1/*
2 * Copyright (c) 2010-2013 ARM Limited
3 * All rights reserved
4 *
5 * The license below extends only to copyright in the software and shall
6 * not be construed as granting a license to any other intellectual
7 * property including but not limited to intellectual property relating
8 * to a hardware implementation of the functionality of the software
9 * licensed hereunder. You may use the software subject to the license
10 * terms below provided that you ensure that this notice is replicated
11 * unmodified and in its entirety in all distributions of the software,
12 * modified or unmodified, in source code or in binary form.
13 *
14 * Copyright (c) 2001-2005 The Regents of The University of Michigan
15 * All rights reserved.
16 *
17 * Redistribution and use in source and binary forms, with or without
18 * modification, are permitted provided that the following conditions are
19 * met: redistributions of source code must retain the above copyright
20 * notice, this list of conditions and the following disclaimer;
21 * redistributions in binary form must reproduce the above copyright
22 * notice, this list of conditions and the following disclaimer in the
23 * documentation and/or other materials provided with the distribution;
24 * neither the name of the copyright holders nor the names of its
25 * contributors may be used to endorse or promote products derived from
26 * this software without specific prior written permission.
27 *
28 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
29 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
30 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
31 * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
32 * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
33 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
34 * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
35 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
36 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
37 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
38 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
39 *
40 * Authors: Ali Saidi
41 * Nathan Binkert
42 * Steve Reinhardt
43 */
44
45#include <memory>
46#include <string>
47#include <vector>
48
49#include "arch/arm/faults.hh"
50#include "arch/arm/pagetable.hh"
51#include "arch/arm/system.hh"
52#include "arch/arm/table_walker.hh"
53#include "arch/arm/stage2_lookup.hh"
54#include "arch/arm/stage2_mmu.hh"
55#include "arch/arm/tlb.hh"
56#include "arch/arm/utility.hh"
57#include "base/inifile.hh"
58#include "base/str.hh"
59#include "base/trace.hh"
60#include "cpu/base.hh"
61#include "cpu/thread_context.hh"
62#include "debug/Checkpoint.hh"
63#include "debug/TLB.hh"
64#include "debug/TLBVerbose.hh"
65#include "mem/page_table.hh"
66#include "params/ArmTLB.hh"
67#include "sim/full_system.hh"
68#include "sim/process.hh"
69
70using namespace std;
71using namespace ArmISA;
72
73TLB::TLB(const ArmTLBParams *p)
74 : BaseTLB(p), table(new TlbEntry[p->size]), size(p->size),
75 isStage2(p->is_stage2), stage2Req(false), _attr(0),
76 directToStage2(false), tableWalker(p->walker), stage2Tlb(NULL),
77 stage2Mmu(NULL), rangeMRU(1),
78 aarch64(false), aarch64EL(EL0), isPriv(false), isSecure(false),
79 isHyp(false), asid(0), vmid(0), dacr(0),
80 miscRegValid(false), curTranType(NormalTran)
81{
82 tableWalker->setTlb(this);
83
84 // Cache system-level properties
85 haveLPAE = tableWalker->haveLPAE();
86 haveVirtualization = tableWalker->haveVirtualization();
87 haveLargeAsid64 = tableWalker->haveLargeAsid64();
88}
89
90TLB::~TLB()
91{
92 delete[] table;
93}
94
95void
96TLB::init()
97{
98 if (stage2Mmu && !isStage2)
99 stage2Tlb = stage2Mmu->stage2Tlb();
100}
101
102void
103TLB::setMMU(Stage2MMU *m, MasterID master_id)
104{
105 stage2Mmu = m;
106 tableWalker->setMMU(m, master_id);
107}
108
109bool
110TLB::translateFunctional(ThreadContext *tc, Addr va, Addr &pa)
111{
112 updateMiscReg(tc);
113
114 if (directToStage2) {
115 assert(stage2Tlb);
116 return stage2Tlb->translateFunctional(tc, va, pa);
117 }
118
119 TlbEntry *e = lookup(va, asid, vmid, isHyp, isSecure, true, false,
120 aarch64 ? aarch64EL : EL1);
121 if (!e)
122 return false;
123 pa = e->pAddr(va);
124 return true;
125}
126
127Fault
128TLB::finalizePhysical(RequestPtr req, ThreadContext *tc, Mode mode) const
129{
130 return NoFault;
131}
132
133TlbEntry*
134TLB::lookup(Addr va, uint16_t asn, uint8_t vmid, bool hyp, bool secure,
135 bool functional, bool ignore_asn, uint8_t target_el)
136{
137
138 TlbEntry *retval = NULL;
139
140 // Maintaining LRU array
141 int x = 0;
142 while (retval == NULL && x < size) {
143 if ((!ignore_asn && table[x].match(va, asn, vmid, hyp, secure, false,
144 target_el)) ||
145 (ignore_asn && table[x].match(va, vmid, hyp, secure, target_el))) {
146 // We only move the hit entry ahead when the position is higher
147 // than rangeMRU
148 if (x > rangeMRU && !functional) {
149 TlbEntry tmp_entry = table[x];
150 for(int i = x; i > 0; i--)
151 table[i] = table[i - 1];
152 table[0] = tmp_entry;
153 retval = &table[0];
154 } else {
155 retval = &table[x];
156 }
157 break;
158 }
159 ++x;
160 }
161
162 DPRINTF(TLBVerbose, "Lookup %#x, asn %#x -> %s vmn 0x%x hyp %d secure %d "
163 "ppn %#x size: %#x pa: %#x ap:%d ns:%d nstid:%d g:%d asid: %d "
164 "el: %d\n",
165 va, asn, retval ? "hit" : "miss", vmid, hyp, secure,
166 retval ? retval->pfn : 0, retval ? retval->size : 0,
167 retval ? retval->pAddr(va) : 0, retval ? retval->ap : 0,
168 retval ? retval->ns : 0, retval ? retval->nstid : 0,
169 retval ? retval->global : 0, retval ? retval->asid : 0,
170 retval ? retval->el : 0);
171
172 return retval;
173}
174
175// insert a new TLB entry
176void
177TLB::insert(Addr addr, TlbEntry &entry)
178{
179 DPRINTF(TLB, "Inserting entry into TLB with pfn:%#x size:%#x vpn: %#x"
180 " asid:%d vmid:%d N:%d global:%d valid:%d nc:%d xn:%d"
181 " ap:%#x domain:%#x ns:%d nstid:%d isHyp:%d\n", entry.pfn,
182 entry.size, entry.vpn, entry.asid, entry.vmid, entry.N,
183 entry.global, entry.valid, entry.nonCacheable, entry.xn,
184 entry.ap, static_cast<uint8_t>(entry.domain), entry.ns, entry.nstid,
185 entry.isHyp);
186
187 if (table[size - 1].valid)
188 DPRINTF(TLB, " - Replacing Valid entry %#x, asn %d vmn %d ppn %#x "
189 "size: %#x ap:%d ns:%d nstid:%d g:%d isHyp:%d el: %d\n",
190 table[size-1].vpn << table[size-1].N, table[size-1].asid,
191 table[size-1].vmid, table[size-1].pfn << table[size-1].N,
192 table[size-1].size, table[size-1].ap, table[size-1].ns,
193 table[size-1].nstid, table[size-1].global, table[size-1].isHyp,
194 table[size-1].el);
195
196 //inserting to MRU position and evicting the LRU one
197
198 for (int i = size - 1; i > 0; --i)
199 table[i] = table[i-1];
200 table[0] = entry;
201
202 inserts++;
203 ppRefills->notify(1);
204}
205
206void
207TLB::printTlb() const
208{
209 int x = 0;
210 TlbEntry *te;
211 DPRINTF(TLB, "Current TLB contents:\n");
212 while (x < size) {
213 te = &table[x];
214 if (te->valid)
215 DPRINTF(TLB, " * %s\n", te->print());
216 ++x;
217 }
218}
219
220void
221TLB::flushAllSecurity(bool secure_lookup, uint8_t target_el, bool ignore_el)
222{
223 DPRINTF(TLB, "Flushing all TLB entries (%s lookup)\n",
224 (secure_lookup ? "secure" : "non-secure"));
225 int x = 0;
226 TlbEntry *te;
227 while (x < size) {
228 te = &table[x];
229 if (te->valid && secure_lookup == !te->nstid &&
230 (te->vmid == vmid || secure_lookup) &&
231 checkELMatch(target_el, te->el, ignore_el)) {
232
233 DPRINTF(TLB, " - %s\n", te->print());
234 te->valid = false;
235 flushedEntries++;
236 }
237 ++x;
238 }
239
240 flushTlb++;
241
242 // If there's a second stage TLB (and we're not it) then flush it as well
243 // if we're currently in hyp mode
244 if (!isStage2 && isHyp) {
245 stage2Tlb->flushAllSecurity(secure_lookup, true);
246 }
247}
248
249void
250TLB::flushAllNs(bool hyp, uint8_t target_el, bool ignore_el)
251{
252 DPRINTF(TLB, "Flushing all NS TLB entries (%s lookup)\n",
253 (hyp ? "hyp" : "non-hyp"));
254 int x = 0;
255 TlbEntry *te;
256 while (x < size) {
257 te = &table[x];
258 if (te->valid && te->nstid && te->isHyp == hyp &&
259 checkELMatch(target_el, te->el, ignore_el)) {
260
261 DPRINTF(TLB, " - %s\n", te->print());
262 flushedEntries++;
263 te->valid = false;
264 }
265 ++x;
266 }
267
268 flushTlb++;
269
270 // If there's a second stage TLB (and we're not it) then flush it as well
271 if (!isStage2 && !hyp) {
272 stage2Tlb->flushAllNs(false, true);
273 }
274}
275
276void
277TLB::flushMvaAsid(Addr mva, uint64_t asn, bool secure_lookup, uint8_t target_el)
278{
279 DPRINTF(TLB, "Flushing TLB entries with mva: %#x, asid: %#x "
280 "(%s lookup)\n", mva, asn, (secure_lookup ?
281 "secure" : "non-secure"));
282 _flushMva(mva, asn, secure_lookup, false, false, target_el);
283 flushTlbMvaAsid++;
284}
285
286void
287TLB::flushAsid(uint64_t asn, bool secure_lookup, uint8_t target_el)
288{
289 DPRINTF(TLB, "Flushing TLB entries with asid: %#x (%s lookup)\n", asn,
290 (secure_lookup ? "secure" : "non-secure"));
291
292 int x = 0 ;
293 TlbEntry *te;
294
295 while (x < size) {
296 te = &table[x];
297 if (te->valid && te->asid == asn && secure_lookup == !te->nstid &&
298 (te->vmid == vmid || secure_lookup) &&
299 checkELMatch(target_el, te->el, false)) {
300
301 te->valid = false;
302 DPRINTF(TLB, " - %s\n", te->print());
303 flushedEntries++;
304 }
305 ++x;
306 }
307 flushTlbAsid++;
308}
309
310void
311TLB::flushMva(Addr mva, bool secure_lookup, bool hyp, uint8_t target_el)
312{
313 DPRINTF(TLB, "Flushing TLB entries with mva: %#x (%s lookup)\n", mva,
314 (secure_lookup ? "secure" : "non-secure"));
315 _flushMva(mva, 0xbeef, secure_lookup, hyp, true, target_el);
316 flushTlbMva++;
317}
318
319void
320TLB::_flushMva(Addr mva, uint64_t asn, bool secure_lookup, bool hyp,
321 bool ignore_asn, uint8_t target_el)
322{
323 TlbEntry *te;
324 // D5.7.2: Sign-extend address to 64 bits
325 mva = sext<56>(mva);
326 te = lookup(mva, asn, vmid, hyp, secure_lookup, false, ignore_asn,
327 target_el);
328 while (te != NULL) {
329 if (secure_lookup == !te->nstid) {
330 DPRINTF(TLB, " - %s\n", te->print());
331 te->valid = false;
332 flushedEntries++;
333 }
334 te = lookup(mva, asn, vmid, hyp, secure_lookup, false, ignore_asn,
335 target_el);
336 }
337}
338
339bool
340TLB::checkELMatch(uint8_t target_el, uint8_t tentry_el, bool ignore_el)
341{
342 bool elMatch = true;
343 if (!ignore_el) {
344 if (target_el == 2 || target_el == 3) {
345 elMatch = (tentry_el == target_el);
346 } else {
347 elMatch = (tentry_el == 0) || (tentry_el == 1);
348 }
349 }
350 return elMatch;
351}
352
353void
354TLB::drainResume()
355{
356 // We might have unserialized something or switched CPUs, so make
357 // sure to re-read the misc regs.
