1/* 2 * Copyright (c) 2010-2013, 2016-2017 ARM Limited 3 * All rights reserved 4 * 5 * The license below extends only to copyright in the software and shall 6 * not be construed as granting a license to any other intellectual 7 * property including but not limited to intellectual property relating 8 * to a hardware implementation of the functionality of the software 9 * licensed hereunder. You may use the software subject to the license 10 * terms below provided that you ensure that this notice is replicated 11 * unmodified and in its entirety in all distributions of the software, 12 * modified or unmodified, in source code or in binary form. 13 * 14 * Copyright (c) 2001-2005 The Regents of The University of Michigan 15 * All rights reserved. 16 * 17 * Redistribution and use in source and binary forms, with or without 18 * modification, are permitted provided that the following conditions are 19 * met: redistributions of source code must retain the above copyright 20 * notice, this list of conditions and the following disclaimer; 21 * redistributions in binary form must reproduce the above copyright 22 * notice, this list of conditions and the following disclaimer in the 23 * documentation and/or other materials provided with the distribution; 24 * neither the name of the copyright holders nor the names of its 25 * contributors may be used to endorse or promote products derived from 26 * this software without specific prior written permission. 27 * 28 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 29 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 30 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR 31 * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT 32 * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 33 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT 34 * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 35 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 36 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 37 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE 38 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 39 * 40 * Authors: Ali Saidi 41 * Nathan Binkert 42 * Steve Reinhardt 43 */ 44 45#include "arch/arm/tlb.hh" 46 47#include <memory> 48#include <string> 49#include <vector> 50 51#include "arch/arm/faults.hh" 52#include "arch/arm/pagetable.hh" 53#include "arch/arm/stage2_lookup.hh" 54#include "arch/arm/stage2_mmu.hh" 55#include "arch/arm/system.hh" 56#include "arch/arm/table_walker.hh" 57#include "arch/arm/utility.hh"
| 1/* 2 * Copyright (c) 2010-2013, 2016-2017 ARM Limited 3 * All rights reserved 4 * 5 * The license below extends only to copyright in the software and shall 6 * not be construed as granting a license to any other intellectual 7 * property including but not limited to intellectual property relating 8 * to a hardware implementation of the functionality of the software 9 * licensed hereunder. You may use the software subject to the license 10 * terms below provided that you ensure that this notice is replicated 11 * unmodified and in its entirety in all distributions of the software, 12 * modified or unmodified, in source code or in binary form. 13 * 14 * Copyright (c) 2001-2005 The Regents of The University of Michigan 15 * All rights reserved. 16 * 17 * Redistribution and use in source and binary forms, with or without 18 * modification, are permitted provided that the following conditions are 19 * met: redistributions of source code must retain the above copyright 20 * notice, this list of conditions and the following disclaimer; 21 * redistributions in binary form must reproduce the above copyright 22 * notice, this list of conditions and the following disclaimer in the 23 * documentation and/or other materials provided with the distribution; 24 * neither the name of the copyright holders nor the names of its 25 * contributors may be used to endorse or promote products derived from 26 * this software without specific prior written permission. 27 * 28 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 29 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 30 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR 31 * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT 32 * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 33 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT 34 * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 35 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 36 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 37 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE 38 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 39 * 40 * Authors: Ali Saidi 41 * Nathan Binkert 42 * Steve Reinhardt 43 */ 44 45#include "arch/arm/tlb.hh" 46 47#include <memory> 48#include <string> 49#include <vector> 50 51#include "arch/arm/faults.hh" 52#include "arch/arm/pagetable.hh" 53#include "arch/arm/stage2_lookup.hh" 54#include "arch/arm/stage2_mmu.hh" 55#include "arch/arm/system.hh" 56#include "arch/arm/table_walker.hh" 57#include "arch/arm/utility.hh"
|
| 58#include "arch/generic/mmapped_ipr.hh"
|
58#include "base/inifile.hh" 59#include "base/str.hh" 60#include "base/trace.hh" 61#include "cpu/base.hh" 62#include "cpu/thread_context.hh" 63#include "debug/Checkpoint.hh" 64#include "debug/TLB.hh" 65#include "debug/TLBVerbose.hh" 66#include "mem/page_table.hh" 67#include "mem/request.hh" 68#include "params/ArmTLB.hh" 69#include "sim/full_system.hh" 70#include "sim/process.hh" 71 72using namespace std; 73using namespace ArmISA; 74 75TLB::TLB(const ArmTLBParams *p) 76 : BaseTLB(p), table(new TlbEntry[p->size]), size(p->size), 77 isStage2(p->is_stage2), stage2Req(false), _attr(0), 78 directToStage2(false), tableWalker(p->walker), stage2Tlb(NULL), 79 stage2Mmu(NULL), test(nullptr), rangeMRU(1), 80 aarch64(false), aarch64EL(EL0), isPriv(false), isSecure(false), 81 isHyp(false), asid(0), vmid(0), dacr(0), 82 miscRegValid(false), miscRegContext(0), curTranType(NormalTran) 83{
| 59#include "base/inifile.hh" 60#include "base/str.hh" 61#include "base/trace.hh" 62#include "cpu/base.hh" 63#include "cpu/thread_context.hh" 64#include "debug/Checkpoint.hh" 65#include "debug/TLB.hh" 66#include "debug/TLBVerbose.hh" 67#include "mem/page_table.hh" 68#include "mem/request.hh" 69#include "params/ArmTLB.hh" 70#include "sim/full_system.hh" 71#include "sim/process.hh" 72 73using namespace std; 74using namespace ArmISA; 75 76TLB::TLB(const ArmTLBParams *p) 77 : BaseTLB(p), table(new TlbEntry[p->size]), size(p->size), 78 isStage2(p->is_stage2), stage2Req(false), _attr(0), 79 directToStage2(false), tableWalker(p->walker), stage2Tlb(NULL), 80 stage2Mmu(NULL), test(nullptr), rangeMRU(1), 81 aarch64(false), aarch64EL(EL0), isPriv(false), isSecure(false), 82 isHyp(false), asid(0), vmid(0), dacr(0), 83 miscRegValid(false), miscRegContext(0), curTranType(NormalTran) 84{
|
| 85 const ArmSystem *sys = dynamic_cast<const ArmSystem *>(p->sys); 86
|
84 tableWalker->setTlb(this); 85 86 // Cache system-level properties 87 haveLPAE = tableWalker->haveLPAE(); 88 haveVirtualization = tableWalker->haveVirtualization(); 89 haveLargeAsid64 = tableWalker->haveLargeAsid64();
| 87 tableWalker->setTlb(this); 88 89 // Cache system-level properties 90 haveLPAE = tableWalker->haveLPAE(); 91 haveVirtualization = tableWalker->haveVirtualization(); 92 haveLargeAsid64 = tableWalker->haveLargeAsid64();
|
| 93 94 if (sys) 95 m5opRange = sys->m5opRange();
|
90} 91 92TLB::~TLB() 93{ 94 delete[] table; 95} 96 97void 98TLB::init() 99{ 100 if (stage2Mmu && !isStage2) 101 stage2Tlb = stage2Mmu->stage2Tlb(); 102} 103 104void 105TLB::setMMU(Stage2MMU *m, MasterID master_id) 106{ 107 stage2Mmu = m; 108 tableWalker->setMMU(m, master_id); 109} 110 111bool 112TLB::translateFunctional(ThreadContext *tc, Addr va, Addr &pa) 113{ 114 updateMiscReg(tc); 115 116 if (directToStage2) { 117 assert(stage2Tlb); 118 return stage2Tlb->translateFunctional(tc, va, pa); 119 } 120 121 TlbEntry *e = lookup(va, asid, vmid, isHyp, isSecure, true, false, 122 aarch64 ? aarch64EL : EL1); 123 if (!e) 124 return false; 125 pa = e->pAddr(va); 126 return true; 127} 128 129Fault 130TLB::finalizePhysical(RequestPtr req, ThreadContext *tc, Mode mode) const 131{
| 96} 97 98TLB::~TLB() 99{ 100 delete[] table; 101} 102 103void 104TLB::init() 105{ 106 if (stage2Mmu && !isStage2) 107 stage2Tlb = stage2Mmu->stage2Tlb(); 108} 109 110void 111TLB::setMMU(Stage2MMU *m, MasterID master_id) 112{ 113 stage2Mmu = m; 114 tableWalker->setMMU(m, master_id); 115} 116 117bool 118TLB::translateFunctional(ThreadContext *tc, Addr va, Addr &pa) 119{ 120 updateMiscReg(tc); 121 122 if (directToStage2) { 123 assert(stage2Tlb); 124 return stage2Tlb->translateFunctional(tc, va, pa); 125 } 126 127 TlbEntry *e = lookup(va, asid, vmid, isHyp, isSecure, true, false, 128 aarch64 ? aarch64EL : EL1); 129 if (!e) 130 return false; 131 pa = e->pAddr(va); 132 return true; 133} 134 135Fault 136TLB::finalizePhysical(RequestPtr req, ThreadContext *tc, Mode mode) const 137{
|
| 138 const Addr paddr = req->getPaddr(); 139 140 if (m5opRange.contains(paddr)) { 141 req->setFlags(Request::MMAPPED_IPR | Request::GENERIC_IPR); 142 req->setPaddr(GenericISA::iprAddressPseudoInst( 143 (paddr >> 8) & 0xFF, 144 paddr & 0xFF)); 145 } 146
|
132 return NoFault; 133} 134 135TlbEntry* 136TLB::lookup(Addr va, uint16_t asn, uint8_t vmid, bool hyp, bool secure, 137 bool functional, bool ignore_asn, uint8_t target_el) 138{ 139 140 TlbEntry *retval = NULL; 141 142 // Maintaining LRU array 143 int x = 0; 144 while (retval == NULL && x < size) { 145 if ((!ignore_asn && table[x].match(va, asn, vmid, hyp, secure, false, 146 target_el)) || 147 (ignore_asn && table[x].match(va, vmid, hyp, secure, target_el))) { 148 // We only move the hit entry ahead when the position is higher 149 // than rangeMRU 150 if (x > rangeMRU && !functional) { 151 TlbEntry tmp_entry = table[x]; 152 for (int i = x; i > 0; i--) 153 table[i] = table[i - 1]; 154 table[0] = tmp_entry; 155 retval = &table[0]; 156 } else { 157 retval = &table[x]; 158 } 159 break; 160 } 161 ++x; 162 } 163 164 DPRINTF(TLBVerbose, "Lookup %#x, asn %#x -> %s vmn 0x%x hyp %d secure %d " 165 "ppn %#x size: %#x pa: %#x ap:%d ns:%d nstid:%d g:%d asid: %d " 166 "el: %d\n", 167 va, asn, retval ? "hit" : "miss", vmid, hyp, secure, 168 retval ? retval->pfn : 0, retval ? retval->size : 0, 169 retval ? retval->pAddr(va) : 0, retval ? retval->ap : 0, 170 retval ? retval->ns : 0, retval ? retval->nstid : 0, 171 retval ? retval->global : 0, retval ? retval->asid : 0, 172 retval ? retval->el : 0); 173 174 return retval; 175} 176 177// insert a new TLB entry 178void 179TLB::insert(Addr addr, TlbEntry &entry) 180{ 181 DPRINTF(TLB, "Inserting entry into TLB with pfn:%#x size:%#x vpn: %#x" 182 " asid:%d vmid:%d N:%d global:%d valid:%d nc:%d xn:%d" 183 " ap:%#x domain:%#x ns:%d nstid:%d isHyp:%d\n", entry.pfn, 184 entry.size, entry.vpn, entry.asid, entry.vmid, entry.N, 185 entry.global, entry.valid, entry.nonCacheable, entry.xn, 186 entry.ap, static_cast<uint8_t>(entry.domain), entry.ns, entry.nstid, 187 entry.isHyp); 188 189 if (table[size - 1].valid) 190 DPRINTF(TLB, " - Replacing Valid entry %#x, asn %d vmn %d ppn %#x " 