78 miscRegValid(false), curTranType(NormalTran)
79{
80 tableWalker->setTlb(this);
81
82 // Cache system-level properties
83 haveLPAE = tableWalker->haveLPAE();
84 haveVirtualization = tableWalker->haveVirtualization();
85 haveLargeAsid64 = tableWalker->haveLargeAsid64();
86}
87
88TLB::~TLB()
89{
90 delete[] table;
91}
92
93void
94TLB::init()
95{
96 if (stage2Mmu && !isStage2)
97 stage2Tlb = stage2Mmu->stage2Tlb();
98}
99
100void
101TLB::setMMU(Stage2MMU *m)
102{
103 stage2Mmu = m;
104 tableWalker->setMMU(m);
105}
106
107bool
108TLB::translateFunctional(ThreadContext *tc, Addr va, Addr &pa)
109{
110 updateMiscReg(tc);
111
112 if (directToStage2) {
113 assert(stage2Tlb);
114 return stage2Tlb->translateFunctional(tc, va, pa);
115 }
116
117 TlbEntry *e = lookup(va, asid, vmid, isHyp, isSecure, true, false,
118 aarch64 ? aarch64EL : EL1);
119 if (!e)
120 return false;
121 pa = e->pAddr(va);
122 return true;
123}
124
125Fault
126TLB::finalizePhysical(RequestPtr req, ThreadContext *tc, Mode mode) const
127{
128 return NoFault;
129}
130
131TlbEntry*
132TLB::lookup(Addr va, uint16_t asn, uint8_t vmid, bool hyp, bool secure,
133 bool functional, bool ignore_asn, uint8_t target_el)
134{
135
136 TlbEntry *retval = NULL;
137
138 // Maintaining LRU array
139 int x = 0;
140 while (retval == NULL && x < size) {
141 if ((!ignore_asn && table[x].match(va, asn, vmid, hyp, secure, false,
142 target_el)) ||
143 (ignore_asn && table[x].match(va, vmid, hyp, secure, target_el))) {
144 // We only move the hit entry ahead when the position is higher
145 // than rangeMRU
146 if (x > rangeMRU && !functional) {
147 TlbEntry tmp_entry = table[x];
148 for(int i = x; i > 0; i--)
149 table[i] = table[i - 1];
150 table[0] = tmp_entry;
151 retval = &table[0];
152 } else {
153 retval = &table[x];
154 }
155 break;
156 }
157 ++x;
158 }
159
160 DPRINTF(TLBVerbose, "Lookup %#x, asn %#x -> %s vmn 0x%x hyp %d secure %d "
161 "ppn %#x size: %#x pa: %#x ap:%d ns:%d nstid:%d g:%d asid: %d "
162 "el: %d\n",
163 va, asn, retval ? "hit" : "miss", vmid, hyp, secure,
164 retval ? retval->pfn : 0, retval ? retval->size : 0,
165 retval ? retval->pAddr(va) : 0, retval ? retval->ap : 0,
166 retval ? retval->ns : 0, retval ? retval->nstid : 0,
167 retval ? retval->global : 0, retval ? retval->asid : 0,
168 retval ? retval->el : 0);
169
170 return retval;
171}
172
173// insert a new TLB entry
174void
175TLB::insert(Addr addr, TlbEntry &entry)
176{
177 DPRINTF(TLB, "Inserting entry into TLB with pfn:%#x size:%#x vpn: %#x"
178 " asid:%d vmid:%d N:%d global:%d valid:%d nc:%d xn:%d"
179 " ap:%#x domain:%#x ns:%d nstid:%d isHyp:%d\n", entry.pfn,
180 entry.size, entry.vpn, entry.asid, entry.vmid, entry.N,
181 entry.global, entry.valid, entry.nonCacheable, entry.xn,
182 entry.ap, static_cast<uint8_t>(entry.domain), entry.ns, entry.nstid,
183 entry.isHyp);
184
185 if (table[size - 1].valid)
186 DPRINTF(TLB, " - Replacing Valid entry %#x, asn %d vmn %d ppn %#x "
187 "size: %#x ap:%d ns:%d nstid:%d g:%d isHyp:%d el: %d\n",
188 table[size-1].vpn << table[size-1].N, table[size-1].asid,
189 table[size-1].vmid, table[size-1].pfn << table[size-1].N,
190 table[size-1].size, table[size-1].ap, table[size-1].ns,
191 table[size-1].nstid, table[size-1].global, table[size-1].isHyp,
192 table[size-1].el);
193
194 //inserting to MRU position and evicting the LRU one
195
196 for (int i = size - 1; i > 0; --i)
197 table[i] = table[i-1];
198 table[0] = entry;
199
200 inserts++;
201 ppRefills->notify(1);
202}
203
204void
205TLB::printTlb() const
206{
207 int x = 0;
208 TlbEntry *te;
209 DPRINTF(TLB, "Current TLB contents:\n");
210 while (x < size) {
211 te = &table[x];
212 if (te->valid)
213 DPRINTF(TLB, " * %s\n", te->print());
214 ++x;
215 }
216}
217
218void
219TLB::flushAllSecurity(bool secure_lookup, uint8_t target_el, bool ignore_el)
220{
221 DPRINTF(TLB, "Flushing all TLB entries (%s lookup)\n",
222 (secure_lookup ? "secure" : "non-secure"));
223 int x = 0;
224 TlbEntry *te;
225 while (x < size) {
226 te = &table[x];
227 if (te->valid && secure_lookup == !te->nstid &&
228 (te->vmid == vmid || secure_lookup) &&
229 checkELMatch(target_el, te->el, ignore_el)) {
230
231 DPRINTF(TLB, " - %s\n", te->print());
232 te->valid = false;
233 flushedEntries++;
234 }
235 ++x;
236 }
237
238 flushTlb++;
239
240 // If there's a second stage TLB (and we're not it) then flush it as well
241 // if we're currently in hyp mode
242 if (!isStage2 && isHyp) {
243 stage2Tlb->flushAllSecurity(secure_lookup, true);
244 }
245}
246
247void
248TLB::flushAllNs(bool hyp, uint8_t target_el, bool ignore_el)
249{
250 DPRINTF(TLB, "Flushing all NS TLB entries (%s lookup)\n",
251 (hyp ? "hyp" : "non-hyp"));
252 int x = 0;
253 TlbEntry *te;
254 while (x < size) {
255 te = &table[x];
256 if (te->valid && te->nstid && te->isHyp == hyp &&
257 checkELMatch(target_el, te->el, ignore_el)) {
258
259 DPRINTF(TLB, " - %s\n", te->print());
260 flushedEntries++;
261 te->valid = false;
262 }
263 ++x;
264 }
265
266 flushTlb++;
267
268 // If there's a second stage TLB (and we're not it) then flush it as well
269 if (!isStage2 && !hyp) {
270 stage2Tlb->flushAllNs(false, true);
271 }
272}
273
274void
275TLB::flushMvaAsid(Addr mva, uint64_t asn, bool secure_lookup, uint8_t target_el)
276{
277 DPRINTF(TLB, "Flushing TLB entries with mva: %#x, asid: %#x "
278 "(%s lookup)\n", mva, asn, (secure_lookup ?
279 "secure" : "non-secure"));
280 _flushMva(mva, asn, secure_lookup, false, false, target_el);
281 flushTlbMvaAsid++;
282}
283
284void
285TLB::flushAsid(uint64_t asn, bool secure_lookup, uint8_t target_el)
286{
287 DPRINTF(TLB, "Flushing TLB entries with asid: %#x (%s lookup)\n", asn,
288 (secure_lookup ? "secure" : "non-secure"));
289
290 int x = 0 ;
291 TlbEntry *te;
292
293 while (x < size) {
294 te = &table[x];
295 if (te->valid && te->asid == asn && secure_lookup == !te->nstid &&
296 (te->vmid == vmid || secure_lookup) &&
297 checkELMatch(target_el, te->el, false)) {
298
299 te->valid = false;
300 DPRINTF(TLB, " - %s\n", te->print());
301 flushedEntries++;
302 }
303 ++x;
304 }
305 flushTlbAsid++;
306}
307
308void
309TLB::flushMva(Addr mva, bool secure_lookup, bool hyp, uint8_t target_el)
310{
311 DPRINTF(TLB, "Flushing TLB entries with mva: %#x (%s lookup)\n", mva,
312 (secure_lookup ? "secure" : "non-secure"));
313 _flushMva(mva, 0xbeef, secure_lookup, hyp, true, target_el);
314 flushTlbMva++;
315}
316
317void
318TLB::_flushMva(Addr mva, uint64_t asn, bool secure_lookup, bool hyp,
319 bool ignore_asn, uint8_t target_el)
320{
321 TlbEntry *te;
322 // D5.7.2: Sign-extend address to 64 bits
323 mva = sext<56>(mva);
324 te = lookup(mva, asn, vmid, hyp, secure_lookup, false, ignore_asn,
325 target_el);
326 while (te != NULL) {
327 if (secure_lookup == !te->nstid) {
328 DPRINTF(TLB, " - %s\n", te->print());
329 te->valid = false;
330 flushedEntries++;
331 }
332 te = lookup(mva, asn, vmid, hyp, secure_lookup, false, ignore_asn,
333 target_el);
334 }
335}
336
337bool
338TLB::checkELMatch(uint8_t target_el, uint8_t tentry_el, bool ignore_el)
339{
340 bool elMatch = true;
341 if (!ignore_el) {
342 if (target_el == 2 || target_el == 3) {
343 elMatch = (tentry_el == target_el);
344 } else {
345 elMatch = (tentry_el == 0) || (tentry_el == 1);
346 }
347 }
348 return elMatch;
349}
350
351void
352TLB::drainResume()
353{
354 // We might have unserialized something or switched CPUs, so make
355 // sure to re-read the misc regs.