358 miscRegValid = false;
359}
360
361void
362TLB::takeOverFrom(BaseTLB *_otlb)
363{
364 TLB *otlb = dynamic_cast<TLB*>(_otlb);
365 /* Make sure we actually have a valid type */
366 if (otlb) {
367 _attr = otlb->_attr;
368 haveLPAE = otlb->haveLPAE;
369 directToStage2 = otlb->directToStage2;
370 stage2Req = otlb->stage2Req;
371
372 /* Sync the stage2 MMU if they exist in both
373 * the old CPU and the new
374 */
375 if (!isStage2 &&
376 stage2Tlb && otlb->stage2Tlb) {
377 stage2Tlb->takeOverFrom(otlb->stage2Tlb);
378 }
379 } else {
380 panic("Incompatible TLB type!");
381 }
382}
383
384void
385TLB::serialize(ostream &os)
386{
387 DPRINTF(Checkpoint, "Serializing Arm TLB\n");
388
389 SERIALIZE_SCALAR(_attr);
390 SERIALIZE_SCALAR(haveLPAE);
391 SERIALIZE_SCALAR(directToStage2);
392 SERIALIZE_SCALAR(stage2Req);
393
394 int num_entries = size;
395 SERIALIZE_SCALAR(num_entries);
396 for(int i = 0; i < size; i++){
397 nameOut(os, csprintf("%s.TlbEntry%d", name(), i));
398 table[i].serialize(os);
399 }
400}
401
402void
403TLB::unserialize(Checkpoint *cp, const string §ion)
404{
405 DPRINTF(Checkpoint, "Unserializing Arm TLB\n");
406
407 UNSERIALIZE_SCALAR(_attr);
408 UNSERIALIZE_SCALAR(haveLPAE);
409 UNSERIALIZE_SCALAR(directToStage2);
410 UNSERIALIZE_SCALAR(stage2Req);
411
412 int num_entries;
413 UNSERIALIZE_SCALAR(num_entries);
414 for(int i = 0; i < min(size, num_entries); i++){
415 table[i].unserialize(cp, csprintf("%s.TlbEntry%d", section, i));
416 }
417}
418
419void
420TLB::regStats()
421{
422 instHits
423 .name(name() + ".inst_hits")
424 .desc("ITB inst hits")
425 ;
426
427 instMisses
428 .name(name() + ".inst_misses")
429 .desc("ITB inst misses")
430 ;
431
432 instAccesses
433 .name(name() + ".inst_accesses")
434 .desc("ITB inst accesses")
435 ;
436
437 readHits
438 .name(name() + ".read_hits")
439 .desc("DTB read hits")
440 ;
441
442 readMisses
443 .name(name() + ".read_misses")
444 .desc("DTB read misses")
445 ;
446
447 readAccesses
448 .name(name() + ".read_accesses")
449 .desc("DTB read accesses")
450 ;
451
452 writeHits
453 .name(name() + ".write_hits")
454 .desc("DTB write hits")
455 ;
456
457 writeMisses
458 .name(name() + ".write_misses")
459 .desc("DTB write misses")
460 ;
461
462 writeAccesses
463 .name(name() + ".write_accesses")
464 .desc("DTB write accesses")
465 ;
466
467 hits
468 .name(name() + ".hits")
469 .desc("DTB hits")
470 ;
471
472 misses
473 .name(name() + ".misses")
474 .desc("DTB misses")
475 ;
476
477 accesses
478 .name(name() + ".accesses")
479 .desc("DTB accesses")
480 ;
481
482 flushTlb
483 .name(name() + ".flush_tlb")
484 .desc("Number of times complete TLB was flushed")
485 ;
486
487 flushTlbMva
488 .name(name() + ".flush_tlb_mva")
489 .desc("Number of times TLB was flushed by MVA")
490 ;
491
492 flushTlbMvaAsid
493 .name(name() + ".flush_tlb_mva_asid")
494 .desc("Number of times TLB was flushed by MVA & ASID")
495 ;
496
497 flushTlbAsid
498 .name(name() + ".flush_tlb_asid")
499 .desc("Number of times TLB was flushed by ASID")
500 ;
501
502 flushedEntries
503 .name(name() + ".flush_entries")
504 .desc("Number of entries that have been flushed from TLB")
505 ;
506
507 alignFaults
508 .name(name() + ".align_faults")
509 .desc("Number of TLB faults due to alignment restrictions")
510 ;
511
512 prefetchFaults
513 .name(name() + ".prefetch_faults")
514 .desc("Number of TLB faults due to prefetch")
515 ;
516
517 domainFaults
518 .name(name() + ".domain_faults")
519 .desc("Number of TLB faults due to domain restrictions")
520 ;
521
522 permsFaults
523 .name(name() + ".perms_faults")
524 .desc("Number of TLB faults due to permissions restrictions")
525 ;
526
527 instAccesses = instHits + instMisses;
528 readAccesses = readHits + readMisses;
529 writeAccesses = writeHits + writeMisses;
530 hits = readHits + writeHits + instHits;
531 misses = readMisses + writeMisses + instMisses;
532 accesses = readAccesses + writeAccesses + instAccesses;
533}
534
535void
536TLB::regProbePoints()
537{
538 ppRefills.reset(new ProbePoints::PMU(getProbeManager(), "Refills"));
539}
540
541Fault
542TLB::translateSe(RequestPtr req, ThreadContext *tc, Mode mode,
543 Translation *translation, bool &delay, bool timing)
544{
545 updateMiscReg(tc);
546 Addr vaddr_tainted = req->getVaddr();
547 Addr vaddr = 0;
548 if (aarch64)
549 vaddr = purifyTaggedAddr(vaddr_tainted, tc, aarch64EL);
550 else
551 vaddr = vaddr_tainted;
552 uint32_t flags = req->getFlags();
553
554 bool is_fetch = (mode == Execute);
555 bool is_write = (mode == Write);
556
557 if (!is_fetch) {
558 assert(flags & MustBeOne);
559 if (sctlr.a || !(flags & AllowUnaligned)) {
560 if (vaddr & mask(flags & AlignmentMask)) {
561 // LPAE is always disabled in SE mode
562 return std::make_shared<DataAbort>(
563 vaddr_tainted,
564 TlbEntry::DomainType::NoAccess, is_write,
565 ArmFault::AlignmentFault, isStage2,
566 ArmFault::VmsaTran);
567 }
568 }
569 }
570
571 Addr paddr;
572 Process *p = tc->getProcessPtr();
573
574 if (!p->pTable->translate(vaddr, paddr))
575 return std::make_shared<GenericPageTableFault>(vaddr_tainted);
576 req->setPaddr(paddr);
577
578 return NoFault;
579}
580
581Fault
582TLB::trickBoxCheck(RequestPtr req, Mode mode, TlbEntry::DomainType domain)
583{
584 return NoFault;
585}
586
587Fault
588TLB::walkTrickBoxCheck(Addr pa, bool is_secure, Addr va, Addr sz, bool is_exec,
589 bool is_write, TlbEntry::DomainType domain, LookupLevel lookup_level)
590{
591 return NoFault;
592}
593
594Fault
595TLB::checkPermissions(TlbEntry *te, RequestPtr req, Mode mode)
596{
597 Addr vaddr = req->getVaddr(); // 32-bit don't have to purify
598 uint32_t flags = req->getFlags();
599 bool is_fetch = (mode == Execute);
600 bool is_write = (mode == Write);
601 bool is_priv = isPriv && !(flags & UserMode);
602
603 // Get the translation type from the actuall table entry
604 ArmFault::TranMethod tranMethod = te->longDescFormat ? ArmFault::LpaeTran
605 : ArmFault::VmsaTran;
606
607 // If this is the second stage of translation and the request is for a
608 // stage 1 page table walk then we need to check the HCR.PTW bit. This
609 // allows us to generate a fault if the request targets an area marked
610 // as a device or strongly ordered.
611 if (isStage2 && req->isPTWalk() && hcr.ptw &&
612 (te->mtype != TlbEntry::MemoryType::Normal)) {
613 return std::make_shared<DataAbort>(
614 vaddr, te->domain, is_write,
615 ArmFault::PermissionLL + te->lookupLevel,
616 isStage2, tranMethod);
617 }
618
619 // Generate an alignment fault for unaligned data accesses to device or
620 // strongly ordered memory
621 if (!is_fetch) {
622 if (te->mtype != TlbEntry::MemoryType::Normal) {
623 if (vaddr & mask(flags & AlignmentMask)) {
624 alignFaults++;
625 return std::make_shared<DataAbort>(
626 vaddr, TlbEntry::DomainType::NoAccess, is_write,
627 ArmFault::AlignmentFault, isStage2,
628 tranMethod);
629 }
630 }
631 }
632
633 if (te->nonCacheable) {
634 // Prevent prefetching from I/O devices.
635 if (req->isPrefetch()) {
636 // Here we can safely use the fault status for the short
637 // desc. format in all cases
638 return std::make_shared<PrefetchAbort>(
639 vaddr, ArmFault::PrefetchUncacheable,
640 isStage2, tranMethod);
641 }
642 }
643
644 if (!te->longDescFormat) {
645 switch ((dacr >> (static_cast<uint8_t>(te->domain) * 2)) & 0x3) {
646 case 0:
647 domainFaults++;
648 DPRINTF(TLB, "TLB Fault: Data abort on domain. DACR: %#x"
649 " domain: %#x write:%d\n", dacr,
650 static_cast<uint8_t>(te->domain), is_write);
651 if (is_fetch)
652 return std::make_shared<PrefetchAbort>(
653 vaddr,
654 ArmFault::DomainLL + te->lookupLevel,
655 isStage2, tranMethod);
656 else
657 return std::make_shared<DataAbort>(
658 vaddr, te->domain, is_write,
659 ArmFault::DomainLL + te->lookupLevel,
660 isStage2, tranMethod);
661 case 1:
662 // Continue with permissions check
663 break;
664 case 2:
665 panic("UNPRED domain\n");
666 case 3:
667 return NoFault;
668 }
669 }
670
671 // The 'ap' variable is AP[2:0] or {AP[2,1],1b'0}, i.e. always three bits
672 uint8_t ap = te->longDescFormat ? te->ap << 1 : te->ap;
673 uint8_t hap = te->hap;
674
675 if (sctlr.afe == 1 || te->longDescFormat)
676 ap |= 1;
677
678 bool abt;
679 bool isWritable = true;
680 // If this is a stage 2 access (eg for reading stage 1 page table entries)
681 // then don't perform the AP permissions check, we stil do the HAP check
682 // below.
683 if (isStage2) {
684 abt = false;
685 } else {
686 switch (ap) {
687 case 0:
688 DPRINTF(TLB, "Access permissions 0, checking rs:%#x\n",
689 (int)sctlr.rs);
690 if (!sctlr.xp) {
691 switch ((int)sctlr.rs) {
692 case 2:
693 abt = is_write;
694 break;
695 case 1:
696 abt = is_write || !is_priv;
697 break;
698 case 0:
699 case 3:
700 default:
701 abt = true;
702 break;
703 }
704 } else {
705 abt = true;
706 }
707 break;
708 case 1:
709 abt = !is_priv;
710 break;
711 case 2:
712 abt = !is_priv && is_write;
713 isWritable = is_priv;
714 break;
715 case 3:
716 abt = false;
717 break;
718 case 4:
719 panic("UNPRED premissions\n");
720 case 5:
721 abt = !is_priv || is_write;
722 isWritable = false;
723 break;
724 case 6:
725 case 7:
726 abt = is_write;
727 isWritable = false;
728 break;
729 default:
730 panic("Unknown permissions %#x\n", ap);
731 }
732 }
733
734 bool hapAbt = is_write ? !(hap & 2) : !(hap & 1);
735 bool xn = te->xn || (isWritable && sctlr.wxn) ||
736 (ap == 3 && sctlr.uwxn && is_priv);
737 if (is_fetch && (abt || xn ||
738 (te->longDescFormat && te->pxn && !is_priv) ||
739 (isSecure && te->ns && scr.sif))) {
740 permsFaults++;
741 DPRINTF(TLB, "TLB Fault: Prefetch abort on permission check. AP:%d "
742 "priv:%d write:%d ns:%d sif:%d sctlr.afe: %d \n",
743 ap, is_priv, is_write, te->ns, scr.sif,sctlr.afe);
744 return std::make_shared<PrefetchAbort>(
745 vaddr,
746 ArmFault::PermissionLL + te->lookupLevel,
747 isStage2, tranMethod);
748 } else if (abt | hapAbt) {
749 permsFaults++;
750 DPRINTF(TLB, "TLB Fault: Data abort on permission check. AP:%d priv:%d"
751 " write:%d\n", ap, is_priv, is_write);
752 return std::make_shared<DataAbort>(
753 vaddr, te->domain, is_write,
754 ArmFault::PermissionLL + te->lookupLevel,
755 isStage2 | !abt, tranMethod);
756 }
757 return NoFault;
758}
759
760
761Fault
762TLB::checkPermissions64(TlbEntry *te, RequestPtr req, Mode mode,
763 ThreadContext *tc)
764{
765 assert(aarch64);
766
767 Addr vaddr_tainted = req->getVaddr();
768 Addr vaddr = purifyTaggedAddr(vaddr_tainted, tc, aarch64EL);
769
770 uint32_t flags = req->getFlags();
771 bool is_fetch = (mode == Execute);
772 bool is_write = (mode == Write);
773 bool is_priv M5_VAR_USED = isPriv && !(flags & UserMode);
774
775 updateMiscReg(tc, curTranType);
776
777 // If this is the second stage of translation and the request is for a
778 // stage 1 page table walk then we need to check the HCR.PTW bit. This
779 // allows us to generate a fault if the request targets an area marked
780 // as a device or strongly ordered.
