On Tue, 3 Dec 2019 at 02:30, Richard Henderson
<richard.hender...@linaro.org> wrote:
>
> Signed-off-by: Richard Henderson <richard.hender...@linaro.org>
> ---
> target/arm/helper.c | 33 ++++++++++++++++++++++++++-------
> 1 file changed, 26 insertions(+), 7 deletions(-)
>
> diff --git a/target/arm/helper.c b/target/arm/helper.c
> index 2a4d4c2c0d..b059d9f81a 100644
> --- a/target/arm/helper.c
> +++ b/target/arm/helper.c
> @@ -4123,8 +4123,12 @@ static CPAccessResult aa64_cacheop_access(CPUARMState
> *env,
>
> static int vae1_tlbmask(CPUARMState *env)
> {
> + /* Since we exclude secure first, we may read HCR_EL2 directly. */
> if (arm_is_secure_below_el3(env)) {
> return ARMMMUIdxBit_SE1 | ARMMMUIdxBit_SE0;
> + } else if ((env->cp15.hcr_el2 & (HCR_E2H | HCR_TGE))
> + == (HCR_E2H | HCR_TGE)) {
> + return ARMMMUIdxBit_EL20_2 | ARMMMUIdxBit_EL20_0;
> } else {
> return ARMMMUIdxBit_EL10_1 | ARMMMUIdxBit_EL10_0;
> }
> @@ -4158,9 +4162,14 @@ static int vmalle1_tlbmask(CPUARMState *env)
> * Note that the 'ALL' scope must invalidate both stage 1 and
> * stage 2 translations, whereas most other scopes only invalidate
> * stage 1 translations.
> + *
> + * Since we exclude secure first, we may read HCR_EL2 directly.
> */
> if (arm_is_secure_below_el3(env)) {
> return ARMMMUIdxBit_SE1 | ARMMMUIdxBit_SE0;
> + } else if ((env->cp15.hcr_el2 & (HCR_E2H | HCR_TGE))
> + == (HCR_E2H | HCR_TGE)) {
> + return ARMMMUIdxBit_EL20_2 | ARMMMUIdxBit_EL20_0;
> } else if (arm_feature(env, ARM_FEATURE_EL2)) {
> return ARMMMUIdxBit_EL10_1 | ARMMMUIdxBit_EL10_0 |
> ARMMMUIdxBit_Stage2;
> } else {
> @@ -4177,13 +4186,22 @@ static void tlbi_aa64_alle1_write(CPUARMState *env,
> const ARMCPRegInfo *ri,
> tlb_flush_by_mmuidx(cs, mask);
> }
>
> +static int vae2_tlbmask(CPUARMState *env)
> +{
> + if (arm_hcr_el2_eff(env) & HCR_E2H) {
> + return ARMMMUIdxBit_EL20_0 | ARMMMUIdxBit_EL20_2;
> + } else {
> + return ARMMMUIdxBit_E2;
> + }
> +}
> +
> static void tlbi_aa64_alle2_write(CPUARMState *env, const ARMCPRegInfo *ri,
> uint64_t value)
> {
> - ARMCPU *cpu = env_archcpu(env);
> - CPUState *cs = CPU(cpu);
> + CPUState *cs = env_cpu(env);
> + int mask = vae2_tlbmask(env);
Why do we use the 'v' mask function for a non 'v' TLB op?
>
> - tlb_flush_by_mmuidx(cs, ARMMMUIdxBit_E2);
> + tlb_flush_by_mmuidx(cs, mask);
The spec fror TLBI ALLE2 doesn't say it depends on
what the E2H setting is. It says it flushes all entries
for either NS EL2 or NS EL2&0 translation regimes.
Wouldn't that be
ARMMMUIdxBit_EL20_0 | ARMMMUIdxBit_EL20_2 | ARMMMUIdxBit_E2
?
Contrast TLBI VAE2, which does say that the entries it
flushes depend on the current setting of HCR_EL2.E2H.
> }
thanks
-- PMM