356 miscRegValid = false;
357}
358
359void
360TLB::takeOverFrom(BaseTLB *_otlb)
361{
362 TLB *otlb = dynamic_cast<TLB*>(_otlb);
363 /* Make sure we actually have a valid type */
364 if (otlb) {
365 _attr = otlb->_attr;
366 haveLPAE = otlb->haveLPAE;
367 directToStage2 = otlb->directToStage2;
368 stage2Req = otlb->stage2Req;
369 bootUncacheability = otlb->bootUncacheability;
370
371 /* Sync the stage2 MMU if they exist in both
372 * the old CPU and the new
373 */
374 if (!isStage2 &&
375 stage2Tlb && otlb->stage2Tlb) {
376 stage2Tlb->takeOverFrom(otlb->stage2Tlb);
377 }
378 } else {
379 panic("Incompatible TLB type!");
380 }
381}
382
383void
384TLB::serialize(ostream &os)
385{
386 DPRINTF(Checkpoint, "Serializing Arm TLB\n");
387
388 SERIALIZE_SCALAR(_attr);
389 SERIALIZE_SCALAR(haveLPAE);
390 SERIALIZE_SCALAR(directToStage2);
391 SERIALIZE_SCALAR(stage2Req);
392 SERIALIZE_SCALAR(bootUncacheability);
393
394 int num_entries = size;
395 SERIALIZE_SCALAR(num_entries);
396 for(int i = 0; i < size; i++){
397 nameOut(os, csprintf("%s.TlbEntry%d", name(), i));
398 table[i].serialize(os);
399 }
400}
401
402void
403TLB::unserialize(Checkpoint *cp, const string §ion)
404{
405 DPRINTF(Checkpoint, "Unserializing Arm TLB\n");
406
407 UNSERIALIZE_SCALAR(_attr);
408 UNSERIALIZE_SCALAR(haveLPAE);
409 UNSERIALIZE_SCALAR(directToStage2);
410 UNSERIALIZE_SCALAR(stage2Req);
411 UNSERIALIZE_SCALAR(bootUncacheability);
412
413 int num_entries;
414 UNSERIALIZE_SCALAR(num_entries);
415 for(int i = 0; i < min(size, num_entries); i++){
416 table[i].unserialize(cp, csprintf("%s.TlbEntry%d", section, i));
417 }
418}
419
420void
421TLB::regStats()
422{
423 instHits
424 .name(name() + ".inst_hits")
425 .desc("ITB inst hits")
426 ;
427
428 instMisses
429 .name(name() + ".inst_misses")
430 .desc("ITB inst misses")
431 ;
432
433 instAccesses
434 .name(name() + ".inst_accesses")
435 .desc("ITB inst accesses")
436 ;
437
438 readHits
439 .name(name() + ".read_hits")
440 .desc("DTB read hits")
441 ;
442
443 readMisses
444 .name(name() + ".read_misses")
445 .desc("DTB read misses")
446 ;
447
448 readAccesses
449 .name(name() + ".read_accesses")
450 .desc("DTB read accesses")
451 ;
452
453 writeHits
454 .name(name() + ".write_hits")
455 .desc("DTB write hits")
456 ;
457
458 writeMisses
459 .name(name() + ".write_misses")
460 .desc("DTB write misses")
461 ;
462
463 writeAccesses
464 .name(name() + ".write_accesses")
465 .desc("DTB write accesses")
466 ;
467
468 hits
469 .name(name() + ".hits")
470 .desc("DTB hits")
471 ;
472
473 misses
474 .name(name() + ".misses")
475 .desc("DTB misses")
476 ;
477
478 accesses
479 .name(name() + ".accesses")
480 .desc("DTB accesses")
481 ;
482
483 flushTlb
484 .name(name() + ".flush_tlb")
485 .desc("Number of times complete TLB was flushed")
486 ;
487
488 flushTlbMva
489 .name(name() + ".flush_tlb_mva")
490 .desc("Number of times TLB was flushed by MVA")
491 ;
492
493 flushTlbMvaAsid
494 .name(name() + ".flush_tlb_mva_asid")
495 .desc("Number of times TLB was flushed by MVA & ASID")
496 ;
497
498 flushTlbAsid
499 .name(name() + ".flush_tlb_asid")
500 .desc("Number of times TLB was flushed by ASID")
501 ;
502
503 flushedEntries
504 .name(name() + ".flush_entries")
505 .desc("Number of entries that have been flushed from TLB")
506 ;
507
508 alignFaults
509 .name(name() + ".align_faults")
510 .desc("Number of TLB faults due to alignment restrictions")
511 ;
512
513 prefetchFaults
514 .name(name() + ".prefetch_faults")
515 .desc("Number of TLB faults due to prefetch")
516 ;
517
518 domainFaults
519 .name(name() + ".domain_faults")
520 .desc("Number of TLB faults due to domain restrictions")
521 ;
522
523 permsFaults
524 .name(name() + ".perms_faults")
525 .desc("Number of TLB faults due to permissions restrictions")
526 ;
527
528 instAccesses = instHits + instMisses;
529 readAccesses = readHits + readMisses;
530 writeAccesses = writeHits + writeMisses;
531 hits = readHits + writeHits + instHits;
532 misses = readMisses + writeMisses + instMisses;
533 accesses = readAccesses + writeAccesses + instAccesses;
534}
535
536void
537TLB::regProbePoints()
538{
539 ppRefills.reset(new ProbePoints::PMU(getProbeManager(), "Refills"));
540}
541
542Fault
543TLB::translateSe(RequestPtr req, ThreadContext *tc, Mode mode,
544 Translation *translation, bool &delay, bool timing)
545{
546 updateMiscReg(tc);
547 Addr vaddr_tainted = req->getVaddr();
548 Addr vaddr = 0;
549 if (aarch64)
550 vaddr = purifyTaggedAddr(vaddr_tainted, tc, aarch64EL);
551 else
552 vaddr = vaddr_tainted;
553 uint32_t flags = req->getFlags();
554
555 bool is_fetch = (mode == Execute);
556 bool is_write = (mode == Write);
557
558 if (!is_fetch) {
559 assert(flags & MustBeOne);
560 if (sctlr.a || !(flags & AllowUnaligned)) {
561 if (vaddr & mask(flags & AlignmentMask)) {
562 // LPAE is always disabled in SE mode
563 return std::make_shared<DataAbort>(
564 vaddr_tainted,
565 TlbEntry::DomainType::NoAccess, is_write,
566 ArmFault::AlignmentFault, isStage2,
567 ArmFault::VmsaTran);
568 }
569 }
570 }
571
572 Addr paddr;
573 Process *p = tc->getProcessPtr();
574
575 if (!p->pTable->translate(vaddr, paddr))
576 return std::make_shared<GenericPageTableFault>(vaddr_tainted);
577 req->setPaddr(paddr);
578
579 return NoFault;
580}
581
582Fault
583TLB::trickBoxCheck(RequestPtr req, Mode mode, TlbEntry::DomainType domain)
584{
585 return NoFault;
586}
587
588Fault
589TLB::walkTrickBoxCheck(Addr pa, bool is_secure, Addr va, Addr sz, bool is_exec,
590 bool is_write, TlbEntry::DomainType domain, LookupLevel lookup_level)
591{
592 return NoFault;
593}
594
595Fault
596TLB::checkPermissions(TlbEntry *te, RequestPtr req, Mode mode)
597{
598 Addr vaddr = req->getVaddr(); // 32-bit don't have to purify
599 uint32_t flags = req->getFlags();
600 bool is_fetch = (mode == Execute);
601 bool is_write = (mode == Write);
602 bool is_priv = isPriv && !(flags & UserMode);
603
604 // Get the translation type from the actuall table entry
605 ArmFault::TranMethod tranMethod = te->longDescFormat ? ArmFault::LpaeTran
606 : ArmFault::VmsaTran;
607
608 // If this is the second stage of translation and the request is for a
609 // stage 1 page table walk then we need to check the HCR.PTW bit. This
610 // allows us to generate a fault if the request targets an area marked
611 // as a device or strongly ordered.
612 if (isStage2 && req->isPTWalk() && hcr.ptw &&
613 (te->mtype != TlbEntry::MemoryType::Normal)) {
614 return std::make_shared<DataAbort>(
615 vaddr, te->domain, is_write,
616 ArmFault::PermissionLL + te->lookupLevel,
617 isStage2, tranMethod);
618 }
619
620 // Generate an alignment fault for unaligned data accesses to device or
621 // strongly ordered memory
622 if (!is_fetch) {
623 if (te->mtype != TlbEntry::MemoryType::Normal) {
624 if (vaddr & mask(flags & AlignmentMask)) {
625 alignFaults++;
626 return std::make_shared<DataAbort>(
627 vaddr, TlbEntry::DomainType::NoAccess, is_write,
628 ArmFault::AlignmentFault, isStage2,
629 tranMethod);
630 }
631 }
632 }
633
634 if (te->nonCacheable) {
635 // Prevent prefetching from I/O devices.
636 if (req->isPrefetch()) {
637 // Here we can safely use the fault status for the short
638 // desc. format in all cases
639 return std::make_shared<PrefetchAbort>(
640 vaddr, ArmFault::PrefetchUncacheable,
641 isStage2, tranMethod);
642 }
643 }
644
645 if (!te->longDescFormat) {
646 switch ((dacr >> (static_cast<uint8_t>(te->domain) * 2)) & 0x3) {
647 case 0:
648 domainFaults++;
649 DPRINTF(TLB, "TLB Fault: Data abort on domain. DACR: %#x"
650 " domain: %#x write:%d\n", dacr,
651 static_cast<uint8_t>(te->domain), is_write);
652 if (is_fetch)
653 return std::make_shared<PrefetchAbort>(
654 vaddr,
655 ArmFault::DomainLL + te->lookupLevel,
656 isStage2, tranMethod);
657 else
658 return std::make_shared<DataAbort>(
659 vaddr, te->domain, is_write,
660 ArmFault::DomainLL + te->lookupLevel,
661 isStage2, tranMethod);
662 case 1:
663 // Continue with permissions check
664 break;
665 case 2:
666 panic("UNPRED domain\n");
667 case 3:
668 return NoFault;
669 }
670 }
671
672 // The 'ap' variable is AP[2:0] or {AP[2,1],1b'0}, i.e. always three bits
673 uint8_t ap = te->longDescFormat ? te->ap << 1 : te->ap;
674 uint8_t hap = te->hap;
675
676 if (sctlr.afe == 1 || te->longDescFormat)
677 ap |= 1;
678
679 bool abt;
680 bool isWritable = true;
681 // If this is a stage 2 access (eg for reading stage 1 page table entries)
682 // then don't perform the AP permissions check, we stil do the HAP check
683 // below.
684 if (isStage2) {
685 abt = false;
686 } else {
687 switch (ap) {
688 case 0:
689 DPRINTF(TLB, "Access permissions 0, checking rs:%#x\n",
690 (int)sctlr.rs);
691 if (!sctlr.xp) {
692 switch ((int)sctlr.rs) {
693 case 2:
694 abt = is_write;
695 break;
696 case 1:
697 abt = is_write || !is_priv;
698 break;
699 case 0:
700 case 3:
701 default:
702 abt = true;
703 break;
704 }
705 } else {
706 abt = true;
707 }
708 break;
709 case 1:
710 abt = !is_priv;
711 break;
712 case 2:
713 abt = !is_priv && is_write;
714 isWritable = is_priv;
715 break;
716 case 3:
717 abt = false;
718 break;
719 case 4:
720 panic("UNPRED premissions\n");
721 case 5:
722 abt = !is_priv || is_write;
723 isWritable = false;
724 break;
725 case 6:
726 case 7:
727 abt = is_write;
728 isWritable = false;
729 break;
730 default:
731 panic("Unknown permissions %#x\n", ap);
732 }
733 }
734
735 bool hapAbt = is_write ? !(hap & 2) : !(hap & 1);
736 bool xn = te->xn || (isWritable && sctlr.wxn) ||
737 (ap == 3 && sctlr.uwxn && is_priv);
738 if (is_fetch && (abt || xn ||
739 (te->longDescFormat && te->pxn && !is_priv) ||
740 (isSecure && te->ns && scr.sif))) {
741 permsFaults++;
742 DPRINTF(TLB, "TLB Fault: Prefetch abort on permission check. AP:%d "
743 "priv:%d write:%d ns:%d sif:%d sctlr.afe: %d \n",
744 ap, is_priv, is_write, te->ns, scr.sif,sctlr.afe);
745 return std::make_shared<PrefetchAbort>(
746 vaddr,
747 ArmFault::PermissionLL + te->lookupLevel,
748 isStage2, tranMethod);
749 } else if (abt | hapAbt) {
750 permsFaults++;
751 DPRINTF(TLB, "TLB Fault: Data abort on permission check. AP:%d priv:%d"
752 " write:%d\n", ap, is_priv, is_write);
753 return std::make_shared<DataAbort>(
754 vaddr, te->domain, is_write,
755 ArmFault::PermissionLL + te->lookupLevel,
756 isStage2 | !abt, tranMethod);
757 }
758 return NoFault;
759}
760
761
762Fault
763TLB::checkPermissions64(TlbEntry *te, RequestPtr req, Mode mode,
764 ThreadContext *tc)
765{
766 assert(aarch64);
767
768 Addr vaddr_tainted = req->getVaddr();
769 Addr vaddr = purifyTaggedAddr(vaddr_tainted, tc, aarch64EL);
770
771 uint32_t flags = req->getFlags();
772 bool is_fetch = (mode == Execute);
773 bool is_write = (mode == Write);
774 bool is_priv M5_VAR_USED = isPriv && !(flags & UserMode);
775
776 updateMiscReg(tc, curTranType);
777
778 // If this is the second stage of translation and the request is for a
779 // stage 1 page table walk then we need to check the HCR.PTW bit. This
780 // allows us to generate a fault if the request targets an area marked
781 // as a device or strongly ordered.
782 if (isStage2 && req->isPTWalk() && hcr.ptw &&
783 (te->mtype != TlbEntry::MemoryType::Normal)) {
784 return std::make_shared<DataAbort>(
785 vaddr_tainted, te->domain, is_write,
786 ArmFault::PermissionLL + te->lookupLevel,
787 isStage2, ArmFault::LpaeTran);
788 }
789
790 // Generate an alignment fault for unaligned accesses to device or
791 // strongly ordered memory
792 if (!is_fetch) {
793 if (te->mtype != TlbEntry::MemoryType::Normal) {
794 if (vaddr & mask(flags & AlignmentMask)) {
795 alignFaults++;
796 return std::make_shared<DataAbort>(
797 vaddr_tainted,
798 TlbEntry::DomainType::NoAccess, is_write,
799 ArmFault::AlignmentFault, isStage2,
800 ArmFault::LpaeTran);
801 }
802 }
803 }
804
805 if (te->nonCacheable) {
806 // Prevent prefetching from I/O devices.