781 if (isStage2 && req->isPTWalk() && hcr.ptw &&
782 (te->mtype != TlbEntry::MemoryType::Normal)) {
783 return std::make_shared<DataAbort>(
784 vaddr_tainted, te->domain, is_write,
785 ArmFault::PermissionLL + te->lookupLevel,
786 isStage2, ArmFault::LpaeTran);
787 }
788
789 // Generate an alignment fault for unaligned accesses to device or
790 // strongly ordered memory
791 if (!is_fetch) {
792 if (te->mtype != TlbEntry::MemoryType::Normal) {
793 if (vaddr & mask(flags & AlignmentMask)) {
794 alignFaults++;
795 return std::make_shared<DataAbort>(
796 vaddr_tainted,
797 TlbEntry::DomainType::NoAccess, is_write,
798 ArmFault::AlignmentFault, isStage2,
799 ArmFault::LpaeTran);
800 }
801 }
802 }
803
804 if (te->nonCacheable) {
805 // Prevent prefetching from I/O devices.
806 if (req->isPrefetch()) {
807 // Here we can safely use the fault status for the short
808 // desc. format in all cases
809 return std::make_shared<PrefetchAbort>(
810 vaddr_tainted,
811 ArmFault::PrefetchUncacheable,
812 isStage2, ArmFault::LpaeTran);
813 }
814 }
815
816 uint8_t ap = 0x3 & (te->ap); // 2-bit access protection field
817 bool grant = false;
818
819 uint8_t xn = te->xn;
820 uint8_t pxn = te->pxn;
821 bool r = !is_write && !is_fetch;
822 bool w = is_write;
823 bool x = is_fetch;
824 DPRINTF(TLBVerbose, "Checking permissions: ap:%d, xn:%d, pxn:%d, r:%d, "
825 "w:%d, x:%d\n", ap, xn, pxn, r, w, x);
826
827 if (isStage2) {
828 panic("Virtualization in AArch64 state is not supported yet");
829 } else {
830 switch (aarch64EL) {
831 case EL0:
832 {
833 uint8_t perm = (ap << 2) | (xn << 1) | pxn;
834 switch (perm) {
835 case 0:
836 case 1:
837 case 8:
838 case 9:
839 grant = x;
840 break;
841 case 4:
842 case 5:
843 grant = r || w || (x && !sctlr.wxn);
844 break;
845 case 6:
846 case 7:
847 grant = r || w;
848 break;
849 case 12:
850 case 13:
851 grant = r || x;
852 break;
853 case 14:
854 case 15:
855 grant = r;
856 break;
857 default:
858 grant = false;
859 }
860 }
861 break;
862 case EL1:
863 {
864 uint8_t perm = (ap << 2) | (xn << 1) | pxn;
865 switch (perm) {
866 case 0:
867 case 2:
868 grant = r || w || (x && !sctlr.wxn);
869 break;
870 case 1:
871 case 3:
872 case 4:
873 case 5:
874 case 6:
875 case 7:
876 // regions that are writeable at EL0 should not be
877 // executable at EL1
878 grant = r || w;
879 break;
880 case 8:
881 case 10:
882 case 12:
883 case 14:
884 grant = r || x;
885 break;
886 case 9:
887 case 11:
888 case 13:
889 case 15:
890 grant = r;
891 break;
892 default:
893 grant = false;
894 }
895 }
896 break;
897 case EL2:
898 case EL3:
899 {
900 uint8_t perm = (ap & 0x2) | xn;
901 switch (perm) {
902 case 0:
903 grant = r || w || (x && !sctlr.wxn) ;
904 break;
905 case 1:
906 grant = r || w;
907 break;
908 case 2:
909 grant = r || x;
910 break;
911 case 3:
912 grant = r;
913 break;
914 default:
915 grant = false;
916 }
917 }
918 break;
919 }
920 }
921
922 if (!grant) {
923 if (is_fetch) {
924 permsFaults++;
925 DPRINTF(TLB, "TLB Fault: Prefetch abort on permission check. "
926 "AP:%d priv:%d write:%d ns:%d sif:%d "
927 "sctlr.afe: %d\n",
928 ap, is_priv, is_write, te->ns, scr.sif, sctlr.afe);
929 // Use PC value instead of vaddr because vaddr might be aligned to
930 // cache line and should not be the address reported in FAR
931 return std::make_shared<PrefetchAbort>(
932 req->getPC(),
933 ArmFault::PermissionLL + te->lookupLevel,
934 isStage2, ArmFault::LpaeTran);
935 } else {
936 permsFaults++;
937 DPRINTF(TLB, "TLB Fault: Data abort on permission check. AP:%d "
938 "priv:%d write:%d\n", ap, is_priv, is_write);
939 return std::make_shared<DataAbort>(
940 vaddr_tainted, te->domain, is_write,
941 ArmFault::PermissionLL + te->lookupLevel,
942 isStage2, ArmFault::LpaeTran);
943 }
944 }
945
946 return NoFault;
947}
948
949Fault
950TLB::translateFs(RequestPtr req, ThreadContext *tc, Mode mode,
951 Translation *translation, bool &delay, bool timing,
952 TLB::ArmTranslationType tranType, bool functional)
953{
954 // No such thing as a functional timing access
955 assert(!(timing && functional));
956
957 updateMiscReg(tc, tranType);
958
959 Addr vaddr_tainted = req->getVaddr();
960 Addr vaddr = 0;
961 if (aarch64)
962 vaddr = purifyTaggedAddr(vaddr_tainted, tc, aarch64EL);
963 else
964 vaddr = vaddr_tainted;
965 uint32_t flags = req->getFlags();
966
967 bool is_fetch = (mode == Execute);
968 bool is_write = (mode == Write);
969 bool long_desc_format = aarch64 || (haveLPAE && ttbcr.eae);
970 ArmFault::TranMethod tranMethod = long_desc_format ? ArmFault::LpaeTran
971 : ArmFault::VmsaTran;
972
973 req->setAsid(asid);
974
975 DPRINTF(TLBVerbose, "CPSR is priv:%d UserMode:%d secure:%d S1S2NsTran:%d\n",
976 isPriv, flags & UserMode, isSecure, tranType & S1S2NsTran);
977
978 DPRINTF(TLB, "translateFs addr %#x, mode %d, st2 %d, scr %#x sctlr %#x "
979 "flags %#x tranType 0x%x\n", vaddr_tainted, mode, isStage2,
980 scr, sctlr, flags, tranType);
981
982 // If this is a clrex instruction, provide a PA of 0 with no fault
983 // This will force the monitor to set the tracked address to 0
984 // a bit of a hack but this effectively clrears this processors monitor
985 if (flags & Request::CLEAR_LL){
986 // @todo: check implications of security extensions
987 req->setPaddr(0);
988 req->setFlags(Request::UNCACHEABLE | Request::STRICT_ORDER);
989 req->setFlags(Request::CLEAR_LL);
990 return NoFault;
991 }
992 if ((req->isInstFetch() && (!sctlr.i)) ||
993 ((!req->isInstFetch()) && (!sctlr.c))){
994 req->setFlags(Request::UNCACHEABLE | Request::STRICT_ORDER);
995 }
996 if (!is_fetch) {
997 assert(flags & MustBeOne);
998 if (sctlr.a || !(flags & AllowUnaligned)) {
999 if (vaddr & mask(flags & AlignmentMask)) {
1000 alignFaults++;
1001 return std::make_shared<DataAbort>(
1002 vaddr_tainted,
1003 TlbEntry::DomainType::NoAccess, is_write,
1004 ArmFault::AlignmentFault, isStage2,
1005 tranMethod);
1006 }
1007 }
1008 }
1009
1010 // If guest MMU is off or hcr.vm=0 go straight to stage2
1011 if ((isStage2 && !hcr.vm) || (!isStage2 && !sctlr.m)) {
1012
1013 req->setPaddr(vaddr);
1014 // When the MMU is off the security attribute corresponds to the
1015 // security state of the processor
1016 if (isSecure)
1017 req->setFlags(Request::SECURE);
1018
1019 // @todo: double check this (ARM ARM issue C B3.2.1)
1020 if (long_desc_format || sctlr.tre == 0) {
1021 req->setFlags(Request::UNCACHEABLE | Request::STRICT_ORDER);
1022 } else {
1023 if (nmrr.ir0 == 0 || nmrr.or0 == 0 || prrr.tr0 != 0x2)
1024 req->setFlags(Request::UNCACHEABLE | Request::STRICT_ORDER);
1025 }
1026
1027 // Set memory attributes
1028 TlbEntry temp_te;
1029 temp_te.ns = !isSecure;
1030 if (isStage2 || hcr.dc == 0 || isSecure ||
1031 (isHyp && !(tranType & S1CTran))) {
1032
1033 temp_te.mtype = is_fetch ? TlbEntry::MemoryType::Normal
1034 : TlbEntry::MemoryType::StronglyOrdered;
1035 temp_te.innerAttrs = 0x0;
1036 temp_te.outerAttrs = 0x0;
1037 temp_te.shareable = true;
1038 temp_te.outerShareable = true;
1039 } else {
1040 temp_te.mtype = TlbEntry::MemoryType::Normal;
1041 temp_te.innerAttrs = 0x3;
1042 temp_te.outerAttrs = 0x3;
1043 temp_te.shareable = false;
1044 temp_te.outerShareable = false;
1045 }
1046 temp_te.setAttributes(long_desc_format);
1047 DPRINTF(TLBVerbose, "(No MMU) setting memory attributes: shareable: "
1048 "%d, innerAttrs: %d, outerAttrs: %d, isStage2: %d\n",
1049 temp_te.shareable, temp_te.innerAttrs, temp_te.outerAttrs,
1050 isStage2);
1051 setAttr(temp_te.attributes);
1052
1053 return trickBoxCheck(req, mode, TlbEntry::DomainType::NoAccess);
1054 }
1055
1056 DPRINTF(TLBVerbose, "Translating %s=%#x context=%d\n",
1057 isStage2 ? "IPA" : "VA", vaddr_tainted, asid);
1058 // Translation enabled
1059
1060 TlbEntry *te = NULL;
1061 TlbEntry mergeTe;
1062 Fault fault = getResultTe(&te, req, tc, mode, translation, timing,
1063 functional, &mergeTe);
1064 // only proceed if we have a valid table entry
1065 if ((te == NULL) && (fault == NoFault)) delay = true;
1066
1067 // If we have the table entry transfer some of the attributes to the
1068 // request that triggered the translation
1069 if (te != NULL) {
1070 // Set memory attributes
1071 DPRINTF(TLBVerbose,
1072 "Setting memory attributes: shareable: %d, innerAttrs: %d, "
1073 "outerAttrs: %d, mtype: %d, isStage2: %d\n",
1074 te->shareable, te->innerAttrs, te->outerAttrs,
1075 static_cast<uint8_t>(te->mtype), isStage2);
1076 setAttr(te->attributes);
1077
1078 if (te->nonCacheable)
| 1/*
2 * Copyright (c) 2010-2013 ARM Limited
3 * All rights reserved
4 *
5 * The license below extends only to copyright in the software and shall
6 * not be construed as granting a license to any other intellectual
7 * property including but not limited to intellectual property relating
8 * to a hardware implementation of the functionality of the software
9 * licensed hereunder. You may use the software subject to the license
10 * terms below provided that you ensure that this notice is replicated
11 * unmodified and in its entirety in all distributions of the software,
12 * modified or unmodified, in source code or in binary form.
13 *
14 * Copyright (c) 2001-2005 The Regents of The University of Michigan
15 * All rights reserved.
16 *
17 * Redistribution and use in source and binary forms, with or without
18 * modification, are permitted provided that the following conditions are
19 * met: redistributions of source code must retain the above copyright
20 * notice, this list of conditions and the following disclaimer;
21 * redistributions in binary form must reproduce the above copyright
22 * notice, this list of conditions and the following disclaimer in the
23 * documentation and/or other materials provided with the distribution;
24 * neither the name of the copyright holders nor the names of its
25 * contributors may be used to endorse or promote products derived from
26 * this software without specific prior written permission.