191 "size: %#x ap:%d ns:%d nstid:%d g:%d isHyp:%d el: %d\n", 192 table[size-1].vpn << table[size-1].N, table[size-1].asid, 193 table[size-1].vmid, table[size-1].pfn << table[size-1].N, 194 table[size-1].size, table[size-1].ap, table[size-1].ns, 195 table[size-1].nstid, table[size-1].global, table[size-1].isHyp, 196 table[size-1].el); 197 198 //inserting to MRU position and evicting the LRU one 199 200 for (int i = size - 1; i > 0; --i) 201 table[i] = table[i-1]; 202 table[0] = entry; 203 204 inserts++; 205 ppRefills->notify(1); 206} 207 208void 209TLB::printTlb() const 210{ 211 int x = 0; 212 TlbEntry *te; 213 DPRINTF(TLB, "Current TLB contents:\n"); 214 while (x < size) { 215 te = &table[x]; 216 if (te->valid) 217 DPRINTF(TLB, " * %s\n", te->print()); 218 ++x; 219 } 220} 221 222void 223TLB::flushAllSecurity(bool secure_lookup, uint8_t target_el, bool ignore_el) 224{ 225 DPRINTF(TLB, "Flushing all TLB entries (%s lookup)\n", 226 (secure_lookup ? "secure" : "non-secure")); 227 int x = 0; 228 TlbEntry *te; 229 while (x < size) { 230 te = &table[x]; 231 if (te->valid && secure_lookup == !te->nstid && 232 (te->vmid == vmid || secure_lookup) && 233 checkELMatch(target_el, te->el, ignore_el)) { 234 235 DPRINTF(TLB, " - %s\n", te->print()); 236 te->valid = false; 237 flushedEntries++; 238 } 239 ++x; 240 } 241 242 flushTlb++; 243 244 // If there's a second stage TLB (and we're not it) then flush it as well 245 // if we're currently in hyp mode 246 if (!isStage2 && isHyp) { 247 stage2Tlb->flushAllSecurity(secure_lookup, true); 248 } 249} 250 251void 252TLB::flushAllNs(bool hyp, uint8_t target_el, bool ignore_el) 253{ 254 DPRINTF(TLB, "Flushing all NS TLB entries (%s lookup)\n", 255 (hyp ? "hyp" : "non-hyp")); 256 int x = 0; 257 TlbEntry *te; 258 while (x < size) { 259 te = &table[x]; 260 if (te->valid && te->nstid && te->isHyp == hyp && 261 checkELMatch(target_el, te->el, ignore_el)) { 262 263 DPRINTF(TLB, " - %s\n", te->print()); 264 flushedEntries++; 265 te->valid = false; 266 } 267 ++x; 268 } 269 270 flushTlb++; 271 272 // If there's a second stage TLB (and we're not it) then flush it as well 273 if (!isStage2 && !hyp) { 274 stage2Tlb->flushAllNs(false, true); 275 } 276} 277 278void 279TLB::flushMvaAsid(Addr mva, uint64_t asn, bool secure_lookup, uint8_t target_el) 280{ 281 DPRINTF(TLB, "Flushing TLB entries with mva: %#x, asid: %#x " 282 "(%s lookup)\n", mva, asn, (secure_lookup ? 283 "secure" : "non-secure")); 284 _flushMva(mva, asn, secure_lookup, false, false, target_el); 285 flushTlbMvaAsid++; 286} 287 288void 289TLB::flushAsid(uint64_t asn, bool secure_lookup, uint8_t target_el) 290{ 291 DPRINTF(TLB, "Flushing TLB entries with asid: %#x (%s lookup)\n", asn, 292 (secure_lookup ? "secure" : "non-secure")); 293 294 int x = 0 ; 295 TlbEntry *te; 296 297 while (x < size) { 298 te = &table[x]; 299 if (te->valid && te->asid == asn && secure_lookup == !te->nstid && 300 (te->vmid == vmid || secure_lookup) && 301 checkELMatch(target_el, te->el, false)) { 302 303 te->valid = false; 304 DPRINTF(TLB, " - %s\n", te->print()); 305 flushedEntries++; 306 } 307 ++x; 308 } 309 flushTlbAsid++; 310} 311 312void 313TLB::flushMva(Addr mva, bool secure_lookup, bool hyp, uint8_t target_el) 314{ 315 DPRINTF(TLB, "Flushing TLB entries with mva: %#x (%s lookup)\n", mva, 316 (secure_lookup ? "secure" : "non-secure")); 317 _flushMva(mva, 0xbeef, secure_lookup, hyp, true, target_el); 318 flushTlbMva++; 319} 320 321void 322TLB::_flushMva(Addr mva, uint64_t asn, bool secure_lookup, bool hyp, 323 bool ignore_asn, uint8_t target_el) 324{ 325 TlbEntry *te; 326 // D5.7.2: Sign-extend address to 64 bits 327 mva = sext<56>(mva); 328 te = lookup(mva, asn, vmid, hyp, secure_lookup, false, ignore_asn, 329 target_el); 330 while (te != NULL) { 331 if (secure_lookup == !te->nstid) { 332 DPRINTF(TLB, " - %s\n", te->print()); 333 te->valid = false; 334 flushedEntries++; 335 } 336 te = lookup(mva, asn, vmid, hyp, secure_lookup, false, ignore_asn, 337 target_el); 338 } 339} 340 341void 342TLB::flushIpaVmid(Addr ipa, bool secure_lookup, bool hyp, uint8_t target_el) 343{ 344 assert(!isStage2); 345 stage2Tlb->_flushMva(ipa, 0xbeef, secure_lookup, hyp, true, target_el); 346} 347 348bool 349TLB::checkELMatch(uint8_t target_el, uint8_t tentry_el, bool ignore_el) 350{ 351 bool elMatch = true; 352 if (!ignore_el) { 353 if (target_el == 2 || target_el == 3) { 354 elMatch = (tentry_el == target_el); 355 } else { 356 elMatch = (tentry_el == 0) || (tentry_el == 1); 357 } 358 } 359 return elMatch; 360} 361 362void 363TLB::drainResume() 364{ 365 // We might have unserialized something or switched CPUs, so make 366 // sure to re-read the misc regs. 367 miscRegValid = false; 368} 369 370void 371TLB::takeOverFrom(BaseTLB *_otlb) 372{ 373 TLB *otlb = dynamic_cast<TLB*>(_otlb); 374 /* Make sure we actually have a valid type */ 375 if (otlb) { 376 _attr = otlb->_attr; 377 haveLPAE = otlb->haveLPAE; 378 directToStage2 = otlb->directToStage2; 379 stage2Req = otlb->stage2Req; 380 381 /* Sync the stage2 MMU if they exist in both 382 * the old CPU and the new 383 */ 384 if (!isStage2 && 385 stage2Tlb && otlb->stage2Tlb) { 386 stage2Tlb->takeOverFrom(otlb->stage2Tlb); 387 } 388 } else { 389 panic("Incompatible TLB type!"); 390 } 391} 392 393void 394TLB::serialize(CheckpointOut &cp) const 395{ 396 DPRINTF(Checkpoint, "Serializing Arm TLB\n"); 397 398 SERIALIZE_SCALAR(_attr); 399 SERIALIZE_SCALAR(haveLPAE); 400 SERIALIZE_SCALAR(directToStage2); 401 SERIALIZE_SCALAR(stage2Req); 402 403 int num_entries = size; 404 SERIALIZE_SCALAR(num_entries); 405 for (int i = 0; i < size; i++) 406 table[i].serializeSection(cp, csprintf("TlbEntry%d", i)); 407} 408 409void 410TLB::unserialize(CheckpointIn &cp) 411{ 412 DPRINTF(Checkpoint, "Unserializing Arm TLB\n"); 413 414 UNSERIALIZE_SCALAR(_attr); 415 UNSERIALIZE_SCALAR(haveLPAE); 416 UNSERIALIZE_SCALAR(directToStage2); 417 UNSERIALIZE_SCALAR(stage2Req); 418 419 int num_entries; 420 UNSERIALIZE_SCALAR(num_entries); 421 for (int i = 0; i < min(size, num_entries); i++) 422 table[i].unserializeSection(cp, csprintf("TlbEntry%d", i)); 423} 424 425void 426TLB::regStats() 427{ 428 BaseTLB::regStats(); 429 instHits 430 .name(name() + ".inst_hits") 431 .desc("ITB inst hits") 432 ; 433 434 instMisses 435 .name(name() + ".inst_misses") 436 .desc("ITB inst misses") 437 ; 438 439 instAccesses 440 .name(name() + ".inst_accesses") 441 .desc("ITB inst accesses") 442 ; 443 444 readHits 445 .name(name() + ".read_hits") 446 .desc("DTB read hits") 447 ; 448 449 readMisses 450 .name(name() + ".read_misses") 451 .desc("DTB read misses") 452 ; 453 454 readAccesses 455 .name(name() + ".read_accesses") 456 .desc("DTB read accesses") 457 ; 458 459 writeHits 460 .name(name() + ".write_hits") 461 .desc("DTB write hits") 462 ; 463 464 writeMisses 465 .name(name() + ".write_misses") 466 .desc("DTB write misses") 467 ; 468 469 writeAccesses 470 .name(name() + ".write_accesses") 471 .desc("DTB write accesses") 472 ; 473 474 hits 475 .name(name() + ".hits") 476 .desc("DTB hits") 477 ; 478 479 misses 480 .name(name() + ".misses") 481 .desc("DTB misses") 482 ; 483 484 accesses 485 .name(name() + ".accesses") 486 .desc("DTB accesses") 487 ; 488 489 flushTlb 490 .name(name() + ".flush_tlb") 491 .desc("Number of times complete TLB was flushed") 492 ; 493 494 flushTlbMva 495 .name(name() + ".flush_tlb_mva") 496 .desc("Number of times TLB was flushed by MVA") 497 ; 498 499 flushTlbMvaAsid 500 .name(name() + ".flush_tlb_mva_asid") 501 .desc("Number of times TLB was flushed by MVA & ASID") 502 ; 503 504 flushTlbAsid 505 .name(name() + ".flush_tlb_asid") 506 .desc("Number of times TLB was flushed by ASID") 507 ; 508 509 flushedEntries 510 .name(name() + ".flush_entries") 511 .desc("Number of entries that have been flushed from TLB") 512 ; 513 514 alignFaults 515 .name(name() + ".align_faults") 516 .desc("Number of TLB faults due to alignment restrictions") 517 ; 518 519 prefetchFaults 520 .name(name() + ".prefetch_faults") 521 .desc("Number of TLB faults due to prefetch") 522 ; 523 524 domainFaults 525 .name(name() + ".domain_faults") 526 .desc("Number of TLB faults due to domain restrictions") 527 ; 528 529 permsFaults 530 .name(name() + ".perms_faults") 531 .desc("Number of TLB faults due to permissions restrictions") 532 ; 533 534 instAccesses = instHits + instMisses; 535 readAccesses = readHits + readMisses; 536 writeAccesses = writeHits + writeMisses; 537 hits = readHits + writeHits + instHits; 538 misses = readMisses + writeMisses + instMisses; 539 accesses = readAccesses + writeAccesses + instAccesses; 540} 541 542void 543TLB::regProbePoints() 544{ 545 ppRefills.reset(new ProbePoints::PMU(getProbeManager(), "Refills")); 546} 547 548Fault 549TLB::translateSe(RequestPtr req, ThreadContext *tc, Mode mode, 550 Translation *translation, bool &delay, bool timing) 551{ 552 updateMiscReg(tc); 553 Addr vaddr_tainted = req->getVaddr(); 554 Addr vaddr = 0; 555 if (aarch64) 556 vaddr = purifyTaggedAddr(vaddr_tainted, tc, aarch64EL, ttbcr); 557 else 558 vaddr = vaddr_tainted; 559 Request::Flags flags = req->getFlags(); 560 561 bool is_fetch = (mode == Execute); 562 bool is_write = (mode == Write); 563 564 if (!is_fetch) { 565 assert(flags & MustBeOne); 566 if (sctlr.a || !(flags & AllowUnaligned)) { 567 if (vaddr & mask(flags & AlignmentMask)) { 568 // LPAE is always disabled in SE mode 569 return std::make_shared<DataAbort>( 570 vaddr_tainted, 571 TlbEntry::DomainType::NoAccess, is_write, 572 ArmFault::AlignmentFault, isStage2, 573 ArmFault::VmsaTran); 574 } 575 } 576 } 577 578 Addr paddr; 579 Process *p = tc->getProcessPtr(); 580 581 if (!p->pTable->translate(vaddr, paddr)) 582 return std::make_shared<GenericPageTableFault>(vaddr_tainted); 583 req->setPaddr(paddr); 584
