tlb.cc (10024:fc10e1f9f124) tlb.cc (10037:5cac77888310)
1/*
1/*
2 * Copyright (c) 2010-2012 ARM Limited
2 * Copyright (c) 2010-2013 ARM Limited
3 * All rights reserved
4 *
5 * The license below extends only to copyright in the software and shall
6 * not be construed as granting a license to any other intellectual
7 * property including but not limited to intellectual property relating
8 * to a hardware implementation of the functionality of the software
9 * licensed hereunder. You may use the software subject to the license
10 * terms below provided that you ensure that this notice is replicated

--- 33 unchanged lines hidden (view full) ---

44
45#include <string>
46#include <vector>
47
48#include "arch/arm/faults.hh"
49#include "arch/arm/pagetable.hh"
50#include "arch/arm/system.hh"
51#include "arch/arm/table_walker.hh"
3 * All rights reserved
4 *
5 * The license below extends only to copyright in the software and shall
6 * not be construed as granting a license to any other intellectual
7 * property including but not limited to intellectual property relating
8 * to a hardware implementation of the functionality of the software
9 * licensed hereunder. You may use the software subject to the license
10 * terms below provided that you ensure that this notice is replicated

--- 33 unchanged lines hidden (view full) ---

44
45#include <string>
46#include <vector>
47
48#include "arch/arm/faults.hh"
49#include "arch/arm/pagetable.hh"
50#include "arch/arm/system.hh"
51#include "arch/arm/table_walker.hh"
52#include "arch/arm/stage2_lookup.hh"
53#include "arch/arm/stage2_mmu.hh"
52#include "arch/arm/tlb.hh"
53#include "arch/arm/utility.hh"
54#include "base/inifile.hh"
55#include "base/str.hh"
56#include "base/trace.hh"
57#include "cpu/base.hh"
58#include "cpu/thread_context.hh"
59#include "debug/Checkpoint.hh"
60#include "debug/TLB.hh"
61#include "debug/TLBVerbose.hh"
62#include "mem/page_table.hh"
63#include "params/ArmTLB.hh"
64#include "sim/full_system.hh"
65#include "sim/process.hh"
66
67using namespace std;
68using namespace ArmISA;
69
54#include "arch/arm/tlb.hh"
55#include "arch/arm/utility.hh"
56#include "base/inifile.hh"
57#include "base/str.hh"
58#include "base/trace.hh"
59#include "cpu/base.hh"
60#include "cpu/thread_context.hh"
61#include "debug/Checkpoint.hh"
62#include "debug/TLB.hh"
63#include "debug/TLBVerbose.hh"
64#include "mem/page_table.hh"
65#include "params/ArmTLB.hh"
66#include "sim/full_system.hh"
67#include "sim/process.hh"
68
69using namespace std;
70using namespace ArmISA;
71
70TLB::TLB(const Params *p)
71 : BaseTLB(p), size(p->size) , tableWalker(p->walker),
72 rangeMRU(1), bootUncacheability(false), miscRegValid(false)
72TLB::TLB(const ArmTLBParams *p)
73 : BaseTLB(p), table(new TlbEntry[p->size]), size(p->size),
74 isStage2(p->is_stage2), tableWalker(p->walker), stage2Tlb(NULL),
75 stage2Mmu(NULL), rangeMRU(1), bootUncacheability(false),
76 miscRegValid(false), curTranType(NormalTran)
73{
77{
74 table = new TlbEntry[size];
75 memset(table, 0, sizeof(TlbEntry) * size);
76
77 tableWalker->setTlb(this);
78 tableWalker->setTlb(this);
79
80 // Cache system-level properties
81 haveLPAE = tableWalker->haveLPAE();
82 haveVirtualization = tableWalker->haveVirtualization();
83 haveLargeAsid64 = tableWalker->haveLargeAsid64();
78}
79
80TLB::~TLB()
81{
84}
85
86TLB::~TLB()
87{
82 if (table)
83 delete [] table;
88 delete[] table;
84}
85
89}
90
91void
92TLB::init()
93{
94 if (stage2Mmu && !isStage2)
95 stage2Tlb = stage2Mmu->stage2Tlb();
96}
97
98void
99TLB::setMMU(Stage2MMU *m)
100{
101 stage2Mmu = m;
102 tableWalker->setMMU(m);
103}
104
86bool
87TLB::translateFunctional(ThreadContext *tc, Addr va, Addr &pa)
88{
105bool
106TLB::translateFunctional(ThreadContext *tc, Addr va, Addr &pa)
107{
89 if (!miscRegValid)
90 updateMiscReg(tc);
91 TlbEntry *e = lookup(va, contextId, true);
108 updateMiscReg(tc);
109
110 if (directToStage2) {
111 assert(stage2Tlb);
112 return stage2Tlb->translateFunctional(tc, va, pa);
113 }
114
115 TlbEntry *e = lookup(va, asid, vmid, isHyp, isSecure, true, false,
116 aarch64 ? aarch64EL : EL1);
92 if (!e)
93 return false;
94 pa = e->pAddr(va);
95 return true;
96}
97
98Fault
99TLB::finalizePhysical(RequestPtr req, ThreadContext *tc, Mode mode) const
100{
101 return NoFault;
102}
103
104TlbEntry*
117 if (!e)
118 return false;
119 pa = e->pAddr(va);
120 return true;
121}
122
123Fault
124TLB::finalizePhysical(RequestPtr req, ThreadContext *tc, Mode mode) const
125{
126 return NoFault;
127}
128
129TlbEntry*
105TLB::lookup(Addr va, uint8_t cid, bool functional)
130TLB::lookup(Addr va, uint16_t asn, uint8_t vmid, bool hyp, bool secure,
131 bool functional, bool ignore_asn, uint8_t target_el)
106{
107
108 TlbEntry *retval = NULL;
109
132{
133
134 TlbEntry *retval = NULL;
135
110 // Maitaining LRU array
111
136 // Maintaining LRU array
112 int x = 0;
113 while (retval == NULL && x < size) {
137 int x = 0;
138 while (retval == NULL && x < size) {
114 if (table[x].match(va, cid)) {
115
116 // We only move the hit entry ahead when the position is higher than rangeMRU
139 if ((!ignore_asn && table[x].match(va, asn, vmid, hyp, secure, false,
140 target_el)) ||
141 (ignore_asn && table[x].match(va, vmid, hyp, secure, target_el))) {
142 // We only move the hit entry ahead when the position is higher
143 // than rangeMRU
117 if (x > rangeMRU && !functional) {
118 TlbEntry tmp_entry = table[x];
119 for(int i = x; i > 0; i--)
144 if (x > rangeMRU && !functional) {
145 TlbEntry tmp_entry = table[x];
146 for(int i = x; i > 0; i--)
120 table[i] = table[i-1];
147 table[i] = table[i - 1];
121 table[0] = tmp_entry;
122 retval = &table[0];
123 } else {
124 retval = &table[x];
125 }
126 break;
127 }
148 table[0] = tmp_entry;
149 retval = &table[0];
150 } else {
151 retval = &table[x];
152 }
153 break;
154 }
128 x++;
155 ++x;