27 *
28 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
29 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
30 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
31 * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
32 * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
33 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
34 * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
35 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
36 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
37 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
38 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
39 *
40 * Authors: Ali Saidi
41 * Nathan Binkert
42 * Steve Reinhardt
43 */
44
45#include <memory>
46#include <string>
47#include <vector>
48
49#include "arch/arm/faults.hh"
50#include "arch/arm/pagetable.hh"
51#include "arch/arm/system.hh"
52#include "arch/arm/table_walker.hh"
53#include "arch/arm/stage2_lookup.hh"
54#include "arch/arm/stage2_mmu.hh"
55#include "arch/arm/tlb.hh"
56#include "arch/arm/utility.hh"
57#include "base/inifile.hh"
58#include "base/str.hh"
59#include "base/trace.hh"
60#include "cpu/base.hh"
61#include "cpu/thread_context.hh"
62#include "debug/Checkpoint.hh"
63#include "debug/TLB.hh"
64#include "debug/TLBVerbose.hh"
65#include "mem/page_table.hh"
66#include "params/ArmTLB.hh"
67#include "sim/full_system.hh"
68#include "sim/process.hh"
69
70using namespace std;
71using namespace ArmISA;
72
73TLB::TLB(const ArmTLBParams *p)
74 : BaseTLB(p), table(new TlbEntry[p->size]), size(p->size),
75 isStage2(p->is_stage2), stage2Req(false), _attr(0),
76 directToStage2(false), tableWalker(p->walker), stage2Tlb(NULL),
77 stage2Mmu(NULL), rangeMRU(1),
78 aarch64(false), aarch64EL(EL0), isPriv(false), isSecure(false),
79 isHyp(false), asid(0), vmid(0), dacr(0),
80 miscRegValid(false), curTranType(NormalTran)
81{
82 tableWalker->setTlb(this);
83
84 // Cache system-level properties
85 haveLPAE = tableWalker->haveLPAE();
86 haveVirtualization = tableWalker->haveVirtualization();
87 haveLargeAsid64 = tableWalker->haveLargeAsid64();
88}
89
90TLB::~TLB()
91{
92 delete[] table;
93}
94
95void
96TLB::init()
97{
98 if (stage2Mmu && !isStage2)
99 stage2Tlb = stage2Mmu->stage2Tlb();
100}
101
102void
103TLB::setMMU(Stage2MMU *m, MasterID master_id)
104{
105 stage2Mmu = m;
106 tableWalker->setMMU(m, master_id);
107}
108
109bool
110TLB::translateFunctional(ThreadContext *tc, Addr va, Addr &pa)
111{
112 updateMiscReg(tc);
113
114 if (directToStage2) {
115 assert(stage2Tlb);
116 return stage2Tlb->translateFunctional(tc, va, pa);
117 }
118
119 TlbEntry *e = lookup(va, asid, vmid, isHyp, isSecure, true, false,
120 aarch64 ? aarch64EL : EL1);
121 if (!e)
122 return false;
123 pa = e->pAddr(va);
124 return true;
125}
126
127Fault
128TLB::finalizePhysical(RequestPtr req, ThreadContext *tc, Mode mode) const
129{
130 return NoFault;
131}
132
133TlbEntry*
134TLB::lookup(Addr va, uint16_t asn, uint8_t vmid, bool hyp, bool secure,
135 bool functional, bool ignore_asn, uint8_t target_el)
136{
137
138 TlbEntry *retval = NULL;
139
140 // Maintaining LRU array
141 int x = 0;
142 while (retval == NULL && x < size) {
143 if ((!ignore_asn && table[x].match(va, asn, vmid, hyp, secure, false,
144 target_el)) ||
145 (ignore_asn && table[x].match(va, vmid, hyp, secure, target_el))) {
146 // We only move the hit entry ahead when the position is higher
147 // than rangeMRU
148 if (x > rangeMRU && !functional) {
149 TlbEntry tmp_entry = table[x];
150 for(int i = x; i > 0; i--)
151 table[i] = table[i - 1];
152 table[0] = tmp_entry;
153 retval = &table[0];
154 } else {
155 retval = &table[x];
156 }
157 break;
158 }
159 ++x;
160 }
161
162 DPRINTF(TLBVerbose, "Lookup %#x, asn %#x -> %s vmn 0x%x hyp %d secure %d "
163 "ppn %#x size: %#x pa: %#x ap:%d ns:%d nstid:%d g:%d asid: %d "
164 "el: %d\n",
165 va, asn, retval ? "hit" : "miss", vmid, hyp, secure,
166 retval ? retval->pfn : 0, retval ? retval->size : 0,
167 retval ? retval->pAddr(va) : 0, retval ? retval->ap : 0,
168 retval ? retval->ns : 0, retval ? retval->nstid : 0,
169 retval ? retval->global : 0, retval ? retval->asid : 0,
170 retval ? retval->el : 0);
171
172 return retval;
173}
174
175// insert a new TLB entry
176void
177TLB::insert(Addr addr, TlbEntry &entry)
178{
179 DPRINTF(TLB, "Inserting entry into TLB with pfn:%#x size:%#x vpn: %#x"
180 " asid:%d vmid:%d N:%d global:%d valid:%d nc:%d xn:%d"
181 " ap:%#x domain:%#x ns:%d nstid:%d isHyp:%d\n", entry.pfn,
182 entry.size, entry.vpn, entry.asid, entry.vmid, entry.N,
183 entry.global, entry.valid, entry.nonCacheable, entry.xn,
184 entry.ap, static_cast<uint8_t>(entry.domain), entry.ns, entry.nstid,
185 entry.isHyp);
186
187 if (table[size - 1].valid)
188 DPRINTF(TLB, " - Replacing Valid entry %#x, asn %d vmn %d ppn %#x "
189 "size: %#x ap:%d ns:%d nstid:%d g:%d isHyp:%d el: %d\n",
190 table[size-1].vpn << table[size-1].N, table[size-1].asid,
191 table[size-1].vmid, table[size-1].pfn << table[size-1].N,
192 table[size-1].size, table[size-1].ap, table[size-1].ns,
193 table[size-1].nstid, table[size-1].global, table[size-1].isHyp,
194 table[size-1].el);
195
196 //inserting to MRU position and evicting the LRU one
197
198 for (int i = size - 1; i > 0; --i)
199 table[i] = table[i-1];
200 table[0] = entry;
201
202 inserts++;
203 ppRefills->notify(1);
204}
205
206void
207TLB::printTlb() const
208{
209 int x = 0;
210 TlbEntry *te;
211 DPRINTF(TLB, "Current TLB contents:\n");
212 while (x < size) {
213 te = &table[x];
214 if (te->valid)
215 DPRINTF(TLB, " * %s\n", te->print());
216 ++x;
217 }
218}
219
220void
221TLB::flushAllSecurity(bool secure_lookup, uint8_t target_el, bool ignore_el)
222{
223 DPRINTF(TLB, "Flushing all TLB entries (%s lookup)\n",
224 (secure_lookup ? "secure" : "non-secure"));
225 int x = 0;
226 TlbEntry *te;
227 while (x < size) {
228 te = &table[x];
229 if (te->valid && secure_lookup == !te->nstid &&
230 (te->vmid == vmid || secure_lookup) &&
231 checkELMatch(target_el, te->el, ignore_el)) {
232
233 DPRINTF(TLB, " - %s\n", te->print());
234 te->valid = false;
235 flushedEntries++;
236 }
237 ++x;
238 }
239
240 flushTlb++;
241
242 // If there's a second stage TLB (and we're not it) then flush it as well
243 // if we're currently in hyp mode
244 if (!isStage2 && isHyp) {
245 stage2Tlb->flushAllSecurity(secure_lookup, true);
246 }
247}
248
249void
250TLB::flushAllNs(bool hyp, uint8_t target_el, bool ignore_el)
251{
252 DPRINTF(TLB, "Flushing all NS TLB entries (%s lookup)\n",
253 (hyp ? "hyp" : "non-hyp"));
254 int x = 0;
255 TlbEntry *te;
256 while (x < size) {
257 te = &table[x];
258 if (te->valid && te->nstid && te->isHyp == hyp &&
259 checkELMatch(target_el, te->el, ignore_el)) {
260
261 DPRINTF(TLB, " - %s\n", te->print());
262 flushedEntries++;
263 te->valid = false;
264 }
265 ++x;
266 }
267
268 flushTlb++;
269
270 // If there's a second stage TLB (and we're not it) then flush it as well
271 if (!isStage2 && !hyp) {
272 stage2Tlb->flushAllNs(false, true);
273 }
274}
275
276void
277TLB::flushMvaAsid(Addr mva, uint64_t asn, bool secure_lookup, uint8_t target_el)
278{
279 DPRINTF(TLB, "Flushing TLB entries with mva: %#x, asid: %#x "
280 "(%s lookup)\n", mva, asn, (secure_lookup ?
281 "secure" : "non-secure"));
282 _flushMva(mva, asn, secure_lookup, false, false, target_el);
283 flushTlbMvaAsid++;
284}
285
286void
287TLB::flushAsid(uint64_t asn, bool secure_lookup, uint8_t target_el)
288{
289 DPRINTF(TLB, "Flushing TLB entries with asid: %#x (%s lookup)\n", asn,
290 (secure_lookup ? "secure" : "non-secure"));
291
292 int x = 0 ;
293 TlbEntry *te;
294
295 while (x < size) {
296 te = &table[x];
297 if (te->valid && te->asid == asn && secure_lookup == !te->nstid &&
298 (te->vmid == vmid || secure_lookup) &&
299 checkELMatch(target_el, te->el, false)) {
300
301 te->valid = false;
302 DPRINTF(TLB, " - %s\n", te->print());
303 flushedEntries++;
304 }
305 ++x;
306 }
307 flushTlbAsid++;
308}
309
310void
311TLB::flushMva(Addr mva, bool secure_lookup, bool hyp, uint8_t target_el)
312{
313 DPRINTF(TLB, "Flushing TLB entries with mva: %#x (%s lookup)\n", mva,
314 (secure_lookup ? "secure" : "non-secure"));
315 _flushMva(mva, 0xbeef, secure_lookup, hyp, true, target_el);
316 flushTlbMva++;
317}
318
319void
320TLB::_flushMva(Addr mva, uint64_t asn, bool secure_lookup, bool hyp,
321 bool ignore_asn, uint8_t target_el)
322{
323 TlbEntry *te;
324 // D5.7.2: Sign-extend address to 64 bits
325 mva = sext<56>(mva);
326 te = lookup(mva, asn, vmid, hyp, secure_lookup, false, ignore_asn,
327 target_el);
328 while (te != NULL) {
329 if (secure_lookup == !te->nstid) {
330 DPRINTF(TLB, " - %s\n", te->print());
331 te->valid = false;
332 flushedEntries++;
333 }
334 te = lookup(mva, asn, vmid, hyp, secure_lookup, false, ignore_asn,
335 target_el);
336 }
337}
338
339bool
340TLB::checkELMatch(uint8_t target_el, uint8_t tentry_el, bool ignore_el)
341{
342 bool elMatch = true;
343 if (!ignore_el) {
344 if (target_el == 2 || target_el == 3) {
345 elMatch = (tentry_el == target_el);
346 } else {
347 elMatch = (tentry_el == 0) || (tentry_el == 1);
348 }
349 }
350 return elMatch;
351}
352
353void
354TLB::drainResume()
355{
356 // We might have unserialized something or switched CPUs, so make
357 // sure to re-read the misc regs.
