mem-cache: Add multiple eviction stats
[gem5.git] / src / arch / x86 / pagetable_walker.cc
index 2471c0663415e6efb25216c319e32351a630b992..aab0a711892e0090b35f8609a3b2e863be840f26 100644 (file)
@@ -1,44 +1,38 @@
 /*
- * Copyright (c) 2007 The Hewlett-Packard Development Company
+ * Copyright (c) 2012 ARM Limited
  * All rights reserved.
  *
- * Redistribution and use of this software in source and binary forms,
- * with or without modification, are permitted provided that the
- * following conditions are met:
+ * The license below extends only to copyright in the software and shall
+ * not be construed as granting a license to any other intellectual
+ * property including but not limited to intellectual property relating
+ * to a hardware implementation of the functionality of the software
+ * licensed hereunder.  You may use the software subject to the license
+ * terms below provided that you ensure that this notice is replicated
+ * unmodified and in its entirety in all distributions of the software,
+ * modified or unmodified, in source code or in binary form.
  *
- * The software must be used only for Non-Commercial Use which means any
- * use which is NOT directed to receiving any direct monetary
- * compensation for, or commercial advantage from such use.  Illustrative
- * examples of non-commercial use are academic research, personal study,
- * teaching, education and corporate research & development.
- * Illustrative examples of commercial use are distributing products for
- * commercial advantage and providing services using the software for
- * commercial advantage.
+ * Copyright (c) 2007 The Hewlett-Packard Development Company
+ * All rights reserved.
  *
- * If you wish to use this software or functionality therein that may be
- * covered by patents for commercial use, please contact:
- *     Director of Intellectual Property Licensing
- *     Office of Strategy and Technology
- *     Hewlett-Packard Company
- *     1501 Page Mill Road
- *     Palo Alto, California  94304
+ * The license below extends only to copyright in the software and shall
+ * not be construed as granting a license to any other intellectual
+ * property including but not limited to intellectual property relating
+ * to a hardware implementation of the functionality of the software
+ * licensed hereunder.  You may use the software subject to the license
+ * terms below provided that you ensure that this notice is replicated
+ * unmodified and in its entirety in all distributions of the software,
+ * modified or unmodified, in source code or in binary form.
  *
- * Redistributions of source code must retain the above copyright notice,
- * this list of conditions and the following disclaimer.  Redistributions
- * in binary form must reproduce the above copyright notice, this list of
- * conditions and the following disclaimer in the documentation and/or
- * other materials provided with the distribution.  Neither the name of
- * the COPYRIGHT HOLDER(s), HEWLETT-PACKARD COMPANY, nor the names of its
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met: redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer;
+ * redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other materials provided with the distribution;
+ * neither the name of the copyright holders nor the names of its
  * contributors may be used to endorse or promote products derived from
- * this software without specific prior written permission.  No right of
- * sublicense is granted herewith.  Derivatives of the software and
- * output created using the software may be prepared, but only for
- * Non-Commercial Uses.  Derivatives of the software may be shared with
- * others provided: (i) the others agree to abide by the list of
- * conditions herein which includes the Non-Commercial Use restrictions;
- * and (ii) such Derivatives of the software include the above copyright
- * notice to acknowledge the contribution from this software where
- * applicable, this list of conditions and the disclaimer below.
+ * this software without specific prior written permission.
  *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * Authors: Gabe Black
  */
 
-#include "arch/x86/pagetable.hh"
 #include "arch/x86/pagetable_walker.hh"
+
+#include <memory>
+
+#include "arch/x86/faults.hh"
+#include "arch/x86/pagetable.hh"
 #include "arch/x86/tlb.hh"
+#include "arch/x86/vtophys.hh"
 #include "base/bitfield.hh"
-#include "cpu/thread_context.hh"
+#include "base/trie.hh"
 #include "cpu/base.hh"
+#include "cpu/thread_context.hh"
+#include "debug/PageTableWalker.hh"
 #include "mem/packet_access.hh"
 #include "mem/request.hh"
-#include "sim/system.hh"
 
