1 /* 2 * QEMU RISC-V PMP (Physical Memory Protection) 3 * 4 * Author: Daire McNamara, daire.mcnamara@emdalo.com 5 * Ivan Griffin, ivan.griffin@emdalo.com 6 * 7 * This provides a RISC-V Physical Memory Protection implementation 8 * 9 * This program is free software; you can redistribute it and/or modify it 10 * under the terms and conditions of the GNU General Public License, 11 * version 2 or later, as published by the Free Software Foundation. 12 * 13 * This program is distributed in the hope it will be useful, but WITHOUT 14 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or 15 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for 16 * more details. 17 * 18 * You should have received a copy of the GNU General Public License along with 19 * this program. If not, see <http://www.gnu.org/licenses/>. 20 */ 21 22 #include "qemu/osdep.h" 23 #include "qemu/log.h" 24 #include "qapi/error.h" 25 #include "cpu.h" 26 #include "trace.h" 27 #include "exec/cputlb.h" 28 #include "exec/page-protection.h" 29 #include "exec/target_page.h" 30 31 static bool pmp_write_cfg(CPURISCVState *env, uint32_t addr_index, 32 uint8_t val); 33 static uint8_t pmp_read_cfg(CPURISCVState *env, uint32_t addr_index); 34 35 /* 36 * Accessor method to extract address matching type 'a field' from cfg reg 37 */ 38 static inline uint8_t pmp_get_a_field(uint8_t cfg) 39 { 40 uint8_t a = cfg >> 3; 41 return a & 0x3; 42 } 43 44 /* 45 * Check whether a PMP is locked or not. 46 */ 47 static inline int pmp_is_locked(CPURISCVState *env, uint32_t pmp_index) 48 { 49 /* mseccfg.RLB is set */ 50 if (MSECCFG_RLB_ISSET(env)) { 51 return 0; 52 } 53 54 if (env->pmp_state.pmp[pmp_index].cfg_reg & PMP_LOCK) { 55 return 1; 56 } 57 58 /* Top PMP has no 'next' to check */ 59 if ((pmp_index + 1u) >= MAX_RISCV_PMPS) { 60 return 0; 61 } 62 63 return 0; 64 } 65 66 /* 67 * Count the number of active rules. 68 */ 69 uint32_t pmp_get_num_rules(CPURISCVState *env) 70 { 71 return env->pmp_state.num_rules; 72 } 73 74 /* 75 * Accessor to get the cfg reg for a specific PMP/HART 76 */ 77 static inline uint8_t pmp_read_cfg(CPURISCVState *env, uint32_t pmp_index) 78 { 79 if (pmp_index < MAX_RISCV_PMPS) { 80 return env->pmp_state.pmp[pmp_index].cfg_reg; 81 } 82 83 return 0; 84 } 85 86 87 /* 88 * Accessor to set the cfg reg for a specific PMP/HART 89 * Bounds checks and relevant lock bit. 90 */ 91 static bool pmp_write_cfg(CPURISCVState *env, uint32_t pmp_index, uint8_t val) 92 { 93 if (pmp_index < MAX_RISCV_PMPS) { 94 bool locked = true; 95 96 if (riscv_cpu_cfg(env)->ext_smepmp) { 97 /* mseccfg.RLB is set */ 98 if (MSECCFG_RLB_ISSET(env)) { 99 locked = false; 100 } 101 102 /* mseccfg.MML is not set */ 103 if (!MSECCFG_MML_ISSET(env) && !pmp_is_locked(env, pmp_index)) { 104 locked = false; 105 } 106 107 /* mseccfg.MML is set */ 108 if (MSECCFG_MML_ISSET(env)) { 109 /* not adding execute bit */ 110 if ((val & PMP_LOCK) != 0 && (val & PMP_EXEC) != PMP_EXEC) { 111 locked = false; 112 } 113 /* shared region and not adding X bit */ 114 if ((val & PMP_LOCK) != PMP_LOCK && 115 (val & 0x7) != (PMP_WRITE | PMP_EXEC)) { 116 locked = false; 117 } 118 } 119 } else { 120 if (!pmp_is_locked(env, pmp_index)) { 121 locked = false; 122 } 123 } 124 125 if (locked) { 126 qemu_log_mask(LOG_GUEST_ERROR, "ignoring pmpcfg write - locked\n"); 127 } else if (env->pmp_state.pmp[pmp_index].cfg_reg != val) { 128 /* If !mseccfg.MML then ignore writes with encoding RW=01 */ 129 if ((val & PMP_WRITE) && !