| 147 return NoFault; 148} 149 150TlbEntry* 151TLB::lookup(Addr va, uint16_t asn, uint8_t vmid, bool hyp, bool secure, 152 bool functional, bool ignore_asn, uint8_t target_el) 153{ 154 155 TlbEntry *retval = NULL; 156 157 // Maintaining LRU array 158 int x = 0; 159 while (retval == NULL && x < size) { 160 if ((!ignore_asn && table[x].match(va, asn, vmid, hyp, secure, false, 161 target_el)) || 162 (ignore_asn && table[x].match(va, vmid, hyp, secure, target_el))) { 163 // We only move the hit entry ahead when the position is higher 164 // than rangeMRU 165 if (x > rangeMRU && !functional) { 166 TlbEntry tmp_entry = table[x]; 167 for (int i = x; i > 0; i--) 168 table[i] = table[i - 1]; 169 table[0] = tmp_entry; 170 retval = &table[0]; 171 } else { 172 retval = &table[x]; 173 } 174 break; 175 } 176 ++x; 177 } 178 179 DPRINTF(TLBVerbose, "Lookup %#x, asn %#x -> %s vmn 0x%x hyp %d secure %d " 180 "ppn %#x size: %#x pa: %#x ap:%d ns:%d nstid:%d g:%d asid: %d " 181 "el: %d\n", 182 va, asn, retval ? "hit" : "miss", vmid, hyp, secure, 183 retval ? retval->pfn : 0, retval ? retval->size : 0, 184 retval ? retval->pAddr(va) : 0, retval ? retval->ap : 0, 185 retval ? retval->ns : 0, retval ? retval->nstid : 0, 186 retval ? retval->global : 0, retval ? retval->asid : 0, 187 retval ? retval->el : 0); 188 189 return retval; 190} 191 192// insert a new TLB entry 193void 194TLB::insert(Addr addr, TlbEntry &entry) 195{ 196 DPRINTF(TLB, "Inserting entry into TLB with pfn:%#x size:%#x vpn: %#x" 197 " asid:%d vmid:%d N:%d global:%d valid:%d nc:%d xn:%d" 198 " ap:%#x domain:%#x ns:%d nstid:%d isHyp:%d\n", entry.pfn, 199 entry.size, entry.vpn, entry.asid, entry.vmid, entry.N, 200 entry.global, entry.valid, entry.nonCacheable, entry.xn, 201 entry.ap, static_cast<uint8_t>(entry.domain), entry.ns, entry.nstid, 202 entry.isHyp); 203 204 if (table[size - 1].valid) 205 DPRINTF(TLB, " - Replacing Valid entry %#x, asn %d vmn %d ppn %#x " 206 "size: %#x ap:%d ns:%d nstid:%d g:%d isHyp:%d el: %d\n", 207 table[size-1].vpn << table[size-1].N, table[size-1].asid, 208 table[size-1].vmid, table[size-1].pfn << table[size-1].N, 209 table[size-1].size, table[size-1].ap, table[size-1].ns, 210 table[size-1].nstid, table[size-1].global, table[size-1].isHyp, 211 table[size-1].el); 212 213 //inserting to MRU position and evicting the LRU one 214 215 for (int i = size - 1; i > 0; --i) 216 table[i] = table[i-1]; 217 table[0] = entry; 218 219 inserts++; 220 ppRefills->notify(1); 221} 222 223void 224TLB::printTlb() const 225{ 226 int x = 0; 227 TlbEntry *te; 228 DPRINTF(TLB, "Current TLB contents:\n"); 229 while (x < size) { 230 te = &table[x]; 231 if (te->valid) 232 DPRINTF(TLB, " * %s\n", te->print()); 233 ++x; 234 } 235} 236 237void 238TLB::flushAllSecurity(bool secure_lookup, uint8_t target_el, bool ignore_el) 239{ 240 DPRINTF(TLB, "Flushing all TLB entries (%s lookup)\n", 241 (secure_lookup ? "secure" : "non-secure")); 242 int x = 0; 243 TlbEntry *te; 244 while (x < size) { 245 te = &table[x]; 246 if (te->valid && secure_lookup == !te->nstid && 247 (te->vmid == vmid || secure_lookup) && 248 checkELMatch(target_el, te->el, ignore_el)) { 249 250 DPRINTF(TLB, " - %s\n", te->print()); 251 te->valid = false; 252 flushedEntries++; 253 } 254 ++x; 255 } 256 257 flushTlb++; 258 259 // If there's a second stage TLB (and we're not it) then flush it as well 260 // if we're currently in hyp mode 261 if (!isStage2 && isHyp) { 262 stage2Tlb->flushAllSecurity(secure_lookup, true); 263 } 264} 265 266void 267TLB::flushAllNs(bool hyp, uint8_t target_el, bool ignore_el) 268{ 269 DPRINTF(TLB, "Flushing all NS TLB entries (%s lookup)\n", 270 (hyp ? "hyp" : "non-hyp")); 271 int x = 0; 272 TlbEntry *te; 273 while (x < size) { 274 te = &table[x]; 275 if (te->valid && te->nstid && te->isHyp == hyp && 276 checkELMatch(target_el, te->el, ignore_el)) { 277 278 DPRINTF(TLB, " - %s\n", te->print()); 279 flushedEntries++; 280 te->valid = false; 281 } 282 ++x; 283 } 284 285 flushTlb++; 286 287 // If there's a second stage TLB (and we're not it) then flush it as well 288 if (!isStage2 && !hyp) { 289 stage2Tlb->flushAllNs(false, true); 290 } 291} 292 293void 294TLB::flushMvaAsid(Addr mva, uint64_t asn, bool secure_lookup, uint8_t target_el) 295{ 296 DPRINTF(TLB, "Flushing TLB entries with mva: %#x, asid: %#x " 297 "(%s lookup)\n", mva, asn, (secure_lookup ? 298 "secure" : "non-secure")); 299 _flushMva(mva, asn, secure_lookup, false, false, target_el); 300 flushTlbMvaAsid++; 301} 302 303void 304TLB::flushAsid(uint64_t asn, bool secure_lookup, uint8_t target_el) 305{ 306 DPRINTF(TLB, "Flushing TLB entries with asid: %#x (%s lookup)\n", asn, 307 (secure_lookup ? "secure" : "non-secure")); 308 309 int x = 0 ; 310 TlbEntry *te; 311 312 while (x < size) { 313 te = &table[x]; 314 if (te->valid && te->asid == asn && secure_lookup == !te->nstid && 315 (te->vmid == vmid || secure_lookup) && 316 checkELMatch(target_el, te->el, false)) { 317 318 te->valid = false; 319 DPRINTF(TLB, " - %s\n", te->print()); 320 flushedEntries++; 321 } 322 ++x; 323 } 324 flushTlbAsid++; 325} 326 327void 328TLB::flushMva(Addr mva, bool secure_lookup, bool hyp, uint8_t target_el) 329{ 330 DPRINTF(TLB, "Flushing TLB entries with mva: %#x (%s lookup)\n", mva, 331 (secure_lookup ? "secure" : "non-secure")); 332 _flushMva(mva, 0xbeef, secure_lookup, hyp, true, target_el); 333 flushTlbMva++; 334} 335 336void 337TLB::_flushMva(Addr mva, uint64_t asn, bool secure_lookup, bool hyp, 338 bool ignore_asn, uint8_t target_el) 339{ 340 TlbEntry *te; 341 // D5.7.2: Sign-extend address to 64 bits 342 mva = sext<56>(mva); 343 te = lookup(mva, asn, vmid, hyp, secure_lookup, false, ignore_asn, 344 target_el); 345 while (te != NULL) { 346 if (secure_lookup == !te->nstid) { 347 DPRINTF(TLB, " - %s\n", te->print()); 348 te->valid = false; 349 flushedEntries++; 350 } 351 te = lookup(mva, asn, vmid, hyp, secure_lookup, false, ignore_asn, 352 target_el); 353 } 354} 355 356void 357TLB::flushIpaVmid(Addr ipa, bool secure_lookup, bool hyp, uint8_t target_el) 358{ 359 assert(!isStage2); 360 stage2Tlb->_flushMva(ipa, 0xbeef, secure_lookup, hyp, true, target_el); 361} 362 363bool 364TLB::checkELMatch(uint8_t target_el, uint8_t tentry_el, bool ignore_el) 365{ 366 bool elMatch = true; 367 if (!ignore_el) { 368 if (target_el == 2 || target_el == 3) { 369 elMatch = (tentry_el == target_el); 370 } else { 371 elMatch = (tentry_el == 0) || (tentry_el == 1); 372 } 373 } 374 return elMatch; 375} 376 377void 378TLB::drainResume() 379{ 380 // We might have unserialized something or switched CPUs, so make 381 // sure to re-read the misc regs. 382 miscRegValid = false; 383} 384 385void 386TLB::takeOverFrom(BaseTLB *_otlb) 387{ 388 TLB *otlb = dynamic_cast<TLB*>(_otlb); 389 /* Make sure we actually have a valid type */ 390 if (otlb) { 391 _attr = otlb->_attr; 392 haveLPAE = otlb->haveLPAE; 393 directToStage2 = otlb->directToStage2; 394 stage2Req = otlb->stage2Req; 395 396 /* Sync the stage2 MMU if they exist in both 397 * the old CPU and the new 398 */ 399 if (!isStage2 && 400 stage2Tlb && otlb->stage2Tlb) { 401 stage2Tlb->takeOverFrom(otlb->stage2Tlb); 402 } 403 } else { 404 panic("Incompatible TLB type!"); 405 } 406} 407 408void 409TLB::serialize(CheckpointOut &cp) const 410{ 411 DPRINTF(Checkpoint, "Serializing Arm TLB\n"); 412 413 SERIALIZE_SCALAR(_attr); 414 SERIALIZE_SCALAR(haveLPAE); 415 SERIALIZE_SCALAR(directToStage2); 416 SERIALIZE_SCALAR(stage2Req); 417 418 int num_entries = size; 419 SERIALIZE_SCALAR(num_entries); 420 for (int i = 0; i < size; i++) 421 table[i].serializeSection(cp, csprintf("TlbEntry%d", i)); 422} 423 424void 425TLB::unserialize(CheckpointIn &cp) 426{ 427 DPRINTF(Checkpoint, "Unserializing Arm TLB\n"); 428 429 UNSERIALIZE_SCALAR(_attr); 430 UNSERIALIZE_SCALAR(haveLPAE); 431 UNSERIALIZE_SCALAR(directToStage2); 432 UNSERIALIZE_SCALAR(stage2Req); 433 434 int num_entries; 435 UNSERIALIZE_SCALAR(num_entries); 436 for (int i = 0; i < min(size, num_entries); i++) 437 table[i].unserializeSection(cp, csprintf("TlbEntry%d", i)); 438} 439 440void 441TLB::regStats() 442{ 443 BaseTLB::regStats(); 444 instHits 445 .name(name() + ".inst_hits") 446 .desc("ITB inst hits") 447 ; 448 449 instMisses 450 .name(name() + ".inst_misses") 451 .desc("ITB inst misses") 452 ; 453 454 instAccesses 455 .name(name() + ".inst_accesses") 456 .desc("ITB inst accesses") 457 ; 458 459 readHits 460 .name(name() + ".read_hits") 461 .desc("DTB read hits") 462 ; 463 464 readMisses 465 .name(name() + ".read_misses") 466 .desc("DTB read misses") 467 ; 468 469 readAccesses 470 .name(name() + ".read_accesses") 471 .desc("DTB read accesses") 472 ; 473 474 writeHits 475 .name(name() + ".write_hits") 476 .desc("DTB write hits") 477 ; 478 479 writeMisses 480 .name(name() + ".write_misses") 481 .desc("DTB write misses") 482 ; 483 484 writeAccesses 485 .name(name() + ".write_accesses") 486 .desc("DTB write accesses") 487 ; 488 489 hits 490 .name(name() + ".hits") 491 .desc("DTB hits") 492 ; 493 494 misses 495 .name(name() + ".misses") 496 .desc("DTB misses") 497 ; 498 499 accesses 500 .name(name() + ".accesses") 501 .desc("DTB accesses") 502 ; 503 504 flushTlb 505 .name(name() + ".flush_tlb") 506 .desc("Number of times complete TLB was flushed") 507 ; 508 509 flushTlbMva 510 .name(name() + ".flush_tlb_mva") 511 .desc("Number of times TLB was flushed by MVA") 512 ; 513 514 flushTlbMvaAsid 515 .name(name() + ".flush_tlb_mva_asid") 516 .desc("Number of times TLB was flushed by MVA & ASID") 517 ; 518 519 flushTlbAsid 520 .name(name() + ".flush_tlb_asid") 521 .desc("Number of times TLB was flushed by ASID") 522 ; 523 524 flushedEntries 525 .name(name() + ".flush_entries") 526 .desc("Number of entries that have been flushed from TLB") 527 ; 528 529 alignFaults 530 .name(name() + ".align_faults") 531 .desc("Number of TLB faults due to alignment restrictions") 532 ; 533 534 prefetchFaults 535 .name(name() + ".prefetch_faults") 536 .desc("Number of TLB faults due to prefetch") 537 ; 538 539 domainFaults 540 .name(name() + ".domain_faults") 541 .desc("Number of TLB faults due to domain restrictions") 542 ; 543 544 permsFaults 545 .name(name() + ".perms_faults") 546 .desc("Number of TLB faults due to permissions restrictions") 547 ; 548 549 instAccesses = instHits + instMisses; 550 readAccesses = readHits + readMisses; 551 writeAccesses = writeHits + writeMisses; 552 hits = readHits + writeHits + instHits; 553 misses = readMisses + writeMisses + instMisses; 554 accesses = readAccesses + writeAccesses + instAccesses; 555} 556 557void 558TLB::regProbePoints() 559{ 560 ppRefills.reset(new ProbePoints::PMU(getProbeManager(), "Refills")); 561} 562 563Fault 564TLB::translateSe(RequestPtr req, ThreadContext *tc, Mode mode, 565 Translation *translation, bool &delay, bool timing) 566{ 567 updateMiscReg(tc); 568 Addr vaddr_tainted = req->getVaddr(); 569 Addr vaddr = 0; 570 if (aarch64) 571 vaddr = purifyTaggedAddr(vaddr_tainted, tc, aarch64EL, ttbcr); 572 else 573 vaddr = vaddr_tainted; 574 Request::Flags flags = req->getFlags(); 575 576 bool is_fetch = (mode == Execute); 577 bool is_write = (mode == Write); 578 579 if (!is_fetch) { 580 assert(flags & MustBeOne); 581 if (sctlr.a || !(flags & AllowUnaligned)) { 582 if (vaddr & mask(flags & AlignmentMask)) { 583 // LPAE is always disabled in SE mode 584 return std::make_shared<DataAbort>( 585 vaddr_tainted, 586 TlbEntry::DomainType::NoAccess, is_write, 587 ArmFault::AlignmentFault, isStage2, 588 ArmFault::VmsaTran); 589 } 590 } 591 } 592 593 Addr paddr; 594 Process *p = tc->getProcessPtr(); 595 596 if (!p->pTable->translate(vaddr, paddr)) 597 return std::make_shared<GenericPageTableFault>(vaddr_tainted); 598 req->setPaddr(paddr); 599
|
585 return NoFault;
| 600 return finalizePhysical(req, tc, mode);
|
