3 * All rights reserved
4 *
5 * The license below extends only to copyright in the software and shall
6 * not be construed as granting a license to any other intellectual
7 * property including but not limited to intellectual property relating
8 * to a hardware implementation of the functionality of the software
9 * licensed hereunder. You may use the software subject to the license
10 * terms below provided that you ensure that this notice is replicated
11 * unmodified and in its entirety in all distributions of the software,
12 * modified or unmodified, in source code or in binary form.
13 *
14 * Copyright (c) 2001-2005 The Regents of The University of Michigan
15 * All rights reserved.
16 *
17 * Redistribution and use in source and binary forms, with or without
18 * modification, are permitted provided that the following conditions are
19 * met: redistributions of source code must retain the above copyright
20 * notice, this list of conditions and the following disclaimer;
21 * redistributions in binary form must reproduce the above copyright
22 * notice, this list of conditions and the following disclaimer in the
23 * documentation and/or other materials provided with the distribution;
24 * neither the name of the copyright holders nor the names of its
25 * contributors may be used to endorse or promote products derived from
26 * this software without specific prior written permission.
27 *
28 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
29 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
30 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
31 * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
32 * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
33 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
34 * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
35 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
36 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
37 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
38 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
39 *
40 * Authors: Ali Saidi
41 * Nathan Binkert
42 * Steve Reinhardt
43 */
44
45#include "arch/arm/tlb.hh"
46
47#include <memory>
48#include <string>
49#include <vector>
50
51#include "arch/arm/faults.hh"
52#include "arch/arm/pagetable.hh"
53#include "arch/arm/stage2_lookup.hh"
54#include "arch/arm/stage2_mmu.hh"
55#include "arch/arm/system.hh"
56#include "arch/arm/table_walker.hh"
57#include "arch/arm/utility.hh"
58#include "base/inifile.hh"
59#include "base/str.hh"
60#include "base/trace.hh"
61#include "cpu/base.hh"
62#include "cpu/thread_context.hh"
63#include "debug/Checkpoint.hh"
64#include "debug/TLB.hh"
65#include "debug/TLBVerbose.hh"
66#include "mem/page_table.hh"
67#include "mem/request.hh"
68#include "params/ArmTLB.hh"
69#include "sim/full_system.hh"
70#include "sim/process.hh"
71
72using namespace std;
73using namespace ArmISA;
74
75TLB::TLB(const ArmTLBParams *p)
76 : BaseTLB(p), table(new TlbEntry[p->size]), size(p->size),
77 isStage2(p->is_stage2), stage2Req(false), _attr(0),
78 directToStage2(false), tableWalker(p->walker), stage2Tlb(NULL),
79 stage2Mmu(NULL), test(nullptr), rangeMRU(1),
80 aarch64(false), aarch64EL(EL0), isPriv(false), isSecure(false),
81 isHyp(false), asid(0), vmid(0), dacr(0),
82 miscRegValid(false), miscRegContext(0), curTranType(NormalTran)
83{
84 tableWalker->setTlb(this);
85
86 // Cache system-level properties
87 haveLPAE = tableWalker->haveLPAE();
88 haveVirtualization = tableWalker->haveVirtualization();
89 haveLargeAsid64 = tableWalker->haveLargeAsid64();
90}
91
92TLB::~TLB()
93{
94 delete[] table;
95}
96
97void
98TLB::init()
99{
100 if (stage2Mmu && !isStage2)
101 stage2Tlb = stage2Mmu->stage2Tlb();
102}
103
104void
105TLB::setMMU(Stage2MMU *m, MasterID master_id)
106{
107 stage2Mmu = m;
108 tableWalker->setMMU(m, master_id);
109}
110
111bool
112TLB::translateFunctional(ThreadContext *tc, Addr va, Addr &pa)
113{
114 updateMiscReg(tc);
115
116 if (directToStage2) {
117 assert(stage2Tlb);
118 return stage2Tlb->translateFunctional(tc, va, pa);
119 }
120
121 TlbEntry *e = lookup(va, asid, vmid, isHyp, isSecure, true, false,
122 aarch64 ? aarch64EL : EL1);
123 if (!e)
124 return false;
125 pa = e->pAddr(va);
126 return true;
127}
128
129Fault
130TLB::finalizePhysical(RequestPtr req, ThreadContext *tc, Mode mode) const
131{
132 return NoFault;
133}
134
135TlbEntry*
136TLB::lookup(Addr va, uint16_t asn, uint8_t vmid, bool hyp, bool secure,
137 bool functional, bool ignore_asn, uint8_t target_el)
138{
139
140 TlbEntry *retval = NULL;
141
142 // Maintaining LRU array
143 int x = 0;
144 while (retval == NULL && x < size) {
145 if ((!ignore_asn && table[x].match(va, asn, vmid, hyp, secure, false,
146 target_el)) ||
147 (ignore_asn && table[x].match(va, vmid, hyp, secure, target_el))) {
148 // We only move the hit entry ahead when the position is higher
149 // than rangeMRU
150 if (x > rangeMRU && !functional) {
151 TlbEntry tmp_entry = table[x];
152 for (int i = x; i > 0; i--)
153 table[i] = table[i - 1];
154 table[0] = tmp_entry;
155 retval = &table[0];
156 } else {
157 retval = &table[x];
158 }
159 break;
160 }
161 ++x;
162 }
163
164 DPRINTF(TLBVerbose, "Lookup %#x, asn %#x -> %s vmn 0x%x hyp %d secure %d "
165 "ppn %#x size: %#x pa: %#x ap:%d ns:%d nstid:%d g:%d asid: %d "
166 "el: %d\n",
167 va, asn, retval ? "hit" : "miss", vmid, hyp, secure,
168 retval ? retval->pfn : 0, retval ? retval->size : 0,
169 retval ? retval->pAddr(va) : 0, retval ? retval->ap : 0,
170 retval ? retval->ns : 0, retval ? retval->nstid : 0,
171 retval ? retval->global : 0, retval ? retval->asid : 0,
172 retval ? retval->el : 0);
173
174 return retval;
175}
176
177// insert a new TLB entry
178void
179TLB::insert(Addr addr, TlbEntry &entry)
180{
181 DPRINTF(TLB, "Inserting entry into TLB with pfn:%#x size:%#x vpn: %#x"
182 " asid:%d vmid:%d N:%d global:%d valid:%d nc:%d xn:%d"
183 " ap:%#x domain:%#x ns:%d nstid:%d isHyp:%d\n", entry.pfn,
184 entry.size, entry.vpn, entry.asid, entry.vmid, entry.N,
185 entry.global, entry.valid, entry.nonCacheable, entry.xn,
186 entry.ap, static_cast<uint8_t>(entry.domain), entry.ns, entry.nstid,
187 entry.isHyp);
188
189 if (table[size - 1].valid)
190 DPRINTF(TLB, " - Replacing Valid entry %#x, asn %d vmn %d ppn %#x "
191 "size: %#x ap:%d ns:%d nstid:%d g:%d isHyp:%d el: %d\n",
192 table[size-1].vpn << table[size-1].N, table[size-1].asid,
193 table[size-1].vmid, table[size-1].pfn << table[size-1].N,
194 table[size-1].size, table[size-1].ap, table[size-1].ns,
195 table[size-1].nstid, table[size-1].global, table[size-1].isHyp,
196 table[size-1].el);
197
198 //inserting to MRU position and evicting the LRU one
199
200 for (int i = size - 1; i > 0; --i)
201 table[i] = table[i-1];
202 table[0] = entry;
203
204 inserts++;
205 ppRefills->notify(1);
206}
207
208void
209TLB::printTlb() const
210{
211 int x = 0;
212 TlbEntry *te;
213 DPRINTF(TLB, "Current TLB contents:\n");
214 while (x < size) {
215 te = &table[x];
216 if (te->valid)
217 DPRINTF(TLB, " * %s\n", te->print());
218 ++x;
219 }
220}
221
222void
223TLB::flushAllSecurity(bool secure_lookup, uint8_t target_el, bool ignore_el)
224{
225 DPRINTF(TLB, "Flushing all TLB entries (%s lookup)\n",
226 (secure_lookup ? "secure" : "non-secure"));
227 int x = 0;
228 TlbEntry *te;
229 while (x < size) {
230 te = &table[x];
231 if (te->valid && secure_lookup == !te->nstid &&
232 (te->vmid == vmid || secure_lookup) &&
233 checkELMatch(target_el, te->el, ignore_el)) {
234
235 DPRINTF(TLB, " - %s\n", te->print());
236 te->valid = false;
237 flushedEntries++;
238 }
239 ++x;
240 }
241
242 flushTlb++;
243
244 // If there's a second stage TLB (and we're not it) then flush it as well
245 // if we're currently in hyp mode
246 if (!isStage2 && isHyp) {
247 stage2Tlb->flushAllSecurity(secure_lookup, true);
248 }
249}
250
251void
252TLB::flushAllNs(bool hyp, uint8_t target_el, bool ignore_el)
253{
254 DPRINTF(TLB, "Flushing all NS TLB entries (%s lookup)\n",
255 (hyp ? "hyp" : "non-hyp"));
256 int x = 0;
257 TlbEntry *te;
258 while (x < size) {
259 te = &table[x];
260 if (te->valid && te->nstid && te->isHyp == hyp &&
261 checkELMatch(target_el, te->el, ignore_el)) {
262
263 DPRINTF(TLB, " - %s\n", te->print());
264 flushedEntries++;
265 te->valid = false;
266 }
267 ++x;
268 }
269
270 flushTlb++;
271
272 // If there's a second stage TLB (and we're not it) then flush it as well
273 if (!isStage2 && !hyp) {
274 stage2Tlb->flushAllNs(false, true);
275 }
276}
277
278void
279TLB::flushMvaAsid(Addr mva, uint64_t asn, bool secure_lookup, uint8_t target_el)
280{
281 DPRINTF(TLB, "Flushing TLB entries with mva: %#x, asid: %#x "
282 "(%s lookup)\n", mva, asn, (secure_lookup ?
283 "secure" : "non-secure"));
284 _flushMva(mva, asn, secure_lookup, false, false, target_el);
285 flushTlbMvaAsid++;
286}
287
288void
289TLB::flushAsid(uint64_t asn, bool secure_lookup, uint8_t target_el)
290{
291 DPRINTF(TLB, "Flushing TLB entries with asid: %#x (%s lookup)\n", asn,
292 (secure_lookup ? "secure" : "non-secure"));
293
294 int x = 0 ;
295 TlbEntry *te;
296
297 while (x < size) {
298 te = &table[x];
299 if (te->valid && te->asid == asn && secure_lookup == !te->nstid &&
300 (te->vmid == vmid || secure_lookup) &&
301 checkELMatch(target_el, te->el, false)) {
302
303 te->valid = false;
304 DPRINTF(TLB, " - %s\n", te->print());
305 flushedEntries++;
306 }
307 ++x;
308 }
309 flushTlbAsid++;
310}
311
312void
313TLB::flushMva(Addr mva, bool secure_lookup, bool hyp, uint8_t target_el)
314{
315 DPRINTF(TLB, "Flushing TLB entries with mva: %#x (%s lookup)\n", mva,
316 (secure_lookup ? "secure" : "non-secure"));
317 _flushMva(mva, 0xbeef, secure_lookup, hyp, true, target_el);
318 flushTlbMva++;
319}
320
321void
322TLB::_flushMva(Addr mva, uint64_t asn, bool secure_lookup, bool hyp,
323 bool ignore_asn, uint8_t target_el)
324{
325 TlbEntry *te;
326 // D5.7.2: Sign-extend address to 64 bits
327 mva = sext<56>(mva);
328 te = lookup(mva, asn, vmid, hyp, secure_lookup, false, ignore_asn,
329 target_el);
330 while (te != NULL) {
331 if (secure_lookup == !te->nstid) {
332 DPRINTF(TLB, " - %s\n", te->print());
333 te->valid = false;
334 flushedEntries++;
335 }
336 te = lookup(mva, asn, vmid, hyp, secure_lookup, false, ignore_asn,
337 target_el);
338 }
339}
340
341void
342TLB::flushIpaVmid(Addr ipa, bool secure_lookup, bool hyp, uint8_t target_el)
343{
344 assert(!isStage2);
345 stage2Tlb->_flushMva(ipa, 0xbeef, secure_lookup, hyp, true, target_el);
346}
347
348bool
349TLB::checkELMatch(uint8_t target_el, uint8_t tentry_el, bool ignore_el)
350{
351 bool elMatch = true;
352 if (!ignore_el) {
353 if (target_el == 2 || target_el == 3) {
354 elMatch = (tentry_el == target_el);
355 } else {
356 elMatch = (tentry_el == 0) || (tentry_el == 1);
357 }
358 }
359 return elMatch;
360}
361
362void
363TLB::drainResume()
364{
365 // We might have unserialized something or switched CPUs, so make
366 // sure to re-read the misc regs.
