xref: /openbmc/qemu/target/riscv/pmp.c (revision 7c4c31f6)
1 /*
2  * QEMU RISC-V PMP (Physical Memory Protection)
3  *
4  * Author: Daire McNamara, daire.mcnamara@emdalo.com
5  *         Ivan Griffin, ivan.griffin@emdalo.com
6  *
7  * This provides a RISC-V Physical Memory Protection implementation
8  *
9  * This program is free software; you can redistribute it and/or modify it
10  * under the terms and conditions of the GNU General Public License,
11  * version 2 or later, as published by the Free Software Foundation.
12  *
13  * This program is distributed in the hope it will be useful, but WITHOUT
14  * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
15  * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
16  * more details.
17  *
18  * You should have received a copy of the GNU General Public License along with
19  * this program.  If not, see <http://www.gnu.org/licenses/>.
20  */
21 
22 #include "qemu/osdep.h"
23 #include "qemu/log.h"
24 #include "qapi/error.h"
25 #include "cpu.h"
26 #include "trace.h"
27 #include "exec/exec-all.h"
28 
29 static void pmp_write_cfg(CPURISCVState *env, uint32_t addr_index,
30                           uint8_t val);
31 static uint8_t pmp_read_cfg(CPURISCVState *env, uint32_t addr_index);
32 static void pmp_update_rule(CPURISCVState *env, uint32_t pmp_index);
33 
34 /*
35  * Accessor method to extract address matching type 'a field' from cfg reg
36  */
37 static inline uint8_t pmp_get_a_field(uint8_t cfg)
38 {
39     uint8_t a = cfg >> 3;
40     return a & 0x3;
41 }
42 
43 /*
44  * Check whether a PMP is locked or not.
45  */
46 static inline int pmp_is_locked(CPURISCVState *env, uint32_t pmp_index)
47 {
48 
49     if (env->pmp_state.pmp[pmp_index].cfg_reg & PMP_LOCK) {
50         return 1;
51     }
52 
53     /* Top PMP has no 'next' to check */
54     if ((pmp_index + 1u) >= MAX_RISCV_PMPS) {
55         return 0;
56     }
57 
58     return 0;
59 }
60 
61 /*
62  * Count the number of active rules.
63  */
64 uint32_t pmp_get_num_rules(CPURISCVState *env)
65 {
66      return env->pmp_state.num_rules;
67 }
68 
69 /*
70  * Accessor to get the cfg reg for a specific PMP/HART
71  */
72 static inline uint8_t pmp_read_cfg(CPURISCVState *env, uint32_t pmp_index)
73 {
74     if (pmp_index < MAX_RISCV_PMPS) {
75         return env->pmp_state.pmp[pmp_index].cfg_reg;
76     }
77 
78     return 0;
79 }
80 
81 
82 /*
83  * Accessor to set the cfg reg for a specific PMP/HART
84  * Bounds checks and relevant lock bit.
85  */
86 static void pmp_write_cfg(CPURISCVState *env, uint32_t pmp_index, uint8_t val)
87 {
88     if (pmp_index < MAX_RISCV_PMPS) {
89         bool locked = true;
90 
91         if (riscv_cpu_cfg(env)->epmp) {
92             /* mseccfg.RLB is set */
93             if (MSECCFG_RLB_ISSET(env)) {
94                 locked = false;
95             }
96 
97             /* mseccfg.MML is not set */
98             if (!MSECCFG_MML_ISSET(env) && !pmp_is_locked(env, pmp_index)) {
99                 locked = false;
100             }
101 
102             /* mseccfg.MML is set */
103             if (MSECCFG_MML_ISSET(env)) {
104                 /* not adding execute bit */
105                 if ((val & PMP_LOCK) != 0 && (val & PMP_EXEC) != PMP_EXEC) {
106                     locked = false;
107                 }
108                 /* shared region and not adding X bit */
109                 if ((val & PMP_LOCK) != PMP_LOCK &&
110                     (val & 0x7) != (PMP_WRITE | PMP_EXEC)) {
111                     locked = false;
112                 }
113             }
114         } else {
115             if (!pmp_is_locked(env, pmp_index)) {
116                 locked = false;
117             }
118         }
119 
120         if (locked) {
121             qemu_log_mask(LOG_GUEST_ERROR, "ignoring pmpcfg write - locked\n");
122         } else {
123             env->pmp_state.pmp[pmp_index].cfg_reg = val;
124             pmp_update_rule(env, pmp_index);
125         }
126     } else {
127         qemu_log_mask(LOG_GUEST_ERROR,
128                       "ignoring pmpcfg write - out of bounds\n");
129     }
130 }
131 
132 static void pmp_decode_napot(target_ulong a, target_ulong *sa,
133                              target_ulong *ea)
134 {
135     /*
136      * aaaa...aaa0   8-byte NAPOT range
137      * aaaa...aa01   16-byte NAPOT range
138      * aaaa...a011   32-byte NAPOT range
139      * ...
