target/riscv/pmp: Raise exception if no PMP entry is configured

As per the privilege specification, any access from S/U mode should fail
if no pmp region is configured.

Backports d102f19a2085ac931cb998e6153b73248cca49f1

qemu/header_gen.py

@@ -7311,7 +7311,9 @@ riscv_symbols = (
     'helper_vcompress_vm_w',
     'helper_vcompress_vm_d',
     'pmp_hart_has_privs',
+    'pmp_get_num_rules',
     'pmp_is_range_in_tlb',
+    'pmp_update_rule_nums',
     'pmpaddr_csr_read',
     'pmpaddr_csr_write',
     'pmpcfg_csr_read',

qemu/riscv32.h

@@ -4747,7 +4747,9 @@
 #define helper_vcompress_vm_w helper_vcompress_vm_w_riscv32
 #define helper_vcompress_vm_d helper_vcompress_vm_d_riscv32
 #define pmp_hart_has_privs pmp_hart_has_privs_riscv32
+#define pmp_get_num_rules pmp_get_num_rules_riscv32
 #define pmp_is_range_in_tlb pmp_is_range_in_tlb_riscv32
+#define pmp_update_rule_nums pmp_update_rule_nums_riscv32
 #define pmpaddr_csr_read pmpaddr_csr_read_riscv32
 #define pmpaddr_csr_write pmpaddr_csr_write_riscv32
 #define pmpcfg_csr_read pmpcfg_csr_read_riscv32

qemu/riscv64.h

@@ -4747,7 +4747,9 @@
 #define helper_vcompress_vm_w helper_vcompress_vm_w_riscv64
 #define helper_vcompress_vm_d helper_vcompress_vm_d_riscv64
 #define pmp_hart_has_privs pmp_hart_has_privs_riscv64
+#define pmp_get_num_rules pmp_get_num_rules_riscv64
 #define pmp_is_range_in_tlb pmp_is_range_in_tlb_riscv64
+#define pmp_update_rule_nums pmp_update_rule_nums_riscv64
 #define pmpaddr_csr_read pmpaddr_csr_read_riscv64
 #define pmpaddr_csr_write pmpaddr_csr_write_riscv64
 #define pmpcfg_csr_read pmpcfg_csr_read_riscv64

qemu/target/riscv/op_helper.c

@@ -150,6 +150,11 @@ target_ulong helper_mret(CPURISCVState *env, target_ulong cpu_pc_deb)
 
     uint64_t mstatus = env->mstatus;
     target_ulong prev_priv = get_field(mstatus, MSTATUS_MPP);
+
+    if (!pmp_get_num_rules(env) && (prev_priv != PRV_M)) {
+        riscv_raise_exception(env, RISCV_EXCP_ILLEGAL_INST, GETPC());
+    }
+
     target_ulong prev_virt = get_field(env->mstatus, MSTATUS_MPV);
     mstatus = set_field(mstatus, MSTATUS_MIE,
                         get_field(mstatus, MSTATUS_MPIE));

qemu/target/riscv/pmp.c

@@ -84,7 +84,7 @@ static inline int pmp_is_locked(CPURISCVState *env, uint32_t pmp_index)
 /*
  * Count the number of active rules.
  */
-static inline uint32_t pmp_get_num_rules(CPURISCVState *env)
+uint32_t pmp_get_num_rules(CPURISCVState *env)
 {
      return env->pmp_state.num_rules;
 }
@@ -147,6 +147,20 @@ static void pmp_decode_napot(target_ulong a, target_ulong *sa, target_ulong *ea)
 }
 
 
+void pmp_update_rule_nums(CPURISCVState *env)
+{
+    int i;
+
+    env->pmp_state.num_rules = 0;
+    for (i = 0; i < MAX_RISCV_PMPS; i++) {
+        const uint8_t a_field =
+            pmp_get_a_field(env->pmp_state.pmp[i].cfg_reg);
+        if (PMP_AMATCH_OFF != a_field) {
+            env->pmp_state.num_rules++;
+        }
+    }
+}
+
 /* Convert cfg/addr reg values here into simple 'sa' --> start address and 'ea'
  *   end address values.
  *   This function is called relatively infrequently whereas the check that
@@ -239,7 +253,7 @@ bool pmp_hart_has_privs(CPURISCVState *env, target_ulong addr,
 
     /* Short cut if no rules */
     if (0 == pmp_get_num_rules(env)) {
-        return true;
+        return (env->priv == PRV_M) ? true : false;
     }
 
     /* 1.10 draft priv spec states there is an implicit order

qemu/target/riscv/pmp.h

@@ -63,4 +63,7 @@ bool pmp_hart_has_privs(CPURISCVState *env, target_ulong addr,
 bool pmp_is_range_in_tlb(CPURISCVState *env, hwaddr tlb_sa,
                          target_ulong *tlb_size);
 
+void pmp_update_rule_nums(CPURISCVState *env);
+uint32_t pmp_get_num_rules(CPURISCVState *env);
+
 #endif