[PATCH v2 0/3] target/arm: Fix the TTBR table base address in its 52-bit layout

[Fuad Tabba <fuad.tabba@linux.dev>]

Hi folks,

Changes since v1 [1]:
  - Moved the test into its own patch, after the two fixes. (Gustavo)
  - Various fixes. (Peter, Gustavo)

Two fixes to how get_phys_addr_lpae() forms the initial table base
address when TTBR uses its 52-bit layout, then a TCG test for both.

The first stops TTBR[5:4] leaking into the base address of a table
smaller than 64 bytes. KVM's page_fault_test hangs on it under TCG in
its 16KB, 52-bit PA guest mode. Itaru reported the 16KB hang on kvmarm
last year [2].

The second uses the 52-bit layout whenever TCR.DS is set, as the
architecture does, not only with a 52-bit OA. With a smaller OA a
non-zero TTBR[5:2] is then an Address size fault.

Based on QEMU master (f7ada39eda).

Cheers,
/fuad

[1] https://msgid.link/20261001175003.ttbr-baddr-52bit-0-fuad.tabba@linux.dev
[2] https://msgid.link/B4C0AC3E-6A4F-4A7B-B7BC-81207539115E@linux.dev

Fuad Tabba (3):
  target/arm: Clear TTBR[5:0] from a 52-bit table base address
  target/arm: Use the 52-bit TTBR base address layout when TCR.DS is set
  tests/tcg/aarch64: Add a test for the 52-bit TTBR base address layout

 target/arm/ptw.c                      |  18 ++-
 tests/tcg/aarch64/system/meson.build  |   6 +
 tests/tcg/aarch64/system/ttbr-baddr.c | 197 ++++++++++++++++++++++++++
 3 files changed, 215 insertions(+), 6 deletions(-)
 create mode 100644 tests/tcg/aarch64/system/ttbr-baddr.c

-- 
2.39.5