 namespace X86ISA {
 
-// Unfortunately, the placement of the base field in a page table entry is
-// very erratic and would make a mess here. It might be moved here at some
-// point in the future.
-BitUnion64(PageTableEntry)
-    Bitfield<63> nx;
-    Bitfield<11, 9> avl;
-    Bitfield<8> g;
-    Bitfield<7> ps;
-    Bitfield<6> d;
-    Bitfield<5> a;
-    Bitfield<4> pcd;
-    Bitfield<3> pwt;
-    Bitfield<2> u;
-    Bitfield<1> w;
-    Bitfield<0> p;
-EndBitUnion(PageTableEntry)
+Fault
+Walker::start(ThreadContext * _tc, BaseTLB::Translation *_translation,
+              const RequestPtr &_req, BaseTLB::Mode _mode)
+{
+    // TODO: in timing mode, instead of blocking when there are other
+    // outstanding requests, see if this request can be coalesced with
+    // another one (i.e. either coalesce or start walk)
+    WalkerState * newState = new WalkerState(this, _translation, _req);
+    newState->initState(_tc, _mode, sys->isTimingMode());
+    if (currStates.size()) {
+        assert(newState->isTiming());
+        DPRINTF(PageTableWalker, "Walks in progress: %d\n", currStates.size());
+        currStates.push_back(newState);
+        return NoFault;
+    } else {
+        currStates.push_back(newState);
+        Fault fault = newState->startWalk();
+        if (!newState->isTiming()) {
+            currStates.pop_front();
+            delete newState;
+        }
+        return fault;
+    }
+}
 
