1 /* 2 * QEMU RISC-V PMP (Physical Memory Protection) 3 * 4 * Author: Daire McNamara, daire.mcnamara@emdalo.com 5 * Ivan Griffin, ivan.griffin@emdalo.com 6 * 7 * This provides a RISC-V Physical Memory Protection implementation 8 * 9 * This program is free software; you can redistribute it and/or modify it 10 * under the terms and conditions of the GNU General Public License, 11 * version 2 or later, as published by the Free Software Foundation. 12 * 13 * This program is distributed in the hope it will be useful, but WITHOUT 14 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or 15 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for 16 * more details. 17 * 18 * You should have received a copy of the GNU General Public License along with 19 * this program. If not, see <http://www.gnu.org/licenses/>. 20 */ 21 22 /* 23 * PMP (Physical Memory Protection) is as-of-yet unused and needs testing. 24 */ 25 26 #include "qemu/osdep.h" 27 #include "qemu/log.h" 28 #include "qapi/error.h" 29 #include "cpu.h" 30 #include "trace.h" 31 32 static void pmp_write_cfg(CPURISCVState *env, uint32_t addr_index, 33 uint8_t val); 34 static uint8_t pmp_read_cfg(CPURISCVState *env, uint32_t addr_index); 35 static void pmp_update_rule(CPURISCVState *env, uint32_t pmp_index); 36 37 /* 38 * Accessor method to extract address matching type 'a field' from cfg reg 39 */ 40 static inline uint8_t pmp_get_a_field(uint8_t cfg) 41 { 42 uint8_t a = cfg >> 3; 43 return a & 0x3; 44 } 45 46 /* 47 * Check whether a PMP is locked or not. 48 */ 49 static inline int pmp_is_locked(CPURISCVState *env, uint32_t pmp_index) 50 { 51 52 if (env->pmp_state.pmp[pmp_index].cfg_reg & PMP_LOCK) { 53 return 1; 54 } 55 56 /* Top PMP has no 'next' to check */ 57 if ((pmp_index + 1u) >= MAX_RISCV_PMPS) { 58 return 0; 59 } 60 61 /* In TOR mode, need to check the lock bit of the next pmp 62 * (if there is a next) 63 */ 64 const uint8_t a_field = 65 pmp_get_a_field(env->pmp_state.pmp[pmp_index + 1].cfg_reg); 66 if ((env->pmp_state.pmp[pmp_index + 1u].cfg_reg & PMP_LOCK) && 67 (PMP_AMATCH_TOR == a_field)) { 68 return 1; 69 } 70 71 return 0; 72 } 73 74 /* 75 * Count the number of active rules. 76 */ 77 static inline uint32_t pmp_get_num_rules(CPURISCVState *env) 78 { 79 return env->pmp_state.num_rules; 80 } 81 82 /* 83 * Accessor to get the cfg reg for a specific PMP/HART 84 */ 85 static inline uint8_t pmp_read_cfg(CPURISCVState *env, uint32_t pmp_index) 86 { 87 if (pmp_index < MAX_RISCV_PMPS) { 88 return env->pmp_state.pmp[pmp_index].cfg_reg; 89 } 90 91 return 0; 92 } 93 94 95 /* 96 * Accessor to set the cfg reg for a specific PMP/HART 97 * Bounds checks and relevant lock bit. 98 */ 99 static void pmp_write_cfg(CPURISCVState *env, uint32_t pmp_index, uint8_t val) 100 { 101 if (pmp_index < MAX_RISCV_PMPS) { 102 if (!pmp_is_locked(env, pmp_index)) { 103 env->pmp_state.pmp[pmp_index].cfg_reg = val; 104 pmp_update_rule(env, pmp_index); 105 } else { 106 qemu_log_mask(LOG_GUEST_ERROR, "ignoring pmpcfg write - locked\n"); 107 } 108 } else { 109 qemu_log_mask(LOG_GUEST_ERROR, 110 "ignoring pmpcfg write - out of bounds\n"); 111 } 112 } 113 114 static void pmp_decode_napot(target_ulong a, target_ulong *sa, target_ulong *ea) 115 { 116 /* 117 aaaa...aaa0 8-byte NAPOT range 118 aaaa...aa01 16-byte NAPOT range 119 aaaa...a011 32-byte NAPOT range 120 ... 