807 if (req->isPrefetch()) {
808 // Here we can safely use the fault status for the short
809 // desc. format in all cases
810 return std::make_shared<PrefetchAbort>(
811 vaddr_tainted,
812 ArmFault::PrefetchUncacheable,
813 isStage2, ArmFault::LpaeTran);
814 }
815 }
816
817 uint8_t ap = 0x3 & (te->ap); // 2-bit access protection field
818 bool grant = false;
819
820 uint8_t xn = te->xn;
821 uint8_t pxn = te->pxn;
822 bool r = !is_write && !is_fetch;
823 bool w = is_write;
824 bool x = is_fetch;
825 DPRINTF(TLBVerbose, "Checking permissions: ap:%d, xn:%d, pxn:%d, r:%d, "
826 "w:%d, x:%d\n", ap, xn, pxn, r, w, x);
827
828 if (isStage2) {
829 panic("Virtualization in AArch64 state is not supported yet");
830 } else {
831 switch (aarch64EL) {
832 case EL0:
833 {
834 uint8_t perm = (ap << 2) | (xn << 1) | pxn;
835 switch (perm) {
836 case 0:
837 case 1:
838 case 8:
839 case 9:
840 grant = x;
841 break;
842 case 4:
843 case 5:
844 grant = r || w || (x && !sctlr.wxn);
845 break;
846 case 6:
847 case 7:
848 grant = r || w;
849 break;
850 case 12:
851 case 13:
852 grant = r || x;
853 break;
854 case 14:
855 case 15:
856 grant = r;
857 break;
858 default:
859 grant = false;
860 }
861 }
862 break;
863 case EL1:
864 {
865 uint8_t perm = (ap << 2) | (xn << 1) | pxn;
866 switch (perm) {
867 case 0:
868 case 2:
869 grant = r || w || (x && !sctlr.wxn);
870 break;
871 case 1:
872 case 3:
873 case 4:
874 case 5:
875 case 6:
876 case 7:
877 // regions that are writeable at EL0 should not be
878 // executable at EL1
879 grant = r || w;
880 break;
881 case 8:
882 case 10:
883 case 12:
884 case 14:
885 grant = r || x;
886 break;
887 case 9:
888 case 11:
889 case 13:
890 case 15:
891 grant = r;
892 break;
893 default:
894 grant = false;
895 }
896 }
897 break;
898 case EL2:
899 case EL3:
900 {
901 uint8_t perm = (ap & 0x2) | xn;
902 switch (perm) {
903 case 0:
904 grant = r || w || (x && !sctlr.wxn) ;
905 break;
906 case 1:
907 grant = r || w;
908 break;
909 case 2:
910 grant = r || x;
911 break;
912 case 3:
913 grant = r;
914 break;
915 default:
916 grant = false;
917 }
918 }
919 break;
920 }
921 }
922
923 if (!grant) {
924 if (is_fetch) {
925 permsFaults++;
926 DPRINTF(TLB, "TLB Fault: Prefetch abort on permission check. "
927 "AP:%d priv:%d write:%d ns:%d sif:%d "
928 "sctlr.afe: %d\n",
929 ap, is_priv, is_write, te->ns, scr.sif, sctlr.afe);
930 // Use PC value instead of vaddr because vaddr might be aligned to
931 // cache line and should not be the address reported in FAR
932 return std::make_shared<PrefetchAbort>(
933 req->getPC(),
934 ArmFault::PermissionLL + te->lookupLevel,
935 isStage2, ArmFault::LpaeTran);
936 } else {
937 permsFaults++;
938 DPRINTF(TLB, "TLB Fault: Data abort on permission check. AP:%d "
939 "priv:%d write:%d\n", ap, is_priv, is_write);
940 return std::make_shared<DataAbort>(
941 vaddr_tainted, te->domain, is_write,
942 ArmFault::PermissionLL + te->lookupLevel,
943 isStage2, ArmFault::LpaeTran);
944 }
945 }
946
947 return NoFault;
948}
949
950Fault
951TLB::translateFs(RequestPtr req, ThreadContext *tc, Mode mode,
952 Translation *translation, bool &delay, bool timing,
953 TLB::ArmTranslationType tranType, bool functional)
954{
955 // No such thing as a functional timing access
956 assert(!(timing && functional));
957
958 updateMiscReg(tc, tranType);
959
960 Addr vaddr_tainted = req->getVaddr();
961 Addr vaddr = 0;
962 if (aarch64)
963 vaddr = purifyTaggedAddr(vaddr_tainted, tc, aarch64EL);
964 else
965 vaddr = vaddr_tainted;
966 uint32_t flags = req->getFlags();
967
968 bool is_fetch = (mode == Execute);
969 bool is_write = (mode == Write);
970 bool long_desc_format = aarch64 || (haveLPAE && ttbcr.eae);
971 ArmFault::TranMethod tranMethod = long_desc_format ? ArmFault::LpaeTran
972 : ArmFault::VmsaTran;
973
974 req->setAsid(asid);
975
976 DPRINTF(TLBVerbose, "CPSR is priv:%d UserMode:%d secure:%d S1S2NsTran:%d\n",
977 isPriv, flags & UserMode, isSecure, tranType & S1S2NsTran);
978
979 DPRINTF(TLB, "translateFs addr %#x, mode %d, st2 %d, scr %#x sctlr %#x "
980 "flags %#x tranType 0x%x\n", vaddr_tainted, mode, isStage2,
981 scr, sctlr, flags, tranType);
982
983 // Generate an alignment fault for unaligned PC
984 if (aarch64 && is_fetch && (req->getPC() & mask(2))) {
985 return std::make_shared<PCAlignmentFault>(req->getPC());
986 }
987
988 // If this is a clrex instruction, provide a PA of 0 with no fault
989 // This will force the monitor to set the tracked address to 0
990 // a bit of a hack but this effectively clrears this processors monitor
991 if (flags & Request::CLEAR_LL){
992 // @todo: check implications of security extensions
993 req->setPaddr(0);
994 req->setFlags(Request::UNCACHEABLE);
995 req->setFlags(Request::CLEAR_LL);
996 return NoFault;
997 }
998 if ((req->isInstFetch() && (!sctlr.i)) ||
999 ((!req->isInstFetch()) && (!sctlr.c))){
1000 req->setFlags(Request::UNCACHEABLE);
1001 }
1002 if (!is_fetch) {
1003 assert(flags & MustBeOne);
1004 if (sctlr.a || !(flags & AllowUnaligned)) {
1005 if (vaddr & mask(flags & AlignmentMask)) {
1006 alignFaults++;
1007 return std::make_shared<DataAbort>(
1008 vaddr_tainted,
1009 TlbEntry::DomainType::NoAccess, is_write,
1010 ArmFault::AlignmentFault, isStage2,
1011 tranMethod);
1012 }
1013 }
1014 }
1015
1016 // If guest MMU is off or hcr.vm=0 go straight to stage2
1017 if ((isStage2 && !hcr.vm) || (!isStage2 && !sctlr.m)) {
1018
1019 req->setPaddr(vaddr);
1020 // When the MMU is off the security attribute corresponds to the
1021 // security state of the processor
1022 if (isSecure)
1023 req->setFlags(Request::SECURE);
1024
1025 // @todo: double check this (ARM ARM issue C B3.2.1)
1026 if (long_desc_format || sctlr.tre == 0) {
1027 req->setFlags(Request::UNCACHEABLE);
1028 } else {
1029 if (nmrr.ir0 == 0 || nmrr.or0 == 0 || prrr.tr0 != 0x2)
1030 req->setFlags(Request::UNCACHEABLE);
1031 }
1032
1033 // Set memory attributes
1034 TlbEntry temp_te;
1035 temp_te.ns = !isSecure;
1036 if (isStage2 || hcr.dc == 0 || isSecure ||
1037 (isHyp && !(tranType & S1CTran))) {
1038
1039 temp_te.mtype = is_fetch ? TlbEntry::MemoryType::Normal
1040 : TlbEntry::MemoryType::StronglyOrdered;
1041 temp_te.innerAttrs = 0x0;
1042 temp_te.outerAttrs = 0x0;
1043 temp_te.shareable = true;
1044 temp_te.outerShareable = true;
1045 } else {
1046 temp_te.mtype = TlbEntry::MemoryType::Normal;
1047 temp_te.innerAttrs = 0x3;
1048 temp_te.outerAttrs = 0x3;
1049 temp_te.shareable = false;
1050 temp_te.outerShareable = false;
1051 }
1052 temp_te.setAttributes(long_desc_format);
1053 DPRINTF(TLBVerbose, "(No MMU) setting memory attributes: shareable: "
1054 "%d, innerAttrs: %d, outerAttrs: %d, isStage2: %d\n",
1055 temp_te.shareable, temp_te.innerAttrs, temp_te.outerAttrs,
1056 isStage2);
1057 setAttr(temp_te.attributes);
1058
1059 return trickBoxCheck(req, mode, TlbEntry::DomainType::NoAccess);
1060 }
1061
1062 DPRINTF(TLBVerbose, "Translating %s=%#x context=%d\n",
1063 isStage2 ? "IPA" : "VA", vaddr_tainted, asid);
1064 // Translation enabled
1065
1066 TlbEntry *te = NULL;
1067 TlbEntry mergeTe;
1068 Fault fault = getResultTe(&te, req, tc, mode, translation, timing,
1069 functional, &mergeTe);
1070 // only proceed if we have a valid table entry
1071 if ((te == NULL) && (fault == NoFault)) delay = true;
1072
1073 // If we have the table entry transfer some of the attributes to the
1074 // request that triggered the translation
1075 if (te != NULL) {
1076 // Set memory attributes
1077 DPRINTF(TLBVerbose,
1078 "Setting memory attributes: shareable: %d, innerAttrs: %d, "
1079 "outerAttrs: %d, mtype: %d, isStage2: %d\n",
1080 te->shareable, te->innerAttrs, te->outerAttrs,
1081 static_cast<uint8_t>(te->mtype), isStage2);
1082 setAttr(te->attributes);
1083 if (te->nonCacheable) {
1084 req->setFlags(Request::UNCACHEABLE);
1085 }
1086
1087 if (!bootUncacheability &&
1088 ((ArmSystem*)tc->getSystemPtr())->adderBootUncacheable(vaddr)) {
1089 req->setFlags(Request::UNCACHEABLE);
1090 }
1091
1092 Addr pa = te->pAddr(vaddr);
1093 req->setPaddr(pa);
1094
1095 if (!bootUncacheability &&
1096 ((ArmSystem*)tc->getSystemPtr())->adderBootUncacheable(pa)) {
1097 req->setFlags(Request::UNCACHEABLE);
1098 }
1099
1100 if (isSecure && !te->ns) {
1101 req->setFlags(Request::SECURE);
1102 }
1103 if ((!is_fetch) && (vaddr & mask(flags & AlignmentMask)) &&
1104 (te->mtype != TlbEntry::MemoryType::Normal)) {
1105 // Unaligned accesses to Device memory should always cause an
1106 // abort regardless of sctlr.a
1107 alignFaults++;
1108 return std::make_shared<DataAbort>(
1109 vaddr_tainted,
1110 TlbEntry::DomainType::NoAccess, is_write,
1111 ArmFault::AlignmentFault, isStage2,
1112 tranMethod);
1113 }
1114
1115 // Check for a trickbox generated address fault
1116 if (fault == NoFault) {
1117 fault = trickBoxCheck(req, mode, te->domain);
1118 }
1119 }
1120
1121 // Generate Illegal Inst Set State fault if IL bit is set in CPSR
1122 if (fault == NoFault) {
1123 CPSR cpsr = tc->readMiscReg(MISCREG_CPSR);
1124 if (aarch64 && is_fetch && cpsr.il == 1) {
1125 return std::make_shared<IllegalInstSetStateFault>();
1126 }
1127 }
1128
1129 return fault;
1130}
1131
1132Fault
1133TLB::translateAtomic(RequestPtr req, ThreadContext *tc, Mode mode,
1134 TLB::ArmTranslationType tranType)
1135{
1136 updateMiscReg(tc, tranType);
1137
1138 if (directToStage2) {
1139 assert(stage2Tlb);
1140 return stage2Tlb->translateAtomic(req, tc, mode, tranType);
1141 }
1142
1143 bool delay = false;
1144 Fault fault;
1145 if (FullSystem)
1146 fault = translateFs(req, tc, mode, NULL, delay, false, tranType);
1147 else
1148 fault = translateSe(req, tc, mode, NULL, delay, false);
1149 assert(!delay);
1150 return fault;
1151}
1152
1153Fault
1154TLB::translateFunctional(RequestPtr req, ThreadContext *tc, Mode mode,
1155 TLB::ArmTranslationType tranType)
1156{
1157 updateMiscReg(tc, tranType);
1158
1159 if (directToStage2) {
1160 assert(stage2Tlb);
1161 return stage2Tlb->translateFunctional(req, tc, mode, tranType);
1162 }
1163
1164 bool delay = false;
1165 Fault fault;
1166 if (FullSystem)
1167 fault = translateFs(req, tc, mode, NULL, delay, false, tranType, true);
1168 else
1169 fault = translateSe(req, tc, mode, NULL, delay, false);
1170 assert(!delay);
1171 return fault;
1172}
1173
1174Fault
1175TLB::translateTiming(RequestPtr req, ThreadContext *tc,
1176 Translation *translation, Mode mode, TLB::ArmTranslationType tranType)
1177{
1178 updateMiscReg(tc, tranType);
1179
1180 if (directToStage2) {
1181 assert(stage2Tlb);
1182 return stage2Tlb->translateTiming(req, tc, translation, mode, tranType);
1183 }
1184
1185 assert(translation);
1186
1187 return translateComplete(req, tc, translation, mode, tranType, isStage2);
1188}
1189
1190Fault
1191TLB::translateComplete(RequestPtr req, ThreadContext *tc,
1192 Translation *translation, Mode mode, TLB::ArmTranslationType tranType,
1193 bool callFromS2)
1194{
1195 bool delay = false;
1196 Fault fault;
1197 if (FullSystem)
1198 fault = translateFs(req, tc, mode, translation, delay, true, tranType);
1199 else
1200 fault = translateSe(req, tc, mode, translation, delay, true);
1201 DPRINTF(TLBVerbose, "Translation returning delay=%d fault=%d\n", delay, fault !=
1202 NoFault);
1203 // If we have a translation, and we're not in the middle of doing a stage
1204 // 2 translation tell the translation that we've either finished or its
1205 // going to take a while. By not doing this when we're in the middle of a
1206 // stage 2 translation we prevent marking the translation as delayed twice,
1207 // one when the translation starts and again when the stage 1 translation
1208 // completes.