(val & PMP_READ) && 130 !MSECCFG_MML_ISSET(env)) { 131 return false; 132 } 133 env->pmp_state.pmp[pmp_index].cfg_reg = val; 134 pmp_update_rule_addr(env, pmp_index); 135 return true; 136 } 137 } else { 138 qemu_log_mask(LOG_GUEST_ERROR, 139 "ignoring pmpcfg write - out of bounds\n"); 140 } 141 142 return false; 143 } 144 145 void pmp_unlock_entries(CPURISCVState *env) 146 { 147 uint32_t pmp_num = pmp_get_num_rules(env); 148 int i; 149 150 for (i = 0; i < pmp_num; i++) { 151 env->pmp_state.pmp[i].cfg_reg &= ~(PMP_LOCK | PMP_AMATCH); 152 } 153 } 154 155 static void pmp_decode_napot(hwaddr a, hwaddr *sa, hwaddr *ea) 156 { 157 /* 158 * aaaa...aaa0 8-byte NAPOT range 159 * aaaa...aa01 16-byte NAPOT range 160 * aaaa...a011 32-byte NAPOT range 161 * ... 162 * aa01...1111 2^XLEN-byte NAPOT range 163 * a011...1111 2^(XLEN+1)-byte NAPOT range 164 * 0111...1111 2^(XLEN+2)-byte NAPOT range 165 * 1111...1111 Reserved 166 */ 167 a = (a << 2) | 0x3; 168 *sa = a & (a + 1); 169 *ea = a | (a + 1); 170 } 171 172 void pmp_update_rule_addr(CPURISCVState *env, uint32_t pmp_index) 173 { 174 uint8_t this_cfg = env->pmp_state.pmp[pmp_index].cfg_reg; 175 target_ulong this_addr = env->pmp_state.pmp[pmp_index].addr_reg; 176 target_ulong prev_addr = 0u; 177 hwaddr sa = 0u; 178 hwaddr ea = 0u; 179 180 if (pmp_index >= 1u) { 181 prev_addr = env->pmp_state.pmp[pmp_index - 1].addr_reg; 182 } 183 184 switch (pmp_get_a_field(this_cfg)) { 185 case PMP_AMATCH_OFF: 186 sa = 0u; 187 ea = -1; 188 break; 189 190 case PMP_AMATCH_TOR: 191 sa = prev_addr << 2; /* shift up from [xx:0] to [xx+2:2] */ 192 ea = (this_addr << 2) - 1u; 193 if (sa > ea) { 194 sa = ea = 0u; 195 } 196 break; 197 198 case PMP_AMATCH_NA4: 199 sa = this_addr << 2; /* shift up from [xx:0] to [xx+2:2] */ 200 ea = (sa + 4u) - 1u; 201 break; 202 203 case PMP_AMATCH_NAPOT: 204 pmp_decode_napot(this_addr, &sa, &ea); 205 break; 206 207 default: 208 sa = 0u; 209 ea = 0u; 210 break; 211 } 212 213 env->pmp_state.addr[pmp_index].sa = sa; 214 env->pmp_state.addr[pmp_index].ea = ea; 215 } 216 217 void pmp_update_rule_nums(CPURISCVState *env) 218 { 219 int i; 220 221 env->pmp_state.num_rules = 0; 222 for (i = 0; i < MAX_RISCV_PMPS; i++) { 223 const uint8_t a_field = 224 pmp_get_a_field(env->pmp_state.pmp[i].cfg_reg); 225 if (PMP_AMATCH_OFF != a_field) { 226 env->pmp_state.num_rules++; 227 } 228 } 229 } 230 231 static int pmp_is_in_range(CPURISCVState *env, int pmp_index, hwaddr addr) 232 { 233 int result = 0; 234 235 if ((addr >= env->pmp_state.addr[pmp_index].sa) && 236 (addr <= env->pmp_state.addr[pmp_index].ea)) { 237 result = 1; 238 } else { 239 result = 0; 240 } 241 242 return result; 243 } 244 245 /* 246 * Check if the address has required RWX privs when no PMP entry is matched. 