diff options
Diffstat (limited to 'riscv/mmu.cc')
-rw-r--r-- | riscv/mmu.cc | 126 |
1 files changed, 105 insertions, 21 deletions
diff --git a/riscv/mmu.cc b/riscv/mmu.cc index 021f587..3e1fc25 100644 --- a/riscv/mmu.cc +++ b/riscv/mmu.cc @@ -34,7 +34,17 @@ void mmu_t::flush_tlb() flush_icache(); } -reg_t mmu_t::translate(reg_t addr, access_type type) +static void throw_access_exception(reg_t addr, access_type type) +{ + switch (type) { + case FETCH: throw trap_instruction_access_fault(addr); + case LOAD: throw trap_load_access_fault(addr); + case STORE: throw trap_store_access_fault(addr); + default: abort(); + } +} + +reg_t mmu_t::translate(reg_t addr, reg_t len, access_type type) { if (!proc) return addr; @@ -45,12 +55,15 @@ reg_t mmu_t::translate(reg_t addr, access_type type) mode = get_field(proc->state.mstatus, MSTATUS_MPP); } - return walk(addr, type, mode) | (addr & (PGSIZE-1)); + reg_t paddr = walk(addr, type, mode) | (addr & (PGSIZE-1)); + if (!pmp_ok(paddr, type, mode) || !pmp_homogeneous(paddr, len)) + throw_access_exception(addr, type); + return paddr; } tlb_entry_t mmu_t::fetch_slow_path(reg_t vaddr) { - reg_t paddr = translate(vaddr, FETCH); + reg_t paddr = translate(vaddr, sizeof(fetch_temp), FETCH); if (auto host_addr = sim->addr_to_mem(paddr)) { return refill_tlb(vaddr, paddr, host_addr, FETCH); @@ -90,7 +103,7 @@ reg_t reg_from_bytes(size_t len, const uint8_t* bytes) void mmu_t::load_slow_path(reg_t addr, reg_t len, uint8_t* bytes) { - reg_t paddr = translate(addr, LOAD); + reg_t paddr = translate(addr, len, LOAD); if (auto host_addr = sim->addr_to_mem(paddr)) { memcpy(bytes, host_addr, len); @@ -112,7 +125,7 @@ void mmu_t::load_slow_path(reg_t addr, reg_t len, uint8_t* bytes) void mmu_t::store_slow_path(reg_t addr, reg_t len, const uint8_t* bytes) { - reg_t paddr = translate(addr, STORE); + reg_t paddr = translate(addr, len, STORE); if (!matched_trigger) { reg_t data = reg_from_bytes(len, bytes); @@ -149,15 +162,90 @@ tlb_entry_t mmu_t::refill_tlb(reg_t vaddr, reg_t paddr, char* host_addr, access_ (check_triggers_store && type == STORE)) expected_tag |= TLB_CHECK_TRIGGERS; - if (type == FETCH) tlb_insn_tag[idx] = expected_tag; - else if (type == STORE) tlb_store_tag[idx] = expected_tag; - else tlb_load_tag[idx] = expected_tag; + if (pmp_homogeneous(paddr & ~reg_t(PGSIZE - 1), PGSIZE)) { + if (type == FETCH) tlb_insn_tag[idx] = expected_tag; + else if (type == STORE) tlb_store_tag[idx] = expected_tag; + else tlb_load_tag[idx] = expected_tag; + } tlb_entry_t entry = {host_addr - vaddr, paddr - vaddr}; tlb_data[idx] = entry; return entry; } +reg_t mmu_t::pmp_ok(reg_t addr, access_type type, reg_t mode) +{ + if (!proc) + return true; + + reg_t base = 0; + for (size_t i = 0; i < proc->state.n_pmp; i++) { + reg_t tor = proc->state.pmpaddr[i] << PMP_SHIFT; + uint8_t cfg = proc->state.pmpcfg[i]; + + if (cfg & PMP_A) { + bool is_tor = (cfg & PMP_A) == PMP_TOR; + bool is_na4 = (cfg & PMP_A) == PMP_NA4; + + reg_t mask = (proc->state.pmpaddr[i] << 1) | (!is_na4); + mask = ~(mask & ~(mask + 1)) << PMP_SHIFT; + bool napot_match = ((addr ^ tor) & mask) == 0; + bool tor_match = base <= addr && addr < tor; + + if (is_tor ? tor_match : napot_match) { + return + (mode == PRV_M && !