target/riscv/pmp.c

   1 /*
   2  * QEMU RISC-V PMP (Physical Memory Protection)
   3  *
   4  * Author: Daire McNamara, daire.mcnamara@emdalo.com
   5  *         Ivan Griffin, ivan.griffin@emdalo.com
   6  *
   7  * This provides a RISC-V Physical Memory Protection implementation
   8  *
   9  * This program is free software; you can redistribute it and/or modify it
  10  * under the terms and conditions of the GNU General Public License,
  11  * version 2 or later, as published by the Free Software Foundation.
  12  *
  13  * This program is distributed in the hope it will be useful, but WITHOUT
  14  * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
  15  * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
  16  * more details.
  17  *
  18  * You should have received a copy of the GNU General Public License along with
  19  * this program.  If not, see <http://www.gnu.org/licenses/>.
  20  */
  21
  22 /*
  23  * PMP (Physical Memory Protection) is as-of-yet unused and needs testing.
  24  */
  25
  26 #include "qemu/osdep.h"
  27 #include "qemu/log.h"
  28 #include "qapi/error.h"
  29 #include "cpu.h"
  30 #include "trace.h"
  31
  32 static void pmp_write_cfg(CPURISCVState *env, uint32_t addr_index,
  33     uint8_t val);
  34 static uint8_t pmp_read_cfg(CPURISCVState *env, uint32_t addr_index);
  35 static void pmp_update_rule(CPURISCVState *env, uint32_t pmp_index);
  36
  37 /*
  38  * Accessor method to extract address matching type 'a field' from cfg reg
  39  */
  40 static inline uint8_t pmp_get_a_field(uint8_t cfg)
  41 {
  42     uint8_t a = cfg >> 3;
  43     return a & 0x3;
  44 }
  45
  46 /*
  47  * Check whether a PMP is locked or not.
  48  */
  49 static inline int pmp_is_locked(CPURISCVState *env, uint32_t pmp_index)
  50 {
  51
  52     if (env->pmp_state.pmp[pmp_index].cfg_reg & PMP_LOCK) {
  53         return 1;
  54     }
  55
  56     /* Top PMP has no 'next' to check */
  57     if ((pmp_index + 1u) >= MAX_RISCV_PMPS) {
  58         return 0;
  59     }
  60
  61     /* In TOR mode, need to check the lock bit of the next pmp
  62      * (if there is a next)
  63      */
  64     const uint8_t a_field =
  65         pmp_get_a_field(env->pmp_state.pmp[pmp_index + 1].cfg_reg);
  66     if ((env->pmp_state.pmp[pmp_index + 1u].cfg_reg & PMP_LOCK) &&
  67          (PMP_AMATCH_TOR == a_field)) {
  68         return 1;
  69     }
  70
  71     return 0;
  72 }
  73
  74 /*
  75  * Count the number of active rules.
  76  */
  77 uint32_t pmp_get_num_rules(CPURISCVState *env)
  78 {
  79      return env->pmp_state.num_rules;
  80 }
  81
  82 /*
  83  * Accessor to get the cfg reg for a specific PMP/HART
  84  */
  85 static inline uint8_t pmp_read_cfg(CPURISCVState *env, uint32_t pmp_index)
  86 {
  87     if (pmp_index < MAX_RISCV_PMPS) {
  88         return env->pmp_state.pmp[pmp_index].cfg_reg;
  89     }
  90
  91     return 0;
  92 }
  93
  94
  95 /*
  96  * Accessor to set the cfg reg for a specific PMP/HART
  97  * Bounds checks and relevant lock bit.
  98  */
  99 static void pmp_write_cfg(CPURISCVState *env, uint32_t pmp_index, uint8_t val)
 100 {
 101     if (pmp_index < MAX_RISCV_PMPS) {
 102         if (!pmp_is_locked(env, pmp_index)) {
 103             env->pmp_state.pmp[pmp_index].cfg_reg = val;
 104             pmp_update_rule(env, pmp_index);
 105         } else {
 106             qemu_log_mask(LOG_GUEST_ERROR, "ignoring pmpcfg write - locked\n");
 107         }
 108     } else {
 109         qemu_log_mask(LOG_GUEST_ERROR,
 110                       "ignoring pmpcfg write - out of bounds\n");
 111     }
 112 }
 113
 114 static void pmp_decode_napot(target_ulong a, target_ulong *sa, target_ulong *ea)
 115 {
 116     /*
 117        aaaa...aaa0   8-byte NAPOT range
 118        aaaa...aa01   16-byte NAPOT range
 119        aaaa...a011   32-byte NAPOT range
 120        ...
