1/*
2 * Copyright (c) 2010-2013, 2016 ARM Limited
3 * All rights reserved
4 *
5 * The license below extends only to copyright in the software and shall
6 * not be construed as granting a license to any other intellectual
7 * property including but not limited to intellectual property relating
8 * to a hardware implementation of the functionality of the software
9 * licensed hereunder. You may use the software subject to the license
10 * terms below provided that you ensure that this notice is replicated
11 * unmodified and in its entirety in all distributions of the software,
12 * modified or unmodified, in source code or in binary form.
13 *
14 * Copyright (c) 2001-2005 The Regents of The University of Michigan
15 * All rights reserved.
16 *
17 * Redistribution and use in source and binary forms, with or without
18 * modification, are permitted provided that the following conditions are
19 * met: redistributions of source code must retain the above copyright
20 * notice, this list of conditions and the following disclaimer;
21 * redistributions in binary form must reproduce the above copyright
22 * notice, this list of conditions and the following disclaimer in the
23 * documentation and/or other materials provided with the distribution;
24 * neither the name of the copyright holders nor the names of its
25 * contributors may be used to endorse or promote products derived from
26 * this software without specific prior written permission.
27 *
28 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
29 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
30 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
31 * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
32 * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
33 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
34 * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
35 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
36 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
37 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
38 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
39 *
40 * Authors: Ali Saidi
41 * Nathan Binkert
42 * Steve Reinhardt
43 */
44
45#include "arch/arm/tlb.hh"
46
47#include <memory>
48#include <string>
49#include <vector>
50
51#include "arch/arm/faults.hh"
52#include "arch/arm/pagetable.hh"
53#include "arch/arm/system.hh"
54#include "arch/arm/table_walker.hh"
55#include "arch/arm/stage2_lookup.hh"
56#include "arch/arm/stage2_mmu.hh"
57#include "arch/arm/utility.hh"
58#include "base/inifile.hh"
59#include "base/str.hh"
60#include "base/trace.hh"
61#include "cpu/base.hh"
62#include "cpu/thread_context.hh"
63#include "debug/Checkpoint.hh"
64#include "debug/TLB.hh"
65#include "debug/TLBVerbose.hh"
66#include "mem/page_table.hh"
67#include "params/ArmTLB.hh"
68#include "sim/full_system.hh"
69#include "sim/process.hh"
70
71using namespace std;
72using namespace ArmISA;
73
74TLB::TLB(const ArmTLBParams *p)
75 : BaseTLB(p), table(new TlbEntry[p->size]), size(p->size),
76 isStage2(p->is_stage2), stage2Req(false), _attr(0),
77 directToStage2(false), tableWalker(p->walker), stage2Tlb(NULL),
78 stage2Mmu(NULL), test(nullptr), rangeMRU(1),
79 aarch64(false), aarch64EL(EL0), isPriv(false), isSecure(false),
80 isHyp(false), asid(0), vmid(0), dacr(0),
81 miscRegValid(false), miscRegContext(0), curTranType(NormalTran)
82{
83 tableWalker->setTlb(this);
84
85 // Cache system-level properties
86 haveLPAE = tableWalker->haveLPAE();
87 haveVirtualization = tableWalker->haveVirtualization();
88 haveLargeAsid64 = tableWalker->haveLargeAsid64();
89}
90
91TLB::~TLB()
92{
93 delete[] table;
94}
95
96void
97TLB::init()
98{
99 if (stage2Mmu && !isStage2)
100 stage2Tlb = stage2Mmu->stage2Tlb();
101}
102
103void
104TLB::setMMU(Stage2MMU *m, MasterID master_id)
105{
106 stage2Mmu = m;
107 tableWalker->setMMU(m, master_id);
108}
109
110bool
111TLB::translateFunctional(ThreadContext *tc, Addr va, Addr &pa)
112{
113 updateMiscReg(tc);
114
115 if (directToStage2) {
116 assert(stage2Tlb);
117 return stage2Tlb->translateFunctional(tc, va, pa);
118 }
119
120 TlbEntry *e = lookup(va, asid, vmid, isHyp, isSecure, true, false,
121 aarch64 ? aarch64EL : EL1);
122 if (!e)
123 return false;
124 pa = e->pAddr(va);
125 return true;
126}
127
128Fault
129TLB::finalizePhysical(RequestPtr req, ThreadContext *tc, Mode mode) const
130{
131 return NoFault;
132}
133
134TlbEntry*
135TLB::lookup(Addr va, uint16_t asn, uint8_t vmid, bool hyp, bool secure,
136 bool functional, bool ignore_asn, uint8_t target_el)
137{
138
139 TlbEntry *retval = NULL;
140
141 // Maintaining LRU array
142 int x = 0;
143 while (retval == NULL && x < size) {
144 if ((!ignore_asn && table[x].match(va, asn, vmid, hyp, secure, false,
145 target_el)) ||
146 (ignore_asn && table[x].match(va, vmid, hyp, secure, target_el))) {
147 // We only move the hit entry ahead when the position is higher
148 // than rangeMRU
149 if (x > rangeMRU && !functional) {
150 TlbEntry tmp_entry = table[x];
151 for (int i = x; i > 0; i--)
152 table[i] = table[i - 1];
153 table[0] = tmp_entry;
154 retval = &table[0];
155 } else {
156 retval = &table[x];
157 }
158 break;
159 }
160 ++x;
161 }
162
163 DPRINTF(TLBVerbose, "Lookup %#x, asn %#x -> %s vmn 0x%x hyp %d secure %d "
164 "ppn %#x size: %#x pa: %#x ap:%d ns:%d nstid:%d g:%d asid: %d "
165 "el: %d\n",
166 va, asn, retval ? "hit" : "miss", vmid, hyp, secure,
167 retval ? retval->pfn : 0, retval ? retval->size : 0,
168 retval ? retval->pAddr(va) : 0, retval ? retval->ap : 0,
169 retval ? retval->ns : 0, retval ? retval->nstid : 0,
170 retval ? retval->global : 0, retval ? retval->asid : 0,
171 retval ? retval->el : 0);
172
173 return retval;
174}
175
176// insert a new TLB entry
177void
178TLB::insert(Addr addr, TlbEntry &entry)
179{
180 DPRINTF(TLB, "Inserting entry into TLB with pfn:%#x size:%#x vpn: %#x"
181 " asid:%d vmid:%d N:%d global:%d valid:%d nc:%d xn:%d"
182 " ap:%#x domain:%#x ns:%d nstid:%d isHyp:%d\n", entry.pfn,
183 entry.size, entry.vpn, entry.asid, entry.vmid, entry.N,
184 entry.global, entry.valid, entry.nonCacheable, entry.xn,
185 entry.ap, static_cast<uint8_t>(entry.domain), entry.ns, entry.nstid,
186 entry.isHyp);
187
188 if (table[size - 1].valid)
189 DPRINTF(TLB, " - Replacing Valid entry %#x, asn %d vmn %d ppn %#x "
190 "size: %#x ap:%d ns:%d nstid:%d g:%d isHyp:%d el: %d\n",
191 table[size-1].vpn << table[size-1].N, table[size-1].asid,
192 table[size-1].vmid, table[size-1].pfn << table[size-1].N,
193 table[size-1].size, table[size-1].ap, table[size-1].ns,
194 table[size-1].nstid, table[size-1].global, table[size-1].isHyp,
195 table[size-1].el);
196
197 //inserting to MRU position and evicting the LRU one
198
199 for (int i = size - 1; i > 0; --i)
200 table[i] = table[i-1];
201 table[0] = entry;
202
203 inserts++;
204 ppRefills->notify(1);
205}
206
207void
208TLB::printTlb() const
209{
210 int x = 0;
211 TlbEntry *te;
212 DPRINTF(TLB, "Current TLB contents:\n");
213 while (x < size) {
214 te = &table[x];
215 if (te->valid)
216 DPRINTF(TLB, " * %s\n", te->print());
217 ++x;
218 }
219}
220
221void
222TLB::flushAllSecurity(bool secure_lookup, uint8_t target_el, bool ignore_el)
223{
224 DPRINTF(TLB, "Flushing all TLB entries (%s lookup)\n",
225 (secure_lookup ? "secure" : "non-secure"));
226 int x = 0;
227 TlbEntry *te;
228 while (x < size) {
229 te = &table[x];
230 if (te->valid && secure_lookup == !te->nstid &&
231 (te->vmid == vmid || secure_lookup) &&
232 checkELMatch(target_el, te->el, ignore_el)) {
233
234 DPRINTF(TLB, " - %s\n", te->print());
235 te->valid = false;
236 flushedEntries++;
237 }
238 ++x;
239 }
240
241 flushTlb++;
242
243 // If there's a second stage TLB (and we're not it) then flush it as well
244 // if we're currently in hyp mode
245 if (!isStage2 && isHyp) {
246 stage2Tlb->flushAllSecurity(secure_lookup, true);
247 }
248}
249
250void
251TLB::flushAllNs(bool hyp, uint8_t target_el, bool ignore_el)
252{
253 DPRINTF(TLB, "Flushing all NS TLB entries (%s lookup)\n",
254 (hyp ? "hyp" : "non-hyp"));
255 int x = 0;
256 TlbEntry *te;
257 while (x < size) {
258 te = &table[x];
259 if (te->valid && te->nstid && te->isHyp == hyp &&
260 checkELMatch(target_el, te->el, ignore_el)) {
261
262 DPRINTF(TLB, " - %s\n", te->print());
263 flushedEntries++;
264 te->valid = false;
265 }
266 ++x;
267 }
268
269 flushTlb++;
270
271 // If there's a second stage TLB (and we're not it) then flush it as well
272 if (!isStage2 && !hyp) {
273 stage2Tlb->flushAllNs(false, true);
274 }
275}
276
277void
278TLB::flushMvaAsid(Addr mva, uint64_t asn, bool secure_lookup, uint8_t target_el)
279{
280 DPRINTF(TLB, "Flushing TLB entries with mva: %#x, asid: %#x "
281 "(%s lookup)\n", mva, asn, (secure_lookup ?
282 "secure" : "non-secure"));
283 _flushMva(mva, asn, secure_lookup, false, false, target_el);
284 flushTlbMvaAsid++;
285}
286
287void
288TLB::flushAsid(uint64_t asn, bool secure_lookup, uint8_t target_el)
289{
290 DPRINTF(TLB, "Flushing TLB entries with asid: %#x (%s lookup)\n", asn,
291 (secure_lookup ? "secure" : "non-secure"));
292
293 int x = 0 ;
294 TlbEntry *te;
295
296 while (x < size) {
297 te = &table[x];
298 if (te->valid && te->asid == asn && secure_lookup == !te->nstid &&
299 (te->vmid == vmid || secure_lookup) &&
300 checkELMatch(target_el, te->el, false)) {
301
302 te->valid = false;
303 DPRINTF(TLB, " - %s\n", te->print());
304 flushedEntries++;
305 }
306 ++x;
307 }
308 flushTlbAsid++;
309}
310
311void
312TLB::flushMva(Addr mva, bool secure_lookup, bool hyp, uint8_t target_el)
313{
314 DPRINTF(TLB, "Flushing TLB entries with mva: %#x (%s lookup)\n", mva,
315 (secure_lookup ? "secure" : "non-secure"));
316 _flushMva(mva, 0xbeef, secure_lookup, hyp, true, target_el);
317 flushTlbMva++;
318}
319
320void
321TLB::_flushMva(Addr mva, uint64_t asn, bool secure_lookup, bool hyp,
322 bool ignore_asn, uint8_t target_el)
323{
324 TlbEntry *te;
325 // D5.7.2: Sign-extend address to 64 bits
326 mva = sext<56>(mva);
327 te = lookup(mva, asn, vmid, hyp, secure_lookup, false, ignore_asn,
328 target_el);
329 while (te != NULL) {
330 if (secure_lookup == !te->nstid) {
331 DPRINTF(TLB, " - %s\n", te->print());
332 te->valid = false;
333 flushedEntries++;
334 }
335 te = lookup(mva, asn, vmid, hyp, secure_lookup, false, ignore_asn,
336 target_el);
337 }
338}
339
| 1/*
2 * Copyright (c) 2010-2013, 2016 ARM Limited
3 * All rights reserved
4 *
5 * The license below extends only to copyright in the software and shall
6 * not be construed as granting a license to any other intellectual
7 * property including but not limited to intellectual property relating
8 * to a hardware implementation of the functionality of the software
9 * licensed hereunder. You may use the software subject to the license
10 * terms below provided that you ensure that this notice is replicated
11 * unmodified and in its entirety in all distributions of the software,
12 * modified or unmodified, in source code or in binary form.
13 *
14 * Copyright (c) 2001-2005 The Regents of The University of Michigan
15 * All rights reserved.
16 *
17 * Redistribution and use in source and binary forms, with or without
18 * modification, are permitted provided that the following conditions are
19 * met: redistributions of source code must retain the above copyright
20 * notice, this list of conditions and the following disclaimer;
21 * redistributions in binary form must reproduce the above copyright
22 * notice, this list of conditions and the following disclaimer in the
23 * documentation and/or other materials provided with the distribution;
24 * neither the name of the copyright holders nor the names of its
25 * contributors may be used to endorse or promote products derived from
26 * this software without specific prior written permission.