586} 587 588Fault 589TLB::checkPermissions(TlbEntry *te, RequestPtr req, Mode mode) 590{ 591 Addr vaddr = req->getVaddr(); // 32-bit don't have to purify 592 Request::Flags flags = req->getFlags(); 593 bool is_fetch = (mode == Execute); 594 bool is_write = (mode == Write); 595 bool is_priv = isPriv && !(flags & UserMode); 596 597 // Get the translation type from the actuall table entry 598 ArmFault::TranMethod tranMethod = te->longDescFormat ? ArmFault::LpaeTran 599 : ArmFault::VmsaTran; 600 601 // If this is the second stage of translation and the request is for a 602 // stage 1 page table walk then we need to check the HCR.PTW bit. This 603 // allows us to generate a fault if the request targets an area marked 604 // as a device or strongly ordered. 605 if (isStage2 && req->isPTWalk() && hcr.ptw && 606 (te->mtype != TlbEntry::MemoryType::Normal)) { 607 return std::make_shared<DataAbort>( 608 vaddr, te->domain, is_write, 609 ArmFault::PermissionLL + te->lookupLevel, 610 isStage2, tranMethod); 611 } 612 613 // Generate an alignment fault for unaligned data accesses to device or 614 // strongly ordered memory 615 if (!is_fetch) { 616 if (te->mtype != TlbEntry::MemoryType::Normal) { 617 if (vaddr & mask(flags & AlignmentMask)) { 618 alignFaults++; 619 return std::make_shared<DataAbort>( 620 vaddr, TlbEntry::DomainType::NoAccess, is_write, 621 ArmFault::AlignmentFault, isStage2, 622 tranMethod); 623 } 624 } 625 } 626 627 if (te->nonCacheable) { 628 // Prevent prefetching from I/O devices. 629 if (req->isPrefetch()) { 630 // Here we can safely use the fault status for the short 631 // desc. format in all cases 632 return std::make_shared<PrefetchAbort>( 633 vaddr, ArmFault::PrefetchUncacheable, 634 isStage2, tranMethod); 635 } 636 } 637 638 if (!te->longDescFormat) { 639 switch ((dacr >> (static_cast<uint8_t>(te->domain) * 2)) & 0x3) { 640 case 0: 641 domainFaults++; 642 DPRINTF(TLB, "TLB Fault: Data abort on domain. DACR: %#x" 643 " domain: %#x write:%d\n", dacr, 644 static_cast<uint8_t>(te->domain), is_write); 645 if (is_fetch) { 646 // Use PC value instead of vaddr because vaddr might 647 // be aligned to cache line and should not be the 648 // address reported in FAR 649 return std::make_shared<PrefetchAbort>( 650 req->getPC(), 651 ArmFault::DomainLL + te->lookupLevel, 652 isStage2, tranMethod); 653 } else 654 return std::make_shared<DataAbort>( 655 vaddr, te->domain, is_write, 656 ArmFault::DomainLL + te->lookupLevel, 657 isStage2, tranMethod); 658 case 1: 659 // Continue with permissions check 660 break; 661 case 2: 662 panic("UNPRED domain\n"); 663 case 3: 664 return NoFault; 665 } 666 } 667 668 // The 'ap' variable is AP[2:0] or {AP[2,1],1b'0}, i.e. always three bits 669 uint8_t ap = te->longDescFormat ? te->ap << 1 : te->ap; 670 uint8_t hap = te->hap; 671 672 if (sctlr.afe == 1 || te->longDescFormat) 673 ap |= 1; 674 675 bool abt; 676 bool isWritable = true; 677 // If this is a stage 2 access (eg for reading stage 1 page table entries) 678 // then don't perform the AP permissions check, we stil do the HAP check 679 // below. 680 if (isStage2) { 681 abt = false; 682 } else { 683 switch (ap) { 684 case 0: 685 DPRINTF(TLB, "Access permissions 0, checking rs:%#x\n", 686 (int)sctlr.rs); 687 if (!sctlr.xp) { 688 switch ((int)sctlr.rs) { 689 case 2: 690 abt = is_write; 691 break; 692 case 1: 693 abt = is_write || !is_priv; 694 break; 695 case 0: 696 case 3: 697 default: 698 abt = true; 699 break; 700 } 701 } else { 702 abt = true; 703 } 704 break; 705 case 1: 706 abt = !is_priv; 707 break; 708 case 2: 709 abt = !is_priv && is_write; 710 isWritable = is_priv; 711 break; 712 case 3: 713 abt = false; 714 break; 715 case 4: 716 panic("UNPRED premissions\n"); 717 case 5: 718 abt = !is_priv || is_write; 719 isWritable = false; 720 break; 721 case 6: 722 case 7: 723 abt = is_write; 724 isWritable = false; 725 break; 726 default: 727 panic("Unknown permissions %#x\n", ap); 728 } 729 } 730 731 bool hapAbt = is_write ? !(hap & 2) : !(hap & 1); 732 bool xn = te->xn || (isWritable && sctlr.wxn) || 733 (ap == 3 && sctlr.uwxn && is_priv); 734 if (is_fetch && (abt || xn || 735 (te->longDescFormat && te->pxn && is_priv) || 736 (isSecure && te->ns && scr.sif))) { 737 permsFaults++; 738 DPRINTF(TLB, "TLB Fault: Prefetch abort on permission check. AP:%d " 739 "priv:%d write:%d ns:%d sif:%d sctlr.afe: %d \n", 740 ap, is_priv, is_write, te->ns, scr.sif,sctlr.afe); 741 // Use PC value instead of vaddr because vaddr might be aligned to 742 // cache line and should not be the address reported in FAR 743 return std::make_shared<PrefetchAbort>( 744 req->getPC(), 745 ArmFault::PermissionLL + te->lookupLevel, 746 isStage2, tranMethod); 747 } else if (abt | hapAbt) { 748 permsFaults++; 749 DPRINTF(TLB, "TLB Fault: Data abort on permission check. AP:%d priv:%d" 750 " write:%d\n", ap, is_priv, is_write); 751 return std::make_shared<DataAbort>( 752 vaddr, te->domain, is_write, 753 ArmFault::PermissionLL + te->lookupLevel, 754 isStage2 | !abt, tranMethod); 755 } 756 return NoFault; 757} 758 759 760Fault 761TLB::checkPermissions64(TlbEntry *te, RequestPtr req, Mode mode, 762 ThreadContext *tc) 763{ 764 assert(aarch64); 765 766 Addr vaddr_tainted = req->getVaddr(); 767 Addr vaddr = purifyTaggedAddr(vaddr_tainted, tc, aarch64EL, ttbcr); 768 769 Request::Flags flags = req->getFlags(); 770 bool is_fetch = (mode == Execute); 771 bool is_write = (mode == Write); 772 bool is_priv M5_VAR_USED = isPriv && !(flags & UserMode); 773 774 updateMiscReg(tc, curTranType); 775 776 // If this is the second stage of translation and the request is for a 777 // stage 1 page table walk then we need to check the HCR.PTW bit. This 778 // allows us to generate a fault if the request targets an area marked 779 // as a device or strongly ordered. 780 if (isStage2 && req->isPTWalk() && hcr.ptw && 781 (te->mtype != TlbEntry::MemoryType::Normal)) { 782 return std::make_shared<DataAbort>( 783 vaddr_tainted, te->domain, is_write, 784 ArmFault::PermissionLL + te->lookupLevel, 785 isStage2, ArmFault::LpaeTran); 786 } 787 788 // Generate an alignment fault for unaligned accesses to device or 789 // strongly ordered memory 790 if (!is_fetch) { 791 if (te->mtype != TlbEntry::MemoryType::Normal) { 792 if (vaddr & mask(flags & AlignmentMask)) { 793 alignFaults++; 794 return std::make_shared<DataAbort>( 795 vaddr_tainted, 796 TlbEntry::DomainType::NoAccess, is_write, 797 ArmFault::AlignmentFault, isStage2, 798 ArmFault::LpaeTran); 799 } 800 } 801 } 802 803 if (te->nonCacheable) { 804 // Prevent prefetching from I/O devices. 805 if (req->isPrefetch()) { 806 // Here we can safely use the fault status for the short 807 // desc. format in all cases 808 return std::make_shared<PrefetchAbort>( 809 vaddr_tainted, 810 ArmFault::PrefetchUncacheable, 811 isStage2, ArmFault::LpaeTran); 812 } 813 } 814 815 uint8_t ap = 0x3 & (te->ap); // 2-bit access protection field 816 bool grant = false; 817 818 uint8_t xn = te->xn; 819 uint8_t pxn = te->pxn; 820 bool r = !is_write && !is_fetch; 821 bool w = is_write; 822 bool x = is_fetch; 823 DPRINTF(TLBVerbose, "Checking permissions: ap:%d, xn:%d, pxn:%d, r:%d, " 824 "w:%d, x:%d\n", ap, xn, pxn, r, w, x); 825 826 if (isStage2) { 827 assert(ArmSystem::haveVirtualization(tc) && aarch64EL != EL2); 828 // In stage 2 we use the hypervisor access permission bits. 829 // The following permissions are described in ARM DDI 0487A.f 830 // D4-1802 831 uint8_t hap = 0x3 & te->hap; 832 if (is_fetch) { 833 // sctlr.wxn overrides the xn bit 834 grant = !sctlr.wxn && !xn; 835 } else if (is_write) { 836 grant = hap & 0x2; 837 } else { // is_read 838 grant = hap & 0x1; 839 } 840 } else { 841 switch (aarch64EL) { 842 case EL0: 843 { 844 uint8_t perm = (ap << 2) | (xn << 1) | pxn; 845 switch (perm) { 846 case 0: 847 case 1: 848 case 8: 849 case 9: 850 grant = x; 851 break; 852 case 4: 853 case 5: 854 grant = r || w || (x && !sctlr.wxn); 855 break; 856 case 6: 857 case 7: 858 grant = r || w; 859 break; 860 case 12: 861 case 13: 862 grant = r || x; 863 break; 864 case 14: 865 case 15: 866 grant = r; 867 break; 868 default: 869 grant = false; 870 } 871 } 872 break; 873 case EL1: 874 { 875 uint8_t perm = (ap << 2) | (xn << 1) | pxn; 876 switch (perm) { 877 case 0: 878 case 2: 879 grant = r || w || (x && !sctlr.wxn); 880 break; 881 case 1: 882 case 3: 883 case 4: 884 case 5: 885 case 6: 886 case 7: 887 // regions that are writeable at EL0 should not be 888 // executable at EL1 889 grant = r || w; 890 break; 891 case 8: 892 case 10: 893 case 12: 894 case 14: 895 grant = r || x; 896 break; 897 case 9: 898 case 11: 899 case 13: 900 case 15: 901 grant = r; 902 break; 903 default: 904 grant = false; 905 } 906 } 907 break; 908 case EL2: 909 case EL3: 910 { 911 uint8_t perm = (ap & 0x2) | xn; 912 switch (perm) { 913 case 0: 914 grant = r || w || (x && !sctlr.wxn) ; 915 break; 916 case 1: 917 grant = r || w; 918 break; 919 case 2: 920 grant = r || x; 921 break; 922 case 3: 923 grant = r; 924 break; 925 default: 926 grant = false; 927 } 928 } 929 break; 930 } 931 } 932 933 if (!grant) { 934 if (is_fetch) { 935 permsFaults++; 936 DPRINTF(TLB, "TLB Fault: Prefetch abort on permission check. " 937 "AP:%d priv:%d write:%d ns:%d sif:%d " 938 "sctlr.afe: %d\n", 939 ap, is_priv, is_write, te->ns, scr.sif, sctlr.afe); 940 // Use PC value instead of vaddr because vaddr might be aligned to 941 // cache line and should not be the address reported in FAR 942 return std::make_shared<PrefetchAbort>( 943 req->getPC(), 944 ArmFault::PermissionLL + te->lookupLevel, 945 isStage2, ArmFault::LpaeTran); 946 } else { 947 permsFaults++; 948 DPRINTF(TLB, "TLB Fault: Data abort on permission check. AP:%d " 949 "priv:%d write:%d\n", ap, is_priv, is_write); 950 return std::make_shared<DataAbort>( 951 vaddr_tainted, te->domain, is_write, 952 ArmFault::PermissionLL + te->lookupLevel, 953 isStage2, ArmFault::LpaeTran); 954 } 955 } 956 957 return NoFault; 958} 959 960Fault 961TLB::translateFs(RequestPtr req, ThreadContext *tc, Mode mode, 962 Translation *translation, bool &delay, bool timing, 963 TLB::ArmTranslationType tranType, bool functional) 964{ 965 // No such thing as a functional timing access 966 assert(!(timing && functional)); 967 968 updateMiscReg(tc, tranType); 969 970 Addr vaddr_tainted = req->getVaddr(); 971 Addr vaddr = 0; 972 if (aarch64) 973 vaddr = purifyTaggedAddr(vaddr_tainted, tc, aarch64EL, ttbcr); 974 else 975 vaddr = vaddr_tainted; 976 Request::Flags flags = req->getFlags(); 977 978 bool is_fetch = (mode == Execute); 979 bool is_write = (mode == Write); 980 bool long_desc_format = aarch64 || longDescFormatInUse(tc); 981 ArmFault::TranMethod tranMethod = long_desc_format ? ArmFault::LpaeTran 982 : ArmFault::VmsaTran; 983 984 req->setAsid(asid); 985 986 DPRINTF(TLBVerbose, "CPSR is priv:%d UserMode:%d secure:%d S1S2NsTran:%d\n", 987 isPriv, flags & UserMode, isSecure, tranType & S1S2NsTran); 988 989 DPRINTF(TLB, "translateFs addr %#x, mode %d, st2 %d, scr %#x sctlr %#x " 990 "flags %#lx tranType 0x%x\n", vaddr_tainted, mode, isStage2, 991 scr, sctlr, flags, tranType); 992 993 if ((req->isInstFetch() && (!sctlr.i)) || 994 ((!req->isInstFetch()) && (!sctlr.c))){ 995 req->setFlags(Request::UNCACHEABLE | Request::STRICT_ORDER); 996 } 997 if (!is_fetch) { 998 assert(flags & MustBeOne); 999 if (sctlr.a || !(flags & AllowUnaligned)) { 1000 if (vaddr & mask(flags & AlignmentMask)) { 1001 alignFaults++; 1002 return std::make_shared<DataAbort>( 1003 vaddr_tainted, 1004 TlbEntry::DomainType::NoAccess, is_write, 1005 ArmFault::AlignmentFault, isStage2, 1006 tranMethod); 1007 } 1008 } 1009 } 1010 1011 // If guest MMU is off or hcr.vm=0 go straight to stage2 1012 if ((isStage2 && !hcr.vm) || (!isStage2 && !sctlr.m)) { 1013 1014 req->setPaddr(vaddr); 1015 // When the MMU is off the security attribute corresponds to the 1016 // security state of the processor 1017 if (isSecure) 1018 req->setFlags(Request::SECURE); 1019 1020 // @todo: double check this (ARM ARM issue C B3.2.1) 1021 if (long_desc_format || sctlr.tre == 0) { 1022 req->setFlags(Request::UNCACHEABLE | Request::STRICT_ORDER); 1023 } else { 1024 if (nmrr.ir0 == 0 || nmrr.or0 == 0 || prrr.tr0 != 0x2) 1025 req->setFlags(Request::UNCACHEABLE | Request::STRICT_ORDER); 1026 } 1027 1028 // Set memory attributes 1029 TlbEntry temp_te; 1030 temp_te.ns = !isSecure; 1031 if (isStage2 || hcr.dc == 0 || isSecure || 1032 (isHyp && !