 121        aa01...1111   2^XLEN-byte NAPOT range
 122        a011...1111   2^(XLEN+1)-byte NAPOT range
 123        0111...1111   2^(XLEN+2)-byte NAPOT range
 124        1111...1111   Reserved
 125     */
 126     if (a == -1) {
 127         *sa = 0u;
 128         *ea = -1;
 129         return;
 130     } else {
 131         target_ulong t1 = ctz64(~a);
 132         target_ulong base = (a & ~(((target_ulong)1 << t1) - 1)) << 2;
 133         target_ulong range = ((target_ulong)1 << (t1 + 3)) - 1;
 134         *sa = base;
 135         *ea = base + range;
 136     }
 137 }
 138
 139 void pmp_update_rule_addr(CPURISCVState *env, uint32_t pmp_index)
 140 {
 141     uint8_t this_cfg = env->pmp_state.pmp[pmp_index].cfg_reg;
 142     target_ulong this_addr = env->pmp_state.pmp[pmp_index].addr_reg;
 143     target_ulong prev_addr = 0u;
 144     target_ulong sa = 0u;
 145     target_ulong ea = 0u;
 146
 147     if (pmp_index >= 1u) {
 148         prev_addr = env->pmp_state.pmp[pmp_index - 1].addr_reg;
 149     }
 150
 151     switch (pmp_get_a_field(this_cfg)) {
 152     case PMP_AMATCH_OFF:
 153         sa = 0u;
 154         ea = -1;
 155         break;
 156
 157     case PMP_AMATCH_TOR:
 158         sa = prev_addr << 2; /* shift up from [xx:0] to [xx+2:2] */
 159         ea = (this_addr << 2) - 1u;
 160         break;
 161
 162     case PMP_AMATCH_NA4:
 163         sa = this_addr << 2; /* shift up from [xx:0] to [xx+2:2] */
 164         ea = (sa + 4u) - 1u;
 165         break;
 166
 167     case PMP_AMATCH_NAPOT:
 168         pmp_decode_napot(this_addr, &sa, &ea);
 169         break;
 170
 171     default:
 172         sa = 0u;
 173         ea = 0u;
 174         break;
 175     }
 176
 177     env->pmp_state.addr[pmp_index].sa = sa;
 178     env->pmp_state.addr[pmp_index].ea = ea;
 179 }
 180
 181 void pmp_update_rule_nums(CPURISCVState *env)
 182 {
 183     int i;
 184
 185     env->pmp_state.num_rules = 0;
 186     for (i = 0; i < MAX_RISCV_PMPS; i++) {
 187         const uint8_t a_field =
 188             pmp_get_a_field(env->pmp_state.pmp[i].cfg_reg);
 189         if (PMP_AMATCH_OFF != a_field) {
 190             env->pmp_state.num_rules++;
 191         }
 192     }
 193 }
 194
 195 /* Convert cfg/addr reg values here into simple 'sa' --> start address and 'ea'
 196  *   end address values.
 197  *   This function is called relatively infrequently whereas the check that
 198  *   an address is within a pmp rule is called often, so optimise that one
 199  */
 200 static void pmp_update_rule(CPURISCVState *env, uint32_t pmp_index)
 201 {
 202     pmp_update_rule_addr(env, pmp_index);
 203     pmp_update_rule_nums(env);
 204 }
 205
 206 static int pmp_is_in_range(CPURISCVState *env, int pmp_index, target_ulong addr)
 207 {
 208     int result = 0;
 209
 210     if ((addr >= env->pmp_state.addr[pmp_index].sa)
 211         && (addr <= env->pmp_state.addr[pmp_index].ea)) {
 212         result = 1;
 213     } else {
 214         result = 0;
 215     }
 216
 217     return result;
 218 }
 219
 220 /*
 221  * Check if the address has required RWX privs when no PMP entry is matched.
 222  */
 223 static bool pmp_hart_has_privs_default(CPURISCVState *env, target_ulong addr,
 224     target_ulong size, pmp_priv_t privs, pmp_priv_t *allowed_privs,
 225     target_ulong mode)
 226 {
 227     bool ret;
 228
 229     if ((!riscv_feature(env, RISCV_FEATURE_PMP)) || (mode == PRV_M)) {
 230         /*
 231          * Privileged spec v1.10 states if HW doesn't implement any PMP entry
 232          * or no PMP entry matches an M-Mode access, the access succeeds.
