1 /* 2 * QEMU RISC-V PMP (Physical Memory Protection) 3 * 4 * Author: Daire McNamara, daire.mcnamara@emdalo.com 5 * Ivan Griffin, ivan.griffin@emdalo.com 6 * 7 * This provides a RISC-V Physical Memory Protection implementation 8 * 9 * This program is free software; you can redistribute it and/or modify it 10 * under the terms and conditions of the GNU General Public License, 11 * version 2 or later, as published by the Free Software Foundation. 12 * 13 * This program is distributed in the hope it will be useful, but WITHOUT 14 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or 15 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for 16 * more details. 17 * 18 * You should have received a copy of the GNU General Public License along with 19 * this program. If not, see <http://www.gnu.org/licenses/>. 20 */ 21 22 #include "qemu/osdep.h" 23 #include "qemu/log.h" 24 #include "qapi/error.h" 25 #include "cpu.h" 26 #include "trace.h" 27 #include "exec/exec-all.h" 28 29 static void pmp_write_cfg(CPURISCVState *env, uint32_t addr_index, 30 uint8_t val); 31 static uint8_t pmp_read_cfg(CPURISCVState *env, uint32_t addr_index); 32 static void pmp_update_rule(CPURISCVState *env, uint32_t pmp_index); 33 34 /* 35 * Accessor method to extract address matching type 'a field' from cfg reg 36 */ 37 static inline uint8_t pmp_get_a_field(uint8_t cfg) 38 { 39 uint8_t a = cfg >> 3; 40 return a & 0x3; 41 } 42 43 /* 44 * Check whether a PMP is locked or not. 45 */ 46 static inline int pmp_is_locked(CPURISCVState *env, uint32_t pmp_index) 47 { 48 49 if (env->pmp_state.pmp[pmp_index].cfg_reg & PMP_LOCK) { 50 return 1; 51 } 52 53 /* Top PMP has no 'next' to check */ 54 if ((pmp_index + 1u) >= MAX_RISCV_PMPS) { 55 return 0; 56 } 57 58 return 0; 59 } 60 61 /* 62 * Count the number of active rules. 63 */ 64 uint32_t pmp_get_num_rules(CPURISCVState *env) 65 { 66 return env->pmp_state.num_rules; 67 } 68 69 /* 70 * Accessor to get the cfg reg for a specific PMP/HART 71 */ 72 static inline uint8_t pmp_read_cfg(CPURISCVState *env, uint32_t pmp_index) 73 { 74 if (pmp_index < MAX_RISCV_PMPS) { 75 return env->pmp_state.pmp[pmp_index].cfg_reg; 76 } 77 78 return 0; 79 } 80 81 82 /* 83 * Accessor to set the cfg reg for a specific PMP/HART 84 * Bounds checks and relevant lock bit. 85 */ 86 static void pmp_write_cfg(CPURISCVState *env, uint32_t pmp_index, uint8_t val) 87 { 88 if (pmp_index < MAX_RISCV_PMPS) { 89 bool locked = true; 90 91 if (riscv_cpu_cfg(env)->epmp) { 92 /* mseccfg.RLB is set */ 93 if (MSECCFG_RLB_ISSET(env)) { 94 locked = false; 95 } 96 97 /* mseccfg.MML is not set */ 98 if (!MSECCFG_MML_ISSET(env) && !pmp_is_locked(env, pmp_index)) { 99 locked = false; 100 } 101 102 /* mseccfg.MML is set */ 103 if (MSECCFG_MML_ISSET(env)) { 104 /* not adding execute bit */ 105 if ((val & PMP_LOCK) != 0 && (val & PMP_EXEC) != PMP_EXEC) { 106 locked = false; 107 } 108 /* shared region and not adding X bit */ 109 if ((val & PMP_LOCK) != PMP_LOCK && 110 (val & 0x7) != (PMP_WRITE | PMP_EXEC)) { 111 locked = false; 112 } 113 } 114 } else { 115 if (!pmp_is_locked(env, pmp_index)) { 116 locked = false; 117 } 118 } 119 120 if (locked) { 121 qemu_log_mask(LOG_GUEST_ERROR, "ignoring pmpcfg write - locked\n"); 122 } else { 123 env->pmp_state.pmp[pmp_index].cfg_reg = val; 124 pmp_update_rule(env, pmp_index); 125 } 126 } else { 127 qemu_log_mask(LOG_GUEST_ERROR, 128 "ignoring pmpcfg write - out of bounds\n"); 129 } 130 } 131 132 static void pmp_decode_napot(target_ulong a, target_ulong *sa, 133 target_ulong *ea) 134 { 135 /* 136 * aaaa...aaa0 8-byte NAPOT range 137 * aaaa...aa01 16-byte NAPOT range 138 * aaaa...a011 32-byte NAPOT range 139 * ... 140 * aa01...1111 2^XLEN-byte NAPOT range 141 * a011...1111 2^(XLEN+1)-byte NAPOT range 142 * 0111...1111 2^(XLEN+2)-byte NAPOT range 143 * 1111...1111 Reserved 144 */ 145 a = (a << 2) | 0x3; 146 *sa = a & (a + 1); 147 *ea = a | (a + 1); 148 } 149 150 void pmp_update_rule_addr(CPURISCVState *env, uint32_t pmp_index) 151 { 152 uint8_t this_cfg = env->pmp_state.pmp[pmp_index].cfg_reg; 153 target_ulong this_addr = env->pmp_state.pmp[pmp_index].addr_reg; 154 target_ulong prev_addr = 0u; 155 target_ulong sa = 0u; 156 target_ulong ea = 0u; 157 158 if (pmp_index >= 1u) { 159 prev_addr = env->pmp_state.pmp[pmp_index - 1].addr_reg; 160 } 161 162 switch (pmp_get_a_field(this_cfg)) { 163 case PMP_AMATCH_OFF: 164 sa = 0u; 165 ea = -1; 166 break; 167 168 case PMP_AMATCH_TOR: 169 sa = prev_addr << 2; /* shift up from [xx:0] to [xx+2:2] */ 170 ea = (this_addr << 2) - 1u; 171 if (sa > ea) { 172 sa = ea = 0u; 173 } 174 break; 175 176 case PMP_AMATCH_NA4: 177 sa = this_addr << 2; /* shift up from [xx:0] to [xx+2:2] */ 178 ea = (sa + 4u) - 1u; 179 break; 180 181 case PMP_AMATCH_NAPOT: 182 pmp_decode_napot(this_addr, &sa, &ea); 183 break; 184 185 default: 186 sa = 0u; 187 ea = 0u; 188 break; 189 } 190 191 env->pmp_state.addr[pmp_index].sa = sa; 192 env->pmp_state.addr[pmp_index].ea = ea; 193 } 194 195 void pmp_update_rule_nums(CPURISCVState *env) 196 { 197 int i; 198 199 env->pmp_state.num_rules = 0; 200 for (i = 0; i < MAX_RISCV_PMPS; i++) { 201 const uint8_t a_field = 202 pmp_get_a_field(env->pmp_state.pmp[i].cfg_reg); 203 if (PMP_AMATCH_OFF != a_field) { 204 env->pmp_state.num_rules++; 205 } 206 } 207 } 208 209 /* 210 * Convert cfg/addr reg values here into simple 'sa' --> start address and 'ea' 211 * end address values. 212 * This function is called relatively infrequently whereas the check that 213 * an address is within a pmp rule is called often, so optimise that one 214 */ 215 static void pmp_update_rule(CPURISCVState *env, uint32_t pmp_index) 216 { 217 pmp_update_rule_addr(env, pmp_index); 218 pmp_update_rule_nums(env); 219 } 220 221 static int pmp_is_in_range(CPURISCVState *env, int pmp_index, 222 target_ulong addr) 223 { 224 int result = 0; 225 226 if ((addr >= env->pmp_state.addr[pmp_index].sa) && 227 (addr <= env->pmp_state.addr[pmp_index].ea)) { 228 result = 1; 229 } else { 230 result = 0; 231 } 232 233 return result; 234 } 235 236 /* 237 * Check if the address has required RWX privs when no PMP entry is matched. 