1209 if (translation && (callFromS2 || !stage2Req || req->hasPaddr() || fault != NoFault)) {
1210 if (!delay)
1211 translation->finish(fault, req, tc, mode);
1212 else
1213 translation->markDelayed();
1214 }
1215 return fault;
1216}
1217
1218BaseMasterPort*
1219TLB::getMasterPort()
1220{
1221 return &tableWalker->getMasterPort("port");
1222}
1223
1224DmaPort&
1225TLB::getWalkerPort()
1226{
1227 return tableWalker->getWalkerPort();
1228}
1229
1230void
1231TLB::updateMiscReg(ThreadContext *tc, ArmTranslationType tranType)
1232{
1233 // check if the regs have changed, or the translation mode is different.
1234 // NOTE: the tran type doesn't affect stage 2 TLB's as they only handle
1235 // one type of translation anyway
1236 if (miscRegValid && ((tranType == curTranType) || isStage2)) {
1237 return;
1238 }
1239
1240 DPRINTF(TLBVerbose, "TLB variables changed!\n");
1241 CPSR cpsr = tc->readMiscReg(MISCREG_CPSR);
1242 // Dependencies: SCR/SCR_EL3, CPSR
1243 isSecure = inSecureState(tc);
1244 isSecure &= (tranType & HypMode) == 0;
1245 isSecure &= (tranType & S1S2NsTran) == 0;
1246 aarch64 = !cpsr.width;
1247 if (aarch64) { // AArch64
1248 aarch64EL = (ExceptionLevel) (uint8_t) cpsr.el;
1249 switch (aarch64EL) {
1250 case EL0:
1251 case EL1:
1252 {
1253 sctlr = tc->readMiscReg(MISCREG_SCTLR_EL1);
1254 ttbcr = tc->readMiscReg(MISCREG_TCR_EL1);
1255 uint64_t ttbr_asid = ttbcr.a1 ?
1256 tc->readMiscReg(MISCREG_TTBR1_EL1) :
1257 tc->readMiscReg(MISCREG_TTBR0_EL1);
1258 asid = bits(ttbr_asid,
1259 (haveLargeAsid64 && ttbcr.as) ? 63 : 55, 48);
1260 }
1261 break;
1262 case EL2:
1263 sctlr = tc->readMiscReg(MISCREG_SCTLR_EL2);
1264 ttbcr = tc->readMiscReg(MISCREG_TCR_EL2);
1265 asid = -1;
1266 break;
1267 case EL3:
1268 sctlr = tc->readMiscReg(MISCREG_SCTLR_EL3);
1269 ttbcr = tc->readMiscReg(MISCREG_TCR_EL3);
1270 asid = -1;
1271 break;
1272 }
1273 scr = tc->readMiscReg(MISCREG_SCR_EL3);
1274 isPriv = aarch64EL != EL0;
1275 // @todo: modify this behaviour to support Virtualization in
1276 // AArch64
1277 vmid = 0;
1278 isHyp = false;
1279 directToStage2 = false;
1280 stage2Req = false;
1281 } else { // AArch32
1282 sctlr = tc->readMiscReg(flattenMiscRegNsBanked(MISCREG_SCTLR, tc,
1283 !isSecure));
1284 ttbcr = tc->readMiscReg(flattenMiscRegNsBanked(MISCREG_TTBCR, tc,
1285 !isSecure));
1286 scr = tc->readMiscReg(MISCREG_SCR);
1287 isPriv = cpsr.mode != MODE_USER;
1288 if (haveLPAE && ttbcr.eae) {
1289 // Long-descriptor translation table format in use
1290 uint64_t ttbr_asid = tc->readMiscReg(
1291 flattenMiscRegNsBanked(ttbcr.a1 ? MISCREG_TTBR1
1292 : MISCREG_TTBR0,
1293 tc, !isSecure));
1294 asid = bits(ttbr_asid, 55, 48);
1295 } else {
1296 // Short-descriptor translation table format in use
1297 CONTEXTIDR context_id = tc->readMiscReg(flattenMiscRegNsBanked(
1298 MISCREG_CONTEXTIDR, tc,!isSecure));
1299 asid = context_id.asid;
1300 }
1301 prrr = tc->readMiscReg(flattenMiscRegNsBanked(MISCREG_PRRR, tc,
1302 !isSecure));
1303 nmrr = tc->readMiscReg(flattenMiscRegNsBanked(MISCREG_NMRR, tc,
1304 !isSecure));
1305 dacr = tc->readMiscReg(flattenMiscRegNsBanked(MISCREG_DACR, tc,
1306 !isSecure));
1307 hcr = tc->readMiscReg(MISCREG_HCR);
1308
1309 if (haveVirtualization) {
1310 vmid = bits(tc->readMiscReg(MISCREG_VTTBR), 55, 48);
1311 isHyp = cpsr.mode == MODE_HYP;
1312 isHyp |= tranType & HypMode;
1313 isHyp &= (tranType & S1S2NsTran) == 0;
1314 isHyp &= (tranType & S1CTran) == 0;
1315 if (isHyp) {
1316 sctlr = tc->readMiscReg(MISCREG_HSCTLR);
1317 }
1318 // Work out if we should skip the first stage of translation and go
1319 // directly to stage 2. This value is cached so we don't have to
1320 // compute it for every translation.
1321 stage2Req = hcr.vm && !isStage2 && !isHyp && !isSecure &&
1322 !(tranType & S1CTran);
1323 directToStage2 = stage2Req && !sctlr.m;
1324 } else {
1325 vmid = 0;
1326 stage2Req = false;
1327 isHyp = false;
1328 directToStage2 = false;
1329 }
1330 }
1331 miscRegValid = true;
1332 curTranType = tranType;
1333}
1334
1335Fault
1336TLB::getTE(TlbEntry **te, RequestPtr req, ThreadContext *tc, Mode mode,
1337 Translation *translation, bool timing, bool functional,
1338 bool is_secure, TLB::ArmTranslationType tranType)
1339{
1340 bool is_fetch = (mode == Execute);
1341 bool is_write = (mode == Write);
1342
1343 Addr vaddr_tainted = req->getVaddr();
1344 Addr vaddr = 0;
1345 ExceptionLevel target_el = aarch64 ? aarch64EL : EL1;
1346 if (aarch64) {
1347 vaddr = purifyTaggedAddr(vaddr_tainted, tc, target_el);
1348 } else {
1349 vaddr = vaddr_tainted;
1350 }
1351 *te = lookup(vaddr, asid, vmid, isHyp, is_secure, false, false, target_el);
1352 if (*te == NULL) {
1353 if (req->isPrefetch()) {
1354 // if the request is a prefetch don't attempt to fill the TLB or go
1355 // any further with the memory access (here we can safely use the
1356 // fault status for the short desc. format in all cases)
1357 prefetchFaults++;
1358 return std::make_shared<PrefetchAbort>(
1359 vaddr_tainted, ArmFault::PrefetchTLBMiss, isStage2);
1360 }
1361
1362 if (is_fetch)
1363 instMisses++;
1364 else if (is_write)
1365 writeMisses++;
1366 else
1367 readMisses++;
1368
1369 // start translation table walk, pass variables rather than
1370 // re-retreaving in table walker for speed
1371 DPRINTF(TLB, "TLB Miss: Starting hardware table walker for %#x(%d:%d)\n",
1372 vaddr_tainted, asid, vmid);
1373 Fault fault;
1374 fault = tableWalker->walk(req, tc, asid, vmid, isHyp, mode,
1375 translation, timing, functional, is_secure,
1376 tranType);
1377 // for timing mode, return and wait for table walk,
1378 if (timing || fault != NoFault) {
1379 return fault;
1380 }
1381
1382 *te = lookup(vaddr, asid, vmid, isHyp, is_secure, false, false, target_el);
1383 if (!*te)
1384 printTlb();
1385 assert(*te);
1386 } else {
1387 if (is_fetch)
1388 instHits++;
1389 else if (is_write)
1390 writeHits++;
1391 else
1392 readHits++;
1393 }
1394 return NoFault;
1395}
1396
1397Fault
1398TLB::getResultTe(TlbEntry **te, RequestPtr req, ThreadContext *tc, Mode mode,
1399 Translation *translation, bool timing, bool functional,
1400 TlbEntry *mergeTe)
1401{
1402 Fault fault;
1403 TlbEntry *s1Te = NULL;
1404
1405 Addr vaddr_tainted = req->getVaddr();
1406
1407 // Get the stage 1 table entry
1408 fault = getTE(&s1Te, req, tc, mode, translation, timing, functional,
1409 isSecure, curTranType);
1410 // only proceed if we have a valid table entry
1411 if ((s1Te != NULL) && (fault == NoFault)) {
1412 // Check stage 1 permissions before checking stage 2
1413 if (aarch64)
1414 fault = checkPermissions64(s1Te, req, mode, tc);
1415 else
1416 fault = checkPermissions(s1Te, req, mode);
1417 if (stage2Req & (fault == NoFault)) {
1418 Stage2LookUp *s2Lookup = new Stage2LookUp(this, stage2Tlb, *s1Te,
1419 req, translation, mode, timing, functional, curTranType);
1420 fault = s2Lookup->getTe(tc, mergeTe);
1421 if (s2Lookup->isComplete()) {
1422 *te = mergeTe;
1423 // We've finished with the lookup so delete it
1424 delete s2Lookup;
1425 } else {
1426 // The lookup hasn't completed, so we can't delete it now. We
1427 // get round this by asking the object to self delete when the
1428 // translation is complete.