121 aa01...1111 2^XLEN-byte NAPOT range 122 a011...1111 2^(XLEN+1)-byte NAPOT range 123 0111...1111 2^(XLEN+2)-byte NAPOT range 124 1111...1111 Reserved 125 */ 126 if (a == -1) { 127 *sa = 0u; 128 *ea = -1; 129 return; 130 } else { 131 target_ulong t1 = ctz64(~a); 132 target_ulong base = (a & ~(((target_ulong)1 << t1) - 1)) << 2; 133 target_ulong range = ((target_ulong)1 << (t1 + 3)) - 1; 134 *sa = base; 135 *ea = base + range; 136 } 137 } 138 139 140 /* Convert cfg/addr reg values here into simple 'sa' --> start address and 'ea' 141 * end address values. 142 * This function is called relatively infrequently whereas the check that 143 * an address is within a pmp rule is called often, so optimise that one 144 */ 145 static void pmp_update_rule(CPURISCVState *env, uint32_t pmp_index) 146 { 147 int i; 148 149 env->pmp_state.num_rules = 0; 150 151 uint8_t this_cfg = env->pmp_state.pmp[pmp_index].cfg_reg; 152 target_ulong this_addr = env->pmp_state.pmp[pmp_index].addr_reg; 153 target_ulong prev_addr = 0u; 154 target_ulong sa = 0u; 155 target_ulong ea = 0u; 156 157 if (pmp_index >= 1u) { 158 prev_addr = env->pmp_state.pmp[pmp_index - 1].addr_reg; 159 } 160 161 switch (pmp_get_a_field(this_cfg)) { 162 case PMP_AMATCH_OFF: 163 sa = 0u; 164 ea = -1; 165 break; 166 167 case PMP_AMATCH_TOR: 168 sa = prev_addr << 2; /* shift up from [xx:0] to [xx+2:2] */ 169 ea = (this_addr << 2) - 1u; 170 break; 171 172 case PMP_AMATCH_NA4: 173 sa = this_addr << 2; /* shift up from [xx:0] to [xx+2:2] */ 174 ea = (this_addr + 4u) - 1u; 175 break; 176 177 case PMP_AMATCH_NAPOT: 178 pmp_decode_napot(this_addr, &sa, &ea); 179 break; 180 181 default: 182 sa = 0u; 183 ea = 0u; 184 break; 185 } 186 187 env->pmp_state.addr[pmp_index].sa = sa; 188 env->pmp_state.addr[pmp_index].ea = ea; 189 190 for (i = 0; i < MAX_RISCV_PMPS; i++) { 191 const uint8_t a_field = 192 pmp_get_a_field(env->pmp_state.pmp[i].cfg_reg); 193 if (PMP_AMATCH_OFF != a_field) { 194 env->pmp_state.num_rules++; 195 } 196 } 197 } 198 199 static int pmp_is_in_range(CPURISCVState *env, int pmp_index, target_ulong addr) 200 { 201 int result = 0; 202 203 if ((addr >= env->pmp_state.addr[pmp_index].sa) 204 && (addr <= env->pmp_state.addr[pmp_index].ea)) { 205 result = 1; 206 } else { 207 result = 0; 208 } 209 210 return result; 211 } 212 213 214 /* 215 * Public Interface 216 */ 217 218 /* 219 * Check if the address has required RWX privs to complete desired operation 220 */ 221 bool pmp_hart_has_privs(CPURISCVState *env, target_ulong addr, 222 target_ulong size, pmp_priv_t privs, target_ulong mode) 223 { 224 int i = 0; 225 int ret = -1; 226 int pmp_size = 0; 227 target_ulong s = 0; 228 target_ulong e = 0; 229 pmp_priv_t allowed_privs = 0; 230 231 /* Short cut if no rules */ 232 if (0 == pmp_get_num_rules(env)) { 233 return true; 234 } 235 236 /* 237 * if size is unknown (0), assume that all bytes 238 * from addr to the end of the page will be accessed. 