1 /* 2 * QEMU RISC-V PMP (Physical Memory Protection) 3 * 4 * Author: Daire McNamara, daire.mcnamara@emdalo.com 5 * Ivan Griffin, ivan.griffin@emdalo.com 6 * 7 * This provides a RISC-V Physical Memory Protection implementation 8 * 9 * This program is free software; you can redistribute it and/or modify it 10 * under the terms and conditions of the GNU General Public License, 11 * version 2 or later, as published by the Free Software Foundation. 12 * 13 * This program is distributed in the hope it will be useful, but WITHOUT 14 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or 15 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for 16 * more details. 17 * 18 * You should have received a copy of the GNU General Public License along with 19 * this program. If not, see <http://www.gnu.org/licenses/>. 20 */ 21 22 /* 23 * PMP (Physical Memory Protection) is as-of-yet unused and needs testing. 24 */ 25 26 #include "qemu/osdep.h" 27 #include "qemu/log.h" 28 #include "qapi/error.h" 29 #include "cpu.h" 30 #include "trace.h" 31 32 static void pmp_write_cfg(CPURISCVState *env, uint32_t addr_index, 33 uint8_t val); 34 static uint8_t pmp_read_cfg(CPURISCVState *env, uint32_t addr_index); 35 static void pmp_update_rule(CPURISCVState *env, uint32_t pmp_index); 36 37 /* 38 * Accessor method to extract address matching type 'a field' from cfg reg 39 */ 40 static inline uint8_t pmp_get_a_field(uint8_t cfg) 41 { 42 uint8_t a = cfg >> 3; 43 return a & 0x3; 44 } 45 46 /* 47 * Check whether a PMP is locked or not. 48 */ 49 static inline int pmp_is_locked(CPURISCVState *env, uint32_t pmp_index) 50 { 51 52 if (env->pmp_state.pmp[pmp_index].cfg_reg & PMP_LOCK) { 53 return 1; 54 } 55 56 /* Top PMP has no 'next' to check */ 57 if ((pmp_index + 1u) >= MAX_RISCV_PMPS) { 58 return 0; 59 } 60 61 /* In TOR mode, need to check the lock bit of the next pmp 62 * (if there is a next) 63 */ 64 const uint8_t a_field = 65 pmp_get_a_field(env->pmp_state.pmp[pmp_index + 1].cfg_reg); 66 if ((env->pmp_state.pmp[pmp_index + 1u].cfg_reg & PMP_LOCK) && 67 (PMP_AMATCH_TOR == a_field)) { 68 return 1; 69 } 70 71 return 0; 72 } 73 74 /* 75 * Count the number of active rules. 76 */ 77 static inline uint32_t pmp_get_num_rules(CPURISCVState *env) 78 { 79 return env->pmp_state.num_rules; 80 } 81 82 /* 83 * Accessor to get the cfg reg for a specific PMP/HART 84 */ 85 static inline uint8_t pmp_read_cfg(CPURISCVState *env, uint32_t pmp_index) 86 { 87 if (pmp_index < MAX_RISCV_PMPS) { 88 return env->pmp_state.pmp[pmp_index].cfg_reg; 89 } 90 91 return 0; 92 } 93 94 95 /* 96 * Accessor to set the cfg reg for a specific PMP/HART 97 * Bounds checks and relevant lock bit. 98 */ 99 static void pmp_write_cfg(CPURISCVState *env, uint32_t pmp_index, uint8_t val) 100 { 101 if (pmp_index < MAX_RISCV_PMPS) { 102 if (!pmp_is_locked(env, pmp_index)) { 103 env->pmp_state.pmp[pmp_index].cfg_reg = val; 104 pmp_update_rule(env, pmp_index); 105 } else { 106 qemu_log_mask(LOG_GUEST_ERROR, "ignoring pmpcfg write - locked\n"); 107 } 108 } else { 109 qemu_log_mask(LOG_GUEST_ERROR, 110 "ignoring pmpcfg write - out of bounds\n"); 111 } 112 } 113 114 static void pmp_decode_napot(target_ulong a, target_ulong *sa, target_ulong *ea) 115 { 116 /* 117 aaaa...aaa0 8-byte NAPOT range 118 aaaa...aa01 16-byte NAPOT range 119 aaaa...a011 32-byte NAPOT range 120 ... 