1429 s2Lookup->setSelfDelete();
1430 }
1431 } else {
1432 // This case deals with an S1 hit (or bypass), followed by
1433 // an S2 hit-but-perms issue
1434 if (isStage2) {
1435 DPRINTF(TLBVerbose, "s2TLB: reqVa %#x, reqPa %#x, fault %p\n",
1436 vaddr_tainted, req->hasPaddr() ? req->getPaddr() : ~0, fault);
1437 if (fault != NoFault) {
1438 ArmFault *armFault = reinterpret_cast<ArmFault *>(fault.get());
1439 armFault->annotate(ArmFault::S1PTW, false);
1440 armFault->annotate(ArmFault::OVA, vaddr_tainted);
1441 }
1442 }
1443 *te = s1Te;
1444 }
1445 }
1446 return fault;
1447}
1448
1449ArmISA::TLB *
1450ArmTLBParams::create()
1451{
1452 return new ArmISA::TLB(this);
1453}
| 80 miscRegValid(false), curTranType(NormalTran)
81{
82 tableWalker->setTlb(this);
83
84 // Cache system-level properties
85 haveLPAE = tableWalker->haveLPAE();
86 haveVirtualization = tableWalker->haveVirtualization();
87 haveLargeAsid64 = tableWalker->haveLargeAsid64();
88}
89
90TLB::~TLB()
91{
92 delete[] table;
93}
94
95void
96TLB::init()
97{
98 if (stage2Mmu && !isStage2)
99 stage2Tlb = stage2Mmu->stage2Tlb();
100}
101
102void
103TLB::setMMU(Stage2MMU *m)
104{
105 stage2Mmu = m;
106 tableWalker->setMMU(m);
107}
108
109bool
110TLB::translateFunctional(ThreadContext *tc, Addr va, Addr &pa)
111{
112 updateMiscReg(tc);
113
114 if (directToStage2) {
115 assert(stage2Tlb);
116 return stage2Tlb->translateFunctional(tc, va, pa);
117 }
118
119 TlbEntry *e = lookup(va, asid, vmid, isHyp, isSecure, true, false,
120 aarch64 ? aarch64EL : EL1);
121 if (!e)
122 return false;
123 pa = e->pAddr(va);
124 return true;
125}
126
127Fault
128TLB::finalizePhysical(RequestPtr req, ThreadContext *tc, Mode mode) const
129{
130 return NoFault;
131}
132
133TlbEntry*
134TLB::lookup(Addr va, uint16_t asn, uint8_t vmid, bool hyp, bool secure,
135 bool functional, bool ignore_asn, uint8_t target_el)
136{
137
138 TlbEntry *retval = NULL;
139
140 // Maintaining LRU array
141 int x = 0;
142 while (retval == NULL && x < size) {
143 if ((!ignore_asn && table[x].match(va, asn, vmid, hyp, secure, false,
144 target_el)) ||
145 (ignore_asn && table[x].match(va, vmid, hyp, secure, target_el))) {
146 // We only move the hit entry ahead when the position is higher
147 // than rangeMRU
148 if (x > rangeMRU && !functional) {
149 TlbEntry tmp_entry = table[x];
150 for(int i = x; i > 0; i--)
151 table[i] = table[i - 1];
152 table[0] = tmp_entry;
153 retval = &table[0];
154 } else {
155 retval = &table[x];
156 }
157 break;
158 }
159 ++x;
160 }
161
162 DPRINTF(TLBVerbose, "Lookup %#x, asn %#x -> %s vmn 0x%x hyp %d secure %d "
163 "ppn %#x size: %#x pa: %#x ap:%d ns:%d nstid:%d g:%d asid: %d "
164 "el: %d\n",
165 va, asn, retval ? "hit" : "miss", vmid, hyp, secure,
166 retval ? retval->pfn : 0, retval ? retval->size : 0,
167 retval ? retval->pAddr(va) : 0, retval ? retval->ap : 0,
168 retval ? retval->ns : 0, retval ? retval->nstid : 0,
169 retval ? retval->global : 0, retval ? retval->asid : 0,
170 retval ? retval->el : 0);
171
172 return retval;
173}
174
175// insert a new TLB entry
176void
177TLB::insert(Addr addr, TlbEntry &entry)
178{
179 DPRINTF(TLB, "Inserting entry into TLB with pfn:%#x size:%#x vpn: %#x"
180 " asid:%d vmid:%d N:%d global:%d valid:%d nc:%d xn:%d"
181 " ap:%#x domain:%#x ns:%d nstid:%d isHyp:%d\n", entry.pfn,
182 entry.size, entry.vpn, entry.asid, entry.vmid, entry.N,
183 entry.global, entry.valid, entry.nonCacheable, entry.xn,
184 entry.ap, static_cast<uint8_t>(entry.domain), entry.ns, entry.nstid,
185 entry.isHyp);
186
187 if (table[size - 1].valid)
188 DPRINTF(TLB, " - Replacing Valid entry %#x, asn %d vmn %d ppn %#x "
189 "size: %#x ap:%d ns:%d nstid:%d g:%d isHyp:%d el: %d\n",
190 table[size-1].vpn << table[size-1].N, table[size-1].asid,
191 table[size-1].vmid, table[size-1].pfn << table[size-1].N,
192 table[size-1].size, table[size-1].ap, table[size-1].ns,
193 table[size-1].nstid, table[size-1].global, table[size-1].isHyp,
194 table[size-1].el);
195
196 //inserting to MRU position and evicting the LRU one
197
198 for (int i = size - 1; i > 0; --i)
199 table[i] = table[i-1];
200 table[0] = entry;
201
202 inserts++;
203 ppRefills->notify(1);
204}
205
206void
207TLB::printTlb() const
208{
209 int x = 0;
210 TlbEntry *te;
211 DPRINTF(TLB, "Current TLB contents:\n");
212 while (x < size) {
213 te = &table[x];
214 if (te->valid)
215 DPRINTF(TLB, " * %s\n", te->print());
216 ++x;
217 }
218}
219
220void
221TLB::flushAllSecurity(bool secure_lookup, uint8_t target_el, bool ignore_el)
222{
223 DPRINTF(TLB, "Flushing all TLB entries (%s lookup)\n",
224 (secure_lookup ? "secure" : "non-secure"));
225 int x = 0;
226 TlbEntry *te;
227 while (x < size) {
228 te = &table[x];
229 if (te->valid && secure_lookup == !te->nstid &&
230 (te->vmid == vmid || secure_lookup) &&
231 checkELMatch(target_el, te->el, ignore_el)) {
232
233 DPRINTF(TLB, " - %s\n", te->print());
234 te->valid = false;
235 flushedEntries++;
236 }
237 ++x;
238 }
239
240 flushTlb++;
241
242 // If there's a second stage TLB (and we're not it) then flush it as well
243 // if we're currently in hyp mode
244 if (!isStage2 && isHyp) {
245 stage2Tlb->flushAllSecurity(secure_lookup, true);
246 }
247}
248
249void
250TLB::flushAllNs(bool hyp, uint8_t target_el, bool ignore_el)
251{
252 DPRINTF(TLB, "Flushing all NS TLB entries (%s lookup)\n",
253 (hyp ? "hyp" : "non-hyp"));
254 int x = 0;
255 TlbEntry *te;
256 while (x < size) {
257 te = &table[x];
258 if (te->valid && te->nstid && te->isHyp == hyp &&
259 checkELMatch(target_el, te->el, ignore_el)) {
260
261 DPRINTF(TLB, " - %s\n", te->print());
262 flushedEntries++;
263 te->valid = false;
264 }
265 ++x;
266 }
267
268 flushTlb++;
269
270 // If there's a second stage TLB (and we're not it) then flush it as well
271 if (!isStage2 && !hyp) {
272 stage2Tlb->flushAllNs(false, true);
273 }
274}
275
276void
277TLB::flushMvaAsid(Addr mva, uint64_t asn, bool secure_lookup, uint8_t target_el)
278{
279 DPRINTF(TLB, "Flushing TLB entries with mva: %#x, asid: %#x "
280 "(%s lookup)\n", mva, asn, (secure_lookup ?
281 "secure" : "non-secure"));
282 _flushMva(mva, asn, secure_lookup, false, false, target_el);
283 flushTlbMvaAsid++;
284}
285
286void
287TLB::flushAsid(uint64_t asn, bool secure_lookup, uint8_t target_el)
288{
289 DPRINTF(TLB, "Flushing TLB entries with asid: %#x (%s lookup)\n", asn,
290 (secure_lookup ? "secure" : "non-secure"));
291
292 int x = 0 ;
293 TlbEntry *te;
294
295 while (x < size) {
296 te = &table[x];
297 if (te->valid && te->asid == asn && secure_lookup == !te->nstid &&
298 (te->vmid == vmid || secure_lookup) &&
299 checkELMatch(target_el, te->el, false)) {
300
301 te->valid = false;
302 DPRINTF(TLB, " - %s\n", te->print());
303 flushedEntries++;
304 }
305 ++x;
306 }
307 flushTlbAsid++;
308}
309
310void
311TLB::flushMva(Addr mva, bool secure_lookup, bool hyp, uint8_t target_el)
312{
313 DPRINTF(TLB, "Flushing TLB entries with mva: %#x (%s lookup)\n", mva,
314 (secure_lookup ? "secure" : "non-secure"));
315 _flushMva(mva, 0xbeef, secure_lookup, hyp, true, target_el);
316 flushTlbMva++;
317}
318
319void
320TLB::_flushMva(Addr mva, uint64_t asn, bool secure_lookup, bool hyp,
321 bool ignore_asn, uint8_t target_el)
322{
323 TlbEntry *te;
324 // D5.7.2: Sign-extend address to 64 bits
325 mva = sext<56>(mva);
326 te = lookup(mva, asn, vmid, hyp, secure_lookup, false, ignore_asn,
327 target_el);
328 while (te != NULL) {
329 if (secure_lookup == !te->nstid) {
330 DPRINTF(TLB, " - %s\n", te->print());
331 te->valid = false;
332 flushedEntries++;
333 }
334 te = lookup(mva, asn, vmid, hyp, secure_lookup, false, ignore_asn,
335 target_el);
336 }
337}
338
339bool
340TLB::checkELMatch(uint8_t target_el, uint8_t tentry_el, bool ignore_el)
341{
342 bool elMatch = true;
343 if (!ignore_el) {
344 if (target_el == 2 || target_el == 3) {
345 elMatch = (tentry_el == target_el);
346 } else {
347 elMatch = (tentry_el == 0) || (tentry_el == 1);
348 }
349 }
350 return elMatch;
351}
352
353void
354TLB::drainResume()
355{
356 // We might have unserialized something or switched CPUs, so make
357 // sure to re-read the misc regs.