140      * aa01...1111   2^XLEN-byte NAPOT range
141      * a011...1111   2^(XLEN+1)-byte NAPOT range
142      * 0111...1111   2^(XLEN+2)-byte NAPOT range
143      * 1111...1111   Reserved
144      */
145     a = (a << 2) | 0x3;
146     *sa = a & (a + 1);
147     *ea = a | (a + 1);
148 }
149 
150 void pmp_update_rule_addr(CPURISCVState *env, uint32_t pmp_index)
151 {
152     uint8_t this_cfg = env->pmp_state.pmp[pmp_index].cfg_reg;
153     target_ulong this_addr = env->pmp_state.pmp[pmp_index].addr_reg;
154     target_ulong prev_addr = 0u;
155     target_ulong sa = 0u;
156     target_ulong ea = 0u;
157 
158     if (pmp_index >= 1u) {
159         prev_addr = env->pmp_state.pmp[pmp_index - 1].addr_reg;
160     }
161 
162     switch (pmp_get_a_field(this_cfg)) {
163     case PMP_AMATCH_OFF:
164         sa = 0u;
165         ea = -1;
166         break;
167 
168     case PMP_AMATCH_TOR:
169         sa = prev_addr << 2; /* shift up from [xx:0] to [xx+2:2] */
170         ea = (this_addr << 2) - 1u;
171         if (sa > ea) {
172             sa = ea = 0u;
173         }
174         break;
175 
176     case PMP_AMATCH_NA4:
177         sa = this_addr << 2; /* shift up from [xx:0] to [xx+2:2] */
178         ea = (sa + 4u) - 1u;
179         break;
180 
181     case PMP_AMATCH_NAPOT:
182         pmp_decode_napot(this_addr, &sa, &ea);
183         break;
184 
185     default:
186         sa = 0u;
187         ea = 0u;
188         break;
189     }
190 
191     env->pmp_state.addr[pmp_index].sa = sa;
192     env->pmp_state.addr[pmp_index].ea = ea;
193 }
194 
195 void pmp_update_rule_nums(CPURISCVState *env)
196 {
197     int i;
198 
199     env->pmp_state.num_rules = 0;
200     for (i = 0; i < MAX_RISCV_PMPS; i++) {
201         const uint8_t a_field =
202             pmp_get_a_field(env->pmp_state.pmp[i].cfg_reg);
203         if (PMP_AMATCH_OFF != a_field) {
204             env->pmp_state.num_rules++;
205         }
206     }
207 }
208 
209 /*
210  * Convert cfg/addr reg values here into simple 'sa' --> start address and 'ea'
211  *   end address values.
212  *   This function is called relatively infrequently whereas the check that
213  *   an address is within a pmp rule is called often, so optimise that one
214  */
215 static void pmp_update_rule(CPURISCVState *env, uint32_t pmp_index)
216 {
217     pmp_update_rule_addr(env, pmp_index);
218     pmp_update_rule_nums(env);
219 }
220 
221 static int pmp_is_in_range(CPURISCVState *env, int pmp_index,
222                            target_ulong addr)
223 {
224     int result = 0;
225 
226     if ((addr >= env->pmp_state.addr[pmp_index].sa) &&
227         (addr <= env->pmp_state.addr[pmp_index].ea)) {
228         result = 1;
229     } else {
230         result = 0;
231     }
232 
233     return result;
234 }
235 
236 /*
237  * Check if the address has required RWX privs when no PMP entry is matched.
