1 /* 2 * QEMU RISC-V PMP (Physical Memory Protection) 3 * 4 * Author: Daire McNamara, daire.mcnamara@emdalo.com 5 * Ivan Griffin, ivan.griffin@emdalo.com 6 * 7 * This provides a RISC-V Physical Memory Protection implementation 8 * 9 * This program is free software; you can redistribute it and/or modify it 10 * under the terms and conditions of the GNU General Public License, 11 * version 2 or later, as published by the Free Software Foundation. 12 * 13 * This program is distributed in the hope it will be useful, but WITHOUT 14 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or 15 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for 16 * more details. 17 * 18 * You should have received a copy of the GNU General Public License along with 19 * this program. If not, see <http://www.gnu.org/licenses/>. 20 */ 21 22 /* 23 * PMP (Physical Memory Protection) is as-of-yet unused and needs testing. 24 */ 25 26 #include "qemu/osdep.h" 27 #include "qemu/log.h" 28 #include "qapi/error.h" 29 #include "cpu.h" 30 31 #ifndef CONFIG_USER_ONLY 32 33 #define RISCV_DEBUG_PMP 0 34 #define PMP_DEBUG(fmt, ...) \ 35 do { \ 36 if (RISCV_DEBUG_PMP) { \ 37 qemu_log_mask(LOG_TRACE, "%s: " fmt "\n", __func__, ##__VA_ARGS__);\ 38 } \ 39 } while (0) 40 41 static void pmp_write_cfg(CPURISCVState *env, uint32_t addr_index, 42 uint8_t val); 43 static uint8_t pmp_read_cfg(CPURISCVState *env, uint32_t addr_index); 44 static void pmp_update_rule(CPURISCVState *env, uint32_t pmp_index); 45 46 /* 47 * Accessor method to extract address matching type 'a field' from cfg reg 48 */ 49 static inline uint8_t pmp_get_a_field(uint8_t cfg) 50 { 51 uint8_t a = cfg >> 3; 52 return a & 0x3; 53 } 54 55 /* 56 * Check whether a PMP is locked or not. 57 */ 58 static inline int pmp_is_locked(CPURISCVState *env, uint32_t pmp_index) 59 { 60 61 if (env->pmp_state.pmp[pmp_index].cfg_reg & PMP_LOCK) { 62 return 1; 63 } 64 65 /* Top PMP has no 'next' to check */ 66 if ((pmp_index + 1u) >= MAX_RISCV_PMPS) { 67 return 0; 68 } 69 70 /* In TOR mode, need to check the lock bit of the next pmp 71 * (if there is a next) 72 */ 73 const uint8_t a_field = 74 pmp_get_a_field(env->pmp_state.pmp[pmp_index + 1].cfg_reg); 75 if ((env->pmp_state.pmp[pmp_index + 1u].cfg_reg & PMP_LOCK) && 76 (PMP_AMATCH_TOR == a_field)) { 77 return 1; 78 } 79 80 return 0; 81 } 82 83 /* 84 * Count the number of active rules. 85 */ 86 static inline uint32_t pmp_get_num_rules(CPURISCVState *env) 87 { 88 return env->pmp_state.num_rules; 89 } 90 91 /* 92 * Accessor to get the cfg reg for a specific PMP/HART 93 */ 94 static inline uint8_t pmp_read_cfg(CPURISCVState *env, uint32_t pmp_index) 95 { 96 if (pmp_index < MAX_RISCV_PMPS) { 97 return env->pmp_state.pmp[pmp_index].cfg_reg; 98 } 99 100 return 0; 101 } 102 103 104 /* 105 * Accessor to set the cfg reg for a specific PMP/HART 106 * Bounds checks and relevant lock bit. 107 */ 108 static void pmp_write_cfg(CPURISCVState *env, uint32_t pmp_index, uint8_t val) 109 { 110 if (pmp_index < MAX_RISCV_PMPS) { 111 if (!pmp_is_locked(env, pmp_index)) { 112 env->pmp_state.pmp[pmp_index].cfg_reg = val; 113 pmp_update_rule(env, pmp_index); 114 } else { 115 qemu_log_mask(LOG_GUEST_ERROR, "ignoring pmpcfg write - locked\n"); 116 } 117 } else { 118 qemu_log_mask(LOG_GUEST_ERROR, 119 "ignoring pmpcfg write - out of bounds\n"); 120 } 121 } 122 123 static void pmp_decode_napot(target_ulong a, target_ulong *sa, target_ulong *ea) 124 { 125 /* 126 aaaa...aaa0 8-byte NAPOT range 127 aaaa...aa01 16-byte NAPOT range 128 aaaa...a011 32-byte NAPOT range 129 ... 