27 *
28 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
29 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
30 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
31 * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
32 * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
33 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
34 * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
35 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
36 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
37 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
38 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
39 *
40 * Authors: Ali Saidi
41 * Nathan Binkert
42 * Steve Reinhardt
43 */
44
45#include "arch/arm/tlb.hh"
46
47#include <memory>
48#include <string>
49#include <vector>
50
51#include "arch/arm/faults.hh"
52#include "arch/arm/pagetable.hh"
53#include "arch/arm/system.hh"
54#include "arch/arm/table_walker.hh"
55#include "arch/arm/stage2_lookup.hh"
56#include "arch/arm/stage2_mmu.hh"
57#include "arch/arm/utility.hh"
58#include "base/inifile.hh"
59#include "base/str.hh"
60#include "base/trace.hh"
61#include "cpu/base.hh"
62#include "cpu/thread_context.hh"
63#include "debug/Checkpoint.hh"
64#include "debug/TLB.hh"
65#include "debug/TLBVerbose.hh"
66#include "mem/page_table.hh"
67#include "params/ArmTLB.hh"
68#include "sim/full_system.hh"
69#include "sim/process.hh"
70
71using namespace std;
72using namespace ArmISA;
73
74TLB::TLB(const ArmTLBParams *p)
75 : BaseTLB(p), table(new TlbEntry[p->size]), size(p->size),
76 isStage2(p->is_stage2), stage2Req(false), _attr(0),
77 directToStage2(false), tableWalker(p->walker), stage2Tlb(NULL),
78 stage2Mmu(NULL), test(nullptr), rangeMRU(1),
79 aarch64(false), aarch64EL(EL0), isPriv(false), isSecure(false),
80 isHyp(false), asid(0), vmid(0), dacr(0),
81 miscRegValid(false), miscRegContext(0), curTranType(NormalTran)
82{
83 tableWalker->setTlb(this);
84
85 // Cache system-level properties
86 haveLPAE = tableWalker->haveLPAE();
87 haveVirtualization = tableWalker->haveVirtualization();
88 haveLargeAsid64 = tableWalker->haveLargeAsid64();
89}
90
91TLB::~TLB()
92{
93 delete[] table;
94}
95
96void
97TLB::init()
98{
99 if (stage2Mmu && !isStage2)
100 stage2Tlb = stage2Mmu->stage2Tlb();
101}
102
103void
104TLB::setMMU(Stage2MMU *m, MasterID master_id)
105{
106 stage2Mmu = m;
107 tableWalker->setMMU(m, master_id);
108}
109
110bool
111TLB::translateFunctional(ThreadContext *tc, Addr va, Addr &pa)
112{
113 updateMiscReg(tc);
114
115 if (directToStage2) {
116 assert(stage2Tlb);
117 return stage2Tlb->translateFunctional(tc, va, pa);
118 }
119
120 TlbEntry *e = lookup(va, asid, vmid, isHyp, isSecure, true, false,
121 aarch64 ? aarch64EL : EL1);
122 if (!e)
123 return false;
124 pa = e->pAddr(va);
125 return true;
126}
127
128Fault
129TLB::finalizePhysical(RequestPtr req, ThreadContext *tc, Mode mode) const
130{
131 return NoFault;
132}
133
134TlbEntry*
135TLB::lookup(Addr va, uint16_t asn, uint8_t vmid, bool hyp, bool secure,
136 bool functional, bool ignore_asn, uint8_t target_el)
137{
138
139 TlbEntry *retval = NULL;
140
141 // Maintaining LRU array
142 int x = 0;
143 while (retval == NULL && x < size) {
144 if ((!ignore_asn && table[x].match(va, asn, vmid, hyp, secure, false,
145 target_el)) ||
146 (ignore_asn && table[x].match(va, vmid, hyp, secure, target_el))) {
147 // We only move the hit entry ahead when the position is higher
148 // than rangeMRU
149 if (x > rangeMRU && !functional) {
150 TlbEntry tmp_entry = table[x];
151 for (int i = x; i > 0; i--)
152 table[i] = table[i - 1];
153 table[0] = tmp_entry;
154 retval = &table[0];
155 } else {
156 retval = &table[x];
157 }
158 break;
159 }
160 ++x;
161 }
162
163 DPRINTF(TLBVerbose, "Lookup %#x, asn %#x -> %s vmn 0x%x hyp %d secure %d "
164 "ppn %#x size: %#x pa: %#x ap:%d ns:%d nstid:%d g:%d asid: %d "
165 "el: %d\n",
166 va, asn, retval ? "hit" : "miss", vmid, hyp, secure,
167 retval ? retval->pfn : 0, retval ? retval->size : 0,
168 retval ? retval->pAddr(va) : 0, retval ? retval->ap : 0,
169 retval ? retval->ns : 0, retval ? retval->nstid : 0,
170 retval ? retval->global : 0, retval ? retval->asid : 0,
171 retval ? retval->el : 0);
172
173 return retval;
174}
175
176// insert a new TLB entry
177void
178TLB::insert(Addr addr, TlbEntry &entry)
179{
180 DPRINTF(TLB, "Inserting entry into TLB with pfn:%#x size:%#x vpn: %#x"
181 " asid:%d vmid:%d N:%d global:%d valid:%d nc:%d xn:%d"
182 " ap:%#x domain:%#x ns:%d nstid:%d isHyp:%d\n", entry.pfn,
183 entry.size, entry.vpn, entry.asid, entry.vmid, entry.N,
184 entry.global, entry.valid, entry.nonCacheable, entry.xn,
185 entry.ap, static_cast<uint8_t>(entry.domain), entry.ns, entry.nstid,
186 entry.isHyp);
187
188 if (table[size - 1].valid)
189 DPRINTF(TLB, " - Replacing Valid entry %#x, asn %d vmn %d ppn %#x "
190 "size: %#x ap:%d ns:%d nstid:%d g:%d isHyp:%d el: %d\n",
191 table[size-1].vpn << table[size-1].N, table[size-1].asid,
192 table[size-1].vmid, table[size-1].pfn << table[size-1].N,
193 table[size-1].size, table[size-1].ap, table[size-1].ns,
194 table[size-1].nstid, table[size-1].global, table[size-1].isHyp,
195 table[size-1].el);
196
197 //inserting to MRU position and evicting the LRU one
198
199 for (int i = size - 1; i > 0; --i)
200 table[i] = table[i-1];
201 table[0] = entry;
202
203 inserts++;
204 ppRefills->notify(1);
205}
206
207void
208TLB::printTlb() const
209{
210 int x = 0;
211 TlbEntry *te;
212 DPRINTF(TLB, "Current TLB contents:\n");
213 while (x < size) {
214 te = &table[x];
215 if (te->valid)
216 DPRINTF(TLB, " * %s\n", te->print());
217 ++x;
218 }
219}
220
221void
222TLB::flushAllSecurity(bool secure_lookup, uint8_t target_el, bool ignore_el)
223{
224 DPRINTF(TLB, "Flushing all TLB entries (%s lookup)\n",
225 (secure_lookup ? "secure" : "non-secure"));
226 int x = 0;
227 TlbEntry *te;
228 while (x < size) {
229 te = &table[x];
230 if (te->valid && secure_lookup == !te->nstid &&
231 (te->vmid == vmid || secure_lookup) &&
232 checkELMatch(target_el, te->el, ignore_el)) {
233
234 DPRINTF(TLB, " - %s\n", te->print());
235 te->valid = false;
236 flushedEntries++;
237 }
238 ++x;
239 }
240
241 flushTlb++;
242
243 // If there's a second stage TLB (and we're not it) then flush it as well
244 // if we're currently in hyp mode
245 if (!isStage2 && isHyp) {
246 stage2Tlb->flushAllSecurity(secure_lookup, true);
247 }
248}
249
250void
251TLB::flushAllNs(bool hyp, uint8_t target_el, bool ignore_el)
252{
253 DPRINTF(TLB, "Flushing all NS TLB entries (%s lookup)\n",
254 (hyp ? "hyp" : "non-hyp"));
255 int x = 0;
256 TlbEntry *te;
257 while (x < size) {
258 te = &table[x];
259 if (te->valid && te->nstid && te->isHyp == hyp &&
260 checkELMatch(target_el, te->el, ignore_el)) {
261
262 DPRINTF(TLB, " - %s\n", te->print());
263 flushedEntries++;
264 te->valid = false;
265 }
266 ++x;
267 }
268
269 flushTlb++;
270
271 // If there's a second stage TLB (and we're not it) then flush it as well
272 if (!isStage2 && !hyp) {
273 stage2Tlb->flushAllNs(false, true);
274 }
275}
276
277void
278TLB::flushMvaAsid(Addr mva, uint64_t asn, bool secure_lookup, uint8_t target_el)
279{
280 DPRINTF(TLB, "Flushing TLB entries with mva: %#x, asid: %#x "
281 "(%s lookup)\n", mva, asn, (secure_lookup ?
282 "secure" : "non-secure"));
283 _flushMva(mva, asn, secure_lookup, false, false, target_el);
284 flushTlbMvaAsid++;
285}
286
287void
288TLB::flushAsid(uint64_t asn, bool secure_lookup, uint8_t target_el)
289{
290 DPRINTF(TLB, "Flushing TLB entries with asid: %#x (%s lookup)\n", asn,
291 (secure_lookup ? "secure" : "non-secure"));
292
293 int x = 0 ;
294 TlbEntry *te;
295
296 while (x < size) {
297 te = &table[x];
298 if (te->valid && te->asid == asn && secure_lookup == !te->nstid &&
299 (te->vmid == vmid || secure_lookup) &&
300 checkELMatch(target_el, te->el, false)) {
301
302 te->valid = false;
303 DPRINTF(TLB, " - %s\n", te->print());
304 flushedEntries++;
305 }
306 ++x;
307 }
308 flushTlbAsid++;
309}
310
311void
312TLB::flushMva(Addr mva, bool secure_lookup, bool hyp, uint8_t target_el)
313{
314 DPRINTF(TLB, "Flushing TLB entries with mva: %#x (%s lookup)\n", mva,
315 (secure_lookup ? "secure" : "non-secure"));
316 _flushMva(mva, 0xbeef, secure_lookup, hyp, true, target_el);
317 flushTlbMva++;
318}
319
320void
321TLB::_flushMva(Addr mva, uint64_t asn, bool secure_lookup, bool hyp,
322 bool ignore_asn, uint8_t target_el)
323{
324 TlbEntry *te;
325 // D5.7.2: Sign-extend address to 64 bits
326 mva = sext<56>(mva);
327 te = lookup(mva, asn, vmid, hyp, secure_lookup, false, ignore_asn,
328 target_el);
329 while (te != NULL) {
330 if (secure_lookup == !te->nstid) {
331 DPRINTF(TLB, " - %s\n", te->print());
332 te->valid = false;
333 flushedEntries++;
334 }
335 te = lookup(mva, asn, vmid, hyp, secure_lookup, false, ignore_asn,
336 target_el);
337 }
338}
339
|
340bool
341TLB::checkELMatch(uint8_t target_el, uint8_t tentry_el, bool ignore_el)
342{
343 bool elMatch = true;
344 if (!ignore_el) {
345 if (target_el == 2 || target_el == 3) {
346 elMatch = (tentry_el == target_el);
347 } else {
348 elMatch = (tentry_el == 0) || (tentry_el == 1);
349 }
350 }
351 return elMatch;
352}
353
354void
355TLB::drainResume()
356{
357 // We might have unserialized something or switched CPUs, so make
358 // sure to re-read the misc regs.