358 miscRegValid = false;
359}
360
361void
362TLB::takeOverFrom(BaseTLB *_otlb)
363{
364 TLB *otlb = dynamic_cast<TLB*>(_otlb);
365 /* Make sure we actually have a valid type */
366 if (otlb) {
367 _attr = otlb->_attr;
368 haveLPAE = otlb->haveLPAE;
369 directToStage2 = otlb->directToStage2;
370 stage2Req = otlb->stage2Req;
371 bootUncacheability = otlb->bootUncacheability;
372
373 /* Sync the stage2 MMU if they exist in both
374 * the old CPU and the new
375 */
376 if (!isStage2 &&
377 stage2Tlb && otlb->stage2Tlb) {
378 stage2Tlb->takeOverFrom(otlb->stage2Tlb);
379 }
380 } else {
381 panic("Incompatible TLB type!");
382 }
383}
384
385void
386TLB::serialize(ostream &os)
387{
388 DPRINTF(Checkpoint, "Serializing Arm TLB\n");
389
390 SERIALIZE_SCALAR(_attr);
391 SERIALIZE_SCALAR(haveLPAE);
392 SERIALIZE_SCALAR(directToStage2);
393 SERIALIZE_SCALAR(stage2Req);
394 SERIALIZE_SCALAR(bootUncacheability);
395
396 int num_entries = size;
397 SERIALIZE_SCALAR(num_entries);
398 for(int i = 0; i < size; i++){
399 nameOut(os, csprintf("%s.TlbEntry%d", name(), i));
400 table[i].serialize(os);
401 }
402}
403
404void
405TLB::unserialize(Checkpoint *cp, const string §ion)
406{
407 DPRINTF(Checkpoint, "Unserializing Arm TLB\n");
408
409 UNSERIALIZE_SCALAR(_attr);
410 UNSERIALIZE_SCALAR(haveLPAE);
411 UNSERIALIZE_SCALAR(directToStage2);
412 UNSERIALIZE_SCALAR(stage2Req);
413 UNSERIALIZE_SCALAR(bootUncacheability);
414
415 int num_entries;
416 UNSERIALIZE_SCALAR(num_entries);
417 for(int i = 0; i < min(size, num_entries); i++){
418 table[i].unserialize(cp, csprintf("%s.TlbEntry%d", section, i));
419 }
420}
421
422void
423TLB::regStats()
424{
425 instHits
426 .name(name() + ".inst_hits")
427 .desc("ITB inst hits")
428 ;
429
430 instMisses
431 .name(name() + ".inst_misses")
432 .desc("ITB inst misses")
433 ;
434
435 instAccesses
436 .name(name() + ".inst_accesses")
437 .desc("ITB inst accesses")
438 ;
439
440 readHits
441 .name(name() + ".read_hits")
442 .desc("DTB read hits")
443 ;
444
445 readMisses
446 .name(name() + ".read_misses")
447 .desc("DTB read misses")
448 ;
449
450 readAccesses
451 .name(name() + ".read_accesses")
452 .desc("DTB read accesses")
453 ;
454
455 writeHits
456 .name(name() + ".write_hits")
457 .desc("DTB write hits")
458 ;
459
460 writeMisses
461 .name(name() + ".write_misses")
462 .desc("DTB write misses")
463 ;
464
465 writeAccesses
466 .name(name() + ".write_accesses")
467 .desc("DTB write accesses")
468 ;
469
470 hits
471 .name(name() + ".hits")
472 .desc("DTB hits")
473 ;
474
475 misses
476 .name(name() + ".misses")
477 .desc("DTB misses")
478 ;
479
480 accesses
481 .name(name() + ".accesses")
482 .desc("DTB accesses")
483 ;
484
485 flushTlb
486 .name(name() + ".flush_tlb")
487 .desc("Number of times complete TLB was flushed")
488 ;
489
490 flushTlbMva
491 .name(name() + ".flush_tlb_mva")
492 .desc("Number of times TLB was flushed by MVA")
493 ;
494
495 flushTlbMvaAsid
496 .name(name() + ".flush_tlb_mva_asid")
497 .desc("Number of times TLB was flushed by MVA & ASID")
498 ;
499
500 flushTlbAsid
501 .name(name() + ".flush_tlb_asid")
502 .desc("Number of times TLB was flushed by ASID")
503 ;
504
505 flushedEntries
506 .name(name() + ".flush_entries")
507 .desc("Number of entries that have been flushed from TLB")
508 ;
509
510 alignFaults
511 .name(name() + ".align_faults")
512 .desc("Number of TLB faults due to alignment restrictions")
513 ;
514
515 prefetchFaults
516 .name(name() + ".prefetch_faults")
517 .desc("Number of TLB faults due to prefetch")
518 ;
519
520 domainFaults
521 .name(name() + ".domain_faults")
522 .desc("Number of TLB faults due to domain restrictions")
523 ;
524
525 permsFaults
526 .name(name() + ".perms_faults")
527 .desc("Number of TLB faults due to permissions restrictions")
528 ;
529
530 instAccesses = instHits + instMisses;
531 readAccesses = readHits + readMisses;
532 writeAccesses = writeHits + writeMisses;
533 hits = readHits + writeHits + instHits;
534 misses = readMisses + writeMisses + instMisses;
535 accesses = readAccesses + writeAccesses + instAccesses;
536}
537
538void
539TLB::regProbePoints()
540{
541 ppRefills.reset(new ProbePoints::PMU(getProbeManager(), "Refills"));
542}
543
544Fault
545TLB::translateSe(RequestPtr req, ThreadContext *tc, Mode mode,
546 Translation *translation, bool &delay, bool timing)
547{
548 updateMiscReg(tc);
549 Addr vaddr_tainted = req->getVaddr();
550 Addr vaddr = 0;
551 if (aarch64)
552 vaddr = purifyTaggedAddr(vaddr_tainted, tc, aarch64EL);
553 else
554 vaddr = vaddr_tainted;
555 uint32_t flags = req->getFlags();
556
557 bool is_fetch = (mode == Execute);
558 bool is_write = (mode == Write);
559
560 if (!is_fetch) {
561 assert(flags & MustBeOne);
562 if (sctlr.a || !(flags & AllowUnaligned)) {
563 if (vaddr & mask(flags & AlignmentMask)) {
564 // LPAE is always disabled in SE mode
565 return std::make_shared<DataAbort>(
566 vaddr_tainted,
567 TlbEntry::DomainType::NoAccess, is_write,
568 ArmFault::AlignmentFault, isStage2,
569 ArmFault::VmsaTran);
570 }
571 }
572 }
573
574 Addr paddr;
575 Process *p = tc->getProcessPtr();
576
577 if (!p->pTable->translate(vaddr, paddr))
578 return std::make_shared<GenericPageTableFault>(vaddr_tainted);
579 req->setPaddr(paddr);
580
581 return NoFault;
582}
583
584Fault
585TLB::trickBoxCheck(RequestPtr req, Mode mode, TlbEntry::DomainType domain)
586{
587 return NoFault;
588}
589
590Fault
591TLB::walkTrickBoxCheck(Addr pa, bool is_secure, Addr va, Addr sz, bool is_exec,
592 bool is_write, TlbEntry::DomainType domain, LookupLevel lookup_level)
593{
594 return NoFault;
595}
596
597Fault
598TLB::checkPermissions(TlbEntry *te, RequestPtr req, Mode mode)
599{
600 Addr vaddr = req->getVaddr(); // 32-bit don't have to purify
601 uint32_t flags = req->getFlags();
602 bool is_fetch = (mode == Execute);
603 bool is_write = (mode == Write);
604 bool is_priv = isPriv && !(flags & UserMode);
605
606 // Get the translation type from the actuall table entry
607 ArmFault::TranMethod tranMethod = te->longDescFormat ? ArmFault::LpaeTran
608 : ArmFault::VmsaTran;
609
610 // If this is the second stage of translation and the request is for a
611 // stage 1 page table walk then we need to check the HCR.PTW bit. This
612 // allows us to generate a fault if the request targets an area marked
613 // as a device or strongly ordered.
614 if (isStage2 && req->isPTWalk() && hcr.ptw &&
615 (te->mtype != TlbEntry::MemoryType::Normal)) {
616 return std::make_shared<DataAbort>(
617 vaddr, te->domain, is_write,
618 ArmFault::PermissionLL + te->lookupLevel,
619 isStage2, tranMethod);
620 }
621
622 // Generate an alignment fault for unaligned data accesses to device or
623 // strongly ordered memory
624 if (!is_fetch) {
625 if (te->mtype != TlbEntry::MemoryType::Normal) {
626 if (vaddr & mask(flags & AlignmentMask)) {
627 alignFaults++;
628 return std::make_shared<DataAbort>(
629 vaddr, TlbEntry::DomainType::NoAccess, is_write,
630 ArmFault::AlignmentFault, isStage2,
631 tranMethod);
632 }
633 }
634 }
635
636 if (te->nonCacheable) {
637 // Prevent prefetching from I/O devices.
638 if (req->isPrefetch()) {
639 // Here we can safely use the fault status for the short
640 // desc. format in all cases
641 return std::make_shared<PrefetchAbort>(
642 vaddr, ArmFault::PrefetchUncacheable,
643 isStage2, tranMethod);
644 }
645 }
646
647 if (!te->longDescFormat) {
648 switch ((dacr >> (static_cast<uint8_t>(te->domain) * 2)) & 0x3) {
649 case 0:
650 domainFaults++;
651 DPRINTF(TLB, "TLB Fault: Data abort on domain. DACR: %#x"
652 " domain: %#x write:%d\n", dacr,
653 static_cast<uint8_t>(te->domain), is_write);
654 if (is_fetch)
655 return std::make_shared<PrefetchAbort>(
656 vaddr,
657 ArmFault::DomainLL + te->lookupLevel,
658 isStage2, tranMethod);
659 else
660 return std::make_shared<DataAbort>(
661 vaddr, te->domain, is_write,
662 ArmFault::DomainLL + te->lookupLevel,
663 isStage2, tranMethod);
664 case 1:
665 // Continue with permissions check
666 break;
667 case 2:
668 panic("UNPRED domain\n");
669 case 3:
670 return NoFault;
671 }
672 }
673
674 // The 'ap' variable is AP[2:0] or {AP[2,1],1b'0}, i.e. always three bits
675 uint8_t ap = te->longDescFormat ? te->ap << 1 : te->ap;
676 uint8_t hap = te->hap;
677
678 if (sctlr.afe == 1 || te->longDescFormat)
679 ap |= 1;
680
681 bool abt;
682 bool isWritable = true;
683 // If this is a stage 2 access (eg for reading stage 1 page table entries)
684 // then don't perform the AP permissions check, we stil do the HAP check
685 // below.
686 if (isStage2) {
687 abt = false;
688 } else {
689 switch (ap) {
690 case 0:
691 DPRINTF(TLB, "Access permissions 0, checking rs:%#x\n",
692 (int)sctlr.rs);
693 if (!sctlr.xp) {
694 switch ((int)sctlr.rs) {
695 case 2:
696 abt = is_write;
697 break;
698 case 1:
699 abt = is_write || !is_priv;
700 break;
701 case 0:
702 case 3:
703 default:
704 abt = true;
705 break;
706 }
707 } else {
708 abt = true;
709 }
710 break;
711 case 1:
712 abt = !is_priv;
713 break;
714 case 2:
715 abt = !is_priv && is_write;
716 isWritable = is_priv;
717 break;
718 case 3:
719 abt = false;
720 break;
721 case 4:
722 panic("UNPRED premissions\n");
723 case 5:
724 abt = !is_priv || is_write;
725 isWritable = false;
726 break;
727 case 6:
728 case 7:
729 abt = is_write;
730 isWritable = false;
731 break;
732 default:
733 panic("Unknown permissions %#x\n", ap);
734 }
735 }
736
737 bool hapAbt = is_write ? !(hap & 2) : !(hap & 1);
738 bool xn = te->xn || (isWritable && sctlr.wxn) ||
739 (ap == 3 && sctlr.uwxn && is_priv);
740 if (is_fetch && (abt || xn ||
741 (te->longDescFormat && te->pxn && !is_priv) ||
742 (isSecure && te->ns && scr.sif))) {
743 permsFaults++;
744 DPRINTF(TLB, "TLB Fault: Prefetch abort on permission check. AP:%d "
745 "priv:%d write:%d ns:%d sif:%d sctlr.afe: %d \n",
746 ap, is_priv, is_write, te->ns, scr.sif,sctlr.afe);
747 return std::make_shared<PrefetchAbort>(
748 vaddr,
749 ArmFault::PermissionLL + te->lookupLevel,
750 isStage2, tranMethod);
751 } else if (abt | hapAbt) {
752 permsFaults++;
753 DPRINTF(TLB, "TLB Fault: Data abort on permission check. AP:%d priv:%d"
754 " write:%d\n", ap, is_priv, is_write);
755 return std::make_shared<DataAbort>(
756 vaddr, te->domain, is_write,
757 ArmFault::PermissionLL + te->lookupLevel,
758 isStage2 | !abt, tranMethod);
759 }
760 return NoFault;
761}
762
763
764Fault
765TLB::checkPermissions64(TlbEntry *te, RequestPtr req, Mode mode,
766 ThreadContext *tc)
767{
768 assert(aarch64);
769
770 Addr vaddr_tainted = req->getVaddr();
771 Addr vaddr = purifyTaggedAddr(vaddr_tainted, tc, aarch64EL);
772
773 uint32_t flags = req->getFlags();
774 bool is_fetch = (mode == Execute);
775 bool is_write = (mode == Write);
776 bool is_priv M5_VAR_USED = isPriv && !(flags & UserMode);
777
778 updateMiscReg(tc, curTranType);
779
780 // If this is the second stage of translation and the request is for a
781 // stage 1 page table walk then we need to check the HCR.PTW bit. This
782 // allows us to generate a fault if the request targets an area marked
783 // as a device or strongly ordered.
784 if (isStage2 && req->isPTWalk() && hcr.ptw &&
785 (te->mtype != TlbEntry::MemoryType::Normal)) {
786 return std::make_shared<DataAbort>(
787 vaddr_tainted, te->domain, is_write,
788 ArmFault::PermissionLL + te->lookupLevel,
789 isStage2, ArmFault::LpaeTran);
790 }
791
792 // Generate an alignment fault for unaligned accesses to device or
793 // strongly ordered memory
794 if (!is_fetch) {
795 if (te->mtype != TlbEntry::MemoryType::Normal) {
796 if (vaddr & mask(flags & AlignmentMask)) {
797 alignFaults++;
798 return std::make_shared<DataAbort>(
799 vaddr_tainted,
800 TlbEntry::DomainType::NoAccess, is_write,
801 ArmFault::AlignmentFault, isStage2,
802 ArmFault::LpaeTran);
803 }
804 }
805 }
806
807 if (te->nonCacheable) {
808 // Prevent prefetching from I/O devices.