367 miscRegValid = false;
368}
369
370void
371TLB::takeOverFrom(BaseTLB *_otlb)
372{
373 TLB *otlb = dynamic_cast<TLB*>(_otlb);
374 /* Make sure we actually have a valid type */
375 if (otlb) {
376 _attr = otlb->_attr;
377 haveLPAE = otlb->haveLPAE;
378 directToStage2 = otlb->directToStage2;
379 stage2Req = otlb->stage2Req;
380
381 /* Sync the stage2 MMU if they exist in both
382 * the old CPU and the new
383 */
384 if (!isStage2 &&
385 stage2Tlb && otlb->stage2Tlb) {
386 stage2Tlb->takeOverFrom(otlb->stage2Tlb);
387 }
388 } else {
389 panic("Incompatible TLB type!");
390 }
391}
392
393void
394TLB::serialize(CheckpointOut &cp) const
395{
396 DPRINTF(Checkpoint, "Serializing Arm TLB\n");
397
398 SERIALIZE_SCALAR(_attr);
399 SERIALIZE_SCALAR(haveLPAE);
400 SERIALIZE_SCALAR(directToStage2);
401 SERIALIZE_SCALAR(stage2Req);
402
403 int num_entries = size;
404 SERIALIZE_SCALAR(num_entries);
405 for (int i = 0; i < size; i++)
406 table[i].serializeSection(cp, csprintf("TlbEntry%d", i));
407}
408
409void
410TLB::unserialize(CheckpointIn &cp)
411{
412 DPRINTF(Checkpoint, "Unserializing Arm TLB\n");
413
414 UNSERIALIZE_SCALAR(_attr);
415 UNSERIALIZE_SCALAR(haveLPAE);
416 UNSERIALIZE_SCALAR(directToStage2);
417 UNSERIALIZE_SCALAR(stage2Req);
418
419 int num_entries;
420 UNSERIALIZE_SCALAR(num_entries);
421 for (int i = 0; i < min(size, num_entries); i++)
422 table[i].unserializeSection(cp, csprintf("TlbEntry%d", i));
423}
424
425void
426TLB::regStats()
427{
428 BaseTLB::regStats();
429 instHits
430 .name(name() + ".inst_hits")
431 .desc("ITB inst hits")
432 ;
433
434 instMisses
435 .name(name() + ".inst_misses")
436 .desc("ITB inst misses")
437 ;
438
439 instAccesses
440 .name(name() + ".inst_accesses")
441 .desc("ITB inst accesses")
442 ;
443
444 readHits
445 .name(name() + ".read_hits")
446 .desc("DTB read hits")
447 ;
448
449 readMisses
450 .name(name() + ".read_misses")
451 .desc("DTB read misses")
452 ;
453
454 readAccesses
455 .name(name() + ".read_accesses")
456 .desc("DTB read accesses")
457 ;
458
459 writeHits
460 .name(name() + ".write_hits")
461 .desc("DTB write hits")
462 ;
463
464 writeMisses
465 .name(name() + ".write_misses")
466 .desc("DTB write misses")
467 ;
468
469 writeAccesses
470 .name(name() + ".write_accesses")
471 .desc("DTB write accesses")
472 ;
473
474 hits
475 .name(name() + ".hits")
476 .desc("DTB hits")
477 ;
478
479 misses
480 .name(name() + ".misses")
481 .desc("DTB misses")
482 ;
483
484 accesses
485 .name(name() + ".accesses")
486 .desc("DTB accesses")
487 ;
488
489 flushTlb
490 .name(name() + ".flush_tlb")
491 .desc("Number of times complete TLB was flushed")
492 ;
493
494 flushTlbMva
495 .name(name() + ".flush_tlb_mva")
496 .desc("Number of times TLB was flushed by MVA")
497 ;
498
499 flushTlbMvaAsid
500 .name(name() + ".flush_tlb_mva_asid")
501 .desc("Number of times TLB was flushed by MVA & ASID")
502 ;
503
504 flushTlbAsid
505 .name(name() + ".flush_tlb_asid")
506 .desc("Number of times TLB was flushed by ASID")
507 ;
508
509 flushedEntries
510 .name(name() + ".flush_entries")
511 .desc("Number of entries that have been flushed from TLB")
512 ;
513
514 alignFaults
515 .name(name() + ".align_faults")
516 .desc("Number of TLB faults due to alignment restrictions")
517 ;
518
519 prefetchFaults
520 .name(name() + ".prefetch_faults")
521 .desc("Number of TLB faults due to prefetch")
522 ;
523
524 domainFaults
525 .name(name() + ".domain_faults")
526 .desc("Number of TLB faults due to domain restrictions")
527 ;
528
529 permsFaults
530 .name(name() + ".perms_faults")
531 .desc("Number of TLB faults due to permissions restrictions")
532 ;
533
534 instAccesses = instHits + instMisses;
535 readAccesses = readHits + readMisses;
536 writeAccesses = writeHits + writeMisses;
537 hits = readHits + writeHits + instHits;
538 misses = readMisses + writeMisses + instMisses;
539 accesses = readAccesses + writeAccesses + instAccesses;
540}
541
542void
543TLB::regProbePoints()
544{
545 ppRefills.reset(new ProbePoints::PMU(getProbeManager(), "Refills"));
546}
547
548Fault
549TLB::translateSe(RequestPtr req, ThreadContext *tc, Mode mode,
550 Translation *translation, bool &delay, bool timing)
551{
552 updateMiscReg(tc);
553 Addr vaddr_tainted = req->getVaddr();
554 Addr vaddr = 0;
555 if (aarch64)
556 vaddr = purifyTaggedAddr(vaddr_tainted, tc, aarch64EL, ttbcr);
557 else
558 vaddr = vaddr_tainted;
559 Request::Flags flags = req->getFlags();
560
561 bool is_fetch = (mode == Execute);
562 bool is_write = (mode == Write);
563
564 if (!is_fetch) {
565 assert(flags & MustBeOne);
566 if (sctlr.a || !(flags & AllowUnaligned)) {
567 if (vaddr & mask(flags & AlignmentMask)) {
568 // LPAE is always disabled in SE mode
569 return std::make_shared<DataAbort>(
570 vaddr_tainted,
571 TlbEntry::DomainType::NoAccess, is_write,
572 ArmFault::AlignmentFault, isStage2,
573 ArmFault::VmsaTran);
574 }
575 }
576 }
577
578 Addr paddr;
579 Process *p = tc->getProcessPtr();
580
581 if (!p->pTable->translate(vaddr, paddr))
582 return std::make_shared<GenericPageTableFault>(vaddr_tainted);
583 req->setPaddr(paddr);
584
585 return NoFault;
586}
587
588Fault
589TLB::checkPermissions(TlbEntry *te, RequestPtr req, Mode mode)
590{
591 Addr vaddr = req->getVaddr(); // 32-bit don't have to purify
592 Request::Flags flags = req->getFlags();
593 bool is_fetch = (mode == Execute);
594 bool is_write = (mode == Write);
595 bool is_priv = isPriv && !(flags & UserMode);
596
597 // Get the translation type from the actuall table entry
598 ArmFault::TranMethod tranMethod = te->longDescFormat ? ArmFault::LpaeTran
599 : ArmFault::VmsaTran;
600
601 // If this is the second stage of translation and the request is for a
602 // stage 1 page table walk then we need to check the HCR.PTW bit. This
603 // allows us to generate a fault if the request targets an area marked
604 // as a device or strongly ordered.
605 if (isStage2 && req->isPTWalk() && hcr.ptw &&
606 (te->mtype != TlbEntry::MemoryType::Normal)) {
607 return std::make_shared<DataAbort>(
608 vaddr, te->domain, is_write,
609 ArmFault::PermissionLL + te->lookupLevel,
610 isStage2, tranMethod);
611 }
612
613 // Generate an alignment fault for unaligned data accesses to device or
614 // strongly ordered memory
615 if (!is_fetch) {
616 if (te->mtype != TlbEntry::MemoryType::Normal) {
617 if (vaddr & mask(flags & AlignmentMask)) {
618 alignFaults++;
619 return std::make_shared<DataAbort>(
620 vaddr, TlbEntry::DomainType::NoAccess, is_write,
621 ArmFault::AlignmentFault, isStage2,
622 tranMethod);
623 }
624 }
625 }
626
627 if (te->nonCacheable) {
628 // Prevent prefetching from I/O devices.
629 if (req->isPrefetch()) {
630 // Here we can safely use the fault status for the short
631 // desc. format in all cases
632 return std::make_shared<PrefetchAbort>(
633 vaddr, ArmFault::PrefetchUncacheable,
634 isStage2, tranMethod);
635 }
636 }
637
638 if (!te->longDescFormat) {
639 switch ((dacr >> (static_cast<uint8_t>(te->domain) * 2)) & 0x3) {
640 case 0:
641 domainFaults++;
642 DPRINTF(TLB, "TLB Fault: Data abort on domain. DACR: %#x"
643 " domain: %#x write:%d\n", dacr,
644 static_cast<uint8_t>(te->domain), is_write);
| 3 * All rights reserved
4 *
5 * The license below extends only to copyright in the software and shall
6 * not be construed as granting a license to any other intellectual
7 * property including but not limited to intellectual property relating
8 * to a hardware implementation of the functionality of the software
9 * licensed hereunder. You may use the software subject to the license
10 * terms below provided that you ensure that this notice is replicated
11 * unmodified and in its entirety in all distributions of the software,
12 * modified or unmodified, in source code or in binary form.
13 *
14 * Copyright (c) 2001-2005 The Regents of The University of Michigan
15 * All rights reserved.
16 *
17 * Redistribution and use in source and binary forms, with or without
18 * modification, are permitted provided that the following conditions are
19 * met: redistributions of source code must retain the above copyright
20 * notice, this list of conditions and the following disclaimer;
21 * redistributions in binary form must reproduce the above copyright
22 * notice, this list of conditions and the following disclaimer in the
23 * documentation and/or other materials provided with the distribution;
24 * neither the name of the copyright holders nor the names of its
25 * contributors may be used to endorse or promote products derived from
26 * this software without specific prior written permission.
