tlb.cc revision 11793:ef606668d247
1/* 2 * Copyright (c) 2010-2013, 2016 ARM Limited 3 * All rights reserved 4 * 5 * The license below extends only to copyright in the software and shall 6 * not be construed as granting a license to any other intellectual 7 * property including but not limited to intellectual property relating 8 * to a hardware implementation of the functionality of the software 9 * licensed hereunder. You may use the software subject to the license 10 * terms below provided that you ensure that this notice is replicated 11 * unmodified and in its entirety in all distributions of the software, 12 * modified or unmodified, in source code or in binary form. 13 * 14 * Copyright (c) 2001-2005 The Regents of The University of Michigan 15 * All rights reserved. 16 * 17 * Redistribution and use in source and binary forms, with or without 18 * modification, are permitted provided that the following conditions are 19 * met: redistributions of source code must retain the above copyright 20 * notice, this list of conditions and the following disclaimer; 21 * redistributions in binary form must reproduce the above copyright 22 * notice, this list of conditions and the following disclaimer in the 23 * documentation and/or other materials provided with the distribution; 24 * neither the name of the copyright holders nor the names of its 25 * contributors may be used to endorse or promote products derived from 26 * this software without specific prior written permission. 27 * 28 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 29 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 30 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR 31 * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT 32 * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 33 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT 34 * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 35 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 36 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 37 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE 38 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 39 * 40 * Authors: Ali Saidi 41 * Nathan Binkert 42 * Steve Reinhardt 43 */ 44 45#include "arch/arm/tlb.hh" 46 47#include <memory> 48#include <string> 49#include <vector> 50 51#include "arch/arm/faults.hh" 52#include "arch/arm/pagetable.hh" 53#include "arch/arm/stage2_lookup.hh" 54#include "arch/arm/stage2_mmu.hh" 55#include "arch/arm/system.hh" 56#include "arch/arm/table_walker.hh" 57#include "arch/arm/utility.hh" 58#include "base/inifile.hh" 59#include "base/str.hh" 60#include "base/trace.hh" 61#include "cpu/base.hh" 62#include "cpu/thread_context.hh" 63#include "debug/Checkpoint.hh" 64#include "debug/TLB.hh" 65#include "debug/TLBVerbose.hh" 66#include "mem/page_table.hh" 67#include "mem/request.hh" 68#include "params/ArmTLB.hh" 69#include "sim/full_system.hh" 70#include "sim/process.hh" 71 72using namespace std; 73using namespace ArmISA; 74 75TLB::TLB(const ArmTLBParams *p) 76 : BaseTLB(p), table(new TlbEntry[p->size]), size(p->size), 77 isStage2(p->is_stage2), stage2Req(false), _attr(0), 78 directToStage2(false), tableWalker(p->walker), stage2Tlb(NULL), 79 stage2Mmu(NULL), test(nullptr), rangeMRU(1), 80 aarch64(false), aarch64EL(EL0), isPriv(false), isSecure(false), 81 isHyp(false), asid(0), vmid(0), dacr(0), 82 miscRegValid(false), miscRegContext(0), curTranType(NormalTran) 83{ 84 tableWalker->setTlb(this); 85 86 // Cache system-level properties 87 haveLPAE = tableWalker->haveLPAE(); 88 haveVirtualization = tableWalker->haveVirtualization(); 89 haveLargeAsid64 = tableWalker->haveLargeAsid64(); 90} 91 92TLB::~TLB() 93{ 94 delete[] table; 95} 96 97void 98TLB::init() 99{ 100 if (stage2Mmu && !isStage2) 101 stage2Tlb = stage2Mmu->stage2Tlb(); 102} 103 104void 105TLB::setMMU(Stage2MMU *m, MasterID master_id) 106{ 107 stage2Mmu = m; 108 tableWalker->setMMU(m, master_id); 109} 110 111bool 112TLB::translateFunctional(ThreadContext *tc, Addr va, Addr &pa) 113{ 114 updateMiscReg(tc); 115 116 if (directToStage2) { 117 assert(stage2Tlb); 118 return stage2Tlb->translateFunctional(tc, va, pa); 119 } 120 121 TlbEntry *e = lookup(va, asid, vmid, isHyp, isSecure, true, false, 122 aarch64 ? aarch64EL : EL1); 123 if (!e) 124 return false; 125 pa = e->pAddr(va); 126 return true; 127} 128 129Fault 130TLB::finalizePhysical(RequestPtr req, ThreadContext *tc, Mode mode) const 131{ 132 return NoFault; 133} 134 135TlbEntry* 136TLB::lookup(Addr va, uint16_t asn, uint8_t vmid, bool hyp, bool secure, 137 bool functional, bool ignore_asn, uint8_t target_el) 138{ 139 140 TlbEntry *retval = NULL; 141 142 // Maintaining LRU array 143 int x = 0; 144 while (retval == NULL && x < size) { 145 if ((!ignore_asn && table[x].match(va, asn, vmid, hyp, secure, false, 146 target_el)) || 147 (ignore_asn && table[x].match(va, vmid, hyp, secure, target_el))) { 148 // We only move the hit entry ahead when the position is higher 149 // than rangeMRU 150 if (x > rangeMRU && !functional) { 151 TlbEntry tmp_entry = table[x]; 152 for (int i = x; i > 0; i--) 153 table[i] = table[i - 1]; 154 table[0] = tmp_entry; 155 retval = &table[0]; 156 } else { 157 retval = &table[x]; 158 } 159 break; 160 } 161 ++x; 162 } 163 164 DPRINTF(TLBVerbose, "Lookup %#x, asn %#x -> %s vmn 0x%x hyp %d secure %d " 165 "ppn %#x size: %#x pa: %#x ap:%d ns:%d nstid:%d g:%d asid: %d " 166 "el: %d\n", 167 va, asn, retval ? "hit" : "miss", vmid, hyp, secure, 168 retval ? retval->pfn : 0, retval ? retval->size : 0, 169 retval ? retval->pAddr(va) : 0, retval ? retval->ap : 0, 170 retval ? retval->ns : 0, retval ? retval->nstid : 0, 171 retval ? retval->global : 0, retval ? retval->asid : 0, 172 retval ? retval->el : 0); 173 174 return retval; 175} 176 177// insert a new TLB entry 178void 179TLB::insert(Addr addr, TlbEntry &entry) 180{ 181 DPRINTF(TLB, "Inserting entry into TLB with pfn:%#x size:%#x vpn: %#x" 182 " asid:%d vmid:%d N:%d global:%d valid:%d nc:%d xn:%d" 183 " ap:%#x domain:%#x ns:%d nstid:%d isHyp:%d\n", entry.pfn, 184 entry.size, entry.vpn, entry.asid, entry.vmid, entry.N, 185 entry.global, entry.valid, entry.nonCacheable, entry.xn, 186 entry.ap, static_cast<uint8_t>(entry.domain), entry.ns, entry.nstid, 187 entry.isHyp); 188 189 if (table[size - 1].valid) 190 DPRINTF(TLB, " - Replacing Valid entry %#x, asn %d vmn %d ppn %#x " 191 "size: %#x ap:%d ns:%d nstid:%d g:%d isHyp:%d el: %d\n", 192 table[size-1].vpn << table[size-1].N, table[size-1].asid, 193 table[size-1].vmid, table[size-1].pfn << table[size-1].N, 194 table[size-1].size, table[size-1].ap, table[size-1].ns, 195 table[size-1].nstid, table[size-1].global, table[size-1].isHyp, 196 table[size-1].el); 197 198 //inserting to MRU position and evicting the LRU one 199 200 for (int i = size - 1; i > 0; --i) 201 table[i] = table[i-1]; 202 table[0] = entry; 203 204 inserts++; 205 ppRefills->notify(1); 206} 207 208void 209TLB::printTlb() const 210{ 211 int x = 0; 212 TlbEntry *te; 213 DPRINTF(TLB, "Current TLB contents:\n"); 214 while (x < size) { 215 te = &table[x]; 216 if (te->valid) 217 DPRINTF(TLB, " * %s\n", te->print()); 218 ++x; 219 } 220} 221 222void 223TLB::flushAllSecurity(bool secure_lookup, uint8_t target_el, bool ignore_el) 224{ 225 DPRINTF(TLB, "Flushing all TLB entries (%s lookup)\n", 226 (secure_lookup ? "secure" : "non-secure")); 227 int x = 0; 228 TlbEntry *te; 229 while (x < size) { 230 te = &table[x]; 231 if (te->valid && secure_lookup == !te->nstid && 232 (te->vmid == vmid || secure_lookup) && 233 checkELMatch(target_el, te->el, ignore_el)) { 234 235 DPRINTF(TLB, " - %s\n", te->print()); 236 te->valid = false; 237 flushedEntries++; 238 } 239 ++x; 240 } 241 242 flushTlb++; 243 244 // If there's a second stage TLB (and we're not it) then flush it as well 245 // if we're currently in hyp mode 246 if (!isStage2 && isHyp) { 247 stage2Tlb->flushAllSecurity(secure_lookup, true); 248 } 249} 250 251void 252TLB::flushAllNs(bool hyp, uint8_t target_el, bool ignore_el) 253{ 254 DPRINTF(TLB, "Flushing all NS TLB entries (%s lookup)\n", 255 (hyp ? "hyp" : "non-hyp")); 256 int x = 0; 257 TlbEntry *te; 258 while (x < size) { 259 te = &table[x]; 260 if (te->valid && te->nstid && te->isHyp == hyp && 261 checkELMatch(target_el, te->el, ignore_el)) { 262 263 DPRINTF(TLB, " - %s\n", te->print()); 264 flushedEntries++; 265 te->valid = false; 266 } 267 ++x; 268 } 269 270 flushTlb++; 271 272 // If there's a second stage TLB (and we're not it) then flush it as well 273 if (!isStage2 && !hyp) { 274 stage2Tlb->flushAllNs(false, true); 275 } 276} 277 278void 279TLB::flushMvaAsid(Addr mva, uint64_t asn, bool secure_lookup, uint8_t target_el) 280{ 281 DPRINTF(TLB, "Flushing TLB entries with mva: %#x, asid: %#x " 282 "(%s lookup)\n", mva, asn, (secure_lookup ? 283 "secure" : "non-secure")); 284 _flushMva(mva, asn, secure_lookup, false, false, target_el); 285 flushTlbMvaAsid++; 286} 287 288void 289TLB::flushAsid(uint64_t asn, bool secure_lookup, uint8_t target_el) 290{ 291 DPRINTF(TLB, "Flushing TLB entries with asid: %#x (%s lookup)\n", asn, 292 (secure_lookup ? "secure" : "non-secure")); 293 294 int x = 0 ; 295 TlbEntry *te; 296 297 while (x < size) { 298 te = &table[x]; 299 if (te->valid && te->asid == asn && secure_lookup == !te->nstid && 300 (te->vmid == vmid || secure_lookup) && 301 checkELMatch(target_el, te->el, false)) { 302 303 te->valid = false; 304 DPRINTF(TLB, " - %s\n", te->print()); 305 flushedEntries++; 306 } 307 ++x; 308 } 309 flushTlbAsid++; 310} 311 312void 313TLB::flushMva(Addr mva, bool secure_lookup, bool hyp, uint8_t target_el) 314{ 315 DPRINTF(TLB, "Flushing TLB entries with mva: %#x (%s lookup)\n", mva, 316 (secure_lookup ? "secure" : "non-secure")); 317 _flushMva(mva, 0xbeef, secure_lookup, hyp, true, target_el); 318 flushTlbMva++; 319} 320 321void 322TLB::_flushMva(Addr mva, uint64_t asn, bool secure_lookup, bool hyp, 323 bool ignore_asn, uint8_t target_el) 324{ 325 TlbEntry *te; 326 // D5.7.2: Sign-extend address to 64 bits 327 mva = sext<56>(mva); 328 te = lookup(mva, asn, vmid, hyp, secure_lookup, false, ignore_asn, 329 target_el); 330 while (te != NULL) { 331 if (secure_lookup == !te->nstid) { 332 DPRINTF(TLB, " - %s\n", te->print()); 333 te->valid = false; 334 flushedEntries++; 335 } 336 te = lookup(mva, asn, vmid, hyp, secure_lookup, false, ignore_asn, 337 target_el); 338 } 339} 340 341void 342TLB::flushIpaVmid(Addr ipa, bool secure_lookup, bool hyp, uint8_t target_el) 343{ 344 assert(!isStage2); 345 stage2Tlb->_flushMva(ipa, 0xbeef, secure_lookup, hyp, true, target_el); 346} 347 348bool 349TLB::checkELMatch(uint8_t target_el, uint8_t tentry_el, bool ignore_el) 350{ 351 bool elMatch = true; 352 if (!ignore_el) { 353 if (target_el == 2 || target_el == 3) { 354 elMatch = (tentry_el == target_el); 355 } else { 356 elMatch = (tentry_el == 0) || (tentry_el == 1); 357 } 358 } 359 return elMatch; 360} 361 362void 363TLB::drainResume() 364{ 365 // We might have unserialized something or switched CPUs, so make 366 // sure to re-read the misc regs. 