238 */ 239 static bool pmp_hart_has_privs_default(CPURISCVState *env, target_ulong addr, 240 target_ulong size, pmp_priv_t privs, 241 pmp_priv_t *allowed_privs, 242 target_ulong mode) 243 { 244 bool ret; 245 246 if (riscv_cpu_cfg(env)->epmp) { 247 if (MSECCFG_MMWP_ISSET(env)) { 248 /* 249 * The Machine Mode Whitelist Policy (mseccfg.MMWP) is set 250 * so we default to deny all, even for M-mode. 251 */ 252 *allowed_privs = 0; 253 return false; 254 } else if (MSECCFG_MML_ISSET(env)) { 255 /* 256 * The Machine Mode Lockdown (mseccfg.MML) bit is set 257 * so we can only execute code in M-mode with an applicable 258 * rule. Other modes are disabled. 259 */ 260 if (mode == PRV_M && !(privs & PMP_EXEC)) { 261 ret = true; 262 *allowed_privs = PMP_READ | PMP_WRITE; 263 } else { 264 ret = false; 265 *allowed_privs = 0; 266 } 267 268 return ret; 269 } 270 } 271 272 if (!riscv_cpu_cfg(env)->pmp || (mode == PRV_M)) { 273 /* 274 * Privileged spec v1.10 states if HW doesn't implement any PMP entry 275 * or no PMP entry matches an M-Mode access, the access succeeds. 276 */ 277 ret = true; 278 *allowed_privs = PMP_READ | PMP_WRITE | PMP_EXEC; 279 } else { 280 /* 281 * Other modes are not allowed to succeed if they don't * match a rule, 282 * but there are rules. We've checked for no rule earlier in this 283 * function. 284 */ 285 ret = false; 286 *allowed_privs = 0; 287 } 288 289 return ret; 290 } 291 292 293 /* 294 * Public Interface 295 */ 296 297 /* 298 * Check if the address has required RWX privs to complete desired operation 299 * Return PMP rule index if a pmp rule match 300 * Return MAX_RISCV_PMPS if default match 301 * Return negtive value if no match 302 */ 303 int pmp_hart_has_privs(CPURISCVState *env, target_ulong addr, 304 target_ulong size, pmp_priv_t privs, 305 pmp_priv_t *allowed_privs, target_ulong mode) 306 { 307 int i = 0; 308 int ret = -1; 309 int pmp_size = 0; 310 target_ulong s = 0; 311 target_ulong e = 0; 312 313 /* Short cut if no rules */ 314 if (0 == pmp_get_num_rules(env)) { 315 if (pmp_hart_has_privs_default(env, addr, size, privs, 316 allowed_privs, mode)) { 317 ret = MAX_RISCV_PMPS; 318 } 319 return ret; 320 } 321 322 if (size == 0) { 323 if (riscv_cpu_cfg(env)->mmu) { 324 /* 325 * If size is unknown (0), assume that all bytes 326 * from addr to the end of the page will be accessed. 