target/riscv/pmp.c

   1 /*
   2  * QEMU RISC-V PMP (Physical Memory Protection)
   3  *
   4  * Author: Daire McNamara, daire.mcnamara@emdalo.com
   5  *         Ivan Griffin, ivan.griffin@emdalo.com
   6  *
   7  * This provides a RISC-V Physical Memory Protection implementation
   8  *
   9  * This program is free software; you can redistribute it and/or modify it
  10  * under the terms and conditions of the GNU General Public License,
  11  * version 2 or later, as published by the Free Software Foundation.
  12  *
  13  * This program is distributed in the hope it will be useful, but WITHOUT
  14  * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
  15  * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
  16  * more details.
  17  *
  18  * You should have received a copy of the GNU General Public License along with
  19  * this program.  If not, see <http://www.gnu.org/licenses/>.
  20  */
  21
  22 #include "qemu/osdep.h"
  23 #include "qemu/log.h"
  24 #include "qapi/error.h"
  25 #include "cpu.h"
  26 #include "trace.h"
  27 #include "exec/exec-all.h"
  28
  29 static void pmp_write_cfg(CPURISCVState *env, uint32_t addr_index,
  30                           uint8_t val);
  31 static uint8_t pmp_read_cfg(CPURISCVState *env, uint32_t addr_index);
  32 static void pmp_update_rule(CPURISCVState *env, uint32_t pmp_index);
  33
  34 /*
  35  * Accessor method to extract address matching type 'a field' from cfg reg
  36  */
  37 static inline uint8_t pmp_get_a_field(uint8_t cfg)
  38 {
  39     uint8_t a = cfg >> 3;
  40     return a & 0x3;
  41 }
  42
  43 /*
  44  * Check whether a PMP is locked or not.
  45  */
  46 static inline int pmp_is_locked(CPURISCVState *env, uint32_t pmp_index)
  47 {
  48
  49     if (env->pmp_state.pmp[pmp_index].cfg_reg & PMP_LOCK) {
  50         return 1;
  51     }
  52
  53     /* Top PMP has no 'next' to check */
  54     if ((pmp_index + 1u) >= MAX_RISCV_PMPS) {
  55         return 0;
  56     }
  57
  58     return 0;
  59 }
  60
  61 /*
  62  * Count the number of active rules.
  63  */
  64 uint32_t pmp_get_num_rules(CPURISCVState *env)
  65 {
  66      return env->pmp_state.num_rules;
  67 }
  68
  69 /*
  70  * Accessor to get the cfg reg for a specific PMP/HART
  71  */
  72 static inline uint8_t pmp_read_cfg(CPURISCVState *env, uint32_t pmp_index)
  73 {
  74     if (pmp_index < MAX_RISCV_PMPS) {
  75         return env->pmp_state.pmp[pmp_index].cfg_reg;
  76     }
  77
  78     return 0;
  79 }
  80
  81
  82 /*
  83  * Accessor to set the cfg reg for a specific PMP/HART
  84  * Bounds checks and relevant lock bit.
  85  */
  86 static void pmp_write_cfg(CPURISCVState *env, uint32_t pmp_index, uint8_t val)
  87 {
  88     if (pmp_index < MAX_RISCV_PMPS) {
  89         bool locked = true;
  90
  91         if (riscv_cpu_cfg(env)->epmp) {
  92             /* mseccfg.RLB is set */
  93             if (MSECCFG_RLB_ISSET(env)) {
  94                 locked = false;
  95             }
  96
  97             /* mseccfg.MML is not set */
  98             if (!MSECCFG_MML_ISSET(env) && !pmp_is_locked(env, pmp_index)) {
  99                 locked = false;
 100             }
 101
 102             /* mseccfg.MML is set */
 103             if (MSECCFG_MML_ISSET(env)) {
 104                 /* not adding execute bit */
 105                 if ((val & PMP_LOCK) != 0 && (val & PMP_EXEC) != PMP_EXEC) {
 106                     locked = false;
 107                 }
 108                 /* shared region and not adding X bit */
 109                 if ((val & PMP_LOCK) != PMP_LOCK &&
 110                     (val & 0x7) != (PMP_WRITE | PMP_EXEC)) {
 111                     locked = false;
 112                 }
 113             }
 114         } else {
 115             if (!pmp_is_locked(env, pmp_index)) {
 116                 locked = false;
 117             }
 118         }
 119
 120         if (locked) {
 121             qemu_log_mask(LOG_GUEST_ERROR, "ignoring pmpcfg write - locked\n");
 122         } else {
 123             env->pmp_state.pmp[pmp_index].cfg_reg = val;
 124             pmp_update_rule(env, pmp_index);
 125         }
 126     } else {
 127         qemu_log_mask(LOG_GUEST_ERROR,
 128                       "ignoring pmpcfg write - out of bounds\n");
 129     }
 130 }
 131
 132 static void pmp_decode_napot(target_ulong a, target_ulong *sa,
 133                              target_ulong *ea)
 134 {
 135     /*
 136      * aaaa...aaa0   8-byte NAPOT range
 137      * aaaa...aa01   16-byte NAPOT range
 138      * aaaa...a011   32-byte NAPOT range
 139      * ...