359 miscRegValid = false;
360}
361
362void
363TLB::takeOverFrom(BaseTLB *_otlb)
364{
365 TLB *otlb = dynamic_cast<TLB*>(_otlb);
366 /* Make sure we actually have a valid type */
367 if (otlb) {
368 _attr = otlb->_attr;
369 haveLPAE = otlb->haveLPAE;
370 directToStage2 = otlb->directToStage2;
371 stage2Req = otlb->stage2Req;
372
373 /* Sync the stage2 MMU if they exist in both
374 * the old CPU and the new
375 */
376 if (!isStage2 &&
377 stage2Tlb && otlb->stage2Tlb) {
378 stage2Tlb->takeOverFrom(otlb->stage2Tlb);
379 }
380 } else {
381 panic("Incompatible TLB type!");
382 }
383}
384
385void
386TLB::serialize(CheckpointOut &cp) const
387{
388 DPRINTF(Checkpoint, "Serializing Arm TLB\n");
389
390 SERIALIZE_SCALAR(_attr);
391 SERIALIZE_SCALAR(haveLPAE);
392 SERIALIZE_SCALAR(directToStage2);
393 SERIALIZE_SCALAR(stage2Req);
394
395 int num_entries = size;
396 SERIALIZE_SCALAR(num_entries);
397 for (int i = 0; i < size; i++)
398 table[i].serializeSection(cp, csprintf("TlbEntry%d", i));
399}
400
401void
402TLB::unserialize(CheckpointIn &cp)
403{
404 DPRINTF(Checkpoint, "Unserializing Arm TLB\n");
405
406 UNSERIALIZE_SCALAR(_attr);
407 UNSERIALIZE_SCALAR(haveLPAE);
408 UNSERIALIZE_SCALAR(directToStage2);
409 UNSERIALIZE_SCALAR(stage2Req);
410
411 int num_entries;
412 UNSERIALIZE_SCALAR(num_entries);
413 for (int i = 0; i < min(size, num_entries); i++)
414 table[i].unserializeSection(cp, csprintf("TlbEntry%d", i));
415}
416
417void
418TLB::regStats()
419{
420 BaseTLB::regStats();
421 instHits
422 .name(name() + ".inst_hits")
423 .desc("ITB inst hits")
424 ;
425
426 instMisses
427 .name(name() + ".inst_misses")
428 .desc("ITB inst misses")
429 ;
430
431 instAccesses
432 .name(name() + ".inst_accesses")
433 .desc("ITB inst accesses")
434 ;
435
436 readHits
437 .name(name() + ".read_hits")
438 .desc("DTB read hits")
439 ;
440
441 readMisses
442 .name(name() + ".read_misses")
443 .desc("DTB read misses")
444 ;
445
446 readAccesses
447 .name(name() + ".read_accesses")
448 .desc("DTB read accesses")
449 ;
450
451 writeHits
452 .name(name() + ".write_hits")
453 .desc("DTB write hits")
454 ;
455
456 writeMisses
457 .name(name() + ".write_misses")
458 .desc("DTB write misses")
459 ;
460
461 writeAccesses
462 .name(name() + ".write_accesses")
463 .desc("DTB write accesses")
464 ;
465
466 hits
467 .name(name() + ".hits")
468 .desc("DTB hits")
469 ;
470
471 misses
472 .name(name() + ".misses")
473 .desc("DTB misses")
474 ;
475
476 accesses
477 .name(name() + ".accesses")
478 .desc("DTB accesses")
479 ;
480
481 flushTlb
482 .name(name() + ".flush_tlb")
483 .desc("Number of times complete TLB was flushed")
484 ;
485
486 flushTlbMva
487 .name(name() + ".flush_tlb_mva")
488 .desc("Number of times TLB was flushed by MVA")
489 ;
490
491 flushTlbMvaAsid
492 .name(name() + ".flush_tlb_mva_asid")
493 .desc("Number of times TLB was flushed by MVA & ASID")
494 ;
495
496 flushTlbAsid
497 .name(name() + ".flush_tlb_asid")
498 .desc("Number of times TLB was flushed by ASID")
499 ;
500
501 flushedEntries
502 .name(name() + ".flush_entries")
503 .desc("Number of entries that have been flushed from TLB")
504 ;
505
506 alignFaults
507 .name(name() + ".align_faults")
508 .desc("Number of TLB faults due to alignment restrictions")
509 ;
510
511 prefetchFaults
512 .name(name() + ".prefetch_faults")
513 .desc("Number of TLB faults due to prefetch")
514 ;
515
516 domainFaults
517 .name(name() + ".domain_faults")
518 .desc("Number of TLB faults due to domain restrictions")
519 ;
520
521 permsFaults
522 .name(name() + ".perms_faults")
523 .desc("Number of TLB faults due to permissions restrictions")
524 ;
525
526 instAccesses = instHits + instMisses;
527 readAccesses = readHits + readMisses;
528 writeAccesses = writeHits + writeMisses;
529 hits = readHits + writeHits + instHits;
530 misses = readMisses + writeMisses + instMisses;
531 accesses = readAccesses + writeAccesses + instAccesses;
532}
533
534void
535TLB::regProbePoints()
536{
537 ppRefills.reset(new ProbePoints::PMU(getProbeManager(), "Refills"));
538}
539
540Fault
541TLB::translateSe(RequestPtr req, ThreadContext *tc, Mode mode,
542 Translation *translation, bool &delay, bool timing)
543{
544 updateMiscReg(tc);
545 Addr vaddr_tainted = req->getVaddr();
546 Addr vaddr = 0;
547 if (aarch64)
548 vaddr = purifyTaggedAddr(vaddr_tainted, tc, aarch64EL, ttbcr);
549 else
550 vaddr = vaddr_tainted;
551 uint32_t flags = req->getFlags();
552
553 bool is_fetch = (mode == Execute);
554 bool is_write = (mode == Write);
555
556 if (!is_fetch) {
557 assert(flags & MustBeOne);
558 if (sctlr.a || !(flags & AllowUnaligned)) {
559 if (vaddr & mask(flags & AlignmentMask)) {
560 // LPAE is always disabled in SE mode
561 return std::make_shared<DataAbort>(
562 vaddr_tainted,
563 TlbEntry::DomainType::NoAccess, is_write,
564 ArmFault::AlignmentFault, isStage2,
565 ArmFault::VmsaTran);
566 }
567 }
568 }
569
570 Addr paddr;
571 Process *p = tc->getProcessPtr();
572
573 if (!p->pTable->translate(vaddr, paddr))
574 return std::make_shared<GenericPageTableFault>(vaddr_tainted);
575 req->setPaddr(paddr);
576
577 return NoFault;
578}
579
580Fault
581TLB::checkPermissions(TlbEntry *te, RequestPtr req, Mode mode)
582{
583 Addr vaddr = req->getVaddr(); // 32-bit don't have to purify
584 uint32_t flags = req->getFlags();
585 bool is_fetch = (mode == Execute);
586 bool is_write = (mode == Write);
587 bool is_priv = isPriv && !(flags & UserMode);
588
589 // Get the translation type from the actuall table entry
590 ArmFault::TranMethod tranMethod = te->longDescFormat ? ArmFault::LpaeTran
591 : ArmFault::VmsaTran;
592
593 // If this is the second stage of translation and the request is for a
594 // stage 1 page table walk then we need to check the HCR.PTW bit. This
595 // allows us to generate a fault if the request targets an area marked
596 // as a device or strongly ordered.
597 if (isStage2 && req->isPTWalk() && hcr.ptw &&
598 (te->mtype != TlbEntry::MemoryType::Normal)) {
599 return std::make_shared<DataAbort>(
600 vaddr, te->domain, is_write,
601 ArmFault::PermissionLL + te->lookupLevel,
602 isStage2, tranMethod);
603 }
604
605 // Generate an alignment fault for unaligned data accesses to device or
606 // strongly ordered memory
607 if (!is_fetch) {
608 if (te->mtype != TlbEntry::MemoryType::Normal) {
609 if (vaddr & mask(flags & AlignmentMask)) {
610 alignFaults++;
611 return std::make_shared<DataAbort>(
612 vaddr, TlbEntry::DomainType::NoAccess, is_write,
613 ArmFault::AlignmentFault, isStage2,
614 tranMethod);
615 }
616 }
617 }
618
619 if (te->nonCacheable) {
620 // Prevent prefetching from I/O devices.
621 if (req->isPrefetch()) {
622 // Here we can safely use the fault status for the short
623 // desc. format in all cases
624 return std::make_shared<PrefetchAbort>(
625 vaddr, ArmFault::PrefetchUncacheable,
626 isStage2, tranMethod);
627 }
628 }
629
630 if (!te->longDescFormat) {
631 switch ((dacr >> (static_cast<uint8_t>(te->domain) * 2)) & 0x3) {
632 case 0:
633 domainFaults++;
634 DPRINTF(TLB, "TLB Fault: Data abort on domain. DACR: %#x"
635 " domain: %#x write:%d\n", dacr,
636 static_cast<uint8_t>(te->domain), is_write);
637 if (is_fetch)
638 return std::make_shared<PrefetchAbort>(
639 vaddr,
640 ArmFault::DomainLL + te->lookupLevel,
641 isStage2, tranMethod);
642 else
643 return std::make_shared<DataAbort>(
644 vaddr, te->domain, is_write,
645 ArmFault::DomainLL + te->lookupLevel,
646 isStage2, tranMethod);
647 case 1:
648 // Continue with permissions check
649 break;
650 case 2:
651 panic("UNPRED domain\n");
652 case 3:
653 return NoFault;
654 }
655 }
656
657 // The 'ap' variable is AP[2:0] or {AP[2,1],1b'0}, i.e. always three bits
658 uint8_t ap = te->longDescFormat ? te->ap << 1 : te->ap;
659 uint8_t hap = te->hap;
660
661 if (sctlr.afe == 1 || te->longDescFormat)
662 ap |= 1;
663
664 bool abt;
665 bool isWritable = true;
666 // If this is a stage 2 access (eg for reading stage 1 page table entries)
667 // then don't perform the AP permissions check, we stil do the HAP check
668 // below.
669 if (isStage2) {
670 abt = false;
671 } else {
672 switch (ap) {
673 case 0:
674 DPRINTF(TLB, "Access permissions 0, checking rs:%#x\n",
675 (int)sctlr.rs);
676 if (!sctlr.xp) {
677 switch ((int)sctlr.rs) {
678 case 2:
679 abt = is_write;
680 break;
681 case 1:
682 abt = is_write || !is_priv;
683 break;
684 case 0:
685 case 3:
686 default:
687 abt = true;
688 break;
689 }
690 } else {
691 abt = true;
692 }
693 break;
694 case 1:
695 abt = !is_priv;
696 break;
697 case 2:
698 abt = !is_priv && is_write;
699 isWritable = is_priv;
700 break;
701 case 3:
702 abt = false;
703 break;
704 case 4:
705 panic("UNPRED premissions\n");
706 case 5:
707 abt = !is_priv || is_write;
708 isWritable = false;
709 break;
710 case 6:
711 case 7:
712 abt = is_write;
713 isWritable = false;
714 break;
715 default:
716 panic("Unknown permissions %#x\n", ap);
717 }
718 }
719
720 bool hapAbt = is_write ? !(hap & 2) : !(hap & 1);
721 bool xn = te->xn || (isWritable && sctlr.wxn) ||
722 (ap == 3 && sctlr.uwxn && is_priv);
723 if (is_fetch && (abt || xn ||
724 (te->longDescFormat && te->pxn && is_priv) ||
725 (isSecure && te->ns && scr.sif))) {
726 permsFaults++;
727 DPRINTF(TLB, "TLB Fault: Prefetch abort on permission check. AP:%d "
728 "priv:%d write:%d ns:%d sif:%d sctlr.afe: %d \n",
729 ap, is_priv, is_write, te->ns, scr.sif,sctlr.afe);
730 return std::make_shared<PrefetchAbort>(
731 vaddr,
732 ArmFault::PermissionLL + te->lookupLevel,
733 isStage2, tranMethod);
734 } else if (abt | hapAbt) {
735 permsFaults++;
736 DPRINTF(TLB, "TLB Fault: Data abort on permission check. AP:%d priv:%d"
737 " write:%d\n", ap, is_priv, is_write);
738 return std::make_shared<DataAbort>(
739 vaddr, te->domain, is_write,
740 ArmFault::PermissionLL + te->lookupLevel,
741 isStage2 | !abt, tranMethod);
742 }
743 return NoFault;
744}
745
746
747Fault
748TLB::checkPermissions64(TlbEntry *te, RequestPtr req, Mode mode,
749 ThreadContext *tc)
750{
751 assert(aarch64);
752
753 Addr vaddr_tainted = req->getVaddr();
754 Addr vaddr = purifyTaggedAddr(vaddr_tainted, tc, aarch64EL, ttbcr);
755
756 uint32_t flags = req->getFlags();
757 bool is_fetch = (mode == Execute);
758 bool is_write = (mode == Write);
759 bool is_priv M5_VAR_USED = isPriv && !(flags & UserMode);
760
761 updateMiscReg(tc, curTranType);
762
763 // If this is the second stage of translation and the request is for a
764 // stage 1 page table walk then we need to check the HCR.PTW bit. This
765 // allows us to generate a fault if the request targets an area marked
766 // as a device or strongly ordered.
767 if (isStage2 && req->isPTWalk() && hcr.ptw &&
768 (te->mtype != TlbEntry::MemoryType::Normal)) {
769 return std::make_shared<DataAbort>(
770 vaddr_tainted, te->domain, is_write,
771 ArmFault::PermissionLL + te->lookupLevel,
772 isStage2, ArmFault::LpaeTran);
773 }
774
775 // Generate an alignment fault for unaligned accesses to device or
776 // strongly ordered memory
777 if (!is_fetch) {
778 if (te->mtype != TlbEntry::MemoryType::Normal) {
779 if (vaddr & mask(flags & AlignmentMask)) {
780 alignFaults++;
781 return std::make_shared<DataAbort>(
782 vaddr_tainted,
783 TlbEntry::DomainType::NoAccess, is_write,
784 ArmFault::AlignmentFault, isStage2,
785 ArmFault::LpaeTran);
786 }
787 }
788 }
789
790 if (te->nonCacheable) {
791 // Prevent prefetching from I/O devices.
792 if (req->isPrefetch()) {
793 // Here we can safely use the fault status for the short
794 // desc. format in all cases
795 return std::make_shared<PrefetchAbort>(
796 vaddr_tainted,
797 ArmFault::PrefetchUncacheable,
798 isStage2, ArmFault::LpaeTran);
799 }
800 }
801
802 uint8_t ap = 0x3 & (te->ap); // 2-bit access protection field
803 bool grant = false;
804
805 uint8_t xn = te->xn;
806 uint8_t pxn = te->pxn;
807 bool r = !is_write && !is_fetch;
808 bool w = is_write;
809 bool x = is_fetch;
810 DPRINTF(TLBVerbose, "Checking permissions: ap:%d, xn:%d, pxn:%d, r:%d, "
811 "w:%d, x:%d\n", ap, xn, pxn, r, w, x);
812
813 if (isStage2) {
814 assert(ArmSystem::haveVirtualization(tc) && aarch64EL != EL2);
815 // In stage 2 we use the hypervisor access permission bits.