(tranType & S1CTran))) { 1033 1034 temp_te.mtype = is_fetch ? TlbEntry::MemoryType::Normal 1035 : TlbEntry::MemoryType::StronglyOrdered; 1036 temp_te.innerAttrs = 0x0; 1037 temp_te.outerAttrs = 0x0; 1038 temp_te.shareable = true; 1039 temp_te.outerShareable = true; 1040 } else { 1041 temp_te.mtype = TlbEntry::MemoryType::Normal; 1042 temp_te.innerAttrs = 0x3; 1043 temp_te.outerAttrs = 0x3; 1044 temp_te.shareable = false; 1045 temp_te.outerShareable = false; 1046 } 1047 temp_te.setAttributes(long_desc_format); 1048 DPRINTF(TLBVerbose, "(No MMU) setting memory attributes: shareable: " 1049 "%d, innerAttrs: %d, outerAttrs: %d, isStage2: %d\n", 1050 temp_te.shareable, temp_te.innerAttrs, temp_te.outerAttrs, 1051 isStage2); 1052 setAttr(temp_te.attributes); 1053 1054 return testTranslation(req, mode, TlbEntry::DomainType::NoAccess); 1055 } 1056 1057 DPRINTF(TLBVerbose, "Translating %s=%#x context=%d\n", 1058 isStage2 ? "IPA" : "VA", vaddr_tainted, asid); 1059 // Translation enabled 1060 1061 TlbEntry *te = NULL; 1062 TlbEntry mergeTe; 1063 Fault fault = getResultTe(&te, req, tc, mode, translation, timing, 1064 functional, &mergeTe); 1065 // only proceed if we have a valid table entry 1066 if ((te == NULL) && (fault == NoFault)) delay = true; 1067 1068 // If we have the table entry transfer some of the attributes to the 1069 // request that triggered the translation 1070 if (te != NULL) { 1071 // Set memory attributes 1072 DPRINTF(TLBVerbose, 1073 "Setting memory attributes: shareable: %d, innerAttrs: %d, " 1074 "outerAttrs: %d, mtype: %d, isStage2: %d\n", 1075 te->shareable, te->innerAttrs, te->outerAttrs, 1076 static_cast<uint8_t>(te->mtype), isStage2); 1077 setAttr(te->attributes); 1078 1079 if (te->nonCacheable) 1080 req->setFlags(Request::UNCACHEABLE); 1081 1082 // Require requests to be ordered if the request goes to 1083 // strongly ordered or device memory (i.e., anything other 1084 // than normal memory requires strict order). 1085 if (te->mtype != TlbEntry::MemoryType::Normal) 1086 req->setFlags(Request::STRICT_ORDER); 1087 1088 Addr pa = te->pAddr(vaddr); 1089 req->setPaddr(pa); 1090 1091 if (isSecure && !te->ns) { 1092 req->setFlags(Request::SECURE); 1093 } 1094 if ((!is_fetch) && (vaddr & mask(flags & AlignmentMask)) && 1095 (te->mtype != TlbEntry::MemoryType::Normal)) { 1096 // Unaligned accesses to Device memory should always cause an 1097 // abort regardless of sctlr.a 1098 alignFaults++; 1099 return std::make_shared<DataAbort>( 1100 vaddr_tainted, 1101 TlbEntry::DomainType::NoAccess, is_write, 1102 ArmFault::AlignmentFault, isStage2, 1103 tranMethod); 1104 } 1105 1106 // Check for a trickbox generated address fault 1107 if (fault == NoFault) 1108 fault = testTranslation(req, mode, te->domain); 1109 } 1110
| 601} 602 603Fault 604TLB::checkPermissions(TlbEntry *te, RequestPtr req, Mode mode) 605{ 606 Addr vaddr = req->getVaddr(); // 32-bit don't have to purify 607 Request::Flags flags = req->getFlags(); 608 bool is_fetch = (mode == Execute); 609 bool is_write = (mode == Write); 610 bool is_priv = isPriv && !(flags & UserMode); 611 612 // Get the translation type from the actuall table entry 613 ArmFault::TranMethod tranMethod = te->longDescFormat ? ArmFault::LpaeTran 614 : ArmFault::VmsaTran; 615 616 // If this is the second stage of translation and the request is for a 617 // stage 1 page table walk then we need to check the HCR.PTW bit. This 618 // allows us to generate a fault if the request targets an area marked 619 // as a device or strongly ordered. 620 if (isStage2 && req->isPTWalk() && hcr.ptw && 621 (te->mtype != TlbEntry::MemoryType::Normal)) { 622 return std::make_shared<DataAbort>( 623 vaddr, te->domain, is_write, 624 ArmFault::PermissionLL + te->lookupLevel, 625 isStage2, tranMethod); 626 } 627 628 // Generate an alignment fault for unaligned data accesses to device or 629 // strongly ordered memory 630 if (!is_fetch) { 631 if (te->mtype != TlbEntry::MemoryType::Normal) { 632 if (vaddr & mask(flags & AlignmentMask)) { 633 alignFaults++; 634 return std::make_shared<DataAbort>( 635 vaddr, TlbEntry::DomainType::NoAccess, is_write, 636 ArmFault::AlignmentFault, isStage2, 637 tranMethod); 638 } 639 } 640 } 641 642 if (te->nonCacheable) { 643 // Prevent prefetching from I/O devices. 644 if (req->isPrefetch()) { 645 // Here we can safely use the fault status for the short 646 // desc. format in all cases 647 return std::make_shared<PrefetchAbort>( 648 vaddr, ArmFault::PrefetchUncacheable, 649 isStage2, tranMethod); 650 } 651 } 652 653 if (!te->longDescFormat) { 654 switch ((dacr >> (static_cast<uint8_t>(te->domain) * 2)) & 0x3) { 655 case 0: 656 domainFaults++; 657 DPRINTF(TLB, "TLB Fault: Data abort on domain. DACR: %#x" 658 " domain: %#x write:%d\n", dacr, 659 static_cast<uint8_t>(te->domain), is_write); 660 if (is_fetch) { 661 // Use PC value instead of vaddr because vaddr might 662 // be aligned to cache line and should not be the 663 // address reported in FAR 664 return std::make_shared<PrefetchAbort>( 665 req->getPC(), 666 ArmFault::DomainLL + te->lookupLevel, 667 isStage2, tranMethod); 668 } else 669 return std::make_shared<DataAbort>( 670 vaddr, te->domain, is_write, 671 ArmFault::DomainLL + te->lookupLevel, 672 isStage2, tranMethod); 673 case 1: 674 // Continue with permissions check 675 break; 676 case 2: 677 panic("UNPRED domain\n"); 678 case 3: 679 return NoFault; 680 } 681 } 682 683 // The 'ap' variable is AP[2:0] or {AP[2,1],1b'0}, i.e. always three bits 684 uint8_t ap = te->longDescFormat ? te->ap << 1 : te->ap; 685 uint8_t hap = te->hap; 686 687 if (sctlr.afe == 1 || te->longDescFormat) 688 ap |= 1; 689 690 bool abt; 691 bool isWritable = true; 692 // If this is a stage 2 access (eg for reading stage 1 page table entries) 693 // then don't perform the AP permissions check, we stil do the HAP check 694 // below. 695 if (isStage2) { 696 abt = false; 697 } else { 698 switch (ap) { 699 case 0: 700 DPRINTF(TLB, "Access permissions 0, checking rs:%#x\n", 701 (int)sctlr.rs); 702 if (!sctlr.xp) { 703 switch ((int)sctlr.rs) { 704 case 2: 705 abt = is_write; 706 break; 707 case 1: 708 abt = is_write || !is_priv; 709 break; 710 case 0: 711 case 3: 712 default: 713 abt = true; 714 break; 715 } 716 } else { 717 abt = true; 718 } 719 break; 720 case 1: 721 abt = !is_priv; 722 break; 723 case 2: 724 abt = !is_priv && is_write; 725 isWritable = is_priv; 726 break; 727 case 3: 728 abt = false; 729 break; 730 case 4: 731 panic("UNPRED premissions\n"); 732 case 5: 733 abt = !is_priv || is_write; 734 isWritable = false; 735 break; 736 case 6: 737 case 7: 738 abt = is_write; 739 isWritable = false; 740 break; 741 default: 742 panic("Unknown permissions %#x\n", ap); 743 } 744 } 745 746 bool hapAbt = is_write ? !(hap & 2) : !(hap & 1); 747 bool xn = te->xn || (isWritable && sctlr.wxn) || 748 (ap == 3 && sctlr.uwxn && is_priv); 749 if (is_fetch && (abt || xn || 750 (te->longDescFormat && te->pxn && is_priv) || 751 (isSecure && te->ns && scr.sif))) { 752 permsFaults++; 753 DPRINTF(TLB, "TLB Fault: Prefetch abort on permission check. AP:%d " 754 "priv:%d write:%d ns:%d sif:%d sctlr.afe: %d \n", 755 ap, is_priv, is_write, te->ns, scr.sif,sctlr.afe); 756 // Use PC value instead of vaddr because vaddr might be aligned to 757 // cache line and should not be the address reported in FAR 758 return std::make_shared<PrefetchAbort>( 759 req->getPC(), 760 ArmFault::PermissionLL + te->lookupLevel, 761 isStage2, tranMethod); 762 } else if (abt | hapAbt) { 763 permsFaults++; 764 DPRINTF(TLB, "TLB Fault: Data abort on permission check. AP:%d priv:%d" 765 " write:%d\n", ap, is_priv, is_write); 766 return std::make_shared<DataAbort>( 767 vaddr, te->domain, is_write, 768 ArmFault::PermissionLL + te->lookupLevel, 769 isStage2 | !abt, tranMethod); 770 } 771 return NoFault; 772} 773 774 775Fault 776TLB::checkPermissions64(TlbEntry *te, RequestPtr req, Mode mode, 777 ThreadContext *tc) 778{ 779 assert(aarch64); 780 781 Addr vaddr_tainted = req->getVaddr(); 782 Addr vaddr = purifyTaggedAddr(vaddr_tainted, tc, aarch64EL, ttbcr); 783 784 Request::Flags flags = req->getFlags(); 785 bool is_fetch = (mode == Execute); 786 bool is_write = (mode == Write); 787 bool is_priv M5_VAR_USED = isPriv && !(flags & UserMode); 788 789 updateMiscReg(tc, curTranType); 790 791 // If this is the second stage of translation and the request is for a 792 // stage 1 page table walk then we need to check the HCR.PTW bit. This 793 // allows us to generate a fault if the request targets an area marked 794 // as a device or strongly ordered. 795 if (isStage2 && req->isPTWalk() && hcr.ptw && 796 (te->mtype != TlbEntry::MemoryType::Normal)) { 797 return std::make_shared<DataAbort>( 798 vaddr_tainted, te->domain, is_write, 799 ArmFault::PermissionLL + te->lookupLevel, 800 isStage2, ArmFault::LpaeTran); 801 } 802 803 // Generate an alignment fault for unaligned accesses to device or 804 // strongly ordered memory 805 if (!is_fetch) { 806 if (te->mtype != TlbEntry::MemoryType::Normal) { 807 if (vaddr & mask(flags & AlignmentMask)) { 808 alignFaults++; 809 return std::make_shared<DataAbort>( 810 vaddr_tainted, 811 TlbEntry::DomainType::NoAccess, is_write, 812 ArmFault::AlignmentFault, isStage2, 813 ArmFault::LpaeTran); 814 } 815 } 816 } 817 818 if (te->nonCacheable) { 819 // Prevent prefetching from I/O devices. 