 140      * aa01...1111   2^XLEN-byte NAPOT range
 141      * a011...1111   2^(XLEN+1)-byte NAPOT range
 142      * 0111...1111   2^(XLEN+2)-byte NAPOT range
 143      * 1111...1111   Reserved
 144      */
 145     a = (a << 2) | 0x3;
 146     *sa = a & (a + 1);
 147     *ea = a | (a + 1);
 148 }
 149
 150 void pmp_update_rule_addr(CPURISCVState *env, uint32_t pmp_index)
 151 {
 152     uint8_t this_cfg = env->pmp_state.pmp[pmp_index].cfg_reg;
 153     target_ulong this_addr = env->pmp_state.pmp[pmp_index].addr_reg;
 154     target_ulong prev_addr = 0u;
 155     target_ulong sa = 0u;
 156     target_ulong ea = 0u;
 157
 158     if (pmp_index >= 1u) {
 159         prev_addr = env->pmp_state.pmp[pmp_index - 1].addr_reg;
 160     }
 161
 162     switch (pmp_get_a_field(this_cfg)) {
 163     case PMP_AMATCH_OFF:
 164         sa = 0u;
 165         ea = -1;
 166         break;
 167
 168     case PMP_AMATCH_TOR:
 169         sa = prev_addr << 2; /* shift up from [xx:0] to [xx+2:2] */
 170         ea = (this_addr << 2) - 1u;
 171         if (sa > ea) {
 172             sa = ea = 0u;
 173         }
 174         break;
 175
 176     case PMP_AMATCH_NA4:
 177         sa = this_addr << 2; /* shift up from [xx:0] to [xx+2:2] */
 178         ea = (sa + 4u) - 1u;
 179         break;
 180
 181     case PMP_AMATCH_NAPOT:
 182         pmp_decode_napot(this_addr, &sa, &ea);
 183         break;
 184
 185     default:
 186         sa = 0u;
 187         ea = 0u;
 188         break;
 189     }
 190
 191     env->pmp_state.addr[pmp_index].sa = sa;
 192     env->pmp_state.addr[pmp_index].ea = ea;
 193 }
 194
 195 void pmp_update_rule_nums(CPURISCVState *env)
 196 {
 197     int i;
 198
 199     env->pmp_state.num_rules = 0;
 200     for (i = 0; i < MAX_RISCV_PMPS; i++) {
 201         const uint8_t a_field =
 202             pmp_get_a_field(env->pmp_state.pmp[i].cfg_reg);
 203         if (PMP_AMATCH_OFF != a_field) {
 204             env->pmp_state.num_rules++;
 205         }
 206     }
 207 }
 208
 209 /*
 210  * Convert cfg/addr reg values here into simple 'sa' --> start address and 'ea'
 211  *   end address values.
 212  *   This function is called relatively infrequently whereas the check that
 213  *   an address is within a pmp rule is called often, so optimise that one
 214  */
 215 static void pmp_update_rule(CPURISCVState *env, uint32_t pmp_index)
 216 {
 217     pmp_update_rule_addr(env, pmp_index);
 218     pmp_update_rule_nums(env);
 219 }
 220
 221 static int pmp_is_in_range(CPURISCVState *env, int pmp_index,
 222                            target_ulong addr)
 223 {
 224     int result = 0;
 225
 226     if ((addr >= env->pmp_state.addr[pmp_index].sa) &&
 227         (addr <= env->pmp_state.addr[pmp_index].ea)) {
 228         result = 1;
 229     } else {
 230         result = 0;
 231     }
 232
 233     return result;
 234 }
 235
 236 /*
 237  * Check if the address has required RWX privs when no PMP entry is matched.