247 */ 248 static bool pmp_hart_has_privs_default(CPURISCVState *env, pmp_priv_t privs, 249 pmp_priv_t *allowed_privs, 250 target_ulong mode) 251 { 252 bool ret; 253 254 if (MSECCFG_MMWP_ISSET(env)) { 255 /* 256 * The Machine Mode Whitelist Policy (mseccfg.MMWP) is set 257 * so we default to deny all, even for M-mode. 258 */ 259 *allowed_privs = 0; 260 return false; 261 } else if (MSECCFG_MML_ISSET(env)) { 262 /* 263 * The Machine Mode Lockdown (mseccfg.MML) bit is set 264 * so we can only execute code in M-mode with an applicable 265 * rule. Other modes are disabled. 266 */ 267 if (mode == PRV_M && !(privs & PMP_EXEC)) { 268 ret = true; 269 *allowed_privs = PMP_READ | PMP_WRITE; 270 } else { 271 ret = false; 272 *allowed_privs = 0; 273 } 274 275 return ret; 276 } 277 278 if (!riscv_cpu_cfg(env)->pmp || (mode == PRV_M)) { 279 /* 280 * Privileged spec v1.10 states if HW doesn't implement any PMP entry 281 * or no PMP entry matches an M-Mode access, the access succeeds. 282 */ 283 ret = true; 284 *allowed_privs = PMP_READ | PMP_WRITE | PMP_EXEC; 285 } else { 286 /* 287 * Other modes are not allowed to succeed if they don't * match a rule, 288 * but there are rules. We've checked for no rule earlier in this 289 * function. 290 */ 291 ret = false; 292 *allowed_privs = 0; 293 } 294 295 return ret; 296 } 297 298 299 /* 300 * Public Interface 301 */ 302 303 /* 304 * Check if the address has required RWX privs to complete desired operation 305 * Return true if a pmp rule match or default match 306 * Return false if no match 307 */ 308 bool pmp_hart_has_privs(CPURISCVState *env, hwaddr addr, 309 target_ulong size, pmp_priv_t privs, 310 pmp_priv_t *allowed_privs, target_ulong mode) 311 { 312 int i = 0; 313 int pmp_size = 0; 314 hwaddr s = 0; 315 hwaddr e = 0; 316 317 /* Short cut if no rules */ 318 if (0 == pmp_get_num_rules(env)) { 319 return pmp_hart_has_privs_default(env, privs, allowed_privs, mode); 320 } 321 322 if (size == 0) { 323 if (riscv_cpu_cfg(env)->mmu) { 324 /* 325 * If size is unknown (0), assume that all bytes 326 * from addr to the end of the page will be accessed. 327 */ 328 pmp_size = -(addr | TARGET_PAGE_MASK); 329 } else { 330 pmp_size = 2 << riscv_cpu_mxl(env); 331 } 332 } else { 333 pmp_size = size; 334 } 335 336 /* 337 * 1.10 draft priv spec states there is an implicit order 338 * from low to high 339 */ 340 for (i = 0; i < MAX_RISCV_PMPS; i++) { 341 s = pmp_is_in_range(env, i, addr); 342 e = pmp_is_in_range(env, i, addr + pmp_size - 1); 343 344 /* partially inside */ 345 if ((s + e) == 1) { 346 qemu_log_mask(LOG_GUEST_ERROR, 347 "pmp violation - access is partially inside\n"); 348 *allowed_privs = 0; 349 return false; 350 } 351 352 /* fully inside */ 353 const uint8_t a_field = 354 pmp_get_a_field(env->pmp_state.pmp[i].cfg_reg); 355 356 /* 357 * Convert the PMP permissions to match the truth table in the 358 * Smepmp spec. 359 */ 360 const uint8_t smepmp_operation = 361 ((env->pmp_state.pmp[i].cfg_reg & PMP_LOCK) >> 4) | 362 ((env->pmp_state.pmp[i].cfg_reg & PMP_READ) << 2) | 363 (env->pmp_state.pmp[i].cfg_reg & PMP_WRITE) | 364 ((env->pmp_state.pmp[i].cfg_reg & PMP_EXEC) >> 2); 365 366 if (((s + e) == 2) && (PMP_AMATCH_OFF != a_field)) { 367 /* 368 * If the PMP entry is not off and the address is in range, 369 * do the priv check 370 */ 371 if (!MSECCFG_MML_ISSET(env)) { 372 /* 373 * If mseccfg.MML Bit is not set, do pmp priv check 374 * This will always apply to regular PMP. 375 */ 376 *allowed_privs = PMP_READ | PMP_WRITE | PMP_EXEC; 377 if ((mode != PRV_M) || pmp_is_locked(env, i)) { 378 *allowed_privs &= env->pmp_state.pmp[i].cfg_reg; 379 } 380 } else { 381 /* 382 * If mseccfg.MML Bit set, do the enhanced pmp priv check 383 */ 384 if (mode == PRV_M) { 385 switch (smepmp_operation) { 386 case 0: 387 case 1: 388 case 4: 389 case 5: 390 case 6: 391 case 7: 392 case 8: 393 *allowed_privs = 0; 394 break; 395 case 2: 396 case 3: 397 case 14: 398 *allowed_privs = PMP_READ | PMP_WRITE; 399 break; 400 case 9: 401 case 10: 402 *allowed_privs = PMP_EXEC; 403 break; 404 case 11: 405 case 13: 406 *allowed_privs = PMP_READ | PMP_EXEC; 407 break; 408 case 12: 409 case 15: 410 *allowed_privs = PMP_READ; 411 break; 412 default: 413 g_assert_not_reached(); 414 } 415 } else { 416 switch (smepmp_operation) { 417 case 0: 418 case 8: 419 case 9: 420 case 12: 421 case 13: 422 case 14: 423 *allowed_privs = 0; 424 break; 425 case 1: 426 case 10: 427 case 11: 428 *allowed_privs = PMP_EXEC; 429 break; 430 case 2: 431 case 4: 432 case 15: 433 *allowed_privs = PMP_READ; 434 break; 435 case 3: 436 case 6: 437 *allowed_privs = PMP_READ | PMP_WRITE; 438 break; 439 case 5: 440 *allowed_privs = PMP_READ | PMP_EXEC; 441 break; 442 case 7: 443 *allowed_privs = PMP_READ | PMP_WRITE | PMP_EXEC; 444 break; 445 default: 446 g_assert_not_reached(); 447 } 448 } 449 } 450 451 /* 452 * If matching address range was found, the protection bits 453 * defined with PMP must be used. We shouldn't fallback on 454 * finding default privileges. 455 */ 456 return (privs & *allowed_privs) == privs; 457 } 458 } 459 460 /* No rule matched */ 461 return pmp_hart_has_privs_default(env, privs, allowed_privs, mode); 462 } 463 464 /* 465 * Handle a write to a pmpcfg CSR 466 */ 467 void pmpcfg_csr_write(CPURISCVState *env, uint32_t reg_index, 468 target_ulong val) 469 { 470 int i; 471 uint8_t cfg_val; 472 int pmpcfg_nums = 2 << riscv_cpu_mxl(env); 473 bool modified = false; 474 475 trace_pmpcfg_csr_write(env->mhartid, reg_index, val); 476 477 for (i = 0; i < pmpcfg_nums; i++) { 478 cfg_val = (val >> 8 * i) & 0xff; 479 modified |= pmp_write_cfg(env, (reg_index * 4) + i, cfg_val); 480 } 481 482 /* If PMP permission of any addr has been changed, flush TLB pages. */ 483 if (modified) { 484 pmp_update_rule_nums(env); 485 tlb_flush(env_cpu(env)); 486 } 487 } 488 489 490 /* 491 * Handle a read from a pmpcfg CSR 492 */ 493 target_ulong pmpcfg_csr_read(CPURISCVState *env, uint32_t reg_index) 494 { 495 int i; 496 target_ulong cfg_val = 0; 497 target_ulong val = 0; 498 int