129 }
130
156 }
157
131 DPRINTF(TLBVerbose, "Lookup %#x, cid %#x -> %s ppn %#x size: %#x pa: %#x ap:%d\n",
132 va, cid, retval ? "hit" : "miss", retval ? retval->pfn : 0,
133 retval ? retval->size : 0, retval ? retval->pAddr(va) : 0,
134 retval ? retval->ap : 0);
135 ;
158 DPRINTF(TLBVerbose, "Lookup %#x, asn %#x -> %s vmn 0x%x hyp %d secure %d "
159 "ppn %#x size: %#x pa: %#x ap:%d ns:%d nstid:%d g:%d asid: %d "
160 "el: %d\n",
161 va, asn, retval ? "hit" : "miss", vmid, hyp, secure,
162 retval ? retval->pfn : 0, retval ? retval->size : 0,
163 retval ? retval->pAddr(va) : 0, retval ? retval->ap : 0,
164 retval ? retval->ns : 0, retval ? retval->nstid : 0,
165 retval ? retval->global : 0, retval ? retval->asid : 0,
166 retval ? retval->el : 0, retval ? retval->el : 0);
167
136 return retval;
137}
138
139// insert a new TLB entry
140void
141TLB::insert(Addr addr, TlbEntry &entry)
142{
143 DPRINTF(TLB, "Inserting entry into TLB with pfn:%#x size:%#x vpn: %#x"
168 return retval;
169}
170
171// insert a new TLB entry
172void
173TLB::insert(Addr addr, TlbEntry &entry)
174{
175 DPRINTF(TLB, "Inserting entry into TLB with pfn:%#x size:%#x vpn: %#x"
144 " asid:%d N:%d global:%d valid:%d nc:%d sNp:%d xn:%d ap:%#x"
145 " domain:%#x\n", entry.pfn, entry.size, entry.vpn, entry.asid,
146 entry.N, entry.global, entry.valid, entry.nonCacheable, entry.sNp,
147 entry.xn, entry.ap, entry.domain);
176 " asid:%d vmid:%d N:%d global:%d valid:%d nc:%d xn:%d"
177 " ap:%#x domain:%#x ns:%d nstid:%d isHyp:%d\n", entry.pfn,
178 entry.size, entry.vpn, entry.asid, entry.vmid, entry.N,
179 entry.global, entry.valid, entry.nonCacheable, entry.xn,
180 entry.ap, static_cast<uint8_t>(entry.domain), entry.ns, entry.nstid,
181 entry.isHyp);
148
182
149 if (table[size-1].valid)
150 DPRINTF(TLB, " - Replacing Valid entry %#x, asn %d ppn %#x size: %#x ap:%d\n",
183 if (table[size - 1].valid)
184 DPRINTF(TLB, " - Replacing Valid entry %#x, asn %d vmn %d ppn %#x "
185 "size: %#x ap:%d ns:%d nstid:%d g:%d isHyp:%d el: %d\n",
151 table[size-1].vpn << table[size-1].N, table[size-1].asid,
186 table[size-1].vpn << table[size-1].N, table[size-1].asid,
152 table[size-1].pfn << table[size-1].N, table[size-1].size,
153 table[size-1].ap);
187 table[size-1].vmid, table[size-1].pfn << table[size-1].N,
188 table[size-1].size, table[size-1].ap, table[size-1].ns,
189 table[size-1].nstid, table[size-1].global, table[size-1].isHyp,
190 table[size-1].el);
154
155 //inserting to MRU position and evicting the LRU one
156
191
192 //inserting to MRU position and evicting the LRU one
193
157 for(int i = size-1; i > 0; i--)
158 table[i] = table[i-1];
194 for (int i = size - 1; i > 0; --i)
195 table[i] = table[i-1];
159 table[0] = entry;
160
161 inserts++;
162}
163
164void
196 table[0] = entry;
197
198 inserts++;
199}
200
201void
165TLB::printTlb()
202TLB::printTlb() const
166{
167 int x = 0;
168 TlbEntry *te;
169 DPRINTF(TLB, "Current TLB contents:\n");
170 while (x < size) {
203{
204 int x = 0;
205 TlbEntry *te;
206 DPRINTF(TLB, "Current TLB contents:\n");
207 while (x < size) {
171 te = &table[x];
172 if (te->valid)
173 DPRINTF(TLB, " * %#x, asn %d ppn %#x size: %#x ap:%d\n",
174 te->vpn << te->N, te->asid, te->pfn << te->N, te->size, te->ap);
175 x++;
208 te = &table[x];
209 if (te->valid)
210 DPRINTF(TLB, " * %s\n", te->print());
211 ++x;
176 }
177}
178
212 }
213}
214
179
180void
215void
181TLB::flushAll()
216TLB::flushAllSecurity(bool secure_lookup, uint8_t target_el, bool ignore_el)
182{
217{
183 DPRINTF(TLB, "Flushing all TLB entries\n");
218 DPRINTF(TLB, "Flushing all TLB entries (%s lookup)\n",
219 (secure_lookup ? "secure" : "non-secure"));
184 int x = 0;
185 TlbEntry *te;
186 while (x < size) {
220 int x = 0;
221 TlbEntry *te;
222 while (x < size) {
187 te = &table[x];
188 if (te->valid) {
189 DPRINTF(TLB, " - %#x, asn %d ppn %#x size: %#x ap:%d\n",
190 te->vpn << te->N, te->asid, te->pfn << te->N, te->size, te->ap);
191 flushedEntries++;
192 }
193 x++;
223 te = &table[x];
224 if (te->valid && secure_lookup == !te->nstid &&
225 (te->vmid == vmid || secure_lookup) &&
226 checkELMatch(target_el, te->el, ignore_el)) {
227
228 DPRINTF(TLB, " - %s\n", te->print());
229 te->valid = false;
230 flushedEntries++;
231 }
232 ++x;
194 }
195
233 }
234
196 memset(table, 0, sizeof(TlbEntry) * size);
197
198 flushTlb++;
235 flushTlb++;
236
237 // If there's a second stage TLB (and we're not it) then flush it as well
238 // if we're currently in hyp mode
239 if (!isStage2 && isHyp) {
240 stage2Tlb->flushAllSecurity(secure_lookup, true);
241 }
199}
200
242}
243
201
202void
244void
203TLB::flushMvaAsid(Addr mva, uint64_t asn)
245TLB::flushAllNs(bool hyp, uint8_t target_el, bool ignore_el)
204{
246{
205 DPRINTF(TLB, "Flushing mva %#x asid: %#x\n", mva, asn);
247 DPRINTF(TLB, "Flushing all NS TLB entries (%s lookup)\n",
248 (hyp ? "hyp" : "non-hyp"));
249 int x = 0;
206 TlbEntry *te;
250 TlbEntry *te;
251 while (x < size) {
252 te = &table[x];
253 if (te->valid && te->nstid && te->isHyp == hyp &&
254 checkELMatch(target_el, te->el, ignore_el)) {
207
255
208 te = lookup(mva, asn);
209 while (te != NULL) {
210 DPRINTF(TLB, " - %#x, asn %d ppn %#x size: %#x ap:%d\n",
211 te->vpn << te->N, te->asid, te->pfn << te->N, te->size, te->ap);
212 te->valid = false;
213 flushedEntries++;
214 te = lookup(mva,asn);
256 DPRINTF(TLB, " - %s\n", te->print());
257 flushedEntries++;
258 te->valid = false;
259 }
260 ++x;
215 }
261 }
262
263 flushTlb++;
264
265 // If there's a second stage TLB (and we're not it) then flush it as well
266 if (!isStage2 && !hyp) {
267 stage2Tlb->flushAllNs(false, true);
268 }
269}
270
271void
272TLB::flushMvaAsid(Addr mva, uint64_t asn, bool secure_lookup, uint8_t target_el)
273{
274 DPRINTF(TLB, "Flushing TLB entries with mva: %#x, asid: %#x "
275 "(%s lookup)\n", mva, asn, (secure_lookup ?