130 aa01...1111 2^XLEN-byte NAPOT range 131 a011...1111 2^(XLEN+1)-byte NAPOT range 132 0111...1111 2^(XLEN+2)-byte NAPOT range 133 1111...1111 Reserved 134 */ 135 if (a == -1) { 136 *sa = 0u; 137 *ea = -1; 138 return; 139 } else { 140 target_ulong t1 = ctz64(~a); 141 target_ulong base = (a & ~(((target_ulong)1 << t1) - 1)) << 2; 142 target_ulong range = ((target_ulong)1 << (t1 + 3)) - 1; 143 *sa = base; 144 *ea = base + range; 145 } 146 } 147 148 149 /* Convert cfg/addr reg values here into simple 'sa' --> start address and 'ea' 150 * end address values. 151 * This function is called relatively infrequently whereas the check that 152 * an address is within a pmp rule is called often, so optimise that one 153 */ 154 static void pmp_update_rule(CPURISCVState *env, uint32_t pmp_index) 155 { 156 int i; 157 158 env->pmp_state.num_rules = 0; 159 160 uint8_t this_cfg = env->pmp_state.pmp[pmp_index].cfg_reg; 161 target_ulong this_addr = env->pmp_state.pmp[pmp_index].addr_reg; 162 target_ulong prev_addr = 0u; 163 target_ulong sa = 0u; 164 target_ulong ea = 0u; 165 166 if (pmp_index >= 1u) { 167 prev_addr = env->pmp_state.pmp[pmp_index - 1].addr_reg; 168 } 169 170 switch (pmp_get_a_field(this_cfg)) { 171 case PMP_AMATCH_OFF: 172 sa = 0u; 173 ea = -1; 174 break; 175 176 case PMP_AMATCH_TOR: 177 sa = prev_addr << 2; /* shift up from [xx:0] to [xx+2:2] */ 178 ea = (this_addr << 2) - 1u; 179 break; 180 181 case PMP_AMATCH_NA4: 182 sa = this_addr << 2; /* shift up from [xx:0] to [xx+2:2] */ 183 ea = (this_addr + 4u) - 1u; 184 break; 185 186 case PMP_AMATCH_NAPOT: 187 pmp_decode_napot(this_addr, &sa, &ea); 188 break; 189 190 default: 191 sa = 0u; 192 ea = 0u; 193 break; 194 } 195 196 env->pmp_state.addr[pmp_index].sa = sa; 197 env->pmp_state.addr[pmp_index].ea = ea; 198 199 for (i = 0; i < MAX_RISCV_PMPS; i++) { 200 const uint8_t a_field = 201 pmp_get_a_field(env->pmp_state.pmp[i].cfg_reg); 202 if (PMP_AMATCH_OFF != a_field) { 203 env->pmp_state.num_rules++; 204 } 205 } 206 } 207 208 static int pmp_is_in_range(CPURISCVState *env, int pmp_index, target_ulong addr) 209 { 210 int result = 0; 211 212 if ((addr >= env->pmp_state.addr[pmp_index].sa) 213 && (addr <= env->pmp_state.addr[pmp_index].ea)) { 214 result = 1; 215 } else { 216 result = 0; 217 } 218 219 return result; 220 } 221 222 223 /* 224 * Public Interface 225 */ 226 227 /* 228 * Check if the address has required RWX privs to complete desired operation 229 */ 230 bool pmp_hart_has_privs(CPURISCVState *env, target_ulong addr, 231 target_ulong size, pmp_priv_t privs) 232 { 233 int i = 0; 234 int ret = -1; 235 target_ulong s = 0; 236 target_ulong e = 0; 237 pmp_priv_t allowed_privs = 0; 238 239 /* Short cut if no rules */ 240 if (0 == pmp_get_num_rules(env)) { 241 return true; 242 } 243 244 /* 1.10 draft priv spec states there is an implicit order 245 from low to high */ 246 for (i = 0; i < MAX_RISCV_PMPS; i++) { 247 s = pmp_is_in_range(env, i, addr); 248 e = pmp_is_in_range(env, i, addr + size); 249 250 /* partially inside */ 251 if ((s + e) == 1) { 252 qemu_log_mask(LOG_GUEST_ERROR, 253 "pmp violation - access is partially inside\n"); 254 ret = 0; 255 break; 256 } 257 258 /* fully inside */ 259 const uint8_t a_field = 260 pmp_get_a_field(env->pmp_state.pmp[i].cfg_reg); 261 if ((s + e) == 2) { 262 if (PMP_AMATCH_OFF == a_field) { 263 return 1; 264 } 265 266 allowed_privs = PMP_READ | PMP_WRITE | PMP_EXEC; 267 if ((env->priv != PRV_M) || pmp_is_locked(env, i)) { 268 allowed_privs &= env->pmp_state.pmp[i].cfg_reg; 269 } 270 271 if ((privs & allowed_privs) == privs) { 272 ret = 1; 273 break; 274 } else { 275 ret = 0; 276 break; 277 } 278 } 279 } 280 281 /* No rule matched */ 282 if (ret == -1) { 283 if (env->priv == PRV_M) { 284 ret = 1; /* Privileged spec v1.10 states if no PMP entry matches an 285 * M-Mode access, the access succeeds */ 286 } else { 287 ret = 0; /* Other modes are not allowed to succeed if they don't 288 * match a rule, but there are rules. We've checked for 289 * no rule earlier in this function. */ 290 } 291 } 292 293 return ret == 1 ? true : false; 294 } 295 296 297 /* 298 * Handle a write to a pmpcfg CSP 299 */ 300 void pmpcfg_csr_write(CPURISCVState *env, uint32_t reg_index, 301 target_ulong val) 302 { 303 int i; 304 uint8_t cfg_val; 305 306 PMP_DEBUG("hart " TARGET_FMT_ld ": reg%d, val: 0x" TARGET_FMT_lx, 307 env->mhartid, reg_index, val); 308 309 if ((reg_index & 1) && (sizeof(target_ulong) == 8)) { 310 qemu_log_mask(LOG_GUEST_ERROR, 311 "ignoring pmpcfg write - incorrect address\n"); 312 return; 313 } 314 315 for (i = 0; i < sizeof(target_ulong); i++) { 316 cfg_val = (val >> 8 * i) & 0xff; 317 pmp_write_cfg(env, (reg_index * sizeof(target_ulong)) + i, 318 cfg_val); 319 } 320 } 321 322 323 /* 324 * Handle a read from a pmpcfg CSP 325 */ 326 target_ulong pmpcfg_csr_read(CPURISCVState *env, uint32_t reg_index) 327 { 328 int i; 329 target_ulong cfg_val = 0; 330 target_ulong val = 0; 331 332 for (i = 0; i < sizeof(target_ulong); i++) { 333 val = pmp_read_cfg(env, (reg_index * sizeof(target_ulong)) + i); 334 cfg_val |= (val << (i * 8)); 335 } 336 337 PMP_DEBUG("hart " TARGET_FMT_ld ": reg%d, val: 0x" TARGET_FMT_lx, 338 env->mhartid, reg_index, cfg_val); 339 340 return cfg_val; 341 } 342 343 344 /* 345 * Handle a write to a pmpaddr CSP 346 */ 347 void pmpaddr_csr_write(CPURISCVState *env, uint32_t addr_index, 348 target_ulong val) 349 { 350 PMP_DEBUG("hart " TARGET_FMT_ld ": addr%d, val: 0x" TARGET_FMT_lx, 351 env->mhartid, addr_index, val); 352 353 if (addr_index < MAX_RISCV_PMPS) { 354 if (!pmp_is_locked(env, addr_index)) { 355 env->pmp_state.pmp[addr_index].addr_reg = val; 356 pmp_update_rule(env, addr_index); 357 } else { 358 qemu_log_mask(LOG_GUEST_ERROR, 359 "ignoring pmpaddr write - locked\n"); 360 } 361 } else { 362 qemu_log_mask(LOG_GUEST_ERROR, 363 "ignoring pmpaddr write - out of bounds\n"); 364 } 365 } 366 367 368 /* 369 * Handle a read from a pmpaddr CSP 370 */ 371 target_ulong pmpaddr_csr_read(CPURISCVState *env, uint32_t addr_index) 372 { 373 PMP_DEBUG("hart " TARGET_FMT_ld ": addr%d, val: 0x" TARGET_FMT_lx, 374 env->mhartid, addr_index, 375 env->pmp_state.pmp[addr_index].addr_reg); 376 if (addr_index < MAX_RISCV_PMPS) { 377 return env->pmp_state.pmp[addr_index].addr_reg; 378 } else { 379 qemu_log_mask(LOG_GUEST_ERROR, 380 "ignoring pmpaddr read - out of bounds\n"); 381 return 0; 382 } 383 } 384 385 #endif 386