809 if (req->isPrefetch()) {
810 // Here we can safely use the fault status for the short
811 // desc. format in all cases
812 return std::make_shared<PrefetchAbort>(
813 vaddr_tainted,
814 ArmFault::PrefetchUncacheable,
815 isStage2, ArmFault::LpaeTran);
816 }
817 }
818
819 uint8_t ap = 0x3 & (te->ap); // 2-bit access protection field
820 bool grant = false;
821
822 uint8_t xn = te->xn;
823 uint8_t pxn = te->pxn;
824 bool r = !is_write && !is_fetch;
825 bool w = is_write;
826 bool x = is_fetch;
827 DPRINTF(TLBVerbose, "Checking permissions: ap:%d, xn:%d, pxn:%d, r:%d, "
828 "w:%d, x:%d\n", ap, xn, pxn, r, w, x);
829
830 if (isStage2) {
831 panic("Virtualization in AArch64 state is not supported yet");
832 } else {
833 switch (aarch64EL) {
834 case EL0:
835 {
836 uint8_t perm = (ap << 2) | (xn << 1) | pxn;
837 switch (perm) {
838 case 0:
839 case 1:
840 case 8:
841 case 9:
842 grant = x;
843 break;
844 case 4:
845 case 5:
846 grant = r || w || (x && !sctlr.wxn);
847 break;
848 case 6:
849 case 7:
850 grant = r || w;
851 break;
852 case 12:
853 case 13:
854 grant = r || x;
855 break;
856 case 14:
857 case 15:
858 grant = r;
859 break;
860 default:
861 grant = false;
862 }
863 }
864 break;
865 case EL1:
866 {
867 uint8_t perm = (ap << 2) | (xn << 1) | pxn;
868 switch (perm) {
869 case 0:
870 case 2:
871 grant = r || w || (x && !sctlr.wxn);
872 break;
873 case 1:
874 case 3:
875 case 4:
876 case 5:
877 case 6:
878 case 7:
879 // regions that are writeable at EL0 should not be
880 // executable at EL1
881 grant = r || w;
882 break;
883 case 8:
884 case 10:
885 case 12:
886 case 14:
887 grant = r || x;
888 break;
889 case 9:
890 case 11:
891 case 13:
892 case 15:
893 grant = r;
894 break;
895 default:
896 grant = false;
897 }
898 }
899 break;
900 case EL2:
901 case EL3:
902 {
903 uint8_t perm = (ap & 0x2) | xn;
904 switch (perm) {
905 case 0:
906 grant = r || w || (x && !sctlr.wxn) ;
907 break;
908 case 1:
909 grant = r || w;
910 break;
911 case 2:
912 grant = r || x;
913 break;
914 case 3:
915 grant = r;
916 break;
917 default:
918 grant = false;
919 }
920 }
921 break;
922 }
923 }
924
925 if (!grant) {
926 if (is_fetch) {
927 permsFaults++;
928 DPRINTF(TLB, "TLB Fault: Prefetch abort on permission check. "
929 "AP:%d priv:%d write:%d ns:%d sif:%d "
930 "sctlr.afe: %d\n",
931 ap, is_priv, is_write, te->ns, scr.sif, sctlr.afe);
932 // Use PC value instead of vaddr because vaddr might be aligned to
933 // cache line and should not be the address reported in FAR
934 return std::make_shared<PrefetchAbort>(
935 req->getPC(),
936 ArmFault::PermissionLL + te->lookupLevel,
937 isStage2, ArmFault::LpaeTran);
938 } else {
939 permsFaults++;
940 DPRINTF(TLB, "TLB Fault: Data abort on permission check. AP:%d "
941 "priv:%d write:%d\n", ap, is_priv, is_write);
942 return std::make_shared<DataAbort>(
943 vaddr_tainted, te->domain, is_write,
944 ArmFault::PermissionLL + te->lookupLevel,
945 isStage2, ArmFault::LpaeTran);
946 }
947 }
948
949 return NoFault;
950}
951
952Fault
953TLB::translateFs(RequestPtr req, ThreadContext *tc, Mode mode,
954 Translation *translation, bool &delay, bool timing,
955 TLB::ArmTranslationType tranType, bool functional)
956{
957 // No such thing as a functional timing access
958 assert(!(timing && functional));
959
960 updateMiscReg(tc, tranType);
961
962 Addr vaddr_tainted = req->getVaddr();
963 Addr vaddr = 0;
964 if (aarch64)
965 vaddr = purifyTaggedAddr(vaddr_tainted, tc, aarch64EL);
966 else
967 vaddr = vaddr_tainted;
968 uint32_t flags = req->getFlags();
969
970 bool is_fetch = (mode == Execute);
971 bool is_write = (mode == Write);
972 bool long_desc_format = aarch64 || (haveLPAE && ttbcr.eae);
973 ArmFault::TranMethod tranMethod = long_desc_format ? ArmFault::LpaeTran
974 : ArmFault::VmsaTran;
975
976 req->setAsid(asid);
977
978 DPRINTF(TLBVerbose, "CPSR is priv:%d UserMode:%d secure:%d S1S2NsTran:%d\n",
979 isPriv, flags & UserMode, isSecure, tranType & S1S2NsTran);
980
981 DPRINTF(TLB, "translateFs addr %#x, mode %d, st2 %d, scr %#x sctlr %#x "
982 "flags %#x tranType 0x%x\n", vaddr_tainted, mode, isStage2,
983 scr, sctlr, flags, tranType);
984
985 // Generate an alignment fault for unaligned PC
986 if (aarch64 && is_fetch && (req->getPC() & mask(2))) {
987 return std::make_shared<PCAlignmentFault>(req->getPC());
988 }
989
990 // If this is a clrex instruction, provide a PA of 0 with no fault
991 // This will force the monitor to set the tracked address to 0
992 // a bit of a hack but this effectively clrears this processors monitor
993 if (flags & Request::CLEAR_LL){
994 // @todo: check implications of security extensions
995 req->setPaddr(0);
996 req->setFlags(Request::UNCACHEABLE);
997 req->setFlags(Request::CLEAR_LL);
998 return NoFault;
999 }
1000 if ((req->isInstFetch() && (!sctlr.i)) ||
1001 ((!req->isInstFetch()) && (!sctlr.c))){
1002 req->setFlags(Request::UNCACHEABLE);
1003 }
1004 if (!is_fetch) {
1005 assert(flags & MustBeOne);
1006 if (sctlr.a || !(flags & AllowUnaligned)) {
1007 if (vaddr & mask(flags & AlignmentMask)) {
1008 alignFaults++;
1009 return std::make_shared<DataAbort>(
1010 vaddr_tainted,
1011 TlbEntry::DomainType::NoAccess, is_write,
1012 ArmFault::AlignmentFault, isStage2,
1013 tranMethod);
1014 }
1015 }
1016 }
1017
1018 // If guest MMU is off or hcr.vm=0 go straight to stage2
1019 if ((isStage2 && !hcr.vm) || (!isStage2 && !sctlr.m)) {
1020
1021 req->setPaddr(vaddr);
1022 // When the MMU is off the security attribute corresponds to the
1023 // security state of the processor
1024 if (isSecure)
1025 req->setFlags(Request::SECURE);
1026
1027 // @todo: double check this (ARM ARM issue C B3.2.1)
1028 if (long_desc_format || sctlr.tre == 0) {
1029 req->setFlags(Request::UNCACHEABLE);
1030 } else {
1031 if (nmrr.ir0 == 0 || nmrr.or0 == 0 || prrr.tr0 != 0x2)
1032 req->setFlags(Request::UNCACHEABLE);
1033 }
1034
1035 // Set memory attributes
1036 TlbEntry temp_te;
1037 temp_te.ns = !isSecure;
1038 if (isStage2 || hcr.dc == 0 || isSecure ||
1039 (isHyp && !(tranType & S1CTran))) {
1040
1041 temp_te.mtype = is_fetch ? TlbEntry::MemoryType::Normal
1042 : TlbEntry::MemoryType::StronglyOrdered;
1043 temp_te.innerAttrs = 0x0;
1044 temp_te.outerAttrs = 0x0;
1045 temp_te.shareable = true;
1046 temp_te.outerShareable = true;
1047 } else {
1048 temp_te.mtype = TlbEntry::MemoryType::Normal;
1049 temp_te.innerAttrs = 0x3;
1050 temp_te.outerAttrs = 0x3;
1051 temp_te.shareable = false;
1052 temp_te.outerShareable = false;
1053 }
1054 temp_te.setAttributes(long_desc_format);
1055 DPRINTF(TLBVerbose, "(No MMU) setting memory attributes: shareable: "
1056 "%d, innerAttrs: %d, outerAttrs: %d, isStage2: %d\n",
1057 temp_te.shareable, temp_te.innerAttrs, temp_te.outerAttrs,
1058 isStage2);
1059 setAttr(temp_te.attributes);
1060
1061 return trickBoxCheck(req, mode, TlbEntry::DomainType::NoAccess);
1062 }
1063
1064 DPRINTF(TLBVerbose, "Translating %s=%#x context=%d\n",
1065 isStage2 ? "IPA" : "VA", vaddr_tainted, asid);
1066 // Translation enabled
1067
1068 TlbEntry *te = NULL;
1069 TlbEntry mergeTe;
1070 Fault fault = getResultTe(&te, req, tc, mode, translation, timing,
1071 functional, &mergeTe);
1072 // only proceed if we have a valid table entry
1073 if ((te == NULL) && (fault == NoFault)) delay = true;
1074
1075 // If we have the table entry transfer some of the attributes to the
1076 // request that triggered the translation
1077 if (te != NULL) {
1078 // Set memory attributes
1079 DPRINTF(TLBVerbose,
1080 "Setting memory attributes: shareable: %d, innerAttrs: %d, "
1081 "outerAttrs: %d, mtype: %d, isStage2: %d\n",
1082 te->shareable, te->innerAttrs, te->outerAttrs,
1083 static_cast<uint8_t>(te->mtype), isStage2);
1084 setAttr(te->attributes);
1085 if (te->nonCacheable) {
1086 req->setFlags(Request::UNCACHEABLE);
1087 }
1088
1089 if (!bootUncacheability &&
1090 ((ArmSystem*)tc->getSystemPtr())->adderBootUncacheable(vaddr)) {
1091 req->setFlags(Request::UNCACHEABLE);
1092 }
1093
1094 Addr pa = te->pAddr(vaddr);
1095 req->setPaddr(pa);
1096
1097 if (!bootUncacheability &&
1098 ((ArmSystem*)tc->getSystemPtr())->adderBootUncacheable(pa)) {
1099 req->setFlags(Request::UNCACHEABLE);
1100 }
1101
1102 if (isSecure && !te->ns) {
1103 req->setFlags(Request::SECURE);
1104 }
1105 if ((!is_fetch) && (vaddr & mask(flags & AlignmentMask)) &&
1106 (te->mtype != TlbEntry::MemoryType::Normal)) {
1107 // Unaligned accesses to Device memory should always cause an
1108 // abort regardless of sctlr.a
1109 alignFaults++;
1110 return std::make_shared<DataAbort>(
1111 vaddr_tainted,
1112 TlbEntry::DomainType::NoAccess, is_write,
1113 ArmFault::AlignmentFault, isStage2,
1114 tranMethod);
1115 }
1116
1117 // Check for a trickbox generated address fault
1118 if (fault == NoFault) {
1119 fault = trickBoxCheck(req, mode, te->domain);
1120 }
1121 }
1122
1123 // Generate Illegal Inst Set State fault if IL bit is set in CPSR
1124 if (fault == NoFault) {
1125 CPSR cpsr = tc->readMiscReg(MISCREG_CPSR);
1126 if (aarch64 && is_fetch && cpsr.il == 1) {
1127 return std::make_shared<IllegalInstSetStateFault>();
1128 }
1129 }
1130
1131 return fault;
1132}
1133
1134Fault
1135TLB::translateAtomic(RequestPtr req, ThreadContext *tc, Mode mode,
1136 TLB::ArmTranslationType tranType)
1137{
1138 updateMiscReg(tc, tranType);
1139
1140 if (directToStage2) {
1141 assert(stage2Tlb);
1142 return stage2Tlb->translateAtomic(req, tc, mode, tranType);
1143 }
1144
1145 bool delay = false;
1146 Fault fault;
1147 if (FullSystem)
1148 fault = translateFs(req, tc, mode, NULL, delay, false, tranType);
1149 else
1150 fault = translateSe(req, tc, mode, NULL, delay, false);
1151 assert(!delay);
1152 return fault;
1153}
1154
1155Fault
1156TLB::translateFunctional(RequestPtr req, ThreadContext *tc, Mode mode,
1157 TLB::ArmTranslationType tranType)
1158{
1159 updateMiscReg(tc, tranType);
1160
1161 if (directToStage2) {
1162 assert(stage2Tlb);
1163 return stage2Tlb->translateFunctional(req, tc, mode, tranType);
1164 }
1165
1166 bool delay = false;
1167 Fault fault;
1168 if (FullSystem)
1169 fault = translateFs(req, tc, mode, NULL, delay, false, tranType, true);
1170 else
1171 fault = translateSe(req, tc, mode, NULL, delay, false);
1172 assert(!delay);
1173 return fault;
1174}
1175
1176Fault
1177TLB::translateTiming(RequestPtr req, ThreadContext *tc,
1178 Translation *translation, Mode mode, TLB::ArmTranslationType tranType)
1179{
1180 updateMiscReg(tc, tranType);
1181
1182 if (directToStage2) {
1183 assert(stage2Tlb);
1184 return stage2Tlb->translateTiming(req, tc, translation, mode, tranType);
1185 }
1186
1187 assert(translation);
1188
1189 return translateComplete(req, tc, translation, mode, tranType, isStage2);
1190}
1191
1192Fault
1193TLB::translateComplete(RequestPtr req, ThreadContext *tc,
1194 Translation *translation, Mode mode, TLB::ArmTranslationType tranType,
1195 bool callFromS2)
1196{
1197 bool delay = false;
1198 Fault fault;
1199 if (FullSystem)
1200 fault = translateFs(req, tc, mode, translation, delay, true, tranType);
1201 else
1202 fault = translateSe(req, tc, mode, translation, delay, true);
1203 DPRINTF(TLBVerbose, "Translation returning delay=%d fault=%d\n", delay, fault !=
1204 NoFault);
1205 // If we have a translation, and we're not in the middle of doing a stage
1206 // 2 translation tell the translation that we've either finished or its
1207 // going to take a while. By not doing this when we're in the middle of a
1208 // stage 2 translation we prevent marking the translation as delayed twice,
1209 // one when the translation starts and again when the stage 1 translation
1210 // completes.