816 // The following permissions are described in ARM DDI 0487A.f
817 // D4-1802
818 uint8_t hap = 0x3 & te->hap;
819 if (is_fetch) {
820 // sctlr.wxn overrides the xn bit
821 grant = !sctlr.wxn && !xn;
822 } else if (is_write) {
823 grant = hap & 0x2;
824 } else { // is_read
825 grant = hap & 0x1;
826 }
827 } else {
828 switch (aarch64EL) {
829 case EL0:
830 {
831 uint8_t perm = (ap << 2) | (xn << 1) | pxn;
832 switch (perm) {
833 case 0:
834 case 1:
835 case 8:
836 case 9:
837 grant = x;
838 break;
839 case 4:
840 case 5:
841 grant = r || w || (x && !sctlr.wxn);
842 break;
843 case 6:
844 case 7:
845 grant = r || w;
846 break;
847 case 12:
848 case 13:
849 grant = r || x;
850 break;
851 case 14:
852 case 15:
853 grant = r;
854 break;
855 default:
856 grant = false;
857 }
858 }
859 break;
860 case EL1:
861 {
862 uint8_t perm = (ap << 2) | (xn << 1) | pxn;
863 switch (perm) {
864 case 0:
865 case 2:
866 grant = r || w || (x && !sctlr.wxn);
867 break;
868 case 1:
869 case 3:
870 case 4:
871 case 5:
872 case 6:
873 case 7:
874 // regions that are writeable at EL0 should not be
875 // executable at EL1
876 grant = r || w;
877 break;
878 case 8:
879 case 10:
880 case 12:
881 case 14:
882 grant = r || x;
883 break;
884 case 9:
885 case 11:
886 case 13:
887 case 15:
888 grant = r;
889 break;
890 default:
891 grant = false;
892 }
893 }
894 break;
895 case EL2:
896 case EL3:
897 {
898 uint8_t perm = (ap & 0x2) | xn;
899 switch (perm) {
900 case 0:
901 grant = r || w || (x && !sctlr.wxn) ;
902 break;
903 case 1:
904 grant = r || w;
905 break;
906 case 2:
907 grant = r || x;
908 break;
909 case 3:
910 grant = r;
911 break;
912 default:
913 grant = false;
914 }
915 }
916 break;
917 }
918 }
919
920 if (!grant) {
921 if (is_fetch) {
922 permsFaults++;
923 DPRINTF(TLB, "TLB Fault: Prefetch abort on permission check. "
924 "AP:%d priv:%d write:%d ns:%d sif:%d "
925 "sctlr.afe: %d\n",
926 ap, is_priv, is_write, te->ns, scr.sif, sctlr.afe);
927 // Use PC value instead of vaddr because vaddr might be aligned to
928 // cache line and should not be the address reported in FAR
929 return std::make_shared<PrefetchAbort>(
930 req->getPC(),
931 ArmFault::PermissionLL + te->lookupLevel,
932 isStage2, ArmFault::LpaeTran);
933 } else {
934 permsFaults++;
935 DPRINTF(TLB, "TLB Fault: Data abort on permission check. AP:%d "
936 "priv:%d write:%d\n", ap, is_priv, is_write);
937 return std::make_shared<DataAbort>(
938 vaddr_tainted, te->domain, is_write,
939 ArmFault::PermissionLL + te->lookupLevel,
940 isStage2, ArmFault::LpaeTran);
941 }
942 }
943
944 return NoFault;
945}
946
947Fault
948TLB::translateFs(RequestPtr req, ThreadContext *tc, Mode mode,
949 Translation *translation, bool &delay, bool timing,
950 TLB::ArmTranslationType tranType, bool functional)
951{
952 // No such thing as a functional timing access
953 assert(!(timing && functional));
954
955 updateMiscReg(tc, tranType);
956
957 Addr vaddr_tainted = req->getVaddr();
958 Addr vaddr = 0;
959 if (aarch64)
960 vaddr = purifyTaggedAddr(vaddr_tainted, tc, aarch64EL, ttbcr);
961 else
962 vaddr = vaddr_tainted;
963 uint32_t flags = req->getFlags();
964
965 bool is_fetch = (mode == Execute);
966 bool is_write = (mode == Write);
967 bool long_desc_format = aarch64 || longDescFormatInUse(tc);
968 ArmFault::TranMethod tranMethod = long_desc_format ? ArmFault::LpaeTran
969 : ArmFault::VmsaTran;
970
971 req->setAsid(asid);
972
973 DPRINTF(TLBVerbose, "CPSR is priv:%d UserMode:%d secure:%d S1S2NsTran:%d\n",
974 isPriv, flags & UserMode, isSecure, tranType & S1S2NsTran);
975
976 DPRINTF(TLB, "translateFs addr %#x, mode %d, st2 %d, scr %#x sctlr %#x "
977 "flags %#x tranType 0x%x\n", vaddr_tainted, mode, isStage2,
978 scr, sctlr, flags, tranType);
979
980 if ((req->isInstFetch() && (!sctlr.i)) ||
981 ((!req->isInstFetch()) && (!sctlr.c))){
982 req->setFlags(Request::UNCACHEABLE | Request::STRICT_ORDER);
983 }
984 if (!is_fetch) {
985 assert(flags & MustBeOne);
986 if (sctlr.a || !(flags & AllowUnaligned)) {
987 if (vaddr & mask(flags & AlignmentMask)) {
988 alignFaults++;
989 return std::make_shared<DataAbort>(
990 vaddr_tainted,
991 TlbEntry::DomainType::NoAccess, is_write,
992 ArmFault::AlignmentFault, isStage2,
993 tranMethod);
994 }
995 }
996 }
997
998 // If guest MMU is off or hcr.vm=0 go straight to stage2
999 if ((isStage2 && !hcr.vm) || (!isStage2 && !sctlr.m)) {
1000
1001 req->setPaddr(vaddr);
1002 // When the MMU is off the security attribute corresponds to the
1003 // security state of the processor
1004 if (isSecure)
1005 req->setFlags(Request::SECURE);
1006
1007 // @todo: double check this (ARM ARM issue C B3.2.1)
1008 if (long_desc_format || sctlr.tre == 0) {
1009 req->setFlags(Request::UNCACHEABLE | Request::STRICT_ORDER);
1010 } else {
1011 if (nmrr.ir0 == 0 || nmrr.or0 == 0 || prrr.tr0 != 0x2)
1012 req->setFlags(Request::UNCACHEABLE | Request::STRICT_ORDER);
1013 }
1014
1015 // Set memory attributes
1016 TlbEntry temp_te;
1017 temp_te.ns = !isSecure;
1018 if (isStage2 || hcr.dc == 0 || isSecure ||
1019 (isHyp && !(tranType & S1CTran))) {
1020
1021 temp_te.mtype = is_fetch ? TlbEntry::MemoryType::Normal
1022 : TlbEntry::MemoryType::StronglyOrdered;
1023 temp_te.innerAttrs = 0x0;
1024 temp_te.outerAttrs = 0x0;
1025 temp_te.shareable = true;
1026 temp_te.outerShareable = true;
1027 } else {
1028 temp_te.mtype = TlbEntry::MemoryType::Normal;
1029 temp_te.innerAttrs = 0x3;
1030 temp_te.outerAttrs = 0x3;
1031 temp_te.shareable = false;
1032 temp_te.outerShareable = false;
1033 }
1034 temp_te.setAttributes(long_desc_format);
1035 DPRINTF(TLBVerbose, "(No MMU) setting memory attributes: shareable: "
1036 "%d, innerAttrs: %d, outerAttrs: %d, isStage2: %d\n",
1037 temp_te.shareable, temp_te.innerAttrs, temp_te.outerAttrs,
1038 isStage2);
1039 setAttr(temp_te.attributes);
1040
1041 return testTranslation(req, mode, TlbEntry::DomainType::NoAccess);
1042 }
1043
1044 DPRINTF(TLBVerbose, "Translating %s=%#x context=%d\n",
1045 isStage2 ? "IPA" : "VA", vaddr_tainted, asid);
1046 // Translation enabled
1047
1048 TlbEntry *te = NULL;
1049 TlbEntry mergeTe;
1050 Fault fault = getResultTe(&te, req, tc, mode, translation, timing,
1051 functional, &mergeTe);
1052 // only proceed if we have a valid table entry
1053 if ((te == NULL) && (fault == NoFault)) delay = true;
1054
1055 // If we have the table entry transfer some of the attributes to the
1056 // request that triggered the translation
1057 if (te != NULL) {
1058 // Set memory attributes
1059 DPRINTF(TLBVerbose,
1060 "Setting memory attributes: shareable: %d, innerAttrs: %d, "
1061 "outerAttrs: %d, mtype: %d, isStage2: %d\n",
1062 te->shareable, te->innerAttrs, te->outerAttrs,
1063 static_cast<uint8_t>(te->mtype), isStage2);
1064 setAttr(te->attributes);
1065
1066 if (te->nonCacheable)
1067 req->setFlags(Request::UNCACHEABLE);
1068
1069 // Require requests to be ordered if the request goes to
1070 // strongly ordered or device memory (i.e., anything other
1071 // than normal memory requires strict order).
1072 if (te->mtype != TlbEntry::MemoryType::Normal)
1073 req->setFlags(Request::STRICT_ORDER);
1074
1075 Addr pa = te->pAddr(vaddr);
1076 req->setPaddr(pa);
1077
1078 if (isSecure && !te->ns) {
1079 req->setFlags(Request::SECURE);
1080 }
1081 if ((!is_fetch) && (vaddr & mask(flags & AlignmentMask)) &&
1082 (te->mtype != TlbEntry::MemoryType::Normal)) {
1083 // Unaligned accesses to Device memory should always cause an
1084 // abort regardless of sctlr.a
1085 alignFaults++;
1086 return std::make_shared<DataAbort>(
1087 vaddr_tainted,
1088 TlbEntry::DomainType::NoAccess, is_write,
1089 ArmFault::AlignmentFault, isStage2,
1090 tranMethod);
1091 }
1092
1093 // Check for a trickbox generated address fault
1094 if (fault == NoFault)
1095 fault = testTranslation(req, mode, te->domain);
1096 }
1097
1098 // Generate Illegal Inst Set State fault if IL bit is set in CPSR
1099 if (fault == NoFault) {
1100 if (aarch64 && is_fetch && cpsr.il == 1) {
1101 return std::make_shared<IllegalInstSetStateFault>();
1102 }
1103 }
1104
1105 return fault;
1106}
1107
1108Fault
1109TLB::translateAtomic(RequestPtr req, ThreadContext *tc, Mode mode,
1110 TLB::ArmTranslationType tranType)
1111{
1112 updateMiscReg(tc, tranType);
1113
1114 if (directToStage2) {
1115 assert(stage2Tlb);
1116 return stage2Tlb->translateAtomic(req, tc, mode, tranType);
1117 }
1118
1119 bool delay = false;
1120 Fault fault;
1121 if (FullSystem)
1122 fault = translateFs(req, tc, mode, NULL, delay, false, tranType);
1123 else
1124 fault = translateSe(req, tc, mode, NULL, delay, false);
1125 assert(!delay);
1126 return fault;
1127}
1128
1129Fault
1130TLB::translateFunctional(RequestPtr req, ThreadContext *tc, Mode mode,
1131 TLB::ArmTranslationType tranType)
1132{
1133 updateMiscReg(tc, tranType);
1134
1135 if (directToStage2) {
1136 assert(stage2Tlb);
1137 return stage2Tlb->translateFunctional(req, tc, mode, tranType);
1138 }
1139
1140 bool delay = false;
1141 Fault fault;
1142 if (FullSystem)
1143 fault = translateFs(req, tc, mode, NULL, delay, false, tranType, true);
1144 else
1145 fault = translateSe(req, tc, mode, NULL, delay, false);
1146 assert(!delay);
1147 return fault;
1148}
1149
1150Fault
1151TLB::translateTiming(RequestPtr req, ThreadContext *tc,
1152 Translation *translation, Mode mode, TLB::ArmTranslationType tranType)
1153{
1154 updateMiscReg(tc, tranType);
1155
1156 if (directToStage2) {
1157 assert(stage2Tlb);
1158 return stage2Tlb->translateTiming(req, tc, translation, mode, tranType);
1159 }
1160
1161 assert(translation);
1162
1163 return translateComplete(req, tc, translation, mode, tranType, isStage2);
1164}
1165
1166Fault
1167TLB::translateComplete(RequestPtr req, ThreadContext *tc,
1168 Translation *translation, Mode mode, TLB::ArmTranslationType tranType,
1169 bool callFromS2)
1170{
1171 bool delay = false;
1172 Fault fault;
1173 if (FullSystem)
1174 fault = translateFs(req, tc, mode, translation, delay, true, tranType);
1175 else
1176 fault = translateSe(req, tc, mode, translation, delay, true);
1177 DPRINTF(TLBVerbose, "Translation returning delay=%d fault=%d\n", delay, fault !=
1178 NoFault);
1179 // If we have a translation, and we're not in the middle of doing a stage
1180 // 2 translation tell the translation that we've either finished or its
1181 // going to take a while. By not doing this when we're in the middle of a
1182 // stage 2 translation we prevent marking the translation as delayed twice,
1183 // one when the translation starts and again when the stage 1 translation
1184 // completes.
1185 if (translation && (callFromS2 || !stage2Req || req->hasPaddr() || fault != NoFault)) {
1186 if (!delay)
1187 translation->finish(fault, req, tc, mode);
1188 else
1189 translation->markDelayed();
1190 }
1191 return fault;
1192}
1193
1194BaseMasterPort*
1195TLB::getMasterPort()
1196{
1197 return &stage2Mmu->getPort();
1198}
1199
1200void
1201TLB::updateMiscReg(ThreadContext *tc, ArmTranslationType tranType)
1202{
1203 // check if the regs have changed, or the translation mode is different.
1204 // NOTE: the tran type doesn't affect stage 2 TLB's as they only handle
1205 // one type of translation anyway
1206 if (miscRegValid && miscRegContext == tc->contextId() &&
1207 ((tranType == curTranType) || isStage2)) {
1208 return;
1209 }
1210
1211 DPRINTF(TLBVerbose, "TLB variables changed!\n");
1212 cpsr = tc->readMiscReg(MISCREG_CPSR);
1213
1214 // Dependencies: SCR/SCR_EL3, CPSR
1215 isSecure = inSecureState(tc) &&
1216 !(tranType & HypMode) && !(tranType & S1S2NsTran);
1217
1218 const OperatingMode op_mode = (OperatingMode) (uint8_t)cpsr.mode;
1219 aarch64 = opModeIs64(op_mode) ||
1220 (opModeToEL(op_mode) == EL0 && ELIs64(tc, EL1));
1221
1222 if (aarch64) { // AArch64
1223 // determine EL we need to translate in
1224 switch (tranType) {
1225 case S1E0Tran:
1226 case S12E0Tran:
1227 aarch64EL = EL0;
1228 break;
1229 case S1E1Tran:
1230 case S12E1Tran:
1231 aarch64EL = EL1;
1232 break;
1233 case S1E2Tran:
1234 aarch64EL = EL2;
1235 break;
1236 case S1E3Tran:
1237 aarch64EL = EL3;
1238 break;
1239 case NormalTran:
1240 case S1CTran:
1241 case S1S2NsTran:
1242 case HypMode:
1243 aarch64EL = (ExceptionLevel) (uint8_t) cpsr.el;
1244 break;
1245 }
1246
1247 switch (aarch64EL) {
1248 case EL0:
1249 case EL1:
1250 {
1251 sctlr = tc->readMiscReg(MISCREG_SCTLR_EL1);
1252 ttbcr = tc->readMiscReg(MISCREG_TCR_EL1);
1253 uint64_t ttbr_asid = ttbcr.a1 ?