27 *
28 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
29 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
30 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
31 * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
32 * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
33 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
34 * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
35 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
36 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
37 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
38 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
39 *
40 * Authors: Ali Saidi
41 * Nathan Binkert
42 * Steve Reinhardt
43 */
44
45#include "arch/arm/tlb.hh"
46
47#include <memory>
48#include <string>
49#include <vector>
50
51#include "arch/arm/faults.hh"
52#include "arch/arm/pagetable.hh"
53#include "arch/arm/stage2_lookup.hh"
54#include "arch/arm/stage2_mmu.hh"
55#include "arch/arm/system.hh"
56#include "arch/arm/table_walker.hh"
57#include "arch/arm/utility.hh"
58#include "base/inifile.hh"
59#include "base/str.hh"
60#include "base/trace.hh"
61#include "cpu/base.hh"
62#include "cpu/thread_context.hh"
63#include "debug/Checkpoint.hh"
64#include "debug/TLB.hh"
65#include "debug/TLBVerbose.hh"
66#include "mem/page_table.hh"
67#include "mem/request.hh"
68#include "params/ArmTLB.hh"
69#include "sim/full_system.hh"
70#include "sim/process.hh"
71
72using namespace std;
73using namespace ArmISA;
74
75TLB::TLB(const ArmTLBParams *p)
76 : BaseTLB(p), table(new TlbEntry[p->size]), size(p->size),
77 isStage2(p->is_stage2), stage2Req(false), _attr(0),
78 directToStage2(false), tableWalker(p->walker), stage2Tlb(NULL),
79 stage2Mmu(NULL), test(nullptr), rangeMRU(1),
80 aarch64(false), aarch64EL(EL0), isPriv(false), isSecure(false),
81 isHyp(false), asid(0), vmid(0), dacr(0),
82 miscRegValid(false), miscRegContext(0), curTranType(NormalTran)
83{
84 tableWalker->setTlb(this);
85
86 // Cache system-level properties
87 haveLPAE = tableWalker->haveLPAE();
88 haveVirtualization = tableWalker->haveVirtualization();
89 haveLargeAsid64 = tableWalker->haveLargeAsid64();
90}
91
92TLB::~TLB()
93{
94 delete[] table;
95}
96
97void
98TLB::init()
99{
100 if (stage2Mmu && !isStage2)
101 stage2Tlb = stage2Mmu->stage2Tlb();
102}
103
104void
105TLB::setMMU(Stage2MMU *m, MasterID master_id)
106{
107 stage2Mmu = m;
108 tableWalker->setMMU(m, master_id);
109}
110
111bool
112TLB::translateFunctional(ThreadContext *tc, Addr va, Addr &pa)
113{
114 updateMiscReg(tc);
115
116 if (directToStage2) {
117 assert(stage2Tlb);
118 return stage2Tlb->translateFunctional(tc, va, pa);
119 }
120
121 TlbEntry *e = lookup(va, asid, vmid, isHyp, isSecure, true, false,
122 aarch64 ? aarch64EL : EL1);
123 if (!e)
124 return false;
125 pa = e->pAddr(va);
126 return true;
127}
128
129Fault
130TLB::finalizePhysical(RequestPtr req, ThreadContext *tc, Mode mode) const
131{
132 return NoFault;
133}
134
135TlbEntry*
136TLB::lookup(Addr va, uint16_t asn, uint8_t vmid, bool hyp, bool secure,
137 bool functional, bool ignore_asn, uint8_t target_el)
138{
139
140 TlbEntry *retval = NULL;
141
142 // Maintaining LRU array
143 int x = 0;
144 while (retval == NULL && x < size) {
145 if ((!ignore_asn && table[x].match(va, asn, vmid, hyp, secure, false,
146 target_el)) ||
147 (ignore_asn && table[x].match(va, vmid, hyp, secure, target_el))) {
148 // We only move the hit entry ahead when the position is higher
149 // than rangeMRU
150 if (x > rangeMRU && !functional) {
151 TlbEntry tmp_entry = table[x];
152 for (int i = x; i > 0; i--)
153 table[i] = table[i - 1];
154 table[0] = tmp_entry;
155 retval = &table[0];
156 } else {
157 retval = &table[x];
158 }
159 break;
160 }
161 ++x;
162 }
163
164 DPRINTF(TLBVerbose, "Lookup %#x, asn %#x -> %s vmn 0x%x hyp %d secure %d "
165 "ppn %#x size: %#x pa: %#x ap:%d ns:%d nstid:%d g:%d asid: %d "
166 "el: %d\n",
167 va, asn, retval ? "hit" : "miss", vmid, hyp, secure,
168 retval ? retval->pfn : 0, retval ? retval->size : 0,
169 retval ? retval->pAddr(va) : 0, retval ? retval->ap : 0,
170 retval ? retval->ns : 0, retval ? retval->nstid : 0,
171 retval ? retval->global : 0, retval ? retval->asid : 0,
172 retval ? retval->el : 0);
173
174 return retval;
175}
176
177// insert a new TLB entry
178void
179TLB::insert(Addr addr, TlbEntry &entry)
180{
181 DPRINTF(TLB, "Inserting entry into TLB with pfn:%#x size:%#x vpn: %#x"
182 " asid:%d vmid:%d N:%d global:%d valid:%d nc:%d xn:%d"
183 " ap:%#x domain:%#x ns:%d nstid:%d isHyp:%d\n", entry.pfn,
184 entry.size, entry.vpn, entry.asid, entry.vmid, entry.N,
185 entry.global, entry.valid, entry.nonCacheable, entry.xn,
186 entry.ap, static_cast<uint8_t>(entry.domain), entry.ns, entry.nstid,
187 entry.isHyp);
188
189 if (table[size - 1].valid)
190 DPRINTF(TLB, " - Replacing Valid entry %#x, asn %d vmn %d ppn %#x "
191 "size: %#x ap:%d ns:%d nstid:%d g:%d isHyp:%d el: %d\n",
192 table[size-1].vpn << table[size-1].N, table[size-1].asid,
193 table[size-1].vmid, table[size-1].pfn << table[size-1].N,
194 table[size-1].size, table[size-1].ap, table[size-1].ns,
195 table[size-1].nstid, table[size-1].global, table[size-1].isHyp,
196 table[size-1].el);
197
198 //inserting to MRU position and evicting the LRU one
199
200 for (int i = size - 1; i > 0; --i)
201 table[i] = table[i-1];
202 table[0] = entry;
203
204 inserts++;
205 ppRefills->notify(1);
206}
207
208void
209TLB::printTlb() const
210{
211 int x = 0;
212 TlbEntry *te;
213 DPRINTF(TLB, "Current TLB contents:\n");
214 while (x < size) {
215 te = &table[x];
216 if (te->valid)
217 DPRINTF(TLB, " * %s\n", te->print());
218 ++x;
219 }
220}
221
222void
223TLB::flushAllSecurity(bool secure_lookup, uint8_t target_el, bool ignore_el)
224{
225 DPRINTF(TLB, "Flushing all TLB entries (%s lookup)\n",
226 (secure_lookup ? "secure" : "non-secure"));
227 int x = 0;
228 TlbEntry *te;
229 while (x < size) {
230 te = &table[x];
231 if (te->valid && secure_lookup == !te->nstid &&
232 (te->vmid == vmid || secure_lookup) &&
233 checkELMatch(target_el, te->el, ignore_el)) {
234
235 DPRINTF(TLB, " - %s\n", te->print());
236 te->valid = false;
237 flushedEntries++;
238 }
239 ++x;
240 }
241
242 flushTlb++;
243
244 // If there's a second stage TLB (and we're not it) then flush it as well
245 // if we're currently in hyp mode
246 if (!isStage2 && isHyp) {
247 stage2Tlb->flushAllSecurity(secure_lookup, true);
248 }
249}
250
251void
252TLB::flushAllNs(bool hyp, uint8_t target_el, bool ignore_el)
253{
254 DPRINTF(TLB, "Flushing all NS TLB entries (%s lookup)\n",
255 (hyp ? "hyp" : "non-hyp"));
256 int x = 0;
257 TlbEntry *te;
258 while (x < size) {
259 te = &table[x];
260 if (te->valid && te->nstid && te->isHyp == hyp &&
261 checkELMatch(target_el, te->el, ignore_el)) {
262
263 DPRINTF(TLB, " - %s\n", te->print());
264 flushedEntries++;
265 te->valid = false;
266 }
267 ++x;
268 }
269
270 flushTlb++;
271
272 // If there's a second stage TLB (and we're not it) then flush it as well
273 if (!isStage2 && !hyp) {
274 stage2Tlb->flushAllNs(false, true);
275 }
276}
277
278void
279TLB::flushMvaAsid(Addr mva, uint64_t asn, bool secure_lookup, uint8_t target_el)
280{
281 DPRINTF(TLB, "Flushing TLB entries with mva: %#x, asid: %#x "
282 "(%s lookup)\n", mva, asn, (secure_lookup ?
283 "secure" : "non-secure"));
284 _flushMva(mva, asn, secure_lookup, false, false, target_el);
285 flushTlbMvaAsid++;
286}
287
288void
289TLB::flushAsid(uint64_t asn, bool secure_lookup, uint8_t target_el)
290{
291 DPRINTF(TLB, "Flushing TLB entries with asid: %#x (%s lookup)\n", asn,
292 (secure_lookup ? "secure" : "non-secure"));
293
294 int x = 0 ;
295 TlbEntry *te;
296
297 while (x < size) {
298 te = &table[x];
299 if (te->valid && te->asid == asn && secure_lookup == !te->nstid &&
300 (te->vmid == vmid || secure_lookup) &&
301 checkELMatch(target_el, te->el, false)) {
302
303 te->valid = false;
304 DPRINTF(TLB, " - %s\n", te->print());
305 flushedEntries++;
306 }
307 ++x;
308 }
309 flushTlbAsid++;
310}
311
312void
313TLB::flushMva(Addr mva, bool secure_lookup, bool hyp, uint8_t target_el)
314{
315 DPRINTF(TLB, "Flushing TLB entries with mva: %#x (%s lookup)\n", mva,
316 (secure_lookup ? "secure" : "non-secure"));
317 _flushMva(mva, 0xbeef, secure_lookup, hyp, true, target_el);
318 flushTlbMva++;
319}
320
321void
322TLB::_flushMva(Addr mva, uint64_t asn, bool secure_lookup, bool hyp,
323 bool ignore_asn, uint8_t target_el)
324{
325 TlbEntry *te;
326 // D5.7.2: Sign-extend address to 64 bits
327 mva = sext<56>(mva);
328 te = lookup(mva, asn, vmid, hyp, secure_lookup, false, ignore_asn,
329 target_el);
330 while (te != NULL) {
331 if (secure_lookup == !te->nstid) {
332 DPRINTF(TLB, " - %s\n", te->print());
333 te->valid = false;
334 flushedEntries++;
335 }
336 te = lookup(mva, asn, vmid, hyp, secure_lookup, false, ignore_asn,
337 target_el);
338 }
339}
340
341void
342TLB::flushIpaVmid(Addr ipa, bool secure_lookup, bool hyp, uint8_t target_el)
343{
344 assert(!isStage2);
345 stage2Tlb->_flushMva(ipa, 0xbeef, secure_lookup, hyp, true, target_el);
346}
347
348bool
349TLB::checkELMatch(uint8_t target_el, uint8_t tentry_el, bool ignore_el)
350{
351 bool elMatch = true;
352 if (!ignore_el) {
353 if (target_el == 2 || target_el == 3) {
354 elMatch = (tentry_el == target_el);
355 } else {
356 elMatch = (tentry_el == 0) || (tentry_el == 1);
357 }
358 }
359 return elMatch;
360}
361
362void
363TLB::drainResume()
364{
365 // We might have unserialized something or switched CPUs, so make
366 // sure to re-read the misc regs.
367 miscRegValid = false;
368}
369
370void
371TLB::takeOverFrom(BaseTLB *_otlb)
372{
373 TLB *otlb = dynamic_cast<TLB*>(_otlb);
374 /* Make sure we actually have a valid type */
375 if (otlb) {
376 _attr = otlb->_attr;
377 haveLPAE = otlb->haveLPAE;
378 directToStage2 = otlb->directToStage2;
379 stage2Req = otlb->stage2Req;
380
381 /* Sync the stage2 MMU if they exist in both
382 * the old CPU and the new
383 */
384 if (!isStage2 &&
385 stage2Tlb && otlb->stage2Tlb) {
386 stage2Tlb->takeOverFrom(otlb->stage2Tlb);
387 }
388 } else {
389 panic("Incompatible TLB type!");
390 }
391}
392
393void
394TLB::serialize(CheckpointOut &cp) const
395{
396 DPRINTF(Checkpoint, "Serializing Arm TLB\n");
397
398 SERIALIZE_SCALAR(_attr);
399 SERIALIZE_SCALAR(haveLPAE);
400 SERIALIZE_SCALAR(directToStage2);
401 SERIALIZE_SCALAR(stage2Req);
402
403 int num_entries = size;
404 SERIALIZE_SCALAR(num_entries);
405 for (int i = 0; i < size; i++)
406 table[i].serializeSection(cp, csprintf("TlbEntry%d", i));
407}
408
409void
410TLB::unserialize(CheckpointIn &cp)
411{
412 DPRINTF(Checkpoint, "Unserializing Arm TLB\n");
413
414 UNSERIALIZE_SCALAR(_attr);
415 UNSERIALIZE_SCALAR(haveLPAE);
416 UNSERIALIZE_SCALAR(directToStage2);
417 UNSERIALIZE_SCALAR(stage2Req);
418
419 int num_entries;
420 UNSERIALIZE_SCALAR(num_entries);
421 for (int i = 0; i < min(size, num_entries); i++)
422 table[i].unserializeSection(cp, csprintf("TlbEntry%d", i));
423}
424
425void
426TLB::regStats()
427{
428 BaseTLB::regStats();
429 instHits
430 .name(name() + ".inst_hits")
431 .desc("ITB inst hits")
432 ;
433
434 instMisses
435 .name(name() + ".inst_misses")
436 .desc("ITB inst misses")
437 ;
438
439 instAccesses
440 .name(name() + ".inst_accesses")
441 .desc("ITB inst accesses")
442 ;
443
444 readHits
445 .name(name() + ".read_hits")
446 .desc("DTB read hits")
447 ;
448
449 readMisses
450 .name(name() + ".read_misses")
451 .desc("DTB read misses")
452 ;
453
454 readAccesses
455 .name(name() + ".read_accesses")
456 .desc("DTB read accesses")
457 ;
458
459 writeHits
460 .name(name() + ".write_hits")
461 .desc("DTB write hits")
462 ;
463
464 writeMisses
465 .name(name() + ".write_misses")
466 .desc("DTB write misses")
467 ;
468
469 writeAccesses
470 .name(name() + ".write_accesses")
471 .desc("DTB write accesses")
472 ;
473
474 hits
475 .name(name() + ".hits")
476 .desc("DTB hits")
477 ;
478
479 misses
480 .name(name() + ".misses")
481 .desc("DTB misses")
482 ;
483
484 accesses
485 .name(name() + ".accesses")
486 .desc("DTB accesses")
487 ;
488
489 flushTlb
490 .name(name() + ".flush_tlb")
491 .desc("Number of times complete TLB was flushed")
492 ;
493
494 flushTlbMva
495 .name(name() + ".flush_tlb_mva")
496 .desc("Number of times TLB was flushed by MVA")
497 ;
498
499 flushTlbMvaAsid
500 .name(name() + ".flush_tlb_mva_asid")
501 .desc("Number of times TLB was flushed by MVA & ASID")
502 ;
503
504 flushTlbAsid
505 .name(name() + ".flush_tlb_asid")
506 .desc("Number of times TLB was flushed by ASID")
507 ;
508
509 flushedEntries
510 .name(name() + ".flush_entries")
511 .desc("Number of entries that have been flushed from TLB")
512 ;
513
514 alignFaults
515 .name(name() + ".align_faults")
516 .desc("Number of TLB faults due to alignment restrictions")
517 ;
518
519 prefetchFaults
520 .name(name() + ".prefetch_faults")
521 .desc("Number of TLB faults due to prefetch")
522 ;
523
524 domainFaults
525 .name(name() + ".domain_faults")
526 .desc("Number of TLB faults due to domain restrictions")
527 ;
528
529 permsFaults
530 .name(name() + ".perms_faults")
531 .desc("Number of TLB faults due to permissions restrictions")
532 ;
533
534 instAccesses = instHits + instMisses;
535 readAccesses = readHits + readMisses;
536 writeAccesses = writeHits + writeMisses;
537 hits = readHits + writeHits + instHits;
538 misses = readMisses + writeMisses + instMisses;
539 accesses = readAccesses + writeAccesses + instAccesses;
540}
541
542void
543TLB::regProbePoints()
544{
545 ppRefills.reset(new ProbePoints::PMU(getProbeManager(), "Refills"));
546}
547
548Fault
549TLB::translateSe(RequestPtr req, ThreadContext *tc, Mode mode,
550 Translation *translation, bool &delay, bool timing)
551{
552 updateMiscReg(tc);
553 Addr vaddr_tainted = req->getVaddr();
554 Addr vaddr = 0;
555 if (aarch64)
556 vaddr = purifyTaggedAddr(vaddr_tainted, tc, aarch64EL, ttbcr);
557 else
558 vaddr = vaddr_tainted;
559 Request::Flags flags = req->getFlags();
560
561 bool is_fetch = (mode == Execute);
562 bool is_write = (mode == Write);
563
564 if (!is_fetch) {
565 assert(flags & MustBeOne);
566 if (sctlr.a || !(flags & AllowUnaligned)) {
567 if (vaddr & mask(flags & AlignmentMask)) {
568 // LPAE is always disabled in SE mode
569 return std::make_shared<DataAbort>(
570 vaddr_tainted,
571 TlbEntry::DomainType::NoAccess, is_write,
572 ArmFault::AlignmentFault, isStage2,
573 ArmFault::VmsaTran);
574 }
575 }
576 }
577
578 Addr paddr;
579 Process *p = tc->getProcessPtr();
580
581 if (!p->pTable->translate(vaddr, paddr))
582 return std::make_shared<GenericPageTableFault>(vaddr_tainted);
583 req->setPaddr(paddr);
584
585 return NoFault;
586}
587
588Fault
589TLB::checkPermissions(TlbEntry *te, RequestPtr req, Mode mode)
590{
591 Addr vaddr = req->getVaddr(); // 32-bit don't have to purify
592 Request::Flags flags = req->getFlags();
593 bool is_fetch = (mode == Execute);
594 bool is_write = (mode == Write);
595 bool is_priv = isPriv && !(flags & UserMode);
596
597 // Get the translation type from the actuall table entry
598 ArmFault::TranMethod tranMethod = te->longDescFormat ? ArmFault::LpaeTran
599 : ArmFault::VmsaTran;
600
601 // If this is the second stage of translation and the request is for a
602 // stage 1 page table walk then we need to check the HCR.PTW bit. This
603 // allows us to generate a fault if the request targets an area marked
604 // as a device or strongly ordered.