pmpcfg_nums = 2 << riscv_cpu_mxl(env); 499 500 for (i = 0; i < pmpcfg_nums; i++) { 501 val = pmp_read_cfg(env, (reg_index * 4) + i); 502 cfg_val |= (val << (i * 8)); 503 } 504 trace_pmpcfg_csr_read(env->mhartid, reg_index, cfg_val); 505 506 return cfg_val; 507 } 508 509 510 /* 511 * Handle a write to a pmpaddr CSR 512 */ 513 void pmpaddr_csr_write(CPURISCVState *env, uint32_t addr_index, 514 target_ulong val) 515 { 516 trace_pmpaddr_csr_write(env->mhartid, addr_index, val); 517 bool is_next_cfg_tor = false; 518 519 if (addr_index < MAX_RISCV_PMPS) { 520 /* 521 * In TOR mode, need to check the lock bit of the next pmp 522 * (if there is a next). 523 */ 524 if (addr_index + 1 < MAX_RISCV_PMPS) { 525 uint8_t pmp_cfg = env->pmp_state.pmp[addr_index + 1].cfg_reg; 526 is_next_cfg_tor = PMP_AMATCH_TOR == pmp_get_a_field(pmp_cfg); 527 528 if (pmp_is_locked(env, addr_index + 1) && is_next_cfg_tor) { 529 qemu_log_mask(LOG_GUEST_ERROR, 530 "ignoring pmpaddr write - pmpcfg + 1 locked\n"); 531 return; 532 } 533 } 534 535 if (!pmp_is_locked(env, addr_index)) { 536 if (env->pmp_state.pmp[addr_index].addr_reg != val) { 537 env->pmp_state.pmp[addr_index].addr_reg = val; 538 pmp_update_rule_addr(env, addr_index); 539 if (is_next_cfg_tor) { 540 pmp_update_rule_addr(env, addr_index + 1); 541 } 542 tlb_flush(env_cpu(env)); 543 } 544 } else { 545 qemu_log_mask(LOG_GUEST_ERROR, 546 "ignoring pmpaddr write - locked\n"); 547 } 548 } else { 549 qemu_log_mask(LOG_GUEST_ERROR, 550 "ignoring pmpaddr write - out of bounds\n"); 551 } 552 } 553 554 555 /* 556 * Handle a read from a pmpaddr CSR 557 */ 558 target_ulong pmpaddr_csr_read(CPURISCVState *env, uint32_t addr_index) 559 { 560 target_ulong val = 0; 561 562 if (addr_index < MAX_RISCV_PMPS) { 563 val = env->pmp_state.pmp[addr_index].addr_reg; 564 trace_pmpaddr_csr_read(env->mhartid, addr_index, val); 565 } else { 566 qemu_log_mask(LOG_GUEST_ERROR, 567 "ignoring pmpaddr read - out of bounds\n"); 568 } 569 570 return val; 571 } 572 573 /* 574 * Handle a write to a mseccfg CSR 575 */ 576 void mseccfg_csr_write(CPURISCVState *env, target_ulong val) 577 { 578 int i; 579 uint64_t mask = MSECCFG_MMWP | MSECCFG_MML; 580 /* Update PMM field only if the value is valid according to Zjpm v1.0 */ 581 if (riscv_cpu_cfg(env)->ext_smmpm && 582 riscv_cpu_mxl(env) == MXL_RV64 && 583 get_field(val, MSECCFG_PMM) != PMM_FIELD_RESERVED) { 584 mask |= MSECCFG_PMM; 585 } 586 587 trace_mseccfg_csr_write(env->mhartid, val); 588 589 /* RLB cannot be enabled if it's already 0 and if any regions are locked */ 590 if (!MSECCFG_RLB_ISSET(env)) { 591 for (i = 0; i < MAX_RISCV_PMPS; i++) { 592 if (pmp_is_locked(env, i)) { 593 val &= ~MSECCFG_RLB; 594 break; 595 } 596 } 597 } 598 599 if (riscv_cpu_cfg(env)->ext_smepmp) { 600 /* Sticky bits */ 601 val |= (env->mseccfg & mask); 602 if ((val ^ env->mseccfg) & mask) { 603 tlb_flush(env_cpu(env)); 604 } 605 } else { 606 mask |= MSECCFG_RLB; 607 val &= ~(mask); 608 } 609 610 /* M-mode forward cfi to be enabled if cfi extension is implemented */ 611 if (env_archcpu(env)->cfg.ext_zicfilp) { 