 238  */
 239 static bool pmp_hart_has_privs_default(CPURISCVState *env, target_ulong addr,
 240                                        target_ulong size, pmp_priv_t privs,
 241                                        pmp_priv_t *allowed_privs,
 242                                        target_ulong mode)
 243 {
 244     bool ret;
 245
 246     if (riscv_cpu_cfg(env)->epmp) {
 247         if (MSECCFG_MMWP_ISSET(env)) {
 248             /*
 249              * The Machine Mode Whitelist Policy (mseccfg.MMWP) is set
 250              * so we default to deny all, even for M-mode.
 251              */
 252             *allowed_privs = 0;
 253             return false;
 254         } else if (MSECCFG_MML_ISSET(env)) {
 255             /*
 256              * The Machine Mode Lockdown (mseccfg.MML) bit is set
 257              * so we can only execute code in M-mode with an applicable
 258              * rule. Other modes are disabled.
 259              */
 260             if (mode == PRV_M && !(privs & PMP_EXEC)) {
 261                 ret = true;
 262                 *allowed_privs = PMP_READ | PMP_WRITE;
 263             } else {
 264                 ret = false;
 265                 *allowed_privs = 0;
 266             }
 267
 268             return ret;
 269         }
 270     }
 271
 272     if (!riscv_cpu_cfg(env)->pmp || (mode == PRV_M)) {
 273         /*
 274          * Privileged spec v1.10 states if HW doesn't implement any PMP entry
 275          * or no PMP entry matches an M-Mode access, the access succeeds.
 276          */
 277         ret = true;
 278         *allowed_privs = PMP_READ | PMP_WRITE | PMP_EXEC;
 279     } else {
 280         /*
 281          * Other modes are not allowed to succeed if they don't * match a rule,
 282          * but there are rules. We've checked for no rule earlier in this
 283          * function.
 284          */
 285         ret = false;
 286         *allowed_privs = 0;
 287     }
 288
 289     return ret;
 290 }
 291
 292
 293 /*
 294  * Public Interface
 295  */
 296
 297 /*
 298  * Check if the address has required RWX privs to complete desired operation
 299  * Return PMP rule index if a pmp rule match
 300  * Return MAX_RISCV_PMPS if default match
 301  * Return negtive value if no match
 302  */
 303 int pmp_hart_has_privs(CPURISCVState *env, target_ulong addr,
 304                        target_ulong size, pmp_priv_t privs,
 305                        pmp_priv_t *allowed_privs, target_ulong mode)
 306 {
 307     int i = 0;
 308     int ret = -1;
 309     int pmp_size = 0;
 310     target_ulong s = 0;
 311     target_ulong e = 0;
 312
 313     /* Short cut if no rules */
 314     if (0 == pmp_get_num_rules(env)) {
 315         if (pmp_hart_has_privs_default(env, addr, size, privs,
 316                                        allowed_privs, mode)) {
 317             ret = MAX_RISCV_PMPS;
 318         }
 319     }
 320
 321     if (size == 0) {
 322         if (riscv_cpu_cfg(env)->mmu) {
 323             /*
 324              * If size is unknown (0), assume that all bytes
 325              * from addr to the end of the page will be accessed.
 326              */
 327             pmp_size = -(addr | TARGET_PAGE_MASK);
 328         } else {
 329             pmp_size = sizeof(target_ulong);
 330         }
 331     } else {
 332         pmp_size = size;
 333     }
 334
 335     /*
 336      * 1.10 draft priv spec states there is an implicit order
 337      * from low to high
 338      */
 339     for (i = 0; i < MAX_RISCV_PMPS; i++) {
 340         s = pmp_is_in_range(env, i, addr);
 341         e = pmp_is_in_range(env, i, addr + pmp_size - 1);
 342
 343         /* partially inside */
 344         if ((s + e) == 1) {
 345             qemu_log_mask(LOG_GUEST_ERROR,
 346                           "pmp violation - access is partially inside\n");
 347             ret = -1;
 348             break;
 349         }
 350
 351         /* fully inside */
 352         const uint8_t a_field =
 353             pmp_get_a_field(env->pmp_state.pmp[i].cfg_reg);
 354
 355         /*
 356          * Convert the PMP permissions to match the truth table in the
 357          * ePMP spec.