605 if (isStage2 && req->isPTWalk() && hcr.ptw &&
606 (te->mtype != TlbEntry::MemoryType::Normal)) {
607 return std::make_shared<DataAbort>(
608 vaddr, te->domain, is_write,
609 ArmFault::PermissionLL + te->lookupLevel,
610 isStage2, tranMethod);
611 }
612
613 // Generate an alignment fault for unaligned data accesses to device or
614 // strongly ordered memory
615 if (!is_fetch) {
616 if (te->mtype != TlbEntry::MemoryType::Normal) {
617 if (vaddr & mask(flags & AlignmentMask)) {
618 alignFaults++;
619 return std::make_shared<DataAbort>(
620 vaddr, TlbEntry::DomainType::NoAccess, is_write,
621 ArmFault::AlignmentFault, isStage2,
622 tranMethod);
623 }
624 }
625 }
626
627 if (te->nonCacheable) {
628 // Prevent prefetching from I/O devices.
629 if (req->isPrefetch()) {
630 // Here we can safely use the fault status for the short
631 // desc. format in all cases
632 return std::make_shared<PrefetchAbort>(
633 vaddr, ArmFault::PrefetchUncacheable,
634 isStage2, tranMethod);
635 }
636 }
637
638 if (!te->longDescFormat) {
639 switch ((dacr >> (static_cast<uint8_t>(te->domain) * 2)) & 0x3) {
640 case 0:
641 domainFaults++;
642 DPRINTF(TLB, "TLB Fault: Data abort on domain. DACR: %#x"
643 " domain: %#x write:%d\n", dacr,
644 static_cast<uint8_t>(te->domain), is_write);
|
740 ArmFault::PermissionLL + te->lookupLevel,
741 isStage2, tranMethod);
742 } else if (abt | hapAbt) {
743 permsFaults++;
744 DPRINTF(TLB, "TLB Fault: Data abort on permission check. AP:%d priv:%d"
745 " write:%d\n", ap, is_priv, is_write);
746 return std::make_shared<DataAbort>(
747 vaddr, te->domain, is_write,
748 ArmFault::PermissionLL + te->lookupLevel,
749 isStage2 | !abt, tranMethod);
750 }
751 return NoFault;
752}
753
754
755Fault
756TLB::checkPermissions64(TlbEntry *te, RequestPtr req, Mode mode,
757 ThreadContext *tc)
758{
759 assert(aarch64);
760
761 Addr vaddr_tainted = req->getVaddr();
762 Addr vaddr = purifyTaggedAddr(vaddr_tainted, tc, aarch64EL, ttbcr);
763
764 Request::Flags flags = req->getFlags();
765 bool is_fetch = (mode == Execute);
766 bool is_write = (mode == Write);
767 bool is_priv M5_VAR_USED = isPriv && !(flags & UserMode);
768
769 updateMiscReg(tc, curTranType);
770
771 // If this is the second stage of translation and the request is for a
772 // stage 1 page table walk then we need to check the HCR.PTW bit. This
773 // allows us to generate a fault if the request targets an area marked
774 // as a device or strongly ordered.
775 if (isStage2 && req->isPTWalk() && hcr.ptw &&
776 (te->mtype != TlbEntry::MemoryType::Normal)) {
777 return std::make_shared<DataAbort>(
778 vaddr_tainted, te->domain, is_write,
779 ArmFault::PermissionLL + te->lookupLevel,
780 isStage2, ArmFault::LpaeTran);
781 }
782
783 // Generate an alignment fault for unaligned accesses to device or
784 // strongly ordered memory
785 if (!is_fetch) {
786 if (te->mtype != TlbEntry::MemoryType::Normal) {
787 if (vaddr & mask(flags & AlignmentMask)) {
788 alignFaults++;
789 return std::make_shared<DataAbort>(
790 vaddr_tainted,
791 TlbEntry::DomainType::NoAccess, is_write,
792 ArmFault::AlignmentFault, isStage2,
793 ArmFault::LpaeTran);
794 }
795 }
796 }
797
798 if (te->nonCacheable) {
799 // Prevent prefetching from I/O devices.
800 if (req->isPrefetch()) {
801 // Here we can safely use the fault status for the short
802 // desc. format in all cases
803 return std::make_shared<PrefetchAbort>(
804 vaddr_tainted,
805 ArmFault::PrefetchUncacheable,
806 isStage2, ArmFault::LpaeTran);
807 }
808 }
809
810 uint8_t ap = 0x3 & (te->ap); // 2-bit access protection field
811 bool grant = false;
812
813 uint8_t xn = te->xn;
814 uint8_t pxn = te->pxn;
815 bool r = !is_write && !is_fetch;
816 bool w = is_write;
817 bool x = is_fetch;
818 DPRINTF(TLBVerbose, "Checking permissions: ap:%d, xn:%d, pxn:%d, r:%d, "
819 "w:%d, x:%d\n", ap, xn, pxn, r, w, x);
820
821 if (isStage2) {
822 assert(ArmSystem::haveVirtualization(tc) && aarch64EL != EL2);
823 // In stage 2 we use the hypervisor access permission bits.
824 // The following permissions are described in ARM DDI 0487A.f
825 // D4-1802
826 uint8_t hap = 0x3 & te->hap;
827 if (is_fetch) {
828 // sctlr.wxn overrides the xn bit
829 grant = !sctlr.wxn && !xn;
830 } else if (is_write) {
831 grant = hap & 0x2;
832 } else { // is_read
833 grant = hap & 0x1;
834 }
835 } else {
836 switch (aarch64EL) {
837 case EL0:
838 {
839 uint8_t perm = (ap << 2) | (xn << 1) | pxn;
840 switch (perm) {
841 case 0:
842 case 1:
843 case 8:
844 case 9:
845 grant = x;
846 break;
847 case 4:
848 case 5:
849 grant = r || w || (x && !sctlr.wxn);
850 break;
851 case 6:
852 case 7:
853 grant = r || w;
854 break;
855 case 12:
856 case 13:
857 grant = r || x;
858 break;
859 case 14:
860 case 15:
861 grant = r;
862 break;
863 default:
864 grant = false;
865 }
866 }
867 break;
868 case EL1:
869 {
870 uint8_t perm = (ap << 2) | (xn << 1) | pxn;
871 switch (perm) {
872 case 0:
873 case 2:
874 grant = r || w || (x && !sctlr.wxn);
875 break;
876 case 1:
877 case 3:
878 case 4:
879 case 5:
880 case 6:
881 case 7:
882 // regions that are writeable at EL0 should not be
883 // executable at EL1
884 grant = r || w;
885 break;
886 case 8:
887 case 10:
888 case 12:
889 case 14:
890 grant = r || x;
891 break;
892 case 9:
893 case 11:
894 case 13:
895 case 15:
896 grant = r;
897 break;
898 default:
899 grant = false;
900 }
901 }
902 break;
903 case EL2:
904 case EL3:
905 {
906 uint8_t perm = (ap & 0x2) | xn;
907 switch (perm) {
908 case 0:
909 grant = r || w || (x && !sctlr.wxn) ;
910 break;
911 case 1:
912 grant = r || w;
913 break;
914 case 2:
915 grant = r || x;
916 break;
917 case 3:
918 grant = r;
919 break;
920 default:
921 grant = false;
922 }
923 }
924 break;
925 }
926 }
927
928 if (!grant) {
929 if (is_fetch) {
930 permsFaults++;
931 DPRINTF(TLB, "TLB Fault: Prefetch abort on permission check. "
932 "AP:%d priv:%d write:%d ns:%d sif:%d "
933 "sctlr.afe: %d\n",
934 ap, is_priv, is_write, te->ns, scr.sif, sctlr.afe);
935 // Use PC value instead of vaddr because vaddr might be aligned to
936 // cache line and should not be the address reported in FAR
937 return std::make_shared<PrefetchAbort>(
938 req->getPC(),
939 ArmFault::PermissionLL + te->lookupLevel,
940 isStage2, ArmFault::LpaeTran);
941 } else {
942 permsFaults++;
943 DPRINTF(TLB, "TLB Fault: Data abort on permission check. AP:%d "
944 "priv:%d write:%d\n", ap, is_priv, is_write);
945 return std::make_shared<DataAbort>(
946 vaddr_tainted, te->domain, is_write,
947 ArmFault::PermissionLL + te->lookupLevel,
948 isStage2, ArmFault::LpaeTran);
949 }
950 }
951
952 return NoFault;
953}
954
955Fault
956TLB::translateFs(RequestPtr req, ThreadContext *tc, Mode mode,
957 Translation *translation, bool &delay, bool timing,
958 TLB::ArmTranslationType tranType, bool functional)
959{
960 // No such thing as a functional timing access
961 assert(!(timing && functional));
962
963 updateMiscReg(tc, tranType);
964
965 Addr vaddr_tainted = req->getVaddr();
966 Addr vaddr = 0;
967 if (aarch64)
968 vaddr = purifyTaggedAddr(vaddr_tainted, tc, aarch64EL, ttbcr);
969 else
970 vaddr = vaddr_tainted;
971 Request::Flags flags = req->getFlags();
972
973 bool is_fetch = (mode == Execute);
974 bool is_write = (mode == Write);
975 bool long_desc_format = aarch64 || longDescFormatInUse(tc);
976 ArmFault::TranMethod tranMethod = long_desc_format ? ArmFault::LpaeTran
977 : ArmFault::VmsaTran;
978
979 req->setAsid(asid);
980
981 DPRINTF(TLBVerbose, "CPSR is priv:%d UserMode:%d secure:%d S1S2NsTran:%d\n",
982 isPriv, flags & UserMode, isSecure, tranType & S1S2NsTran);
983
984 DPRINTF(TLB, "translateFs addr %#x, mode %d, st2 %d, scr %#x sctlr %#x "
985 "flags %#lx tranType 0x%x\n", vaddr_tainted, mode, isStage2,
986 scr, sctlr, flags, tranType);
987
988 if ((req->isInstFetch() && (!sctlr.i)) ||
989 ((!req->isInstFetch()) && (!sctlr.c))){
990 req->setFlags(Request::UNCACHEABLE | Request::STRICT_ORDER);
991 }
992 if (!is_fetch) {
993 assert(flags & MustBeOne);
994 if (sctlr.a || !(flags & AllowUnaligned)) {
995 if (vaddr & mask(flags & AlignmentMask)) {
996 alignFaults++;
997 return std::make_shared<DataAbort>(
998 vaddr_tainted,
999 TlbEntry::DomainType::NoAccess, is_write,
1000 ArmFault::AlignmentFault, isStage2,
1001 tranMethod);
1002 }
1003 }
1004 }
1005
1006 // If guest MMU is off or hcr.vm=0 go straight to stage2
1007 if ((isStage2 && !hcr.vm) || (!isStage2 && !sctlr.m)) {
1008
1009 req->setPaddr(vaddr);
1010 // When the MMU is off the security attribute corresponds to the
1011 // security state of the processor
1012 if (isSecure)
1013 req->setFlags(Request::SECURE);
1014
1015 // @todo: double check this (ARM ARM issue C B3.2.1)
1016 if (long_desc_format || sctlr.tre == 0) {
1017 req->setFlags(Request::UNCACHEABLE | Request::STRICT_ORDER);
1018 } else {
1019 if (nmrr.ir0 == 0 || nmrr.or0 == 0 || prrr.tr0 != 0x2)
1020 req->setFlags(Request::UNCACHEABLE | Request::STRICT_ORDER);
1021 }
1022
1023 // Set memory attributes
1024 TlbEntry temp_te;
1025 temp_te.ns = !isSecure;
1026 if (isStage2 || hcr.dc == 0 || isSecure ||
1027 (isHyp && !(tranType & S1CTran))) {
1028
1029 temp_te.mtype = is_fetch ? TlbEntry::MemoryType::Normal
1030 : TlbEntry::MemoryType::StronglyOrdered;
1031 temp_te.innerAttrs = 0x0;
1032 temp_te.outerAttrs = 0x0;
1033 temp_te.shareable = true;
1034 temp_te.outerShareable = true;
1035 } else {
1036 temp_te.mtype = TlbEntry::MemoryType::Normal;
1037 temp_te.innerAttrs = 0x3;
1038 temp_te.outerAttrs = 0x3;
1039 temp_te.shareable = false;
1040 temp_te.outerShareable = false;
1041 }
1042 temp_te.setAttributes(long_desc_format);
1043 DPRINTF(TLBVerbose, "(No MMU) setting memory attributes: shareable: "
1044 "%d, innerAttrs: %d, outerAttrs: %d, isStage2: %d\n",
1045 temp_te.shareable, temp_te.innerAttrs, temp_te.outerAttrs,
1046 isStage2);
1047 setAttr(temp_te.attributes);
1048
1049 return testTranslation(req, mode, TlbEntry::DomainType::NoAccess);
1050 }
1051
1052 DPRINTF(TLBVerbose, "Translating %s=%#x context=%d\n",
1053 isStage2 ? "IPA" : "VA", vaddr_tainted, asid);
1054 // Translation enabled
1055
1056 TlbEntry *te = NULL;
1057 TlbEntry mergeTe;
1058 Fault fault = getResultTe(&te, req, tc, mode, translation, timing,
1059 functional, &mergeTe);
1060 // only proceed if we have a valid table entry
1061 if ((te == NULL) && (fault == NoFault)) delay = true;
1062
1063 // If we have the table entry transfer some of the attributes to the
1064 // request that triggered the translation
1065 if (te != NULL) {
1066 // Set memory attributes
1067 DPRINTF(TLBVerbose,
1068 "Setting memory attributes: shareable: %d, innerAttrs: %d, "
1069 "outerAttrs: %d, mtype: %d, isStage2: %d\n",
1070 te->shareable, te->innerAttrs, te->outerAttrs,
1071 static_cast<uint8_t>(te->mtype), isStage2);
1072 setAttr(te->attributes);
1073
1074 if (te->nonCacheable)
1075 req->setFlags(Request::UNCACHEABLE);
1076
1077 // Require requests to be ordered if the request goes to
1078 // strongly ordered or device memory (i.e., anything other
1079 // than normal memory requires strict order).
