ea - pmp_sa + 1;
 610     }
 611
 612     if (pmp_ea <= tlb_ea && pmp_ea >= tlb_sa && pmp_sa <= tlb_sa) {
 613         return pmp_ea - tlb_sa + 1;
 614     }
 615
 616     return 0;
 617 }
 618
 619 /*
 620  * Check is there a PMP entry which range covers this page. If so,
 621  * try to find the minimum granularity for the TLB size.
 622  */
 623 bool pmp_is_range_in_tlb(CPURISCVState *env, hwaddr tlb_sa,
 624                          target_ulong *tlb_size)
 625 {
 626     int i;
 627     target_ulong val;
 628     target_ulong tlb_ea = (tlb_sa + TARGET_PAGE_SIZE - 1);
 629
 630     for (i = 0; i < MAX_RISCV_PMPS; i++) {
 631         val = pmp_get_tlb_size(env, i, tlb_sa, tlb_ea);
 632         if (val) {
 633             if (*tlb_size == 0 || *tlb_size > val) {
 634                 *tlb_size = val;
 635             }
 636         }
 637     }
 638
 639     if (*tlb_size != 0) {
 640         return true;
 641     }
 642
 643     return false;
 644 }
 645
 646 /*
 647  * Convert PMP privilege to TLB page privilege.
 648  */
 649 int pmp_priv_to_page_prot(pmp_priv_t pmp_priv)
 650 {
 651     int prot = 0;
 652
 653     if (pmp_priv & PMP_READ) {
 654         prot |= PAGE_READ;
 655     }
 656     if (pmp_priv & PMP_WRITE) {
 657         prot |= PAGE_WRITE;
 658     }
 659     if (pmp_priv & PMP_EXEC) {
 660         prot |= PAGE_EXEC;
 661     }
 662
 663     return prot;
 664 }