327 */ 328 pmp_size = -(addr | TARGET_PAGE_MASK); 329 } else { 330 pmp_size = sizeof(target_ulong); 331 } 332 } else { 333 pmp_size = size; 334 } 335 336 /* 337 * 1.10 draft priv spec states there is an implicit order 338 * from low to high 339 */ 340 for (i = 0; i < MAX_RISCV_PMPS; i++) { 341 s = pmp_is_in_range(env, i, addr); 342 e = pmp_is_in_range(env, i, addr + pmp_size - 1); 343 344 /* partially inside */ 345 if ((s + e) == 1) { 346 qemu_log_mask(LOG_GUEST_ERROR, 347 "pmp violation - access is partially inside\n"); 348 ret = -1; 349 break; 350 } 351 352 /* fully inside */ 353 const uint8_t a_field = 354 pmp_get_a_field(env->pmp_state.pmp[i].cfg_reg); 355 356 /* 357 * Convert the PMP permissions to match the truth table in the 358 * ePMP spec. 359 */ 360 const uint8_t epmp_operation = 361 ((env->pmp_state.pmp[i].cfg_reg & PMP_LOCK) >> 4) | 362 ((env->pmp_state.pmp[i].cfg_reg & PMP_READ) << 2) | 363 (env->pmp_state.pmp[i].cfg_reg & PMP_WRITE) | 364 ((env->pmp_state.pmp[i].cfg_reg & PMP_EXEC) >> 2); 365 366 if (((s + e) == 2) && (PMP_AMATCH_OFF != a_field)) { 367 /* 368 * If the PMP entry is not off and the address is in range, 369 * do the priv check 370 */ 371 if (!MSECCFG_MML_ISSET(env)) { 372 /* 373 * If mseccfg.MML Bit is not set, do pmp priv check 374 * This will always apply to regular PMP. 375 */ 376 *allowed_privs = PMP_READ | PMP_WRITE | PMP_EXEC; 377 if ((mode != PRV_M) || pmp_is_locked(env, i)) { 378 *allowed_privs &= env->pmp_state.pmp[i].cfg_reg; 379 } 380 } else { 381 /* 382 * If mseccfg.MML Bit set, do the enhanced pmp priv check 383 */ 384 if (mode == PRV_M) { 385 switch (epmp_operation) { 386 case 0: 387 case 1: 388 case 4: 389 case 5: 390 case 6: 391 case 7: 392 case 8: 393 *allowed_privs = 0; 394 break; 395 case 2: 396 case 3: 397 case 14: 398 *allowed_privs = PMP_READ | PMP_WRITE; 399 break; 400 case 9: 401 case 10: 402 *allowed_privs = PMP_EXEC; 403 break; 404 case 11: 405 case 13: 406 *allowed_privs = PMP_READ | PMP_EXEC; 407 break; 408 case 12: 409 case 15: 410 *allowed_privs = PMP_READ; 411 break; 412 default: 413 g_assert_not_reached(); 414 } 415 } else { 416 switch (epmp_operation) { 417 case 0: 418 case 8: 419 case 9: 420 case 12: 421 case 13: 422 case 14: 423 *allowed_privs = 0; 424 break; 425 case 1: 426 case 10: 427 case 11: 428 *allowed_privs = PMP_EXEC; 429 break; 430 case 2: 431 case 4: 432 case 15: 433 *allowed_privs = PMP_READ; 434 break; 435 case 3: 436 case 6: 437 *allowed_privs = PMP_READ | PMP_WRITE; 438 break; 439 case 5: 440 *allowed_privs = PMP_READ | PMP_EXEC; 441 break; 442 case 7: 443 *allowed_privs = PMP_READ | PMP_WRITE | PMP_EXEC; 444 break; 445 default: 446 g_assert_not_reached(); 447 } 448 } 449 } 450 451 /* 452 * If matching address range was found, the protection bits 453 * defined with PMP must be used. We shouldn't fallback on 454 * finding default privileges. 