1080 if (te->mtype != TlbEntry::MemoryType::Normal)
1081 req->setFlags(Request::STRICT_ORDER);
1082
1083 Addr pa = te->pAddr(vaddr);
1084 req->setPaddr(pa);
1085
1086 if (isSecure && !te->ns) {
1087 req->setFlags(Request::SECURE);
1088 }
1089 if ((!is_fetch) && (vaddr & mask(flags & AlignmentMask)) &&
1090 (te->mtype != TlbEntry::MemoryType::Normal)) {
1091 // Unaligned accesses to Device memory should always cause an
1092 // abort regardless of sctlr.a
1093 alignFaults++;
1094 return std::make_shared<DataAbort>(
1095 vaddr_tainted,
1096 TlbEntry::DomainType::NoAccess, is_write,
1097 ArmFault::AlignmentFault, isStage2,
1098 tranMethod);
1099 }
1100
1101 // Check for a trickbox generated address fault
1102 if (fault == NoFault)
1103 fault = testTranslation(req, mode, te->domain);
1104 }
1105
1106 // Generate Illegal Inst Set State fault if IL bit is set in CPSR
1107 if (fault == NoFault) {
1108 if (aarch64 && is_fetch && cpsr.il == 1) {
1109 return std::make_shared<IllegalInstSetStateFault>();
1110 }
1111 }
1112
1113 return fault;
1114}
1115
1116Fault
1117TLB::translateAtomic(RequestPtr req, ThreadContext *tc, Mode mode,
1118 TLB::ArmTranslationType tranType)
1119{
1120 updateMiscReg(tc, tranType);
1121
1122 if (directToStage2) {
1123 assert(stage2Tlb);
1124 return stage2Tlb->translateAtomic(req, tc, mode, tranType);
1125 }
1126
1127 bool delay = false;
1128 Fault fault;
1129 if (FullSystem)
1130 fault = translateFs(req, tc, mode, NULL, delay, false, tranType);
1131 else
1132 fault = translateSe(req, tc, mode, NULL, delay, false);
1133 assert(!delay);
1134 return fault;
1135}
1136
1137Fault
1138TLB::translateFunctional(RequestPtr req, ThreadContext *tc, Mode mode,
1139 TLB::ArmTranslationType tranType)
1140{
1141 updateMiscReg(tc, tranType);
1142
1143 if (directToStage2) {
1144 assert(stage2Tlb);
1145 return stage2Tlb->translateFunctional(req, tc, mode, tranType);
1146 }
1147
1148 bool delay = false;
1149 Fault fault;
1150 if (FullSystem)
1151 fault = translateFs(req, tc, mode, NULL, delay, false, tranType, true);
1152 else
1153 fault = translateSe(req, tc, mode, NULL, delay, false);
1154 assert(!delay);
1155 return fault;
1156}
1157
1158Fault
1159TLB::translateTiming(RequestPtr req, ThreadContext *tc,
1160 Translation *translation, Mode mode, TLB::ArmTranslationType tranType)
1161{
1162 updateMiscReg(tc, tranType);
1163
1164 if (directToStage2) {
1165 assert(stage2Tlb);
1166 return stage2Tlb->translateTiming(req, tc, translation, mode, tranType);
1167 }
1168
1169 assert(translation);
1170
1171 return translateComplete(req, tc, translation, mode, tranType, isStage2);
1172}
1173
1174Fault
1175TLB::translateComplete(RequestPtr req, ThreadContext *tc,
1176 Translation *translation, Mode mode, TLB::ArmTranslationType tranType,
1177 bool callFromS2)
1178{
1179 bool delay = false;
1180 Fault fault;
1181 if (FullSystem)
1182 fault = translateFs(req, tc, mode, translation, delay, true, tranType);
1183 else
1184 fault = translateSe(req, tc, mode, translation, delay, true);
1185 DPRINTF(TLBVerbose, "Translation returning delay=%d fault=%d\n", delay, fault !=
1186 NoFault);
1187 // If we have a translation, and we're not in the middle of doing a stage
1188 // 2 translation tell the translation that we've either finished or its
1189 // going to take a while. By not doing this when we're in the middle of a
1190 // stage 2 translation we prevent marking the translation as delayed twice,
1191 // one when the translation starts and again when the stage 1 translation
1192 // completes.
1193 if (translation && (callFromS2 || !stage2Req || req->hasPaddr() || fault != NoFault)) {
1194 if (!delay)
1195 translation->finish(fault, req, tc, mode);
1196 else
1197 translation->markDelayed();
1198 }
1199 return fault;
1200}
1201
1202BaseMasterPort*
1203TLB::getMasterPort()
1204{
1205 return &stage2Mmu->getPort();
1206}
1207
1208void
1209TLB::updateMiscReg(ThreadContext *tc, ArmTranslationType tranType)
1210{
1211 // check if the regs have changed, or the translation mode is different.
1212 // NOTE: the tran type doesn't affect stage 2 TLB's as they only handle
1213 // one type of translation anyway
1214 if (miscRegValid && miscRegContext == tc->contextId() &&
1215 ((tranType == curTranType) || isStage2)) {
1216 return;
1217 }
1218
1219 DPRINTF(TLBVerbose, "TLB variables changed!\n");
1220 cpsr = tc->readMiscReg(MISCREG_CPSR);
1221
1222 // Dependencies: SCR/SCR_EL3, CPSR
1223 isSecure = inSecureState(tc) &&
1224 !(tranType & HypMode) && !(tranType & S1S2NsTran);
1225
1226 const OperatingMode op_mode = (OperatingMode) (uint8_t)cpsr.mode;
1227 aarch64 = opModeIs64(op_mode) ||
1228 (opModeToEL(op_mode) == EL0 && ELIs64(tc, EL1));
1229
1230 if (aarch64) { // AArch64
1231 // determine EL we need to translate in
1232 switch (tranType) {
1233 case S1E0Tran:
1234 case S12E0Tran:
1235 aarch64EL = EL0;
1236 break;
1237 case S1E1Tran:
1238 case S12E1Tran:
1239 aarch64EL = EL1;
1240 break;
1241 case S1E2Tran:
1242 aarch64EL = EL2;
1243 break;
1244 case S1E3Tran:
1245 aarch64EL = EL3;
1246 break;
1247 case NormalTran:
1248 case S1CTran:
1249 case S1S2NsTran:
1250 case HypMode:
1251 aarch64EL = (ExceptionLevel) (uint8_t) cpsr.el;
1252 break;
1253 }
1254
1255 switch (aarch64EL) {
1256 case EL0:
1257 case EL1:
1258 {
1259 sctlr = tc->readMiscReg(MISCREG_SCTLR_EL1);
1260 ttbcr = tc->readMiscReg(MISCREG_TCR_EL1);
1261 uint64_t ttbr_asid = ttbcr.a1 ?
1262 tc->readMiscReg(MISCREG_TTBR1_EL1) :
1263 tc->readMiscReg(MISCREG_TTBR0_EL1);
1264 asid = bits(ttbr_asid,
1265 (haveLargeAsid64 && ttbcr.as) ? 63 : 55, 48);
1266 }
1267 break;
1268 case EL2:
1269 sctlr = tc->readMiscReg(MISCREG_SCTLR_EL2);
1270 ttbcr = tc->readMiscReg(MISCREG_TCR_EL2);
1271 asid = -1;
1272 break;
1273 case EL3:
1274 sctlr = tc->readMiscReg(MISCREG_SCTLR_EL3);
1275 ttbcr = tc->readMiscReg(MISCREG_TCR_EL3);
1276 asid = -1;
1277 break;
1278 }
1279 hcr = tc->readMiscReg(MISCREG_HCR_EL2);
1280 scr = tc->readMiscReg(MISCREG_SCR_EL3);
1281 isPriv = aarch64EL != EL0;
1282 if (haveVirtualization) {
1283 vmid = bits(tc->readMiscReg(MISCREG_VTTBR_EL2), 55, 48);
1284 isHyp = tranType & HypMode;
1285 isHyp &= (tranType & S1S2NsTran) == 0;
1286 isHyp &= (tranType & S1CTran) == 0;
1287 // Work out if we should skip the first stage of translation and go
1288 // directly to stage 2. This value is cached so we don't have to
1289 // compute it for every translation.