 Fault
-Walker::doNext(PacketPtr &write)
+Walker::startFunctional(ThreadContext * _tc, Addr &addr, unsigned &logBytes,
+              BaseTLB::Mode _mode)
+{
+    funcState.initState(_tc, _mode);
+    return funcState.startFunctional(addr, logBytes);
+}
+
+bool
+Walker::WalkerPort::recvTimingResp(PacketPtr pkt)
+{
+    return walker->recvTimingResp(pkt);
+}
+
+bool
+Walker::recvTimingResp(PacketPtr pkt)
+{
+    WalkerSenderState * senderState =
+        dynamic_cast<WalkerSenderState *>(pkt->popSenderState());
+    WalkerState * senderWalk = senderState->senderWalk;
+    bool walkComplete = senderWalk->recvPacket(pkt);
+    delete senderState;
+    if (walkComplete) {
+        std::list<WalkerState *>::iterator iter;
+        for (iter = currStates.begin(); iter != currStates.end(); iter++) {
+            WalkerState * walkerState = *(iter);
+            if (walkerState == senderWalk) {
+                iter = currStates.erase(iter);
+                break;
+            }
+        }
+        delete senderWalk;
+        // Since we block requests when another is outstanding, we
+        // need to check if there is a waiting request to be serviced
+        if (currStates.size() && !startWalkWrapperEvent.scheduled())
+            // delay sending any new requests until we are finished
+            // with the responses
+            schedule(startWalkWrapperEvent, clockEdge());
+    }
+    return true;
+}
+
+void
+Walker::WalkerPort::recvReqRetry()
+{
+    walker->recvReqRetry();
+}
+
+void
+Walker::recvReqRetry()
+{
+    std::list<WalkerState *>::iterator iter;
+    for (iter = currStates.begin(); iter != currStates.end(); iter++) {
+        WalkerState * walkerState = *(iter);
+        if (walkerState->isRetrying()) {
+            walkerState->retry();
+        }
+    }
+}
+
+bool Walker::sendTiming(WalkerState* sendingState, PacketPtr pkt)
+{
+    WalkerSenderState* walker_state = new WalkerSenderState(sendingState);
+    pkt->pushSenderState(walker_state);
+    if (port.sendTimingReq(pkt)) {
+        return true;
+    } else {
+        // undo the adding of the sender state and delete it, as we
+        // will do it again the next time we attempt to send it
+        pkt->popSenderState();
+        delete walker_state;
+        return false;
+    }
+
+}
+
+Port &
+Walker::getPort(const std::string &if_name, PortID idx)
+{
+    if (if_name == "port")
+        return port;
+    else
+        return ClockedObject::getPort(if_name, idx);
+}
+
+void
+Walker::WalkerState::initState(ThreadContext * _tc,
+        BaseTLB::Mode _mode, bool _isTiming)
+{
+    assert(state == Ready);
+    started = false;
+    tc = _tc;
+    mode = _mode;
+    timing = _isTiming;
+}
+
+void
+Walker::startWalkWrapper()
+{
+    unsigned num_squashed = 0;
+    WalkerState *currState = currStates.front();
+    while ((num_squashed < numSquashable) && currState &&
+        currState->translation->squashed()) {
+        currStates.pop_front();
+        num_squashed++;
+
+        DPRINTF(PageTableWalker, "Squashing table walk for address %#x\n",
+            currState->req->getVaddr());
+
+        // finish the translation which will delete the translation object
+        currState->translation->finish(
+            std::make_shared<UnimpFault>("Squashed Inst"),
+            currState->req, currState->tc, currState->mode);
+
+        // delete the current request if there are no inflight packets.
+        // if there is something in flight, delete when the packets are
+        // received and inflight is zero.
+        if (currState->numInflight() == 0) {
+            delete currState;
+        } else {
+            currState->squash();
+        }
+
+        // check the next translation request, if it exists
+        if (currStates.size())
+            currState = currStates.front();
+        else
+            currState = NULL;
+    }
+    if (currState && !currState->wasStarted())
+        currState->startWalk();
+}
+
+Fault
+Walker::WalkerState::startWalk()
+{
+    Fault fault = NoFault;
+    assert(!started);
+    started = true;
+    setupWalk(req->getVaddr());
+    if (timing) {
+        nextState = state;
+        state = Waiting;
+        timingFault = NoFault;
+        sendPackets();
+    } else {
+        do {
+            walker->port.sendAtomic(read);
+            PacketPtr write = NULL;
+            fault = stepWalk(write);
+            assert(fault == NoFault || read == NULL);
+            state = nextState;
+            nextState = Ready;
+            if (write)
+                walker->port.sendAtomic(write);
+        } while (read);
+        state = Ready;
+        nextState = Waiting;
+    }
+    return fault;
+}
+
+Fault
+Walker::WalkerState::startFunctional(Addr &addr, unsigned &logBytes)
+{
+    Fault fault = NoFault;
+    assert(!started);
+    started = true;
+    setupWalk(addr);
+
+    do {
+        walker->port.sendFunctional(read);
+        // On a functional access (page table lookup), writes should
+        // not happen so this pointer is ignored after stepWalk
+        PacketPtr write = NULL;
+        fault = stepWalk(write);
+        assert(fault == NoFault || read == NULL);
+        state = nextState;
+        nextState = Ready;
+    } while (read);
+    logBytes = entry.logBytes;
+    addr = entry.paddr;
+
+    return fault;
+}
+
+Fault
+Walker::WalkerState::stepWalk(PacketPtr &write)
 {
     assert(state != Ready && state != Waiting);
+    Fault fault = NoFault;
