get_phys_addr_lpae() can read the first descriptor of a walk from the wrong address. This happens with a 52-bit OA when the initial lookup table has fewer than eight entries and its base address has bit 51 set, or bit 50 for a two-entry table. The walk then faults or translates through whatever that address holds. VTTBR walks for stage 2 take the same path.
For example, the 16KB granule with a 48-bit VA has a two-entry level 0 (FEAT_LPA2). The 64KB granule with a 44-bit VA has a four-entry level 1 (FEAT_LPA). KVM's page_fault_test hangs on this in its 16KB, 52-bit PA guest mode under TCG, as reported on kvmarm. With a 52-bit OA, TTBR[5:2] hold bits [51:48] of the base address. Such a table is 64-byte aligned (R_KBLCR), so bits [5:0] of the base address are zero. get_phys_addr_lpae() ORs TTBR[5:2] into bits [51:48], but then clears only the bits in indexmask. For these tables indexmask covers fewer than six bits, so TTBR[5] stays in the address, and TTBR[4] too for a two-entry table. Clear TTBR[5:0] when forming a 52-bit table base address. Reported-by: Itaru Kitayama <[email protected]> Link: https://lore.kernel.org/kvmarm/[email protected]/ Fixes: 7a928f43d872 ("target/arm: Implement FEAT_LPA") Cc: [email protected] Signed-off-by: Fuad Tabba <[email protected]> --- target/arm/ptw.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/target/arm/ptw.c b/target/arm/ptw.c index de0435a58b..6cff52d592 100644 --- a/target/arm/ptw.c +++ b/target/arm/ptw.c @@ -2107,13 +2107,16 @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw, descaddr = extract64(ttbr, 0, 48); /* - * For FEAT_LPA and PS=6, bits [51:48] of descaddr are in [5:2] of TTBR. + * With a 52-bit OA (FEAT_LPA or FEAT_LPA2), bits [51:48] of descaddr are + * in [5:2] of TTBR, and bits [5:0] of the base address are zero: a table + * under 64 bytes is still 64-byte aligned (R_KBLCR). * * Otherwise, if the base address is out of range, raise AddressSizeFault. * In the pseudocode, this is !IsZero(baseregister<47:outputsize>), * but we've just cleared the bits above 47, so simplify the test. */ if (outputsize > 48) { + descaddr &= ~MAKE_64BIT_MASK(0, 6); descaddr |= extract64(ttbr, 2, 4) << 48; } else if (descaddr >> outputsize) { level = 0; -- 2.39.5