820 if (req->isPrefetch()) { 821 // Here we can safely use the fault status for the short 822 // desc. format in all cases 823 return std::make_shared<PrefetchAbort>( 824 vaddr_tainted, 825 ArmFault::PrefetchUncacheable, 826 isStage2, ArmFault::LpaeTran); 827 } 828 } 829 830 uint8_t ap = 0x3 & (te->ap); // 2-bit access protection field 831 bool grant = false; 832 833 uint8_t xn = te->xn; 834 uint8_t pxn = te->pxn; 835 bool r = !is_write && !is_fetch; 836 bool w = is_write; 837 bool x = is_fetch; 838 DPRINTF(TLBVerbose, "Checking permissions: ap:%d, xn:%d, pxn:%d, r:%d, " 839 "w:%d, x:%d\n", ap, xn, pxn, r, w, x); 840 841 if (isStage2) { 842 assert(ArmSystem::haveVirtualization(tc) && aarch64EL != EL2); 843 // In stage 2 we use the hypervisor access permission bits. 844 // The following permissions are described in ARM DDI 0487A.f 845 // D4-1802 846 uint8_t hap = 0x3 & te->hap; 847 if (is_fetch) { 848 // sctlr.wxn overrides the xn bit 849 grant = !sctlr.wxn && !xn; 850 } else if (is_write) { 851 grant = hap & 0x2; 852 } else { // is_read 853 grant = hap & 0x1; 854 } 855 } else { 856 switch (aarch64EL) { 857 case EL0: 858 { 859 uint8_t perm = (ap << 2) | (xn << 1) | pxn; 860 switch (perm) { 861 case 0: 862 case 1: 863 case 8: 864 case 9: 865 grant = x; 866 break; 867 case 4: 868 case 5: 869 grant = r || w || (x && !sctlr.wxn); 870 break; 871 case 6: 872 case 7: 873 grant = r || w; 874 break; 875 case 12: 876 case 13: 877 grant = r || x; 878 break; 879 case 14: 880 case 15: 881 grant = r; 882 break; 883 default: 884 grant = false; 885 } 886 } 887 break; 888 case EL1: 889 { 890 uint8_t perm = (ap << 2) | (xn << 1) | pxn; 891 switch (perm) { 892 case 0: 893 case 2: 894 grant = r || w || (x && !sctlr.wxn); 895 break; 896 case 1: 897 case 3: 898 case 4: 899 case 5: 900 case 6: 901 case 7: 902 // regions that are writeable at EL0 should not be 903 // executable at EL1 904 grant = r || w; 905 break; 906 case 8: 907 case 10: 908 case 12: 909 case 14: 910 grant = r || x; 911 break; 912 case 9: 913 case 11: 914 case 13: 915 case 15: 916 grant = r; 917 break; 918 default: 919 grant = false; 920 } 921 } 922 break; 923 case EL2: 924 case EL3: 925 { 926 uint8_t perm = (ap & 0x2) | xn; 927 switch (perm) { 928 case 0: 929 grant = r || w || (x && !sctlr.wxn) ; 930 break; 931 case 1: 932 grant = r || w; 933 break; 934 case 2: 935 grant = r || x; 936 break; 937 case 3: 938 grant = r; 939 break; 940 default: 941 grant = false; 942 } 943 } 944 break; 945 } 946 } 947 948 if (!grant) { 949 if (is_fetch) { 950 permsFaults++; 951 DPRINTF(TLB, "TLB Fault: Prefetch abort on permission check. " 952 "AP:%d priv:%d write:%d ns:%d sif:%d " 953 "sctlr.afe: %d\n", 954 ap, is_priv, is_write, te->ns, scr.sif, sctlr.afe); 955 // Use PC value instead of vaddr because vaddr might be aligned to 956 // cache line and should not be the address reported in FAR 957 return std::make_shared<PrefetchAbort>( 958 req->getPC(), 959 ArmFault::PermissionLL + te->lookupLevel, 960 isStage2, ArmFault::LpaeTran); 961 } else { 962 permsFaults++; 963 DPRINTF(TLB, "TLB Fault: Data abort on permission check. AP:%d " 964 "priv:%d write:%d\n", ap, is_priv, is_write); 965 return std::make_shared<DataAbort>( 966 vaddr_tainted, te->domain, is_write, 967 ArmFault::PermissionLL + te->lookupLevel, 968 isStage2, ArmFault::LpaeTran); 969 } 970 } 971 972 return NoFault; 973} 974 975Fault 976TLB::translateFs(RequestPtr req, ThreadContext *tc, Mode mode, 977 Translation *translation, bool &delay, bool timing, 978 TLB::ArmTranslationType tranType, bool functional) 979{ 980 // No such thing as a functional timing access 981 assert(!(timing && functional)); 982 983 updateMiscReg(tc, tranType); 984 985 Addr vaddr_tainted = req->getVaddr(); 986 Addr vaddr = 0; 987 if (aarch64) 988 vaddr = purifyTaggedAddr(vaddr_tainted, tc, aarch64EL, ttbcr); 989 else 990 vaddr = vaddr_tainted; 991 Request::Flags flags = req->getFlags(); 992 993 bool is_fetch = (mode == Execute); 994 bool is_write = (mode == Write); 995 bool long_desc_format = aarch64 || longDescFormatInUse(tc); 996 ArmFault::TranMethod tranMethod = long_desc_format ? ArmFault::LpaeTran 997 : ArmFault::VmsaTran; 998 999 req->setAsid(asid); 1000 1001 DPRINTF(TLBVerbose, "CPSR is priv:%d UserMode:%d secure:%d S1S2NsTran:%d\n", 1002 isPriv, flags & UserMode, isSecure, tranType & S1S2NsTran); 1003 1004 DPRINTF(TLB, "translateFs addr %#x, mode %d, st2 %d, scr %#x sctlr %#x " 1005 "flags %#lx tranType 0x%x\n", vaddr_tainted, mode, isStage2, 1006 scr, sctlr, flags, tranType); 1007 1008 if ((req->isInstFetch() && (!sctlr.i)) || 1009 ((!req->isInstFetch()) && (!sctlr.c))){ 1010 req->setFlags(Request::UNCACHEABLE | Request::STRICT_ORDER); 1011 } 1012 if (!is_fetch) { 1013 assert(flags & MustBeOne); 1014 if (sctlr.a || !(flags & AllowUnaligned)) { 1015 if (vaddr & mask(flags & AlignmentMask)) { 1016 alignFaults++; 1017 return std::make_shared<DataAbort>( 1018 vaddr_tainted, 1019 TlbEntry::DomainType::NoAccess, is_write, 1020 ArmFault::AlignmentFault, isStage2, 1021 tranMethod); 1022 } 1023 } 1024 } 1025 1026 // If guest MMU is off or hcr.vm=0 go straight to stage2 1027 if ((isStage2 && !hcr.vm) || (!isStage2 && !sctlr.m)) { 1028 1029 req->setPaddr(vaddr); 1030 // When the MMU is off the security attribute corresponds to the 1031 // security state of the processor 1032 if (isSecure) 1033 req->setFlags(Request::SECURE); 1034 1035 // @todo: double check this (ARM ARM issue C B3.2.1) 1036 if (long_desc_format || sctlr.tre == 0) { 1037 req->setFlags(Request::UNCACHEABLE | Request::STRICT_ORDER); 1038 } else { 1039 if (nmrr.ir0 == 0 || nmrr.or0 == 0 || prrr.tr0 != 0x2) 1040 req->setFlags(Request::UNCACHEABLE | Request::STRICT_ORDER); 1041 } 1042 1043 // Set memory attributes 1044 TlbEntry temp_te; 1045 temp_te.ns = !isSecure; 1046 if (isStage2 || hcr.dc == 0 || isSecure || 1047 (isHyp && !(tranType & S1CTran))) { 1048 1049 temp_te.mtype = is_fetch ? TlbEntry::MemoryType::Normal 1050 : TlbEntry::MemoryType::StronglyOrdered; 1051 temp_te.innerAttrs = 0x0; 1052 temp_te.outerAttrs = 0x0; 1053 temp_te.shareable = true; 1054 temp_te.outerShareable = true; 1055 } else { 1056 temp_te.mtype = TlbEntry::MemoryType::Normal; 1057 temp_te.innerAttrs = 0x3; 1058 temp_te.outerAttrs = 0x3; 1059 temp_te.shareable = false; 1060 temp_te.outerShareable = false; 1061 } 1062 temp_te.setAttributes(long_desc_format); 1063 DPRINTF(TLBVerbose, "(No MMU) setting memory attributes: shareable: " 1064 "%d, innerAttrs: %d, outerAttrs: %d, isStage2: %d\n", 1065 temp_te.shareable, temp_te.innerAttrs, temp_te.outerAttrs, 1066 isStage2); 1067 setAttr(temp_te.attributes); 1068 1069 return testTranslation(req, mode, TlbEntry::DomainType::NoAccess); 1070 } 1071 1072 DPRINTF(TLBVerbose, "Translating %s=%#x context=%d\n", 1073 isStage2 ? "IPA" : "VA", vaddr_tainted, asid); 1074 // Translation enabled 1075 1076 TlbEntry *te = NULL; 1077 TlbEntry mergeTe; 1078 Fault fault = getResultTe(&te, req, tc, mode, translation, timing, 1079 functional, &mergeTe); 1080 // only proceed if we have a valid table entry 1081 if ((te == NULL) && (fault == NoFault)) delay = true; 1082 1083 // If we have the table entry transfer some of the attributes to the 1084 // request that triggered the translation 1085 if (te != NULL) { 1086 // Set memory attributes 1087 DPRINTF(TLBVerbose, 1088 "Setting memory attributes: shareable: %d, innerAttrs: %d, " 1089 "outerAttrs: %d, mtype: %d, isStage2: %d\n", 1090 te->shareable, te->innerAttrs, te->outerAttrs, 1091 static_cast<uint8_t>(te->mtype), isStage2); 1092 setAttr(te->attributes); 1093 1094 if (te->nonCacheable) 1095 req->setFlags(Request::UNCACHEABLE); 1096 1097 // Require requests to be ordered if the request goes to 1098 // strongly ordered or device memory (i.e., anything other 1099 // than normal memory requires strict order). 1100 if (te->mtype != TlbEntry::MemoryType::Normal) 1101 req->setFlags(Request::STRICT_ORDER); 1102 1103 Addr pa = te->pAddr(vaddr); 1104 req->setPaddr(pa); 1105 1106 if (isSecure && !te->ns) { 1107 req->setFlags(Request::SECURE); 1108 } 1109 if ((!is_fetch) && (vaddr & mask(flags & AlignmentMask)) && 1110 (te->mtype != TlbEntry::MemoryType::Normal)) { 1111 // Unaligned accesses to Device memory should always cause an 1112 // abort regardless of sctlr.a 1113 alignFaults++; 1114 return std::make_shared<DataAbort>( 1115 vaddr_tainted, 1116 TlbEntry::DomainType::NoAccess, is_write, 1117 ArmFault::AlignmentFault, isStage2, 1118 tranMethod); 1119 } 1120 1121 // Check for a trickbox generated address fault 1122 if (fault == NoFault) 1123 fault = testTranslation(req, mode, te->domain); 1124 } 1125
|
1111 // Generate Illegal Inst Set State fault if IL bit is set in CPSR
| |
1112 if (fault == NoFault) {
| 1126 if (fault == NoFault) {
|
| 1127 // Generate Illegal Inst Set State fault if IL bit is set in CPSR
|
1113 if (aarch64 && is_fetch && cpsr.il == 1) { 1114 return std::make_shared<IllegalInstSetStateFault>(); 1115 }
| 1128 if (aarch64 && is_fetch && cpsr.il == 1) { 1129 return std::make_shared<IllegalInstSetStateFault>(); 1130 }
|
1116 }
| |
1117
| 1131
|
1118 return fault;
| 1132 // Don't try to finalize a physical address unless the 1133 // translation has completed (i.e., there is a table entry). 1134 return te ? finalizePhysical(req, tc, mode) : NoFault; 1135 } else { 1136 return fault; 1137 }
|
1119} 1120 1121Fault 1122TLB::translateAtomic(RequestPtr req, ThreadContext *tc, Mode mode, 1123 TLB::ArmTranslationType tranType) 1124{ 1125 updateMiscReg(tc, tranType); 1126 1127 if (directToStage2) { 1128 assert(stage2Tlb); 1129 return stage2Tlb->translateAtomic(req, tc, mode, tranType); 1130 } 1131 1132 bool delay = false; 1133 Fault fault; 1134 if (FullSystem) 1135 fault = translateFs(req, tc, mode, NULL, delay, false, tranType); 1136 else 1137 fault = translateSe(req, tc, mode, NULL, delay, false); 1138 assert(!delay); 1139 return fault; 1140} 1141 1142Fault 1143TLB::translateFunctional(RequestPtr req, ThreadContext *tc, Mode mode, 1144 TLB::ArmTranslationType tranType) 1145{ 1146 updateMiscReg(tc, tranType); 1147 1148 if (directToStage2) { 1149 assert(stage2Tlb); 1150 return stage2Tlb->translateFunctional(req, tc, mode, tranType); 1151 } 1152 1153 bool delay = false; 1154 Fault fault; 1155 if (FullSystem) 1156 fault = translateFs(req, tc, mode, NULL, delay, false, tranType, true); 1157 else 1158 fault = translateSe(req, tc, mode, NULL, delay, false); 1159 assert(!delay); 1160 return fault; 1161} 1162 1163Fault 1164TLB::translateTiming(RequestPtr req, ThreadContext *tc, 1165 Translation *translation, Mode mode, TLB::ArmTranslationType tranType) 1166{ 1167 updateMiscReg(tc, tranType); 1168 1169 if (directToStage2) { 1170 assert(stage2Tlb); 1171 return stage2Tlb->translateTiming(req, tc, translation, mode, tranType); 1172 } 1173 1174 assert(translation); 1175 1176 return translateComplete(req, tc, translation, mode, tranType, isStage2); 1177} 1178 1179Fault 1180TLB::translateComplete(RequestPtr req, ThreadContext *tc, 1181 Translation *translation, Mode mode, TLB::ArmTranslationType tranType, 1182 bool callFromS2) 1183{ 1184 bool delay = false; 1185 Fault fault; 1186 if (FullSystem) 1187 fault = translateFs(req, tc, mode, translation, delay, true, tranType); 1188 else 1189 fault = translateSe(req, tc, mode, translation, delay, true); 1190 DPRINTF(TLBVerbose, "Translation returning delay=%d fault=%d\n", delay, fault != 1191 NoFault); 1192 // If we have a translation, and we're not in the middle of doing a stage 1193 // 2 translation tell the translation that we've either finished or its 1194 // going to take a while. By not doing this when we're in the middle of a 1195 // stage 2 translation we prevent marking the translation as delayed twice, 1196 // one when the translation starts and again when the stage 1 translation 1197 // completes. 1198 if (translation && (callFromS2 || !stage2Req || req->hasPaddr() || fault != NoFault)) { 1199 if (!delay) 1200 translation->finish(fault, req, tc, mode); 1201 else 1202 translation->markDelayed(); 1203 } 1204 return fault; 1205} 1206 1207BaseMasterPort* 1208TLB::getMasterPort() 1209{ 1210 return &stage2Mmu->getPort(); 1211} 1212 1213void 1214TLB::updateMiscReg(ThreadContext *tc, ArmTranslationType tranType) 1215{ 1216 // check if the regs have changed, or the translation mode is different. 1217 // NOTE: the tran type doesn't affect stage 2 TLB's as they only handle 1218 // one type of translation anyway 1219 if (miscRegValid && miscRegContext == tc->contextId() && 1220 ((tranType == curTranType) || isStage2)) { 1221 return; 1222 } 1223 1224 DPRINTF(TLBVerbose, "TLB variables changed!\n"); 1225 cpsr = tc->readMiscReg(MISCREG_CPSR); 1226 1227 // Dependencies: SCR/SCR_EL3, CPSR 1228 isSecure = inSecureState(tc) && 1229 !