276 "secure" : "non-secure"));
277 _flushMva(mva, asn, secure_lookup, false, false, target_el);
216 flushTlbMvaAsid++;
217}
218
219void
278 flushTlbMvaAsid++;
279}
280
281void
220TLB::flushAsid(uint64_t asn)
282TLB::flushAsid(uint64_t asn, bool secure_lookup, uint8_t target_el)
221{
283{
222 DPRINTF(TLB, "Flushing all entries with asid: %#x\n", asn);
284 DPRINTF(TLB, "Flushing TLB entries with asid: %#x (%s lookup)\n", asn,
285 (secure_lookup ? "secure" : "non-secure"));
223
286
224 int x = 0;
287 int x = 0 ;
225 TlbEntry *te;
226
227 while (x < size) {
228 te = &table[x];
288 TlbEntry *te;
289
290 while (x < size) {
291 te = &table[x];
229 if (te->asid == asn) {
292 if (te->valid && te->asid == asn && secure_lookup == !te->nstid &&
293 (te->vmid == vmid || secure_lookup) &&
294 checkELMatch(target_el, te->el, false)) {
295
230 te->valid = false;
296 te->valid = false;
231 DPRINTF(TLB, " - %#x, asn %d ppn %#x size: %#x ap:%d\n",
232 te->vpn << te->N, te->asid, te->pfn << te->N, te->size, te->ap);
297 DPRINTF(TLB, " - %s\n", te->print());
233 flushedEntries++;
234 }
298 flushedEntries++;
299 }
235 x++;
300 ++x;
236 }
237 flushTlbAsid++;
238}
239
240void
301 }
302 flushTlbAsid++;
303}
304
305void
241TLB::flushMva(Addr mva)
306TLB::flushMva(Addr mva, bool secure_lookup, bool hyp, uint8_t target_el)
242{
307{
243 DPRINTF(TLB, "Flushing all entries with mva: %#x\n", mva);
308 DPRINTF(TLB, "Flushing TLB entries with mva: %#x (%s lookup)\n", mva,
309 (secure_lookup ? "secure" : "non-secure"));
310 _flushMva(mva, 0xbeef, secure_lookup, hyp, true, target_el);
311 flushTlbMva++;
312}
244
313
245 int x = 0;
314void
315TLB::_flushMva(Addr mva, uint64_t asn, bool secure_lookup, bool hyp,
316 bool ignore_asn, uint8_t target_el)
317{
246 TlbEntry *te;
318 TlbEntry *te;
247
248 while (x < size) {
249 te = &table[x];
250 Addr v = te->vpn << te->N;
251 if (mva >= v && mva < v + te->size) {
319 // D5.7.2: Sign-extend address to 64 bits
320 mva = sext<56>(mva);
321 te = lookup(mva, asn, vmid, hyp, secure_lookup, false, ignore_asn,
322 target_el);
323 while (te != NULL) {
324 if (secure_lookup == !te->nstid) {
325 DPRINTF(TLB, " - %s\n", te->print());
252 te->valid = false;
326 te->valid = false;
253 DPRINTF(TLB, " - %#x, asn %d ppn %#x size: %#x ap:%d\n",
254 te->vpn << te->N, te->asid, te->pfn << te->N, te->size, te->ap);
255 flushedEntries++;
256 }
327 flushedEntries++;
328 }
257 x++;
329 te = lookup(mva, asn, vmid, hyp, secure_lookup, false, ignore_asn,
330 target_el);
258 }
331 }
259 flushTlbMva++;
260}
261
332}
333
334bool
335TLB::checkELMatch(uint8_t target_el, uint8_t tentry_el, bool ignore_el)
336{
337 bool elMatch = true;
338 if (!ignore_el) {
339 if (target_el == 2 || target_el == 3) {
340 elMatch = (tentry_el == target_el);
341 } else {
342 elMatch = (tentry_el == 0) || (tentry_el == 1);
343 }
344 }
345 return elMatch;
346}
347
262void
263TLB::drainResume()
264{
265 // We might have unserialized something or switched CPUs, so make
266 // sure to re-read the misc regs.
267 miscRegValid = false;
268}
269
270void
271TLB::serialize(ostream &os)
272{
273 DPRINTF(Checkpoint, "Serializing Arm TLB\n");
274
275 SERIALIZE_SCALAR(_attr);
348void
349TLB::drainResume()
350{
351 // We might have unserialized something or switched CPUs, so make
352 // sure to re-read the misc regs.
353 miscRegValid = false;
354}
355
356void
357TLB::serialize(ostream &os)
358{
359 DPRINTF(Checkpoint, "Serializing Arm TLB\n");
360
361 SERIALIZE_SCALAR(_attr);
362 SERIALIZE_SCALAR(haveLPAE);
363 SERIALIZE_SCALAR(directToStage2);
364 SERIALIZE_SCALAR(stage2Req);
365 SERIALIZE_SCALAR(bootUncacheability);
276
277 int num_entries = size;
278 SERIALIZE_SCALAR(num_entries);
279 for(int i = 0; i < size; i++){
280 nameOut(os, csprintf("%s.TlbEntry%d", name(), i));
281 table[i].serialize(os);
282 }
283}
284
285void
286TLB::unserialize(Checkpoint *cp, const string &section)
287{
288 DPRINTF(Checkpoint, "Unserializing Arm TLB\n");
289
290 UNSERIALIZE_SCALAR(_attr);
366
367 int num_entries = size;
368 SERIALIZE_SCALAR(num_entries);
369 for(int i = 0; i < size; i++){
370 nameOut(os, csprintf("%s.TlbEntry%d", name(), i));
371 table[i].serialize(os);
372 }
373}
374
375void
376TLB::unserialize(Checkpoint *cp, const string &section)
377{
378 DPRINTF(Checkpoint, "Unserializing Arm TLB\n");
379
380 UNSERIALIZE_SCALAR(_attr);
381 UNSERIALIZE_SCALAR(haveLPAE);
382 UNSERIALIZE_SCALAR(directToStage2);
383 UNSERIALIZE_SCALAR(stage2Req);
384 UNSERIALIZE_SCALAR(bootUncacheability);
385
291 int num_entries;
292 UNSERIALIZE_SCALAR(num_entries);
293 for(int i = 0; i < min(size, num_entries); i++){
294 table[i].unserialize(cp, csprintf("%s.TlbEntry%d", section, i));
295 }
296}
297
298void

--- 109 unchanged lines hidden (view full) ---

408 writeAccesses = writeHits + writeMisses;
409 hits = readHits + writeHits + instHits;
410 misses = readMisses + writeMisses + instMisses;
411 accesses = readAccesses + writeAccesses + instAccesses;
412}
413
414Fault
415TLB::translateSe(RequestPtr req, ThreadContext *tc, Mode mode,
386 int num_entries;
387 UNSERIALIZE_SCALAR(num_entries);
388 for(int i = 0; i < min(size, num_entries); i++){
389 table[i].unserialize(cp, csprintf("%s.TlbEntry%d", section, i));
390 }
391}
392
393void

--- 109 unchanged lines hidden (view full) ---

503 writeAccesses = writeHits + writeMisses;
504 hits = readHits + writeHits + instHits;
505 misses = readMisses + writeMisses + instMisses;
506 accesses = readAccesses + writeAccesses + instAccesses;
507}
508
509Fault
510TLB::translateSe(RequestPtr req, ThreadContext *tc, Mode mode,
416 Translation *translation, bool &delay, bool timing)
511 Translation *translation, bool &delay, bool timing)
417{
512{
418 if (!miscRegValid)
419 updateMiscReg(tc);
420 Addr vaddr = req->getVaddr();
513 updateMiscReg(tc);
514 Addr vaddr_tainted = req->getVaddr();
515 Addr vaddr = 0;
516 if (aarch64)
517 vaddr = purifyTaggedAddr(vaddr_tainted, tc, aarch64EL);
518 else
519 vaddr = vaddr_tainted;
421 uint32_t flags = req->getFlags();
422
423 bool is_fetch = (mode == Execute);
424 bool is_write = (mode == Write);
425
426 if (!is_fetch) {
427 assert(flags & MustBeOne);
428 if (sctlr.a || !(flags & AllowUnaligned)) {
520 uint32_t flags = req->getFlags();
521
522 bool is_fetch = (mode == Execute);
523 bool is_write = (mode == Write);
524
525 if (!is_fetch) {
526 assert(flags & MustBeOne);
527 if (sctlr.a || !(flags & AllowUnaligned)) {
429 if (vaddr & flags & AlignmentMask) {
430 return new DataAbort(vaddr, 0, is_write, ArmFault::AlignmentFault);
528 if (vaddr & mask(flags & AlignmentMask)) {
529 // LPAE is always disabled in SE mode
530 return new DataAbort(vaddr_tainted,
531 TlbEntry::DomainType::NoAccess, is_write,
532 ArmFault::AlignmentFault, isStage2,
533 ArmFault::VmsaTran);
431 }
432 }
433 }
434
435 Addr paddr;
436 Process *p = tc->getProcessPtr();
437
438 if (!p->pTable->translate(vaddr, paddr))
534 }
535 }
536 }
537
538 Addr paddr;
539 Process *p = tc->getProcessPtr();
540
541 if (!p->pTable->translate(vaddr, paddr))
439 return Fault(new GenericPageTableFault(vaddr));
542 return Fault(new GenericPageTableFault(vaddr_tainted));
440 req->setPaddr(paddr);
441
442 return NoFault;
443}
444
445Fault
543 req->setPaddr(paddr);
544
545 return NoFault;
546}
547
548Fault
446TLB::trickBoxCheck(RequestPtr req, Mode mode, uint8_t domain, bool sNp)
549TLB::trickBoxCheck(RequestPtr req, Mode mode, TlbEntry::DomainType domain)
447{
448 return NoFault;
449}
450
451Fault
550{
551 return NoFault;
552}
553
554Fault
452TLB::walkTrickBoxCheck(Addr pa, Addr va, Addr sz, bool is_exec,
453 bool is_write, uint8_t domain, bool sNp)
555TLB::walkTrickBoxCheck(Addr pa, bool is_secure, Addr va, Addr sz, bool is_exec,
556 bool is_write, TlbEntry::DomainType domain, LookupLevel lookup_level)
454{
455 return NoFault;
456}
457
458Fault
557{
558 return NoFault;
559}
560
561Fault
562TLB::checkPermissions(TlbEntry *te, RequestPtr req, Mode mode)
563{
564 Addr vaddr = req->getVaddr(); // 32-bit don't have to purify
565 uint32_t flags = req->getFlags();
566 bool is_fetch = (mode == Execute);
567 bool is_write = (mode == Write);
568 bool is_priv = isPriv && !(flags & UserMode);
569
570 // Get the translation type from the actuall table entry
571 ArmFault::TranMethod tranMethod = te->longDescFormat ? ArmFault::LpaeTran
572 : ArmFault::VmsaTran;
573
574 // If this is the second stage of translation and the request is for a
575 // stage 1 page table walk then we need to check the HCR.PTW bit. This
576 // allows us to generate a fault if the request targets an area marked
577 // as a device or strongly ordered.