     write = NULL;
     PageTableEntry pte;
-    if (size == 8)
-        pte = read->get<uint64_t>();
+    if (dataSize == 8)
+        pte = read->getLE<uint64_t>();
     else
-        pte = read->get<uint32_t>();
+        pte = read->getLE<uint32_t>();
     VAddr vaddr = entry.vaddr;
     bool uncacheable = pte.pcd;
     Addr nextRead = 0;
     bool doWrite = false;
-    bool badNX = pte.nx && execute && enableNX;
+    bool doTLBInsert = false;
+    bool doEndWalk = false;
+    bool badNX = pte.nx && mode == BaseTLB::Execute && enableNX;
     switch(state) {
       case LongPML4:
         DPRINTF(PageTableWalker,
                 "Got long mode PML4 entry %#016x.\n", (uint64_t)pte);
-        nextRead = ((uint64_t)pte & (mask(40) << 12)) + vaddr.longl3 * size;
+        nextRead = ((uint64_t)pte & (mask(40) << 12)) + vaddr.longl3 * dataSize;
         doWrite = !pte.a;
         pte.a = 1;
         entry.writable = pte.w;
         entry.user = pte.u;
         if (badNX || !pte.p) {
-            stop();
-            return pageFault(pte.p);
+            doEndWalk = true;
+            fault = pageFault(pte.p);
+            break;
         }
         entry.noExec = pte.nx;
         nextState = LongPDP;
@@ -118,14 +316,15 @@ Walker::doNext(PacketPtr &write)
       case LongPDP:
         DPRINTF(PageTableWalker,
                 "Got long mode PDP entry %#016x.\n", (uint64_t)pte);
-        nextRead = ((uint64_t)pte & (mask(40) << 12)) + vaddr.longl2 * size;
+        nextRead = ((uint64_t)pte & (mask(40) << 12)) + vaddr.longl2 * dataSize;
         doWrite = !pte.a;
         pte.a = 1;
         entry.writable = entry.writable && pte.w;
         entry.user = entry.user && pte.u;
         if (badNX || !pte.p) {
-            stop();
-            return pageFault(pte.p);
+            doEndWalk = true;
+            fault = pageFault(pte.p);
+            break;
         }
         nextState = LongPD;
         break;
@@ -137,27 +336,28 @@ Walker::doNext(PacketPtr &write)
         entry.writable = entry.writable && pte.w;
         entry.user = entry.user && pte.u;
         if (badNX || !pte.p) {
-            stop();
-            return pageFault(pte.p);
+            doEndWalk = true;
+            fault = pageFault(pte.p);
+            break;
         }
         if (!pte.ps) {
             // 4 KB page
-            entry.size = 4 * (1 << 10);
+            entry.logBytes = 12;
             nextRead =
-                ((uint64_t)pte & (mask(40) << 12)) + vaddr.longl1 * size;
+                ((uint64_t)pte & (mask(40) << 12)) + vaddr.longl1 * dataSize;
             nextState = LongPTE;
             break;
         } else {
             // 2 MB page
-            entry.size = 2 * (1 << 20);
+            entry.logBytes = 21;
             entry.paddr = (uint64_t)pte & (mask(31) << 21);
             entry.uncacheable = uncacheable;
             entry.global = pte.g;
             entry.patBit = bits(pte, 12);
             entry.vaddr = entry.vaddr & ~((2 * (1 << 20)) - 1);
-            tlb->insert(entry.vaddr, entry);
-            stop();
-            return NoFault;
+            doTLBInsert = true;
+            doEndWalk = true;
+            break;
         }
       case LongPTE:
         DPRINTF(PageTableWalker,
@@ -167,24 +367,26 @@ Walker::doNext(PacketPtr &write)
         entry.writable = entry.writable && pte.w;
         entry.user = entry.user && pte.u;
         if (badNX || !pte.p) {
-            stop();
-            return pageFault(pte.p);
+            doEndWalk = true;
+            fault = pageFault(pte.p);
+            break;
         }
         entry.paddr = (uint64_t)pte & (mask(40) << 12);
         entry.uncacheable = uncacheable;
         entry.global = pte.g;
         entry.patBit = bits(pte, 12);
         entry.vaddr = entry.vaddr & ~((4 * (1 << 10)) - 1);
-        tlb->insert(entry.vaddr, entry);
-        stop();
-        return NoFault;
+        doTLBInsert = true;
+        doEndWalk = true;
+        break;
       case PAEPDP:
         DPRINTF(PageTableWalker,
                 "Got legacy mode PAE PDP entry %#08x.\n", (uint32_t)pte);
-        nextRead = ((uint64_t)pte & (mask(40) << 12)) + vaddr.pael2 * size;
+        nextRead = ((uint64_t)pte & (mask(40) << 12)) + vaddr.pael2 * dataSize;
         if (!pte.p) {
-            stop();
-            return pageFault(pte.p);
+            doEndWalk = true;
+            fault = pageFault(pte.p);
+            break;
         }
         nextState = PAEPD;
         break;
@@ -196,26 +398,27 @@ Walker::doNext(PacketPtr &write)
         entry.writable = pte.w;
         entry.user = pte.u;
         if (badNX || !pte.p) {
-            stop();
-            return pageFault(pte.p);
+            doEndWalk = true;
+            fault = pageFault(pte.p);
+            break;
         }
         if (!pte.ps) {
             // 4 KB page
-            entry.size = 4 * (1 << 10);
-            nextRead = ((uint64_t)pte & (mask(40) << 12)) + vaddr.pael1 * size;
+            entry.logBytes = 12;
+            nextRead = ((uint64_t)pte & (mask(40) << 12)) + vaddr.pael1 * dataSize;
             nextState = PAEPTE;
             break;
         } else {
             // 2 MB page
-            entry.size = 2 * (1 << 20);
+            entry.logBytes = 21;
             entry.paddr = (uint64_t)pte & (mask(31) << 21);
             entry.uncacheable = uncacheable;
             entry.global = pte.g;
             entry.patBit = bits(pte, 12);
             entry.vaddr = entry.vaddr & ~((2 * (1 << 20)) - 1);