(tranType & HypMode) && !(tranType & S1S2NsTran); 1230 1231 const OperatingMode op_mode = (OperatingMode) (uint8_t)cpsr.mode; 1232 aarch64 = opModeIs64(op_mode) || 1233 (opModeToEL(op_mode) == EL0 && ELIs64(tc, EL1)); 1234 1235 if (aarch64) { // AArch64 1236 // determine EL we need to translate in 1237 switch (tranType) { 1238 case S1E0Tran: 1239 case S12E0Tran: 1240 aarch64EL = EL0; 1241 break; 1242 case S1E1Tran: 1243 case S12E1Tran: 1244 aarch64EL = EL1; 1245 break; 1246 case S1E2Tran: 1247 aarch64EL = EL2; 1248 break; 1249 case S1E3Tran: 1250 aarch64EL = EL3; 1251 break; 1252 case NormalTran: 1253 case S1CTran: 1254 case S1S2NsTran: 1255 case HypMode: 1256 aarch64EL = (ExceptionLevel) (uint8_t) cpsr.el; 1257 break; 1258 } 1259 1260 switch (aarch64EL) { 1261 case EL0: 1262 case EL1: 1263 { 1264 sctlr = tc->readMiscReg(MISCREG_SCTLR_EL1); 1265 ttbcr = tc->readMiscReg(MISCREG_TCR_EL1); 1266 uint64_t ttbr_asid = ttbcr.a1 ? 1267 tc->readMiscReg(MISCREG_TTBR1_EL1) : 1268 tc->readMiscReg(MISCREG_TTBR0_EL1); 1269 asid = bits(ttbr_asid, 1270 (haveLargeAsid64 && ttbcr.as) ? 63 : 55, 48); 1271 } 1272 break; 1273 case EL2: 1274 sctlr = tc->readMiscReg(MISCREG_SCTLR_EL2); 1275 ttbcr = tc->readMiscReg(MISCREG_TCR_EL2); 1276 asid = -1; 1277 break; 1278 case EL3: 1279 sctlr = tc->readMiscReg(MISCREG_SCTLR_EL3); 1280 ttbcr = tc->readMiscReg(MISCREG_TCR_EL3); 1281 asid = -1; 1282 break; 1283 } 1284 hcr = tc->readMiscReg(MISCREG_HCR_EL2); 1285 scr = tc->readMiscReg(MISCREG_SCR_EL3); 1286 isPriv = aarch64EL != EL0; 1287 if (haveVirtualization) { 1288 vmid = bits(tc->readMiscReg(MISCREG_VTTBR_EL2), 55, 48); 1289 isHyp = tranType & HypMode; 1290 isHyp &= (tranType & S1S2NsTran) == 0; 1291 isHyp &= (tranType & S1CTran) == 0; 1292 // Work out if we should skip the first stage of translation and go 1293 // directly to stage 2. This value is cached so we don't have to 1294 // compute it for every translation. 1295 stage2Req = isStage2 || 1296 (hcr.vm && !isHyp && !isSecure && 1297 !(tranType & S1CTran) && (aarch64EL < EL2) && 1298 !(tranType & S1E1Tran)); // <--- FIX THIS HACK 1299 directToStage2 = !isStage2 && stage2Req && !sctlr.m; 1300 } else { 1301 vmid = 0; 1302 isHyp = false; 1303 directToStage2 = false; 1304 stage2Req = false; 1305 } 1306 } else { // AArch32 1307 sctlr = tc->readMiscReg(flattenMiscRegNsBanked(MISCREG_SCTLR, tc, 1308 !isSecure)); 1309 ttbcr = tc->readMiscReg(flattenMiscRegNsBanked(MISCREG_TTBCR, tc, 1310 !isSecure)); 1311 scr = tc->readMiscReg(MISCREG_SCR); 1312 isPriv = cpsr.mode != MODE_USER; 1313 if (longDescFormatInUse(tc)) { 1314 uint64_t ttbr_asid = tc->readMiscReg( 1315 flattenMiscRegNsBanked(ttbcr.a1 ? MISCREG_TTBR1 1316 : MISCREG_TTBR0, 1317 tc, !isSecure)); 1318 asid = bits(ttbr_asid, 55, 48); 1319 } else { // Short-descriptor translation table format in use 1320 CONTEXTIDR context_id = tc->readMiscReg(flattenMiscRegNsBanked( 1321 MISCREG_CONTEXTIDR, tc,!isSecure)); 1322 asid = context_id.asid; 1323 } 1324 prrr = tc->readMiscReg(flattenMiscRegNsBanked(MISCREG_PRRR, tc, 1325 !isSecure)); 1326 nmrr = tc->readMiscReg(flattenMiscRegNsBanked(MISCREG_NMRR, tc, 1327 !isSecure)); 1328 dacr = tc->readMiscReg(flattenMiscRegNsBanked(MISCREG_DACR, tc, 1329 !isSecure)); 1330 hcr = tc->readMiscReg(MISCREG_HCR); 1331 1332 if (haveVirtualization) { 1333 vmid = bits(tc->readMiscReg(MISCREG_VTTBR), 55, 48); 1334 isHyp = cpsr.mode == MODE_HYP; 1335 isHyp |= tranType & HypMode; 1336 isHyp &= (tranType & S1S2NsTran) == 0; 1337 isHyp &= (tranType & S1CTran) == 0; 1338 if (isHyp) { 1339 sctlr = tc->readMiscReg(MISCREG_HSCTLR); 1340 } 1341 // Work out if we should skip the first stage of translation and go 1342 // directly to stage 2. This value is cached so we don't have to 1343 // compute it for every translation. 1344 stage2Req = hcr.vm && !isStage2 && !isHyp && !isSecure && 1345 !(tranType & S1CTran); 1346 directToStage2 = stage2Req && !sctlr.m; 1347 } else { 1348 vmid = 0; 1349 stage2Req = false; 1350 isHyp = false; 1351 directToStage2 = false; 1352 } 1353 } 1354 miscRegValid = true; 1355 miscRegContext = tc->contextId(); 1356 curTranType = tranType; 1357} 1358 1359Fault 1360TLB::getTE(TlbEntry **te, RequestPtr req, ThreadContext *tc, Mode mode, 1361 Translation *translation, bool timing, bool functional, 1362 bool is_secure, TLB::ArmTranslationType tranType) 1363{ 1364 bool is_fetch = (mode == Execute); 1365 bool is_write = (mode == Write); 1366 1367 Addr vaddr_tainted = req->getVaddr(); 1368 Addr vaddr = 0; 1369 ExceptionLevel target_el = aarch64 ? aarch64EL : EL1; 1370 if (aarch64) { 1371 vaddr = purifyTaggedAddr(vaddr_tainted, tc, target_el, ttbcr); 1372 } else { 1373 vaddr = vaddr_tainted; 1374 } 1375 *te = lookup(vaddr, asid, vmid, isHyp, is_secure, false, false, target_el); 1376 if (*te == NULL) { 1377 if (req->isPrefetch()) { 1378 // if the request is a prefetch don't attempt to fill the TLB or go 1379 // any further with the memory access (here we can safely use the 1380 // fault status for the short desc. format in all cases) 1381 prefetchFaults++; 1382 return std::make_shared<PrefetchAbort>( 1383 vaddr_tainted, ArmFault::PrefetchTLBMiss, isStage2); 1384 } 1385 1386 if (is_fetch) 1387 instMisses++; 1388 else if (is_write) 1389 writeMisses++; 1390 else 1391 readMisses++; 1392 1393 // start translation table walk, pass variables rather than 1394 // re-retreaving in table walker for speed 1395 DPRINTF(TLB, "TLB Miss: Starting hardware table walker for %#x(%d:%d)\n", 1396 vaddr_tainted, asid, vmid); 1397 Fault fault; 1398 fault = tableWalker->walk(req, tc, asid, vmid, isHyp, mode, 1399 translation, timing, functional, is_secure, 1400 tranType, stage2Req); 1401 // for timing mode, return and wait for table walk, 1402 if (timing || fault != NoFault) { 1403 return fault; 1404 } 1405 1406 *te = lookup(vaddr, asid, vmid, isHyp, is_secure, false, false, target_el); 1407 if (!*te) 1408 printTlb(); 1409 assert(*te); 1410 } else { 1411 if (is_fetch) 1412 instHits++; 1413 else if (is_write) 1414 writeHits++; 1415 else 1416 readHits++; 1417 } 1418 return NoFault; 1419} 1420 1421Fault 1422TLB::getResultTe(TlbEntry **te, RequestPtr req, ThreadContext *tc, Mode mode, 1423 Translation *translation, bool timing, bool functional, 1424 TlbEntry *mergeTe) 1425{ 1426 Fault fault; 1427 1428 if (isStage2) { 1429 // We are already in the stage 2 TLB. Grab the table entry for stage 1430 // 2 only. We are here because stage 1 translation is disabled. 1431 TlbEntry *s2Te = NULL; 1432 // Get the stage 2 table entry 1433 fault = getTE(&s2Te, req, tc, mode, translation, timing, functional, 1434 isSecure, curTranType); 1435 // Check permissions of stage 2 1436 if ((s2Te != NULL) && (fault = NoFault)) { 1437 if(aarch64) 1438 fault = checkPermissions64(s2Te, req, mode, tc); 1439 else 1440 fault = checkPermissions(s2Te, req, mode); 1441 } 1442 *te = s2Te; 1443 return fault; 1444 } 1445 1446 TlbEntry *s1Te = NULL; 1447 1448 Addr vaddr_tainted = req->getVaddr(); 1449 1450 // Get the stage 1 table entry 1451 fault = getTE(&s1Te, req, tc, mode, translation, timing, functional, 1452 isSecure, curTranType); 1453 // only proceed if we have a valid table entry 1454 if ((s1Te != NULL) && (fault == NoFault)) { 1455 // Check stage 1 permissions before checking stage 2 1456 if (aarch64) 1457 fault = checkPermissions64(s1Te, req, mode, tc); 1458 else 1459 fault = checkPermissions(s1Te, req, mode); 1460 if (stage2Req & (fault == NoFault)) { 1461 Stage2LookUp *s2Lookup = new Stage2LookUp(this, stage2Tlb, *s1Te, 1462 req, translation, mode, timing, functional, curTranType); 1463 fault = s2Lookup->getTe(tc, mergeTe); 1464 if (s2Lookup->isComplete()) { 1465 *te = mergeTe; 1466 // We've finished with the lookup so delete it 1467 delete s2Lookup; 1468 } else { 1469 // The lookup hasn't completed, so we can't delete it now. We 1470 // get round this by asking the object to self delete when the 1471 // translation is complete. 1472 s2Lookup->setSelfDelete(); 1473 } 1474 } else { 1475 // This case deals with an S1 hit (or bypass), followed by 1476 // an S2 hit-but-perms issue 1477 if (isStage2) { 1478 DPRINTF(TLBVerbose, "s2TLB: reqVa %#x, reqPa %#x, fault %p\n", 1479 vaddr_tainted, req->hasPaddr() ? req->getPaddr() : ~0, fault); 1480 if (fault != NoFault) { 1481 ArmFault *armFault = reinterpret_cast<ArmFault *>(fault.get()); 1482 armFault->annotate(ArmFault::S1PTW, false); 1483 armFault->annotate(ArmFault::OVA, vaddr_tainted); 1484 } 1485 } 1486 *te = s1Te; 1487 } 1488 } 1489 return fault; 1490} 1491 1492void 1493TLB::setTestInterface(SimObject *_ti) 1494{ 1495 if (!_ti) { 1496 test = nullptr; 1497 } else { 1498 TlbTestInterface *ti(dynamic_cast<TlbTestInterface *>(_ti)); 1499 fatal_if(!ti, "%s is not a valid ARM TLB tester\n", _ti->name()); 1500 test = ti; 1501 } 1502} 1503 1504Fault 1505TLB::testTranslation(RequestPtr req, Mode mode, TlbEntry::DomainType domain) 1506{ 1507 if (!test || !req->hasSize() || req->getSize() == 0) { 1508 return NoFault; 1509 } else { 1510 return test->translationCheck(req, isPriv, mode, domain); 1511 } 1512} 1513 1514Fault 1515TLB::testWalk(Addr pa, Addr size, Addr va, bool is_secure, Mode mode, 1516 TlbEntry::DomainType domain, LookupLevel lookup_level) 1517{ 1518 if (!test) { 1519 return NoFault; 1520 } else { 1521 return test->walkCheck(pa, size, va, is_secure, isPriv, mode, 1522 domain, lookup_level); 1523 } 1524} 1525 1526 1527ArmISA::TLB * 1528ArmTLBParams::create() 1529{ 1530 return new ArmISA::TLB(this); 1531}
| 1138} 1139 1140Fault 1141TLB::translateAtomic(RequestPtr req, ThreadContext *tc, Mode mode, 1142 TLB::ArmTranslationType tranType) 1143{ 1144 updateMiscReg(tc, tranType); 1145 1146 if (directToStage2) { 1147 assert(stage2Tlb); 1148 return stage2Tlb->translateAtomic(req, tc, mode, tranType); 1149 } 1150 1151 bool delay = false; 1152 Fault fault; 1153 if (FullSystem) 1154 fault = translateFs(req, tc, mode, NULL, delay, false, tranType); 1155 else 1156 fault = translateSe(req, tc, mode, NULL, delay, false); 1157 assert(!delay); 1158 return fault; 1159} 1160 1161Fault 1162TLB::translateFunctional(RequestPtr req, ThreadContext *tc, Mode mode, 1163 TLB::ArmTranslationType tranType) 1164{ 1165 updateMiscReg(tc, tranType); 1166 1167 if (directToStage2) { 1168 assert(stage2Tlb); 1169 return stage2Tlb->translateFunctional(req, tc, mode, tranType); 1170 } 1171 1172 bool delay = false; 1173 Fault fault; 1174 if (FullSystem) 1175 fault = translateFs(req, tc, mode, NULL, delay, false, tranType, true); 1176 else 1177 fault = translateSe(req, tc, mode, NULL, delay, false); 1178 assert(!delay); 1179 return fault; 1180} 1181 1182Fault 1183TLB::translateTiming(RequestPtr req, ThreadContext *tc, 1184 Translation *translation, Mode mode, TLB::ArmTranslationType tranType) 1185{ 1186 updateMiscReg(tc, tranType); 1187 1188 if (directToStage2) { 1189 assert(stage2Tlb); 1190 return stage2Tlb->translateTiming(req, tc, translation, mode, tranType); 1191 } 1192 1193 assert(translation); 1194 1195 return translateComplete(req, tc, translation, mode, tranType, isStage2); 1196} 1197 1198Fault 1199TLB::translateComplete(RequestPtr req, ThreadContext *tc, 1200 Translation *translation, Mode mode, TLB::ArmTranslationType tranType, 1201 bool callFromS2) 1202{ 1203 bool delay = false; 1204 Fault fault; 1205 if (FullSystem) 1206 fault = translateFs(req, tc, mode, translation, delay, true, tranType); 1207 else 1208 fault = translateSe(req, tc, mode, translation, delay, true); 1209 DPRINTF(TLBVerbose, "Translation returning delay=%d fault=%d\n", delay, fault != 1210 NoFault); 1211 // If we have a translation, and we're not in the middle of doing a stage 1212 // 2 translation tell the translation that we've either finished or its 1213 // going to take a while. By not doing this when we're in the middle of a 1214 // stage 2 translation we prevent marking the translation as delayed twice, 1215 // one when the translation starts and again when the stage 1 translation 1216 // completes. 