1254 tc->readMiscReg(MISCREG_TTBR1_EL1) :
1255 tc->readMiscReg(MISCREG_TTBR0_EL1);
1256 asid = bits(ttbr_asid,
1257 (haveLargeAsid64 && ttbcr.as) ? 63 : 55, 48);
1258 }
1259 break;
1260 case EL2:
1261 sctlr = tc->readMiscReg(MISCREG_SCTLR_EL2);
1262 ttbcr = tc->readMiscReg(MISCREG_TCR_EL2);
1263 asid = -1;
1264 break;
1265 case EL3:
1266 sctlr = tc->readMiscReg(MISCREG_SCTLR_EL3);
1267 ttbcr = tc->readMiscReg(MISCREG_TCR_EL3);
1268 asid = -1;
1269 break;
1270 }
1271 hcr = tc->readMiscReg(MISCREG_HCR_EL2);
1272 scr = tc->readMiscReg(MISCREG_SCR_EL3);
1273 isPriv = aarch64EL != EL0;
1274 if (haveVirtualization) {
1275 vmid = bits(tc->readMiscReg(MISCREG_VTTBR_EL2), 55, 48);
1276 isHyp = tranType & HypMode;
1277 isHyp &= (tranType & S1S2NsTran) == 0;
1278 isHyp &= (tranType & S1CTran) == 0;
1279 // Work out if we should skip the first stage of translation and go
1280 // directly to stage 2. This value is cached so we don't have to
1281 // compute it for every translation.
1282 stage2Req = isStage2 ||
1283 (hcr.vm && !isHyp && !isSecure &&
1284 !(tranType & S1CTran) && (aarch64EL < EL2) &&
1285 !(tranType & S1E1Tran)); // <--- FIX THIS HACK
1286 directToStage2 = !isStage2 && stage2Req && !sctlr.m;
1287 } else {
1288 vmid = 0;
1289 isHyp = false;
1290 directToStage2 = false;
1291 stage2Req = false;
1292 }
1293 } else { // AArch32
1294 sctlr = tc->readMiscReg(flattenMiscRegNsBanked(MISCREG_SCTLR, tc,
1295 !isSecure));
1296 ttbcr = tc->readMiscReg(flattenMiscRegNsBanked(MISCREG_TTBCR, tc,
1297 !isSecure));
1298 scr = tc->readMiscReg(MISCREG_SCR);
1299 isPriv = cpsr.mode != MODE_USER;
1300 if (longDescFormatInUse(tc)) {
1301 uint64_t ttbr_asid = tc->readMiscReg(
1302 flattenMiscRegNsBanked(ttbcr.a1 ? MISCREG_TTBR1
1303 : MISCREG_TTBR0,
1304 tc, !isSecure));
1305 asid = bits(ttbr_asid, 55, 48);
1306 } else { // Short-descriptor translation table format in use
1307 CONTEXTIDR context_id = tc->readMiscReg(flattenMiscRegNsBanked(
1308 MISCREG_CONTEXTIDR, tc,!isSecure));
1309 asid = context_id.asid;
1310 }
1311 prrr = tc->readMiscReg(flattenMiscRegNsBanked(MISCREG_PRRR, tc,
1312 !isSecure));
1313 nmrr = tc->readMiscReg(flattenMiscRegNsBanked(MISCREG_NMRR, tc,
1314 !isSecure));
1315 dacr = tc->readMiscReg(flattenMiscRegNsBanked(MISCREG_DACR, tc,
1316 !isSecure));
1317 hcr = tc->readMiscReg(MISCREG_HCR);
1318
1319 if (haveVirtualization) {
1320 vmid = bits(tc->readMiscReg(MISCREG_VTTBR), 55, 48);
1321 isHyp = cpsr.mode == MODE_HYP;
1322 isHyp |= tranType & HypMode;
1323 isHyp &= (tranType & S1S2NsTran) == 0;
1324 isHyp &= (tranType & S1CTran) == 0;
1325 if (isHyp) {
1326 sctlr = tc->readMiscReg(MISCREG_HSCTLR);
1327 }
1328 // Work out if we should skip the first stage of translation and go
1329 // directly to stage 2. This value is cached so we don't have to
1330 // compute it for every translation.
1331 stage2Req = hcr.vm && !isStage2 && !isHyp && !isSecure &&
1332 !(tranType & S1CTran);
1333 directToStage2 = stage2Req && !sctlr.m;
1334 } else {
1335 vmid = 0;
1336 stage2Req = false;
1337 isHyp = false;
1338 directToStage2 = false;
1339 }
1340 }
1341 miscRegValid = true;
1342 miscRegContext = tc->contextId();
1343 curTranType = tranType;
1344}
1345
1346Fault
1347TLB::getTE(TlbEntry **te, RequestPtr req, ThreadContext *tc, Mode mode,
1348 Translation *translation, bool timing, bool functional,
1349 bool is_secure, TLB::ArmTranslationType tranType)
1350{
1351 bool is_fetch = (mode == Execute);
1352 bool is_write = (mode == Write);
1353
1354 Addr vaddr_tainted = req->getVaddr();
1355 Addr vaddr = 0;
1356 ExceptionLevel target_el = aarch64 ? aarch64EL : EL1;
1357 if (aarch64) {
1358 vaddr = purifyTaggedAddr(vaddr_tainted, tc, target_el, ttbcr);
1359 } else {
1360 vaddr = vaddr_tainted;
1361 }
1362 *te = lookup(vaddr, asid, vmid, isHyp, is_secure, false, false, target_el);
1363 if (*te == NULL) {
1364 if (req->isPrefetch()) {
1365 // if the request is a prefetch don't attempt to fill the TLB or go
1366 // any further with the memory access (here we can safely use the
1367 // fault status for the short desc. format in all cases)
1368 prefetchFaults++;
1369 return std::make_shared<PrefetchAbort>(
1370 vaddr_tainted, ArmFault::PrefetchTLBMiss, isStage2);
1371 }
1372
1373 if (is_fetch)
1374 instMisses++;
1375 else if (is_write)
1376 writeMisses++;
1377 else
1378 readMisses++;
1379
1380 // start translation table walk, pass variables rather than
1381 // re-retreaving in table walker for speed
1382 DPRINTF(TLB, "TLB Miss: Starting hardware table walker for %#x(%d:%d)\n",
1383 vaddr_tainted, asid, vmid);
1384 Fault fault;
1385 fault = tableWalker->walk(req, tc, asid, vmid, isHyp, mode,
1386 translation, timing, functional, is_secure,
1387 tranType, stage2Req);
1388 // for timing mode, return and wait for table walk,
1389 if (timing || fault != NoFault) {
1390 return fault;
1391 }
1392
1393 *te = lookup(vaddr, asid, vmid, isHyp, is_secure, false, false, target_el);
1394 if (!*te)
1395 printTlb();
1396 assert(*te);
1397 } else {
1398 if (is_fetch)
1399 instHits++;
1400 else if (is_write)
1401 writeHits++;
1402 else
1403 readHits++;
1404 }
1405 return NoFault;
1406}
1407
1408Fault
1409TLB::getResultTe(TlbEntry **te, RequestPtr req, ThreadContext *tc, Mode mode,
1410 Translation *translation, bool timing, bool functional,
1411 TlbEntry *mergeTe)
1412{
1413 Fault fault;
1414
1415 if (isStage2) {
1416 // We are already in the stage 2 TLB. Grab the table entry for stage
1417 // 2 only. We are here because stage 1 translation is disabled.
1418 TlbEntry *s2Te = NULL;
1419 // Get the stage 2 table entry
1420 fault = getTE(&s2Te, req, tc, mode, translation, timing, functional,
1421 isSecure, curTranType);
1422 // Check permissions of stage 2
1423 if ((s2Te != NULL) && (fault = NoFault)) {
1424 if(aarch64)
1425 fault = checkPermissions64(s2Te, req, mode, tc);
1426 else
1427 fault = checkPermissions(s2Te, req, mode);
1428 }
1429 *te = s2Te;
1430 return fault;
1431 }
1432
1433 TlbEntry *s1Te = NULL;
1434
1435 Addr vaddr_tainted = req->getVaddr();
1436
1437 // Get the stage 1 table entry
1438 fault = getTE(&s1Te, req, tc, mode, translation, timing, functional,
1439 isSecure, curTranType);
1440 // only proceed if we have a valid table entry
1441 if ((s1Te != NULL) && (fault == NoFault)) {
1442 // Check stage 1 permissions before checking stage 2
1443 if (aarch64)
1444 fault = checkPermissions64(s1Te, req, mode, tc);
1445 else
1446 fault = checkPermissions(s1Te, req, mode);
1447 if (stage2Req & (fault == NoFault)) {
1448 Stage2LookUp *s2Lookup = new Stage2LookUp(this, stage2Tlb, *s1Te,
1449 req, translation, mode, timing, functional, curTranType);
1450 fault = s2Lookup->getTe(tc, mergeTe);
1451 if (s2Lookup->isComplete()) {
1452 *te = mergeTe;
1453 // We've finished with the lookup so delete it
1454 delete s2Lookup;
1455 } else {
1456 // The lookup hasn't completed, so we can't delete it now. We
1457 // get round this by asking the object to self delete when the
1458 // translation is complete.
1459 s2Lookup->setSelfDelete();
1460 }
1461 } else {
1462 // This case deals with an S1 hit (or bypass), followed by
1463 // an S2 hit-but-perms issue
1464 if (isStage2) {
1465 DPRINTF(TLBVerbose, "s2TLB: reqVa %#x, reqPa %#x, fault %p\n",
1466 vaddr_tainted, req->hasPaddr() ? req->getPaddr() : ~0, fault);
1467 if (fault != NoFault) {
1468 ArmFault *armFault = reinterpret_cast<ArmFault *>(fault.get());
1469 armFault->annotate(ArmFault::S1PTW, false);
1470 armFault->annotate(ArmFault::OVA, vaddr_tainted);
1471 }
1472 }
1473 *te = s1Te;
1474 }
1475 }
1476 return fault;
1477}
1478
1479void
1480TLB::setTestInterface(SimObject *_ti)
1481{
1482 if (!_ti) {
1483 test = nullptr;
1484 } else {
1485 TlbTestInterface *ti(dynamic_cast<TlbTestInterface *>(_ti));
1486 fatal_if(!ti, "%s is not a valid ARM TLB tester\n", _ti->name());
1487 test = ti;
1488 }
1489}
1490
1491Fault
1492TLB::testTranslation(RequestPtr req, Mode mode, TlbEntry::DomainType domain)
1493{
1494 if (!test || !req->hasSize() || req->getSize() == 0) {
1495 return NoFault;
1496 } else {
1497 return test->translationCheck(req, isPriv, mode, domain);
1498 }
1499}
1500
1501Fault
1502TLB::testWalk(Addr pa, Addr size, Addr va, bool is_secure, Mode mode,
1503 TlbEntry::DomainType domain, LookupLevel lookup_level)
1504{
1505 if (!test) {
1506 return NoFault;
1507 } else {
1508 return test->walkCheck(pa, size, va, is_secure, isPriv, mode,
1509 domain, lookup_level);
1510 }
1511}
1512
1513
1514ArmISA::TLB *
1515ArmTLBParams::create()
1516{
1517 return new ArmISA::TLB(this);
1518}
| 347bool
348TLB::checkELMatch(uint8_t target_el, uint8_t tentry_el, bool ignore_el)
349{
350 bool elMatch = true;
351 if (!ignore_el) {
352 if (target_el == 2 || target_el == 3) {
353 elMatch = (tentry_el == target_el);
354 } else {
355 elMatch = (tentry_el == 0) || (tentry_el == 1);
356 }
357 }
358 return elMatch;
359}
360
361void
362TLB::drainResume()
363{
364 // We might have unserialized something or switched CPUs, so make
365 // sure to re-read the misc regs.