367 miscRegValid = false; 368} 369 370void 371TLB::takeOverFrom(BaseTLB *_otlb) 372{ 373 TLB *otlb = dynamic_cast<TLB*>(_otlb); 374 /* Make sure we actually have a valid type */ 375 if (otlb) { 376 _attr = otlb->_attr; 377 haveLPAE = otlb->haveLPAE; 378 directToStage2 = otlb->directToStage2; 379 stage2Req = otlb->stage2Req; 380 381 /* Sync the stage2 MMU if they exist in both 382 * the old CPU and the new 383 */ 384 if (!isStage2 && 385 stage2Tlb && otlb->stage2Tlb) { 386 stage2Tlb->takeOverFrom(otlb->stage2Tlb); 387 } 388 } else { 389 panic("Incompatible TLB type!"); 390 } 391} 392 393void 394TLB::serialize(CheckpointOut &cp) const 395{ 396 DPRINTF(Checkpoint, "Serializing Arm TLB\n"); 397 398 SERIALIZE_SCALAR(_attr); 399 SERIALIZE_SCALAR(haveLPAE); 400 SERIALIZE_SCALAR(directToStage2); 401 SERIALIZE_SCALAR(stage2Req); 402 403 int num_entries = size; 404 SERIALIZE_SCALAR(num_entries); 405 for (int i = 0; i < size; i++) 406 table[i].serializeSection(cp, csprintf("TlbEntry%d", i)); 407} 408 409void 410TLB::unserialize(CheckpointIn &cp) 411{ 412 DPRINTF(Checkpoint, "Unserializing Arm TLB\n"); 413 414 UNSERIALIZE_SCALAR(_attr); 415 UNSERIALIZE_SCALAR(haveLPAE); 416 UNSERIALIZE_SCALAR(directToStage2); 417 UNSERIALIZE_SCALAR(stage2Req); 418 419 int num_entries; 420 UNSERIALIZE_SCALAR(num_entries); 421 for (int i = 0; i < min(size, num_entries); i++) 422 table[i].unserializeSection(cp, csprintf("TlbEntry%d", i)); 423} 424 425void 426TLB::regStats() 427{ 428 BaseTLB::regStats(); 429 instHits 430 .name(name() + ".inst_hits") 431 .desc("ITB inst hits") 432 ; 433 434 instMisses 435 .name(name() + ".inst_misses") 436 .desc("ITB inst misses") 437 ; 438 439 instAccesses 440 .name(name() + ".inst_accesses") 441 .desc("ITB inst accesses") 442 ; 443 444 readHits 445 .name(name() + ".read_hits") 446 .desc("DTB read hits") 447 ; 448 449 readMisses 450 .name(name() + ".read_misses") 451 .desc("DTB read misses") 452 ; 453 454 readAccesses 455 .name(name() + ".read_accesses") 456 .desc("DTB read accesses") 457 ; 458 459 writeHits 460 .name(name() + ".write_hits") 461 .desc("DTB write hits") 462 ; 463 464 writeMisses 465 .name(name() + ".write_misses") 466 .desc("DTB write misses") 467 ; 468 469 writeAccesses 470 .name(name() + ".write_accesses") 471 .desc("DTB write accesses") 472 ; 473 474 hits 475 .name(name() + ".hits") 476 .desc("DTB hits") 477 ; 478 479 misses 480 .name(name() + ".misses") 481 .desc("DTB misses") 482 ; 483 484 accesses 485 .name(name() + ".accesses") 486 .desc("DTB accesses") 487 ; 488 489 flushTlb 490 .name(name() + ".flush_tlb") 491 .desc("Number of times complete TLB was flushed") 492 ; 493 494 flushTlbMva 495 .name(name() + ".flush_tlb_mva") 496 .desc("Number of times TLB was flushed by MVA") 497 ; 498 499 flushTlbMvaAsid 500 .name(name() + ".flush_tlb_mva_asid") 501 .desc("Number of times TLB was flushed by MVA & ASID") 502 ; 503 504 flushTlbAsid 505 .name(name() + ".flush_tlb_asid") 506 .desc("Number of times TLB was flushed by ASID") 507 ; 508 509 flushedEntries 510 .name(name() + ".flush_entries") 511 .desc("Number of entries that have been flushed from TLB") 512 ; 513 514 alignFaults 515 .name(name() + ".align_faults") 516 .desc("Number of TLB faults due to alignment restrictions") 517 ; 518 519 prefetchFaults 520 .name(name() + ".prefetch_faults") 521 .desc("Number of TLB faults due to prefetch") 522 ; 523 524 domainFaults 525 .name(name() + ".domain_faults") 526 .desc("Number of TLB faults due to domain restrictions") 527 ; 528 529 permsFaults 530 .name(name() + ".perms_faults") 531 .desc("Number of TLB faults due to permissions restrictions") 532 ; 533 534 instAccesses = instHits + instMisses; 535 readAccesses = readHits + readMisses; 536 writeAccesses = writeHits + writeMisses; 537 hits = readHits + writeHits + instHits; 538 misses = readMisses + writeMisses + instMisses; 539 accesses = readAccesses + writeAccesses + instAccesses; 540} 541 542void 543TLB::regProbePoints() 544{ 545 ppRefills.reset(new ProbePoints::PMU(getProbeManager(), "Refills")); 546} 547 548Fault 549TLB::translateSe(RequestPtr req, ThreadContext *tc, Mode mode, 550 Translation *translation, bool &delay, bool timing) 551{ 552 updateMiscReg(tc); 553 Addr vaddr_tainted = req->getVaddr(); 554 Addr vaddr = 0; 555 if (aarch64) 556 vaddr = purifyTaggedAddr(vaddr_tainted, tc, aarch64EL, ttbcr); 557 else 558 vaddr = vaddr_tainted; 559 Request::Flags flags = req->getFlags(); 560 561 bool is_fetch = (mode == Execute); 562 bool is_write = (mode == Write); 563 564 if (!is_fetch) { 565 assert(flags & MustBeOne); 566 if (sctlr.a || !(flags & AllowUnaligned)) { 567 if (vaddr & mask(flags & AlignmentMask)) { 568 // LPAE is always disabled in SE mode 569 return std::make_shared<DataAbort>( 570 vaddr_tainted, 571 TlbEntry::DomainType::NoAccess, is_write, 572 ArmFault::AlignmentFault, isStage2, 573 ArmFault::VmsaTran); 574 } 575 } 576 } 577 578 Addr paddr; 579 Process *p = tc->getProcessPtr(); 580 581 if (!p->pTable->translate(vaddr, paddr)) 582 return std::make_shared<GenericPageTableFault>(vaddr_tainted); 583 req->setPaddr(paddr); 584 585 return NoFault; 586} 587 588Fault 589TLB::checkPermissions(TlbEntry *te, RequestPtr req, Mode mode) 590{ 591 Addr vaddr = req->getVaddr(); // 32-bit don't have to purify 592 Request::Flags flags = req->getFlags(); 593 bool is_fetch = (mode == Execute); 594 bool is_write = (mode == Write); 595 bool is_priv = isPriv && !