tlb.cc revision 10854:f449d6f8a647
1/* 2 * Copyright (c) 2010-2013 ARM Limited 3 * All rights reserved 4 * 5 * The license below extends only to copyright in the software and shall 6 * not be construed as granting a license to any other intellectual 7 * property including but not limited to intellectual property relating 8 * to a hardware implementation of the functionality of the software 9 * licensed hereunder. You may use the software subject to the license 10 * terms below provided that you ensure that this notice is replicated 11 * unmodified and in its entirety in all distributions of the software, 12 * modified or unmodified, in source code or in binary form. 13 * 14 * Copyright (c) 2001-2005 The Regents of The University of Michigan 15 * All rights reserved. 16 * 17 * Redistribution and use in source and binary forms, with or without 18 * modification, are permitted provided that the following conditions are 19 * met: redistributions of source code must retain the above copyright 20 * notice, this list of conditions and the following disclaimer; 21 * redistributions in binary form must reproduce the above copyright 22 * notice, this list of conditions and the following disclaimer in the 23 * documentation and/or other materials provided with the distribution; 24 * neither the name of the copyright holders nor the names of its 25 * contributors may be used to endorse or promote products derived from 26 * this software without specific prior written permission. 27 * 28 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 29 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 30 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR 31 * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT 32 * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 33 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT 34 * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 35 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 36 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 37 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE 38 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 39 * 40 * Authors: Ali Saidi 41 * Nathan Binkert 42 * Steve Reinhardt 43 */ 44 45#include <memory> 46#include <string> 47#include <vector> 48 49#include "arch/arm/faults.hh" 50#include "arch/arm/pagetable.hh" 51#include "arch/arm/system.hh" 52#include "arch/arm/table_walker.hh" 53#include "arch/arm/stage2_lookup.hh" 54#include "arch/arm/stage2_mmu.hh" 55#include "arch/arm/tlb.hh" 56#include "arch/arm/utility.hh" 57#include "base/inifile.hh" 58#include "base/str.hh" 59#include "base/trace.hh" 60#include "cpu/base.hh" 61#include "cpu/thread_context.hh" 62#include "debug/Checkpoint.hh" 63#include "debug/TLB.hh" 64#include "debug/TLBVerbose.hh" 65#include "mem/page_table.hh" 66#include "params/ArmTLB.hh" 67#include "sim/full_system.hh" 68#include "sim/process.hh" 69 70using namespace std; 71using namespace ArmISA; 72 73TLB::TLB(const ArmTLBParams *p) 74 : BaseTLB(p), table(new TlbEntry[p->size]), size(p->size), 75 isStage2(p->is_stage2), stage2Req(false), _attr(0), 76 directToStage2(false), tableWalker(p->walker), stage2Tlb(NULL), 77 stage2Mmu(NULL), rangeMRU(1), 78 aarch64(false), aarch64EL(EL0), isPriv(false), isSecure(false), 79 isHyp(false), asid(0), vmid(0), dacr(0), 80 miscRegValid(false), curTranType(NormalTran) 81{ 82 tableWalker->setTlb(this); 83 84 // Cache system-level properties 85 haveLPAE = tableWalker->haveLPAE(); 86 haveVirtualization = tableWalker->haveVirtualization(); 87 haveLargeAsid64 = tableWalker->haveLargeAsid64(); 88} 89 90TLB::~TLB() 91{ 92 delete[] table; 93} 94 95void 96TLB::init() 97{ 98 if (stage2Mmu && !isStage2) 99 stage2Tlb = stage2Mmu->stage2Tlb(); 100} 101 102void 103TLB::setMMU(Stage2MMU *m, MasterID master_id) 104{ 105 stage2Mmu = m; 106 tableWalker->setMMU(m, master_id); 107} 108 109bool 110TLB::translateFunctional(ThreadContext *tc, Addr va, Addr &pa) 111{ 112 updateMiscReg(tc); 113 114 if (directToStage2) { 115 assert(stage2Tlb); 116 return stage2Tlb->translateFunctional(tc, va, pa); 117 } 118 119 TlbEntry *e = lookup(va, asid, vmid, isHyp, isSecure, true, false, 120 aarch64 ? aarch64EL : EL1); 121 if (!e) 122 return false; 123 pa = e->pAddr(va); 124 return true; 125} 126 127Fault 128TLB::finalizePhysical(RequestPtr req, ThreadContext *tc, Mode mode) const 129{ 130 return NoFault; 131} 132 133TlbEntry* 134TLB::lookup(Addr va, uint16_t asn, uint8_t vmid, bool hyp, bool secure, 135 bool functional, bool ignore_asn, uint8_t target_el) 136{ 137 138 TlbEntry *retval = NULL; 139 140 // Maintaining LRU array 141 int x = 0; 142 while (retval == NULL && x < size) { 143 if ((!ignore_asn && table[x].match(va, asn, vmid, hyp, secure, false, 144 target_el)) || 145 (ignore_asn && table[x].match(va, vmid, hyp, secure, target_el))) { 146 // We only move the hit entry ahead when the position is higher 147 // than rangeMRU 148 if (x > rangeMRU && !functional) { 149 TlbEntry tmp_entry = table[x]; 150 for(int i = x; i > 0; i--) 151 table[i] = table[i - 1]; 152 table[0] = tmp_entry; 153 retval = &table[0]; 154 } else { 155 retval = &table[x]; 156 } 157 break; 158 } 159 ++x; 160 } 161 162 DPRINTF(TLBVerbose, "Lookup %#x, asn %#x -> %s vmn 0x%x hyp %d secure %d " 163 "ppn %#x size: %#x pa: %#x ap:%d ns:%d nstid:%d g:%d asid: %d " 164 "el: %d\n", 165 va, asn, retval ? "hit" : "miss", vmid, hyp, secure, 166 retval ? retval->pfn : 0, retval ? retval->size : 0, 167 retval ? retval->pAddr(va) : 0, retval ? retval->ap : 0, 168 retval ? retval->ns : 0, retval ? retval->nstid : 0, 169 retval ? retval->global : 0, retval ? retval->asid : 0, 170 retval ? retval->el : 0); 171 172 return retval; 173} 174 175// insert a new TLB entry 176void 177TLB::insert(Addr addr, TlbEntry &entry) 178{ 179 DPRINTF(TLB, "Inserting entry into TLB with pfn:%#x size:%#x vpn: %#x" 180 " asid:%d vmid:%d N:%d global:%d valid:%d nc:%d xn:%d" 181 " ap:%#x domain:%#x ns:%d nstid:%d isHyp:%d\n", entry.pfn, 182 entry.size, entry.vpn, entry.asid, entry.vmid, entry.N, 183 entry.global, entry.valid, entry.nonCacheable, entry.xn, 184 entry.ap, static_cast<uint8_t>(entry.domain), entry.ns, entry.nstid, 185 entry.isHyp); 186 187 if (table[size - 1].valid) 188 DPRINTF(TLB, " - Replacing Valid entry %#x, asn %d vmn %d ppn %#x " 189 "size: %#x ap:%d ns:%d nstid:%d g:%d isHyp:%d el: %d\n", 190 table[size-1].vpn << table[size-1].N, table[size-1].asid, 191 table[size-1].vmid, table[size-1].pfn << table[size-1].N, 192 table[size-1].size, table[size-1].ap, table[size-1].ns, 193 table[size-1].nstid, table[size-1].global, table[size-1].isHyp, 194 table[size-1].el); 195 196 //inserting to MRU position and evicting the LRU one 197 198 for (int i = size - 1; i > 0; --i) 199 table[i] = table[i-1]; 200 table[0] = entry; 201 202 inserts++; 203 ppRefills->notify(1); 204} 205 206void 207TLB::printTlb() const 208{ 209 int x = 0; 210 TlbEntry *te; 211 DPRINTF(TLB, "Current TLB contents:\n"); 212 while (x < size) { 213 te = &table[x]; 214 if (te->valid) 215 DPRINTF(TLB, " * %s\n", te->print()); 216 ++x; 217 } 218} 219 220void 221TLB::flushAllSecurity(bool secure_lookup, uint8_t target_el, bool ignore_el) 222{ 223 DPRINTF(TLB, "Flushing all TLB entries (%s lookup)\n", 224 (secure_lookup ? "secure" : "non-secure")); 225 int x = 0; 226 TlbEntry *te; 227 while (x < size) { 228 te = &table[x]; 229 if (te->valid && secure_lookup == !te->nstid && 230 (te->vmid == vmid || secure_lookup) && 231 checkELMatch(target_el, te->el, ignore_el)) { 232 233 DPRINTF(TLB, " - %s\n", te->print()); 234 te->valid = false; 235 flushedEntries++; 236 } 237 ++x; 238 } 239 240 flushTlb++; 241 242 // If there's a second stage TLB (and we're not it) then flush it as well 243 // if we're currently in hyp mode 244 if (!isStage2 && isHyp) { 245 stage2Tlb->flushAllSecurity(secure_lookup, true); 246 } 247} 248 249void 250TLB::flushAllNs(bool hyp, uint8_t target_el, bool ignore_el) 251{ 252 DPRINTF(TLB, "Flushing all NS TLB entries (%s lookup)\n", 253 (hyp ? "hyp" : "non-hyp")); 254 int x = 0; 255 TlbEntry *te; 256 while (x < size) { 257 te = &table[x]; 258 if (te->valid && te->nstid && te->isHyp == hyp && 259 checkELMatch(target_el, te->el, ignore_el)) { 260 261 DPRINTF(TLB, " - %s\n", te->print()); 262 flushedEntries++; 263 te->valid = false; 264 } 265 ++x; 266 } 267 268 flushTlb++; 269 270 // If there's a second stage TLB (and we're not it) then flush it as well 271 if (!isStage2 && !hyp) { 272 stage2Tlb->flushAllNs(false, true); 273 } 274} 275 276void 277TLB::flushMvaAsid(Addr mva, uint64_t asn, bool secure_lookup, uint8_t target_el) 278{ 279 DPRINTF(TLB, "Flushing TLB entries with mva: %#x, asid: %#x " 280 "(%s lookup)\n", mva, asn, (secure_lookup ? 281 "secure" : "non-secure")); 282 _flushMva(mva, asn, secure_lookup, false, false, target_el); 283 flushTlbMvaAsid++; 284} 285 286void 287TLB::flushAsid(uint64_t asn, bool secure_lookup, uint8_t target_el) 288{ 289 DPRINTF(TLB, "Flushing TLB entries with asid: %#x (%s lookup)\n", asn, 290 (secure_lookup ? "secure" : "non-secure")); 291 292 int x = 0 ; 293 TlbEntry *te; 294 295 while (x < size) { 296 te = &table[x]; 297 if (te->valid && te->asid == asn && secure_lookup == !te->nstid && 298 (te->vmid == vmid || secure_lookup) && 299 checkELMatch(target_el, te->el, false)) { 300 301 te->valid = false; 302 DPRINTF(TLB, " - %s\n", te->print()); 303 flushedEntries++; 304 } 305 ++x; 306 } 307 flushTlbAsid++; 308} 309 310void 311TLB::flushMva(Addr mva, bool secure_lookup, bool hyp, uint8_t target_el) 312{ 313 DPRINTF(TLB, "Flushing TLB entries with mva: %#x (%s lookup)\n", mva, 314 (secure_lookup ? "secure" : "non-secure")); 315 _flushMva(mva, 0xbeef, secure_lookup, hyp, true, target_el); 316 flushTlbMva++; 317} 318 319void 320TLB::_flushMva(Addr mva, uint64_t asn, bool secure_lookup, bool hyp, 321 bool ignore_asn, uint8_t target_el) 322{ 323 TlbEntry *te; 324 // D5.7.2: Sign-extend address to 64 bits 325 mva = sext<56>(mva); 326 te = lookup(mva, asn, vmid, hyp, secure_lookup, false, ignore_asn, 327 target_el); 328 while (te != NULL) { 329 if (secure_lookup == !te->nstid) { 330 DPRINTF(TLB, " - %s\n", te->print()); 331 te->valid = false; 332 flushedEntries++; 333 } 334 te = lookup(mva, asn, vmid, hyp, secure_lookup, false, ignore_asn, 335 target_el); 336 } 337} 338 339bool 340TLB::checkELMatch(uint8_t target_el, uint8_t tentry_el, bool ignore_el) 341{ 342 bool elMatch = true; 343 if (!ignore_el) { 344 if (target_el == 2 || target_el == 3) { 345 elMatch = (tentry_el == target_el); 346 } else { 347 elMatch = (tentry_el == 0) || (tentry_el == 1); 348 } 349 } 350 return elMatch; 351} 352 353void 354TLB::drainResume() 355{ 356 // We might have unserialized something or switched CPUs, so make 357 // sure to re-read the misc regs. 358 miscRegValid = false; 359} 360 361void 362TLB::takeOverFrom(BaseTLB *_otlb) 363{ 364 TLB *otlb = dynamic_cast<TLB*>(_otlb); 365 /* Make sure we actually have a valid type */ 366 if (otlb) { 367 _attr = otlb->_attr; 368 haveLPAE = otlb->haveLPAE; 369 directToStage2 = otlb->directToStage2; 370 stage2Req = otlb->stage2Req; 371 372 /* Sync the stage2 MMU if they exist in both 373 * the old CPU and the new 374 */ 375 if (!isStage2 && 376 stage2Tlb && otlb->stage2Tlb) { 377 stage2Tlb->takeOverFrom(otlb->stage2Tlb); 378 } 379 } else { 380 panic("Incompatible TLB type!"); 381 } 382} 383 384void 385TLB::serialize(ostream &os) 386{ 387 DPRINTF(Checkpoint, "Serializing Arm TLB\n"); 388 389 SERIALIZE_SCALAR(_attr); 390 SERIALIZE_SCALAR(haveLPAE); 391 SERIALIZE_SCALAR(directToStage2); 392 SERIALIZE_SCALAR(stage2Req); 393 394 int num_entries = size; 395 SERIALIZE_SCALAR(num_entries); 396 for(int i = 0; i < size; i++){ 397 nameOut(os, csprintf("%s.TlbEntry%d", name(), i)); 398 table[i].serialize(os); 399 } 400} 401 402void 403TLB::unserialize(Checkpoint *cp, const string §ion) 404{ 405 DPRINTF(Checkpoint, "Unserializing Arm TLB\n"); 406 407 UNSERIALIZE_SCALAR(_attr); 408 UNSERIALIZE_SCALAR(haveLPAE); 409 UNSERIALIZE_SCALAR(directToStage2); 410 UNSERIALIZE_SCALAR(stage2Req); 411 412 int num_entries; 413 UNSERIALIZE_SCALAR(num_entries); 414 for(int i = 0; i < min(size, num_entries); i++){ 415 table[i].unserialize(cp, csprintf("%s.TlbEntry%d", section, i)); 416 } 417} 418 419void 420TLB::regStats() 421{ 422 instHits 423 .name(name() + ".inst_hits") 424 .desc("ITB inst hits") 425 ; 426 427 instMisses 428 .name(name() + ".inst_misses") 429 .desc("ITB inst misses") 430 ; 431 432 instAccesses 433 .name(name() + ".inst_accesses") 434 .desc("ITB inst accesses") 435 ; 436 437 readHits 438 .name(name() + ".read_hits") 439 .desc("DTB read hits") 440 ; 441 442 readMisses 443 .name(name() + ".read_misses") 444 .desc("DTB read misses") 445 ; 446 447 readAccesses 448 .name(name() + ".read_accesses") 449 .desc("DTB read accesses") 450 ; 451 452 writeHits 453 .name(name() + ".write_hits") 454 .desc("DTB write hits") 455 ; 456 457 writeMisses 458 .name(name() + ".write_misses") 459 .desc("DTB write misses") 460 ; 461 462 writeAccesses 463 .name(name() + ".write_accesses") 464 .desc("DTB write accesses") 465 ; 466 467 hits 468 .name(name() + ".hits") 469 .desc("DTB hits") 470 ; 471 472 misses 473 .name(name() + ".misses") 474 .desc("DTB misses") 475 ; 476 477 accesses 478 .name(name() + ".accesses") 479 .desc("DTB accesses") 480 ; 481 482 flushTlb 483 .name(name() + ".flush_tlb") 484 .desc("Number of times complete TLB was flushed") 485 ; 486 487 flushTlbMva 488 .name(name() + ".flush_tlb_mva") 489 .desc("Number of times TLB was flushed by MVA") 490 ; 491 492 flushTlbMvaAsid 493 .name(name() + ".flush_tlb_mva_asid") 494 .desc("Number of times TLB was flushed by MVA & ASID") 495 ; 496 497 flushTlbAsid 498 .name(name() + ".flush_tlb_asid") 499 .desc("Number of times TLB was flushed by ASID") 500 ; 501 502 flushedEntries 503 .name(name() + ".flush_entries") 504 .desc("Number of entries that have been flushed from TLB") 505 ; 506 507 alignFaults 508 .name(name() + ".align_faults") 509 .desc("Number of TLB faults due to alignment restrictions") 510 ; 511 512 prefetchFaults 513 .name(name() + ".prefetch_faults") 514 .desc("Number of TLB faults due to prefetch") 515 ; 516 517 domainFaults 518 .name(name() + ".domain_faults") 519 .desc("Number of TLB faults due to domain restrictions") 520 ; 521 522 permsFaults 523 .name(name() + ".perms_faults") 524 .desc("Number of TLB faults due to permissions restrictions") 525 ; 526 527 instAccesses = instHits + instMisses; 528 readAccesses = readHits + readMisses; 529 writeAccesses = writeHits + writeMisses; 530 hits = readHits + writeHits + instHits; 531 misses = readMisses + writeMisses + instMisses; 532 accesses = readAccesses + writeAccesses + instAccesses; 533} 534 535void 536TLB::regProbePoints() 537{ 538 ppRefills.reset(new ProbePoints::PMU(getProbeManager(), "Refills")); 539} 540 541Fault 542TLB::translateSe(RequestPtr req, ThreadContext *tc, Mode mode, 543 Translation *translation, bool &delay, bool timing) 544{ 545 updateMiscReg(tc); 546 Addr vaddr_tainted = req->getVaddr(); 547 Addr vaddr = 0; 548 if (aarch64) 549 vaddr = purifyTaggedAddr(vaddr_tainted, tc, aarch64EL, ttbcr); 550 else 551 vaddr = vaddr_tainted; 552 uint32_t flags = req->getFlags(); 553 554 bool is_fetch = (mode == Execute); 555 bool is_write = (mode == Write); 556 557 if (!is_fetch) { 558 assert(flags & MustBeOne); 559 if (sctlr.a || !