Hi Fuad, Thanks for separating the fixes from the tests.
On Wed, Oct 07, 2026 at 09:00:17AM +0100, Fuad Tabba wrote: > get_phys_addr_lpae() can read the first descriptor of a walk from the > wrong address. This happens with a 52-bit OA when the initial lookup > table has fewer than eight entries and its base address has bit 51 set, > or bit 50 for a two-entry table. The walk then faults or translates > through whatever that address holds. VTTBR walks for stage 2 take the > same path. > > For example, the 16KB granule with a 48-bit VA has a two-entry level 0 > (FEAT_LPA2). The 64KB granule with a 44-bit VA has a four-entry level 1 > (FEAT_LPA). KVM's page_fault_test hangs on this in its 16KB, 52-bit PA > guest mode under TCG, as reported on kvmarm. > > With a 52-bit OA, TTBR[5:2] hold bits [51:48] of the base address. Such > a table is 64-byte aligned (R_KBLCR), so bits [5:0] of the base address > are zero. get_phys_addr_lpae() ORs TTBR[5:2] into bits [51:48], but > then clears only the bits in indexmask. For these tables indexmask > covers fewer than six bits, so TTBR[5] stays in the address, and > TTBR[4] too for a two-entry table. > > Clear TTBR[5:0] when forming a 52-bit table base address. > > Reported-by: Itaru Kitayama <[email protected]> > Link: > https://lore.kernel.org/kvmarm/[email protected]/ > Fixes: 7a928f43d872 ("target/arm: Implement FEAT_LPA") > Cc: [email protected] > Signed-off-by: Fuad Tabba <[email protected]> > --- > target/arm/ptw.c | 5 ++++- > 1 file changed, 4 insertions(+), 1 deletion(-) > > diff --git a/target/arm/ptw.c b/target/arm/ptw.c > index de0435a58b..6cff52d592 100644 > --- a/target/arm/ptw.c > +++ b/target/arm/ptw.c > @@ -2107,13 +2107,16 @@ static bool get_phys_addr_lpae(CPUARMState *env, > S1Translate *ptw, > descaddr = extract64(ttbr, 0, 48); > > /* > - * For FEAT_LPA and PS=6, bits [51:48] of descaddr are in [5:2] of TTBR. > + * With a 52-bit OA (FEAT_LPA or FEAT_LPA2), bits [51:48] of descaddr are > + * in [5:2] of TTBR, and bits [5:0] of the base address are zero: a table > + * under 64 bytes is still 64-byte aligned (R_KBLCR). > * > * Otherwise, if the base address is out of range, raise > AddressSizeFault. > * In the pseudocode, this is !IsZero(baseregister<47:outputsize>), > * but we've just cleared the bits above 47, so simplify the test. > */ > if (outputsize > 48) { > + descaddr &= ~MAKE_64BIT_MASK(0, 6); > descaddr |= extract64(ttbr, 2, 4) << 48; > } else if (descaddr >> outputsize) { > level = 0; > -- > 2.39.5 > Reviewed-by: Gustavo Romero <[email protected]> Cheers, Gustavo