 358          */
 359         const uint8_t epmp_operation =
 360             ((env->pmp_state.pmp[i].cfg_reg & PMP_LOCK) >> 4) |
 361             ((env->pmp_state.pmp[i].cfg_reg & PMP_READ) << 2) |
 362             (env->pmp_state.pmp[i].cfg_reg & PMP_WRITE) |
 363             ((env->pmp_state.pmp[i].cfg_reg & PMP_EXEC) >> 2);
 364
 365         if (((s + e) == 2) && (PMP_AMATCH_OFF != a_field)) {
 366             /*
 367              * If the PMP entry is not off and the address is in range,
 368              * do the priv check
 369              */
 370             if (!MSECCFG_MML_ISSET(env)) {
 371                 /*
 372                  * If mseccfg.MML Bit is not set, do pmp priv check
 373                  * This will always apply to regular PMP.
 374                  */
 375                 *allowed_privs = PMP_READ | PMP_WRITE | PMP_EXEC;
 376                 if ((mode != PRV_M) || pmp_is_locked(env, i)) {
 377                     *allowed_privs &= env->pmp_state.pmp[i].cfg_reg;
 378                 }
 379             } else {
 380                 /*
 381                  * If mseccfg.MML Bit set, do the enhanced pmp priv check
 382                  */
 383                 if (mode == PRV_M) {
 384                     switch (epmp_operation) {
 385                     case 0:
 386                     case 1:
 387                     case 4:
 388                     case 5:
 389                     case 6:
 390                     case 7:
 391                     case 8:
 392                         *allowed_privs = 0;
 393                         break;
 394                     case 2:
 395                     case 3:
 396                     case 14:
 397                         *allowed_privs = PMP_READ | PMP_WRITE;
 398                         break;
 399                     case 9:
 400                     case 10:
 401                         *allowed_privs = PMP_EXEC;
 402                         break;
 403                     case 11:
 404                     case 13:
 405                         *allowed_privs = PMP_READ | PMP_EXEC;
 406                         break;
 407                     case 12:
 408                     case 15:
 409                         *allowed_privs = PMP_READ;
 410                         break;
 411                     default:
 412                         g_assert_not_reached();
 413                     }
 414                 } else {
 415                     switch (epmp_operation) {
 416                     case 0:
 417                     case 8:
 418                     case 9:
 419                     case 12:
 420                     case 13:
 421                     case 14:
 422                         *allowed_privs = 0;
 423                         break;
 424                     case 1:
 425                     case 10:
 426                     case 11:
 427                         *allowed_privs = PMP_EXEC;
 428                         break;
 429                     case 2:
 430                     case 4:
 431                     case 15:
 432                         *allowed_privs = PMP_READ;
 433                         break;
 434                     case 3:
 435                     case 6:
 436                         *allowed_privs = PMP_READ | PMP_WRITE;
 437                         break;
 438                     case 5:
 439                         *allowed_privs = PMP_READ | PMP_EXEC;
 440                         break;
 441                     case 7:
 442                         *allowed_privs = PMP_READ | PMP_WRITE | PMP_EXEC;
 443                         break;
 444                     default:
 445                         g_assert_not_reached();
 446                     }
 447                 }
 448             }
 449
 450             /*
 451              * If matching address range was found, the protection bits
 452              * defined with PMP must be used. We shouldn't fallback on
 453              * finding default privileges.