1211 if (translation && (callFromS2 || !stage2Req || req->hasPaddr() || fault != NoFault)) {
1212 if (!delay)
1213 translation->finish(fault, req, tc, mode);
1214 else
1215 translation->markDelayed();
1216 }
1217 return fault;
1218}
1219
1220BaseMasterPort*
1221TLB::getMasterPort()
1222{
1223 return &tableWalker->getMasterPort("port");
1224}
1225
1226DmaPort&
1227TLB::getWalkerPort()
1228{
1229 return tableWalker->getWalkerPort();
1230}
1231
1232void
1233TLB::updateMiscReg(ThreadContext *tc, ArmTranslationType tranType)
1234{
1235 // check if the regs have changed, or the translation mode is different.
1236 // NOTE: the tran type doesn't affect stage 2 TLB's as they only handle
1237 // one type of translation anyway
1238 if (miscRegValid && ((tranType == curTranType) || isStage2)) {
1239 return;
1240 }
1241
1242 DPRINTF(TLBVerbose, "TLB variables changed!\n");
1243 CPSR cpsr = tc->readMiscReg(MISCREG_CPSR);
1244 // Dependencies: SCR/SCR_EL3, CPSR
1245 isSecure = inSecureState(tc);
1246 isSecure &= (tranType & HypMode) == 0;
1247 isSecure &= (tranType & S1S2NsTran) == 0;
1248 aarch64 = !cpsr.width;
1249 if (aarch64) { // AArch64
1250 aarch64EL = (ExceptionLevel) (uint8_t) cpsr.el;
1251 switch (aarch64EL) {
1252 case EL0:
1253 case EL1:
1254 {
1255 sctlr = tc->readMiscReg(MISCREG_SCTLR_EL1);
1256 ttbcr = tc->readMiscReg(MISCREG_TCR_EL1);
1257 uint64_t ttbr_asid = ttbcr.a1 ?
1258 tc->readMiscReg(MISCREG_TTBR1_EL1) :
1259 tc->readMiscReg(MISCREG_TTBR0_EL1);
1260 asid = bits(ttbr_asid,
1261 (haveLargeAsid64 && ttbcr.as) ? 63 : 55, 48);
1262 }
1263 break;
1264 case EL2:
1265 sctlr = tc->readMiscReg(MISCREG_SCTLR_EL2);
1266 ttbcr = tc->readMiscReg(MISCREG_TCR_EL2);
1267 asid = -1;
1268 break;
1269 case EL3:
1270 sctlr = tc->readMiscReg(MISCREG_SCTLR_EL3);
1271 ttbcr = tc->readMiscReg(MISCREG_TCR_EL3);
1272 asid = -1;
1273 break;
1274 }
1275 scr = tc->readMiscReg(MISCREG_SCR_EL3);
1276 isPriv = aarch64EL != EL0;
1277 // @todo: modify this behaviour to support Virtualization in
1278 // AArch64
1279 vmid = 0;
1280 isHyp = false;
1281 directToStage2 = false;
1282 stage2Req = false;
1283 } else { // AArch32
1284 sctlr = tc->readMiscReg(flattenMiscRegNsBanked(MISCREG_SCTLR, tc,
1285 !isSecure));
1286 ttbcr = tc->readMiscReg(flattenMiscRegNsBanked(MISCREG_TTBCR, tc,
1287 !isSecure));
1288 scr = tc->readMiscReg(MISCREG_SCR);
1289 isPriv = cpsr.mode != MODE_USER;
1290 if (haveLPAE && ttbcr.eae) {
1291 // Long-descriptor translation table format in use
1292 uint64_t ttbr_asid = tc->readMiscReg(
1293 flattenMiscRegNsBanked(ttbcr.a1 ? MISCREG_TTBR1
1294 : MISCREG_TTBR0,
1295 tc, !isSecure));
1296 asid = bits(ttbr_asid, 55, 48);
1297 } else {
1298 // Short-descriptor translation table format in use
1299 CONTEXTIDR context_id = tc->readMiscReg(flattenMiscRegNsBanked(
1300 MISCREG_CONTEXTIDR, tc,!isSecure));
1301 asid = context_id.asid;
1302 }
1303 prrr = tc->readMiscReg(flattenMiscRegNsBanked(MISCREG_PRRR, tc,
1304 !isSecure));
1305 nmrr = tc->readMiscReg(flattenMiscRegNsBanked(MISCREG_NMRR, tc,
1306 !isSecure));
1307 dacr = tc->readMiscReg(flattenMiscRegNsBanked(MISCREG_DACR, tc,
1308 !isSecure));
1309 hcr = tc->readMiscReg(MISCREG_HCR);
1310
1311 if (haveVirtualization) {
1312 vmid = bits(tc->readMiscReg(MISCREG_VTTBR), 55, 48);
1313 isHyp = cpsr.mode == MODE_HYP;
1314 isHyp |= tranType & HypMode;
1315 isHyp &= (tranType & S1S2NsTran) == 0;
1316 isHyp &= (tranType & S1CTran) == 0;
1317 if (isHyp) {
1318 sctlr = tc->readMiscReg(MISCREG_HSCTLR);
1319 }
1320 // Work out if we should skip the first stage of translation and go
1321 // directly to stage 2. This value is cached so we don't have to
1322 // compute it for every translation.
1323 stage2Req = hcr.vm && !isStage2 && !isHyp && !isSecure &&
1324 !(tranType & S1CTran);
1325 directToStage2 = stage2Req && !sctlr.m;
1326 } else {
1327 vmid = 0;
1328 stage2Req = false;
1329 isHyp = false;
1330 directToStage2 = false;
1331 }
1332 }
1333 miscRegValid = true;
1334 curTranType = tranType;
1335}
1336
1337Fault
1338TLB::getTE(TlbEntry **te, RequestPtr req, ThreadContext *tc, Mode mode,
1339 Translation *translation, bool timing, bool functional,
1340 bool is_secure, TLB::ArmTranslationType tranType)
1341{
1342 bool is_fetch = (mode == Execute);
1343 bool is_write = (mode == Write);
1344
1345 Addr vaddr_tainted = req->getVaddr();
1346 Addr vaddr = 0;
1347 ExceptionLevel target_el = aarch64 ? aarch64EL : EL1;
1348 if (aarch64) {
1349 vaddr = purifyTaggedAddr(vaddr_tainted, tc, target_el);
1350 } else {
1351 vaddr = vaddr_tainted;
1352 }
1353 *te = lookup(vaddr, asid, vmid, isHyp, is_secure, false, false, target_el);
1354 if (*te == NULL) {
1355 if (req->isPrefetch()) {
1356 // if the request is a prefetch don't attempt to fill the TLB or go
1357 // any further with the memory access (here we can safely use the
1358 // fault status for the short desc. format in all cases)
1359 prefetchFaults++;
1360 return std::make_shared<PrefetchAbort>(
1361 vaddr_tainted, ArmFault::PrefetchTLBMiss, isStage2);
1362 }
1363
1364 if (is_fetch)
1365 instMisses++;
1366 else if (is_write)
1367 writeMisses++;
1368 else
1369 readMisses++;
1370
1371 // start translation table walk, pass variables rather than
1372 // re-retreaving in table walker for speed
1373 DPRINTF(TLB, "TLB Miss: Starting hardware table walker for %#x(%d:%d)\n",
1374 vaddr_tainted, asid, vmid);
1375 Fault fault;
1376 fault = tableWalker->walk(req, tc, asid, vmid, isHyp, mode,
1377 translation, timing, functional, is_secure,
1378 tranType);
1379 // for timing mode, return and wait for table walk,
1380 if (timing || fault != NoFault) {
1381 return fault;
1382 }
1383
1384 *te = lookup(vaddr, asid, vmid, isHyp, is_secure, false, false, target_el);
1385 if (!*te)
1386 printTlb();
1387 assert(*te);
1388 } else {
1389 if (is_fetch)
1390 instHits++;
1391 else if (is_write)
1392 writeHits++;
1393 else
1394 readHits++;
1395 }
1396 return NoFault;
1397}
1398
1399Fault
1400TLB::getResultTe(TlbEntry **te, RequestPtr req, ThreadContext *tc, Mode mode,
1401 Translation *translation, bool timing, bool functional,
1402 TlbEntry *mergeTe)
1403{
1404 Fault fault;
1405 TlbEntry *s1Te = NULL;
1406
1407 Addr vaddr_tainted = req->getVaddr();
1408
1409 // Get the stage 1 table entry
1410 fault = getTE(&s1Te, req, tc, mode, translation, timing, functional,
1411 isSecure, curTranType);
1412 // only proceed if we have a valid table entry
1413 if ((s1Te != NULL) && (fault == NoFault)) {
1414 // Check stage 1 permissions before checking stage 2
1415 if (aarch64)
1416 fault = checkPermissions64(s1Te, req, mode, tc);
1417 else
1418 fault = checkPermissions(s1Te, req, mode);
1419 if (stage2Req & (fault == NoFault)) {
1420 Stage2LookUp *s2Lookup = new Stage2LookUp(this, stage2Tlb, *s1Te,
1421 req, translation, mode, timing, functional, curTranType);
1422 fault = s2Lookup->getTe(tc, mergeTe);
1423 if (s2Lookup->isComplete()) {
1424 *te = mergeTe;
1425 // We've finished with the lookup so delete it
1426 delete s2Lookup;
1427 } else {
1428 // The lookup hasn't completed, so we can't delete it now. We
1429 // get round this by asking the object to self delete when the
1430 // translation is complete.
1431 s2Lookup->setSelfDelete();
1432 }
1433 } else {
1434 // This case deals with an S1 hit (or bypass), followed by
1435 // an S2 hit-but-perms issue
1436 if (isStage2) {
1437 DPRINTF(TLBVerbose, "s2TLB: reqVa %#x, reqPa %#x, fault %p\n",
1438 vaddr_tainted, req->hasPaddr() ? req->getPaddr() : ~0, fault);
1439 if (fault != NoFault) {
1440 ArmFault *armFault = reinterpret_cast<ArmFault *>(fault.get());
1441 armFault->annotate(ArmFault::S1PTW, false);
1442 armFault->annotate(ArmFault::OVA, vaddr_tainted);
1443 }
1444 }
1445 *te = s1Te;
1446 }
1447 }
1448 return fault;
1449}
1450
1451ArmISA::TLB *
1452ArmTLBParams::create()
1453{
1454 return new ArmISA::TLB(this);
1455}
|