358 miscRegValid = false;
359}
360
361void
362TLB::takeOverFrom(BaseTLB *_otlb)
363{
364 TLB *otlb = dynamic_cast<TLB*>(_otlb);
365 /* Make sure we actually have a valid type */
366 if (otlb) {
367 _attr = otlb->_attr;
368 haveLPAE = otlb->haveLPAE;
369 directToStage2 = otlb->directToStage2;
370 stage2Req = otlb->stage2Req;
371
372 /* Sync the stage2 MMU if they exist in both
373 * the old CPU and the new
374 */
375 if (!isStage2 &&
376 stage2Tlb && otlb->stage2Tlb) {
377 stage2Tlb->takeOverFrom(otlb->stage2Tlb);
378 }
379 } else {
380 panic("Incompatible TLB type!");
381 }
382}
383
384void
385TLB::serialize(ostream &os)
386{
387 DPRINTF(Checkpoint, "Serializing Arm TLB\n");
388
389 SERIALIZE_SCALAR(_attr);
390 SERIALIZE_SCALAR(haveLPAE);
391 SERIALIZE_SCALAR(directToStage2);
392 SERIALIZE_SCALAR(stage2Req);
393
394 int num_entries = size;
395 SERIALIZE_SCALAR(num_entries);
396 for(int i = 0; i < size; i++){
397 nameOut(os, csprintf("%s.TlbEntry%d", name(), i));
398 table[i].serialize(os);
399 }
400}
401
402void
403TLB::unserialize(Checkpoint *cp, const string §ion)
404{
405 DPRINTF(Checkpoint, "Unserializing Arm TLB\n");
406
407 UNSERIALIZE_SCALAR(_attr);
408 UNSERIALIZE_SCALAR(haveLPAE);
409 UNSERIALIZE_SCALAR(directToStage2);
410 UNSERIALIZE_SCALAR(stage2Req);
411
412 int num_entries;
413 UNSERIALIZE_SCALAR(num_entries);
414 for(int i = 0; i < min(size, num_entries); i++){
415 table[i].unserialize(cp, csprintf("%s.TlbEntry%d", section, i));
416 }
417}
418
419void
420TLB::regStats()
421{
422 instHits
423 .name(name() + ".inst_hits")
424 .desc("ITB inst hits")
425 ;
426
427 instMisses
428 .name(name() + ".inst_misses")
429 .desc("ITB inst misses")
430 ;
431
432 instAccesses
433 .name(name() + ".inst_accesses")
434 .desc("ITB inst accesses")
435 ;
436
437 readHits
438 .name(name() + ".read_hits")
439 .desc("DTB read hits")
440 ;
441
442 readMisses
443 .name(name() + ".read_misses")
444 .desc("DTB read misses")
445 ;
446
447 readAccesses
448 .name(name() + ".read_accesses")
449 .desc("DTB read accesses")
450 ;
451
452 writeHits
453 .name(name() + ".write_hits")
454 .desc("DTB write hits")
455 ;
456
457 writeMisses
458 .name(name() + ".write_misses")
459 .desc("DTB write misses")
460 ;
461
462 writeAccesses
463 .name(name() + ".write_accesses")
464 .desc("DTB write accesses")
465 ;
466
467 hits
468 .name(name() + ".hits")
469 .desc("DTB hits")
470 ;
471
472 misses
473 .name(name() + ".misses")
474 .desc("DTB misses")
475 ;
476
477 accesses
478 .name(name() + ".accesses")
479 .desc("DTB accesses")
480 ;
481
482 flushTlb
483 .name(name() + ".flush_tlb")
484 .desc("Number of times complete TLB was flushed")
485 ;
486
487 flushTlbMva
488 .name(name() + ".flush_tlb_mva")
489 .desc("Number of times TLB was flushed by MVA")
490 ;
491
492 flushTlbMvaAsid
493 .name(name() + ".flush_tlb_mva_asid")
494 .desc("Number of times TLB was flushed by MVA & ASID")
495 ;
496
497 flushTlbAsid
498 .name(name() + ".flush_tlb_asid")
499 .desc("Number of times TLB was flushed by ASID")
500 ;
501
502 flushedEntries
503 .name(name() + ".flush_entries")
504 .desc("Number of entries that have been flushed from TLB")
505 ;
506
507 alignFaults
508 .name(name() + ".align_faults")
509 .desc("Number of TLB faults due to alignment restrictions")
510 ;
511
512 prefetchFaults
513 .name(name() + ".prefetch_faults")
514 .desc("Number of TLB faults due to prefetch")
515 ;
516
517 domainFaults
518 .name(name() + ".domain_faults")
519 .desc("Number of TLB faults due to domain restrictions")
520 ;
521
522 permsFaults
523 .name(name() + ".perms_faults")
524 .desc("Number of TLB faults due to permissions restrictions")
525 ;
526
527 instAccesses = instHits + instMisses;
528 readAccesses = readHits + readMisses;
529 writeAccesses = writeHits + writeMisses;
530 hits = readHits + writeHits + instHits;
531 misses = readMisses + writeMisses + instMisses;
532 accesses = readAccesses + writeAccesses + instAccesses;
533}
534
535void
536TLB::regProbePoints()
537{
538 ppRefills.reset(new ProbePoints::PMU(getProbeManager(), "Refills"));
539}
540
541Fault
542TLB::translateSe(RequestPtr req, ThreadContext *tc, Mode mode,
543 Translation *translation, bool &delay, bool timing)
544{
545 updateMiscReg(tc);
546 Addr vaddr_tainted = req->getVaddr();
547 Addr vaddr = 0;
548 if (aarch64)
549 vaddr = purifyTaggedAddr(vaddr_tainted, tc, aarch64EL);
550 else
551 vaddr = vaddr_tainted;
552 uint32_t flags = req->getFlags();
553
554 bool is_fetch = (mode == Execute);
555 bool is_write = (mode == Write);
556
557 if (!is_fetch) {
558 assert(flags & MustBeOne);
559 if (sctlr.a || !(flags & AllowUnaligned)) {
560 if (vaddr & mask(flags & AlignmentMask)) {
561 // LPAE is always disabled in SE mode
562 return std::make_shared<DataAbort>(
563 vaddr_tainted,
564 TlbEntry::DomainType::NoAccess, is_write,
565 ArmFault::AlignmentFault, isStage2,
566 ArmFault::VmsaTran);
567 }
568 }
569 }
570
571 Addr paddr;
572 Process *p = tc->getProcessPtr();
573
574 if (!p->pTable->translate(vaddr, paddr))
575 return std::make_shared<GenericPageTableFault>(vaddr_tainted);
576 req->setPaddr(paddr);
577
578 return NoFault;
579}
580
581Fault
582TLB::trickBoxCheck(RequestPtr req, Mode mode, TlbEntry::DomainType domain)
583{
584 return NoFault;
585}
586
587Fault
588TLB::walkTrickBoxCheck(Addr pa, bool is_secure, Addr va, Addr sz, bool is_exec,
589 bool is_write, TlbEntry::DomainType domain, LookupLevel lookup_level)
590{
591 return NoFault;
592}
593
594Fault
595TLB::checkPermissions(TlbEntry *te, RequestPtr req, Mode mode)
596{
597 Addr vaddr = req->getVaddr(); // 32-bit don't have to purify
598 uint32_t flags = req->getFlags();
599 bool is_fetch = (mode == Execute);
600 bool is_write = (mode == Write);
601 bool is_priv = isPriv && !(flags & UserMode);
602
603 // Get the translation type from the actuall table entry
604 ArmFault::TranMethod tranMethod = te->longDescFormat ? ArmFault::LpaeTran
605 : ArmFault::VmsaTran;
606
607 // If this is the second stage of translation and the request is for a
608 // stage 1 page table walk then we need to check the HCR.PTW bit. This
609 // allows us to generate a fault if the request targets an area marked
610 // as a device or strongly ordered.
611 if (isStage2 && req->isPTWalk() && hcr.ptw &&
612 (te->mtype != TlbEntry::MemoryType::Normal)) {
613 return std::make_shared<DataAbort>(
614 vaddr, te->domain, is_write,
615 ArmFault::PermissionLL + te->lookupLevel,
616 isStage2, tranMethod);
617 }
618
619 // Generate an alignment fault for unaligned data accesses to device or
620 // strongly ordered memory
621 if (!is_fetch) {
622 if (te->mtype != TlbEntry::MemoryType::Normal) {
623 if (vaddr & mask(flags & AlignmentMask)) {
624 alignFaults++;
625 return std::make_shared<DataAbort>(
626 vaddr, TlbEntry::DomainType::NoAccess, is_write,
627 ArmFault::AlignmentFault, isStage2,
628 tranMethod);
629 }
630 }
631 }
632
633 if (te->nonCacheable) {
634 // Prevent prefetching from I/O devices.
635 if (req->isPrefetch()) {
636 // Here we can safely use the fault status for the short
637 // desc. format in all cases
638 return std::make_shared<PrefetchAbort>(
639 vaddr, ArmFault::PrefetchUncacheable,
640 isStage2, tranMethod);
641 }
642 }
643
644 if (!te->longDescFormat) {
645 switch ((dacr >> (static_cast<uint8_t>(te->domain) * 2)) & 0x3) {
646 case 0:
647 domainFaults++;
648 DPRINTF(TLB, "TLB Fault: Data abort on domain. DACR: %#x"
649 " domain: %#x write:%d\n", dacr,
650 static_cast<uint8_t>(te->domain), is_write);
651 if (is_fetch)
652 return std::make_shared<PrefetchAbort>(
653 vaddr,
654 ArmFault::DomainLL + te->lookupLevel,
655 isStage2, tranMethod);
656 else
657 return std::make_shared<DataAbort>(
658 vaddr, te->domain, is_write,
659 ArmFault::DomainLL + te->lookupLevel,
660 isStage2, tranMethod);
661 case 1:
662 // Continue with permissions check
663 break;
664 case 2:
665 panic("UNPRED domain\n");
666 case 3:
667 return NoFault;
668 }
669 }
670
671 // The 'ap' variable is AP[2:0] or {AP[2,1],1b'0}, i.e. always three bits
672 uint8_t ap = te->longDescFormat ? te->ap << 1 : te->ap;
673 uint8_t hap = te->hap;
674
675 if (sctlr.afe == 1 || te->longDescFormat)
676 ap |= 1;
677
678 bool abt;
679 bool isWritable = true;
680 // If this is a stage 2 access (eg for reading stage 1 page table entries)
681 // then don't perform the AP permissions check, we stil do the HAP check
682 // below.
683 if (isStage2) {
684 abt = false;
685 } else {
686 switch (ap) {
687 case 0:
688 DPRINTF(TLB, "Access permissions 0, checking rs:%#x\n",
689 (int)sctlr.rs);
690 if (!sctlr.xp) {
691 switch ((int)sctlr.rs) {
692 case 2:
693 abt = is_write;
694 break;
695 case 1:
696 abt = is_write || !is_priv;
697 break;
698 case 0:
699 case 3:
700 default:
701 abt = true;
702 break;
703 }
704 } else {
705 abt = true;
706 }
707 break;
708 case 1:
709 abt = !is_priv;
710 break;
711 case 2:
712 abt = !is_priv && is_write;
713 isWritable = is_priv;
714 break;
715 case 3:
716 abt = false;
717 break;
718 case 4:
719 panic("UNPRED premissions\n");
720 case 5:
721 abt = !is_priv || is_write;
722 isWritable = false;
723 break;
724 case 6:
725 case 7:
726 abt = is_write;
727 isWritable = false;
728 break;
729 default:
730 panic("Unknown permissions %#x\n", ap);
731 }
732 }
733
734 bool hapAbt = is_write ? !(hap & 2) : !(hap & 1);
735 bool xn = te->xn || (isWritable && sctlr.wxn) ||
736 (ap == 3 && sctlr.uwxn && is_priv);
737 if (is_fetch && (abt || xn ||
738 (te->longDescFormat && te->pxn && !is_priv) ||
739 (isSecure && te->ns && scr.sif))) {
740 permsFaults++;
741 DPRINTF(TLB, "TLB Fault: Prefetch abort on permission check. AP:%d "
742 "priv:%d write:%d ns:%d sif:%d sctlr.afe: %d \n",
743 ap, is_priv, is_write, te->ns, scr.sif,sctlr.afe);
744 return std::make_shared<PrefetchAbort>(
745 vaddr,
746 ArmFault::PermissionLL + te->lookupLevel,
747 isStage2, tranMethod);
748 } else if (abt | hapAbt) {
749 permsFaults++;
750 DPRINTF(TLB, "TLB Fault: Data abort on permission check. AP:%d priv:%d"
751 " write:%d\n", ap, is_priv, is_write);
752 return std::make_shared<DataAbort>(
753 vaddr, te->domain, is_write,
754 ArmFault::PermissionLL + te->lookupLevel,
755 isStage2 | !abt, tranMethod);
756 }
757 return NoFault;
758}
759
760
761Fault
762TLB::checkPermissions64(TlbEntry *te, RequestPtr req, Mode mode,
763 ThreadContext *tc)
764{
765 assert(aarch64);
766
767 Addr vaddr_tainted = req->getVaddr();
768 Addr vaddr = purifyTaggedAddr(vaddr_tainted, tc, aarch64EL);
769
770 uint32_t flags = req->getFlags();
771 bool is_fetch = (mode == Execute);
772 bool is_write = (mode == Write);
773 bool is_priv M5_VAR_USED = isPriv && !(flags & UserMode);
774
775 updateMiscReg(tc, curTranType);
776
777 // If this is the second stage of translation and the request is for a
778 // stage 1 page table walk then we need to check the HCR.PTW bit. This
779 // allows us to generate a fault if the request targets an area marked
780 // as a device or strongly ordered.
781 if (isStage2 && req->isPTWalk() && hcr.ptw &&
782 (te->mtype != TlbEntry::MemoryType::Normal)) {
783 return std::make_shared<DataAbort>(
784 vaddr_tainted, te->domain, is_write,
785 ArmFault::PermissionLL + te->lookupLevel,
786 isStage2, ArmFault::LpaeTran);
787 }
788
789 // Generate an alignment fault for unaligned accesses to device or
790 // strongly ordered memory
791 if (!is_fetch) {
792 if (te->mtype != TlbEntry::MemoryType::Normal) {
793 if (vaddr & mask(flags & AlignmentMask)) {
794 alignFaults++;
795 return std::make_shared<DataAbort>(
796 vaddr_tainted,
797 TlbEntry::DomainType::NoAccess, is_write,
798 ArmFault::AlignmentFault, isStage2,
799 ArmFault::LpaeTran);
800 }
801 }
802 }
803
804 if (te->nonCacheable) {
805 // Prevent prefetching from I/O devices.