(flags & AllowUnaligned)) { 560 if (vaddr & mask(flags & AlignmentMask)) { 561 // LPAE is always disabled in SE mode 562 return std::make_shared<DataAbort>( 563 vaddr_tainted, 564 TlbEntry::DomainType::NoAccess, is_write, 565 ArmFault::AlignmentFault, isStage2, 566 ArmFault::VmsaTran); 567 } 568 } 569 } 570 571 Addr paddr; 572 Process *p = tc->getProcessPtr(); 573 574 if (!p->pTable->translate(vaddr, paddr)) 575 return std::make_shared<GenericPageTableFault>(vaddr_tainted); 576 req->setPaddr(paddr); 577 578 return NoFault; 579} 580 581Fault 582TLB::trickBoxCheck(RequestPtr req, Mode mode, TlbEntry::DomainType domain) 583{ 584 return NoFault; 585} 586 587Fault 588TLB::walkTrickBoxCheck(Addr pa, bool is_secure, Addr va, Addr sz, bool is_exec, 589 bool is_write, TlbEntry::DomainType domain, LookupLevel lookup_level) 590{ 591 return NoFault; 592} 593 594Fault 595TLB::checkPermissions(TlbEntry *te, RequestPtr req, Mode mode) 596{ 597 Addr vaddr = req->getVaddr(); // 32-bit don't have to purify 598 uint32_t flags = req->getFlags(); 599 bool is_fetch = (mode == Execute); 600 bool is_write = (mode == Write); 601 bool is_priv = isPriv && !(flags & UserMode); 602 603 // Get the translation type from the actuall table entry 604 ArmFault::TranMethod tranMethod = te->longDescFormat ? ArmFault::LpaeTran 605 : ArmFault::VmsaTran; 606 607 // If this is the second stage of translation and the request is for a 608 // stage 1 page table walk then we need to check the HCR.PTW bit. This 609 // allows us to generate a fault if the request targets an area marked 610 // as a device or strongly ordered. 611 if (isStage2 && req->isPTWalk() && hcr.ptw && 612 (te->mtype != TlbEntry::MemoryType::Normal)) { 613 return std::make_shared<DataAbort>( 614 vaddr, te->domain, is_write, 615 ArmFault::PermissionLL + te->lookupLevel, 616 isStage2, tranMethod); 617 } 618 619 // Generate an alignment fault for unaligned data accesses to device or 620 // strongly ordered memory 621 if (!is_fetch) { 622 if (te->mtype != TlbEntry::MemoryType::Normal) { 623 if (vaddr & mask(flags & AlignmentMask)) { 624 alignFaults++; 625 return std::make_shared<DataAbort>( 626 vaddr, TlbEntry::DomainType::NoAccess, is_write, 627 ArmFault::AlignmentFault, isStage2, 628 tranMethod); 629 } 630 } 631 } 632 633 if (te->nonCacheable) { 634 // Prevent prefetching from I/O devices. 635 if (req->isPrefetch()) { 636 // Here we can safely use the fault status for the short 637 // desc. format in all cases 638 return std::make_shared<PrefetchAbort>( 639 vaddr, ArmFault::PrefetchUncacheable, 640 isStage2, tranMethod); 641 } 642 } 643 644 if (!te->longDescFormat) { 645 switch ((dacr >> (static_cast<uint8_t>(te->domain) * 2)) & 0x3) { 646 case 0: 647 domainFaults++; 648 DPRINTF(TLB, "TLB Fault: Data abort on domain. DACR: %#x" 649 " domain: %#x write:%d\n", dacr, 650 static_cast<uint8_t>(te->domain), is_write); 651 if (is_fetch) 652 return std::make_shared<PrefetchAbort>( 653 vaddr, 654 ArmFault::DomainLL + te->lookupLevel, 655 isStage2, tranMethod); 656 else 657 return std::make_shared<DataAbort>( 658 vaddr, te->domain, is_write, 659 ArmFault::DomainLL + te->lookupLevel, 660 isStage2, tranMethod); 661 case 1: 662 // Continue with permissions check 663 break; 664 case 2: 665 panic("UNPRED domain\n"); 666 case 3: 667 return NoFault; 668 } 669 } 670 671 // The 'ap' variable is AP[2:0] or {AP[2,1],1b'0}, i.e. always three bits 672 uint8_t ap = te->longDescFormat ? te->ap << 1 : te->ap; 673 uint8_t hap = te->hap; 674 675 if (sctlr.afe == 1 || te->longDescFormat) 676 ap |= 1; 677 678 bool abt; 679 bool isWritable = true; 680 // If this is a stage 2 access (eg for reading stage 1 page table entries) 681 // then don't perform the AP permissions check, we stil do the HAP check 682 // below. 683 if (isStage2) { 684 abt = false; 685 } else { 686 switch (ap) { 687 case 0: 688 DPRINTF(TLB, "Access permissions 0, checking rs:%#x\n", 689 (int)sctlr.rs); 690 if (!sctlr.xp) { 691 switch ((int)sctlr.rs) { 692 case 2: 693 abt = is_write; 694 break; 695 case 1: 696 abt = is_write || !is_priv; 697 break; 698 case 0: 699 case 3: 700 default: 701 abt = true; 702 break; 703 } 704 } else { 705 abt = true; 706 } 707 break; 708 case 1: 709 abt = !is_priv; 710 break; 711 case 2: 712 abt = !is_priv && is_write; 713 isWritable = is_priv; 714 break; 715 case 3: 716 abt = false; 717 break; 718 case 4: 719 panic("UNPRED premissions\n"); 720 case 5: 721 abt = !is_priv || is_write; 722 isWritable = false; 723 break; 724 case 6: 725 case 7: 726 abt = is_write; 727 isWritable = false; 728 break; 729 default: 730 panic("Unknown permissions %#x\n", ap); 731 } 732 } 733 734 bool hapAbt = is_write ? !(hap & 2) : !(hap & 1); 735 bool xn = te->xn || (isWritable && sctlr.wxn) || 736 (ap == 3 && sctlr.uwxn && is_priv); 737 if (is_fetch && (abt || xn || 738 (te->longDescFormat && te->pxn && !is_priv) || 739 (isSecure && te->ns && scr.sif))) { 740 permsFaults++; 741 DPRINTF(TLB, "TLB Fault: Prefetch abort on permission check. AP:%d " 742 "priv:%d write:%d ns:%d sif:%d sctlr.afe: %d \n", 743 ap, is_priv, is_write, te->ns, scr.sif,sctlr.afe); 744 return std::make_shared<PrefetchAbort>( 745 vaddr, 746 ArmFault::PermissionLL + te->lookupLevel, 747 isStage2, tranMethod); 748 } else if (abt | hapAbt) { 749 permsFaults++; 750 DPRINTF(TLB, "TLB Fault: Data abort on permission check. AP:%d priv:%d" 751 " write:%d\n", ap, is_priv, is_write); 752 return std::make_shared<DataAbort>( 753 vaddr, te->domain, is_write, 754 ArmFault::PermissionLL + te->lookupLevel, 755 isStage2 | !abt, tranMethod); 756 } 757 return NoFault; 758} 759 760 761Fault 762TLB::checkPermissions64(TlbEntry *te, RequestPtr req, Mode mode, 763 ThreadContext *tc) 764{ 765 assert(aarch64); 766 767 Addr vaddr_tainted = req->getVaddr(); 768 Addr vaddr = purifyTaggedAddr(vaddr_tainted, tc, aarch64EL, ttbcr); 769 770 uint32_t flags = req->getFlags(); 771 bool is_fetch = (mode == Execute); 772 bool is_write = (mode == Write); 773 bool is_priv M5_VAR_USED = isPriv && !