(flags & UserMode); 596 597 // Get the translation type from the actuall table entry 598 ArmFault::TranMethod tranMethod = te->longDescFormat ? ArmFault::LpaeTran 599 : ArmFault::VmsaTran; 600 601 // If this is the second stage of translation and the request is for a 602 // stage 1 page table walk then we need to check the HCR.PTW bit. This 603 // allows us to generate a fault if the request targets an area marked 604 // as a device or strongly ordered. 605 if (isStage2 && req->isPTWalk() && hcr.ptw && 606 (te->mtype != TlbEntry::MemoryType::Normal)) { 607 return std::make_shared<DataAbort>( 608 vaddr, te->domain, is_write, 609 ArmFault::PermissionLL + te->lookupLevel, 610 isStage2, tranMethod); 611 } 612 613 // Generate an alignment fault for unaligned data accesses to device or 614 // strongly ordered memory 615 if (!is_fetch) { 616 if (te->mtype != TlbEntry::MemoryType::Normal) { 617 if (vaddr & mask(flags & AlignmentMask)) { 618 alignFaults++; 619 return std::make_shared<DataAbort>( 620 vaddr, TlbEntry::DomainType::NoAccess, is_write, 621 ArmFault::AlignmentFault, isStage2, 622 tranMethod); 623 } 624 } 625 } 626 627 if (te->nonCacheable) { 628 // Prevent prefetching from I/O devices. 629 if (req->isPrefetch()) { 630 // Here we can safely use the fault status for the short 631 // desc. format in all cases 632 return std::make_shared<PrefetchAbort>( 633 vaddr, ArmFault::PrefetchUncacheable, 634 isStage2, tranMethod); 635 } 636 } 637 638 if (!te->longDescFormat) { 639 switch ((dacr >> (static_cast<uint8_t>(te->domain) * 2)) & 0x3) { 640 case 0: 641 domainFaults++; 642 DPRINTF(TLB, "TLB Fault: Data abort on domain. DACR: %#x" 643 " domain: %#x write:%d\n", dacr, 644 static_cast<uint8_t>(te->domain), is_write); 645 if (is_fetch) 646 return std::make_shared<PrefetchAbort>( 647 vaddr, 648 ArmFault::DomainLL + te->lookupLevel, 649 isStage2, tranMethod); 650 else 651 return std::make_shared<DataAbort>( 652 vaddr, te->domain, is_write, 653 ArmFault::DomainLL + te->lookupLevel, 654 isStage2, tranMethod); 655 case 1: 656 // Continue with permissions check 657 break; 658 case 2: 659 panic("UNPRED domain\n"); 660 case 3: 661 return NoFault; 662 } 663 } 664 665 // The 'ap' variable is AP[2:0] or {AP[2,1],1b'0}, i.e. always three bits 666 uint8_t ap = te->longDescFormat ? te->ap << 1 : te->ap; 667 uint8_t hap = te->hap; 668 669 if (sctlr.afe == 1 || te->longDescFormat) 670 ap |= 1; 671 672 bool abt; 673 bool isWritable = true; 674 // If this is a stage 2 access (eg for reading stage 1 page table entries) 675 // then don't perform the AP permissions check, we stil do the HAP check 676 // below. 677 if (isStage2) { 678 abt = false; 679 } else { 680 switch (ap) { 681 case 0: 682 DPRINTF(TLB, "Access permissions 0, checking rs:%#x\n", 683 (int)sctlr.rs); 684 if (!sctlr.xp) { 685 switch ((int)sctlr.rs) { 686 case 2: 687 abt = is_write; 688 break; 689 case 1: 690 abt = is_write || !is_priv; 691 break; 692 case 0: 693 case 3: 694 default: 695 abt = true; 696 break; 697 } 698 } else { 699 abt = true; 700 } 701 break; 702 case 1: 703 abt = !is_priv; 704 break; 705 case 2: 706 abt = !is_priv && is_write; 707 isWritable = is_priv; 708 break; 709 case 3: 710 abt = false; 711 break; 712 case 4: 713 panic("UNPRED premissions\n"); 714 case 5: 715 abt = !is_priv || is_write; 716 isWritable = false; 717 break; 718 case 6: 719 case 7: 720 abt = is_write; 721 isWritable = false; 722 break; 723 default: 724 panic("Unknown permissions %#x\n", ap); 725 } 726 } 727 728 bool hapAbt = is_write ? !(hap & 2) : !(hap & 1); 729 bool xn = te->xn || (isWritable && sctlr.wxn) || 730 (ap == 3 && sctlr.uwxn && is_priv); 731 if (is_fetch && (abt || xn || 732 (te->longDescFormat && te->pxn && is_priv) || 733 (isSecure && te->ns && scr.sif))) { 734 permsFaults++; 735 DPRINTF(TLB, "TLB Fault: Prefetch abort on permission check. AP:%d " 736 "priv:%d write:%d ns:%d sif:%d sctlr.afe: %d \n", 737 ap, is_priv, is_write, te->ns, scr.sif,sctlr.afe); 738 return std::make_shared<PrefetchAbort>( 739 vaddr, 740 ArmFault::PermissionLL + te->lookupLevel, 741 isStage2, tranMethod); 742 } else if (abt | hapAbt) { 743 permsFaults++; 744 DPRINTF(TLB, "TLB Fault: Data abort on permission check. AP:%d priv:%d" 745 " write:%d\n", ap, is_priv, is_write); 746 return std::make_shared<DataAbort>( 747 vaddr, te->domain, is_write, 748 ArmFault::PermissionLL + te->lookupLevel, 749 isStage2 | !abt, tranMethod); 750 } 751 return NoFault; 752} 753 754 755Fault 756TLB::checkPermissions64(TlbEntry *te, RequestPtr req, Mode mode, 757 ThreadContext *tc) 758{ 759 assert(aarch64); 760 761 Addr vaddr_tainted = req->getVaddr(); 762 Addr vaddr = purifyTaggedAddr(vaddr_tainted, tc, aarch64EL, ttbcr); 763 764 Request::Flags flags = req->getFlags(); 765 bool is_fetch = (mode == Execute); 766 bool is_write = (mode == Write); 767 bool is_priv M5_VAR_USED = isPriv && !(flags & UserMode); 768 769 updateMiscReg(tc, curTranType); 770 771 // If this is the second stage of translation and the request is for a 772 // stage 1 page table walk then we need to check the HCR.PTW bit. This 773 // allows us to generate a fault if the request targets an area marked 774 // as a device or strongly ordered. 775 if (isStage2 && req->isPTWalk() && hcr.ptw && 776 (te->mtype != TlbEntry::MemoryType::Normal)) { 777 return std::make_shared<DataAbort>( 778 vaddr_tainted, te->domain, is_write, 779 ArmFault::PermissionLL + te->lookupLevel, 780 isStage2, ArmFault::LpaeTran); 781 } 782 783 // Generate an alignment fault for unaligned accesses to device or 784 // strongly ordered memory 785 if (!is_fetch) { 786 if (te->mtype != TlbEntry::MemoryType::Normal) { 787 if (vaddr & mask(flags & AlignmentMask)) { 788 alignFaults++; 789 return std::make_shared<DataAbort>( 790 vaddr_tainted, 791 TlbEntry::DomainType::NoAccess, is_write, 792 ArmFault::AlignmentFault, isStage2, 793 ArmFault::LpaeTran); 794 } 795 } 796 } 797 798 if (te->nonCacheable) { 799 // Prevent prefetching from I/O devices. 