578 if (isStage2 && req->isPTWalk() && hcr.ptw &&
579 (te->mtype != TlbEntry::MemoryType::Normal)) {
580 return new DataAbort(vaddr, te->domain, is_write,
581 ArmFault::PermissionLL + te->lookupLevel,
582 isStage2, tranMethod);
583 }
584
585 // Generate an alignment fault for unaligned data accesses to device or
586 // strongly ordered memory
587 if (!is_fetch) {
588 if (te->mtype != TlbEntry::MemoryType::Normal) {
589 if (vaddr & mask(flags & AlignmentMask)) {
590 alignFaults++;
591 return new DataAbort(vaddr, TlbEntry::DomainType::NoAccess, is_write,
592 ArmFault::AlignmentFault, isStage2,
593 tranMethod);
594 }
595 }
596 }
597
598 if (te->nonCacheable) {
599 // Prevent prefetching from I/O devices.
600 if (req->isPrefetch()) {
601 // Here we can safely use the fault status for the short
602 // desc. format in all cases
603 return new PrefetchAbort(vaddr, ArmFault::PrefetchUncacheable,
604 isStage2, tranMethod);
605 }
606 }
607
608 if (!te->longDescFormat) {
609 switch ((dacr >> (static_cast<uint8_t>(te->domain) * 2)) & 0x3) {
610 case 0:
611 domainFaults++;
612 DPRINTF(TLB, "TLB Fault: Data abort on domain. DACR: %#x"
613 " domain: %#x write:%d\n", dacr,
614 static_cast<uint8_t>(te->domain), is_write);
615 if (is_fetch)
616 return new PrefetchAbort(vaddr,
617 ArmFault::DomainLL + te->lookupLevel,
618 isStage2, tranMethod);
619 else
620 return new DataAbort(vaddr, te->domain, is_write,
621 ArmFault::DomainLL + te->lookupLevel,
622 isStage2, tranMethod);
623 case 1:
624 // Continue with permissions check
625 break;
626 case 2:
627 panic("UNPRED domain\n");
628 case 3:
629 return NoFault;
630 }
631 }
632
633 // The 'ap' variable is AP[2:0] or {AP[2,1],1b'0}, i.e. always three bits
634 uint8_t ap = te->longDescFormat ? te->ap << 1 : te->ap;
635 uint8_t hap = te->hap;
636
637 if (sctlr.afe == 1 || te->longDescFormat)
638 ap |= 1;
639
640 bool abt;
641 bool isWritable = true;
642 // If this is a stage 2 access (eg for reading stage 1 page table entries)
643 // then don't perform the AP permissions check, we stil do the HAP check
644 // below.
645 if (isStage2) {
646 abt = false;
647 } else {
648 switch (ap) {
649 case 0:
650 DPRINTF(TLB, "Access permissions 0, checking rs:%#x\n",
651 (int)sctlr.rs);
652 if (!sctlr.xp) {
653 switch ((int)sctlr.rs) {
654 case 2:
655 abt = is_write;
656 break;
657 case 1:
658 abt = is_write || !is_priv;
659 break;
660 case 0:
661 case 3:
662 default:
663 abt = true;
664 break;
665 }
666 } else {
667 abt = true;
668 }
669 break;
670 case 1:
671 abt = !is_priv;
672 break;
673 case 2:
674 abt = !is_priv && is_write;
675 isWritable = is_priv;
676 break;
677 case 3:
678 abt = false;
679 break;
680 case 4:
681 panic("UNPRED premissions\n");
682 case 5:
683 abt = !is_priv || is_write;
684 isWritable = false;
685 break;
686 case 6:
687 case 7:
688 abt = is_write;
689 isWritable = false;
690 break;
691 default:
692 panic("Unknown permissions %#x\n", ap);
693 }
694 }
695
696 bool hapAbt = is_write ? !(hap & 2) : !(hap & 1);
697 bool xn = te->xn || (isWritable && sctlr.wxn) ||
698 (ap == 3 && sctlr.uwxn && is_priv);
699 if (is_fetch && (abt || xn ||
700 (te->longDescFormat && te->pxn && !is_priv) ||
701 (isSecure && te->ns && scr.sif))) {
702 permsFaults++;
703 DPRINTF(TLB, "TLB Fault: Prefetch abort on permission check. AP:%d "
704 "priv:%d write:%d ns:%d sif:%d sctlr.afe: %d \n",
705 ap, is_priv, is_write, te->ns, scr.sif,sctlr.afe);
706 return new PrefetchAbort(vaddr,
707 ArmFault::PermissionLL + te->lookupLevel,
708 isStage2, tranMethod);
709 } else if (abt | hapAbt) {
710 permsFaults++;
711 DPRINTF(TLB, "TLB Fault: Data abort on permission check. AP:%d priv:%d"
712 " write:%d\n", ap, is_priv, is_write);
713 return new DataAbort(vaddr, te->domain, is_write,
714 ArmFault::PermissionLL + te->lookupLevel,
715 isStage2 | !abt, tranMethod);
716 }
717 return NoFault;
718}
719
720
721Fault
722TLB::checkPermissions64(TlbEntry *te, RequestPtr req, Mode mode,
723 ThreadContext *tc)
724{
725 assert(aarch64);
726
727 Addr vaddr_tainted = req->getVaddr();
728 Addr vaddr = purifyTaggedAddr(vaddr_tainted, tc, aarch64EL);
729
730 uint32_t flags = req->getFlags();
731 bool is_fetch = (mode == Execute);
732 bool is_write = (mode == Write);
733 bool is_priv M5_VAR_USED = isPriv && !(flags & UserMode);
734
735 updateMiscReg(tc, curTranType);
736
737 // If this is the second stage of translation and the request is for a
738 // stage 1 page table walk then we need to check the HCR.PTW bit. This
739 // allows us to generate a fault if the request targets an area marked
740 // as a device or strongly ordered.
741 if (isStage2 && req->isPTWalk() && hcr.ptw &&
742 (te->mtype != TlbEntry::MemoryType::Normal)) {
743 return new DataAbort(vaddr_tainted, te->domain, is_write,
744 ArmFault::PermissionLL + te->lookupLevel,
745 isStage2, ArmFault::LpaeTran);
746 }
747
748 // Generate an alignment fault for unaligned accesses to device or
749 // strongly ordered memory
750 if (!is_fetch) {
751 if (te->mtype != TlbEntry::MemoryType::Normal) {
752 if (vaddr & mask(flags & AlignmentMask)) {
753 alignFaults++;
754 return new DataAbort(vaddr_tainted,
755 TlbEntry::DomainType::NoAccess, is_write,
756 ArmFault::AlignmentFault, isStage2,
757 ArmFault::LpaeTran);
758 }
759 }
760 }
761
762 if (te->nonCacheable) {
763 // Prevent prefetching from I/O devices.