(flags & UserMode); 774 775 updateMiscReg(tc, curTranType); 776 777 // If this is the second stage of translation and the request is for a 778 // stage 1 page table walk then we need to check the HCR.PTW bit. This 779 // allows us to generate a fault if the request targets an area marked 780 // as a device or strongly ordered. 781 if (isStage2 && req->isPTWalk() && hcr.ptw && 782 (te->mtype != TlbEntry::MemoryType::Normal)) { 783 return std::make_shared<DataAbort>( 784 vaddr_tainted, te->domain, is_write, 785 ArmFault::PermissionLL + te->lookupLevel, 786 isStage2, ArmFault::LpaeTran); 787 } 788 789 // Generate an alignment fault for unaligned accesses to device or 790 // strongly ordered memory 791 if (!is_fetch) { 792 if (te->mtype != TlbEntry::MemoryType::Normal) { 793 if (vaddr & mask(flags & AlignmentMask)) { 794 alignFaults++; 795 return std::make_shared<DataAbort>( 796 vaddr_tainted, 797 TlbEntry::DomainType::NoAccess, is_write, 798 ArmFault::AlignmentFault, isStage2, 799 ArmFault::LpaeTran); 800 } 801 } 802 } 803 804 if (te->nonCacheable) { 805 // Prevent prefetching from I/O devices. 806 if (req->isPrefetch()) { 807 // Here we can safely use the fault status for the short 808 // desc. format in all cases 809 return std::make_shared<PrefetchAbort>( 810 vaddr_tainted, 811 ArmFault::PrefetchUncacheable, 812 isStage2, ArmFault::LpaeTran); 813 } 814 } 815 816 uint8_t ap = 0x3 & (te->ap); // 2-bit access protection field 817 bool grant = false; 818 819 uint8_t xn = te->xn; 820 uint8_t pxn = te->pxn; 821 bool r = !is_write && !is_fetch; 822 bool w = is_write; 823 bool x = is_fetch; 824 DPRINTF(TLBVerbose, "Checking permissions: ap:%d, xn:%d, pxn:%d, r:%d, " 825 "w:%d, x:%d\n", ap, xn, pxn, r, w, x); 826 827 if (isStage2) { 828 panic("Virtualization in AArch64 state is not supported yet"); 829 } else { 830 switch (aarch64EL) { 831 case EL0: 832 { 833 uint8_t perm = (ap << 2) | (xn << 1) | pxn; 834 switch (perm) { 835 case 0: 836 case 1: 837 case 8: 838 case 9: 839 grant = x; 840 break; 841 case 4: 842 case 5: 843 grant = r || w || (x && !sctlr.wxn); 844 break; 845 case 6: 846 case 7: 847 grant = r || w; 848 break; 849 case 12: 850 case 13: 851 grant = r || x; 852 break; 853 case 14: 854 case 15: 855 grant = r; 856 break; 857 default: 858 grant = false; 859 } 860 } 861 break; 862 case EL1: 863 { 864 uint8_t perm = (ap << 2) | (xn << 1) | pxn; 865 switch (perm) { 866 case 0: 867 case 2: 868 grant = r || w || (x && !sctlr.wxn); 869 break; 870 case 1: 871 case 3: 872 case 4: 873 case 5: 874 case 6: 875 case 7: 876 // regions that are writeable at EL0 should not be 877 // executable at EL1 878 grant = r || w; 879 break; 880 case 8: 881 case 10: 882 case 12: 883 case 14: 884 grant = r || x; 885 break; 886 case 9: 887 case 11: 888 case 13: 889 case 15: 890 grant = r; 891 break; 892 default: 893 grant = false; 894 } 895 } 896 break; 897 case EL2: 898 case EL3: 899 { 900 uint8_t perm = (ap & 0x2) | xn; 901 switch (perm) { 902 case 0: 903 grant = r || w || (x && !sctlr.wxn) ; 904 break; 905 case 1: 906 grant = r || w; 907 break; 908 case 2: 909 grant = r || x; 910 break; 911 case 3: 912 grant = r; 913 break; 914 default: 915 grant = false; 916 } 917 } 918 break; 919 } 920 } 921 922 if (!grant) { 923 if (is_fetch) { 924 permsFaults++; 925 DPRINTF(TLB, "TLB Fault: Prefetch abort on permission check. " 926 "AP:%d priv:%d write:%d ns:%d sif:%d " 927 "sctlr.afe: %d\n", 928 ap, is_priv, is_write, te->ns, scr.sif, sctlr.afe); 929 // Use PC value instead of vaddr because vaddr might be aligned to 930 // cache line and should not be the address reported in FAR 931 return std::make_shared<PrefetchAbort>( 932 req->getPC(), 933 ArmFault::PermissionLL + te->lookupLevel, 934 isStage2, ArmFault::LpaeTran); 935 } else { 936 permsFaults++; 937 DPRINTF(TLB, "TLB Fault: Data abort on permission check. AP:%d " 938 "priv:%d write:%d\n", ap, is_priv, is_write); 939 return std::make_shared<DataAbort>( 940 vaddr_tainted, te->domain, is_write, 941 ArmFault::PermissionLL + te->lookupLevel, 942 isStage2, ArmFault::LpaeTran); 943 } 944 } 945 946 return NoFault; 947} 948 949Fault 950TLB::translateFs(RequestPtr req, ThreadContext *tc, Mode mode, 951 Translation *translation, bool &delay, bool timing, 952 TLB::ArmTranslationType tranType, bool functional) 953{ 954 // No such thing as a functional timing access 955 assert(!