238  */
239 static bool pmp_hart_has_privs_default(CPURISCVState *env, pmp_priv_t privs,
240                                        pmp_priv_t *allowed_privs,
241                                        target_ulong mode)
242 {
243     bool ret;
244 
245     if (MSECCFG_MMWP_ISSET(env)) {
246         /*
247          * The Machine Mode Whitelist Policy (mseccfg.MMWP) is set
248          * so we default to deny all, even for M-mode.
249          */
250         *allowed_privs = 0;
251         return false;
252     } else if (MSECCFG_MML_ISSET(env)) {
253         /*
254          * The Machine Mode Lockdown (mseccfg.MML) bit is set
255          * so we can only execute code in M-mode with an applicable
256          * rule. Other modes are disabled.
257          */
258         if (mode == PRV_M && !(privs & PMP_EXEC)) {
259             ret = true;
260             *allowed_privs = PMP_READ | PMP_WRITE;
261         } else {
262             ret = false;
263             *allowed_privs = 0;
264         }
265 
266         return ret;
267     }
268 
269     if (!riscv_cpu_cfg(env)->pmp || (mode == PRV_M)) {
270         /*
271          * Privileged spec v1.10 states if HW doesn't implement any PMP entry
272          * or no PMP entry matches an M-Mode access, the access succeeds.
273          */
274         ret = true;
275         *allowed_privs = PMP_READ | PMP_WRITE | PMP_EXEC;
276     } else {
277         /*
278          * Other modes are not allowed to succeed if they don't * match a rule,
279          * but there are rules. We've checked for no rule earlier in this
280          * function.
281          */
282         ret = false;
283         *allowed_privs = 0;
284     }
285 
286     return ret;
287 }
288 
289 
290 /*
291  * Public Interface
292  */
293 
294 /*
295  * Check if the address has required RWX privs to complete desired operation
296  * Return true if a pmp rule match or default match
297  * Return false if no match
298  */
299 bool pmp_hart_has_privs(CPURISCVState *env, target_ulong addr,
300                         target_ulong size, pmp_priv_t privs,
301                         pmp_priv_t *allowed_privs, target_ulong mode)
302 {
303     int i = 0;
304     bool ret = false;
305     int pmp_size = 0;
306     target_ulong s = 0;
307     target_ulong e = 0;
308 
309     /* Short cut if no rules */
310     if (0 == pmp_get_num_rules(env)) {
311         return pmp_hart_has_privs_default(env, privs, allowed_privs, mode);
312     }
313 
314     if (size == 0) {
315         if (riscv_cpu_cfg(env)->mmu) {
316             /*
317              * If size is unknown (0), assume that all bytes
318              * from addr to the end of the page will be accessed.
319              */
320             pmp_size = -(addr | TARGET_PAGE_MASK);
321         } else {
322             pmp_size = sizeof(target_ulong);
323         }
324     } else {
325         pmp_size = size;
326     }
327 
328     /*
329      * 1.10 draft priv spec states there is an implicit order
330      * from low to high
331      */
332     for (i = 0; i < MAX_RISCV_PMPS; i++) {
333         s = pmp_is_in_range(env, i, addr);
334         e = pmp_is_in_range(env, i, addr + pmp_size - 1);
335 
336         /* partially inside */
337         if ((s + e) == 1) {
338             qemu_log_mask(LOG_GUEST_ERROR,
339                           "pmp violation - access is partially inside\n");
340             ret = false;
341             break;
342         }
343 
344         /* fully inside */
345         const uint8_t a_field =
346             pmp_get_a_field(env->pmp_state.pmp[i].cfg_reg);
347 
348         /*
349          * Convert the PMP permissions to match the truth table in the
350          * ePMP spec.
