Changeset 201 for trunk/modules/vci_cc_vcache_wrapper_v4/caba/source

Timestamp:

Feb 24, 2012, 2:07:31 PM (13 years ago)

Author:

alain

Message:

fixing a malicious bug in ICAHE FSM : bad handling of the
speculative access in IDLE state (thanks to Ghassan)

File:

• trunk/modules/vci_cc_vcache_wrapper_v4/caba/source/src/vci_cc_vcache_wrapper_v4.cpp (modified) (5 diffs)

trunk/modules/vci_cc_vcache_wrapper_v4/caba/source/src/vci_cc_vcache_wrapper_v4.cpp

@@ -208 +208 @@
       m_dcache_yzmask((~0)<<(uint32_log2(dcache_words) + 2)),
       m_dcache_words(dcache_words),
+
+      m_proc_id(proc_id),
 
       m_max_frozen_cycles(max_frozen_cycles),
@@ -1424 +1426 @@
             r_icache_vci_paddr   = paddr;
 
-            // Finally, we get the instruction depending on cacheability
+            // We enter this section only in case of TLB hit:
+            // Finally, we get the instruction depending on cacheability,
+            // we send the response to processor, and compute next state
             if ( cacheable )    // cacheable read
             {
+                if ( (r_icache_vci_paddr.read() & ~PAGE_K_MASK) 
+                      != (paddr & ~PAGE_K_MASK) )       // speculative access KO 
+                {
+
+#ifdef INSTRUMENTATION
+m_cpt_icache_spc_miss++;
+#endif
+                    // we return an invalid response and stay in IDLE state
+                    // the cache access will cost one extra cycle.
+                    break;
+                }
+                
                 if ( not cache_hit )    // cache miss
                 {
@@ -1440 +1456 @@
                         r_icache_miss_req = true;
                     }
+                    break;
                 }
                 else                    // cache hit
                 {
-                    if ( (r_icache_vci_paddr.read() & ~PAGE_K_MASK) 
-                             != (paddr & ~PAGE_K_MASK) )        // speculative access KO 
-                    {
-
-#ifdef INSTRUMENTATION
-m_cpt_icache_spc_miss++;
-#endif
-                        // we return an invalid response
-                        // and the cache access will cost one extra cycle.
-                        break;
-                    }
-                    else                                        // speculative access OK
-                    {
       
 #ifdef INSTRUMENTATION
 m_cpt_ins_read++; 
 #endif
-                        irsp.valid       = true;
-                        irsp.instruction = cache_inst;
-                    }
+                    irsp.valid       = true;
+                    irsp.instruction = cache_inst;
                 }
             }
@@ -2051 +2054 @@
                         // There is 4 configurations to access the cache, 
                         // depending on the pipe-line state, defined 
-                        // by the r_dcache_p0_valid flip-flop (P1 stage activated)
-                        // and    r_dcache_p1_valid flip-flop (P2 stage activated) : 
+                        // by the r_dcache_p0_valid (V0) flip-flop : P1 stage activated
+                        // and    r_dcache_p1_valid (V1) flip-flop : P2 stage activated
                         //  V0 / V1 / Data      / Directory / comment                    
                         //  0  / 0  / read(A0)  / read(A0)  / read speculative access  
@@ -2709 +2712 @@
                     // SC request:
                     // - if a valid LL reservation (with the same address) is registered, 
-                    // we request a SC transaction to CMD FSM and go to the DCACHE_SC_WAIT state
+                    // we request a SC transaction to CMD FSM and go to the DCACHE_UNC_WAIT state
                     // that will directly return the response to the processor, and invalidate 
-                    // the LL reservation. We don't check a possible hit in dcache, as this is
-                    // done by the coherence transaction...
+                    // the LL reservation. We don't check a possible write hit in dcache, 
+                    // as the cache update is done by the coherence transaction...
                     // - if there is no registerd LL, we just stay in IDLE state, invalidate
                     // the LL reservation, and return 1 (atomic access failed)