764 if (req->isPrefetch()) {
765 // Here we can safely use the fault status for the short
766 // desc. format in all cases
767 return new PrefetchAbort(vaddr_tainted,
768 ArmFault::PrefetchUncacheable,
769 isStage2, ArmFault::LpaeTran);
770 }
771 }
772
773 uint8_t ap = 0x3 & (te->ap); // 2-bit access protection field
774 bool grant = false;
775
776 uint8_t xn = te->xn;
777 uint8_t pxn = te->pxn;
778 bool r = !is_write && !is_fetch;
779 bool w = is_write;
780 bool x = is_fetch;
781 DPRINTF(TLBVerbose, "Checking permissions: ap:%d, xn:%d, pxn:%d, r:%d, "
782 "w:%d, x:%d\n", ap, xn, pxn, r, w, x);
783
784 if (isStage2) {
785 panic("Virtualization in AArch64 state is not supported yet");
786 } else {
787 switch (aarch64EL) {
788 case EL0:
789 {
790 uint8_t perm = (ap << 2) | (xn << 1) | pxn;
791 switch (perm) {
792 case 0:
793 case 1:
794 case 8:
795 case 9:
796 grant = x;
797 break;
798 case 4:
799 case 5:
800 grant = r || w || (x && !sctlr.wxn);
801 break;
802 case 6:
803 case 7:
804 grant = r || w;
805 break;
806 case 12:
807 case 13:
808 grant = r || x;
809 break;
810 case 14:
811 case 15:
812 grant = r;
813 break;
814 default:
815 grant = false;
816 }
817 }
818 break;
819 case EL1:
820 {
821 uint8_t perm = (ap << 2) | (xn << 1) | pxn;
822 switch (perm) {
823 case 0:
824 case 2:
825 grant = r || w || (x && !sctlr.wxn);
826 break;
827 case 1:
828 case 3:
829 case 4:
830 case 5:
831 case 6:
832 case 7:
833 // regions that are writeable at EL0 should not be
834 // executable at EL1
835 grant = r || w;
836 break;
837 case 8:
838 case 10:
839 case 12:
840 case 14:
841 grant = r || x;
842 break;
843 case 9:
844 case 11:
845 case 13:
846 case 15:
847 grant = r;
848 break;
849 default:
850 grant = false;
851 }
852 }
853 break;
854 case EL2:
855 case EL3:
856 {
857 uint8_t perm = (ap & 0x2) | xn;
858 switch (perm) {
859 case 0:
860 grant = r || w || (x && !sctlr.wxn) ;
861 break;
862 case 1:
863 grant = r || w;
864 break;
865 case 2:
866 grant = r || x;
867 break;
868 case 3:
869 grant = r;
870 break;
871 default:
872 grant = false;
873 }
874 }
875 break;
876 }
877 }
878
879 if (!grant) {
880 if (is_fetch) {
881 permsFaults++;
882 DPRINTF(TLB, "TLB Fault: Prefetch abort on permission check. "
883 "AP:%d priv:%d write:%d ns:%d sif:%d "
884 "sctlr.afe: %d\n",
885 ap, is_priv, is_write, te->ns, scr.sif, sctlr.afe);
886 // Use PC value instead of vaddr because vaddr might be aligned to
887 // cache line and should not be the address reported in FAR
888 return new PrefetchAbort(req->getPC(),
889 ArmFault::PermissionLL + te->lookupLevel,
890 isStage2, ArmFault::LpaeTran);
891 } else {
892 permsFaults++;
893 DPRINTF(TLB, "TLB Fault: Data abort on permission check. AP:%d "
894 "priv:%d write:%d\n", ap, is_priv, is_write);
895 return new DataAbort(vaddr_tainted, te->domain, is_write,
896 ArmFault::PermissionLL + te->lookupLevel,
897 isStage2, ArmFault::LpaeTran);
898 }
899 }
900
901 return NoFault;
902}
903
904Fault
459TLB::translateFs(RequestPtr req, ThreadContext *tc, Mode mode,
905TLB::translateFs(RequestPtr req, ThreadContext *tc, Mode mode,
460 Translation *translation, bool &delay, bool timing, bool functional)
906 Translation *translation, bool &delay, bool timing,
907 TLB::ArmTranslationType tranType, bool functional)
461{
462 // No such thing as a functional timing access
463 assert(!(timing && functional));
464
908{
909 // No such thing as a functional timing access
910 assert(!(timing && functional));
911
465 if (!miscRegValid) {
466 updateMiscReg(tc);
467 DPRINTF(TLBVerbose, "TLB variables changed!\n");
468 }
912 updateMiscReg(tc, tranType);
469
913
470 Addr vaddr = req->getVaddr();
914 Addr vaddr_tainted = req->getVaddr();
915 Addr vaddr = 0;
916 if (aarch64)
917 vaddr = purifyTaggedAddr(vaddr_tainted, tc, aarch64EL);
918 else
919 vaddr = vaddr_tainted;
471 uint32_t flags = req->getFlags();
472
920 uint32_t flags = req->getFlags();
921
473 bool is_fetch = (mode == Execute);
474 bool is_write = (mode == Write);
475 bool is_priv = isPriv && !(flags & UserMode);
922 bool is_fetch = (mode == Execute);
923 bool is_write = (mode == Write);
924 bool long_desc_format = aarch64 || (haveLPAE && ttbcr.eae);
925 ArmFault::TranMethod tranMethod = long_desc_format ? ArmFault::LpaeTran
926 : ArmFault::VmsaTran;
476
927
477 req->setAsid(contextId.asid);
478 if (is_priv)
479 req->setFlags(Request::PRIVILEGED);
928 req->setAsid(asid);
480
929
481 req->taskId(tc->getCpuPtr()->taskId());
930 DPRINTF(TLBVerbose, "CPSR is priv:%d UserMode:%d secure:%d S1S2NsTran:%d\n",
931 isPriv, flags & UserMode, isSecure, tranType & S1S2NsTran);
482
932
483 DPRINTF(TLBVerbose, "CPSR is priv:%d UserMode:%d\n",
484 isPriv, flags & UserMode);
933 DPRINTF(TLB, "translateFs addr %#x, mode %d, st2 %d, scr %#x sctlr %#x "
934 "flags %#x tranType 0x%x\n", vaddr_tainted, mode, isStage2,
935 scr, sctlr, flags, tranType);
936
937 // Generate an alignment fault for unaligned PC
938 if (aarch64 && is_fetch && (req->getPC() & mask(2))) {
939 return new PCAlignmentFault(req->getPC());
940 }
941
485 // If this is a clrex instruction, provide a PA of 0 with no fault
486 // This will force the monitor to set the tracked address to 0
487 // a bit of a hack but this effectively clrears this processors monitor
488 if (flags & Request::CLEAR_LL){
942 // If this is a clrex instruction, provide a PA of 0 with no fault
943 // This will force the monitor to set the tracked address to 0
944 // a bit of a hack but this effectively clrears this processors monitor
945 if (flags & Request::CLEAR_LL){
946 // @todo: check implications of security extensions
489 req->setPaddr(0);
490 req->setFlags(Request::UNCACHEABLE);
491 req->setFlags(Request::CLEAR_LL);
492 return NoFault;
493 }
494 if ((req->isInstFetch() && (!sctlr.i)) ||
495 ((!req->isInstFetch()) && (!sctlr.c))){
496 req->setFlags(Request::UNCACHEABLE);
497 }
498 if (!is_fetch) {
499 assert(flags & MustBeOne);
500 if (sctlr.a || !(flags & AllowUnaligned)) {
947 req->setPaddr(0);
948 req->setFlags(Request::UNCACHEABLE);
949 req->setFlags(Request::CLEAR_LL);