455 */ 456 ret = i; 457 break; 458 } 459 } 460 461 /* No rule matched */ 462 if (ret == -1) { 463 if (pmp_hart_has_privs_default(env, addr, size, privs, 464 allowed_privs, mode)) { 465 ret = MAX_RISCV_PMPS; 466 } 467 } 468 469 return ret; 470 } 471 472 /* 473 * Handle a write to a pmpcfg CSR 474 */ 475 void pmpcfg_csr_write(CPURISCVState *env, uint32_t reg_index, 476 target_ulong val) 477 { 478 int i; 479 uint8_t cfg_val; 480 int pmpcfg_nums = 2 << riscv_cpu_mxl(env); 481 482 trace_pmpcfg_csr_write(env->mhartid, reg_index, val); 483 484 for (i = 0; i < pmpcfg_nums; i++) { 485 cfg_val = (val >> 8 * i) & 0xff; 486 pmp_write_cfg(env, (reg_index * 4) + i, cfg_val); 487 } 488 489 /* If PMP permission of any addr has been changed, flush TLB pages. */ 490 tlb_flush(env_cpu(env)); 491 } 492 493 494 /* 495 * Handle a read from a pmpcfg CSR 496 */ 497 target_ulong pmpcfg_csr_read(CPURISCVState *env, uint32_t reg_index) 498 { 499 int i; 500 target_ulong cfg_val = 0; 501 target_ulong val = 0; 502 int pmpcfg_nums = 2 << riscv_cpu_mxl(env); 503 504 for (i = 0; i < pmpcfg_nums; i++) { 505 val = pmp_read_cfg(env, (reg_index * 4) + i); 506 cfg_val |= (val << (i * 8)); 507 } 508 trace_pmpcfg_csr_read(env->mhartid, reg_index, cfg_val); 509 510 return cfg_val; 511 } 512 513 514 /* 515 * Handle a write to a pmpaddr CSR 516 */ 517 void pmpaddr_csr_write(CPURISCVState *env, uint32_t addr_index, 518 target_ulong val) 519 { 520 trace_pmpaddr_csr_write(env->mhartid, addr_index, val); 521 522 if (addr_index < MAX_RISCV_PMPS) { 523 /* 524 * In TOR mode, need to check the lock bit of the next pmp 525 * (if there is a next). 526 */ 527 if (addr_index + 1 < MAX_RISCV_PMPS) { 528 uint8_t pmp_cfg = env->pmp_state.pmp[addr_index + 1].cfg_reg; 529 530 if (pmp_cfg & PMP_LOCK && 531 PMP_AMATCH_TOR == pmp_get_a_field(pmp_cfg)) { 532 qemu_log_mask(LOG_GUEST_ERROR, 533 "ignoring pmpaddr write - pmpcfg + 1 locked\n"); 534 return; 535 } 536 } 537 538 if (!pmp_is_locked(env, addr_index)) { 539 env->pmp_state.pmp[addr_index].addr_reg = val; 540 pmp_update_rule(env, addr_index); 541 } else { 542 qemu_log_mask(LOG_GUEST_ERROR, 543 "ignoring pmpaddr write - locked\n"); 544 } 545 } else { 546 qemu_log_mask(LOG_GUEST_ERROR, 547 "ignoring pmpaddr write - out of bounds\n"); 548 } 549 } 550 551 552 /* 553 * Handle a read from a pmpaddr CSR 554 */ 555 target_ulong pmpaddr_csr_read(CPURISCVState *env, uint32_t addr_index) 556 { 557 target_ulong val = 0; 558 559 if (addr_index < MAX_RISCV_PMPS) { 560 val = env->pmp_state.pmp[addr_index].addr_reg; 561 trace_pmpaddr_csr_read(env->mhartid, addr_index, val); 562 } else { 563 qemu_log_mask(LOG_GUEST_ERROR, 564 "ignoring pmpaddr read - out of bounds\n"); 565 } 566 567 return val; 568 } 569 570 /* 571 * Handle a write to a mseccfg CSR 572 */ 573 void mseccfg_csr_write(CPURISCVState *env, target_ulong val) 574 { 575 int i; 576 577 trace_mseccfg_csr_write(env->mhartid, val); 578 579 /* RLB cannot be enabled if it's already 0 and if any regions are locked */ 580 if (!MSECCFG_RLB_ISSET(env)) { 581 for (i = 0; i < MAX_RISCV_PMPS; i++) { 582 if (pmp_is_locked(env, i)) { 583 val &= ~MSECCFG_RLB; 584 break; 585 } 586 } 587 } 588 589 /* Sticky bits */ 590 val |= (env->mseccfg & (MSECCFG_MMWP | MSECCFG_MML)); 591 592 env->mseccfg = val; 593 } 594 595 /* 596 * Handle a read from a mseccfg CSR 597 */ 598 target_ulong mseccfg_csr_read(CPURISCVState *env) 599 { 600 trace_mseccfg_csr_read(env->mhartid, env->mseccfg); 601 return env->mseccfg; 602 } 603 604 /* 605 * Calculate the TLB size. 606 * It's possible that PMP regions only cover partial of the TLB page, and 607 * this may split the page into regions with different permissions. 