 233          */
 234         ret = true;
 235         *allowed_privs = PMP_READ | PMP_WRITE | PMP_EXEC;
 236     } else {
 237         /*
 238          * Other modes are not allowed to succeed if they don't * match a rule,
 239          * but there are rules. We've checked for no rule earlier in this
 240          * function.
 241          */
 242         ret = false;
 243         *allowed_privs = 0;
 244     }
 245
 246     return ret;
 247 }
 248
 249
 250 /*
 251  * Public Interface
 252  */
 253
 254 /*
 255  * Check if the address has required RWX privs to complete desired operation
 256  */
 257 bool pmp_hart_has_privs(CPURISCVState *env, target_ulong addr,
 258     target_ulong size, pmp_priv_t privs, pmp_priv_t *allowed_privs,
 259     target_ulong mode)
 260 {
 261     int i = 0;
 262     int ret = -1;
 263     int pmp_size = 0;
 264     target_ulong s = 0;
 265     target_ulong e = 0;
 266
 267     /* Short cut if no rules */
 268     if (0 == pmp_get_num_rules(env)) {
 269         return pmp_hart_has_privs_default(env, addr, size, privs,
 270                                           allowed_privs, mode);
 271     }
 272
 273     if (size == 0) {
 274         if (riscv_feature(env, RISCV_FEATURE_MMU)) {
 275             /*
 276              * If size is unknown (0), assume that all bytes
 277              * from addr to the end of the page will be accessed.
 278              */
 279             pmp_size = -(addr | TARGET_PAGE_MASK);
 280         } else {
 281             pmp_size = sizeof(target_ulong);
 282         }
 283     } else {
 284         pmp_size = size;
 285     }
 286
 287     /* 1.10 draft priv spec states there is an implicit order
 288          from low to high */
 289     for (i = 0; i < MAX_RISCV_PMPS; i++) {
 290         s = pmp_is_in_range(env, i, addr);
 291         e = pmp_is_in_range(env, i, addr + pmp_size - 1);
 292
 293         /* partially inside */
 294         if ((s + e) == 1) {
 295             qemu_log_mask(LOG_GUEST_ERROR,
 296                           "pmp violation - access is partially inside\n");
 297             ret = 0;
 298             break;
 299         }
 300
 301         /* fully inside */
 302         const uint8_t a_field =
 303             pmp_get_a_field(env->pmp_state.pmp[i].cfg_reg);
 304
 305         /*
 306          * If the PMP entry is not off and the address is in range, do the priv
 307          * check
 308          */
 309         if (((s + e) == 2) && (PMP_AMATCH_OFF != a_field)) {
 310             *allowed_privs = PMP_READ | PMP_WRITE | PMP_EXEC;
 311             if ((mode != PRV_M) || pmp_is_locked(env, i)) {
 312                 *allowed_privs &= env->pmp_state.pmp[i].cfg_reg;
 313             }
 314
 315             ret = ((privs & *allowed_privs) == privs);
 316             break;
 317         }
 318     }
 319
 320     /* No rule matched */
 321     if (ret == -1) {
 322         return pmp_hart_has_privs_default(env, addr, size, privs,
 323                                           allowed_privs, mode);
 324     }
 325
 326     return ret == 1 ? true : false;
 327 }
 328
 329 /*
 330  * Handle a write to a pmpcfg CSP
 331  */
 332 void pmpcfg_csr_write(CPURISCVState *env, uint32_t reg_index,
 333     target_ulong val)
 334 {
 335     int i;
 336     uint8_t cfg_val;
 337
 338     trace_pmpcfg_csr_write(env->mhartid, reg_index, val);
 339
 340     if ((reg_index & 1) && (sizeof(target_ulong) == 8)) {
 341         qemu_log_mask(LOG_GUEST_ERROR,
 342                       "ignoring pmpcfg write - incorrect address\n");
 343         return;
 344     }
 345
 346     for (i = 0; i < sizeof(target_ulong); i++) {
 347         cfg_val = (val >> 8 * i)  & 0xff;
 348         pmp_write_cfg(env, (reg_index * 4) + i, cfg_val);
 349     }
 350 }
 351
 352
 353 /*