(timing && functional)); 956 957 updateMiscReg(tc, tranType); 958 959 Addr vaddr_tainted = req->getVaddr(); 960 Addr vaddr = 0; 961 if (aarch64) 962 vaddr = purifyTaggedAddr(vaddr_tainted, tc, aarch64EL, ttbcr); 963 else 964 vaddr = vaddr_tainted; 965 uint32_t flags = req->getFlags(); 966 967 bool is_fetch = (mode == Execute); 968 bool is_write = (mode == Write); 969 bool long_desc_format = aarch64 || (haveLPAE && ttbcr.eae); 970 ArmFault::TranMethod tranMethod = long_desc_format ? ArmFault::LpaeTran 971 : ArmFault::VmsaTran; 972 973 req->setAsid(asid); 974 975 DPRINTF(TLBVerbose, "CPSR is priv:%d UserMode:%d secure:%d S1S2NsTran:%d\n", 976 isPriv, flags & UserMode, isSecure, tranType & S1S2NsTran); 977 978 DPRINTF(TLB, "translateFs addr %#x, mode %d, st2 %d, scr %#x sctlr %#x " 979 "flags %#x tranType 0x%x\n", vaddr_tainted, mode, isStage2, 980 scr, sctlr, flags, tranType); 981 982 // If this is a clrex instruction, provide a PA of 0 with no fault 983 // This will force the monitor to set the tracked address to 0 984 // a bit of a hack but this effectively clrears this processors monitor 985 if (flags & Request::CLEAR_LL){ 986 // @todo: check implications of security extensions 987 req->setPaddr(0); 988 req->setFlags(Request::UNCACHEABLE | Request::STRICT_ORDER); 989 req->setFlags(Request::CLEAR_LL); 990 return NoFault; 991 } 992 if ((req->isInstFetch() && (!sctlr.i)) || 993 ((!req->isInstFetch()) && (!sctlr.c))){ 994 req->setFlags(Request::UNCACHEABLE | Request::STRICT_ORDER); 995 } 996 if (!is_fetch) { 997 assert(flags & MustBeOne); 998 if (sctlr.a || !(flags & AllowUnaligned)) { 999 if (vaddr & mask(flags & AlignmentMask)) { 1000 alignFaults++; 1001 return std::make_shared<DataAbort>( 1002 vaddr_tainted, 1003 TlbEntry::DomainType::NoAccess, is_write, 1004 ArmFault::AlignmentFault, isStage2, 1005 tranMethod); 1006 } 1007 } 1008 } 1009 1010 // If guest MMU is off or hcr.vm=0 go straight to stage2 1011 if ((isStage2 && !hcr.vm) || (!isStage2 && !sctlr.m)) { 1012 1013 req->setPaddr(vaddr); 1014 // When the MMU is off the security attribute corresponds to the 1015 // security state of the processor 1016 if (isSecure) 1017 req->setFlags(Request::SECURE); 1018 1019 // @todo: double check this (ARM ARM issue C B3.2.1) 1020 if (long_desc_format || sctlr.tre == 0) { 1021 req->setFlags(Request::UNCACHEABLE | Request::STRICT_ORDER); 1022 } else { 1023 if (nmrr.ir0 == 0 || nmrr.or0 == 0 || prrr.tr0 != 0x2) 1024 req->setFlags(Request::UNCACHEABLE | Request::STRICT_ORDER); 1025 } 1026 1027 // Set memory attributes 1028 TlbEntry temp_te; 1029 temp_te.ns = !isSecure; 1030 if (isStage2 || hcr.dc == 0 || isSecure || 1031 (isHyp && !(tranType & S1CTran))) { 1032 1033 temp_te.mtype = is_fetch ? TlbEntry::MemoryType::Normal 1034 : TlbEntry::MemoryType::StronglyOrdered; 1035 temp_te.innerAttrs = 0x0; 1036 temp_te.outerAttrs = 0x0; 1037 temp_te.shareable = true; 1038 temp_te.outerShareable = true; 1039 } else { 1040 temp_te.mtype = TlbEntry::MemoryType::Normal; 1041 temp_te.innerAttrs = 0x3; 1042 temp_te.outerAttrs = 0x3; 1043 temp_te.shareable = false; 1044 temp_te.outerShareable = false; 1045 } 1046 temp_te.setAttributes(long_desc_format); 1047 DPRINTF(TLBVerbose, "(No MMU) setting memory attributes: shareable: " 1048 "%d, innerAttrs: %d, outerAttrs: %d, isStage2: %d\n", 1049 temp_te.shareable, temp_te.innerAttrs, temp_te.outerAttrs, 1050 isStage2); 1051 setAttr(temp_te.attributes); 1052 1053 return trickBoxCheck(req, mode, TlbEntry::DomainType::NoAccess); 1054 } 1055 1056 DPRINTF(TLBVerbose, "Translating %s=%#x context=%d\n", 1057 isStage2 ? "IPA" : "VA", vaddr_tainted, asid); 1058 // Translation enabled 1059 1060 TlbEntry *te = NULL; 1061 TlbEntry mergeTe; 1062 Fault fault = getResultTe(&te, req, tc, mode, translation, timing, 1063 functional, &mergeTe); 1064 // only proceed if we have a valid table entry 1065 if ((te == NULL) && (fault == NoFault)) delay = true; 1066 1067 // If we have the table entry transfer some of the attributes to the 1068 // request that triggered the translation 1069 if (te != NULL) { 1070 // Set memory attributes 1071 DPRINTF(TLBVerbose, 1072 "Setting memory attributes: shareable: %d, innerAttrs: %d, " 1073 "outerAttrs: %d, mtype: %d, isStage2: %d\n", 1074 te->shareable, te->innerAttrs, te->outerAttrs, 1075 static_cast<uint8_t>(te->mtype), isStage2); 1076 setAttr(te->attributes); 1077 1078 if (te->nonCacheable) 1079 req->setFlags(Request::UNCACHEABLE); 1080 1081 // Require requests to be ordered if the request goes to 1082 // strongly ordered or device memory (i.e., anything other 1083 // than normal memory requires strict order). 1084 if (te->mtype != TlbEntry::MemoryType::Normal) 1085 req->setFlags(Request::STRICT_ORDER); 1086 1087 Addr pa = te->pAddr(vaddr); 1088 req->setPaddr(pa); 1089 1090 if (isSecure && !te->ns) { 1091 req->setFlags(Request::SECURE); 1092 } 1093 if ((!is_fetch) && (vaddr & mask(flags & AlignmentMask)) && 1094 (te->mtype != TlbEntry::MemoryType::Normal)) { 1095 // Unaligned accesses to Device memory should always cause an 1096 // abort regardless of sctlr.a 1097 alignFaults++; 1098 return std::make_shared<DataAbort>( 1099 vaddr_tainted, 1100 TlbEntry::DomainType::NoAccess, is_write, 1101 ArmFault::AlignmentFault, isStage2, 1102 tranMethod); 1103 } 1104 1105 // Check for a trickbox generated address fault 1106 if (fault == NoFault) { 1107 fault = trickBoxCheck(req, mode, te->domain); 1108 } 1109 } 1110 1111 // Generate Illegal Inst Set State fault if IL bit is