351          */
352         const uint8_t epmp_operation =
353             ((env->pmp_state.pmp[i].cfg_reg & PMP_LOCK) >> 4) |
354             ((env->pmp_state.pmp[i].cfg_reg & PMP_READ) << 2) |
355             (env->pmp_state.pmp[i].cfg_reg & PMP_WRITE) |
356             ((env->pmp_state.pmp[i].cfg_reg & PMP_EXEC) >> 2);
357 
358         if (((s + e) == 2) && (PMP_AMATCH_OFF != a_field)) {
359             /*
360              * If the PMP entry is not off and the address is in range,
361              * do the priv check
362              */
363             if (!MSECCFG_MML_ISSET(env)) {
364                 /*
365                  * If mseccfg.MML Bit is not set, do pmp priv check
366                  * This will always apply to regular PMP.
367                  */
368                 *allowed_privs = PMP_READ | PMP_WRITE | PMP_EXEC;
369                 if ((mode != PRV_M) || pmp_is_locked(env, i)) {
370                     *allowed_privs &= env->pmp_state.pmp[i].cfg_reg;
371                 }
372             } else {
373                 /*
374                  * If mseccfg.MML Bit set, do the enhanced pmp priv check
375                  */
376                 if (mode == PRV_M) {
377                     switch (epmp_operation) {
378                     case 0:
379                     case 1:
380                     case 4:
381                     case 5:
382                     case 6:
383                     case 7:
384                     case 8:
385                         *allowed_privs = 0;
386                         break;
387                     case 2:
388                     case 3:
389                     case 14:
390                         *allowed_privs = PMP_READ | PMP_WRITE;
391                         break;
392                     case 9:
393                     case 10:
394                         *allowed_privs = PMP_EXEC;
395                         break;
396                     case 11:
397                     case 13:
398                         *allowed_privs = PMP_READ | PMP_EXEC;
399                         break;
400                     case 12:
401                     case 15:
402                         *allowed_privs = PMP_READ;
403                         break;
404                     default:
405                         g_assert_not_reached();
406                     }
407                 } else {
408                     switch (epmp_operation) {
409                     case 0:
410                     case 8:
411                     case 9:
412                     case 12:
413                     case 13:
414                     case 14:
415                         *allowed_privs = 0;
416                         break;
417                     case 1:
418                     case 10:
419                     case 11:
420                         *allowed_privs = PMP_EXEC;
421                         break;
422                     case 2:
423                     case 4:
424                     case 15:
425                         *allowed_privs = PMP_READ;
426                         break;
427                     case 3:
428                     case 6:
429                         *allowed_privs = PMP_READ | PMP_WRITE;
430                         break;
431                     case 5:
432                         *allowed_privs = PMP_READ | PMP_EXEC;
433                         break;
434                     case 7:
435                         *allowed_privs = PMP_READ | PMP_WRITE | PMP_EXEC;
436                         break;
437                     default:
438                         g_assert_not_reached();
439                     }
440                 }
441             }
442 
443             /*
444              * If matching address range was found, the protection bits
445              * defined with PMP must be used. We shouldn't fallback on
446              * finding default privileges.