950 return NoFault;
951 }
952 if ((req->isInstFetch() && (!sctlr.i)) ||
953 ((!req->isInstFetch()) && (!sctlr.c))){
954 req->setFlags(Request::UNCACHEABLE);
955 }
956 if (!is_fetch) {
957 assert(flags & MustBeOne);
958 if (sctlr.a || !(flags & AllowUnaligned)) {
501 if (vaddr & flags & AlignmentMask) {
959 if (vaddr & mask(flags & AlignmentMask)) {
502 alignFaults++;
960 alignFaults++;
503 return new DataAbort(vaddr, 0, is_write, ArmFault::AlignmentFault);
961 return new DataAbort(vaddr_tainted,
962 TlbEntry::DomainType::NoAccess, is_write,
963 ArmFault::AlignmentFault, isStage2,
964 tranMethod);
504 }
505 }
506 }
507
965 }
966 }
967 }
968
508 Fault fault;
969 // If guest MMU is off or hcr.vm=0 go straight to stage2
970 if ((isStage2 && !hcr.vm) || (!isStage2 && !sctlr.m)) {
509
971
510 if (!sctlr.m) {
511 req->setPaddr(vaddr);
972 req->setPaddr(vaddr);
512 if (sctlr.tre == 0) {
973 // When the MMU is off the security attribute corresponds to the
974 // security state of the processor
975 if (isSecure)
976 req->setFlags(Request::SECURE);
977
978 // @todo: double check this (ARM ARM issue C B3.2.1)
979 if (long_desc_format || sctlr.tre == 0) {
513 req->setFlags(Request::UNCACHEABLE);
514 } else {
515 if (nmrr.ir0 == 0 || nmrr.or0 == 0 || prrr.tr0 != 0x2)
980 req->setFlags(Request::UNCACHEABLE);
981 } else {
982 if (nmrr.ir0 == 0 || nmrr.or0 == 0 || prrr.tr0 != 0x2)
516 req->setFlags(Request::UNCACHEABLE);
983 req->setFlags(Request::UNCACHEABLE);
517 }
518
519 // Set memory attributes
520 TlbEntry temp_te;
984 }
985
986 // Set memory attributes
987 TlbEntry temp_te;
521 tableWalker->memAttrs(tc, temp_te, sctlr, 0, 1);
522 temp_te.shareable = true;
988 temp_te.ns = !isSecure;
989 if (isStage2 || hcr.dc == 0 || isSecure ||
990 (isHyp && !(tranType & S1CTran))) {
991
992 temp_te.mtype = is_fetch ? TlbEntry::MemoryType::Normal
993 : TlbEntry::MemoryType::StronglyOrdered;
994 temp_te.innerAttrs = 0x0;
995 temp_te.outerAttrs = 0x0;
996 temp_te.shareable = true;
997 temp_te.outerShareable = true;
998 } else {
999 temp_te.mtype = TlbEntry::MemoryType::Normal;
1000 temp_te.innerAttrs = 0x3;
1001 temp_te.outerAttrs = 0x3;
1002 temp_te.shareable = false;
1003 temp_te.outerShareable = false;
1004 }
1005 temp_te.setAttributes(long_desc_format);
523 DPRINTF(TLBVerbose, "(No MMU) setting memory attributes: shareable:\
1006 DPRINTF(TLBVerbose, "(No MMU) setting memory attributes: shareable:\
524 %d, innerAttrs: %d, outerAttrs: %d\n", temp_te.shareable,
525 temp_te.innerAttrs, temp_te.outerAttrs);
1007 %d, innerAttrs: %d, outerAttrs: %d, isStage2: %d\n",
1008 temp_te.shareable, temp_te.innerAttrs, temp_te.outerAttrs,
1009 isStage2);
526 setAttr(temp_te.attributes);
527
1010 setAttr(temp_te.attributes);
1011
528 return trickBoxCheck(req, mode, 0, false);
1012 return trickBoxCheck(req, mode, TlbEntry::DomainType::NoAccess);
529 }
530
1013 }
1014
531 DPRINTF(TLBVerbose, "Translating vaddr=%#x context=%d\n", vaddr, contextId);
1015 DPRINTF(TLBVerbose, "Translating %s=%#x context=%d\n",
1016 isStage2 ? "IPA" : "VA", vaddr_tainted, asid);
532 // Translation enabled
533
1017 // Translation enabled
1018
534 TlbEntry *te = lookup(vaddr, contextId);
535 if (te == NULL) {
536 if (req->isPrefetch()){
537 //if the request is a prefetch don't attempt to fill the TLB
538 //or go any further with the memory access
539 prefetchFaults++;
540 return new PrefetchAbort(vaddr, ArmFault::PrefetchTLBMiss);
1019 TlbEntry *te = NULL;
1020 TlbEntry mergeTe;
1021 Fault fault = getResultTe(&te, req, tc, mode, translation, timing,
1022 functional, &mergeTe);
1023 // only proceed if we have a valid table entry
1024 if ((te == NULL) && (fault == NoFault)) delay = true;
1025
1026 // If we have the table entry transfer some of the attributes to the
1027 // request that triggered the translation
1028 if (te != NULL) {
1029 // Set memory attributes
1030 DPRINTF(TLBVerbose,
1031 "Setting memory attributes: shareable: %d, innerAttrs: %d, \
1032 outerAttrs: %d, mtype: %d, isStage2: %d\n",
1033 te->shareable, te->innerAttrs, te->outerAttrs,
1034 static_cast<uint8_t>(te->mtype), isStage2);
1035 setAttr(te->attributes);
1036 if (te->nonCacheable) {
1037 req->setFlags(Request::UNCACHEABLE);
541 }
542
1038 }
1039
543 if (is_fetch)
544 instMisses++;
545 else if (is_write)
546 writeMisses++;
547 else
548 readMisses++;
1040 if (!bootUncacheability &&
1041 ((ArmSystem*)tc->getSystemPtr())->adderBootUncacheable(vaddr)) {
1042 req->setFlags(Request::UNCACHEABLE);
1043 }
549
1044
550 // start translation table walk, pass variables rather than
551 // re-retreaving in table walker for speed
552 DPRINTF(TLB, "TLB Miss: Starting hardware table walker for %#x(%d)\n",
553 vaddr, contextId);
554 fault = tableWalker->walk(req, tc, contextId, mode, translation,
555 timing, functional);
556 if (timing && fault == NoFault) {
557 delay = true;
558 // for timing mode, return and wait for table walk
559 return fault;
1045 req->setPaddr(te->pAddr(vaddr));
1046 if (isSecure && !te->ns) {
1047 req->setFlags(Request::SECURE);
560 }
1048 }
561 if (fault)
562 return fault;
1049 if ((!is_fetch) && (vaddr & mask(flags & AlignmentMask)) &&
1050 (te->mtype != TlbEntry::MemoryType::Normal)) {
1051 // Unaligned accesses to Device memory should always cause an
1052 // abort regardless of sctlr.a
1053 alignFaults++;
1054 return new DataAbort(vaddr_tainted,
1055 TlbEntry::DomainType::NoAccess, is_write,
1056 ArmFault::AlignmentFault, isStage2,
1057 tranMethod);
1058 }
563
1059
564 te = lookup(vaddr, contextId);
565 if (!te)
566 printTlb();
567 assert(te);
568 } else {
569 if (is_fetch)
570 instHits++;
571 else if (is_write)
572 writeHits++;
573 else
574 readHits++;
575 }
576
577 // Set memory attributes
578 DPRINTF(TLBVerbose,
579 "Setting memory attributes: shareable: %d, innerAttrs: %d, \
580 outerAttrs: %d\n",
581 te->shareable, te->innerAttrs, te->outerAttrs);
582 setAttr(te->attributes);
583 if (te->nonCacheable) {
584 req->setFlags(Request::UNCACHEABLE);
585
586 // Prevent prefetching from I/O devices.