121 aa01...1111 2^XLEN-byte NAPOT range 122 a011...1111 2^(XLEN+1)-byte NAPOT range 123 0111...1111 2^(XLEN+2)-byte NAPOT range 124 1111...1111 Reserved 125 */ 126 if (a == -1) { 127 *sa = 0u; 128 *ea = -1; 129 return; 130 } else { 131 target_ulong t1 = ctz64(~a); 132 target_ulong base = (a & ~(((target_ulong)1 << t1) - 1)) << 2; 133 target_ulong range = ((target_ulong)1 << (t1 + 3)) - 1; 134 *sa = base; 135 *ea = base + range; 136 } 137 } 138 139 140 /* Convert cfg/addr reg values here into simple 'sa' --> start address and 'ea' 141 * end address values. 142 * This function is called relatively infrequently whereas the check that 143 * an address is within a pmp rule is called often, so optimise that one 144 */ 145 static void pmp_update_rule(CPURISCVState *env, uint32_t pmp_index) 146 { 147 int i; 148 149 env->pmp_state.num_rules = 0; 150 151 uint8_t this_cfg = env->pmp_state.pmp[pmp_index].cfg_reg; 152 target_ulong this_addr = env->pmp_state.pmp[pmp_index].addr_reg; 153 target_ulong prev_addr = 0u; 154 target_ulong sa = 0u; 155 target_ulong ea = 0u; 156 157 if (pmp_index >= 1u) { 158 prev_addr = env->pmp_state.pmp[pmp_index - 1].addr_reg; 159 } 160 161 switch (pmp_get_a_field(this_cfg)) { 162 case PMP_AMATCH_OFF: 163 sa = 0u; 164 ea = -1; 165 break; 166 167 case PMP_AMATCH_TOR: 168 sa = prev_addr << 2; /* shift up from [xx:0] to [xx+2:2] */ 169 ea = (this_addr << 2) - 1u; 170 break; 171 172 case PMP_AMATCH_NA4: 173 sa = this_addr << 2; /* shift up from [xx:0] to [xx+2:2] */ 174 ea = (this_addr + 4u) - 1u; 175 break; 176 177 case PMP_AMATCH_NAPOT: 178 pmp_decode_napot(this_addr, &sa, &ea); 179 break; 180 181 default: 182 sa = 0u; 183 ea = 0u; 184 break; 185 } 186 187 env->pmp_state.addr[pmp_index].sa = sa; 188 env->pmp_state.addr[pmp_index].ea = ea; 189 190 for (i = 0; i < MAX_RISCV_PMPS; i++) { 191 const uint8_t a_field = 192 pmp_get_a_field(env->pmp_state.pmp[i].cfg_reg); 193 if (PMP_AMATCH_OFF != a_field) { 194 env->pmp_state.num_rules++; 195 } 196 } 197 } 198 199 static int pmp_is_in_range(CPURISCVState *env, int pmp_index, target_ulong addr) 200 { 201 int result = 0; 202 203 if ((addr >= env->pmp_state.addr[pmp_index].sa) 204 && (addr <= env->pmp_state.addr[pmp_index].ea)) { 205 result = 1; 206 } else { 207 result = 0; 208 } 209 210 return result; 211 } 212 213 214 /* 215 * Public Interface 216 */ 217 218 /* 219 * Check if the address has required RWX privs to complete desired operation 220 */ 221 bool pmp_hart_has_privs(CPURISCVState *env, target_ulong addr, 222 target_ulong size, pmp_priv_t privs, target_ulong mode) 223 { 224 int i = 0; 225 int ret = -1; 226 int pmp_size = 0; 227 target_ulong s = 0; 228 target_ulong e = 0; 229 pmp_priv_t allowed_privs = 0; 230 231 /* Short cut if no rules */ 232 if (0 == pmp_get_num_rules(env)) { 233 return true; 234 } 235 236 if (size == 0) { 237 if (riscv_feature(env, RISCV_FEATURE_MMU)) { 238 /* 239 * If size is unknown (0), assume that all bytes 240 * from addr to the end of the page will be accessed. 