366 miscRegValid = false;
367}
368
369void
370TLB::takeOverFrom(BaseTLB *_otlb)
371{
372 TLB *otlb = dynamic_cast<TLB*>(_otlb);
373 /* Make sure we actually have a valid type */
374 if (otlb) {
375 _attr = otlb->_attr;
376 haveLPAE = otlb->haveLPAE;
377 directToStage2 = otlb->directToStage2;
378 stage2Req = otlb->stage2Req;
379
380 /* Sync the stage2 MMU if they exist in both
381 * the old CPU and the new
382 */
383 if (!isStage2 &&
384 stage2Tlb && otlb->stage2Tlb) {
385 stage2Tlb->takeOverFrom(otlb->stage2Tlb);
386 }
387 } else {
388 panic("Incompatible TLB type!");
389 }
390}
391
392void
393TLB::serialize(CheckpointOut &cp) const
394{
395 DPRINTF(Checkpoint, "Serializing Arm TLB\n");
396
397 SERIALIZE_SCALAR(_attr);
398 SERIALIZE_SCALAR(haveLPAE);
399 SERIALIZE_SCALAR(directToStage2);
400 SERIALIZE_SCALAR(stage2Req);
401
402 int num_entries = size;
403 SERIALIZE_SCALAR(num_entries);
404 for (int i = 0; i < size; i++)
405 table[i].serializeSection(cp, csprintf("TlbEntry%d", i));
406}
407
408void
409TLB::unserialize(CheckpointIn &cp)
410{
411 DPRINTF(Checkpoint, "Unserializing Arm TLB\n");
412
413 UNSERIALIZE_SCALAR(_attr);
414 UNSERIALIZE_SCALAR(haveLPAE);
415 UNSERIALIZE_SCALAR(directToStage2);
416 UNSERIALIZE_SCALAR(stage2Req);
417
418 int num_entries;
419 UNSERIALIZE_SCALAR(num_entries);
420 for (int i = 0; i < min(size, num_entries); i++)
421 table[i].unserializeSection(cp, csprintf("TlbEntry%d", i));
422}
423
424void
425TLB::regStats()
426{
427 BaseTLB::regStats();
428 instHits
429 .name(name() + ".inst_hits")
430 .desc("ITB inst hits")
431 ;
432
433 instMisses
434 .name(name() + ".inst_misses")
435 .desc("ITB inst misses")
436 ;
437
438 instAccesses
439 .name(name() + ".inst_accesses")
440 .desc("ITB inst accesses")
441 ;
442
443 readHits
444 .name(name() + ".read_hits")
445 .desc("DTB read hits")
446 ;
447
448 readMisses
449 .name(name() + ".read_misses")
450 .desc("DTB read misses")
451 ;
452
453 readAccesses
454 .name(name() + ".read_accesses")
455 .desc("DTB read accesses")
456 ;
457
458 writeHits
459 .name(name() + ".write_hits")
460 .desc("DTB write hits")
461 ;
462
463 writeMisses
464 .name(name() + ".write_misses")
465 .desc("DTB write misses")
466 ;
467
468 writeAccesses
469 .name(name() + ".write_accesses")
470 .desc("DTB write accesses")
471 ;
472
473 hits
474 .name(name() + ".hits")
475 .desc("DTB hits")
476 ;
477
478 misses
479 .name(name() + ".misses")
480 .desc("DTB misses")
481 ;
482
483 accesses
484 .name(name() + ".accesses")
485 .desc("DTB accesses")
486 ;
487
488 flushTlb
489 .name(name() + ".flush_tlb")
490 .desc("Number of times complete TLB was flushed")
491 ;
492
493 flushTlbMva
494 .name(name() + ".flush_tlb_mva")
495 .desc("Number of times TLB was flushed by MVA")
496 ;
497
498 flushTlbMvaAsid
499 .name(name() + ".flush_tlb_mva_asid")
500 .desc("Number of times TLB was flushed by MVA & ASID")
501 ;
502
503 flushTlbAsid
504 .name(name() + ".flush_tlb_asid")
505 .desc("Number of times TLB was flushed by ASID")
506 ;
507
508 flushedEntries
509 .name(name() + ".flush_entries")
510 .desc("Number of entries that have been flushed from TLB")
511 ;
512
513 alignFaults
514 .name(name() + ".align_faults")
515 .desc("Number of TLB faults due to alignment restrictions")
516 ;
517
518 prefetchFaults
519 .name(name() + ".prefetch_faults")
520 .desc("Number of TLB faults due to prefetch")
521 ;
522
523 domainFaults
524 .name(name() + ".domain_faults")
525 .desc("Number of TLB faults due to domain restrictions")
526 ;
527
528 permsFaults
529 .name(name() + ".perms_faults")
530 .desc("Number of TLB faults due to permissions restrictions")
531 ;
532
533 instAccesses = instHits + instMisses;
534 readAccesses = readHits + readMisses;
535 writeAccesses = writeHits + writeMisses;
536 hits = readHits + writeHits + instHits;
537 misses = readMisses + writeMisses + instMisses;
538 accesses = readAccesses + writeAccesses + instAccesses;
539}
540
541void
542TLB::regProbePoints()
543{
544 ppRefills.reset(new ProbePoints::PMU(getProbeManager(), "Refills"));
545}
546
547Fault
548TLB::translateSe(RequestPtr req, ThreadContext *tc, Mode mode,
549 Translation *translation, bool &delay, bool timing)
550{
551 updateMiscReg(tc);
552 Addr vaddr_tainted = req->getVaddr();
553 Addr vaddr = 0;
554 if (aarch64)
555 vaddr = purifyTaggedAddr(vaddr_tainted, tc, aarch64EL, ttbcr);
556 else
557 vaddr = vaddr_tainted;
558 uint32_t flags = req->getFlags();
559
560 bool is_fetch = (mode == Execute);
561 bool is_write = (mode == Write);
562
563 if (!is_fetch) {
564 assert(flags & MustBeOne);
565 if (sctlr.a || !(flags & AllowUnaligned)) {
566 if (vaddr & mask(flags & AlignmentMask)) {
567 // LPAE is always disabled in SE mode
568 return std::make_shared<DataAbort>(
569 vaddr_tainted,
570 TlbEntry::DomainType::NoAccess, is_write,
571 ArmFault::AlignmentFault, isStage2,
572 ArmFault::VmsaTran);
573 }
574 }
575 }
576
577 Addr paddr;
578 Process *p = tc->getProcessPtr();
579
580 if (!p->pTable->translate(vaddr, paddr))
581 return std::make_shared<GenericPageTableFault>(vaddr_tainted);
582 req->setPaddr(paddr);
583
584 return NoFault;
585}
586
587Fault
588TLB::checkPermissions(TlbEntry *te, RequestPtr req, Mode mode)
589{
590 Addr vaddr = req->getVaddr(); // 32-bit don't have to purify
591 uint32_t flags = req->getFlags();
592 bool is_fetch = (mode == Execute);
593 bool is_write = (mode == Write);
594 bool is_priv = isPriv && !(flags & UserMode);
595
596 // Get the translation type from the actuall table entry
597 ArmFault::TranMethod tranMethod = te->longDescFormat ? ArmFault::LpaeTran
598 : ArmFault::VmsaTran;
599
600 // If this is the second stage of translation and the request is for a
601 // stage 1 page table walk then we need to check the HCR.PTW bit. This
602 // allows us to generate a fault if the request targets an area marked
603 // as a device or strongly ordered.
604 if (isStage2 && req->isPTWalk() && hcr.ptw &&
605 (te->mtype != TlbEntry::MemoryType::Normal)) {
606 return std::make_shared<DataAbort>(
607 vaddr, te->domain, is_write,
608 ArmFault::PermissionLL + te->lookupLevel,
609 isStage2, tranMethod);
610 }
611
612 // Generate an alignment fault for unaligned data accesses to device or
613 // strongly ordered memory
614 if (!is_fetch) {
615 if (te->mtype != TlbEntry::MemoryType::Normal) {
616 if (vaddr & mask(flags & AlignmentMask)) {
617 alignFaults++;
618 return std::make_shared<DataAbort>(
619 vaddr, TlbEntry::DomainType::NoAccess, is_write,
620 ArmFault::AlignmentFault, isStage2,
621 tranMethod);
622 }
623 }
624 }
625
626 if (te->nonCacheable) {
627 // Prevent prefetching from I/O devices.
628 if (req->isPrefetch()) {
629 // Here we can safely use the fault status for the short
630 // desc. format in all cases
631 return std::make_shared<PrefetchAbort>(
632 vaddr, ArmFault::PrefetchUncacheable,
633 isStage2, tranMethod);
634 }
635 }
636
637 if (!te->longDescFormat) {
638 switch ((dacr >> (static_cast<uint8_t>(te->domain) * 2)) & 0x3) {
639 case 0:
640 domainFaults++;
641 DPRINTF(TLB, "TLB Fault: Data abort on domain. DACR: %#x"
642 " domain: %#x write:%d\n", dacr,
643 static_cast<uint8_t>(te->domain), is_write);
644 if (is_fetch)
645 return std::make_shared<PrefetchAbort>(
646 vaddr,
647 ArmFault::DomainLL + te->lookupLevel,
648 isStage2, tranMethod);
649 else
650 return std::make_shared<DataAbort>(
651 vaddr, te->domain, is_write,
652 ArmFault::DomainLL + te->lookupLevel,
653 isStage2, tranMethod);
654 case 1:
655 // Continue with permissions check
656 break;
657 case 2:
658 panic("UNPRED domain\n");
659 case 3:
660 return NoFault;
661 }
662 }
663
664 // The 'ap' variable is AP[2:0] or {AP[2,1],1b'0}, i.e. always three bits
665 uint8_t ap = te->longDescFormat ? te->ap << 1 : te->ap;
666 uint8_t hap = te->hap;
667
668 if (sctlr.afe == 1 || te->longDescFormat)
669 ap |= 1;
670
671 bool abt;
672 bool isWritable = true;
673 // If this is a stage 2 access (eg for reading stage 1 page table entries)
674 // then don't perform the AP permissions check, we stil do the HAP check
675 // below.
676 if (isStage2) {
677 abt = false;
678 } else {
679 switch (ap) {
680 case 0:
681 DPRINTF(TLB, "Access permissions 0, checking rs:%#x\n",
682 (int)sctlr.rs);
683 if (!sctlr.xp) {
684 switch ((int)sctlr.rs) {
685 case 2:
686 abt = is_write;
687 break;
688 case 1:
689 abt = is_write || !is_priv;
690 break;
691 case 0:
692 case 3:
693 default:
694 abt = true;
695 break;
696 }
697 } else {
698 abt = true;
699 }
700 break;
701 case 1:
702 abt = !is_priv;
703 break;
704 case 2:
705 abt = !is_priv && is_write;
706 isWritable = is_priv;
707 break;
708 case 3:
709 abt = false;
710 break;
711 case 4:
712 panic("UNPRED premissions\n");
713 case 5:
714 abt = !is_priv || is_write;
715 isWritable = false;
716 break;
717 case 6:
718 case 7:
719 abt = is_write;
720 isWritable = false;
721 break;
722 default:
723 panic("Unknown permissions %#x\n", ap);
724 }
725 }
726
727 bool hapAbt = is_write ? !(hap & 2) : !(hap & 1);
728 bool xn = te->xn || (isWritable && sctlr.wxn) ||
729 (ap == 3 && sctlr.uwxn && is_priv);
730 if (is_fetch && (abt || xn ||
731 (te->longDescFormat && te->pxn && is_priv) ||
732 (isSecure && te->ns && scr.sif))) {
733 permsFaults++;
734 DPRINTF(TLB, "TLB Fault: Prefetch abort on permission check. AP:%d "
735 "priv:%d write:%d ns:%d sif:%d sctlr.afe: %d \n",
736 ap, is_priv, is_write, te->ns, scr.sif,sctlr.afe);
737 return std::make_shared<PrefetchAbort>(
738 vaddr,
739 ArmFault::PermissionLL + te->lookupLevel,
740 isStage2, tranMethod);
741 } else if (abt | hapAbt) {
742 permsFaults++;
743 DPRINTF(TLB, "TLB Fault: Data abort on permission check. AP:%d priv:%d"
744 " write:%d\n", ap, is_priv, is_write);
745 return std::make_shared<DataAbort>(
746 vaddr, te->domain, is_write,
747 ArmFault::PermissionLL + te->lookupLevel,
748 isStage2 | !abt, tranMethod);
749 }
750 return NoFault;
751}
752
753
754Fault
755TLB::checkPermissions64(TlbEntry *te, RequestPtr req, Mode mode,
756 ThreadContext *tc)
757{
758 assert(aarch64);
759
760 Addr vaddr_tainted = req->getVaddr();
761 Addr vaddr = purifyTaggedAddr(vaddr_tainted, tc, aarch64EL, ttbcr);
762
763 uint32_t flags = req->getFlags();
764 bool is_fetch = (mode == Execute);
765 bool is_write = (mode == Write);
766 bool is_priv M5_VAR_USED = isPriv && !(flags & UserMode);
767
768 updateMiscReg(tc, curTranType);
769
770 // If this is the second stage of translation and the request is for a
771 // stage 1 page table walk then we need to check the HCR.PTW bit. This
772 // allows us to generate a fault if the request targets an area marked
773 // as a device or strongly ordered.
774 if (isStage2 && req->isPTWalk() && hcr.ptw &&
775 (te->mtype != TlbEntry::MemoryType::Normal)) {
776 return std::make_shared<DataAbort>(
777 vaddr_tainted, te->domain, is_write,
778 ArmFault::PermissionLL + te->lookupLevel,
779 isStage2, ArmFault::LpaeTran);
780 }
781
782 // Generate an alignment fault for unaligned accesses to device or
783 // strongly ordered memory
784 if (!is_fetch) {
785 if (te->mtype != TlbEntry::MemoryType::Normal) {
786 if (vaddr & mask(flags & AlignmentMask)) {
787 alignFaults++;
788 return std::make_shared<DataAbort>(
789 vaddr_tainted,
790 TlbEntry::DomainType::NoAccess, is_write,
791 ArmFault::AlignmentFault, isStage2,
792 ArmFault::LpaeTran);
793 }
794 }
795 }
796
797 if (te->nonCacheable) {
798 // Prevent prefetching from I/O devices.
799 if (req->isPrefetch()) {
800 // Here we can safely use the fault status for the short
801 // desc. format in all cases
802 return std::make_shared<PrefetchAbort>(
803 vaddr_tainted,
804 ArmFault::PrefetchUncacheable,
805 isStage2, ArmFault::LpaeTran);
806 }
807 }
808
809 uint8_t ap = 0x3 & (te->ap); // 2-bit access protection field
810 bool grant = false;
811
812 uint8_t xn = te->xn;
813 uint8_t pxn = te->pxn;
814 bool r = !is_write && !is_fetch;
815 bool w = is_write;
816 bool x = is_fetch;
817 DPRINTF(TLBVerbose, "Checking permissions: ap:%d, xn:%d, pxn:%d, r:%d, "
818 "w:%d, x:%d\n", ap, xn, pxn, r, w, x);
819
820 if (isStage2) {
821 assert(ArmSystem::haveVirtualization(tc) && aarch64EL != EL2);
822 // In stage 2 we use the hypervisor access permission bits.