806 if (req->isPrefetch()) {
807 // Here we can safely use the fault status for the short
808 // desc. format in all cases
809 return std::make_shared<PrefetchAbort>(
810 vaddr_tainted,
811 ArmFault::PrefetchUncacheable,
812 isStage2, ArmFault::LpaeTran);
813 }
814 }
815
816 uint8_t ap = 0x3 & (te->ap); // 2-bit access protection field
817 bool grant = false;
818
819 uint8_t xn = te->xn;
820 uint8_t pxn = te->pxn;
821 bool r = !is_write && !is_fetch;
822 bool w = is_write;
823 bool x = is_fetch;
824 DPRINTF(TLBVerbose, "Checking permissions: ap:%d, xn:%d, pxn:%d, r:%d, "
825 "w:%d, x:%d\n", ap, xn, pxn, r, w, x);
826
827 if (isStage2) {
828 panic("Virtualization in AArch64 state is not supported yet");
829 } else {
830 switch (aarch64EL) {
831 case EL0:
832 {
833 uint8_t perm = (ap << 2) | (xn << 1) | pxn;
834 switch (perm) {
835 case 0:
836 case 1:
837 case 8:
838 case 9:
839 grant = x;
840 break;
841 case 4:
842 case 5:
843 grant = r || w || (x && !sctlr.wxn);
844 break;
845 case 6:
846 case 7:
847 grant = r || w;
848 break;
849 case 12:
850 case 13:
851 grant = r || x;
852 break;
853 case 14:
854 case 15:
855 grant = r;
856 break;
857 default:
858 grant = false;
859 }
860 }
861 break;
862 case EL1:
863 {
864 uint8_t perm = (ap << 2) | (xn << 1) | pxn;
865 switch (perm) {
866 case 0:
867 case 2:
868 grant = r || w || (x && !sctlr.wxn);
869 break;
870 case 1:
871 case 3:
872 case 4:
873 case 5:
874 case 6:
875 case 7:
876 // regions that are writeable at EL0 should not be
877 // executable at EL1
878 grant = r || w;
879 break;
880 case 8:
881 case 10:
882 case 12:
883 case 14:
884 grant = r || x;
885 break;
886 case 9:
887 case 11:
888 case 13:
889 case 15:
890 grant = r;
891 break;
892 default:
893 grant = false;
894 }
895 }
896 break;
897 case EL2:
898 case EL3:
899 {
900 uint8_t perm = (ap & 0x2) | xn;
901 switch (perm) {
902 case 0:
903 grant = r || w || (x && !sctlr.wxn) ;
904 break;
905 case 1:
906 grant = r || w;
907 break;
908 case 2:
909 grant = r || x;
910 break;
911 case 3:
912 grant = r;
913 break;
914 default:
915 grant = false;
916 }
917 }
918 break;
919 }
920 }
921
922 if (!grant) {
923 if (is_fetch) {
924 permsFaults++;
925 DPRINTF(TLB, "TLB Fault: Prefetch abort on permission check. "
926 "AP:%d priv:%d write:%d ns:%d sif:%d "
927 "sctlr.afe: %d\n",
928 ap, is_priv, is_write, te->ns, scr.sif, sctlr.afe);
929 // Use PC value instead of vaddr because vaddr might be aligned to
930 // cache line and should not be the address reported in FAR
931 return std::make_shared<PrefetchAbort>(
932 req->getPC(),
933 ArmFault::PermissionLL + te->lookupLevel,
934 isStage2, ArmFault::LpaeTran);
935 } else {
936 permsFaults++;
937 DPRINTF(TLB, "TLB Fault: Data abort on permission check. AP:%d "
938 "priv:%d write:%d\n", ap, is_priv, is_write);
939 return std::make_shared<DataAbort>(
940 vaddr_tainted, te->domain, is_write,
941 ArmFault::PermissionLL + te->lookupLevel,
942 isStage2, ArmFault::LpaeTran);
943 }
944 }
945
946 return NoFault;
947}
948
949Fault
950TLB::translateFs(RequestPtr req, ThreadContext *tc, Mode mode,
951 Translation *translation, bool &delay, bool timing,
952 TLB::ArmTranslationType tranType, bool functional)
953{
954 // No such thing as a functional timing access
955 assert(!(timing && functional));
956
957 updateMiscReg(tc, tranType);
958
959 Addr vaddr_tainted = req->getVaddr();
960 Addr vaddr = 0;
961 if (aarch64)
962 vaddr = purifyTaggedAddr(vaddr_tainted, tc, aarch64EL);
963 else
964 vaddr = vaddr_tainted;
965 uint32_t flags = req->getFlags();
966
967 bool is_fetch = (mode == Execute);
968 bool is_write = (mode == Write);
969 bool long_desc_format = aarch64 || (haveLPAE && ttbcr.eae);
970 ArmFault::TranMethod tranMethod = long_desc_format ? ArmFault::LpaeTran
971 : ArmFault::VmsaTran;
972
973 req->setAsid(asid);
974
975 DPRINTF(TLBVerbose, "CPSR is priv:%d UserMode:%d secure:%d S1S2NsTran:%d\n",
976 isPriv, flags & UserMode, isSecure, tranType & S1S2NsTran);
977
978 DPRINTF(TLB, "translateFs addr %#x, mode %d, st2 %d, scr %#x sctlr %#x "
979 "flags %#x tranType 0x%x\n", vaddr_tainted, mode, isStage2,
980 scr, sctlr, flags, tranType);
981
982 // If this is a clrex instruction, provide a PA of 0 with no fault
983 // This will force the monitor to set the tracked address to 0
984 // a bit of a hack but this effectively clrears this processors monitor
985 if (flags & Request::CLEAR_LL){
986 // @todo: check implications of security extensions
987 req->setPaddr(0);
988 req->setFlags(Request::UNCACHEABLE | Request::STRICT_ORDER);
989 req->setFlags(Request::CLEAR_LL);
990 return NoFault;
991 }
992 if ((req->isInstFetch() && (!sctlr.i)) ||
993 ((!req->isInstFetch()) && (!sctlr.c))){
994 req->setFlags(Request::UNCACHEABLE | Request::STRICT_ORDER);
995 }
996 if (!is_fetch) {
997 assert(flags & MustBeOne);
998 if (sctlr.a || !(flags & AllowUnaligned)) {
999 if (vaddr & mask(flags & AlignmentMask)) {
1000 alignFaults++;
1001 return std::make_shared<DataAbort>(
1002 vaddr_tainted,
1003 TlbEntry::DomainType::NoAccess, is_write,
1004 ArmFault::AlignmentFault, isStage2,
1005 tranMethod);
1006 }
1007 }
1008 }
1009
1010 // If guest MMU is off or hcr.vm=0 go straight to stage2
1011 if ((isStage2 && !hcr.vm) || (!isStage2 && !sctlr.m)) {
1012
1013 req->setPaddr(vaddr);
1014 // When the MMU is off the security attribute corresponds to the
1015 // security state of the processor
1016 if (isSecure)
1017 req->setFlags(Request::SECURE);
1018
1019 // @todo: double check this (ARM ARM issue C B3.2.1)
1020 if (long_desc_format || sctlr.tre == 0) {
1021 req->setFlags(Request::UNCACHEABLE | Request::STRICT_ORDER);
1022 } else {
1023 if (nmrr.ir0 == 0 || nmrr.or0 == 0 || prrr.tr0 != 0x2)
1024 req->setFlags(Request::UNCACHEABLE | Request::STRICT_ORDER);
1025 }
1026
1027 // Set memory attributes
1028 TlbEntry temp_te;
1029 temp_te.ns = !isSecure;
1030 if (isStage2 || hcr.dc == 0 || isSecure ||
1031 (isHyp && !(tranType & S1CTran))) {
1032
1033 temp_te.mtype = is_fetch ? TlbEntry::MemoryType::Normal
1034 : TlbEntry::MemoryType::StronglyOrdered;
1035 temp_te.innerAttrs = 0x0;
1036 temp_te.outerAttrs = 0x0;
1037 temp_te.shareable = true;
1038 temp_te.outerShareable = true;
1039 } else {
1040 temp_te.mtype = TlbEntry::MemoryType::Normal;
1041 temp_te.innerAttrs = 0x3;
1042 temp_te.outerAttrs = 0x3;
1043 temp_te.shareable = false;
1044 temp_te.outerShareable = false;
1045 }
1046 temp_te.setAttributes(long_desc_format);
1047 DPRINTF(TLBVerbose, "(No MMU) setting memory attributes: shareable: "
1048 "%d, innerAttrs: %d, outerAttrs: %d, isStage2: %d\n",
1049 temp_te.shareable, temp_te.innerAttrs, temp_te.outerAttrs,
1050 isStage2);
1051 setAttr(temp_te.attributes);
1052
1053 return trickBoxCheck(req, mode, TlbEntry::DomainType::NoAccess);
1054 }
1055
1056 DPRINTF(TLBVerbose, "Translating %s=%#x context=%d\n",
1057 isStage2 ? "IPA" : "VA", vaddr_tainted, asid);
1058 // Translation enabled
1059
1060 TlbEntry *te = NULL;
1061 TlbEntry mergeTe;
1062 Fault fault = getResultTe(&te, req, tc, mode, translation, timing,
1063 functional, &mergeTe);
1064 // only proceed if we have a valid table entry
1065 if ((te == NULL) && (fault == NoFault)) delay = true;
1066
1067 // If we have the table entry transfer some of the attributes to the
1068 // request that triggered the translation
1069 if (te != NULL) {
1070 // Set memory attributes
1071 DPRINTF(TLBVerbose,
1072 "Setting memory attributes: shareable: %d, innerAttrs: %d, "
1073 "outerAttrs: %d, mtype: %d, isStage2: %d\n",
1074 te->shareable, te->innerAttrs, te->outerAttrs,
1075 static_cast<uint8_t>(te->mtype), isStage2);
1076 setAttr(te->attributes);
1077
1078 if (te->nonCacheable)
|
1081 Addr pa = te->pAddr(vaddr);
1082 req->setPaddr(pa);
1083
1084 if (isSecure && !te->ns) {
1085 req->setFlags(Request::SECURE);
1086 }
1087 if ((!is_fetch) && (vaddr & mask(flags & AlignmentMask)) &&
1088 (te->mtype != TlbEntry::MemoryType::Normal)) {
1089 // Unaligned accesses to Device memory should always cause an
1090 // abort regardless of sctlr.a
1091 alignFaults++;
1092 return std::make_shared<DataAbort>(
1093 vaddr_tainted,
1094 TlbEntry::DomainType::NoAccess, is_write,
1095 ArmFault::AlignmentFault, isStage2,
1096 tranMethod);
1097 }
1098
1099 // Check for a trickbox generated address fault
1100 if (fault == NoFault) {
1101 fault = trickBoxCheck(req, mode, te->domain);
1102 }
1103 }
1104
1105 // Generate Illegal Inst Set State fault if IL bit is set in CPSR
1106 if (fault == NoFault) {
1107 CPSR cpsr = tc->readMiscReg(MISCREG_CPSR);
1108 if (aarch64 && is_fetch && cpsr.il == 1) {
1109 return std::make_shared<IllegalInstSetStateFault>();
1110 }
1111 }
1112
1113 return fault;
1114}
1115
1116Fault
1117TLB::translateAtomic(RequestPtr req, ThreadContext *tc, Mode mode,
1118 TLB::ArmTranslationType tranType)
1119{
1120 updateMiscReg(tc, tranType);
1121
1122 if (directToStage2) {
1123 assert(stage2Tlb);
1124 return stage2Tlb->translateAtomic(req, tc, mode, tranType);
1125 }
1126
1127 bool delay = false;
1128 Fault fault;
1129 if (FullSystem)
1130 fault = translateFs(req, tc, mode, NULL, delay, false, tranType);
1131 else
1132 fault = translateSe(req, tc, mode, NULL, delay, false);
1133 assert(!delay);
1134 return fault;
1135}
1136
1137Fault
1138TLB::translateFunctional(RequestPtr req, ThreadContext *tc, Mode mode,
1139 TLB::ArmTranslationType tranType)
1140{
1141 updateMiscReg(tc, tranType);
1142
1143 if (directToStage2) {
1144 assert(stage2Tlb);
1145 return stage2Tlb->translateFunctional(req, tc, mode, tranType);
1146 }
1147
1148 bool delay = false;
1149 Fault fault;
1150 if (FullSystem)
1151 fault = translateFs(req, tc, mode, NULL, delay, false, tranType, true);
1152 else
1153 fault = translateSe(req, tc, mode, NULL, delay, false);
1154 assert(!delay);
1155 return fault;
1156}
1157
1158Fault
1159TLB::translateTiming(RequestPtr req, ThreadContext *tc,
1160 Translation *translation, Mode mode, TLB::ArmTranslationType tranType)
1161{
1162 updateMiscReg(tc, tranType);
1163
1164 if (directToStage2) {
1165 assert(stage2Tlb);
1166 return stage2Tlb->translateTiming(req, tc, translation, mode, tranType);
1167 }
1168
1169 assert(translation);
1170
1171 return translateComplete(req, tc, translation, mode, tranType, isStage2);
1172}
1173
1174Fault
1175TLB::translateComplete(RequestPtr req, ThreadContext *tc,
1176 Translation *translation, Mode mode, TLB::ArmTranslationType tranType,
1177 bool callFromS2)
1178{
1179 bool delay = false;
1180 Fault fault;
1181 if (FullSystem)
1182 fault = translateFs(req, tc, mode, translation, delay, true, tranType);
1183 else
1184 fault = translateSe(req, tc, mode, translation, delay, true);
1185 DPRINTF(TLBVerbose, "Translation returning delay=%d fault=%d\n", delay, fault !=
1186 NoFault);
1187 // If we have a translation, and we're not in the middle of doing a stage
1188 // 2 translation tell the translation that we've either finished or its
1189 // going to take a while. By not doing this when we're in the middle of a
1190 // stage 2 translation we prevent marking the translation as delayed twice,
1191 // one when the translation starts and again when the stage 1 translation
1192 // completes.
