diff mbox series

[v4,30/40] target/arm: Flush tlbs for E2&0 translation regime

Message ID 20191203022937.1474-31-richard.henderson@linaro.org
State New
Headers show
Series target/arm: Implement ARMv8.1-VHE | expand

Commit Message

Richard Henderson Dec. 3, 2019, 2:29 a.m. UTC 
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/arm/helper.c | 33 ++++++++++++++++++++++++++-------
 1 file changed, 26 insertions(+), 7 deletions(-)

Comments

Peter Maydell Dec. 6, 2019, 5:14 p.m. UTC | #1 
On Tue, 3 Dec 2019 at 02:30, Richard Henderson
<richard.henderson@linaro.org> wrote:
>
> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
> ---
>  target/arm/helper.c | 33 ++++++++++++++++++++++++++-------
>  1 file changed, 26 insertions(+), 7 deletions(-)
>
> diff --git a/target/arm/helper.c b/target/arm/helper.c
> index 2a4d4c2c0d..b059d9f81a 100644
> --- a/target/arm/helper.c
> +++ b/target/arm/helper.c
> @@ -4123,8 +4123,12 @@ static CPAccessResult aa64_cacheop_access(CPUARMState *env,
>
>  static int vae1_tlbmask(CPUARMState *env)
>  {
> +    /* Since we exclude secure first, we may read HCR_EL2 directly. */
>      if (arm_is_secure_below_el3(env)) {
>          return ARMMMUIdxBit_SE1 | ARMMMUIdxBit_SE0;
> +    } else if ((env->cp15.hcr_el2 & (HCR_E2H | HCR_TGE))
> +               == (HCR_E2H | HCR_TGE)) {
> +        return ARMMMUIdxBit_EL20_2 | ARMMMUIdxBit_EL20_0;
>      } else {
>          return ARMMMUIdxBit_EL10_1 | ARMMMUIdxBit_EL10_0;
>      }
> @@ -4158,9 +4162,14 @@ static int vmalle1_tlbmask(CPUARMState *env)
>       * Note that the 'ALL' scope must invalidate both stage 1 and
>       * stage 2 translations, whereas most other scopes only invalidate
>       * stage 1 translations.
> +     *
> +     * Since we exclude secure first, we may read HCR_EL2 directly.
>       */
>      if (arm_is_secure_below_el3(env)) {
>          return ARMMMUIdxBit_SE1 | ARMMMUIdxBit_SE0;
> +    } else if ((env->cp15.hcr_el2 & (HCR_E2H | HCR_TGE))
> +               == (HCR_E2H | HCR_TGE)) {
> +        return ARMMMUIdxBit_EL20_2 | ARMMMUIdxBit_EL20_0;
>      } else if (arm_feature(env, ARM_FEATURE_EL2)) {
>          return ARMMMUIdxBit_EL10_1 | ARMMMUIdxBit_EL10_0 | ARMMMUIdxBit_Stage2;
>      } else {
> @@ -4177,13 +4186,22 @@ static void tlbi_aa64_alle1_write(CPUARMState *env, const ARMCPRegInfo *ri,
>      tlb_flush_by_mmuidx(cs, mask);
>  }
>
> +static int vae2_tlbmask(CPUARMState *env)
> +{
> +    if (arm_hcr_el2_eff(env) & HCR_E2H) {
> +        return ARMMMUIdxBit_EL20_0 | ARMMMUIdxBit_EL20_2;
> +    } else {
> +        return ARMMMUIdxBit_E2;
> +    }
> +}
> +
>  static void tlbi_aa64_alle2_write(CPUARMState *env, const ARMCPRegInfo *ri,
>                                    uint64_t value)
>  {
> -    ARMCPU *cpu = env_archcpu(env);
> -    CPUState *cs = CPU(cpu);
> +    CPUState *cs = env_cpu(env);
> +    int mask = vae2_tlbmask(env);

Why do we use the 'v' mask function for a non 'v' TLB op?

>
> -    tlb_flush_by_mmuidx(cs, ARMMMUIdxBit_E2);
> +    tlb_flush_by_mmuidx(cs, mask);

The spec fror TLBI ALLE2 doesn't say it depends on
what the E2H setting is. It says it flushes all entries
for either NS EL2 or NS EL2&0 translation regimes.
Wouldn't that be
ARMMMUIdxBit_EL20_0 | ARMMMUIdxBit_EL20_2 | ARMMMUIdxBit_E2
?

Contrast TLBI VAE2, which does say that the entries it
flushes depend on the current setting of HCR_EL2.E2H.

>  }


thanks
-- PMM
Richard Henderson Jan. 29, 2020, 5:05 p.m. UTC | #2 
On 12/6/19 9:14 AM, Peter Maydell wrote:
>>  static void tlbi_aa64_alle2_write(CPUARMState *env, const ARMCPRegInfo *ri,
>>                                    uint64_t value)
>>  {
>> -    ARMCPU *cpu = env_archcpu(env);
>> -    CPUState *cs = CPU(cpu);
>> +    CPUState *cs = env_cpu(env);
>> +    int mask = vae2_tlbmask(env);
> 
> Why do we use the 'v' mask function for a non 'v' TLB op?
> 
>>
>> -    tlb_flush_by_mmuidx(cs, ARMMMUIdxBit_E2);
>> +    tlb_flush_by_mmuidx(cs, mask);
> 
> The spec fror TLBI ALLE2 doesn't say it depends on
> what the E2H setting is. It says it flushes all entries
> for either NS EL2 or NS EL2&0 translation regimes.
> Wouldn't that be
> ARMMMUIdxBit_EL20_0 | ARMMMUIdxBit_EL20_2 | ARMMMUIdxBit_E2
> ?
> 
> Contrast TLBI VAE2, which does say that the entries it
> flushes depend on the current setting of HCR_EL2.E2H.