1217 if (translation && (callFromS2 || !stage2Req || req->hasPaddr() || fault != NoFault)) { 1218 if (!delay) 1219 translation->finish(fault, req, tc, mode); 1220 else 1221 translation->markDelayed(); 1222 } 1223 return fault; 1224} 1225 1226BaseMasterPort* 1227TLB::getMasterPort() 1228{ 1229 return &stage2Mmu->getPort(); 1230} 1231 1232void 1233TLB::updateMiscReg(ThreadContext *tc, ArmTranslationType tranType) 1234{ 1235 // check if the regs have changed, or the translation mode is different. 1236 // NOTE: the tran type doesn't affect stage 2 TLB's as they only handle 1237 // one type of translation anyway 1238 if (miscRegValid && miscRegContext == tc->contextId() && 1239 ((tranType == curTranType) || isStage2)) { 1240 return; 1241 } 1242 1243 DPRINTF(TLBVerbose, "TLB variables changed!\n"); 1244 cpsr = tc->readMiscReg(MISCREG_CPSR); 1245 1246 // Dependencies: SCR/SCR_EL3, CPSR 1247 isSecure = inSecureState(tc) && 1248 !(tranType & HypMode) && !(tranType & S1S2NsTran); 1249 1250 const OperatingMode op_mode = (OperatingMode) (uint8_t)cpsr.mode; 1251 aarch64 = opModeIs64(op_mode) || 1252 (opModeToEL(op_mode) == EL0 && ELIs64(tc, EL1)); 1253 1254 if (aarch64) { // AArch64 1255 // determine EL we need to translate in 1256 switch (tranType) { 1257 case S1E0Tran: 1258 case S12E0Tran: 1259 aarch64EL = EL0; 1260 break; 1261 case S1E1Tran: 1262 case S12E1Tran: 1263 aarch64EL = EL1; 1264 break; 1265 case S1E2Tran: 1266 aarch64EL = EL2; 1267 break; 1268 case S1E3Tran: 1269 aarch64EL = EL3; 1270 break; 1271 case NormalTran: 1272 case S1CTran: 1273 case S1S2NsTran: 1274 case HypMode: 1275 aarch64EL = (ExceptionLevel) (uint8_t) cpsr.el; 1276 break; 1277 } 1278 1279 switch (aarch64EL) { 1280 case EL0: 1281 case EL1: 1282 { 1283 sctlr = tc->readMiscReg(MISCREG_SCTLR_EL1); 1284 ttbcr = tc->readMiscReg(MISCREG_TCR_EL1); 1285 uint64_t ttbr_asid = ttbcr.a1 ? 1286 tc->readMiscReg(MISCREG_TTBR1_EL1) : 1287 tc->readMiscReg(MISCREG_TTBR0_EL1); 1288 asid = bits(ttbr_asid, 1289 (haveLargeAsid64 && ttbcr.as) ? 63 : 55, 48); 1290 } 1291 break; 1292 case EL2: 1293 sctlr = tc->readMiscReg(MISCREG_SCTLR_EL2); 1294 ttbcr = tc->readMiscReg(MISCREG_TCR_EL2); 1295 asid = -1; 1296 break; 1297 case EL3: 1298 sctlr = tc->readMiscReg(MISCREG_SCTLR_EL3); 1299 ttbcr = tc->readMiscReg(MISCREG_TCR_EL3); 1300 asid = -1; 1301 break; 1302 } 1303 hcr = tc->readMiscReg(MISCREG_HCR_EL2); 1304 scr = tc->readMiscReg(MISCREG_SCR_EL3); 1305 isPriv = aarch64EL != EL0; 1306 if (haveVirtualization) { 1307 vmid = bits(tc->readMiscReg(MISCREG_VTTBR_EL2), 55, 48); 1308 isHyp = tranType & HypMode; 1309 isHyp &= (tranType & S1S2NsTran) == 0; 1310 isHyp &= (tranType & S1CTran) == 0; 1311 // Work out if we should skip the first stage of translation and go 1312 // directly to stage 2. This value is cached so we don't have to 1313 // compute it for every translation. 1314 stage2Req = isStage2 || 1315 (hcr.vm && !isHyp && !isSecure && 1316 !(tranType & S1CTran) && (aarch64EL < EL2) && 1317 !(tranType & S1E1Tran)); // <--- FIX THIS HACK 1318 directToStage2 = !isStage2 && stage2Req && !sctlr.m; 1319 } else { 1320 vmid = 0; 1321 isHyp = false; 1322 directToStage2 = false; 1323 stage2Req = false; 1324 } 1325 } else { // AArch32 1326 sctlr = tc->readMiscReg(flattenMiscRegNsBanked(MISCREG_SCTLR, tc, 1327 !isSecure)); 1328 ttbcr = tc->readMiscReg(flattenMiscRegNsBanked(MISCREG_TTBCR, tc, 1329 !isSecure)); 1330 scr = tc->readMiscReg(MISCREG_SCR); 1331 isPriv = cpsr.mode != MODE_USER; 1332 if (longDescFormatInUse(tc)) { 1333 uint64_t ttbr_asid = tc->readMiscReg( 1334 flattenMiscRegNsBanked(ttbcr.a1 ? MISCREG_TTBR1 1335 : MISCREG_TTBR0, 1336 tc, !isSecure)); 1337 asid = bits(ttbr_asid, 55, 48); 1338 } else { // Short-descriptor translation table format in use 1339 CONTEXTIDR context_id = tc->readMiscReg(flattenMiscRegNsBanked( 1340 MISCREG_CONTEXTIDR, tc,!isSecure)); 1341 asid = context_id.asid; 1342 } 1343 prrr = tc->readMiscReg(flattenMiscRegNsBanked(MISCREG_PRRR, tc, 1344 !isSecure)); 1345 nmrr = tc->readMiscReg(flattenMiscRegNsBanked(MISCREG_NMRR, tc, 1346 !isSecure)); 1347 dacr = tc->readMiscReg(flattenMiscRegNsBanked(MISCREG_DACR, tc, 1348 !isSecure)); 1349 hcr = tc->readMiscReg(MISCREG_HCR); 1350 1351 if (haveVirtualization) { 1352 vmid = bits(tc->readMiscReg(MISCREG_VTTBR), 55, 48); 1353 isHyp = cpsr.mode == MODE_HYP; 1354 isHyp |= tranType & HypMode; 1355 isHyp &= (tranType & S1S2NsTran) == 0; 1356 isHyp &= (tranType & S1CTran) == 0; 1357 if (isHyp) { 1358 sctlr = tc->readMiscReg(MISCREG_HSCTLR); 1359 } 1360 // Work out if we should skip the first stage of translation and go 1361 // directly to stage 2. This value is cached so we don't have to 1362 // compute it for every translation. 1363 stage2Req = hcr.vm && !isStage2 && !isHyp && !isSecure && 1364 !(tranType & S1CTran); 1365 directToStage2 = stage2Req && !sctlr.m; 1366 } else { 1367 vmid = 0; 1368 stage2Req = false; 1369 isHyp = false; 1370 directToStage2 = false; 1371 } 1372 } 1373 miscRegValid = true; 1374 miscRegContext = tc->contextId(); 1375 curTranType = tranType; 1376} 1377 1378Fault 1379TLB::getTE(TlbEntry **te, RequestPtr req, ThreadContext *tc, Mode mode, 1380 Translation *translation, bool timing, bool functional, 1381 bool is_secure, TLB::ArmTranslationType tranType) 1382{ 1383 bool is_fetch = (mode == Execute); 1384 bool is_write = (mode == Write); 1385 1386 Addr vaddr_tainted = req->getVaddr(); 1387 Addr vaddr = 0; 1388 ExceptionLevel target_el = aarch64 ? aarch64EL : EL1; 1389 if (aarch64) { 1390 vaddr = purifyTaggedAddr(vaddr_tainted, tc, target_el, ttbcr); 1391 } else { 1392 vaddr = vaddr_tainted; 1393 } 1394 *te = lookup(vaddr, asid, vmid, isHyp, is_secure, false, false, target_el); 1395 if (*te == NULL) { 1396 if (req->isPrefetch()) { 1397 // if the request is a prefetch don't attempt to fill the TLB or go 1398 // any further with the memory access (here we can safely use the 1399 // fault status for the short desc. format in all cases) 1400 prefetchFaults++; 1401 return std::make_shared<PrefetchAbort>( 1402 vaddr_tainted, ArmFault::PrefetchTLBMiss, isStage2); 1403 } 1404 1405 if (is_fetch) 1406 instMisses++; 1407 else if (is_write) 1408 writeMisses++; 1409 else 1410 readMisses++; 1411 1412 // start translation table walk, pass variables rather than 1413 // re-retreaving in table walker for speed 1414 DPRINTF(TLB, "TLB Miss: Starting hardware table walker for %#x(%d:%d)\n", 1415 vaddr_tainted, asid, vmid); 1416 Fault fault; 1417 fault = tableWalker->walk(req, tc, asid, vmid, isHyp, mode, 1418 translation, timing, functional, is_secure, 1419 tranType, stage2Req); 1420 // for timing mode, return and wait for table walk, 1421 if (timing || fault != NoFault) { 1422 return fault; 1423 } 1424 1425 *te = lookup(vaddr, asid, vmid, isHyp, is_secure, false, false, target_el); 1426 if (!*te) 1427 printTlb(); 1428 assert(*te); 1429 } else { 1430 if (is_fetch) 1431 instHits++; 1432 else if (is_write) 1433 writeHits++; 1434 else 1435 readHits++; 1436 } 1437 return NoFault; 1438} 1439 1440Fault 1441TLB::getResultTe(TlbEntry **te, RequestPtr req, ThreadContext *tc, Mode mode, 1442 Translation *translation, bool timing, bool functional, 1443 TlbEntry *mergeTe) 1444{ 1445 Fault fault; 1446 1447 if (isStage2) { 1448 // We are already in the stage 2 TLB. Grab the table entry for stage 1449 // 2 only. We are here because stage 1 translation is disabled. 1450 TlbEntry *s2Te = NULL; 1451 // Get the stage 2 table entry 1452 fault = getTE(&s2Te, req, tc, mode, translation, timing, functional, 1453 isSecure, curTranType); 1454 // Check permissions of stage 2 1455 if ((s2Te != NULL) && (fault = NoFault)) { 1456 if(aarch64) 1457 fault = checkPermissions64(s2Te, req, mode, tc); 1458 else 1459 fault = checkPermissions(s2Te, req, mode); 1460 } 1461 *te = s2Te; 1462 return fault; 1463 } 1464 1465 TlbEntry *s1Te = NULL; 1466 1467 Addr vaddr_tainted = req->getVaddr(); 1468 1469 // Get the stage 1 table entry 1470 fault = getTE(&s1Te, req, tc, mode, translation, timing, functional, 1471 isSecure, curTranType); 1472 // only proceed if we have a valid table entry 1473 if ((s1Te != NULL) && (fault == NoFault)) { 1474 // Check stage 1 permissions before checking stage 2 1475 if (aarch64) 1476 fault = checkPermissions64(s1Te, req, mode, tc); 1477 else 1478 fault = checkPermissions(s1Te, req, mode); 1479 if (stage2Req & (fault == NoFault)) { 1480 Stage2LookUp *s2Lookup = new Stage2LookUp(this, stage2Tlb, *s1Te, 1481 req, translation, mode, timing, functional, curTranType); 1482 fault = s2Lookup->getTe(tc, mergeTe); 1483 if (s2Lookup->isComplete()) { 1484 *te = mergeTe; 1485 // We've finished with the lookup so delete it 1486 delete s2Lookup; 1487 } else { 1488 // The lookup hasn't completed, so we can't delete it now. We 1489 // get round this by asking the object to self delete when the 1490 // translation is complete. 1491 s2Lookup->setSelfDelete(); 1492 } 1493 } else { 1494 // This case deals with an S1 hit (or bypass), followed by 1495 // an S2 hit-but-perms issue 1496 if (isStage2) { 1497 DPRINTF(TLBVerbose, "s2TLB: reqVa %#x, reqPa %#x, fault %p\n", 1498 vaddr_tainted, req->hasPaddr() ? req->getPaddr() : ~0, fault); 1499 if (fault != NoFault) { 1500 ArmFault *armFault = reinterpret_cast<ArmFault *>(fault.get()); 1501 armFault->annotate(ArmFault::S1PTW, false); 1502 armFault->annotate(ArmFault::OVA, vaddr_tainted); 1503 } 1504 } 1505 *te = s1Te; 1506 } 1507 } 1508 return fault; 1509} 1510 1511void 1512TLB::setTestInterface(SimObject *_ti) 1513{ 1514 if (!_ti) { 1515 test = nullptr; 1516 } else { 1517 TlbTestInterface *ti(dynamic_cast<TlbTestInterface *>(_ti)); 1518 fatal_if(!ti, "%s is not a valid ARM TLB tester\n", _ti->name()); 1519 test = ti; 1520 } 1521} 1522 1523Fault 1524TLB::testTranslation(RequestPtr req, Mode mode, TlbEntry::DomainType domain) 1525{ 1526 if (!test || !req->hasSize() || req->getSize() == 0) { 1527 return NoFault; 1528 } else { 1529 return test->translationCheck(req, isPriv, mode, domain); 1530 } 1531} 1532 1533Fault 1534TLB::testWalk(Addr pa, Addr size, Addr va, bool is_secure, Mode mode, 1535 TlbEntry::DomainType domain, LookupLevel lookup_level) 1536{ 1537 if (!test) { 1538 return NoFault; 1539 } else { 1540 return test->walkCheck(pa, size, va, is_secure, isPriv, mode, 1541 domain, lookup_level); 1542 } 1543} 1544 1545 1546ArmISA::TLB * 1547ArmTLBParams::create() 1548{ 1549 return new ArmISA::TLB(this); 1550}
|