set in CPSR 1112 if (fault == NoFault) { 1113 if (aarch64 && is_fetch && cpsr.il == 1) { 1114 return std::make_shared<IllegalInstSetStateFault>(); 1115 } 1116 } 1117 1118 return fault; 1119} 1120 1121Fault 1122TLB::translateAtomic(RequestPtr req, ThreadContext *tc, Mode mode, 1123 TLB::ArmTranslationType tranType) 1124{ 1125 updateMiscReg(tc, tranType); 1126 1127 if (directToStage2) { 1128 assert(stage2Tlb); 1129 return stage2Tlb->translateAtomic(req, tc, mode, tranType); 1130 } 1131 1132 bool delay = false; 1133 Fault fault; 1134 if (FullSystem) 1135 fault = translateFs(req, tc, mode, NULL, delay, false, tranType); 1136 else 1137 fault = translateSe(req, tc, mode, NULL, delay, false); 1138 assert(!delay); 1139 return fault; 1140} 1141 1142Fault 1143TLB::translateFunctional(RequestPtr req, ThreadContext *tc, Mode mode, 1144 TLB::ArmTranslationType tranType) 1145{ 1146 updateMiscReg(tc, tranType); 1147 1148 if (directToStage2) { 1149 assert(stage2Tlb); 1150 return stage2Tlb->translateFunctional(req, tc, mode, tranType); 1151 } 1152 1153 bool delay = false; 1154 Fault fault; 1155 if (FullSystem) 1156 fault = translateFs(req, tc, mode, NULL, delay, false, tranType, true); 1157 else 1158 fault = translateSe(req, tc, mode, NULL, delay, false); 1159 assert(!delay); 1160 return fault; 1161} 1162 1163Fault 1164TLB::translateTiming(RequestPtr req, ThreadContext *tc, 1165 Translation *translation, Mode mode, TLB::ArmTranslationType tranType) 1166{ 1167 updateMiscReg(tc, tranType); 1168 1169 if (directToStage2) { 1170 assert(stage2Tlb); 1171 return stage2Tlb->translateTiming(req, tc, translation, mode, tranType); 1172 } 1173 1174 assert(translation); 1175 1176 return translateComplete(req, tc, translation, mode, tranType, isStage2); 1177} 1178 1179Fault 1180TLB::translateComplete(RequestPtr req, ThreadContext *tc, 1181 Translation *translation, Mode mode, TLB::ArmTranslationType tranType, 1182 bool callFromS2) 1183{ 1184 bool delay = false; 1185 Fault fault; 1186 if (FullSystem) 1187 fault = translateFs(req, tc, mode, translation, delay, true, tranType); 1188 else 1189 fault = translateSe(req, tc, mode, translation, delay, true); 1190 DPRINTF(TLBVerbose, "Translation returning delay=%d fault=%d\n", delay, fault != 1191 NoFault); 1192 // If we have a translation, and we're not in the middle of doing a stage 1193 // 2 translation tell the translation that we've either finished or its 1194 // going to take a while. By not doing this when we're in the middle of a 1195 // stage 2 translation we prevent marking the translation as delayed twice, 1196 // one when the translation starts and again when the stage 1 translation 1197 // completes. 1198 if (translation && (callFromS2 || !stage2Req || req->hasPaddr() || fault != NoFault)) { 1199 if (!delay) 1200 translation->finish(fault, req, tc, mode); 1201 else 1202 translation->markDelayed(); 1203 } 1204 return fault; 1205} 1206 1207BaseMasterPort* 1208TLB::getMasterPort() 1209{ 1210 return &stage2Mmu->getPort(); 1211} 1212 1213void 1214TLB::updateMiscReg(ThreadContext *tc, ArmTranslationType tranType) 1215{ 1216 // check if the regs have changed, or the translation mode is different. 1217 // NOTE: the tran type doesn't affect stage 2 TLB's as they only handle 1218 // one type of translation anyway 1219 if (miscRegValid && ((tranType == curTranType) || isStage2)) { 1220 return; 1221 } 1222 1223 DPRINTF(TLBVerbose, "TLB variables changed!\n"); 1224 cpsr = tc->readMiscReg(MISCREG_CPSR); 1225 // Dependencies: SCR/SCR_EL3, CPSR 1226 isSecure = inSecureState(tc); 1227 isSecure &= (tranType & HypMode) == 0; 1228 isSecure &= (tranType & S1S2NsTran) == 0; 1229 aarch64 = !cpsr.width; 1230 if (aarch64) { // AArch64 1231 aarch64EL = (ExceptionLevel) (uint8_t) cpsr.el; 1232 switch (aarch64EL) { 1233 case EL0: 1234 case EL1: 1235 { 1236 sctlr = tc->readMiscReg(MISCREG_SCTLR_EL1); 1237 ttbcr = tc->readMiscReg(MISCREG_TCR_EL1); 1238 uint64_t ttbr_asid = ttbcr.a1 ? 1239 tc->readMiscReg(MISCREG_TTBR1_EL1) : 1240 tc->readMiscReg(MISCREG_TTBR0_EL1); 1241 asid = bits(ttbr_asid, 1242 (haveLargeAsid64 && ttbcr.as) ? 63 : 55, 48); 1243 } 1244 break; 1245 case EL2: 1246 sctlr = tc->readMiscReg(MISCREG_SCTLR_EL2); 1247 ttbcr = tc->readMiscReg(MISCREG_TCR_EL2); 1248 asid = -1; 1249 break; 1250 case EL3: 1251 sctlr = tc->readMiscReg(MISCREG_SCTLR_EL3); 1252 ttbcr = tc->readMiscReg(MISCREG_TCR_EL3); 1253 asid = -1; 1254 break; 1255 } 1256 scr = tc->readMiscReg(MISCREG_SCR_EL3); 1257 isPriv = aarch64EL != EL0; 1258 // @todo: modify this behaviour to support Virtualization in 1259 // AArch64 1260 vmid = 0; 1261 isHyp = false; 1262 directToStage2 = false; 1263 stage2Req = false; 1264 } else { // AArch32 1265 sctlr = tc->readMiscReg(flattenMiscRegNsBanked(MISCREG_SCTLR, tc, 1266 !isSecure)); 1267 ttbcr = tc->readMiscReg(flattenMiscRegNsBanked(MISCREG_TTBCR, tc, 1268 !isSecure)); 1269 scr = tc->readMiscReg(MISCREG_SCR); 1270 isPriv = cpsr.mode != MODE_USER; 1271 if (haveLPAE && ttbcr.eae) { 1272 // Long-descriptor translation table format in use 1273 uint64_t ttbr_asid = tc->readMiscReg( 1274 flattenMiscRegNsBanked(ttbcr.a1 ? MISCREG_TTBR1 1275 : MISCREG_TTBR0, 1276 tc, !isSecure)); 1277 asid = bits(ttbr_asid, 