823 // The following permissions are described in ARM DDI 0487A.f
824 // D4-1802
825 uint8_t hap = 0x3 & te->hap;
826 if (is_fetch) {
827 // sctlr.wxn overrides the xn bit
828 grant = !sctlr.wxn && !xn;
829 } else if (is_write) {
830 grant = hap & 0x2;
831 } else { // is_read
832 grant = hap & 0x1;
833 }
834 } else {
835 switch (aarch64EL) {
836 case EL0:
837 {
838 uint8_t perm = (ap << 2) | (xn << 1) | pxn;
839 switch (perm) {
840 case 0:
841 case 1:
842 case 8:
843 case 9:
844 grant = x;
845 break;
846 case 4:
847 case 5:
848 grant = r || w || (x && !sctlr.wxn);
849 break;
850 case 6:
851 case 7:
852 grant = r || w;
853 break;
854 case 12:
855 case 13:
856 grant = r || x;
857 break;
858 case 14:
859 case 15:
860 grant = r;
861 break;
862 default:
863 grant = false;
864 }
865 }
866 break;
867 case EL1:
868 {
869 uint8_t perm = (ap << 2) | (xn << 1) | pxn;
870 switch (perm) {
871 case 0:
872 case 2:
873 grant = r || w || (x && !sctlr.wxn);
874 break;
875 case 1:
876 case 3:
877 case 4:
878 case 5:
879 case 6:
880 case 7:
881 // regions that are writeable at EL0 should not be
882 // executable at EL1
883 grant = r || w;
884 break;
885 case 8:
886 case 10:
887 case 12:
888 case 14:
889 grant = r || x;
890 break;
891 case 9:
892 case 11:
893 case 13:
894 case 15:
895 grant = r;
896 break;
897 default:
898 grant = false;
899 }
900 }
901 break;
902 case EL2:
903 case EL3:
904 {
905 uint8_t perm = (ap & 0x2) | xn;
906 switch (perm) {
907 case 0:
908 grant = r || w || (x && !sctlr.wxn) ;
909 break;
910 case 1:
911 grant = r || w;
912 break;
913 case 2:
914 grant = r || x;
915 break;
916 case 3:
917 grant = r;
918 break;
919 default:
920 grant = false;
921 }
922 }
923 break;
924 }
925 }
926
927 if (!grant) {
928 if (is_fetch) {
929 permsFaults++;
930 DPRINTF(TLB, "TLB Fault: Prefetch abort on permission check. "
931 "AP:%d priv:%d write:%d ns:%d sif:%d "
932 "sctlr.afe: %d\n",
933 ap, is_priv, is_write, te->ns, scr.sif, sctlr.afe);
934 // Use PC value instead of vaddr because vaddr might be aligned to
935 // cache line and should not be the address reported in FAR
936 return std::make_shared<PrefetchAbort>(
937 req->getPC(),
938 ArmFault::PermissionLL + te->lookupLevel,
939 isStage2, ArmFault::LpaeTran);
940 } else {
941 permsFaults++;
942 DPRINTF(TLB, "TLB Fault: Data abort on permission check. AP:%d "
943 "priv:%d write:%d\n", ap, is_priv, is_write);
944 return std::make_shared<DataAbort>(
945 vaddr_tainted, te->domain, is_write,
946 ArmFault::PermissionLL + te->lookupLevel,
947 isStage2, ArmFault::LpaeTran);
948 }
949 }
950
951 return NoFault;
952}
953
954Fault
955TLB::translateFs(RequestPtr req, ThreadContext *tc, Mode mode,
956 Translation *translation, bool &delay, bool timing,
957 TLB::ArmTranslationType tranType, bool functional)
958{
959 // No such thing as a functional timing access
960 assert(!(timing && functional));
961
962 updateMiscReg(tc, tranType);
963
964 Addr vaddr_tainted = req->getVaddr();
965 Addr vaddr = 0;
966 if (aarch64)
967 vaddr = purifyTaggedAddr(vaddr_tainted, tc, aarch64EL, ttbcr);
968 else
969 vaddr = vaddr_tainted;
970 uint32_t flags = req->getFlags();
971
972 bool is_fetch = (mode == Execute);
973 bool is_write = (mode == Write);
974 bool long_desc_format = aarch64 || longDescFormatInUse(tc);
975 ArmFault::TranMethod tranMethod = long_desc_format ? ArmFault::LpaeTran
976 : ArmFault::VmsaTran;
977
978 req->setAsid(asid);
979
980 DPRINTF(TLBVerbose, "CPSR is priv:%d UserMode:%d secure:%d S1S2NsTran:%d\n",
981 isPriv, flags & UserMode, isSecure, tranType & S1S2NsTran);
982
983 DPRINTF(TLB, "translateFs addr %#x, mode %d, st2 %d, scr %#x sctlr %#x "
984 "flags %#x tranType 0x%x\n", vaddr_tainted, mode, isStage2,
985 scr, sctlr, flags, tranType);
986
987 if ((req->isInstFetch() && (!sctlr.i)) ||
988 ((!req->isInstFetch()) && (!sctlr.c))){
989 req->setFlags(Request::UNCACHEABLE | Request::STRICT_ORDER);
990 }
991 if (!is_fetch) {
992 assert(flags & MustBeOne);
993 if (sctlr.a || !(flags & AllowUnaligned)) {
994 if (vaddr & mask(flags & AlignmentMask)) {
995 alignFaults++;
996 return std::make_shared<DataAbort>(
997 vaddr_tainted,
998 TlbEntry::DomainType::NoAccess, is_write,
999 ArmFault::AlignmentFault, isStage2,
1000 tranMethod);
1001 }
1002 }
1003 }
1004
1005 // If guest MMU is off or hcr.vm=0 go straight to stage2
1006 if ((isStage2 && !hcr.vm) || (!isStage2 && !sctlr.m)) {
1007
1008 req->setPaddr(vaddr);
1009 // When the MMU is off the security attribute corresponds to the
1010 // security state of the processor
1011 if (isSecure)
1012 req->setFlags(Request::SECURE);
1013
1014 // @todo: double check this (ARM ARM issue C B3.2.1)
1015 if (long_desc_format || sctlr.tre == 0) {
1016 req->setFlags(Request::UNCACHEABLE | Request::STRICT_ORDER);
1017 } else {
1018 if (nmrr.ir0 == 0 || nmrr.or0 == 0 || prrr.tr0 != 0x2)
1019 req->setFlags(Request::UNCACHEABLE | Request::STRICT_ORDER);
1020 }
1021
1022 // Set memory attributes
1023 TlbEntry temp_te;
1024 temp_te.ns = !isSecure;
1025 if (isStage2 || hcr.dc == 0 || isSecure ||
1026 (isHyp && !(tranType & S1CTran))) {
1027
1028 temp_te.mtype = is_fetch ? TlbEntry::MemoryType::Normal
1029 : TlbEntry::MemoryType::StronglyOrdered;
1030 temp_te.innerAttrs = 0x0;
1031 temp_te.outerAttrs = 0x0;
1032 temp_te.shareable = true;
1033 temp_te.outerShareable = true;
1034 } else {
1035 temp_te.mtype = TlbEntry::MemoryType::Normal;
1036 temp_te.innerAttrs = 0x3;
1037 temp_te.outerAttrs = 0x3;
1038 temp_te.shareable = false;
1039 temp_te.outerShareable = false;
1040 }
1041 temp_te.setAttributes(long_desc_format);
1042 DPRINTF(TLBVerbose, "(No MMU) setting memory attributes: shareable: "
1043 "%d, innerAttrs: %d, outerAttrs: %d, isStage2: %d\n",
1044 temp_te.shareable, temp_te.innerAttrs, temp_te.outerAttrs,
1045 isStage2);
1046 setAttr(temp_te.attributes);
1047
1048 return testTranslation(req, mode, TlbEntry::DomainType::NoAccess);
1049 }
1050
1051 DPRINTF(TLBVerbose, "Translating %s=%#x context=%d\n",
1052 isStage2 ? "IPA" : "VA", vaddr_tainted, asid);
1053 // Translation enabled
1054
1055 TlbEntry *te = NULL;
1056 TlbEntry mergeTe;
1057 Fault fault = getResultTe(&te, req, tc, mode, translation, timing,
1058 functional, &mergeTe);
1059 // only proceed if we have a valid table entry
1060 if ((te == NULL) && (fault == NoFault)) delay = true;
1061
1062 // If we have the table entry transfer some of the attributes to the
1063 // request that triggered the translation
1064 if (te != NULL) {
1065 // Set memory attributes
1066 DPRINTF(TLBVerbose,
1067 "Setting memory attributes: shareable: %d, innerAttrs: %d, "
1068 "outerAttrs: %d, mtype: %d, isStage2: %d\n",
1069 te->shareable, te->innerAttrs, te->outerAttrs,
1070 static_cast<uint8_t>(te->mtype), isStage2);
1071 setAttr(te->attributes);
1072
1073 if (te->nonCacheable)
1074 req->setFlags(Request::UNCACHEABLE);
1075
1076 // Require requests to be ordered if the request goes to
1077 // strongly ordered or device memory (i.e., anything other
1078 // than normal memory requires strict order).
1079 if (te->mtype != TlbEntry::MemoryType::Normal)
1080 req->setFlags(Request::STRICT_ORDER);
1081
1082 Addr pa = te->pAddr(vaddr);
1083 req->setPaddr(pa);
1084
1085 if (isSecure && !te->ns) {
1086 req->setFlags(Request::SECURE);
1087 }
1088 if ((!is_fetch) && (vaddr & mask(flags & AlignmentMask)) &&
1089 (te->mtype != TlbEntry::MemoryType::Normal)) {
1090 // Unaligned accesses to Device memory should always cause an
1091 // abort regardless of sctlr.a
1092 alignFaults++;
1093 return std::make_shared<DataAbort>(
1094 vaddr_tainted,
1095 TlbEntry::DomainType::NoAccess, is_write,
1096 ArmFault::AlignmentFault, isStage2,
1097 tranMethod);
1098 }
1099
1100 // Check for a trickbox generated address fault
1101 if (fault == NoFault)
1102 fault = testTranslation(req, mode, te->domain);
1103 }
1104
1105 // Generate Illegal Inst Set State fault if IL bit is set in CPSR
1106 if (fault == NoFault) {
1107 if (aarch64 && is_fetch && cpsr.il == 1) {
1108 return std::make_shared<IllegalInstSetStateFault>();
1109 }
1110 }
1111
1112 return fault;
1113}
1114
1115Fault
1116TLB::translateAtomic(RequestPtr req, ThreadContext *tc, Mode mode,
1117 TLB::ArmTranslationType tranType)
1118{
1119 updateMiscReg(tc, tranType);
1120
1121 if (directToStage2) {
1122 assert(stage2Tlb);
1123 return stage2Tlb->translateAtomic(req, tc, mode, tranType);
1124 }
1125
1126 bool delay = false;
1127 Fault fault;
1128 if (FullSystem)
1129 fault = translateFs(req, tc, mode, NULL, delay, false, tranType);
1130 else
1131 fault = translateSe(req, tc, mode, NULL, delay, false);
1132 assert(!delay);
1133 return fault;
1134}
1135
1136Fault
1137TLB::translateFunctional(RequestPtr req, ThreadContext *tc, Mode mode,
1138 TLB::ArmTranslationType tranType)
1139{
1140 updateMiscReg(tc, tranType);
1141
1142 if (directToStage2) {
1143 assert(stage2Tlb);
1144 return stage2Tlb->translateFunctional(req, tc, mode, tranType);
1145 }
1146
1147 bool delay = false;
1148 Fault fault;
1149 if (FullSystem)
1150 fault = translateFs(req, tc, mode, NULL, delay, false, tranType, true);
1151 else
1152 fault = translateSe(req, tc, mode, NULL, delay, false);
1153 assert(!delay);
1154 return fault;
1155}
1156
1157Fault
1158TLB::translateTiming(RequestPtr req, ThreadContext *tc,
1159 Translation *translation, Mode mode, TLB::ArmTranslationType tranType)
1160{
1161 updateMiscReg(tc, tranType);
1162
1163 if (directToStage2) {
1164 assert(stage2Tlb);
1165 return stage2Tlb->translateTiming(req, tc, translation, mode, tranType);
1166 }
1167
1168 assert(translation);
1169
1170 return translateComplete(req, tc, translation, mode, tranType, isStage2);
1171}
1172
1173Fault
1174TLB::translateComplete(RequestPtr req, ThreadContext *tc,
1175 Translation *translation, Mode mode, TLB::ArmTranslationType tranType,
1176 bool callFromS2)
1177{
1178 bool delay = false;
1179 Fault fault;
1180 if (FullSystem)
1181 fault = translateFs(req, tc, mode, translation, delay, true, tranType);
1182 else
1183 fault = translateSe(req, tc, mode, translation, delay, true);
1184 DPRINTF(TLBVerbose, "Translation returning delay=%d fault=%d\n", delay, fault !=
1185 NoFault);
1186 // If we have a translation, and we're not in the middle of doing a stage
1187 // 2 translation tell the translation that we've either finished or its
1188 // going to take a while. By not doing this when we're in the middle of a
1189 // stage 2 translation we prevent marking the translation as delayed twice,
1190 // one when the translation starts and again when the stage 1 translation
1191 // completes.