587 if (req->isPrefetch()) {
588 return new PrefetchAbort(vaddr, ArmFault::PrefetchUncacheable);
1060 // Check for a trickbox generated address fault
1061 if (fault == NoFault) {
1062 fault = trickBoxCheck(req, mode, te->domain);
589 }
590 }
591
1063 }
1064 }
1065
592 if (!bootUncacheability &&
593 ((ArmSystem*)tc->getSystemPtr())->adderBootUncacheable(vaddr))
594 req->setFlags(Request::UNCACHEABLE);
595
596 switch ( (dacr >> (te->domain * 2)) & 0x3) {
597 case 0:
598 domainFaults++;
599 DPRINTF(TLB, "TLB Fault: Data abort on domain. DACR: %#x domain: %#x"
600 " write:%d sNp:%d\n", dacr, te->domain, is_write, te->sNp);
601 if (is_fetch)
602 return new PrefetchAbort(vaddr,
603 (te->sNp ? ArmFault::Domain0 : ArmFault::Domain1));
604 else
605 return new DataAbort(vaddr, te->domain, is_write,
606 (te->sNp ? ArmFault::Domain0 : ArmFault::Domain1));
607 case 1:
608 // Continue with permissions check
609 break;
610 case 2:
611 panic("UNPRED domain\n");
612 case 3:
613 req->setPaddr(te->pAddr(vaddr));
614 fault = trickBoxCheck(req, mode, te->domain, te->sNp);
615 if (fault)
616 return fault;
617 return NoFault;
618 }
619
620 uint8_t ap = te->ap;
621
622 if (sctlr.afe == 1)
623 ap |= 1;
624
625 bool abt;
626
627 /* if (!sctlr.xp)
628 ap &= 0x3;
629*/
630 switch (ap) {
631 case 0:
632 DPRINTF(TLB, "Access permissions 0, checking rs:%#x\n", (int)sctlr.rs);
633 if (!sctlr.xp) {
634 switch ((int)sctlr.rs) {
635 case 2:
636 abt = is_write;
637 break;
638 case 1:
639 abt = is_write || !is_priv;
640 break;
641 case 0:
642 case 3:
643 default:
644 abt = true;
645 break;
646 }
647 } else {
648 abt = true;
1066 // Generate Illegal Inst Set State fault if IL bit is set in CPSR
1067 if (fault == NoFault) {
1068 CPSR cpsr = tc->readMiscReg(MISCREG_CPSR);
1069 if (aarch64 && is_fetch && cpsr.il == 1) {
1070 return new IllegalInstSetStateFault();
649 }
1071 }
650 break;
651 case 1:
652 abt = !is_priv;
653 break;
654 case 2:
655 abt = !is_priv && is_write;
656 break;
657 case 3:
658 abt = false;
659 break;
660 case 4:
661 panic("UNPRED premissions\n");
662 case 5:
663 abt = !is_priv || is_write;
664 break;
665 case 6:
666 case 7:
667 abt = is_write;
668 break;
669 default:
670 panic("Unknown permissions\n");
671 }
1072 }
672 if ((is_fetch) && (abt || te->xn)) {
673 permsFaults++;
674 DPRINTF(TLB, "TLB Fault: Prefetch abort on permission check. AP:%d priv:%d"
675 " write:%d sNp:%d\n", ap, is_priv, is_write, te->sNp);
676 return new PrefetchAbort(vaddr,
677 (te->sNp ? ArmFault::Permission0 :
678 ArmFault::Permission1));
679 } else if (abt) {
680 permsFaults++;
681 DPRINTF(TLB, "TLB Fault: Data abort on permission check. AP:%d priv:%d"
682 " write:%d sNp:%d\n", ap, is_priv, is_write, te->sNp);
683 return new DataAbort(vaddr, te->domain, is_write,
684 (te->sNp ? ArmFault::Permission0 :
685 ArmFault::Permission1));
686 }
687
1073
688 req->setPaddr(te->pAddr(vaddr));
689 // Check for a trickbox generated address fault
690 fault = trickBoxCheck(req, mode, te->domain, te->sNp);
691 if (fault)
692 return fault;
693
694 return NoFault;
1074 return fault;
695}
696
697Fault
1075}
1076
1077Fault
698TLB::translateAtomic(RequestPtr req, ThreadContext *tc, Mode mode)
1078TLB::translateAtomic(RequestPtr req, ThreadContext *tc, Mode mode,
1079 TLB::ArmTranslationType tranType)
699{
1080{
1081 updateMiscReg(tc, tranType);
1082
1083 if (directToStage2) {
1084 assert(stage2Tlb);
1085 return stage2Tlb->translateAtomic(req, tc, mode, tranType);
1086 }
1087
700 bool delay = false;
701 Fault fault;
702 if (FullSystem)
1088 bool delay = false;
1089 Fault fault;
1090 if (FullSystem)
703 fault = translateFs(req, tc, mode, NULL, delay, false);
1091 fault = translateFs(req, tc, mode, NULL, delay, false, tranType);
704 else
705 fault = translateSe(req, tc, mode, NULL, delay, false);
706 assert(!delay);
707 return fault;
708}
709
710Fault
1092 else
1093 fault = translateSe(req, tc, mode, NULL, delay, false);
1094 assert(!delay);
1095 return fault;
1096}
1097
1098Fault
711TLB::translateFunctional(RequestPtr req, ThreadContext *tc, Mode mode)
1099TLB::translateFunctional(RequestPtr req, ThreadContext *tc, Mode mode,
1100 TLB::ArmTranslationType tranType)
712{
1101{
1102 updateMiscReg(tc, tranType);
1103
1104 if (directToStage2) {
1105 assert(stage2Tlb);
1106 return stage2Tlb->translateFunctional(req, tc, mode, tranType);
1107 }
1108
713 bool delay = false;
714 Fault fault;
715 if (FullSystem)
1109 bool delay = false;
1110 Fault fault;
1111 if (FullSystem)
716 fault = translateFs(req, tc, mode, NULL, delay, false, true);
717 else
1112 fault = translateFs(req, tc, mode, NULL, delay, false, tranType, true);
1113 else
718 fault = translateSe(req, tc, mode, NULL, delay, false);
719 assert(!delay);
720 return fault;
721}
722
723Fault
724TLB::translateTiming(RequestPtr req, ThreadContext *tc,
1114 fault = translateSe(req, tc, mode, NULL, delay, false);
1115 assert(!delay);
1116 return fault;
1117}
1118
1119Fault
1120TLB::translateTiming(RequestPtr req, ThreadContext *tc,
725 Translation *translation, Mode mode)
1121 Translation *translation, Mode mode, TLB::ArmTranslationType tranType)
726{
1122{
1123 updateMiscReg(tc, tranType);
1124
1125 if (directToStage2) {
1126 assert(stage2Tlb);
1127 return stage2Tlb->translateTiming(req, tc, translation, mode, tranType);
1128 }
1129
727 assert(translation);
1130 assert(translation);
1131
1132 return translateComplete(req, tc, translation, mode, tranType, isStage2);
1133}
1134
1135Fault
1136TLB::translateComplete(RequestPtr req, ThreadContext *tc,
1137 Translation *translation, Mode mode, TLB::ArmTranslationType tranType,
1138 bool callFromS2)
1139{
728 bool delay = false;
729 Fault fault;
730 if (FullSystem)
1140 bool delay = false;
1141 Fault fault;
1142 if (FullSystem)
731 fault = translateFs(req, tc, mode, translation, delay, true);
1143 fault = translateFs(req, tc, mode, translation, delay, true, tranType);
732 else
733 fault = translateSe(req, tc, mode, translation, delay, true);
734 DPRINTF(TLBVerbose, "Translation returning delay=%d fault=%d\n", delay, fault !=
735 NoFault);
1144 else
1145 fault = translateSe(req, tc, mode, translation, delay, true);
1146 DPRINTF(TLBVerbose, "Translation returning delay=%d fault=%d\n", delay, fault !=
1147 NoFault);
736 if (!delay)
737 translation->finish(fault, req, tc, mode);
738 else
739 translation->markDelayed();
1148 // If we have a translation, and we're not in the middle of doing a stage
1149 // 2 translation tell the translation that we've either finished or its
1150 // going to take a while. By not doing this when we're in the middle of a
1151 // stage 2 translation we prevent marking the translation as delayed twice,
1152 // one when the translation starts and again when the stage 1 translation
1153 // completes.
1154 if (translation && (callFromS2 || !stage2Req || req->hasPaddr() || fault != NoFault)) {
1155 if (!delay)
1156 translation->finish(fault, req, tc, mode);
1157 else
1158 translation->markDelayed();
1159 }
740 return fault;
741}
742
743BaseMasterPort*
744TLB::getMasterPort()
745{
746 return &tableWalker->getMasterPort("port");
747}
748
1160 return fault;
1161}
1162
1163BaseMasterPort*
1164TLB::getMasterPort()
1165{
1166 return &tableWalker->getMasterPort("port");
1167}
1168
1169DmaPort&
1170TLB::getWalkerPort()
1171{
1172 return tableWalker->getWalkerPort();
1173}
749
1174
1175void
1176TLB::updateMiscReg(ThreadContext *tc, ArmTranslationType tranType)
1177{
1178 // check if the regs have changed, or the translation mode is different.
1179 // NOTE: the tran type doesn't affect stage 2 TLB's as they only handle
1180 // one type of translation anyway
1181 if (miscRegValid && ((tranType == curTranType) || isStage2)) {
1182 return;
1183 }
750
1184
1185 DPRINTF(TLBVerbose, "TLB variables changed!\n");
1186 CPSR cpsr = tc->readMiscReg(MISCREG_CPSR);
1187 // Dependencies: SCR/SCR_EL3, CPSR
1188 isSecure = inSecureState(tc);
1189 isSecure &= (tranType & HypMode) == 0;
1190 isSecure &= (tranType & S1S2NsTran) == 0;
1191 aarch64 = !cpsr.width;
1192 if (aarch64) { // AArch64
1193 aarch64EL = (ExceptionLevel) (uint8_t) cpsr.el;
1194 switch (aarch64EL) {
1195 case EL0:
1196 case EL1:
1197 {
1198 sctlr = tc->readMiscReg(MISCREG_SCTLR_EL1);
1199 ttbcr = tc->readMiscReg(MISCREG_TCR_EL1);
1200 uint64_t ttbr_asid = ttbcr.a1 ?