800 if (req->isPrefetch()) { 801 // Here we can safely use the fault status for the short 802 // desc. format in all cases 803 return std::make_shared<PrefetchAbort>( 804 vaddr_tainted, 805 ArmFault::PrefetchUncacheable, 806 isStage2, ArmFault::LpaeTran); 807 } 808 } 809 810 uint8_t ap = 0x3 & (te->ap); // 2-bit access protection field 811 bool grant = false; 812 813 uint8_t xn = te->xn; 814 uint8_t pxn = te->pxn; 815 bool r = !is_write && !is_fetch; 816 bool w = is_write; 817 bool x = is_fetch; 818 DPRINTF(TLBVerbose, "Checking permissions: ap:%d, xn:%d, pxn:%d, r:%d, " 819 "w:%d, x:%d\n", ap, xn, pxn, r, w, x); 820 821 if (isStage2) { 822 assert(ArmSystem::haveVirtualization(tc) && aarch64EL != EL2); 823 // In stage 2 we use the hypervisor access permission bits. 824 // The following permissions are described in ARM DDI 0487A.f 825 // D4-1802 826 uint8_t hap = 0x3 & te->hap; 827 if (is_fetch) { 828 // sctlr.wxn overrides the xn bit 829 grant = !sctlr.wxn && !xn; 830 } else if (is_write) { 831 grant = hap & 0x2; 832 } else { // is_read 833 grant = hap & 0x1; 834 } 835 } else { 836 switch (aarch64EL) { 837 case EL0: 838 { 839 uint8_t perm = (ap << 2) | (xn << 1) | pxn; 840 switch (perm) { 841 case 0: 842 case 1: 843 case 8: 844 case 9: 845 grant = x; 846 break; 847 case 4: 848 case 5: 849 grant = r || w || (x && !sctlr.wxn); 850 break; 851 case 6: 852 case 7: 853 grant = r || w; 854 break; 855 case 12: 856 case 13: 857 grant = r || x; 858 break; 859 case 14: 860 case 15: 861 grant = r; 862 break; 863 default: 864 grant = false; 865 } 866 } 867 break; 868 case EL1: 869 { 870 uint8_t perm = (ap << 2) | (xn << 1) | pxn; 871 switch (perm) { 872 case 0: 873 case 2: 874 grant = r || w || (x && !sctlr.wxn); 875 break; 876 case 1: 877 case 3: 878 case 4: 879 case 5: 880 case 6: 881 case 7: 882 // regions that are writeable at EL0 should not be 883 // executable at EL1 884 grant = r || w; 885 break; 886 case 8: 887 case 10: 888 case 12: 889 case 14: 890 grant = r || x; 891 break; 892 case 9: 893 case 11: 894 case 13: 895 case 15: 896 grant = r; 897 break; 898 default: 899 grant = false; 900 } 901 } 902 break; 903 case EL2: 904 case EL3: 905 { 906 uint8_t perm = (ap & 0x2) | xn; 907 switch (perm) { 908 case 0: 909 grant = r || w || (x && !sctlr.wxn) ; 910 break; 911 case 1: 912 grant = r || w; 913 break; 914 case 2: 915 grant = r || x; 916 break; 917 case 3: 918 grant = r; 919 break; 920 default: 921 grant = false; 922 } 923 } 924 break; 925 } 926 } 927 928 if (!grant) { 929 if (is_fetch) { 930 permsFaults++; 931 DPRINTF(TLB, "TLB Fault: Prefetch abort on permission check. " 932 "AP:%d priv:%d write:%d ns:%d sif:%d " 933 "sctlr.afe: %d\n", 934 ap, is_priv, is_write, te->ns, scr.sif, sctlr.afe); 935 // Use PC value instead of vaddr because vaddr might be aligned to 936 // cache line and should not be the address reported in FAR 937 return std::make_shared<PrefetchAbort>( 938 req->getPC(), 939 ArmFault::PermissionLL + te->lookupLevel, 940 isStage2, ArmFault::LpaeTran); 941 } else { 942 permsFaults++; 943 DPRINTF(TLB, "TLB Fault: Data abort on permission check. AP:%d " 944 "priv:%d write:%d\n", ap, is_priv, is_write); 945 return std::make_shared<DataAbort>( 946 vaddr_tainted, te->domain, is_write, 947 ArmFault::PermissionLL + te->lookupLevel, 948 isStage2, ArmFault::LpaeTran); 949 } 950 } 951 952 return NoFault; 953} 954 955Fault 956TLB::translateFs(RequestPtr req, ThreadContext *tc, Mode mode, 957 Translation *translation, bool &delay, bool timing, 958 TLB::ArmTranslationType tranType, bool functional) 959{ 960 // No such thing as a functional timing access 961 assert(!(timing && functional)); 962 963 updateMiscReg(tc, tranType); 964 965 Addr vaddr_tainted = req->getVaddr(); 966 Addr vaddr = 0; 967 if (aarch64) 968 vaddr = purifyTaggedAddr(vaddr_tainted, tc, aarch64EL, ttbcr); 969 else 970 vaddr = vaddr_tainted; 971 Request::Flags flags = req->getFlags(); 972 973 bool is_fetch = (mode == Execute); 974 bool is_write = (mode == Write); 975 bool long_desc_format = aarch64 || longDescFormatInUse(tc); 976 ArmFault::TranMethod tranMethod = long_desc_format ? ArmFault::LpaeTran 977 : ArmFault::VmsaTran; 978 979 req->setAsid(asid); 980 981 DPRINTF(TLBVerbose, "CPSR is priv:%d UserMode:%d secure:%d S1S2NsTran:%d\n", 982 isPriv, flags & UserMode, isSecure, tranType & S1S2NsTran); 983 984 DPRINTF(TLB, "translateFs addr %#x, mode %d, st2 %d, scr %#x sctlr %#x " 985 "flags %#lx tranType 0x%x\n", vaddr_tainted, mode, isStage2, 986 scr, sctlr, flags, tranType); 987 988 if ((req->isInstFetch() && (!sctlr.i)) || 989 ((!req->isInstFetch()) && (!sctlr.c))){ 990 req->setFlags(Request::UNCACHEABLE | Request::STRICT_ORDER); 991 } 992 if (!is_fetch) { 993 assert(flags & MustBeOne); 994 if (sctlr.a || !