1192 if (translation && (callFromS2 || !stage2Req || req->hasPaddr() || fault != NoFault)) {
1193 if (!delay)
1194 translation->finish(fault, req, tc, mode);
1195 else
1196 translation->markDelayed();
1197 }
1198 return fault;
1199}
1200
1201BaseMasterPort*
1202TLB::getMasterPort()
1203{
1204 return &stage2Mmu->getPort();
1205}
1206
1207void
1208TLB::updateMiscReg(ThreadContext *tc, ArmTranslationType tranType)
1209{
1210 // check if the regs have changed, or the translation mode is different.
1211 // NOTE: the tran type doesn't affect stage 2 TLB's as they only handle
1212 // one type of translation anyway
1213 if (miscRegValid && miscRegContext == tc->contextId() &&
1214 ((tranType == curTranType) || isStage2)) {
1215 return;
1216 }
1217
1218 DPRINTF(TLBVerbose, "TLB variables changed!\n");
1219 cpsr = tc->readMiscReg(MISCREG_CPSR);
1220
1221 // Dependencies: SCR/SCR_EL3, CPSR
1222 isSecure = inSecureState(tc) &&
1223 !(tranType & HypMode) && !(tranType & S1S2NsTran);
1224
1225 const OperatingMode op_mode = (OperatingMode) (uint8_t)cpsr.mode;
1226 aarch64 = opModeIs64(op_mode) ||
1227 (opModeToEL(op_mode) == EL0 && ELIs64(tc, EL1));
1228
1229 if (aarch64) { // AArch64
1230 // determine EL we need to translate in
1231 switch (tranType) {
1232 case S1E0Tran:
1233 case S12E0Tran:
1234 aarch64EL = EL0;
1235 break;
1236 case S1E1Tran:
1237 case S12E1Tran:
1238 aarch64EL = EL1;
1239 break;
1240 case S1E2Tran:
1241 aarch64EL = EL2;
1242 break;
1243 case S1E3Tran:
1244 aarch64EL = EL3;
1245 break;
1246 case NormalTran:
1247 case S1CTran:
1248 case S1S2NsTran:
1249 case HypMode:
1250 aarch64EL = (ExceptionLevel) (uint8_t) cpsr.el;
1251 break;
1252 }
1253
1254 switch (aarch64EL) {
1255 case EL0:
1256 case EL1:
1257 {
1258 sctlr = tc->readMiscReg(MISCREG_SCTLR_EL1);
1259 ttbcr = tc->readMiscReg(MISCREG_TCR_EL1);
1260 uint64_t ttbr_asid = ttbcr.a1 ?
1261 tc->readMiscReg(MISCREG_TTBR1_EL1) :
1262 tc->readMiscReg(MISCREG_TTBR0_EL1);
1263 asid = bits(ttbr_asid,
1264 (haveLargeAsid64 && ttbcr.as) ? 63 : 55, 48);
1265 }
1266 break;
1267 case EL2:
1268 sctlr = tc->readMiscReg(MISCREG_SCTLR_EL2);
1269 ttbcr = tc->readMiscReg(MISCREG_TCR_EL2);
1270 asid = -1;
1271 break;
1272 case EL3:
1273 sctlr = tc->readMiscReg(MISCREG_SCTLR_EL3);
1274 ttbcr = tc->readMiscReg(MISCREG_TCR_EL3);
1275 asid = -1;
1276 break;
1277 }
1278 hcr = tc->readMiscReg(MISCREG_HCR_EL2);
1279 scr = tc->readMiscReg(MISCREG_SCR_EL3);
1280 isPriv = aarch64EL != EL0;
1281 if (haveVirtualization) {
1282 vmid = bits(tc->readMiscReg(MISCREG_VTTBR_EL2), 55, 48);
1283 isHyp = tranType & HypMode;
1284 isHyp &= (tranType & S1S2NsTran) == 0;
1285 isHyp &= (tranType & S1CTran) == 0;
1286 // Work out if we should skip the first stage of translation and go
1287 // directly to stage 2. This value is cached so we don't have to
1288 // compute it for every translation.
1289 stage2Req = isStage2 ||
1290 (hcr.vm && !isHyp && !isSecure &&
1291 !(tranType & S1CTran) && (aarch64EL < EL2) &&
1292 !(tranType & S1E1Tran)); // <--- FIX THIS HACK
1293 directToStage2 = !isStage2 && stage2Req && !sctlr.m;
1294 } else {
1295 vmid = 0;
1296 isHyp = false;
1297 directToStage2 = false;
1298 stage2Req = false;
1299 }
1300 } else { // AArch32
1301 sctlr = tc->readMiscReg(flattenMiscRegNsBanked(MISCREG_SCTLR, tc,
1302 !isSecure));
1303 ttbcr = tc->readMiscReg(flattenMiscRegNsBanked(MISCREG_TTBCR, tc,
1304 !isSecure));
1305 scr = tc->readMiscReg(MISCREG_SCR);
1306 isPriv = cpsr.mode != MODE_USER;
1307 if (longDescFormatInUse(tc)) {
1308 uint64_t ttbr_asid = tc->readMiscReg(
1309 flattenMiscRegNsBanked(ttbcr.a1 ? MISCREG_TTBR1
1310 : MISCREG_TTBR0,
1311 tc, !isSecure));
1312 asid = bits(ttbr_asid, 55, 48);
1313 } else { // Short-descriptor translation table format in use
1314 CONTEXTIDR context_id = tc->readMiscReg(flattenMiscRegNsBanked(
1315 MISCREG_CONTEXTIDR, tc,!isSecure));
1316 asid = context_id.asid;
1317 }
1318 prrr = tc->readMiscReg(flattenMiscRegNsBanked(MISCREG_PRRR, tc,
1319 !isSecure));
1320 nmrr = tc->readMiscReg(flattenMiscRegNsBanked(MISCREG_NMRR, tc,
1321 !isSecure));
1322 dacr = tc->readMiscReg(flattenMiscRegNsBanked(MISCREG_DACR, tc,
1323 !isSecure));
1324 hcr = tc->readMiscReg(MISCREG_HCR);
1325
1326 if (haveVirtualization) {
1327 vmid = bits(tc->readMiscReg(MISCREG_VTTBR), 55, 48);
1328 isHyp = cpsr.mode == MODE_HYP;
1329 isHyp |= tranType & HypMode;
1330 isHyp &= (tranType & S1S2NsTran) == 0;
1331 isHyp &= (tranType & S1CTran) == 0;
1332 if (isHyp) {
1333 sctlr = tc->readMiscReg(MISCREG_HSCTLR);
1334 }
1335 // Work out if we should skip the first stage of translation and go
1336 // directly to stage 2. This value is cached so we don't have to
1337 // compute it for every translation.
1338 stage2Req = hcr.vm && !isStage2 && !isHyp && !isSecure &&
1339 !(tranType & S1CTran);
1340 directToStage2 = stage2Req && !sctlr.m;
1341 } else {
1342 vmid = 0;
1343 stage2Req = false;
1344 isHyp = false;
1345 directToStage2 = false;
1346 }
1347 }
1348 miscRegValid = true;
1349 miscRegContext = tc->contextId();
1350 curTranType = tranType;
1351}
1352
1353Fault
1354TLB::getTE(TlbEntry **te, RequestPtr req, ThreadContext *tc, Mode mode,
1355 Translation *translation, bool timing, bool functional,
1356 bool is_secure, TLB::ArmTranslationType tranType)
1357{
1358 bool is_fetch = (mode == Execute);
1359 bool is_write = (mode == Write);
1360
1361 Addr vaddr_tainted = req->getVaddr();
1362 Addr vaddr = 0;
1363 ExceptionLevel target_el = aarch64 ? aarch64EL : EL1;
1364 if (aarch64) {
1365 vaddr = purifyTaggedAddr(vaddr_tainted, tc, target_el, ttbcr);
1366 } else {
1367 vaddr = vaddr_tainted;
1368 }
1369 *te = lookup(vaddr, asid, vmid, isHyp, is_secure, false, false, target_el);
1370 if (*te == NULL) {
1371 if (req->isPrefetch()) {
1372 // if the request is a prefetch don't attempt to fill the TLB or go
1373 // any further with the memory access (here we can safely use the
1374 // fault status for the short desc. format in all cases)
1375 prefetchFaults++;
1376 return std::make_shared<PrefetchAbort>(
1377 vaddr_tainted, ArmFault::PrefetchTLBMiss, isStage2);
1378 }
1379
1380 if (is_fetch)
1381 instMisses++;
1382 else if (is_write)
1383 writeMisses++;
1384 else
1385 readMisses++;
1386
1387 // start translation table walk, pass variables rather than
1388 // re-retreaving in table walker for speed
1389 DPRINTF(TLB, "TLB Miss: Starting hardware table walker for %#x(%d:%d)\n",
1390 vaddr_tainted, asid, vmid);
1391 Fault fault;
1392 fault = tableWalker->walk(req, tc, asid, vmid, isHyp, mode,
1393 translation, timing, functional, is_secure,
1394 tranType, stage2Req);
1395 // for timing mode, return and wait for table walk,
1396 if (timing || fault != NoFault) {
1397 return fault;
1398 }
1399
1400 *te = lookup(vaddr, asid, vmid, isHyp, is_secure, false, false, target_el);
1401 if (!*te)
1402 printTlb();
1403 assert(*te);
1404 } else {
1405 if (is_fetch)
1406 instHits++;
1407 else if (is_write)
1408 writeHits++;
1409 else
1410 readHits++;
1411 }
1412 return NoFault;
1413}
1414
1415Fault
1416TLB::getResultTe(TlbEntry **te, RequestPtr req, ThreadContext *tc, Mode mode,
1417 Translation *translation, bool timing, bool functional,
1418 TlbEntry *mergeTe)
1419{
1420 Fault fault;
1421
1422 if (isStage2) {
1423 // We are already in the stage 2 TLB. Grab the table entry for stage
1424 // 2 only. We are here because stage 1 translation is disabled.
1425 TlbEntry *s2Te = NULL;
1426 // Get the stage 2 table entry
1427 fault = getTE(&s2Te, req, tc, mode, translation, timing, functional,
1428 isSecure, curTranType);
1429 // Check permissions of stage 2
1430 if ((s2Te != NULL) && (fault = NoFault)) {
1431 if(aarch64)
1432 fault = checkPermissions64(s2Te, req, mode, tc);
1433 else
1434 fault = checkPermissions(s2Te, req, mode);
1435 }
1436 *te = s2Te;
1437 return fault;
1438 }
1439
1440 TlbEntry *s1Te = NULL;
1441
1442 Addr vaddr_tainted = req->getVaddr();
1443
1444 // Get the stage 1 table entry
1445 fault = getTE(&s1Te, req, tc, mode, translation, timing, functional,
1446 isSecure, curTranType);
1447 // only proceed if we have a valid table entry
1448 if ((s1Te != NULL) && (fault == NoFault)) {
1449 // Check stage 1 permissions before checking stage 2
1450 if (aarch64)
1451 fault = checkPermissions64(s1Te, req, mode, tc);
1452 else
1453 fault = checkPermissions(s1Te, req, mode);
1454 if (stage2Req & (fault == NoFault)) {
1455 Stage2LookUp *s2Lookup = new Stage2LookUp(this, stage2Tlb, *s1Te,
1456 req, translation, mode, timing, functional, curTranType);
1457 fault = s2Lookup->getTe(tc, mergeTe);
1458 if (s2Lookup->isComplete()) {
1459 *te = mergeTe;
1460 // We've finished with the lookup so delete it
1461 delete s2Lookup;
1462 } else {
1463 // The lookup hasn't completed, so we can't delete it now. We
1464 // get round this by asking the object to self delete when the
1465 // translation is complete.
1466 s2Lookup->setSelfDelete();
1467 }
1468 } else {
1469 // This case deals with an S1 hit (or bypass), followed by
1470 // an S2 hit-but-perms issue
1471 if (isStage2) {
1472 DPRINTF(TLBVerbose, "s2TLB: reqVa %#x, reqPa %#x, fault %p\n",
1473 vaddr_tainted, req->hasPaddr() ? req->getPaddr() : ~0, fault);
1474 if (fault != NoFault) {
1475 ArmFault *armFault = reinterpret_cast<ArmFault *>(fault.get());
1476 armFault->annotate(ArmFault::S1PTW, false);
1477 armFault->annotate(ArmFault::OVA, vaddr_tainted);
1478 }
1479 }
1480 *te = s1Te;
1481 }
1482 }
1483 return fault;
1484}
1485
1486void
1487TLB::setTestInterface(SimObject *_ti)
1488{
1489 if (!_ti) {
1490 test = nullptr;
1491 } else {
1492 TlbTestInterface *ti(dynamic_cast<TlbTestInterface *>(_ti));
1493 fatal_if(!ti, "%s is not a valid ARM TLB tester\n", _ti->name());
1494 test = ti;
1495 }
1496}
1497
1498Fault
1499TLB::testTranslation(RequestPtr req, Mode mode, TlbEntry::DomainType domain)
1500{
1501 if (!test || !req->hasSize() || req->getSize() == 0) {
1502 return NoFault;
1503 } else {
1504 return test->translationCheck(req, isPriv, mode, domain);
1505 }
1506}
1507
1508Fault
1509TLB::testWalk(Addr pa, Addr size, Addr va, bool is_secure, Mode mode,
1510 TlbEntry::DomainType domain, LookupLevel lookup_level)
1511{
1512 if (!test) {
1513 return NoFault;
1514 } else {
1515 return test->walkCheck(pa, size, va, is_secure, isPriv, mode,
1516 domain, lookup_level);
1517 }
1518}
1519
1520
1521ArmISA::TLB *
1522ArmTLBParams::create()
1523{
1524 return new ArmISA::TLB(this);
1525}
|