-            tlb->insert(entry.vaddr, entry);
-            stop();
-            return NoFault;
+            doTLBInsert = true;
+            doEndWalk = true;
+            break;
         }
       case PAEPTE:
         DPRINTF(PageTableWalker,
@@ -225,17 +428,18 @@ Walker::doNext(PacketPtr &write)
         entry.writable = entry.writable && pte.w;
         entry.user = entry.user && pte.u;
         if (badNX || !pte.p) {
-            stop();
-            return pageFault(pte.p);
+            doEndWalk = true;
+            fault = pageFault(pte.p);
+            break;
         }
         entry.paddr = (uint64_t)pte & (mask(40) << 12);
         entry.uncacheable = uncacheable;
         entry.global = pte.g;
         entry.patBit = bits(pte, 7);
         entry.vaddr = entry.vaddr & ~((4 * (1 << 10)) - 1);
-        tlb->insert(entry.vaddr, entry);
-        stop();
-        return NoFault;
+        doTLBInsert = true;
+        doEndWalk = true;
+        break;
       case PSEPD:
         DPRINTF(PageTableWalker,
                 "Got legacy mode PSE PD entry %#08x.\n", (uint32_t)pte);
@@ -244,27 +448,28 @@ Walker::doNext(PacketPtr &write)
         entry.writable = pte.w;
         entry.user = pte.u;
         if (!pte.p) {
-            stop();
-            return pageFault(pte.p);
+            doEndWalk = true;
+            fault = pageFault(pte.p);
+            break;
         }
         if (!pte.ps) {
             // 4 KB page
-            entry.size = 4 * (1 << 10);
+            entry.logBytes = 12;
             nextRead =
-                ((uint64_t)pte & (mask(20) << 12)) + vaddr.norml2 * size;
+                ((uint64_t)pte & (mask(20) << 12)) + vaddr.norml2 * dataSize;
             nextState = PTE;
             break;
         } else {
             // 4 MB page
-            entry.size = 4 * (1 << 20);
+            entry.logBytes = 21;
             entry.paddr = bits(pte, 20, 13) << 32 | bits(pte, 31, 22) << 22;
             entry.uncacheable = uncacheable;
             entry.global = pte.g;
             entry.patBit = bits(pte, 12);
             entry.vaddr = entry.vaddr & ~((4 * (1 << 20)) - 1);
-            tlb->insert(entry.vaddr, entry);
-            stop();
-            return NoFault;
+            doTLBInsert = true;
+            doEndWalk = true;
+            break;
         }
       case PD:
         DPRINTF(PageTableWalker,
@@ -274,12 +479,13 @@ Walker::doNext(PacketPtr &write)
         entry.writable = pte.w;
         entry.user = pte.u;
         if (!pte.p) {
-            stop();
-            return pageFault(pte.p);
+            doEndWalk = true;
+            fault = pageFault(pte.p);
+            break;
         }
         // 4 KB page
-        entry.size = 4 * (1 << 10);
-        nextRead = ((uint64_t)pte & (mask(20) << 12)) + vaddr.norml2 * size;
+        entry.logBytes = 12;
+        nextRead = ((uint64_t)pte & (mask(20) << 12)) + vaddr.norml2 * dataSize;
         nextState = PTE;
         break;
       case PTE:
@@ -290,67 +496,70 @@ Walker::doNext(PacketPtr &write)
         entry.writable = pte.w;
         entry.user = pte.u;
         if (!pte.p) {
-            stop();
-            return pageFault(pte.p);
+            doEndWalk = true;
+            fault = pageFault(pte.p);
+            break;
         }
         entry.paddr = (uint64_t)pte & (mask(20) << 12);
         entry.uncacheable = uncacheable;
         entry.global = pte.g;
         entry.patBit = bits(pte, 7);
         entry.vaddr = entry.vaddr & ~((4 * (1 << 10)) - 1);
-        tlb->insert(entry.vaddr, entry);
-        stop();
-        return NoFault;
+        doTLBInsert = true;
+        doEndWalk = true;
+        break;
       default:
         panic("Unknown page table walker state %d!\n");
     }
-    PacketPtr oldRead = read;
-    //If we didn't return, we're setting up another read.
-    Request::Flags flags = oldRead->req->getFlags();
-    flags.set(Request::UNCACHEABLE, uncacheable);
-    RequestPtr request =
-        new Request(nextRead, oldRead->getSize(), flags);
-    read = new Packet(request, MemCmd::ReadExReq, Packet::Broadcast);
-    read->allocate();
-    //If we need to write, adjust the read packet to write the modified value
-    //back to memory.
-    if (doWrite) {
-        write = oldRead;
-        write->set<uint64_t>(pte);
-        write->cmd = MemCmd::WriteReq;
-        write->setDest(Packet::Broadcast);
+    if (doEndWalk) {
+        if (doTLBInsert)
+            if (!functional)
+                walker->tlb->insert(entry.vaddr, entry);
+        endWalk();
     } else {
-        write = NULL;
-        delete oldRead->req;
-        delete oldRead;
+        PacketPtr oldRead = read;
+        //If we didn't return, we're setting up another read.
+        Request::Flags flags = oldRead->req->getFlags();
+        flags.set(Request::UNCACHEABLE, uncacheable);
+        RequestPtr request = std::make_shared<Request>(
+            nextRead, oldRead->getSize(), flags, walker->masterId);
+        read = new Packet(request, MemCmd::ReadReq);
+        read->allocate();
+        // If we need to write, adjust the read packet to write the modified
+        // value back to memory.
+        if (doWrite) {
+            write = oldRead;
+            write->setLE<uint64_t>(pte);
+            write->cmd = MemCmd::WriteReq;
+        } else {
+            write = NULL;
+            delete oldRead;
+        }
     }
-    return NoFault;
+    return fault;
 }
 