(flags & AllowUnaligned)) { 995 if (vaddr & mask(flags & AlignmentMask)) { 996 alignFaults++; 997 return std::make_shared<DataAbort>( 998 vaddr_tainted, 999 TlbEntry::DomainType::NoAccess, is_write, 1000 ArmFault::AlignmentFault, isStage2, 1001 tranMethod); 1002 } 1003 } 1004 } 1005 1006 // If guest MMU is off or hcr.vm=0 go straight to stage2 1007 if ((isStage2 && !hcr.vm) || (!isStage2 && !sctlr.m)) { 1008 1009 req->setPaddr(vaddr); 1010 // When the MMU is off the security attribute corresponds to the 1011 // security state of the processor 1012 if (isSecure) 1013 req->setFlags(Request::SECURE); 1014 1015 // @todo: double check this (ARM ARM issue C B3.2.1) 1016 if (long_desc_format || sctlr.tre == 0) { 1017 req->setFlags(Request::UNCACHEABLE | Request::STRICT_ORDER); 1018 } else { 1019 if (nmrr.ir0 == 0 || nmrr.or0 == 0 || prrr.tr0 != 0x2) 1020 req->setFlags(Request::UNCACHEABLE | Request::STRICT_ORDER); 1021 } 1022 1023 // Set memory attributes 1024 TlbEntry temp_te; 1025 temp_te.ns = !isSecure; 1026 if (isStage2 || hcr.dc == 0 || isSecure || 1027 (isHyp && !(tranType & S1CTran))) { 1028 1029 temp_te.mtype = is_fetch ? TlbEntry::MemoryType::Normal 1030 : TlbEntry::MemoryType::StronglyOrdered; 1031 temp_te.innerAttrs = 0x0; 1032 temp_te.outerAttrs = 0x0; 1033 temp_te.shareable = true; 1034 temp_te.outerShareable = true; 1035 } else { 1036 temp_te.mtype = TlbEntry::MemoryType::Normal; 1037 temp_te.innerAttrs = 0x3; 1038 temp_te.outerAttrs = 0x3; 1039 temp_te.shareable = false; 1040 temp_te.outerShareable = false; 1041 } 1042 temp_te.setAttributes(long_desc_format); 1043 DPRINTF(TLBVerbose, "(No MMU) setting memory attributes: shareable: " 1044 "%d, innerAttrs: %d, outerAttrs: %d, isStage2: %d\n", 1045 temp_te.shareable, temp_te.innerAttrs, temp_te.outerAttrs, 1046 isStage2); 1047 setAttr(temp_te.attributes); 1048 1049 return testTranslation(req, mode, TlbEntry::DomainType::NoAccess); 1050 } 1051 1052 DPRINTF(TLBVerbose, "Translating %s=%#x context=%d\n", 1053 isStage2 ? "IPA" : "VA", vaddr_tainted, asid); 1054 // Translation enabled 1055 1056 TlbEntry *te = NULL; 1057 TlbEntry mergeTe; 1058 Fault fault = getResultTe(&te, req, tc, mode, translation, timing, 1059 functional, &mergeTe); 1060 // only proceed if we have a valid table entry 1061 if ((te == NULL) && (fault == NoFault)) delay = true; 1062 1063 // If we have the table entry transfer some of the attributes to the 1064 // request that triggered the translation 1065 if (te != NULL) { 1066 // Set memory attributes 1067 DPRINTF(TLBVerbose, 1068 "Setting memory attributes: shareable: %d, innerAttrs: %d, " 1069 "outerAttrs: %d, mtype: %d, isStage2: %d\n", 1070 te->shareable, te->innerAttrs, te->outerAttrs, 1071 static_cast<uint8_t>(te->mtype), isStage2); 1072 setAttr(te->attributes); 1073 1074 if (te->nonCacheable) 1075 req->setFlags(Request::UNCACHEABLE); 1076 1077 // Require requests to be ordered if the request goes to 1078 // strongly ordered or device memory (i.e., anything other 1079 // than normal memory requires strict order). 1080 if (te->mtype != TlbEntry::MemoryType::Normal) 1081 req->setFlags(Request::STRICT_ORDER); 1082 1083 Addr pa = te->pAddr(vaddr); 1084 req->setPaddr(pa); 1085 1086 if (isSecure && !te->ns) { 1087 req->setFlags(Request::SECURE); 1088 } 1089 if ((!is_fetch) && (vaddr & mask(flags & AlignmentMask)) && 1090 (te->mtype != TlbEntry::MemoryType::Normal)) { 1091 // Unaligned accesses to Device memory should always cause an 1092 // abort regardless of sctlr.a 1093 alignFaults++; 1094 return std::make_shared<DataAbort>( 1095 vaddr_tainted, 1096 TlbEntry::DomainType::NoAccess, is_write, 1097 ArmFault::AlignmentFault, isStage2, 1098 tranMethod); 1099 } 1100 1101 // Check for a trickbox generated address fault 1102 if (fault == NoFault) 1103 fault = testTranslation(req, mode, te->domain); 1104 } 1105 1106 // Generate Illegal Inst Set State fault if IL bit is set in CPSR 1107 if (fault == NoFault) { 1108 if (aarch64 && is_fetch && cpsr.il == 1) { 1109 return std::make_shared<IllegalInstSetStateFault>(); 1110 } 1111 } 1112 1113 return fault; 1114} 1115 1116Fault 1117TLB::translateAtomic(RequestPtr req, ThreadContext *tc, Mode mode, 1118 TLB::ArmTranslationType tranType) 1119{ 1120 updateMiscReg(tc, tranType); 1121 1122 if (directToStage2) { 1123 assert(stage2Tlb); 1124 return stage2Tlb->translateAtomic(req, tc, mode, tranType); 1125 } 1126 1127 bool delay = false; 1128 Fault fault; 1129 if (FullSystem) 1130 fault = translateFs(req, tc, mode, NULL, delay, false, tranType); 1131 else 1132 fault = translateSe(req, tc, mode, NULL, delay, false); 1133 assert(!delay); 1134 return fault; 1135} 1136 1137Fault 1138TLB::translateFunctional(RequestPtr req, ThreadContext *tc, Mode mode, 1139 TLB::ArmTranslationType tranType) 1140{ 1141 updateMiscReg(tc, tranType); 1142 1143 if (directToStage2) { 1144 assert(stage2Tlb); 1145 return stage2Tlb->translateFunctional(req, tc, mode, tranType); 1146 } 1147 1148 bool delay = false; 1149 Fault fault; 1150 if (FullSystem) 1151 fault = translateFs(req, tc, mode, NULL, delay, false, tranType, true); 1152 else 1153 fault = translateSe(req, tc, mode, NULL, delay, false); 1154 assert(!delay); 1155 return fault; 1156} 1157 1158Fault 1159TLB::translateTiming(RequestPtr req, ThreadContext *tc, 1160 Translation *translation, Mode mode, TLB::ArmTranslationType tranType) 1161{ 1162 updateMiscReg(tc, tranType); 1163 1164 if (directToStage2) { 1165 assert(stage2Tlb); 1166 return stage2Tlb->translateTiming(req, tc, translation, mode, tranType); 1167 } 1168 1169 assert(translation); 1170 1171 return translateComplete(req, tc, translation, mode, tranType, isStage2); 1172} 1173 1174Fault 1175TLB::translateComplete(RequestPtr req, ThreadContext *tc, 1176 Translation *translation, Mode mode, TLB::ArmTranslationType tranType, 1177 bool callFromS2) 1178{ 1179 bool delay = false; 1180 Fault fault; 1181 if (FullSystem) 1182 fault = translateFs(req, tc, mode, translation, delay, true, tranType); 1183 else 1184 fault = translateSe(req, tc, mode, translation, delay, true); 1185 DPRINTF(TLBVerbose, "Translation returning delay=%d fault=%d\n", delay, fault != 1186 NoFault); 1187 // If we have a translation, and we're not in the middle of doing a stage 1188 // 2 translation tell the translation that we've either finished or its 1189 // going to take a while. By not doing this when we're in the middle of a 1190 // stage 2 translation we prevent marking the translation as delayed twice, 1191 // one when the translation starts and again when the stage 1 translation 1192 // completes. 