1193 if (translation && (callFromS2 || !stage2Req || req->hasPaddr() || fault != NoFault)) {
1194 if (!delay)
1195 translation->finish(fault, req, tc, mode);
1196 else
1197 translation->markDelayed();
1198 }
1199 return fault;
1200}
1201
1202BaseMasterPort*
1203TLB::getMasterPort()
1204{
1205 return &stage2Mmu->getPort();
1206}
1207
1208void
1209TLB::updateMiscReg(ThreadContext *tc, ArmTranslationType tranType)
1210{
1211 // check if the regs have changed, or the translation mode is different.
1212 // NOTE: the tran type doesn't affect stage 2 TLB's as they only handle
1213 // one type of translation anyway
1214 if (miscRegValid && ((tranType == curTranType) || isStage2)) {
1215 return;
1216 }
1217
1218 DPRINTF(TLBVerbose, "TLB variables changed!\n");
1219 CPSR cpsr = tc->readMiscReg(MISCREG_CPSR);
1220 // Dependencies: SCR/SCR_EL3, CPSR
1221 isSecure = inSecureState(tc);
1222 isSecure &= (tranType & HypMode) == 0;
1223 isSecure &= (tranType & S1S2NsTran) == 0;
1224 aarch64 = !cpsr.width;
1225 if (aarch64) { // AArch64
1226 aarch64EL = (ExceptionLevel) (uint8_t) cpsr.el;
1227 switch (aarch64EL) {
1228 case EL0:
1229 case EL1:
1230 {
1231 sctlr = tc->readMiscReg(MISCREG_SCTLR_EL1);
1232 ttbcr = tc->readMiscReg(MISCREG_TCR_EL1);
1233 uint64_t ttbr_asid = ttbcr.a1 ?
1234 tc->readMiscReg(MISCREG_TTBR1_EL1) :
1235 tc->readMiscReg(MISCREG_TTBR0_EL1);
1236 asid = bits(ttbr_asid,
1237 (haveLargeAsid64 && ttbcr.as) ? 63 : 55, 48);
1238 }
1239 break;
1240 case EL2:
1241 sctlr = tc->readMiscReg(MISCREG_SCTLR_EL2);
1242 ttbcr = tc->readMiscReg(MISCREG_TCR_EL2);
1243 asid = -1;
1244 break;
1245 case EL3:
1246 sctlr = tc->readMiscReg(MISCREG_SCTLR_EL3);
1247 ttbcr = tc->readMiscReg(MISCREG_TCR_EL3);
1248 asid = -1;
1249 break;
1250 }
1251 scr = tc->readMiscReg(MISCREG_SCR_EL3);
1252 isPriv = aarch64EL != EL0;
1253 // @todo: modify this behaviour to support Virtualization in
1254 // AArch64
1255 vmid = 0;
1256 isHyp = false;
1257 directToStage2 = false;
1258 stage2Req = false;
1259 } else { // AArch32
1260 sctlr = tc->readMiscReg(flattenMiscRegNsBanked(MISCREG_SCTLR, tc,
1261 !isSecure));
1262 ttbcr = tc->readMiscReg(flattenMiscRegNsBanked(MISCREG_TTBCR, tc,
1263 !isSecure));
1264 scr = tc->readMiscReg(MISCREG_SCR);
1265 isPriv = cpsr.mode != MODE_USER;
1266 if (haveLPAE && ttbcr.eae) {
1267 // Long-descriptor translation table format in use
1268 uint64_t ttbr_asid = tc->readMiscReg(
1269 flattenMiscRegNsBanked(ttbcr.a1 ? MISCREG_TTBR1
1270 : MISCREG_TTBR0,
1271 tc, !isSecure));
1272 asid = bits(ttbr_asid, 55, 48);
1273 } else {
1274 // Short-descriptor translation table format in use
1275 CONTEXTIDR context_id = tc->readMiscReg(flattenMiscRegNsBanked(
1276 MISCREG_CONTEXTIDR, tc,!isSecure));
1277 asid = context_id.asid;
1278 }
1279 prrr = tc->readMiscReg(flattenMiscRegNsBanked(MISCREG_PRRR, tc,
1280 !isSecure));
1281 nmrr = tc->readMiscReg(flattenMiscRegNsBanked(MISCREG_NMRR, tc,
1282 !isSecure));
1283 dacr = tc->readMiscReg(flattenMiscRegNsBanked(MISCREG_DACR, tc,
1284 !isSecure));
1285 hcr = tc->readMiscReg(MISCREG_HCR);
1286
1287 if (haveVirtualization) {
1288 vmid = bits(tc->readMiscReg(MISCREG_VTTBR), 55, 48);
1289 isHyp = cpsr.mode == MODE_HYP;
1290 isHyp |= tranType & HypMode;
1291 isHyp &= (tranType & S1S2NsTran) == 0;
1292 isHyp &= (tranType & S1CTran) == 0;
1293 if (isHyp) {
1294 sctlr = tc->readMiscReg(MISCREG_HSCTLR);
1295 }
1296 // Work out if we should skip the first stage of translation and go
1297 // directly to stage 2. This value is cached so we don't have to
1298 // compute it for every translation.
1299 stage2Req = hcr.vm && !isStage2 && !isHyp && !isSecure &&
1300 !(tranType & S1CTran);
1301 directToStage2 = stage2Req && !sctlr.m;
1302 } else {
1303 vmid = 0;
1304 stage2Req = false;
1305 isHyp = false;
1306 directToStage2 = false;
1307 }
1308 }
1309 miscRegValid = true;
1310 curTranType = tranType;
1311}
1312
1313Fault
1314TLB::getTE(TlbEntry **te, RequestPtr req, ThreadContext *tc, Mode mode,
1315 Translation *translation, bool timing, bool functional,
1316 bool is_secure, TLB::ArmTranslationType tranType)
1317{
1318 bool is_fetch = (mode == Execute);
1319 bool is_write = (mode == Write);
1320
1321 Addr vaddr_tainted = req->getVaddr();
1322 Addr vaddr = 0;
1323 ExceptionLevel target_el = aarch64 ? aarch64EL : EL1;
1324 if (aarch64) {
1325 vaddr = purifyTaggedAddr(vaddr_tainted, tc, target_el);
1326 } else {
1327 vaddr = vaddr_tainted;
1328 }
1329 *te = lookup(vaddr, asid, vmid, isHyp, is_secure, false, false, target_el);
1330 if (*te == NULL) {
1331 if (req->isPrefetch()) {
1332 // if the request is a prefetch don't attempt to fill the TLB or go
1333 // any further with the memory access (here we can safely use the
1334 // fault status for the short desc. format in all cases)
1335 prefetchFaults++;
1336 return std::make_shared<PrefetchAbort>(
1337 vaddr_tainted, ArmFault::PrefetchTLBMiss, isStage2);
1338 }
1339
1340 if (is_fetch)
1341 instMisses++;
1342 else if (is_write)
1343 writeMisses++;
1344 else
1345 readMisses++;
1346
1347 // start translation table walk, pass variables rather than
1348 // re-retreaving in table walker for speed
1349 DPRINTF(TLB, "TLB Miss: Starting hardware table walker for %#x(%d:%d)\n",
1350 vaddr_tainted, asid, vmid);
1351 Fault fault;
1352 fault = tableWalker->walk(req, tc, asid, vmid, isHyp, mode,
1353 translation, timing, functional, is_secure,
1354 tranType);
1355 // for timing mode, return and wait for table walk,
1356 if (timing || fault != NoFault) {
1357 return fault;
1358 }
1359
1360 *te = lookup(vaddr, asid, vmid, isHyp, is_secure, false, false, target_el);
1361 if (!*te)
1362 printTlb();
1363 assert(*te);
1364 } else {
1365 if (is_fetch)
1366 instHits++;
1367 else if (is_write)
1368 writeHits++;
1369 else
1370 readHits++;
1371 }
1372 return NoFault;
1373}
1374
1375Fault
1376TLB::getResultTe(TlbEntry **te, RequestPtr req, ThreadContext *tc, Mode mode,
1377 Translation *translation, bool timing, bool functional,
1378 TlbEntry *mergeTe)
1379{
1380 Fault fault;
1381 TlbEntry *s1Te = NULL;
1382
1383 Addr vaddr_tainted = req->getVaddr();
1384
1385 // Get the stage 1 table entry
1386 fault = getTE(&s1Te, req, tc, mode, translation, timing, functional,
1387 isSecure, curTranType);
1388 // only proceed if we have a valid table entry
1389 if ((s1Te != NULL) && (fault == NoFault)) {
1390 // Check stage 1 permissions before checking stage 2
1391 if (aarch64)
1392 fault = checkPermissions64(s1Te, req, mode, tc);
1393 else
1394 fault = checkPermissions(s1Te, req, mode);
1395 if (stage2Req & (fault == NoFault)) {
1396 Stage2LookUp *s2Lookup = new Stage2LookUp(this, stage2Tlb, *s1Te,
1397 req, translation, mode, timing, functional, curTranType);
1398 fault = s2Lookup->getTe(tc, mergeTe);
1399 if (s2Lookup->isComplete()) {
1400 *te = mergeTe;
1401 // We've finished with the lookup so delete it
1402 delete s2Lookup;
1403 } else {
1404 // The lookup hasn't completed, so we can't delete it now. We
1405 // get round this by asking the object to self delete when the
1406 // translation is complete.
