Re: [Qemu-devel] [PATCH v2 3/3] target/arm: Flush only the TLBs affected by TTBR*_EL1

[Peter Maydell]

On 19 October 2018 at 02:56, Richard Henderson
<address@hidden> wrote:
> Only the EL0 and EL1 TLBs are affected by the EL1 register,
> so flush only 2 of the 8 TLBs.
>
> In testing a boot of the Ubuntu installer to the first menu, this
> accounts for nearly all of the full tlb flushes: all but 11k of
> the 1.2M instances without the patch.
>
> Signed-off-by: Richard Henderson <address@hidden>
> ---
>  target/arm/helper.c | 16 +++++++++-------
>  1 file changed, 9 insertions(+), 7 deletions(-)
>
> diff --git a/target/arm/helper.c b/target/arm/helper.c
> index ed70ac645e..3ba8e66487 100644
> --- a/target/arm/helper.c
> +++ b/target/arm/helper.c
> @@ -2706,14 +2706,16 @@ static void vmsa_tcr_el1_write(CPUARMState *env, 
> const ARMCPRegInfo *ri,
>      tcr->raw_tcr = value;
>  }
>
> -static void vmsa_ttbr_write(CPUARMState *env, const ARMCPRegInfo *ri,
> -                            uint64_t value)
> +static void vmsa_ttbr_el1_write(CPUARMState *env, const ARMCPRegInfo *ri,
> +                                uint64_t value)
>  {
>      /* If the ASID changes (with a 64-bit write), we must flush the TLB.  */
>      if (cpreg_field_is_64bit(ri) &&
>          extract64(raw_read(env, ri) ^ value, 48, 16) != 0) {
>          ARMCPU *cpu = arm_env_get_cpu(env);
> -        tlb_flush(CPU(cpu));
> +        tlb_flush_by_mmuidx(CPU(cpu),
> +                            ARMMMUIdxBit_S12NSE1 |
> +                            ARMMMUIdxBit_S12NSE0);

This isn't taking account of the possibility of secure mode.
ARMMMUIdxBit_S1SE0 and ARMMMUIdxBit_S1SE1 might also be affected.

And for AArch32, this writefn is used for the secure-banked versions
of TTBR0/TTBR1, which means ARMMMUIdxBit_S1E3 may also need flushing.

thanks
-- PMM