1193 if (translation && (callFromS2 || !stage2Req || req->hasPaddr() || fault != NoFault)) { 1194 if (!delay) 1195 translation->finish(fault, req, tc, mode); 1196 else 1197 translation->markDelayed(); 1198 } 1199 return fault; 1200} 1201 1202BaseMasterPort* 1203TLB::getMasterPort() 1204{ 1205 return &stage2Mmu->getPort(); 1206} 1207 1208void 1209TLB::updateMiscReg(ThreadContext *tc, ArmTranslationType tranType) 1210{ 1211 // check if the regs have changed, or the translation mode is different. 1212 // NOTE: the tran type doesn't affect stage 2 TLB's as they only handle 1213 // one type of translation anyway 1214 if (miscRegValid && miscRegContext == tc->contextId() && 1215 ((tranType == curTranType) || isStage2)) { 1216 return; 1217 } 1218 1219 DPRINTF(TLBVerbose, "TLB variables changed!\n"); 1220 cpsr = tc->readMiscReg(MISCREG_CPSR); 1221 1222 // Dependencies: SCR/SCR_EL3, CPSR 1223 isSecure = inSecureState(tc) && 1224 !(tranType & HypMode) && !(tranType & S1S2NsTran); 1225 1226 const OperatingMode op_mode = (OperatingMode) (uint8_t)cpsr.mode; 1227 aarch64 = opModeIs64(op_mode) || 1228 (opModeToEL(op_mode) == EL0 && ELIs64(tc, EL1)); 1229 1230 if (aarch64) { // AArch64 1231 // determine EL we need to translate in 1232 switch (tranType) { 1233 case S1E0Tran: 1234 case S12E0Tran: 1235 aarch64EL = EL0; 1236 break; 1237 case S1E1Tran: 1238 case S12E1Tran: 1239 aarch64EL = EL1; 1240 break; 1241 case S1E2Tran: 1242 aarch64EL = EL2; 1243 break; 1244 case S1E3Tran: 1245 aarch64EL = EL3; 1246 break; 1247 case NormalTran: 1248 case S1CTran: 1249 case S1S2NsTran: 1250 case HypMode: 1251 aarch64EL = (ExceptionLevel) (uint8_t) cpsr.el; 1252 break; 1253 } 1254 1255 switch (aarch64EL) { 1256 case EL0: 1257 case EL1: 1258 { 1259 sctlr = tc->readMiscReg(MISCREG_SCTLR_EL1); 1260 ttbcr = tc->readMiscReg(MISCREG_TCR_EL1); 1261 uint64_t ttbr_asid = ttbcr.a1 ? 1262 tc->readMiscReg(MISCREG_TTBR1_EL1) : 1263 tc->readMiscReg(MISCREG_TTBR0_EL1); 1264 asid = bits(ttbr_asid, 1265 (haveLargeAsid64 && ttbcr.as) ? 63 : 55, 48); 1266 } 1267 break; 1268 case EL2: 1269 sctlr = tc->readMiscReg(MISCREG_SCTLR_EL2); 1270 ttbcr = tc->readMiscReg(MISCREG_TCR_EL2); 1271 asid = -1; 1272 break; 1273 case EL3: 1274 sctlr = tc->readMiscReg(MISCREG_SCTLR_EL3); 1275 ttbcr = tc->readMiscReg(MISCREG_TCR_EL3); 1276 asid = -1; 1277 break; 1278 } 1279 hcr = tc->readMiscReg(MISCREG_HCR_EL2); 1280 scr = tc->readMiscReg(MISCREG_SCR_EL3); 1281 isPriv = aarch64EL != EL0; 1282 if (haveVirtualization) { 1283 vmid = bits(tc->readMiscReg(MISCREG_VTTBR_EL2), 55, 48); 1284 isHyp = tranType & HypMode; 1285 isHyp &= (tranType & S1S2NsTran) == 0; 1286 isHyp &= (tranType & S1CTran) == 0; 1287 // Work out if we should skip the first stage of translation and go 1288 // directly to stage 2. This value is cached so we don't have to 1289 // compute it for every translation. 1290 stage2Req = isStage2 || 1291 (hcr.vm && !isHyp && !isSecure && 1292 !(tranType & S1CTran) && (aarch64EL < EL2) && 1293 !(tranType & S1E1Tran)); // <--- FIX THIS HACK 1294 directToStage2 = !isStage2 && stage2Req && !sctlr.m; 1295 } else { 1296 vmid = 0; 1297 isHyp = false; 1298 directToStage2 = false; 1299 stage2Req = false; 1300 } 1301 } else { // AArch32 1302 sctlr = tc->readMiscReg(flattenMiscRegNsBanked(MISCREG_SCTLR, tc, 1303 !isSecure)); 1304 ttbcr = tc->readMiscReg(flattenMiscRegNsBanked(MISCREG_TTBCR, tc, 1305 !isSecure)); 1306 scr = tc->readMiscReg(MISCREG_SCR); 1307 isPriv = cpsr.mode != MODE_USER; 1308 if (longDescFormatInUse(tc)) { 1309 uint64_t ttbr_asid = tc->readMiscReg( 1310 flattenMiscRegNsBanked(ttbcr.a1 ? MISCREG_TTBR1 1311 : MISCREG_TTBR0, 1312 tc, !isSecure)); 1313 asid = bits(ttbr_asid, 55, 48); 1314 } else { // Short-descriptor translation table format in use 1315 CONTEXTIDR context_id = tc->readMiscReg(flattenMiscRegNsBanked( 1316 MISCREG_CONTEXTIDR, tc,!isSecure)); 1317 asid = context_id.asid; 1318 } 1319 prrr = tc->readMiscReg(flattenMiscRegNsBanked(MISCREG_PRRR, tc, 1320 !isSecure)); 1321 nmrr = tc->readMiscReg(flattenMiscRegNsBanked(MISCREG_NMRR, tc, 1322 !isSecure)); 1323 dacr = tc->readMiscReg(flattenMiscRegNsBanked(MISCREG_DACR, tc, 1324 !isSecure)); 1325 hcr = tc->readMiscReg(MISCREG_HCR); 1326 1327 if (haveVirtualization) { 1328 vmid = bits(tc->readMiscReg(MISCREG_VTTBR), 55, 48); 1329 isHyp = cpsr.mode == MODE_HYP; 1330 isHyp |= tranType & HypMode; 1331 isHyp &= (tranType & S1S2NsTran) == 0; 1332 isHyp &= (tranType & S1CTran) == 0; 1333 if (isHyp) { 1334 sctlr = tc->readMiscReg(MISCREG_HSCTLR); 1335 } 1336 // Work out if we should skip the first stage of translation and go 1337 // directly to stage 2. This value is cached so we don't have to 1338 // compute it for every translation. 1339 stage2Req = hcr.vm && !isStage2 && !isHyp && !isSecure && 1340 !