612 val |= (val & MSECCFG_MLPE); 613 } 614 615 env->mseccfg = val; 616 } 617 618 /* 619 * Handle a read from a mseccfg CSR 620 */ 621 target_ulong mseccfg_csr_read(CPURISCVState *env) 622 { 623 trace_mseccfg_csr_read(env->mhartid, env->mseccfg); 624 return env->mseccfg; 625 } 626 627 /* 628 * Calculate the TLB size. 629 * It's possible that PMP regions only cover partial of the TLB page, and 630 * this may split the page into regions with different permissions. 631 * For example if PMP0 is (0x80000008~0x8000000F, R) and PMP1 is (0x80000000 632 * ~0x80000FFF, RWX), then region 0x80000008~0x8000000F has R permission, and 633 * the other regions in this page have RWX permissions. 634 * A write access to 0x80000000 will match PMP1. However we cannot cache the 635 * translation result in the TLB since this will make the write access to 636 * 0x80000008 bypass the check of PMP0. 637 * To avoid this we return a size of 1 (which means no caching) if the PMP 638 * region only covers partial of the TLB page. 639 */ 640 target_ulong pmp_get_tlb_size(CPURISCVState *env, hwaddr addr) 641 { 642 hwaddr pmp_sa; 643 hwaddr pmp_ea; 644 hwaddr tlb_sa = addr & ~(TARGET_PAGE_SIZE - 1); 645 hwaddr tlb_ea = tlb_sa + TARGET_PAGE_SIZE - 1; 646 int i; 647 648 /* 649 * If PMP is not supported or there are no PMP rules, the TLB page will not 650 * be split into regions with different permissions by PMP so we set the 651 * size to TARGET_PAGE_SIZE. 652 */ 653 if (!riscv_cpu_cfg(env)->pmp || !pmp_get_num_rules(env)) { 654 return TARGET_PAGE_SIZE; 655 } 656 657 for (i = 0; i < MAX_RISCV_PMPS; i++) { 658 if (pmp_get_a_field(env->pmp_state.pmp[i].cfg_reg) == PMP_AMATCH_OFF) { 659 continue; 660 } 661 662 pmp_sa = env->pmp_state.addr[i].sa; 663 pmp_ea = env->pmp_state.addr[i].ea; 664 665 /* 666 * Only the first PMP entry that covers (whole or partial of) the TLB 667 * page really matters: 668 * If it covers the whole TLB page, set the size to TARGET_PAGE_SIZE, 669 * since the following PMP entries have lower priority and will not 670 * affect the permissions of the page. 671 * If it only covers partial of the TLB page, set the size to 1 since 672 * the allowed permissions of the region may be different from other 673 * region of the page. 674 */ 675 if (pmp_sa <= tlb_sa && pmp_ea >= tlb_ea) { 676 return TARGET_PAGE_SIZE; 677 } else if ((pmp_sa >= tlb_sa && pmp_sa <= tlb_ea) || 678 (pmp_ea >= tlb_sa && pmp_ea <= tlb_ea)) { 679 return 1; 680 } 681 } 682 683 /* 684 * If no PMP entry matches the TLB page, the TLB page will also not be 685 * split into regions with different permissions by PMP so we set the size 686 * to TARGET_PAGE_SIZE. 687 */ 688 return TARGET_PAGE_SIZE; 689 } 690 691 /* 692 * Convert PMP privilege to TLB page privilege. 693 */ 694 int pmp_priv_to_page_prot(pmp_priv_t pmp_priv) 695 { 696 int prot = 0; 697 698 if (pmp_priv & PMP_READ) { 699 prot |= PAGE_READ; 700 } 701 if (pmp_priv & PMP_WRITE) { 702 prot |= PAGE_WRITE; 703 } 704 if (pmp_priv & PMP_EXEC) { 705 prot |= PAGE_EXEC; 706 } 707 708 return prot; 709 } 710