1407 s2Lookup->setSelfDelete();
1408 }
1409 } else {
1410 // This case deals with an S1 hit (or bypass), followed by
1411 // an S2 hit-but-perms issue
1412 if (isStage2) {
1413 DPRINTF(TLBVerbose, "s2TLB: reqVa %#x, reqPa %#x, fault %p\n",
1414 vaddr_tainted, req->hasPaddr() ? req->getPaddr() : ~0, fault);
1415 if (fault != NoFault) {
1416 ArmFault *armFault = reinterpret_cast<ArmFault *>(fault.get());
1417 armFault->annotate(ArmFault::S1PTW, false);
1418 armFault->annotate(ArmFault::OVA, vaddr_tainted);
1419 }
1420 }
1421 *te = s1Te;
1422 }
1423 }
1424 return fault;
1425}
1426
1427ArmISA::TLB *
1428ArmTLBParams::create()
1429{
1430 return new ArmISA::TLB(this);
1431}
| 1087 Addr pa = te->pAddr(vaddr);
1088 req->setPaddr(pa);
1089
1090 if (isSecure && !te->ns) {
1091 req->setFlags(Request::SECURE);
1092 }
1093 if ((!is_fetch) && (vaddr & mask(flags & AlignmentMask)) &&
1094 (te->mtype != TlbEntry::MemoryType::Normal)) {
1095 // Unaligned accesses to Device memory should always cause an
1096 // abort regardless of sctlr.a
1097 alignFaults++;
1098 return std::make_shared<DataAbort>(
1099 vaddr_tainted,
1100 TlbEntry::DomainType::NoAccess, is_write,
1101 ArmFault::AlignmentFault, isStage2,
1102 tranMethod);
1103 }
1104
1105 // Check for a trickbox generated address fault
1106 if (fault == NoFault) {
1107 fault = trickBoxCheck(req, mode, te->domain);
1108 }
1109 }
1110
1111 // Generate Illegal Inst Set State fault if IL bit is set in CPSR
1112 if (fault == NoFault) {
1113 CPSR cpsr = tc->readMiscReg(MISCREG_CPSR);
1114 if (aarch64 && is_fetch && cpsr.il == 1) {
1115 return std::make_shared<IllegalInstSetStateFault>();
1116 }
1117 }
1118
1119 return fault;
1120}
1121
1122Fault
1123TLB::translateAtomic(RequestPtr req, ThreadContext *tc, Mode mode,
1124 TLB::ArmTranslationType tranType)
1125{
1126 updateMiscReg(tc, tranType);
1127
1128 if (directToStage2) {
1129 assert(stage2Tlb);
1130 return stage2Tlb->translateAtomic(req, tc, mode, tranType);
1131 }
1132
1133 bool delay = false;
1134 Fault fault;
1135 if (FullSystem)
1136 fault = translateFs(req, tc, mode, NULL, delay, false, tranType);
1137 else
1138 fault = translateSe(req, tc, mode, NULL, delay, false);
1139 assert(!delay);
1140 return fault;
1141}
1142
1143Fault
1144TLB::translateFunctional(RequestPtr req, ThreadContext *tc, Mode mode,
1145 TLB::ArmTranslationType tranType)
1146{
1147 updateMiscReg(tc, tranType);
1148
1149 if (directToStage2) {
1150 assert(stage2Tlb);
1151 return stage2Tlb->translateFunctional(req, tc, mode, tranType);
1152 }
1153
1154 bool delay = false;
1155 Fault fault;
1156 if (FullSystem)
1157 fault = translateFs(req, tc, mode, NULL, delay, false, tranType, true);
1158 else
1159 fault = translateSe(req, tc, mode, NULL, delay, false);
1160 assert(!delay);
1161 return fault;
1162}
1163
1164Fault
1165TLB::translateTiming(RequestPtr req, ThreadContext *tc,
1166 Translation *translation, Mode mode, TLB::ArmTranslationType tranType)
1167{
1168 updateMiscReg(tc, tranType);
1169
1170 if (directToStage2) {
1171 assert(stage2Tlb);
1172 return stage2Tlb->translateTiming(req, tc, translation, mode, tranType);
1173 }
1174
1175 assert(translation);
1176
1177 return translateComplete(req, tc, translation, mode, tranType, isStage2);
1178}
1179
1180Fault
1181TLB::translateComplete(RequestPtr req, ThreadContext *tc,
1182 Translation *translation, Mode mode, TLB::ArmTranslationType tranType,
1183 bool callFromS2)
1184{
1185 bool delay = false;
1186 Fault fault;
1187 if (FullSystem)
1188 fault = translateFs(req, tc, mode, translation, delay, true, tranType);
1189 else
1190 fault = translateSe(req, tc, mode, translation, delay, true);
1191 DPRINTF(TLBVerbose, "Translation returning delay=%d fault=%d\n", delay, fault !=
1192 NoFault);
1193 // If we have a translation, and we're not in the middle of doing a stage
1194 // 2 translation tell the translation that we've either finished or its
1195 // going to take a while. By not doing this when we're in the middle of a
1196 // stage 2 translation we prevent marking the translation as delayed twice,
1197 // one when the translation starts and again when the stage 1 translation
1198 // completes.
1199 if (translation && (callFromS2 || !stage2Req || req->hasPaddr() || fault != NoFault)) {
1200 if (!delay)
1201 translation->finish(fault, req, tc, mode);
1202 else
1203 translation->markDelayed();
1204 }
1205 return fault;
1206}
1207
1208BaseMasterPort*
1209TLB::getMasterPort()
1210{
1211 return &stage2Mmu->getPort();
1212}
1213
1214void
1215TLB::updateMiscReg(ThreadContext *tc, ArmTranslationType tranType)
1216{
1217 // check if the regs have changed, or the translation mode is different.
1218 // NOTE: the tran type doesn't affect stage 2 TLB's as they only handle
1219 // one type of translation anyway
1220 if (miscRegValid && ((tranType == curTranType) || isStage2)) {
1221 return;
1222 }
1223
1224 DPRINTF(TLBVerbose, "TLB variables changed!\n");
1225 CPSR cpsr = tc->readMiscReg(MISCREG_CPSR);
1226 // Dependencies: SCR/SCR_EL3, CPSR
1227 isSecure = inSecureState(tc);
1228 isSecure &= (tranType & HypMode) == 0;
1229 isSecure &= (tranType & S1S2NsTran) == 0;
1230 aarch64 = !cpsr.width;
1231 if (aarch64) { // AArch64
1232 aarch64EL = (ExceptionLevel) (uint8_t) cpsr.el;
1233 switch (aarch64EL) {
1234 case EL0:
1235 case EL1:
1236 {
1237 sctlr = tc->readMiscReg(MISCREG_SCTLR_EL1);
1238 ttbcr = tc->readMiscReg(MISCREG_TCR_EL1);
1239 uint64_t ttbr_asid = ttbcr.a1 ?
1240 tc->readMiscReg(MISCREG_TTBR1_EL1) :
1241 tc->readMiscReg(MISCREG_TTBR0_EL1);
1242 asid = bits(ttbr_asid,
1243 (haveLargeAsid64 && ttbcr.as) ? 63 : 55, 48);
1244 }
1245 break;
1246 case EL2:
1247 sctlr = tc->readMiscReg(MISCREG_SCTLR_EL2);
1248 ttbcr = tc->readMiscReg(MISCREG_TCR_EL2);
1249 asid = -1;
1250 break;
1251 case EL3:
1252 sctlr = tc->readMiscReg(MISCREG_SCTLR_EL3);
1253 ttbcr = tc->readMiscReg(MISCREG_TCR_EL3);
1254 asid = -1;
1255 break;
1256 }
1257 scr = tc->readMiscReg(MISCREG_SCR_EL3);
1258 isPriv = aarch64EL != EL0;
1259 // @todo: modify this behaviour to support Virtualization in
1260 // AArch64
1261 vmid = 0;
1262 isHyp = false;
1263 directToStage2 = false;
1264 stage2Req = false;
1265 } else { // AArch32
1266 sctlr = tc->readMiscReg(flattenMiscRegNsBanked(MISCREG_SCTLR, tc,
1267 !isSecure));
1268 ttbcr = tc->readMiscReg(flattenMiscRegNsBanked(MISCREG_TTBCR, tc,
1269 !isSecure));
1270 scr = tc->readMiscReg(MISCREG_SCR);
1271 isPriv = cpsr.mode != MODE_USER;
1272 if (haveLPAE && ttbcr.eae) {
1273 // Long-descriptor translation table format in use
1274 uint64_t ttbr_asid = tc->readMiscReg(
1275 flattenMiscRegNsBanked(ttbcr.a1 ? MISCREG_TTBR1
1276 : MISCREG_TTBR0,
1277 tc, !isSecure));
1278 asid = bits(ttbr_asid, 55, 48);
1279 } else {
1280 // Short-descriptor translation table format in use
1281 CONTEXTIDR context_id = tc->readMiscReg(flattenMiscRegNsBanked(
1282 MISCREG_CONTEXTIDR, tc,!isSecure));
1283 asid = context_id.asid;
1284 }
1285 prrr = tc->readMiscReg(flattenMiscRegNsBanked(MISCREG_PRRR, tc,
1286 !isSecure));
1287 nmrr = tc->readMiscReg(flattenMiscRegNsBanked(MISCREG_NMRR, tc,
1288 !isSecure));
1289 dacr = tc->readMiscReg(flattenMiscRegNsBanked(MISCREG_DACR, tc,
1290 !isSecure));
1291 hcr = tc->readMiscReg(MISCREG_HCR);
1292
1293 if (haveVirtualization) {
1294 vmid = bits(tc->readMiscReg(MISCREG_VTTBR), 55, 48);
1295 isHyp = cpsr.mode == MODE_HYP;
1296 isHyp |= tranType & HypMode;
1297 isHyp &= (tranType & S1S2NsTran) == 0;
1298 isHyp &= (tranType & S1CTran) == 0;
1299 if (isHyp) {
1300 sctlr = tc->readMiscReg(MISCREG_HSCTLR);
1301 }
1302 // Work out if we should skip the first stage of translation and go
1303 // directly to stage 2. This value is cached so we don't have to
1304 // compute it for every translation.
1305 stage2Req = hcr.vm && !isStage2 && !isHyp && !isSecure &&
1306 !(tranType & S1CTran);
1307 directToStage2 = stage2Req && !sctlr.m;
1308 } else {
1309 vmid = 0;
1310 stage2Req = false;
1311 isHyp = false;
1312 directToStage2 = false;
1313 }
1314 }
1315 miscRegValid = true;
1316 curTranType = tranType;
1317}
1318
1319Fault
1320TLB::getTE(TlbEntry **te, RequestPtr req, ThreadContext *tc, Mode mode,
1321 Translation *translation, bool timing, bool functional,
1322 bool is_secure, TLB::ArmTranslationType tranType)
1323{
1324 bool is_fetch = (mode == Execute);
1325 bool is_write = (mode == Write);
1326
1327 Addr vaddr_tainted = req->getVaddr();
1328 Addr vaddr = 0;
1329 ExceptionLevel target_el = aarch64 ? aarch64EL : EL1;
1330 if (aarch64) {
1331 vaddr = purifyTaggedAddr(vaddr_tainted, tc, target_el);
1332 } else {
1333 vaddr = vaddr_tainted;
1334 }
1335 *te = lookup(vaddr, asid, vmid, isHyp, is_secure, false, false, target_el);
1336 if (*te == NULL) {
1337 if (req->isPrefetch()) {
1338 // if the request is a prefetch don't attempt to fill the TLB or go
1339 // any further with the memory access (here we can safely use the
1340 // fault status for the short desc. format in all cases)
1341 prefetchFaults++;
1342 return std::make_shared<PrefetchAbort>(
1343 vaddr_tainted, ArmFault::PrefetchTLBMiss, isStage2);
1344 }
1345
1346 if (is_fetch)
1347 instMisses++;
1348 else if (is_write)
1349 writeMisses++;
1350 else
1351 readMisses++;
1352
1353 // start translation table walk, pass variables rather than
1354 // re-retreaving in table walker for speed
1355 DPRINTF(TLB, "TLB Miss: Starting hardware table walker for %#x(%d:%d)\n",
1356 vaddr_tainted, asid, vmid);
1357 Fault fault;
1358 fault = tableWalker->walk(req, tc, asid, vmid, isHyp, mode,
1359 translation, timing, functional, is_secure,
1360 tranType);
1361 // for timing mode, return and wait for table walk,
1362 if (timing || fault != NoFault) {
1363 return fault;
1364 }
1365
1366 *te = lookup(vaddr, asid, vmid, isHyp, is_secure, false, false, target_el);
1367 if (!*te)
1368 printTlb();
1369 assert(*te);
1370 } else {
1371 if (is_fetch)
1372 instHits++;
1373 else if (is_write)
1374 writeHits++;
1375 else
1376 readHits++;
1377 }
1378 return NoFault;
1379}
1380
1381Fault
1382TLB::getResultTe(TlbEntry **te, RequestPtr req, ThreadContext *tc, Mode mode,
1383 Translation *translation, bool timing, bool functional,
1384 TlbEntry *mergeTe)
1385{
1386 Fault fault;
1387 TlbEntry *s1Te = NULL;
1388
1389 Addr vaddr_tainted = req->getVaddr();
1390
1391 // Get the stage 1 table entry
1392 fault = getTE(&s1Te, req, tc, mode, translation, timing, functional,
1393 isSecure, curTranType);
1394 // only proceed if we have a valid table entry
1395 if ((s1Te != NULL) && (fault == NoFault)) {
1396 // Check stage 1 permissions before checking stage 2
1397 if (aarch64)
1398 fault = checkPermissions64(s1Te, req, mode, tc);
1399 else
1400 fault = checkPermissions(s1Te, req, mode);
1401 if (stage2Req & (fault == NoFault)) {
1402 Stage2LookUp *s2Lookup = new Stage2LookUp(this, stage2Tlb, *s1Te,
1403 req, translation, mode, timing, functional, curTranType);
1404 fault = s2Lookup->getTe(tc, mergeTe);
1405 if (s2Lookup->isComplete()) {
1406 *te = mergeTe;
1407 // We've finished with the lookup so delete it
1408 delete s2Lookup;
1409 } else {
1410 // The lookup hasn't completed, so we can't delete it now. We
1411 // get round this by asking the object to self delete when the
1412 // translation is complete.
1413 s2Lookup->setSelfDelete();
1414 }
1415 } else {
1416 // This case deals with an S1 hit (or bypass), followed by
1417 // an S2 hit-but-perms issue
1418 if (isStage2) {
1419 DPRINTF(TLBVerbose, "s2TLB: reqVa %#x, reqPa %#x, fault %p\n",
1420 vaddr_tainted, req->hasPaddr() ? req->getPaddr() : ~0, fault);
1421 if (fault != NoFault) {
1422 ArmFault *armFault = reinterpret_cast<ArmFault *>(fault.get());
1423 armFault->annotate(ArmFault::S1PTW, false);
1424 armFault->annotate(ArmFault::OVA, vaddr_tainted);
1425 }
1426 }
1427 *te = s1Te;
1428 }
1429 }
1430 return fault;
1431}
1432
1433ArmISA::TLB *
1434ArmTLBParams::create()
1435{
1436 return new ArmISA::TLB(this);
1437}
|