-Fault
-Walker::start(ThreadContext * _tc, BaseTLB::Translation *_translation,
-        RequestPtr _req, bool _write, bool _execute)
+void
+Walker::WalkerState::endWalk()
 {
-    assert(state == Ready);
-    tc = _tc;
-    req = _req;
-    Addr vaddr = req->getVaddr();
-    execute = _execute;
-    write = _write;
-    translation = _translation;
+    nextState = Ready;
+    delete read;
+    read = NULL;
+}
 
+void
+Walker::WalkerState::setupWalk(Addr vaddr)
+{
     VAddr addr = vaddr;
-
-    //Figure out what we're doing.
     CR3 cr3 = tc->readMiscRegNoEffect(MISCREG_CR3);
-    Addr top = 0;
     // Check if we're in long mode or not
     Efer efer = tc->readMiscRegNoEffect(MISCREG_EFER);
-    size = 8;
+    dataSize = 8;
+    Addr topAddr;
     if (efer.lma) {
         // Do long mode.
         state = LongPML4;
-        top = (cr3.longPdtb << 12) + addr.longl4 * size;
+        topAddr = (cr3.longPdtb << 12) + addr.longl4 * dataSize;
         enableNX = efer.nxe;
     } else {
         // We're in some flavor of legacy mode.
@@ -358,11 +567,11 @@ Walker::start(ThreadContext * _tc, BaseTLB::Translation *_translation,
         if (cr4.pae) {
             // Do legacy PAE.
             state = PAEPDP;
-            top = (cr3.paePdtb << 5) + addr.pael3 * size;
+            topAddr = (cr3.paePdtb << 5) + addr.pael3 * dataSize;
             enableNX = efer.nxe;
         } else {
-            size = 4;
-            top = (cr3.pdtb << 12) + addr.norml2 * size;
+            dataSize = 4;
+            topAddr = (cr3.pdtb << 12) + addr.norml2 * dataSize;
             if (cr4.pse) {
                 // Do legacy PSE.
                 state = PSEPD;
@@ -380,144 +589,76 @@ Walker::start(ThreadContext * _tc, BaseTLB::Translation *_translation,
     Request::Flags flags = Request::PHYSICAL;
     if (cr3.pcd)
         flags.set(Request::UNCACHEABLE);
-    RequestPtr request = new Request(top, size, flags);
-    read = new Packet(request, MemCmd::ReadExReq, Packet::Broadcast);
-    read->allocate();
-    Enums::MemoryMode memMode = sys->getMemoryMode();
-    if (memMode == Enums::timing) {
-        nextState = state;
-        state = Waiting;
-        timingFault = NoFault;
-        sendPackets();
-    } else if (memMode == Enums::atomic) {
-        Fault fault;
-        do {
-            port.sendAtomic(read);
-            PacketPtr write = NULL;
-            fault = doNext(write);
-            assert(fault == NoFault || read == NULL);
-            state = nextState;
-            nextState = Ready;
-            if (write)
-                port.sendAtomic(write);
-        } while(read);
-        state = Ready;
-        nextState = Waiting;
-        return fault;
-    } else {
-        panic("Unrecognized memory system mode.\n");
-    }
-    return NoFault;
-}
 