241 */ 242 pmp_size = -(addr | TARGET_PAGE_MASK); 243 } else { 244 pmp_size = sizeof(target_ulong); 245 } 246 } else { 247 pmp_size = size; 248 } 249 250 /* 1.10 draft priv spec states there is an implicit order 251 from low to high */ 252 for (i = 0; i < MAX_RISCV_PMPS; i++) { 253 s = pmp_is_in_range(env, i, addr); 254 e = pmp_is_in_range(env, i, addr + pmp_size - 1); 255 256 /* partially inside */ 257 if ((s + e) == 1) { 258 qemu_log_mask(LOG_GUEST_ERROR, 259 "pmp violation - access is partially inside\n"); 260 ret = 0; 261 break; 262 } 263 264 /* fully inside */ 265 const uint8_t a_field = 266 pmp_get_a_field(env->pmp_state.pmp[i].cfg_reg); 267 268 /* 269 * If the PMP entry is not off and the address is in range, do the priv 270 * check 271 */ 272 if (((s + e) == 2) && (PMP_AMATCH_OFF != a_field)) { 273 allowed_privs = PMP_READ | PMP_WRITE | PMP_EXEC; 274 if ((mode != PRV_M) || pmp_is_locked(env, i)) { 275 allowed_privs &= env->pmp_state.pmp[i].cfg_reg; 276 } 277 278 if ((privs & allowed_privs) == privs) { 279 ret = 1; 280 break; 281 } else { 282 ret = 0; 283 break; 284 } 285 } 286 } 287 288 /* No rule matched */ 289 if (ret == -1) { 290 if (mode == PRV_M) { 291 ret = 1; /* Privileged spec v1.10 states if no PMP entry matches an 292 * M-Mode access, the access succeeds */ 293 } else { 294 ret = 0; /* Other modes are not allowed to succeed if they don't 295 * match a rule, but there are rules. We've checked for 296 * no rule earlier in this function. */ 297 } 298 } 299 300 return ret == 1 ? true : false; 301 } 302 303 304 /* 305 * Handle a write to a pmpcfg CSP 306 */ 307 void pmpcfg_csr_write(CPURISCVState *env, uint32_t reg_index, 308 target_ulong val) 309 { 310 int i; 311 uint8_t cfg_val; 312 313 trace_pmpcfg_csr_write(env->mhartid, reg_index, val); 314 315 if ((reg_index & 1) && (sizeof(target_ulong) == 8)) { 316 qemu_log_mask(LOG_GUEST_ERROR, 317 "ignoring pmpcfg write - incorrect address\n"); 318 return; 319 } 320 321 for (i = 0; i < sizeof(target_ulong); i++) { 322 cfg_val = (val >> 8 * i) & 0xff; 323 pmp_write_cfg(env, (reg_index * sizeof(target_ulong)) + i, 324 cfg_val); 325 } 326 } 327 328 329 /* 330 * Handle a read from a pmpcfg CSP 331 */ 332 target_ulong pmpcfg_csr_read(CPURISCVState *env, uint32_t reg_index) 333 { 334 int i; 335 target_ulong cfg_val = 0; 336 target_ulong val = 0; 337 338 for (i = 0; i < sizeof(target_ulong); i++) { 339 val = pmp_read_cfg(env, (reg_index * sizeof(target_ulong)) + i); 340 cfg_val |= (val << (i * 8)); 341 } 342 trace_pmpcfg_csr_read(env->mhartid, reg_index, cfg_val); 343 344 return cfg_val; 345 } 346 347 348 /* 349 * Handle a write to a pmpaddr CSP 350 */ 351 void pmpaddr_csr_write(CPURISCVState *env, uint32_t addr_index, 352 target_ulong val) 353 { 354 trace_pmpaddr_csr_write(env->mhartid, addr_index, val); 355 if (addr_index < MAX_RISCV_PMPS) { 356 if (!pmp_is_locked(env, addr_index)) { 357 env->pmp_state.pmp[addr_index].addr_reg = val; 358 pmp_update_rule(env, addr_index); 359 } else { 360 qemu_log_mask(LOG_GUEST_ERROR, 361 "ignoring pmpaddr write - locked\n"); 362 } 363 } else { 364 qemu_log_mask(LOG_GUEST_ERROR, 365 "ignoring pmpaddr write - out of bounds\n"); 366 } 367 } 368 369 370 /* 371 * Handle a read from a pmpaddr CSP 372 */ 373 target_ulong pmpaddr_csr_read(CPURISCVState *env, uint32_t addr_index) 374 { 375 target_ulong val = 0; 376 377 if (addr_index < MAX_RISCV_PMPS) { 378 val = env->pmp_state.pmp[addr_index].addr_reg; 379 trace_pmpaddr_csr_read(env->mhartid, addr_index, val); 380 } else { 381 qemu_log_mask(LOG_GUEST_ERROR, 382 "ignoring pmpaddr read - out of bounds\n"); 383 } 384 385 return val; 386 } 387