[v3] target/arm: Fix the TTBR table base address in its 52-bit layout

[PATCH v3 0/4] target/arm: Fix the TTBR table base address in its 52-bit layout

Posted by Fuad Tabba 1 week, 6 days ago

Hi folks,

Changes since v2 [1]:
  - Each fix is now followed by its own test, and the test description
    moved from the commit message into the file header. (Gustavo)
  - Clarified the stage 2 comment in the test. (Gustavo)
  - Noted that RAM_BASE matches the address kernel.ld links the test
    at. (Gustavo)
  - Collected Reviewed-by from Gustavo on all patches. (thanks!)

Two fixes to how get_phys_addr_lpae() forms the initial table base
address when TTBR uses its 52-bit layout, each followed by a TCG test.

The first stops TTBR[5:4] leaking into the base address of a table
smaller than 64 bytes. KVM's page_fault_test hangs on it under TCG in
its 16KB, 52-bit PA guest mode. Itaru reported the 16KB hang on kvmarm
last year [2].

The second uses the 52-bit layout whenever TCR.DS is set, as the
architecture does, where QEMU used it only with a 52-bit OA. With a
smaller OA a non-zero TTBR[5:2] is then an Address size fault.

Based on QEMU master (f7ada39eda).

Cheers,
/fuad

[1] https://lore.kernel.org/r/20261007080019.350315-1-fuad.tabba@linux.dev
[2] https://lore.kernel.org/r/B4C0AC3E-6A4F-4A7B-B7BC-81207539115E@linux.dev

Fuad Tabba (4):
  target/arm: Clear TTBR[5:0] from a 52-bit table base address
  tests/tcg/aarch64: Add a test for a two-entry 52-bit TTBR table
  target/arm: Use the 52-bit TTBR base address layout when TCR.DS is set
  tests/tcg/aarch64: Test the TTBR layout with TCR.DS and a 48-bit OA

 target/arm/ptw.c                      |  18 ++-
 tests/tcg/aarch64/system/meson.build  |   6 +
 tests/tcg/aarch64/system/ttbr-baddr.c | 208 ++++++++++++++++++++++++++
 3 files changed, 226 insertions(+), 6 deletions(-)
 create mode 100644 tests/tcg/aarch64/system/ttbr-baddr.c


base-commit: f7ada39edacaa5c26b30e98b94017b0b2ccbcf94
-- 
2.39.5

Re: [PATCH v3 0/4] target/arm: Fix the TTBR table base address in its 52-bit layout

Posted by Peter Maydell 1 week, 3 days ago

On Fri, 9 Oct 2026 at 12:57, Fuad Tabba <fuad.tabba@linux.dev> wrote:
>
> Hi folks,
>
> Changes since v2 [1]:
>   - Each fix is now followed by its own test, and the test description
>     moved from the commit message into the file header. (Gustavo)
>   - Clarified the stage 2 comment in the test. (Gustavo)
>   - Noted that RAM_BASE matches the address kernel.ld links the test
>     at. (Gustavo)
>   - Collected Reviewed-by from Gustavo on all patches. (thanks!)
>
> Two fixes to how get_phys_addr_lpae() forms the initial table base
> address when TTBR uses its 52-bit layout, each followed by a TCG test.
>
> The first stops TTBR[5:4] leaking into the base address of a table
> smaller than 64 bytes. KVM's page_fault_test hangs on it under TCG in
> its 16KB, 52-bit PA guest mode. Itaru reported the 16KB hang on kvmarm
> last year [2].
>
> The second uses the 52-bit layout whenever TCR.DS is set, as the
> architecture does, where QEMU used it only with a 52-bit OA. With a
> smaller OA a non-zero TTBR[5:2] is then an Address size fault.
>
> Based on QEMU master (f7ada39eda).
>
> Cheers,
> /fuad
>
> [1] https://lore.kernel.org/r/20261007080019.350315-1-fuad.tabba@linux.dev
> [2] https://lore.kernel.org/r/B4C0AC3E-6A4F-4A7B-B7BC-81207539115E@linux.dev
>
> Fuad Tabba (4):
>   target/arm: Clear TTBR[5:0] from a 52-bit table base address
>   tests/tcg/aarch64: Add a test for a two-entry 52-bit TTBR table
>   target/arm: Use the 52-bit TTBR base address layout when TCR.DS is set
>   tests/tcg/aarch64: Test the TTBR layout with TCR.DS and a 48-bit OA



Applied to target-arm.next, thanks.

-- PMM