 354  * Handle a read from a pmpcfg CSP
 355  */
 356 target_ulong pmpcfg_csr_read(CPURISCVState *env, uint32_t reg_index)
 357 {
 358     int i;
 359     target_ulong cfg_val = 0;
 360     target_ulong val = 0;
 361
 362     for (i = 0; i < sizeof(target_ulong); i++) {
 363         val = pmp_read_cfg(env, (reg_index * 4) + i);
 364         cfg_val |= (val << (i * 8));
 365     }
 366     trace_pmpcfg_csr_read(env->mhartid, reg_index, cfg_val);
 367
 368     return cfg_val;
 369 }
 370
 371
 372 /*
 373  * Handle a write to a pmpaddr CSP
 374  */
 375 void pmpaddr_csr_write(CPURISCVState *env, uint32_t addr_index,
 376     target_ulong val)
 377 {
 378     trace_pmpaddr_csr_write(env->mhartid, addr_index, val);
 379     if (addr_index < MAX_RISCV_PMPS) {
 380         if (!pmp_is_locked(env, addr_index)) {
 381             env->pmp_state.pmp[addr_index].addr_reg = val;
 382             pmp_update_rule(env, addr_index);
 383         } else {
 384             qemu_log_mask(LOG_GUEST_ERROR,
 385                           "ignoring pmpaddr write - locked\n");
 386         }
 387     } else {
 388         qemu_log_mask(LOG_GUEST_ERROR,
 389                       "ignoring pmpaddr write - out of bounds\n");
 390     }
 391 }
 392
 393
 394 /*
 395  * Handle a read from a pmpaddr CSP
 396  */
 397 target_ulong pmpaddr_csr_read(CPURISCVState *env, uint32_t addr_index)
 398 {
 399     target_ulong val = 0;
 400
 401     if (addr_index < MAX_RISCV_PMPS) {
 402         val = env->pmp_state.pmp[addr_index].addr_reg;
 403         trace_pmpaddr_csr_read(env->mhartid, addr_index, val);
 404     } else {
 405         qemu_log_mask(LOG_GUEST_ERROR,
 406                       "ignoring pmpaddr read - out of bounds\n");
 407     }
 408
 409     return val;
 410 }
 411
 412 /*
 413  * Calculate the TLB size if the start address or the end address of
 414  * PMP entry is presented in thie TLB page.
 415  */
 416 static target_ulong pmp_get_tlb_size(CPURISCVState *env, int pmp_index,
 417                                      target_ulong tlb_sa, target_ulong tlb_ea)
 418 {
 419     target_ulong pmp_sa = env->pmp_state.addr[pmp_index].sa;
 420     target_ulong pmp_ea = env->pmp_state.addr[pmp_index].ea;
 421
 422     if (pmp_sa >= tlb_sa && pmp_ea <= tlb_ea) {
 423         return pmp_ea - pmp_sa + 1;
 424     }
 425
 426     if (pmp_sa >= tlb_sa && pmp_sa <= tlb_ea && pmp_ea >= tlb_ea) {
 427         return tlb_ea - pmp_sa + 1;
 428     }
 429
 430     if (pmp_ea <= tlb_ea && pmp_ea >= tlb_sa && pmp_sa <= tlb_sa) {
 431         return pmp_ea - tlb_sa + 1;
 432     }
 433
 434     return 0;
 435 }
 436
 437 /*
 438  * Check is there a PMP entry which range covers this page. If so,
 439  * try to find the minimum granularity for the TLB size.
 440  */
 441 bool pmp_is_range_in_tlb(CPURISCVState *env, hwaddr tlb_sa,
 442                          target_ulong *tlb_size)
 443 {
 444     int i;
 445     target_ulong val;
 446     target_ulong tlb_ea = (tlb_sa + TARGET_PAGE_SIZE - 1);
 447
 448     for (i = 0; i < MAX_RISCV_PMPS; i++) {
 449         val = pmp_get_tlb_size(env, i, tlb_sa, tlb_ea);
 450         if (val) {
 451             if (*tlb_size == 0 || *tlb_size > val) {
 452                 *tlb_size = val;
 453             }
 454         }
 455     }
 456
 457     if (*tlb_size != 0) {
 458         return true;
 459     }
 460
 461     return false;
 462 }
 463
 464 /*
 465  * Convert PMP privilege to TLB page privilege.
 466  */
 467 int pmp_priv_to_page_prot(pmp_priv_t pmp_priv)
 468 {
 469     int prot = 0;
 470
 471     if (pmp_priv & PMP_READ) {
 472         prot |= PAGE_READ;
 473     }
 474     if (pmp_priv & PMP_WRITE) {
 475         prot |= PAGE_WRITE;
 476     }
 477     if (pmp_priv & PMP_EXEC) {
 478         prot |= PAGE_EXEC;
 479     }
 480
 481     return prot;
 482 }