1201 tc->readMiscReg(MISCREG_TTBR1_EL1) :
1202 tc->readMiscReg(MISCREG_TTBR0_EL1);
1203 asid = bits(ttbr_asid,
1204 (haveLargeAsid64 && ttbcr.as) ? 63 : 55, 48);
1205 }
1206 break;
1207 case EL2:
1208 sctlr = tc->readMiscReg(MISCREG_SCTLR_EL2);
1209 ttbcr = tc->readMiscReg(MISCREG_TCR_EL2);
1210 asid = -1;
1211 break;
1212 case EL3:
1213 sctlr = tc->readMiscReg(MISCREG_SCTLR_EL3);
1214 ttbcr = tc->readMiscReg(MISCREG_TCR_EL3);
1215 asid = -1;
1216 break;
1217 }
1218 scr = tc->readMiscReg(MISCREG_SCR_EL3);
1219 isPriv = aarch64EL != EL0;
1220 // @todo: modify this behaviour to support Virtualization in
1221 // AArch64
1222 vmid = 0;
1223 isHyp = false;
1224 directToStage2 = false;
1225 stage2Req = false;
1226 } else { // AArch32
1227 sctlr = tc->readMiscReg(flattenMiscRegNsBanked(MISCREG_SCTLR, tc,
1228 !isSecure));
1229 ttbcr = tc->readMiscReg(flattenMiscRegNsBanked(MISCREG_TTBCR, tc,
1230 !isSecure));
1231 scr = tc->readMiscReg(MISCREG_SCR);
1232 isPriv = cpsr.mode != MODE_USER;
1233 if (haveLPAE && ttbcr.eae) {
1234 // Long-descriptor translation table format in use
1235 uint64_t ttbr_asid = tc->readMiscReg(
1236 flattenMiscRegNsBanked(ttbcr.a1 ? MISCREG_TTBR1
1237 : MISCREG_TTBR0,
1238 tc, !isSecure));
1239 asid = bits(ttbr_asid, 55, 48);
1240 } else {
1241 // Short-descriptor translation table format in use
1242 CONTEXTIDR context_id = tc->readMiscReg(flattenMiscRegNsBanked(
1243 MISCREG_CONTEXTIDR, tc,!isSecure));
1244 asid = context_id.asid;
1245 }
1246 prrr = tc->readMiscReg(flattenMiscRegNsBanked(MISCREG_PRRR, tc,
1247 !isSecure));
1248 nmrr = tc->readMiscReg(flattenMiscRegNsBanked(MISCREG_NMRR, tc,
1249 !isSecure));
1250 dacr = tc->readMiscReg(flattenMiscRegNsBanked(MISCREG_DACR, tc,
1251 !isSecure));
1252 hcr = tc->readMiscReg(MISCREG_HCR);
1253
1254 if (haveVirtualization) {
1255 vmid = bits(tc->readMiscReg(MISCREG_VTTBR), 55, 48);
1256 isHyp = cpsr.mode == MODE_HYP;
1257 isHyp |= tranType & HypMode;
1258 isHyp &= (tranType & S1S2NsTran) == 0;
1259 isHyp &= (tranType & S1CTran) == 0;
1260 if (isHyp) {
1261 sctlr = tc->readMiscReg(MISCREG_HSCTLR);
1262 }
1263 // Work out if we should skip the first stage of translation and go
1264 // directly to stage 2. This value is cached so we don't have to
1265 // compute it for every translation.
1266 stage2Req = hcr.vm && !isStage2 && !isHyp && !isSecure &&
1267 !(tranType & S1CTran);
1268 directToStage2 = stage2Req && !sctlr.m;
1269 } else {
1270 vmid = 0;
1271 stage2Req = false;
1272 isHyp = false;
1273 directToStage2 = false;
1274 }
1275 }
1276 miscRegValid = true;
1277 curTranType = tranType;
1278}
1279
1280Fault
1281TLB::getTE(TlbEntry **te, RequestPtr req, ThreadContext *tc, Mode mode,
1282 Translation *translation, bool timing, bool functional,
1283 bool is_secure, TLB::ArmTranslationType tranType)
1284{
1285 bool is_fetch = (mode == Execute);
1286 bool is_write = (mode == Write);
1287
1288 Addr vaddr_tainted = req->getVaddr();
1289 Addr vaddr = 0;
1290 ExceptionLevel target_el = aarch64 ? aarch64EL : EL1;
1291 if (aarch64) {
1292 vaddr = purifyTaggedAddr(vaddr_tainted, tc, target_el);
1293 } else {
1294 vaddr = vaddr_tainted;
1295 }
1296 *te = lookup(vaddr, asid, vmid, isHyp, is_secure, false, false, target_el);
1297 if (*te == NULL) {
1298 if (req->isPrefetch()) {
1299 // if the request is a prefetch don't attempt to fill the TLB or go
1300 // any further with the memory access (here we can safely use the
1301 // fault status for the short desc. format in all cases)
1302 prefetchFaults++;
1303 return new PrefetchAbort(vaddr_tainted, ArmFault::PrefetchTLBMiss, isStage2);
1304 }
1305
1306 if (is_fetch)
1307 instMisses++;
1308 else if (is_write)
1309 writeMisses++;
1310 else
1311 readMisses++;
1312
1313 // start translation table walk, pass variables rather than
1314 // re-retreaving in table walker for speed
1315 DPRINTF(TLB, "TLB Miss: Starting hardware table walker for %#x(%d:%d)\n",
1316 vaddr_tainted, asid, vmid);
1317 Fault fault;
1318 fault = tableWalker->walk(req, tc, asid, vmid, isHyp, mode,
1319 translation, timing, functional, is_secure,
1320 tranType);
1321 // for timing mode, return and wait for table walk,
1322 if (timing || fault != NoFault) {
1323 return fault;
1324 }
1325
1326 *te = lookup(vaddr, asid, vmid, isHyp, is_secure, false, false, target_el);
1327 if (!*te)
1328 printTlb();
1329 assert(*te);
1330 } else {
1331 if (is_fetch)
1332 instHits++;
1333 else if (is_write)
1334 writeHits++;
1335 else
1336 readHits++;
1337 }
1338 return NoFault;
1339}
1340
1341Fault
1342TLB::getResultTe(TlbEntry **te, RequestPtr req, ThreadContext *tc, Mode mode,
1343 Translation *translation, bool timing, bool functional,
1344 TlbEntry *mergeTe)
1345{
1346 Fault fault;
1347 TlbEntry *s1Te = NULL;
1348
1349 Addr vaddr_tainted = req->getVaddr();
1350
1351 // Get the stage 1 table entry
1352 fault = getTE(&s1Te, req, tc, mode, translation, timing, functional,
1353 isSecure, curTranType);
1354 // only proceed if we have a valid table entry
1355 if ((s1Te != NULL) && (fault == NoFault)) {
1356 // Check stage 1 permissions before checking stage 2
1357 if (aarch64)
1358 fault = checkPermissions64(s1Te, req, mode, tc);
1359 else
1360 fault = checkPermissions(s1Te, req, mode);
1361 if (stage2Req & (fault == NoFault)) {
1362 Stage2LookUp *s2Lookup = new Stage2LookUp(this, stage2Tlb, *s1Te,
1363 req, translation, mode, timing, functional, curTranType);
1364 fault = s2Lookup->getTe(tc, mergeTe);
1365 if (s2Lookup->isComplete()) {
1366 *te = mergeTe;
1367 // We've finished with the lookup so delete it
1368 delete s2Lookup;
1369 } else {
1370 // The lookup hasn't completed, so we can't delete it now. We
1371 // get round this by asking the object to self delete when the
1372 // translation is complete.
1373 s2Lookup->setSelfDelete();
1374 }
1375 } else {
1376 // This case deals with an S1 hit (or bypass), followed by
1377 // an S2 hit-but-perms issue
1378 if (isStage2) {
1379 DPRINTF(TLBVerbose, "s2TLB: reqVa %#x, reqPa %#x, fault %p\n",
1380 vaddr_tainted, req->hasPaddr() ? req->getPaddr() : ~0, fault);
1381 if (fault != NoFault) {
1382 ArmFault *armFault = reinterpret_cast<ArmFault *>(fault.get());
1383 armFault->annotate(ArmFault::S1PTW, false);
1384 armFault->annotate(ArmFault::OVA, vaddr_tainted);
1385 }
1386 }
1387 *te = s1Te;
1388 }
1389 }
1390 return fault;
1391}
1392
751ArmISA::TLB *
752ArmTLBParams::create()
753{
754 return new ArmISA::TLB(this);
755}
1393ArmISA::TLB *
1394ArmTLBParams::create()
1395{
1396 return new ArmISA::TLB(this);
1397}