239 */ 240 if (size == 0) { 241 pmp_size = -(addr | TARGET_PAGE_MASK); 242 } else { 243 pmp_size = size; 244 } 245 246 /* 1.10 draft priv spec states there is an implicit order 247 from low to high */ 248 for (i = 0; i < MAX_RISCV_PMPS; i++) { 249 s = pmp_is_in_range(env, i, addr); 250 e = pmp_is_in_range(env, i, addr + pmp_size - 1); 251 252 /* partially inside */ 253 if ((s + e) == 1) { 254 qemu_log_mask(LOG_GUEST_ERROR, 255 "pmp violation - access is partially inside\n"); 256 ret = 0; 257 break; 258 } 259 260 /* fully inside */ 261 const uint8_t a_field = 262 pmp_get_a_field(env->pmp_state.pmp[i].cfg_reg); 263 264 /* 265 * If the PMP entry is not off and the address is in range, do the priv 266 * check 267 */ 268 if (((s + e) == 2) && (PMP_AMATCH_OFF != a_field)) { 269 allowed_privs = PMP_READ | PMP_WRITE | PMP_EXEC; 270 if ((mode != PRV_M) || pmp_is_locked(env, i)) { 271 allowed_privs &= env->pmp_state.pmp[i].cfg_reg; 272 } 273 274 if ((privs & allowed_privs) == privs) { 275 ret = 1; 276 break; 277 } else { 278 ret = 0; 279 break; 280 } 281 } 282 } 283 284 /* No rule matched */ 285 if (ret == -1) { 286 if (mode == PRV_M) { 287 ret = 1; /* Privileged spec v1.10 states if no PMP entry matches an 288 * M-Mode access, the access succeeds */ 289 } else { 290 ret = 0; /* Other modes are not allowed to succeed if they don't 291 * match a rule, but there are rules. We've checked for 292 * no rule earlier in this function. */ 293 } 294 } 295 296 return ret == 1 ? true : false; 297 } 298 299 300 /* 301 * Handle a write to a pmpcfg CSP 302 */ 303 void pmpcfg_csr_write(CPURISCVState *env, uint32_t reg_index, 304 target_ulong val) 305 { 306 int i; 307 uint8_t cfg_val; 308 309 trace_pmpcfg_csr_write(env->mhartid, reg_index, val); 310 311 if ((reg_index & 1) && (sizeof(target_ulong) == 8)) { 312 qemu_log_mask(LOG_GUEST_ERROR, 313 "ignoring pmpcfg write - incorrect address\n"); 314 return; 315 } 316 317 for (i = 0; i < sizeof(target_ulong); i++) { 318 cfg_val = (val >> 8 * i) & 0xff; 319 pmp_write_cfg(env, (reg_index * sizeof(target_ulong)) + i, 320 cfg_val); 321 } 322 } 323 324 325 /* 326 * Handle a read from a pmpcfg CSP 327 */ 328 target_ulong pmpcfg_csr_read(CPURISCVState *env, uint32_t reg_index) 329 { 330 int i; 331 target_ulong cfg_val = 0; 332 target_ulong val = 0; 333 334 for (i = 0; i < sizeof(target_ulong); i++) { 335 val = pmp_read_cfg(env, (reg_index * sizeof(target_ulong)) + i); 336 cfg_val |= (val << (i * 8)); 337 } 338 trace_pmpcfg_csr_read(env->mhartid, reg_index, cfg_val); 339 340 return cfg_val; 341 } 342 343 344 /* 345 * Handle a write to a pmpaddr CSP 346 */ 347 void pmpaddr_csr_write(CPURISCVState *env, uint32_t addr_index, 348 target_ulong val) 349 { 350 trace_pmpaddr_csr_write(env->mhartid, addr_index, val); 351 if (addr_index < MAX_RISCV_PMPS) { 352 if (!pmp_is_locked(env, addr_index)) { 353 env->pmp_state.pmp[addr_index].addr_reg = val; 354 pmp_update_rule(env, addr_index); 355 } else { 356 qemu_log_mask(LOG_GUEST_ERROR, 357 "ignoring pmpaddr write - locked\n"); 358 } 359 } else { 360 qemu_log_mask(LOG_GUEST_ERROR, 361 "ignoring pmpaddr write - out of bounds\n"); 362 } 363 } 364 365 366 /* 367 * Handle a read from a pmpaddr CSP 368 */ 369 target_ulong pmpaddr_csr_read(CPURISCVState *env, uint32_t addr_index) 370 { 371 target_ulong val = 0; 372 373 if (addr_index < MAX_RISCV_PMPS) { 374 val = env->pmp_state.pmp[addr_index].addr_reg; 375 trace_pmpaddr_csr_read(env->mhartid, addr_index, val); 376 } else { 377 qemu_log_mask(LOG_GUEST_ERROR, 378 "ignoring pmpaddr read - out of bounds\n"); 379 } 380 381 return val; 382 } 383