1290 stage2Req = isStage2 ||
1291 (hcr.vm && !isHyp && !isSecure &&
1292 !(tranType & S1CTran) && (aarch64EL < EL2) &&
1293 !(tranType & S1E1Tran)); // <--- FIX THIS HACK
1294 directToStage2 = !isStage2 && stage2Req && !sctlr.m;
1295 } else {
1296 vmid = 0;
1297 isHyp = false;
1298 directToStage2 = false;
1299 stage2Req = false;
1300 }
1301 } else { // AArch32
1302 sctlr = tc->readMiscReg(flattenMiscRegNsBanked(MISCREG_SCTLR, tc,
1303 !isSecure));
1304 ttbcr = tc->readMiscReg(flattenMiscRegNsBanked(MISCREG_TTBCR, tc,
1305 !isSecure));
1306 scr = tc->readMiscReg(MISCREG_SCR);
1307 isPriv = cpsr.mode != MODE_USER;
1308 if (longDescFormatInUse(tc)) {
1309 uint64_t ttbr_asid = tc->readMiscReg(
1310 flattenMiscRegNsBanked(ttbcr.a1 ? MISCREG_TTBR1
1311 : MISCREG_TTBR0,
1312 tc, !isSecure));
1313 asid = bits(ttbr_asid, 55, 48);
1314 } else { // Short-descriptor translation table format in use
1315 CONTEXTIDR context_id = tc->readMiscReg(flattenMiscRegNsBanked(
1316 MISCREG_CONTEXTIDR, tc,!isSecure));
1317 asid = context_id.asid;
1318 }
1319 prrr = tc->readMiscReg(flattenMiscRegNsBanked(MISCREG_PRRR, tc,
1320 !isSecure));
1321 nmrr = tc->readMiscReg(flattenMiscRegNsBanked(MISCREG_NMRR, tc,
1322 !isSecure));
1323 dacr = tc->readMiscReg(flattenMiscRegNsBanked(MISCREG_DACR, tc,
1324 !isSecure));
1325 hcr = tc->readMiscReg(MISCREG_HCR);
1326
1327 if (haveVirtualization) {
1328 vmid = bits(tc->readMiscReg(MISCREG_VTTBR), 55, 48);
1329 isHyp = cpsr.mode == MODE_HYP;
1330 isHyp |= tranType & HypMode;
1331 isHyp &= (tranType & S1S2NsTran) == 0;
1332 isHyp &= (tranType & S1CTran) == 0;
1333 if (isHyp) {
1334 sctlr = tc->readMiscReg(MISCREG_HSCTLR);
1335 }
1336 // Work out if we should skip the first stage of translation and go
1337 // directly to stage 2. This value is cached so we don't have to
1338 // compute it for every translation.
1339 stage2Req = hcr.vm && !isStage2 && !isHyp && !isSecure &&
1340 !(tranType & S1CTran);
1341 directToStage2 = stage2Req && !sctlr.m;
1342 } else {
1343 vmid = 0;
1344 stage2Req = false;
1345 isHyp = false;
1346 directToStage2 = false;
1347 }
1348 }
1349 miscRegValid = true;
1350 miscRegContext = tc->contextId();
1351 curTranType = tranType;
1352}
1353
1354Fault
1355TLB::getTE(TlbEntry **te, RequestPtr req, ThreadContext *tc, Mode mode,
1356 Translation *translation, bool timing, bool functional,
1357 bool is_secure, TLB::ArmTranslationType tranType)
1358{
1359 bool is_fetch = (mode == Execute);
1360 bool is_write = (mode == Write);
1361
1362 Addr vaddr_tainted = req->getVaddr();
1363 Addr vaddr = 0;
1364 ExceptionLevel target_el = aarch64 ? aarch64EL : EL1;
1365 if (aarch64) {
1366 vaddr = purifyTaggedAddr(vaddr_tainted, tc, target_el, ttbcr);
1367 } else {
1368 vaddr = vaddr_tainted;
1369 }
1370 *te = lookup(vaddr, asid, vmid, isHyp, is_secure, false, false, target_el);
1371 if (*te == NULL) {
1372 if (req->isPrefetch()) {
1373 // if the request is a prefetch don't attempt to fill the TLB or go
1374 // any further with the memory access (here we can safely use the
1375 // fault status for the short desc. format in all cases)
1376 prefetchFaults++;
1377 return std::make_shared<PrefetchAbort>(
1378 vaddr_tainted, ArmFault::PrefetchTLBMiss, isStage2);
1379 }
1380
1381 if (is_fetch)
1382 instMisses++;
1383 else if (is_write)
1384 writeMisses++;
1385 else
1386 readMisses++;
1387
1388 // start translation table walk, pass variables rather than
1389 // re-retreaving in table walker for speed
1390 DPRINTF(TLB, "TLB Miss: Starting hardware table walker for %#x(%d:%d)\n",
1391 vaddr_tainted, asid, vmid);
1392 Fault fault;
1393 fault = tableWalker->walk(req, tc, asid, vmid, isHyp, mode,
1394 translation, timing, functional, is_secure,
1395 tranType, stage2Req);
1396 // for timing mode, return and wait for table walk,
1397 if (timing || fault != NoFault) {
1398 return fault;
1399 }
1400
1401 *te = lookup(vaddr, asid, vmid, isHyp, is_secure, false, false, target_el);
1402 if (!*te)
1403 printTlb();
1404 assert(*te);
1405 } else {
1406 if (is_fetch)
1407 instHits++;
1408 else if (is_write)
1409 writeHits++;
1410 else
1411 readHits++;
1412 }
1413 return NoFault;
1414}
1415
1416Fault
1417TLB::getResultTe(TlbEntry **te, RequestPtr req, ThreadContext *tc, Mode mode,
1418 Translation *translation, bool timing, bool functional,
1419 TlbEntry *mergeTe)
1420{
1421 Fault fault;
1422
1423 if (isStage2) {
1424 // We are already in the stage 2 TLB. Grab the table entry for stage
1425 // 2 only. We are here because stage 1 translation is disabled.
1426 TlbEntry *s2Te = NULL;
1427 // Get the stage 2 table entry
1428 fault = getTE(&s2Te, req, tc, mode, translation, timing, functional,
1429 isSecure, curTranType);
1430 // Check permissions of stage 2
1431 if ((s2Te != NULL) && (fault = NoFault)) {
1432 if(aarch64)
1433 fault = checkPermissions64(s2Te, req, mode, tc);
1434 else
1435 fault = checkPermissions(s2Te, req, mode);
1436 }
1437 *te = s2Te;
1438 return fault;
1439 }
1440
1441 TlbEntry *s1Te = NULL;
1442
1443 Addr vaddr_tainted = req->getVaddr();
1444
1445 // Get the stage 1 table entry
1446 fault = getTE(&s1Te, req, tc, mode, translation, timing, functional,
1447 isSecure, curTranType);
1448 // only proceed if we have a valid table entry
1449 if ((s1Te != NULL) && (fault == NoFault)) {
1450 // Check stage 1 permissions before checking stage 2
1451 if (aarch64)
1452 fault = checkPermissions64(s1Te, req, mode, tc);
1453 else
1454 fault = checkPermissions(s1Te, req, mode);
1455 if (stage2Req & (fault == NoFault)) {
1456 Stage2LookUp *s2Lookup = new Stage2LookUp(this, stage2Tlb, *s1Te,
1457 req, translation, mode, timing, functional, curTranType);
1458 fault = s2Lookup->getTe(tc, mergeTe);
1459 if (s2Lookup->isComplete()) {
1460 *te = mergeTe;
1461 // We've finished with the lookup so delete it
1462 delete s2Lookup;
1463 } else {
1464 // The lookup hasn't completed, so we can't delete it now. We
1465 // get round this by asking the object to self delete when the
1466 // translation is complete.
1467 s2Lookup->setSelfDelete();
1468 }
1469 } else {
1470 // This case deals with an S1 hit (or bypass), followed by
1471 // an S2 hit-but-perms issue
1472 if (isStage2) {
1473 DPRINTF(TLBVerbose, "s2TLB: reqVa %#x, reqPa %#x, fault %p\n",
1474 vaddr_tainted, req->hasPaddr() ? req->getPaddr() : ~0, fault);
1475 if (fault != NoFault) {
1476 ArmFault *armFault = reinterpret_cast<ArmFault *>(fault.get());
1477 armFault->annotate(ArmFault::S1PTW, false);
1478 armFault->annotate(ArmFault::OVA, vaddr_tainted);
1479 }
1480 }
1481 *te = s1Te;
1482 }
1483 }
1484 return fault;
1485}
1486
1487void
1488TLB::setTestInterface(SimObject *_ti)
1489{
1490 if (!_ti) {
1491 test = nullptr;
1492 } else {
1493 TlbTestInterface *ti(dynamic_cast<TlbTestInterface *>(_ti));
1494 fatal_if(!ti, "%s is not a valid ARM TLB tester\n", _ti->name());
1495 test = ti;
1496 }
1497}
1498
1499Fault
1500TLB::testTranslation(RequestPtr req, Mode mode, TlbEntry::DomainType domain)
1501{
1502 if (!test || !req->hasSize() || req->getSize() == 0) {
1503 return NoFault;
1504 } else {
1505 return test->translationCheck(req, isPriv, mode, domain);
1506 }
1507}
1508
1509Fault
1510TLB::testWalk(Addr pa, Addr size, Addr va, bool is_secure, Mode mode,
1511 TlbEntry::DomainType domain, LookupLevel lookup_level)
1512{
1513 if (!test) {
1514 return NoFault;
1515 } else {
1516 return test->walkCheck(pa, size, va, is_secure, isPriv, mode,
1517 domain, lookup_level);
1518 }
1519}
1520
1521
1522ArmISA::TLB *
1523ArmTLBParams::create()
1524{
1525 return new ArmISA::TLB(this);
1526}
| 745 ArmFault::PermissionLL + te->lookupLevel,
746 isStage2, tranMethod);
747 } else if (abt | hapAbt) {
748 permsFaults++;
749 DPRINTF(TLB, "TLB Fault: Data abort on permission check. AP:%d priv:%d"
750 " write:%d\n", ap, is_priv, is_write);
751 return std::make_shared<DataAbort>(
752 vaddr, te->domain, is_write,
753 ArmFault::PermissionLL + te->lookupLevel,
754 isStage2 | !abt, tranMethod);
755 }
756 return NoFault;
757}
758
759
760Fault
761TLB::checkPermissions64(TlbEntry *te, RequestPtr req, Mode mode,
762 ThreadContext *tc)
763{
764 assert(aarch64);
765
766 Addr vaddr_tainted = req->getVaddr();
767 Addr vaddr = purifyTaggedAddr(vaddr_tainted, tc, aarch64EL, ttbcr);
768
769 Request::Flags flags = req->getFlags();
770 bool is_fetch = (mode == Execute);
771 bool is_write = (mode == Write);
772 bool is_priv M5_VAR_USED = isPriv && !(flags & UserMode);
773
774 updateMiscReg(tc, curTranType);
775
776 // If this is the second stage of translation and the request is for a
777 // stage 1 page table walk then we need to check the HCR.PTW bit. This
778 // allows us to generate a fault if the request targets an area marked
779 // as a device or strongly ordered.
780 if (isStage2 && req->isPTWalk() && hcr.ptw &&
781 (te->mtype != TlbEntry::MemoryType::Normal)) {
782 return std::make_shared<DataAbort>(
783 vaddr_tainted, te->domain, is_write,
784 ArmFault::PermissionLL + te->lookupLevel,
785 isStage2, ArmFault::LpaeTran);
786 }
787
788 // Generate an alignment fault for unaligned accesses to device or
789 // strongly ordered memory
790 if (!is_fetch) {
791 if (te->mtype != TlbEntry::MemoryType::Normal) {
792 if (vaddr & mask(flags & AlignmentMask)) {
793 alignFaults++;
794 return std::make_shared<DataAbort>(
795 vaddr_tainted,
796 TlbEntry::DomainType::NoAccess, is_write,
797 ArmFault::AlignmentFault, isStage2,
798 ArmFault::LpaeTran);
799 }
800 }
801 }
802
803 if (te->nonCacheable) {
804 // Prevent prefetching from I/O devices.
805 if (req->isPrefetch()) {
806 // Here we can safely use the fault status for the short
807 // desc. format in all cases
808 return std::make_shared<PrefetchAbort>(
809 vaddr_tainted,
810 ArmFault::PrefetchUncacheable,
811 isStage2, ArmFault::LpaeTran);
812 }
813 }
814
815 uint8_t ap = 0x3 & (te->ap); // 2-bit access protection field
816 bool grant = false;
817
818 uint8_t xn = te->xn;
819 uint8_t pxn = te->pxn;
820 bool r = !is_write && !is_fetch;
821 bool w = is_write;
822 bool x = is_fetch;
823 DPRINTF(TLBVerbose, "Checking permissions: ap:%d, xn:%d, pxn:%d, r:%d, "
824 "w:%d, x:%d\n", ap, xn, pxn, r, w, x);
825
826 if (isStage2) {
827 assert(ArmSystem::haveVirtualization(tc) && aarch64EL != EL2);
828 // In stage 2 we use the hypervisor access permission bits.