-bool
-Walker::WalkerPort::recvTiming(PacketPtr pkt)
-{
-    return walker->recvTiming(pkt);
+    RequestPtr request = std::make_shared<Request>(
+        topAddr, dataSize, flags, walker->masterId);
+
+    read = new Packet(request, MemCmd::ReadReq);
+    read->allocate();
 }
 
 bool
-Walker::recvTiming(PacketPtr pkt)
+Walker::WalkerState::recvPacket(PacketPtr pkt)
 {
-    if (pkt->isResponse() && !pkt->wasNacked()) {
-        assert(inflight);
-        assert(state == Waiting);
-        assert(!read);
-        inflight--;
-        if (pkt->isRead()) {
-            state = nextState;
-            nextState = Ready;
-            PacketPtr write = NULL;
-            read = pkt;
-            timingFault = doNext(write);
-            state = Waiting;
-            assert(timingFault == NoFault || read == NULL);
-            if (write) {
-                writes.push_back(write);
-            }
-            sendPackets();
-        } else {
-            sendPackets();
-        }
-        if (inflight == 0 && read == NULL && writes.size() == 0) {
-            state = Ready;
-            nextState = Waiting;
-            if (timingFault == NoFault) {
-                /*
-                 * Finish the translation. Now that we now the right entry is
-                 * in the TLB, this should work with no memory accesses.
-                 * There could be new faults unrelated to the table walk like
-                 * permissions violations, so we'll need the return value as
-                 * well.
-                 */
-                bool delayedResponse;
-                Fault fault = tlb->translate(req, tc, NULL, write, execute,
-                        delayedResponse, true);
-                assert(!delayedResponse);
-                // Let the CPU continue.
-                translation->finish(fault, req, tc, write);
-            } else {
-                // There was a fault during the walk. Let the CPU know.
-                translation->finish(timingFault, req, tc, write);
-            }
-        }
-    } else if (pkt->wasNacked()) {
-        pkt->reinitNacked();
-        if (!port.sendTiming(pkt)) {
-            inflight--;
-            retrying = true;
-            if (pkt->isWrite()) {
-                writes.push_back(pkt);
-            } else {
-                assert(!read);
-                read = pkt;
-            }
-        }
+    assert(pkt->isResponse());
+    assert(inflight);
+    assert(state == Waiting);
+    inflight--;
+    if (squashed) {
+        // if were were squashed, return true once inflight is zero and
+        // this WalkerState will be freed there.
+        return (inflight == 0);
     }
-    return true;
-}
-
-Tick
-Walker::WalkerPort::recvAtomic(PacketPtr pkt)
-{
-    return 0;
-}
+    if (pkt->isRead()) {
+        // should not have a pending read it we also had one outstanding
+        assert(!read);
 
-void
-Walker::WalkerPort::recvFunctional(PacketPtr pkt)
-{
-    return;
-}
+        // @todo someone should pay for this
+        pkt->headerDelay = pkt->payloadDelay = 0;
 