608 * For example if PMP0 is (0x80000008~0x8000000F, R) and PMP1 is (0x80000000 609 * ~0x80000FFF, RWX), then region 0x80000008~0x8000000F has R permission, and 610 * the other regions in this page have RWX permissions. 611 * A write access to 0x80000000 will match PMP1. However we cannot cache the 612 * translation result in the TLB since this will make the write access to 613 * 0x80000008 bypass the check of PMP0. 614 * To avoid this we return a size of 1 (which means no caching) if the PMP 615 * region only covers partial of the TLB page. 616 */ 617 target_ulong pmp_get_tlb_size(CPURISCVState *env, target_ulong addr) 618 { 619 target_ulong pmp_sa; 620 target_ulong pmp_ea; 621 target_ulong tlb_sa = addr & ~(TARGET_PAGE_SIZE - 1); 622 target_ulong tlb_ea = tlb_sa + TARGET_PAGE_SIZE - 1; 623 int i; 624 625 /* 626 * If PMP is not supported or there are no PMP rules, the TLB page will not 627 * be split into regions with different permissions by PMP so we set the 628 * size to TARGET_PAGE_SIZE. 629 */ 630 if (!riscv_cpu_cfg(env)->pmp || !pmp_get_num_rules(env)) { 631 return TARGET_PAGE_SIZE; 632 } 633 634 for (i = 0; i < MAX_RISCV_PMPS; i++) { 635 if (pmp_get_a_field(env->pmp_state.pmp[i].cfg_reg) == PMP_AMATCH_OFF) { 636 continue; 637 } 638 639 pmp_sa = env->pmp_state.addr[i].sa; 640 pmp_ea = env->pmp_state.addr[i].ea; 641 642 /* 643 * Only the first PMP entry that covers (whole or partial of) the TLB 644 * page really matters: 645 * If it covers the whole TLB page, set the size to TARGET_PAGE_SIZE, 646 * since the following PMP entries have lower priority and will not 647 * affect the permissions of the page. 648 * If it only covers partial of the TLB page, set the size to 1 since 649 * the allowed permissions of the region may be different from other 650 * region of the page. 651 */ 652 if (pmp_sa <= tlb_sa && pmp_ea >= tlb_ea) { 653 return TARGET_PAGE_SIZE; 654 } else if ((pmp_sa >= tlb_sa && pmp_sa <= tlb_ea) || 655 (pmp_ea >= tlb_sa && pmp_ea <= tlb_ea)) { 656 return 1; 657 } 658 } 659 660 /* 661 * If no PMP entry matches the TLB page, the TLB page will also not be 662 * split into regions with different permissions by PMP so we set the size 663 * to TARGET_PAGE_SIZE. 664 */ 665 return TARGET_PAGE_SIZE; 666 } 667 668 /* 669 * Convert PMP privilege to TLB page privilege. 670 */ 671 int pmp_priv_to_page_prot(pmp_priv_t pmp_priv) 672 { 673 int prot = 0; 674 675 if (pmp_priv & PMP_READ) { 676 prot |= PAGE_READ; 677 } 678 if (pmp_priv & PMP_WRITE) { 679 prot |= PAGE_WRITE; 680 } 681 if (pmp_priv & PMP_EXEC) { 682 prot |= PAGE_EXEC; 683 } 684 685 return prot; 686 } 687