829 // The following permissions are described in ARM DDI 0487A.f
830 // D4-1802
831 uint8_t hap = 0x3 & te->hap;
832 if (is_fetch) {
833 // sctlr.wxn overrides the xn bit
834 grant = !sctlr.wxn && !xn;
835 } else if (is_write) {
836 grant = hap & 0x2;
837 } else { // is_read
838 grant = hap & 0x1;
839 }
840 } else {
841 switch (aarch64EL) {
842 case EL0:
843 {
844 uint8_t perm = (ap << 2) | (xn << 1) | pxn;
845 switch (perm) {
846 case 0:
847 case 1:
848 case 8:
849 case 9:
850 grant = x;
851 break;
852 case 4:
853 case 5:
854 grant = r || w || (x && !sctlr.wxn);
855 break;
856 case 6:
857 case 7:
858 grant = r || w;
859 break;
860 case 12:
861 case 13:
862 grant = r || x;
863 break;
864 case 14:
865 case 15:
866 grant = r;
867 break;
868 default:
869 grant = false;
870 }
871 }
872 break;
873 case EL1:
874 {
875 uint8_t perm = (ap << 2) | (xn << 1) | pxn;
876 switch (perm) {
877 case 0:
878 case 2:
879 grant = r || w || (x && !sctlr.wxn);
880 break;
881 case 1:
882 case 3:
883 case 4:
884 case 5:
885 case 6:
886 case 7:
887 // regions that are writeable at EL0 should not be
888 // executable at EL1
889 grant = r || w;
890 break;
891 case 8:
892 case 10:
893 case 12:
894 case 14:
895 grant = r || x;
896 break;
897 case 9:
898 case 11:
899 case 13:
900 case 15:
901 grant = r;
902 break;
903 default:
904 grant = false;
905 }
906 }
907 break;
908 case EL2:
909 case EL3:
910 {
911 uint8_t perm = (ap & 0x2) | xn;
912 switch (perm) {
913 case 0:
914 grant = r || w || (x && !sctlr.wxn) ;
915 break;
916 case 1:
917 grant = r || w;
918 break;
919 case 2:
920 grant = r || x;
921 break;
922 case 3:
923 grant = r;
924 break;
925 default:
926 grant = false;
927 }
928 }
929 break;
930 }
931 }
932
933 if (!grant) {
934 if (is_fetch) {
935 permsFaults++;
936 DPRINTF(TLB, "TLB Fault: Prefetch abort on permission check. "
937 "AP:%d priv:%d write:%d ns:%d sif:%d "
938 "sctlr.afe: %d\n",
939 ap, is_priv, is_write, te->ns, scr.sif, sctlr.afe);
940 // Use PC value instead of vaddr because vaddr might be aligned to
941 // cache line and should not be the address reported in FAR
942 return std::make_shared<PrefetchAbort>(
943 req->getPC(),
944 ArmFault::PermissionLL + te->lookupLevel,
945 isStage2, ArmFault::LpaeTran);
946 } else {
947 permsFaults++;
948 DPRINTF(TLB, "TLB Fault: Data abort on permission check. AP:%d "
949 "priv:%d write:%d\n", ap, is_priv, is_write);
950 return std::make_shared<DataAbort>(
951 vaddr_tainted, te->domain, is_write,
952 ArmFault::PermissionLL + te->lookupLevel,
953 isStage2, ArmFault::LpaeTran);
954 }
955 }
956
957 return NoFault;
958}
959
960Fault
961TLB::translateFs(RequestPtr req, ThreadContext *tc, Mode mode,
962 Translation *translation, bool &delay, bool timing,
963 TLB::ArmTranslationType tranType, bool functional)
964{
965 // No such thing as a functional timing access
966 assert(!(timing && functional));
967
968 updateMiscReg(tc, tranType);
969
970 Addr vaddr_tainted = req->getVaddr();
971 Addr vaddr = 0;
972 if (aarch64)
973 vaddr = purifyTaggedAddr(vaddr_tainted, tc, aarch64EL, ttbcr);
974 else
975 vaddr = vaddr_tainted;
976 Request::Flags flags = req->getFlags();
977
978 bool is_fetch = (mode == Execute);
979 bool is_write = (mode == Write);
980 bool long_desc_format = aarch64 || longDescFormatInUse(tc);
981 ArmFault::TranMethod tranMethod = long_desc_format ? ArmFault::LpaeTran
982 : ArmFault::VmsaTran;
983
984 req->setAsid(asid);
985
986 DPRINTF(TLBVerbose, "CPSR is priv:%d UserMode:%d secure:%d S1S2NsTran:%d\n",
987 isPriv, flags & UserMode, isSecure, tranType & S1S2NsTran);
988
989 DPRINTF(TLB, "translateFs addr %#x, mode %d, st2 %d, scr %#x sctlr %#x "
990 "flags %#lx tranType 0x%x\n", vaddr_tainted, mode, isStage2,
991 scr, sctlr, flags, tranType);
992
993 if ((req->isInstFetch() && (!sctlr.i)) ||
994 ((!req->isInstFetch()) && (!sctlr.c))){
995 req->setFlags(Request::UNCACHEABLE | Request::STRICT_ORDER);
996 }
997 if (!is_fetch) {
998 assert(flags & MustBeOne);
999 if (sctlr.a || !(flags & AllowUnaligned)) {
1000 if (vaddr & mask(flags & AlignmentMask)) {
1001 alignFaults++;
1002 return std::make_shared<DataAbort>(
1003 vaddr_tainted,
1004 TlbEntry::DomainType::NoAccess, is_write,
1005 ArmFault::AlignmentFault, isStage2,
1006 tranMethod);
1007 }
1008 }
1009 }
1010
1011 // If guest MMU is off or hcr.vm=0 go straight to stage2
1012 if ((isStage2 && !hcr.vm) || (!isStage2 && !sctlr.m)) {
1013
1014 req->setPaddr(vaddr);
1015 // When the MMU is off the security attribute corresponds to the
1016 // security state of the processor
1017 if (isSecure)
1018 req->setFlags(Request::SECURE);
1019
1020 // @todo: double check this (ARM ARM issue C B3.2.1)
1021 if (long_desc_format || sctlr.tre == 0) {
1022 req->setFlags(Request::UNCACHEABLE | Request::STRICT_ORDER);
1023 } else {
1024 if (nmrr.ir0 == 0 || nmrr.or0 == 0 || prrr.tr0 != 0x2)
1025 req->setFlags(Request::UNCACHEABLE | Request::STRICT_ORDER);
1026 }
1027
1028 // Set memory attributes
1029 TlbEntry temp_te;
1030 temp_te.ns = !isSecure;
1031 if (isStage2 || hcr.dc == 0 || isSecure ||
1032 (isHyp && !(tranType & S1CTran))) {
1033
1034 temp_te.mtype = is_fetch ? TlbEntry::MemoryType::Normal
1035 : TlbEntry::MemoryType::StronglyOrdered;
1036 temp_te.innerAttrs = 0x0;
1037 temp_te.outerAttrs = 0x0;
1038 temp_te.shareable = true;
1039 temp_te.outerShareable = true;
1040 } else {
1041 temp_te.mtype = TlbEntry::MemoryType::Normal;
1042 temp_te.innerAttrs = 0x3;
1043 temp_te.outerAttrs = 0x3;
1044 temp_te.shareable = false;
1045 temp_te.outerShareable = false;
1046 }
1047 temp_te.setAttributes(long_desc_format);
1048 DPRINTF(TLBVerbose, "(No MMU) setting memory attributes: shareable: "
1049 "%d, innerAttrs: %d, outerAttrs: %d, isStage2: %d\n",
1050 temp_te.shareable, temp_te.innerAttrs, temp_te.outerAttrs,
1051 isStage2);
1052 setAttr(temp_te.attributes);
1053
1054 return testTranslation(req, mode, TlbEntry::DomainType::NoAccess);
1055 }
1056
1057 DPRINTF(TLBVerbose, "Translating %s=%#x context=%d\n",
1058 isStage2 ? "IPA" : "VA", vaddr_tainted, asid);
1059 // Translation enabled
1060
1061 TlbEntry *te = NULL;
1062 TlbEntry mergeTe;
1063 Fault fault = getResultTe(&te, req, tc, mode, translation, timing,
1064 functional, &mergeTe);
1065 // only proceed if we have a valid table entry
1066 if ((te == NULL) && (fault == NoFault)) delay = true;
1067
1068 // If we have the table entry transfer some of the attributes to the
1069 // request that triggered the translation
1070 if (te != NULL) {
1071 // Set memory attributes
1072 DPRINTF(TLBVerbose,
1073 "Setting memory attributes: shareable: %d, innerAttrs: %d, "
1074 "outerAttrs: %d, mtype: %d, isStage2: %d\n",
1075 te->shareable, te->innerAttrs, te->outerAttrs,
1076 static_cast<uint8_t>(te->mtype), isStage2);
1077 setAttr(te->attributes);
1078
1079 if (te->nonCacheable)
1080 req->setFlags(Request::UNCACHEABLE);
1081
1082 // Require requests to be ordered if the request goes to
1083 // strongly ordered or device memory (i.e., anything other
1084 // than normal memory requires strict order).
1085 if (te->mtype != TlbEntry::MemoryType::Normal)
1086 req->setFlags(Request::STRICT_ORDER);
1087
1088 Addr pa = te->pAddr(vaddr);
1089 req->setPaddr(pa);
1090
1091 if (isSecure && !te->ns) {
1092 req->setFlags(Request::SECURE);
1093 }
1094 if ((!is_fetch) && (vaddr & mask(flags & AlignmentMask)) &&
1095 (te->mtype != TlbEntry::MemoryType::Normal)) {
1096 // Unaligned accesses to Device memory should always cause an
1097 // abort regardless of sctlr.a
1098 alignFaults++;
1099 return std::make_shared<DataAbort>(
1100 vaddr_tainted,
1101 TlbEntry::DomainType::NoAccess, is_write,
1102 ArmFault::AlignmentFault, isStage2,
1103 tranMethod);
1104 }
1105
1106 // Check for a trickbox generated address fault
1107 if (fault == NoFault)
1108 fault = testTranslation(req, mode, te->domain);
1109 }
1110
1111 // Generate Illegal Inst Set State fault if IL bit is set in CPSR
1112 if (fault == NoFault) {
1113 if (aarch64 && is_fetch && cpsr.il == 1) {
1114 return std::make_shared<IllegalInstSetStateFault>();
1115 }
1116 }
1117
1118 return fault;
1119}
1120
1121Fault
1122TLB::translateAtomic(RequestPtr req, ThreadContext *tc, Mode mode,
1123 TLB::ArmTranslationType tranType)
1124{
1125 updateMiscReg(tc, tranType);
1126
1127 if (directToStage2) {
1128 assert(stage2Tlb);
1129 return stage2Tlb->translateAtomic(req, tc, mode, tranType);
1130 }
1131
1132 bool delay = false;
1133 Fault fault;
1134 if (FullSystem)
1135 fault = translateFs(req, tc, mode, NULL, delay, false, tranType);
1136 else
1137 fault = translateSe(req, tc, mode, NULL, delay, false);
1138 assert(!delay);
1139 return fault;
1140}
1141
1142Fault
1143TLB::translateFunctional(RequestPtr req, ThreadContext *tc, Mode mode,
1144 TLB::ArmTranslationType tranType)
1145{
1146 updateMiscReg(tc, tranType);
1147
1148 if (directToStage2) {
1149 assert(stage2Tlb);
1150 return stage2Tlb->translateFunctional(req, tc, mode, tranType);
1151 }
1152
1153 bool delay = false;
1154 Fault fault;
1155 if (FullSystem)
1156 fault = translateFs(req, tc, mode, NULL, delay, false, tranType, true);
1157 else
1158 fault = translateSe(req, tc, mode, NULL, delay, false);
1159 assert(!delay);
1160 return fault;
1161}
1162
1163Fault
1164TLB::translateTiming(RequestPtr req, ThreadContext *tc,
1165 Translation *translation, Mode mode, TLB::ArmTranslationType tranType)
1166{
1167 updateMiscReg(tc, tranType);
1168
1169 if (directToStage2) {
1170 assert(stage2Tlb);
1171 return stage2Tlb->translateTiming(req, tc, translation, mode, tranType);
1172 }
1173
1174 assert(translation);
1175
1176 return translateComplete(req, tc, translation, mode, tranType, isStage2);
1177}
1178
1179Fault
1180TLB::translateComplete(RequestPtr req, ThreadContext *tc,
1181 Translation *translation, Mode mode, TLB::ArmTranslationType tranType,
1182 bool callFromS2)
1183{
1184 bool delay = false;
1185 Fault fault;
1186 if (FullSystem)
1187 fault = translateFs(req, tc, mode, translation, delay, true, tranType);
1188 else
1189 fault = translateSe(req, tc, mode, translation, delay, true);
1190 DPRINTF(TLBVerbose, "Translation returning delay=%d fault=%d\n", delay, fault !=
1191 NoFault);
1192 // If we have a translation, and we're not in the middle of doing a stage
1193 // 2 translation tell the translation that we've either finished or its
1194 // going to take a while. By not doing this when we're in the middle of a
1195 // stage 2 translation we prevent marking the translation as delayed twice,
1196 // one when the translation starts and again when the stage 1 translation
1197 // completes.
1198 if (translation && (callFromS2 || !stage2Req || req->hasPaddr() || fault != NoFault)) {
1199 if (!delay)
1200 translation->finish(fault, req, tc, mode);
1201 else
1202 translation->markDelayed();
1203 }
1204 return fault;
1205}
1206
1207BaseMasterPort*
1208TLB::getMasterPort()
1209{
1210 return &stage2Mmu->getPort();
1211}
1212
1213void
1214TLB::updateMiscReg(ThreadContext *tc, ArmTranslationType tranType)
1215{
1216 // check if the regs have changed, or the translation mode is different.