Hmm.  True.  It would seem that ALLE1 has the same bug, because I confused
matters in 4a354502869.  Will fix both.


r~
diff mbox series

Patch

diff --git a/target/arm/helper.c b/target/arm/helper.c
index 2a4d4c2c0d..b059d9f81a 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -4123,8 +4123,12 @@  static CPAccessResult aa64_cacheop_access(CPUARMState *env,
 
 static int vae1_tlbmask(CPUARMState *env)
 {
+    /* Since we exclude secure first, we may read HCR_EL2 directly. */
     if (arm_is_secure_below_el3(env)) {
         return ARMMMUIdxBit_SE1 | ARMMMUIdxBit_SE0;
+    } else if ((env->cp15.hcr_el2 & (HCR_E2H | HCR_TGE))
+               == (HCR_E2H | HCR_TGE)) {
+        return ARMMMUIdxBit_EL20_2 | ARMMMUIdxBit_EL20_0;
     } else {
         return ARMMMUIdxBit_EL10_1 | ARMMMUIdxBit_EL10_0;
     }
@@ -4158,9 +4162,14 @@  static int vmalle1_tlbmask(CPUARMState *env)
      * Note that the 'ALL' scope must invalidate both stage 1 and
      * stage 2 translations, whereas most other scopes only invalidate
      * stage 1 translations.
+     *
+     * Since we exclude secure first, we may read HCR_EL2 directly.
      */
     if (arm_is_secure_below_el3(env)) {
         return ARMMMUIdxBit_SE1 | ARMMMUIdxBit_SE0;
+    } else if ((env->cp15.hcr_el2 & (HCR_E2H | HCR_TGE))
+               == (HCR_E2H | HCR_TGE)) {
+        return ARMMMUIdxBit_EL20_2 | ARMMMUIdxBit_EL20_0;
     } else if (arm_feature(env, ARM_FEATURE_EL2)) {
         return ARMMMUIdxBit_EL10_1 | ARMMMUIdxBit_EL10_0 | ARMMMUIdxBit_Stage2;
     } else {
@@ -4177,13 +4186,22 @@  static void tlbi_aa64_alle1_write(CPUARMState *env, const ARMCPRegInfo *ri,
     tlb_flush_by_mmuidx(cs, mask);
 }
 
+static int vae2_tlbmask(CPUARMState *env)
+{
+    if (arm_hcr_el2_eff(env) & HCR_E2H) {
+        return ARMMMUIdxBit_EL20_0 | ARMMMUIdxBit_EL20_2;
+    } else {
+        return ARMMMUIdxBit_E2;
+    }
+}
+
 static void tlbi_aa64_alle2_write(CPUARMState *env, const ARMCPRegInfo *ri,
                                   uint64_t value)
 {
-    ARMCPU *cpu = env_archcpu(env);
-    CPUState *cs = CPU(cpu);
+    CPUState *cs = env_cpu(env);
+    int mask = vae2_tlbmask(env);
 
-    tlb_flush_by_mmuidx(cs, ARMMMUIdxBit_E2);
+    tlb_flush_by_mmuidx(cs, mask);
 }
 
 static void tlbi_aa64_alle3_write(CPUARMState *env, const ARMCPRegInfo *ri,
@@ -4208,8 +4226,9 @@  static void tlbi_aa64_alle2is_write(CPUARMState *env, const ARMCPRegInfo *ri,
                                     uint64_t value)
 {
     CPUState *cs = env_cpu(env);
+    int mask = vae2_tlbmask(env);
 
-    tlb_flush_by_mmuidx_all_cpus_synced(cs, ARMMMUIdxBit_E2);
+    tlb_flush_by_mmuidx_all_cpus_synced(cs, mask);
 }
 
 static void tlbi_aa64_alle3is_write(CPUARMState *env, const ARMCPRegInfo *ri,
@@ -4227,11 +4246,11 @@  static void tlbi_aa64_vae2_write(CPUARMState *env, const ARMCPRegInfo *ri,
      * Currently handles both VAE2 and VALE2, since we don't support
      * flush-last-level-only.
      */
-    ARMCPU *cpu = env_archcpu(env);
-    CPUState *cs = CPU(cpu);
+    CPUState *cs = env_cpu(env);
+    int mask = vae2_tlbmask(env);
     uint64_t pageaddr = sextract64(value << 12, 0, 56);
 
-    tlb_flush_page_by_mmuidx(cs, pageaddr, ARMMMUIdxBit_E2);
+    tlb_flush_page_by_mmuidx(cs, pageaddr, mask);
 }
 
 static void tlbi_aa64_vae3_write(CPUARMState *env, const ARMCPRegInfo *ri,