(tranType & S1CTran); 1341 directToStage2 = stage2Req && !sctlr.m; 1342 } else { 1343 vmid = 0; 1344 stage2Req = false; 1345 isHyp = false; 1346 directToStage2 = false; 1347 } 1348 } 1349 miscRegValid = true; 1350 miscRegContext = tc->contextId(); 1351 curTranType = tranType; 1352} 1353 1354Fault 1355TLB::getTE(TlbEntry **te, RequestPtr req, ThreadContext *tc, Mode mode, 1356 Translation *translation, bool timing, bool functional, 1357 bool is_secure, TLB::ArmTranslationType tranType) 1358{ 1359 bool is_fetch = (mode == Execute); 1360 bool is_write = (mode == Write); 1361 1362 Addr vaddr_tainted = req->getVaddr(); 1363 Addr vaddr = 0; 1364 ExceptionLevel target_el = aarch64 ? aarch64EL : EL1; 1365 if (aarch64) { 1366 vaddr = purifyTaggedAddr(vaddr_tainted, tc, target_el, ttbcr); 1367 } else { 1368 vaddr = vaddr_tainted; 1369 } 1370 *te = lookup(vaddr, asid, vmid, isHyp, is_secure, false, false, target_el); 1371 if (*te == NULL) { 1372 if (req->isPrefetch()) { 1373 // if the request is a prefetch don't attempt to fill the TLB or go 1374 // any further with the memory access (here we can safely use the 1375 // fault status for the short desc. format in all cases) 1376 prefetchFaults++; 1377 return std::make_shared<PrefetchAbort>( 1378 vaddr_tainted, ArmFault::PrefetchTLBMiss, isStage2); 1379 } 1380 1381 if (is_fetch) 1382 instMisses++; 1383 else if (is_write) 1384 writeMisses++; 1385 else 1386 readMisses++; 1387 1388 // start translation table walk, pass variables rather than 1389 // re-retreaving in table walker for speed 1390 DPRINTF(TLB, "TLB Miss: Starting hardware table walker for %#x(%d:%d)\n", 1391 vaddr_tainted, asid, vmid); 1392 Fault fault; 1393 fault = tableWalker->walk(req, tc, asid, vmid, isHyp, mode, 1394 translation, timing, functional, is_secure, 1395 tranType, stage2Req); 1396 // for timing mode, return and wait for table walk, 1397 if (timing || fault != NoFault) { 1398 return fault; 1399 } 1400 1401 *te = lookup(vaddr, asid, vmid, isHyp, is_secure, false, false, target_el); 1402 if (!*te) 1403 printTlb(); 1404 assert(*te); 1405 } else { 1406 if (is_fetch) 1407 instHits++; 1408 else if (is_write) 1409 writeHits++; 1410 else 1411 readHits++; 1412 } 1413 return NoFault; 1414} 1415 1416Fault 1417TLB::getResultTe(TlbEntry **te, RequestPtr req, ThreadContext *tc, Mode mode, 1418 Translation *translation, bool timing, bool functional, 1419 TlbEntry *mergeTe) 1420{ 1421 Fault fault; 1422 1423 if (isStage2) { 1424 // We are already in the stage 2 TLB. Grab the table entry for stage 1425 // 2 only. We are here because stage 1 translation is disabled. 1426 TlbEntry *s2Te = NULL; 1427 // Get the stage 2 table entry 1428 fault = getTE(&s2Te, req, tc, mode, translation, timing, functional, 1429 isSecure, curTranType); 1430 // Check permissions of stage 2 1431 if ((s2Te != NULL) && (fault = NoFault)) { 1432 if(aarch64) 1433 fault = checkPermissions64(s2Te, req, mode, tc); 1434 else 1435 fault = checkPermissions(s2Te, req, mode); 1436 } 1437 *te = s2Te; 1438 return fault; 1439 } 1440 1441 TlbEntry *s1Te = NULL; 1442 1443 Addr vaddr_tainted = req->getVaddr(); 1444 1445 // Get the stage 1 table entry 1446 fault = getTE(&s1Te, req, tc, mode, translation, timing, functional, 1447 isSecure, curTranType); 1448 // only proceed if we have a valid table entry 1449 if ((s1Te != NULL) && (fault == NoFault)) { 1450 // Check stage 1 permissions before checking stage 2 1451 if (aarch64) 1452 fault = checkPermissions64(s1Te, req, mode, tc); 1453 else 1454 fault = checkPermissions(s1Te, req, mode); 1455 if (stage2Req & (fault == NoFault)) { 1456 Stage2LookUp *s2Lookup = new Stage2LookUp(this, stage2Tlb, *s1Te, 1457 req, translation, mode, timing, functional, curTranType); 1458 fault = s2Lookup->getTe(tc, mergeTe); 1459 if (s2Lookup->isComplete()) { 1460 *te = mergeTe; 1461 // We've finished with the lookup so delete it 1462 delete s2Lookup; 1463 } else { 1464 // The lookup hasn't completed, so we can't delete it now. We 1465 // get round this by asking the object to self delete when the 1466 // translation is complete. 1467 s2Lookup->setSelfDelete(); 1468 } 1469 } else { 1470 // This case deals with an S1 hit (or bypass), followed by 1471 // an S2 hit-but-perms issue 1472 if (isStage2) { 1473 DPRINTF(TLBVerbose, "s2TLB: reqVa %#x, reqPa %#x, fault %p\n", 1474 vaddr_tainted, req->hasPaddr() ? req->getPaddr() : ~0, fault); 1475 if (fault != NoFault) { 1476 ArmFault *armFault = reinterpret_cast<ArmFault *>(fault.get()); 1477 armFault->annotate(ArmFault::S1PTW, false); 1478 armFault->annotate(ArmFault::OVA, vaddr_tainted); 1479 } 1480 } 1481 *te = s1Te; 1482 } 1483 } 1484 return fault; 1485} 1486 1487void 1488TLB::setTestInterface(SimObject *_ti) 1489{ 1490 if (!_ti) { 1491 test = nullptr; 1492 } else { 1493 TlbTestInterface *ti(dynamic_cast<TlbTestInterface *>(_ti)); 1494 fatal_if(!ti, "%s is not a valid ARM TLB tester\n", _ti->name()); 1495 test = ti; 1496 } 1497} 1498 1499Fault 1500TLB::testTranslation(RequestPtr req, Mode mode, TlbEntry::DomainType domain) 1501{ 1502 if (!test || !req->hasSize() || req->getSize() == 0) { 1503 return NoFault; 1504 } else { 1505 return test->translationCheck(req, isPriv, mode, domain); 1506 } 1507} 1508 1509Fault 1510TLB::testWalk(Addr pa, Addr size, Addr va, bool is_secure, Mode mode, 1511 TlbEntry::DomainType domain, LookupLevel lookup_level) 1512{ 1513 if (!test) { 1514 return NoFault; 1515 } else { 1516 return test->walkCheck(pa, size, va, is_secure, isPriv, mode, 1517 domain, lookup_level); 1518 } 1519} 1520 1521 1522ArmISA::TLB * 1523ArmTLBParams::create() 1524{ 1525 return new ArmISA::TLB(this); 1526} 1527