1217 // NOTE: the tran type doesn't affect stage 2 TLB's as they only handle
1218 // one type of translation anyway
1219 if (miscRegValid && miscRegContext == tc->contextId() &&
1220 ((tranType == curTranType) || isStage2)) {
1221 return;
1222 }
1223
1224 DPRINTF(TLBVerbose, "TLB variables changed!\n");
1225 cpsr = tc->readMiscReg(MISCREG_CPSR);
1226
1227 // Dependencies: SCR/SCR_EL3, CPSR
1228 isSecure = inSecureState(tc) &&
1229 !(tranType & HypMode) && !(tranType & S1S2NsTran);
1230
1231 const OperatingMode op_mode = (OperatingMode) (uint8_t)cpsr.mode;
1232 aarch64 = opModeIs64(op_mode) ||
1233 (opModeToEL(op_mode) == EL0 && ELIs64(tc, EL1));
1234
1235 if (aarch64) { // AArch64
1236 // determine EL we need to translate in
1237 switch (tranType) {
1238 case S1E0Tran:
1239 case S12E0Tran:
1240 aarch64EL = EL0;
1241 break;
1242 case S1E1Tran:
1243 case S12E1Tran:
1244 aarch64EL = EL1;
1245 break;
1246 case S1E2Tran:
1247 aarch64EL = EL2;
1248 break;
1249 case S1E3Tran:
1250 aarch64EL = EL3;
1251 break;
1252 case NormalTran:
1253 case S1CTran:
1254 case S1S2NsTran:
1255 case HypMode:
1256 aarch64EL = (ExceptionLevel) (uint8_t) cpsr.el;
1257 break;
1258 }
1259
1260 switch (aarch64EL) {
1261 case EL0:
1262 case EL1:
1263 {
1264 sctlr = tc->readMiscReg(MISCREG_SCTLR_EL1);
1265 ttbcr = tc->readMiscReg(MISCREG_TCR_EL1);
1266 uint64_t ttbr_asid = ttbcr.a1 ?
1267 tc->readMiscReg(MISCREG_TTBR1_EL1) :
1268 tc->readMiscReg(MISCREG_TTBR0_EL1);
1269 asid = bits(ttbr_asid,
1270 (haveLargeAsid64 && ttbcr.as) ? 63 : 55, 48);
1271 }
1272 break;
1273 case EL2:
1274 sctlr = tc->readMiscReg(MISCREG_SCTLR_EL2);
1275 ttbcr = tc->readMiscReg(MISCREG_TCR_EL2);
1276 asid = -1;
1277 break;
1278 case EL3:
1279 sctlr = tc->readMiscReg(MISCREG_SCTLR_EL3);
1280 ttbcr = tc->readMiscReg(MISCREG_TCR_EL3);
1281 asid = -1;
1282 break;
1283 }
1284 hcr = tc->readMiscReg(MISCREG_HCR_EL2);
1285 scr = tc->readMiscReg(MISCREG_SCR_EL3);
1286 isPriv = aarch64EL != EL0;
1287 if (haveVirtualization) {
1288 vmid = bits(tc->readMiscReg(MISCREG_VTTBR_EL2), 55, 48);
1289 isHyp = tranType & HypMode;
1290 isHyp &= (tranType & S1S2NsTran) == 0;
1291 isHyp &= (tranType & S1CTran) == 0;
1292 // Work out if we should skip the first stage of translation and go
1293 // directly to stage 2. This value is cached so we don't have to
1294 // compute it for every translation.
1295 stage2Req = isStage2 ||
1296 (hcr.vm && !isHyp && !isSecure &&
1297 !(tranType & S1CTran) && (aarch64EL < EL2) &&
1298 !(tranType & S1E1Tran)); // <--- FIX THIS HACK
1299 directToStage2 = !isStage2 && stage2Req && !sctlr.m;
1300 } else {
1301 vmid = 0;
1302 isHyp = false;
1303 directToStage2 = false;
1304 stage2Req = false;
1305 }
1306 } else { // AArch32
1307 sctlr = tc->readMiscReg(flattenMiscRegNsBanked(MISCREG_SCTLR, tc,
1308 !isSecure));
1309 ttbcr = tc->readMiscReg(flattenMiscRegNsBanked(MISCREG_TTBCR, tc,
1310 !isSecure));
1311 scr = tc->readMiscReg(MISCREG_SCR);
1312 isPriv = cpsr.mode != MODE_USER;
1313 if (longDescFormatInUse(tc)) {
1314 uint64_t ttbr_asid = tc->readMiscReg(
1315 flattenMiscRegNsBanked(ttbcr.a1 ? MISCREG_TTBR1
1316 : MISCREG_TTBR0,
1317 tc, !isSecure));
1318 asid = bits(ttbr_asid, 55, 48);
1319 } else { // Short-descriptor translation table format in use
1320 CONTEXTIDR context_id = tc->readMiscReg(flattenMiscRegNsBanked(
1321 MISCREG_CONTEXTIDR, tc,!isSecure));
1322 asid = context_id.asid;
1323 }
1324 prrr = tc->readMiscReg(flattenMiscRegNsBanked(MISCREG_PRRR, tc,
1325 !isSecure));
1326 nmrr = tc->readMiscReg(flattenMiscRegNsBanked(MISCREG_NMRR, tc,
1327 !isSecure));
1328 dacr = tc->readMiscReg(flattenMiscRegNsBanked(MISCREG_DACR, tc,
1329 !isSecure));
1330 hcr = tc->readMiscReg(MISCREG_HCR);
1331
1332 if (haveVirtualization) {
1333 vmid = bits(tc->readMiscReg(MISCREG_VTTBR), 55, 48);
1334 isHyp = cpsr.mode == MODE_HYP;
1335 isHyp |= tranType & HypMode;
1336 isHyp &= (tranType & S1S2NsTran) == 0;
1337 isHyp &= (tranType & S1CTran) == 0;
1338 if (isHyp) {
1339 sctlr = tc->readMiscReg(MISCREG_HSCTLR);
1340 }
1341 // Work out if we should skip the first stage of translation and go
1342 // directly to stage 2. This value is cached so we don't have to
1343 // compute it for every translation.
1344 stage2Req = hcr.vm && !isStage2 && !isHyp && !isSecure &&
1345 !(tranType & S1CTran);
1346 directToStage2 = stage2Req && !sctlr.m;
1347 } else {
1348 vmid = 0;
1349 stage2Req = false;
1350 isHyp = false;
1351 directToStage2 = false;
1352 }
1353 }
1354 miscRegValid = true;
1355 miscRegContext = tc->contextId();
1356 curTranType = tranType;
1357}
1358
1359Fault
1360TLB::getTE(TlbEntry **te, RequestPtr req, ThreadContext *tc, Mode mode,
1361 Translation *translation, bool timing, bool functional,
1362 bool is_secure, TLB::ArmTranslationType tranType)
1363{
1364 bool is_fetch = (mode == Execute);
1365 bool is_write = (mode == Write);
1366
1367 Addr vaddr_tainted = req->getVaddr();
1368 Addr vaddr = 0;
1369 ExceptionLevel target_el = aarch64 ? aarch64EL : EL1;
1370 if (aarch64) {
1371 vaddr = purifyTaggedAddr(vaddr_tainted, tc, target_el, ttbcr);
1372 } else {
1373 vaddr = vaddr_tainted;
1374 }
1375 *te = lookup(vaddr, asid, vmid, isHyp, is_secure, false, false, target_el);
1376 if (*te == NULL) {
1377 if (req->isPrefetch()) {
1378 // if the request is a prefetch don't attempt to fill the TLB or go
1379 // any further with the memory access (here we can safely use the
1380 // fault status for the short desc. format in all cases)
1381 prefetchFaults++;
1382 return std::make_shared<PrefetchAbort>(
1383 vaddr_tainted, ArmFault::PrefetchTLBMiss, isStage2);
1384 }
1385
1386 if (is_fetch)
1387 instMisses++;
1388 else if (is_write)
1389 writeMisses++;
1390 else
1391 readMisses++;
1392
1393 // start translation table walk, pass variables rather than
1394 // re-retreaving in table walker for speed
1395 DPRINTF(TLB, "TLB Miss: Starting hardware table walker for %#x(%d:%d)\n",
1396 vaddr_tainted, asid, vmid);
1397 Fault fault;
1398 fault = tableWalker->walk(req, tc, asid, vmid, isHyp, mode,
1399 translation, timing, functional, is_secure,
1400 tranType, stage2Req);
1401 // for timing mode, return and wait for table walk,
1402 if (timing || fault != NoFault) {
1403 return fault;
1404 }
1405
1406 *te = lookup(vaddr, asid, vmid, isHyp, is_secure, false, false, target_el);
1407 if (!*te)
1408 printTlb();
1409 assert(*te);
1410 } else {
1411 if (is_fetch)
1412 instHits++;
1413 else if (is_write)
1414 writeHits++;
1415 else
1416 readHits++;
1417 }
1418 return NoFault;
1419}
1420
1421Fault
1422TLB::getResultTe(TlbEntry **te, RequestPtr req, ThreadContext *tc, Mode mode,
1423 Translation *translation, bool timing, bool functional,
1424 TlbEntry *mergeTe)
1425{
1426 Fault fault;
1427
1428 if (isStage2) {
1429 // We are already in the stage 2 TLB. Grab the table entry for stage
1430 // 2 only. We are here because stage 1 translation is disabled.
1431 TlbEntry *s2Te = NULL;
1432 // Get the stage 2 table entry
1433 fault = getTE(&s2Te, req, tc, mode, translation, timing, functional,
1434 isSecure, curTranType);
1435 // Check permissions of stage 2
1436 if ((s2Te != NULL) && (fault = NoFault)) {
1437 if(aarch64)
1438 fault = checkPermissions64(s2Te, req, mode, tc);
1439 else
1440 fault = checkPermissions(s2Te, req, mode);
1441 }
1442 *te = s2Te;
1443 return fault;
1444 }
1445
1446 TlbEntry *s1Te = NULL;
1447
1448 Addr vaddr_tainted = req->getVaddr();
1449
1450 // Get the stage 1 table entry
1451 fault = getTE(&s1Te, req, tc, mode, translation, timing, functional,
1452 isSecure, curTranType);
1453 // only proceed if we have a valid table entry
1454 if ((s1Te != NULL) && (fault == NoFault)) {
1455 // Check stage 1 permissions before checking stage 2
1456 if (aarch64)
1457 fault = checkPermissions64(s1Te, req, mode, tc);
1458 else
1459 fault = checkPermissions(s1Te, req, mode);
1460 if (stage2Req & (fault == NoFault)) {
1461 Stage2LookUp *s2Lookup = new Stage2LookUp(this, stage2Tlb, *s1Te,
1462 req, translation, mode, timing, functional, curTranType);
1463 fault = s2Lookup->getTe(tc, mergeTe);
1464 if (s2Lookup->isComplete()) {
1465 *te = mergeTe;
1466 // We've finished with the lookup so delete it
1467 delete s2Lookup;
1468 } else {
1469 // The lookup hasn't completed, so we can't delete it now. We
1470 // get round this by asking the object to self delete when the
1471 // translation is complete.
1472 s2Lookup->setSelfDelete();
1473 }
1474 } else {
1475 // This case deals with an S1 hit (or bypass), followed by
1476 // an S2 hit-but-perms issue
1477 if (isStage2) {
1478 DPRINTF(TLBVerbose, "s2TLB: reqVa %#x, reqPa %#x, fault %p\n",
1479 vaddr_tainted, req->hasPaddr() ? req->getPaddr() : ~0, fault);
1480 if (fault != NoFault) {
1481 ArmFault *armFault = reinterpret_cast<ArmFault *>(fault.get());
1482 armFault->annotate(ArmFault::S1PTW, false);
1483 armFault->annotate(ArmFault::OVA, vaddr_tainted);
1484 }
1485 }
1486 *te = s1Te;
1487 }
1488 }
1489 return fault;
1490}
1491
1492void
1493TLB::setTestInterface(SimObject *_ti)
1494{
1495 if (!_ti) {
1496 test = nullptr;
1497 } else {
1498 TlbTestInterface *ti(dynamic_cast<TlbTestInterface *>(_ti));
1499 fatal_if(!ti, "%s is not a valid ARM TLB tester\n", _ti->name());
1500 test = ti;
1501 }
1502}
1503
1504Fault
1505TLB::testTranslation(RequestPtr req, Mode mode, TlbEntry::DomainType domain)
1506{
1507 if (!test || !req->hasSize() || req->getSize() == 0) {
1508 return NoFault;
1509 } else {
1510 return test->translationCheck(req, isPriv, mode, domain);
1511 }
1512}
1513
1514Fault
1515TLB::testWalk(Addr pa, Addr size, Addr va, bool is_secure, Mode mode,
1516 TlbEntry::DomainType domain, LookupLevel lookup_level)
1517{
1518 if (!test) {
1519 return NoFault;
1520 } else {
1521 return test->walkCheck(pa, size, va, is_secure, isPriv, mode,
1522 domain, lookup_level);
1523 }
1524}
1525
1526
1527ArmISA::TLB *
1528ArmTLBParams::create()
1529{
1530 return new ArmISA::TLB(this);
1531}
|