-void
-Walker::WalkerPort::recvStatusChange(Status status)
-{
-    if (status == RangeChange) {
-        if (!snoopRangeSent) {
-            snoopRangeSent = true;
-            sendStatusChange(Port::RangeChange);
+        state = nextState;
+        nextState = Ready;
+        PacketPtr write = NULL;
+        read = pkt;
+        timingFault = stepWalk(write);
+        state = Waiting;
+        assert(timingFault == NoFault || read == NULL);
+        if (write) {
+            writes.push_back(write);
         }
-        return;
+        sendPackets();
+    } else {
+        sendPackets();
+    }
+    if (inflight == 0 && read == NULL && writes.size() == 0) {
+        state = Ready;
+        nextState = Waiting;
+        if (timingFault == NoFault) {
+            /*
+             * Finish the translation. Now that we know the right entry is
+             * in the TLB, this should work with no memory accesses.
+             * There could be new faults unrelated to the table walk like
+             * permissions violations, so we'll need the return value as
+             * well.
+             */
+            bool delayedResponse;
+            Fault fault = walker->tlb->translate(req, tc, NULL, mode,
+                                                 delayedResponse, true);
+            assert(!delayedResponse);
+            // Let the CPU continue.
+            translation->finish(fault, req, tc, mode);
+        } else {
+            // There was a fault during the walk. Let the CPU know.
+            translation->finish(timingFault, req, tc, mode);
+        }
+        return true;
     }
 
-    panic("Unexpected recvStatusChange.\n");
-}
-
-void
-Walker::WalkerPort::recvRetry()
-{
-    walker->recvRetry();
+    return false;
 }
 
 void
-Walker::recvRetry()
-{
-    retrying = false;
-    sendPackets();
-}
-
-void
-Walker::sendPackets()
+Walker::WalkerState::sendPackets()
 {
     //If we're already waiting for the port to become available, just return.
     if (retrying)
@@ -528,7 +669,7 @@ Walker::sendPackets()
         PacketPtr pkt = read;
         read = NULL;
         inflight++;
-        if (!port.sendTiming(pkt)) {
+        if (!walker->sendTiming(this, pkt)) {
             retrying = true;
             read = pkt;
             inflight--;
@@ -540,7 +681,7 @@ Walker::sendPackets()
         PacketPtr write = writes.back();
         writes.pop_back();
         inflight++;
-        if (!port.sendTiming(write)) {
+        if (!walker->sendTiming(this, write)) {
             retrying = true;
             writes.push_back(write);
             inflight--;
@@ -549,25 +690,55 @@ Walker::sendPackets()
     }
 }
 
-Port *
-Walker::getPort(const std::string &if_name, int idx)
+unsigned
+Walker::WalkerState::numInflight() const
 {
-    if (if_name == "port")
-        return &port;
-    else
-        panic("No page table walker port named %s!\n", if_name);
+    return inflight;
+}
+
+bool
+Walker::WalkerState::isRetrying()
+{
+    return retrying;
+}
+
+bool
+Walker::WalkerState::isTiming()
+{
+    return timing;
+}
+
+bool
+Walker::WalkerState::wasStarted()
+{
+    return started;
+}
+
+void
+Walker::WalkerState::squash()
+{
+    squashed = true;
+}
+
+void
+Walker::WalkerState::retry()
+{
+    retrying = false;
+    sendPackets();
 }
 
 Fault
-Walker::pageFault(bool present)
+Walker::WalkerState::pageFault(bool present)
 {
     DPRINTF(PageTableWalker, "Raising page fault.\n");
     HandyM5Reg m5reg = tc->readMiscRegNoEffect(MISCREG_M5_REG);
-    return new PageFault(entry.vaddr, present, write,
-            m5reg.cpl == 3, false, execute && enableNX);
+    if (mode == BaseTLB::Execute && !enableNX)
+        mode = BaseTLB::Read;
+    return std::make_shared<PageFault>(entry.vaddr, present, mode,
+                                       m5reg.cpl == 3, false);
 }
 
-}
+/* end namespace X86ISA */ }
 
 X86ISA::Walker *
 X86PagetableWalkerParams::create()