 454              */
 455             ret = i;
 456             break;
 457         }
 458     }
 459
 460     /* No rule matched */
 461     if (ret == -1) {
 462         if (pmp_hart_has_privs_default(env, addr, size, privs,
 463                                        allowed_privs, mode)) {
 464             ret = MAX_RISCV_PMPS;
 465         }
 466     }
 467
 468     return ret;
 469 }
 470
 471 /*
 472  * Handle a write to a pmpcfg CSR
 473  */
 474 void pmpcfg_csr_write(CPURISCVState *env, uint32_t reg_index,
 475                       target_ulong val)
 476 {
 477     int i;
 478     uint8_t cfg_val;
 479     int pmpcfg_nums = 2 << riscv_cpu_mxl(env);
 480
 481     trace_pmpcfg_csr_write(env->mhartid, reg_index, val);
 482
 483     for (i = 0; i < pmpcfg_nums; i++) {
 484         cfg_val = (val >> 8 * i)  & 0xff;
 485         pmp_write_cfg(env, (reg_index * 4) + i, cfg_val);
 486     }
 487
 488     /* If PMP permission of any addr has been changed, flush TLB pages. */
 489     tlb_flush(env_cpu(env));
 490 }
 491
 492
 493 /*
 494  * Handle a read from a pmpcfg CSR
 495  */
 496 target_ulong pmpcfg_csr_read(CPURISCVState *env, uint32_t reg_index)
 497 {
 498     int i;
 499     target_ulong cfg_val = 0;
 500     target_ulong val = 0;
 501     int pmpcfg_nums = 2 << riscv_cpu_mxl(env);
 502
 503     for (i = 0; i < pmpcfg_nums; i++) {
 504         val = pmp_read_cfg(env, (reg_index * 4) + i);
 505         cfg_val |= (val << (i * 8));
 506     }
 507     trace_pmpcfg_csr_read(env->mhartid, reg_index, cfg_val);
 508
 509     return cfg_val;
 510 }
 511
 512
 513 /*
 514  * Handle a write to a pmpaddr CSR
 515  */
 516 void pmpaddr_csr_write(CPURISCVState *env, uint32_t addr_index,
 517                        target_ulong val)
 518 {
 519     trace_pmpaddr_csr_write(env->mhartid, addr_index, val);
 520
 521     if (addr_index < MAX_RISCV_PMPS) {
 522         /*
 523          * In TOR mode, need to check the lock bit of the next pmp
 524          * (if there is a next).
 525          */
 526         if (addr_index + 1 < MAX_RISCV_PMPS) {
 527             uint8_t pmp_cfg = env->pmp_state.pmp[addr_index + 1].cfg_reg;
 528
 529             if (pmp_cfg & PMP_LOCK &&
 530                 PMP_AMATCH_TOR == pmp_get_a_field(pmp_cfg)) {
 531                 qemu_log_mask(LOG_GUEST_ERROR,
 532                               "ignoring pmpaddr write - pmpcfg + 1 locked\n");
 533                 return;
 534             }
 535         }
 536
 537         if (!pmp_is_locked(env, addr_index)) {
 538             env->pmp_state.pmp[addr_index].addr_reg = val;
 539             pmp_update_rule(env, addr_index);
 540         } else {
 541             qemu_log_mask(LOG_GUEST_ERROR,
 542                           "ignoring pmpaddr write - locked\n");
 543         }
 544     } else {
 545         qemu_log_mask(LOG_GUEST_ERROR,
 546                       "ignoring pmpaddr write - out of bounds\n");
 547     }
 548 }
 549
 550
 551 /*
 552  * Handle a read from a pmpaddr CSR
 553  */
 554 target_ulong pmpaddr_csr_read(CPURISCVState *env, uint32_t addr_index)
 555 {
 556     target_ulong val = 0;
 557
 558     if (addr_index < MAX_RISCV_PMPS) {
 559         val = env->pmp_state.pmp[addr_index].addr_reg;
 560         trace_pmpaddr_csr_read(env->mhartid, addr_index, val);
 561     } else {
 562         qemu_log_mask(LOG_GUEST_ERROR,
 563                       "ignoring pmpaddr read - out of bounds\n");
 564     }
 565
 566     return val;
 567 }
 568
 569 /*
 570  * Handle a write to a mseccfg CSR
 571  */
 572 void mseccfg_csr_write(CPURISCVState *env, target_ulong val)
 573 {
 574     int i;
 575
 576     trace_mseccfg_csr_write(env->mhartid, val);
 577
 578     /* RLB cannot be enabled if it's already 0 and if any regions are locked */
 579     if (!MSECCFG_RLB_ISSET(env)) {
 580         for (i = 0; i < MAX_RISCV_PMPS; i++) {
 581             if (pmp_is_locked(env, i)) {
 582                 val &= ~MSECCFG_RLB;
 583                 break;
 584             }
 585         }
 586     }
 587
 588     /* Sticky bits */
 589     val |= (env->mseccfg & (MSECCFG_MMWP | MSECCFG_MML));
 590
 591     env->mseccfg = val;
 592 }
 593
 594 /*
 595  * Handle a read from a mseccfg CSR
 596  */
 597 target_ulong mseccfg_csr_read(CPURISCVState *env)
 598 {
 599     trace_mseccfg_csr_read(env->mhartid, env->mseccfg);
 600     return env->mseccfg;
 601 }
 602
 603 /*
 604  * Calculate the TLB size.