(cfg & PMP_L)) || + (type == LOAD && (cfg & PMP_R)) || + (type == STORE && (cfg & PMP_W)) || + (type == FETCH && (cfg & PMP_X)); + } + } + + base = tor; + } + + return mode == PRV_M; +} + +reg_t mmu_t::pmp_homogeneous(reg_t addr, reg_t len) +{ + if ((addr | len) & (len - 1)) + abort(); + + if (!proc) + return true; + + reg_t base = 0; + for (size_t i = 0; i < proc->state.n_pmp; i++) { + reg_t tor = proc->state.pmpaddr[i] << PMP_SHIFT; + uint8_t cfg = proc->state.pmpcfg[i]; + + if (cfg & PMP_A) { + bool is_tor = (cfg & PMP_A) == PMP_TOR; + bool is_na4 = (cfg & PMP_A) == PMP_NA4; + + bool begins_after_lower = addr >= base; + bool begins_after_upper = addr >= tor; + bool ends_before_lower = (addr & -len) < (base & -len); + bool ends_before_upper = (addr & -len) < (tor & -len); + bool tor_homogeneous = ends_before_lower || begins_after_upper || + (begins_after_lower && ends_before_upper); + + reg_t mask = (proc->state.pmpaddr[i] << 1) | (!is_na4); + mask = ~(mask & ~(mask + 1)) << PMP_SHIFT; + bool mask_homogeneous = ~(mask << 1) & len; + bool napot_homogeneous = mask_homogeneous || ((addr ^ tor) / len) != 0; + + if (!(is_tor ? tor_homogeneous : napot_homogeneous)) + return false; + } + + base = tor; + } + + return true; +} + reg_t mmu_t::walk(reg_t addr, access_type type, reg_t mode) { vm_info vm = decode_vm_info(proc->max_xlen, mode, proc->get_state()->satp); @@ -181,9 +269,10 @@ reg_t mmu_t::walk(reg_t addr, access_type type, reg_t mode) reg_t idx = (addr >> (PGSHIFT + ptshift)) & ((1 << vm.idxbits) - 1); // check that physical address of PTE is legal - auto ppte = sim->addr_to_mem(base + idx * vm.ptesize); - if (!ppte) - goto fail_access; + auto pte_paddr = base + idx * vm.ptesize; + auto ppte = sim->addr_to_mem(pte_paddr); + if (!ppte || !pmp_ok(pte_paddr, LOAD, PRV_S)) + throw_access_exception(addr, type); reg_t pte = vm.ptesize == 4 ? *(uint32_t*)ppte : *(uint64_t*)ppte; reg_t ppn = pte >> PTE_PPN_SHIFT; @@ -204,7 +293,11 @@ reg_t mmu_t::walk(reg_t addr, access_type type, reg_t mode) reg_t ad = PTE_A | ((type == STORE) * PTE_D); #ifdef RISCV_ENABLE_DIRTY // set accessed and possibly dirty bits. - *(uint32_t*)ppte |= ad; + if ((pte & ad) != ad) { + if (!pmp_ok(pte_paddr, STORE, PRV_S)) + throw_access_exception(addr, type); + *(uint32_t*)ppte |= ad; + } #else // take exception if access or possibly dirty bit is not set. if ((pte & ad) != ad) @@ -217,21 +310,12 @@ reg_t mmu_t::walk(reg_t addr, access_type type, reg_t mode) } } -fail: switch (type) { case FETCH: throw trap_instruction_page_fault(addr); case LOAD: throw trap_load_page_fault(addr); case STORE: throw trap_store_page_fault(addr); default: abort(); } - -fail_access: - switch (type) { - case FETCH: throw trap_instruction_access_fault(addr); - case LOAD: throw trap_load_access_fault(addr); - case STORE: throw trap_store_access_fault(addr); - default: abort(); - } } void mmu_t::register_memtracer(memtracer_t* t) |