447              */
448             ret = true;
449             break;
450         }
451     }
452 
453     /* No rule matched */
454     if (!ret) {
455         ret = pmp_hart_has_privs_default(env, privs, allowed_privs, mode);
456     }
457 
458     return ret;
459 }
460 
461 /*
462  * Handle a write to a pmpcfg CSR
463  */
464 void pmpcfg_csr_write(CPURISCVState *env, uint32_t reg_index,
465                       target_ulong val)
466 {
467     int i;
468     uint8_t cfg_val;
469     int pmpcfg_nums = 2 << riscv_cpu_mxl(env);
470 
471     trace_pmpcfg_csr_write(env->mhartid, reg_index, val);
472 
473     for (i = 0; i < pmpcfg_nums; i++) {
474         cfg_val = (val >> 8 * i)  & 0xff;
475         pmp_write_cfg(env, (reg_index * 4) + i, cfg_val);
476     }
477 
478     /* If PMP permission of any addr has been changed, flush TLB pages. */
479     tlb_flush(env_cpu(env));
480 }
481 
482 
483 /*
484  * Handle a read from a pmpcfg CSR
485  */
486 target_ulong pmpcfg_csr_read(CPURISCVState *env, uint32_t reg_index)
487 {
488     int i;
489     target_ulong cfg_val = 0;
490     target_ulong val = 0;
491     int pmpcfg_nums = 2 << riscv_cpu_mxl(env);
492 
493     for (i = 0; i < pmpcfg_nums; i++) {
494         val = pmp_read_cfg(env, (reg_index * 4) + i);
495         cfg_val |= (val << (i * 8));
496     }
497     trace_pmpcfg_csr_read(env->mhartid, reg_index, cfg_val);
498 
499     return cfg_val;
500 }
501 
502 
503 /*
504  * Handle a write to a pmpaddr CSR
505  */
506 void pmpaddr_csr_write(CPURISCVState *env, uint32_t addr_index,
507                        target_ulong val)
508 {
509     trace_pmpaddr_csr_write(env->mhartid, addr_index, val);
510     bool is_next_cfg_tor = false;
511 
512     if (addr_index < MAX_RISCV_PMPS) {
513         /*
514          * In TOR mode, need to check the lock bit of the next pmp
515          * (if there is a next).
516          */
517         if (addr_index + 1 < MAX_RISCV_PMPS) {
518             uint8_t pmp_cfg = env->pmp_state.pmp[addr_index + 1].cfg_reg;
519             is_next_cfg_tor = PMP_AMATCH_TOR == pmp_get_a_field(pmp_cfg);
520 
521             if (pmp_cfg & PMP_LOCK && is_next_cfg_tor) {
522                 qemu_log_mask(LOG_GUEST_ERROR,
523                               "ignoring pmpaddr write - pmpcfg + 1 locked\n");
524                 return;
525             }
526         }
527 
528         if (!pmp_is_locked(env, addr_index)) {
529             env->pmp_state.pmp[addr_index].addr_reg = val;
530             pmp_update_rule_addr(env, addr_index);
531             if (is_next_cfg_tor) {
532                 pmp_update_rule_addr(env, addr_index + 1);
533             }
534             tlb_flush(env_cpu(env));
535         } else {
536             qemu_log_mask(LOG_GUEST_ERROR,
537                           "ignoring pmpaddr write - locked\n");
538         }
539     } else {
540         qemu_log_mask(LOG_GUEST_ERROR,
541                       "ignoring pmpaddr write - out of bounds\n");
542     }
543 }
544 
545 
546 /*
547  * Handle a read from a pmpaddr CSR
548  */
549 target_ulong pmpaddr_csr_read(CPURISCVState *env, uint32_t addr_index)
550 {
551     target_ulong val = 0;
552 
553     if (addr_index < MAX_RISCV_PMPS) {
554         val = env->pmp_state.pmp[addr_index].addr_reg;
555         trace_pmpaddr_csr_read(env->mhartid, addr_index, val);
556     } else {
557         qemu_log_mask(LOG_GUEST_ERROR,
558                       "ignoring pmpaddr read - out of bounds\n");
559     }
560 
561     return val;
562 }
563 
564 /*
565  * Handle a write to a mseccfg CSR
566  */
567 void mseccfg_csr_write(CPURISCVState *env, target_ulong val)
568 {
569     int i;
570 
571     trace_mseccfg_csr_write(env->mhartid, val);
572 
573     /* RLB cannot be enabled if it's already 0 and if any regions are locked */
574     if (!MSECCFG_RLB_ISSET(env)) {
575         for (i = 0; i < MAX_RISCV_PMPS; i++) {
576             if (pmp_is_locked(env, i)) {
577                 val &= ~MSECCFG_RLB;
578                 break;
579             }
580         }
581     }
582 
583     if (riscv_cpu_cfg(env)->epmp) {
584         /* Sticky bits */
585         val |= (env->mseccfg & (MSECCFG_MMWP | MSECCFG_MML));
586         if ((val ^ env->mseccfg) & (MSECCFG_MMWP | MSECCFG_MML)) {
587             tlb_flush(env_cpu(env));
588         }
589     } else {
590         val &= ~(MSECCFG_MMWP | MSECCFG_MML | MSECCFG_RLB);
591     }
592 
593     env->mseccfg = val;
594 }
595 
596 /*
597  * Handle a read from a mseccfg CSR
598  */
599 target_ulong mseccfg_csr_read(CPURISCVState *env)
600 {
601     trace_mseccfg_csr_read(env->mhartid, env->mseccfg);
602     return env->mseccfg;
603 }
604 
605 /*
606  * Calculate the TLB size.