 605  * It's possible that PMP regions only cover partial of the TLB page, and
 606  * this may split the page into regions with different permissions.
 607  * For example if PMP0 is (0x80000008~0x8000000F, R) and PMP1 is (0x80000000
 608  * ~0x80000FFF, RWX), then region 0x80000008~0x8000000F has R permission, and
 609  * the other regions in this page have RWX permissions.
 610  * A write access to 0x80000000 will match PMP1. However we cannot cache the
 611  * translation result in the TLB since this will make the write access to
 612  * 0x80000008 bypass the check of PMP0.
 613  * To avoid this we return a size of 1 (which means no caching) if the PMP
 614  * region only covers partial of the TLB page.
 615  */
 616 target_ulong pmp_get_tlb_size(CPURISCVState *env, target_ulong addr)
 617 {
 618     target_ulong pmp_sa;
 619     target_ulong pmp_ea;
 620     target_ulong tlb_sa = addr & ~(TARGET_PAGE_SIZE - 1);
 621     target_ulong tlb_ea = tlb_sa + TARGET_PAGE_SIZE - 1;
 622     int i;
 623
 624     /*
 625      * If PMP is not supported or there are no PMP rules, the TLB page will not
 626      * be split into regions with different permissions by PMP so we set the
 627      * size to TARGET_PAGE_SIZE.
 628      */
 629     if (!riscv_cpu_cfg(env)->pmp || !pmp_get_num_rules(env)) {
 630         return TARGET_PAGE_SIZE;
 631     }
 632
 633     for (i = 0; i < MAX_RISCV_PMPS; i++) {
 634         if (pmp_get_a_field(env->pmp_state.pmp[i].cfg_reg) == PMP_AMATCH_OFF) {
 635             continue;
 636         }
 637
 638         pmp_sa = env->pmp_state.addr[i].sa;
 639         pmp_ea = env->pmp_state.addr[i].ea;
 640
 641         /*
 642          * Only the first PMP entry that covers (whole or partial of) the TLB
 643          * page really matters:
 644          * If it covers the whole TLB page, set the size to TARGET_PAGE_SIZE,
 645          * since the following PMP entries have lower priority and will not
 646          * affect the permissions of the page.
 647          * If it only covers partial of the TLB page, set the size to 1 since
 648          * the allowed permissions of the region may be different from other
 649          * region of the page.
 650          */
 651         if (pmp_sa <= tlb_sa && pmp_ea >= tlb_ea) {
 652             return TARGET_PAGE_SIZE;
 653         } else if ((pmp_sa >= tlb_sa && pmp_sa <= tlb_ea) ||
 654                    (pmp_ea >= tlb_sa && pmp_ea <= tlb_ea)) {
 655             return 1;
 656         }
 657     }
 658
 659     /*
 660      * If no PMP entry matches the TLB page, the TLB page will also not be
 661      * split into regions with different permissions by PMP so we set the size
 662      * to TARGET_PAGE_SIZE.
 663      */
 664     return TARGET_PAGE_SIZE;
 665 }
 666
 667 /*
 668  * Convert PMP privilege to TLB page privilege.
 669  */
 670 int pmp_priv_to_page_prot(pmp_priv_t pmp_priv)
 671 {
 672     int prot = 0;
 673
 674     if (pmp_priv & PMP_READ) {
 675         prot |= PAGE_READ;
 676     }
 677     if (pmp_priv & PMP_WRITE) {
 678         prot |= PAGE_WRITE;
 679     }
 680     if (pmp_priv & PMP_EXEC) {
 681         prot |= PAGE_EXEC;
 682     }
 683
 684     return prot;
 685 }