Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

KVM: arm64: selftests: Disable unused TTBR1_EL1 translations

KVM selftests map all guest code and data into the lower virtual address
range (0x0000...) managed by TTBR0_EL1. The upper range (0xFFFF...)
managed by TTBR1_EL1 is unused and uninitialized.

If a guest accesses the upper range, the MMU attempts a translation
table walk using uninitialized registers, leading to unpredictable
behavior.

Set `TCR_EL1.EPD1` to disable translation table walks for TTBR1_EL1,
ensuring that any access to the upper range generates an immediate
Translation Fault. Additionally, set `TCR_EL1.TBI1` (Top Byte Ignore) to
ensure that tagged pointers in the upper range also deterministically
trigger a Translation Fault via EPD1.

Define `TCR_EPD1_MASK`, `TCR_EPD1_SHIFT`, and `TCR_TBI1` in
`processor.h` to support this configuration. These are based on their
definitions in `arch/arm64/include/asm/pgtable-hwdef.h`.

Suggested-by: Will Deacon <will@kernel.org>
Reviewed-by: Itaru Kitayama <itaru.kitayama@fujitsu.com>
Signed-off-by: Fuad Tabba <tabba@google.com>
Link: https://patch.msgid.link/20260109082218.3236580-2-tabba@google.com
Signed-off-by: Marc Zyngier <maz@kernel.org>

authored by

Fuad Tabba and committed by
Marc Zyngier
7e03d07d 9ace4753

+6
+4
tools/testing/selftests/kvm/include/arm64/processor.h
··· 90 90 #define TCR_TG0_64K (UL(1) << TCR_TG0_SHIFT) 91 91 #define TCR_TG0_16K (UL(2) << TCR_TG0_SHIFT) 92 92 93 + #define TCR_EPD1_SHIFT 23 94 + #define TCR_EPD1_MASK (UL(1) << TCR_EPD1_SHIFT) 95 + 93 96 #define TCR_IPS_SHIFT 32 94 97 #define TCR_IPS_MASK (UL(7) << TCR_IPS_SHIFT) 95 98 #define TCR_IPS_52_BITS (UL(6) << TCR_IPS_SHIFT) ··· 100 97 #define TCR_IPS_40_BITS (UL(2) << TCR_IPS_SHIFT) 101 98 #define TCR_IPS_36_BITS (UL(1) << TCR_IPS_SHIFT) 102 99 100 + #define TCR_TBI1 (UL(1) << 38) 103 101 #define TCR_HA (UL(1) << 39) 104 102 #define TCR_DS (UL(1) << 59) 105 103
+2
tools/testing/selftests/kvm/lib/arm64/processor.c
··· 384 384 385 385 tcr_el1 |= TCR_IRGN0_WBWA | TCR_ORGN0_WBWA | TCR_SH0_INNER; 386 386 tcr_el1 |= TCR_T0SZ(vm->va_bits); 387 + tcr_el1 |= TCR_TBI1; 388 + tcr_el1 |= TCR_EPD1_MASK; 387 389 if (use_lpa2_pte_format(vm)) 388 390 tcr_el1 |= TCR_DS; 389 391