55, 48); 1278 } else { 1279 // Short-descriptor translation table format in use 1280 CONTEXTIDR context_id = tc->readMiscReg(flattenMiscRegNsBanked( 1281 MISCREG_CONTEXTIDR, tc,!isSecure)); 1282 asid = context_id.asid; 1283 } 1284 prrr = tc->readMiscReg(flattenMiscRegNsBanked(MISCREG_PRRR, tc, 1285 !isSecure)); 1286 nmrr = tc->readMiscReg(flattenMiscRegNsBanked(MISCREG_NMRR, tc, 1287 !isSecure)); 1288 dacr = tc->readMiscReg(flattenMiscRegNsBanked(MISCREG_DACR, tc, 1289 !isSecure)); 1290 hcr = tc->readMiscReg(MISCREG_HCR); 1291 1292 if (haveVirtualization) { 1293 vmid = bits(tc->readMiscReg(MISCREG_VTTBR), 55, 48); 1294 isHyp = cpsr.mode == MODE_HYP; 1295 isHyp |= tranType & HypMode; 1296 isHyp &= (tranType & S1S2NsTran) == 0; 1297 isHyp &= (tranType & S1CTran) == 0; 1298 if (isHyp) { 1299 sctlr = tc->readMiscReg(MISCREG_HSCTLR); 1300 } 1301 // Work out if we should skip the first stage of translation and go 1302 // directly to stage 2. This value is cached so we don't have to 1303 // compute it for every translation. 1304 stage2Req = hcr.vm && !isStage2 && !isHyp && !isSecure && 1305 !(tranType & S1CTran); 1306 directToStage2 = stage2Req && !sctlr.m; 1307 } else { 1308 vmid = 0; 1309 stage2Req = false; 1310 isHyp = false; 1311 directToStage2 = false; 1312 } 1313 } 1314 miscRegValid = true; 1315 curTranType = tranType; 1316} 1317 1318Fault 1319TLB::getTE(TlbEntry **te, RequestPtr req, ThreadContext *tc, Mode mode, 1320 Translation *translation, bool timing, bool functional, 1321 bool is_secure, TLB::ArmTranslationType tranType) 1322{ 1323 bool is_fetch = (mode == Execute); 1324 bool is_write = (mode == Write); 1325 1326 Addr vaddr_tainted = req->getVaddr(); 1327 Addr vaddr = 0; 1328 ExceptionLevel target_el = aarch64 ? aarch64EL : EL1; 1329 if (aarch64) { 1330 vaddr = purifyTaggedAddr(vaddr_tainted, tc, target_el, ttbcr); 1331 } else { 1332 vaddr = vaddr_tainted; 1333 } 1334 *te = lookup(vaddr, asid, vmid, isHyp, is_secure, false, false, target_el); 1335 if (*te == NULL) { 1336 if (req->isPrefetch()) { 1337 // if the request is a prefetch don't attempt to fill the TLB or go 1338 // any further with the memory access (here we can safely use the 1339 // fault status for the short desc. format in all cases) 1340 prefetchFaults++; 1341 return std::make_shared<PrefetchAbort>( 1342 vaddr_tainted, ArmFault::PrefetchTLBMiss, isStage2); 1343 } 1344 1345 if (is_fetch) 1346 instMisses++; 1347 else if (is_write) 1348 writeMisses++; 1349 else 1350 readMisses++; 1351 1352 // start translation table walk, pass variables rather than 1353 // re-retreaving in table walker for speed 1354 DPRINTF(TLB, "TLB Miss: Starting hardware table walker for %#x(%d:%d)\n", 1355 vaddr_tainted, asid, vmid); 1356 Fault fault; 1357 fault = tableWalker->walk(req, tc, asid, vmid, isHyp, mode, 1358 translation, timing, functional, is_secure, 1359 tranType); 1360 // for timing mode, return and wait for table walk, 1361 if (timing || fault != NoFault) { 1362 return fault; 1363 } 1364 1365 *te = lookup(vaddr, asid, vmid, isHyp, is_secure, false, false, target_el); 1366 if (!*te) 1367 printTlb(); 1368 assert(*te); 1369 } else { 1370 if (is_fetch) 1371 instHits++; 1372 else if (is_write) 1373 writeHits++; 1374 else 1375 readHits++; 1376 } 1377 return NoFault; 1378} 1379 1380Fault 1381TLB::getResultTe(TlbEntry **te, RequestPtr req, ThreadContext *tc, Mode mode, 1382 Translation *translation, bool timing, bool functional, 1383 TlbEntry *mergeTe) 1384{ 1385 Fault fault; 1386 TlbEntry *s1Te = NULL; 1387 1388 Addr vaddr_tainted = req->getVaddr(); 1389 1390 // Get the stage 1 table entry 1391 fault = getTE(&s1Te, req, tc, mode, translation, timing, functional, 1392 isSecure, curTranType); 1393 // only proceed if we have a valid table entry 1394 if ((s1Te != NULL) && (fault == NoFault)) { 1395 // Check stage 1 permissions before checking stage 2 1396 if (aarch64) 1397 fault = checkPermissions64(s1Te, req, mode, tc); 1398 else 1399 fault = checkPermissions(s1Te, req, mode); 1400 if (stage2Req & (fault == NoFault)) { 1401 Stage2LookUp *s2Lookup = new Stage2LookUp(this, stage2Tlb, *s1Te, 1402 req, translation, mode, timing, functional, curTranType); 1403 fault = s2Lookup->getTe(tc, mergeTe); 1404 if (s2Lookup->isComplete()) { 1405 *te = mergeTe; 1406 // We've finished with the lookup so delete it 1407 delete s2Lookup; 1408 } else { 1409 // The lookup hasn't completed, so we can't delete it now. We 1410 // get round this by asking the object to self delete when the 1411 // translation is complete. 1412 s2Lookup->setSelfDelete(); 1413 } 1414 } else { 1415 // This case deals with an S1 hit (or bypass), followed by 1416 // an S2 hit-but-perms issue 1417 if (isStage2) { 1418 DPRINTF(TLBVerbose, "s2TLB: reqVa %#x, reqPa %#x, fault %p\n", 1419 vaddr_tainted, req->hasPaddr() ? req->getPaddr() : ~0, fault); 1420 if (fault != NoFault) { 1421 ArmFault *armFault = reinterpret_cast<ArmFault *>(fault.get()); 1422 armFault->annotate(ArmFault::S1PTW, false); 1423 armFault->annotate(ArmFault::OVA, vaddr_tainted); 1424 } 1425 } 1426 *te = s1Te; 1427 } 1428 } 1429 return fault; 1430} 1431 1432ArmISA::TLB * 1433ArmTLBParams::create() 1434{ 1435 return new ArmISA::TLB(this); 1436} 1437