607  * It's possible that PMP regions only cover partial of the TLB page, and
608  * this may split the page into regions with different permissions.
609  * For example if PMP0 is (0x80000008~0x8000000F, R) and PMP1 is (0x80000000
610  * ~0x80000FFF, RWX), then region 0x80000008~0x8000000F has R permission, and
611  * the other regions in this page have RWX permissions.
612  * A write access to 0x80000000 will match PMP1. However we cannot cache the
613  * translation result in the TLB since this will make the write access to
614  * 0x80000008 bypass the check of PMP0.
615  * To avoid this we return a size of 1 (which means no caching) if the PMP
616  * region only covers partial of the TLB page.
617  */
618 target_ulong pmp_get_tlb_size(CPURISCVState *env, target_ulong addr)
619 {
620     target_ulong pmp_sa;
621     target_ulong pmp_ea;
622     target_ulong tlb_sa = addr & ~(TARGET_PAGE_SIZE - 1);
623     target_ulong tlb_ea = tlb_sa + TARGET_PAGE_SIZE - 1;
624     int i;
625 
626     /*
627      * If PMP is not supported or there are no PMP rules, the TLB page will not
628      * be split into regions with different permissions by PMP so we set the
629      * size to TARGET_PAGE_SIZE.
630      */
631     if (!riscv_cpu_cfg(env)->pmp || !pmp_get_num_rules(env)) {
632         return TARGET_PAGE_SIZE;
633     }
634 
635     for (i = 0; i < MAX_RISCV_PMPS; i++) {
636         if (pmp_get_a_field(env->pmp_state.pmp[i].cfg_reg) == PMP_AMATCH_OFF) {
637             continue;
638         }
639 
640         pmp_sa = env->pmp_state.addr[i].sa;
641         pmp_ea = env->pmp_state.addr[i].ea;
642 
643         /*
644          * Only the first PMP entry that covers (whole or partial of) the TLB
645          * page really matters:
646          * If it covers the whole TLB page, set the size to TARGET_PAGE_SIZE,
647          * since the following PMP entries have lower priority and will not
648          * affect the permissions of the page.
649          * If it only covers partial of the TLB page, set the size to 1 since
650          * the allowed permissions of the region may be different from other
651          * region of the page.
652          */
653         if (pmp_sa <= tlb_sa && pmp_ea >= tlb_ea) {
654             return TARGET_PAGE_SIZE;
655         } else if ((pmp_sa >= tlb_sa && pmp_sa <= tlb_ea) ||
656                    (pmp_ea >= tlb_sa && pmp_ea <= tlb_ea)) {
657             return 1;
658         }
659     }
660 
661     /*
662      * If no PMP entry matches the TLB page, the TLB page will also not be
663      * split into regions with different permissions by PMP so we set the size
664      * to TARGET_PAGE_SIZE.
665      */
666     return TARGET_PAGE_SIZE;
667 }
668 
669 /*
670  * Convert PMP privilege to TLB page privilege.
671  */
672 int pmp_priv_to_page_prot(pmp_priv_t pmp_priv)
673 {
674     int prot = 0;
675 
676     if (pmp_priv & PMP_READ) {
677         prot |= PAGE_READ;
678     }
679     if (pmp_priv & PMP_WRITE) {
680         prot |= PAGE_WRITE;
681     }
682     if (pmp_priv & PMP_EXEC) {
683         prot |= PAGE_EXEC;
684     }
685 
686     return prot;
687 }
688