Aarch64: VTCR.T0SZ / iasize test for Aarch32 guests wrong
Host environment
- Operating system: Debian/Sid/Bookworm
- OS/kernel version: 6.1.25 (Debian)
- Architecture: x86 / 64-bit
- QEMU flavor: qemu-system-aarch64
- QEMU version: v8.0.0-248-g732d6603d0-dirty
- QEMU command line:
qemu-system-aarch64 \ -kernel bootstrap.elf -serial stdio -display none -nic none \ -m 1024 -smp 4,cores=4,maxcpus=4 -machine virt,virtualization=true
Emulated/Virtualized environment
- Operating system: L4Re (custom)
- OS/kernel version: L4Re kernel
- Architecture: ARM (Aarch64)
Description of problem
With QEMU 8 we are no longer able to execute Aarch32 guest code on an Aarch64 host. We use virtualization for the QEMU guest:
- The QEMU guest kernel (L4Re kernel) runs at EL2 in AArch64 mode.
- The L4Re guest code runs at EL1 in AAarch32 mode.
It seems that the check for T0SZ / iasize in ptw.c
/ check_s2_mmu_setup()
is too strict:
if (is_aa64) {
/*
* AArch64.S2InvalidTxSZ: While we checked tsz_oob near the top of
* get_phys_addr_lpae, that used aa64_va_parameters which apply
* to aarch64. If Stage1 is aarch32, the min_txsz is larger.
* See AArch64.S2MinTxSZ, where min_tsz is 24, translated to
* inputsize is 64 - 24 = 40.
*/
if (iasize < 40 && !arm_el_is_aa64(&cpu->env, 1)) {
goto fail;
}
The above test fails for us when executing Aarch32 EL1 code on Aarch64 EL2.
Please note that the comment talks about S2MinTxSZ
/ min_tsz
, so if the minimum value of T0SZ
is 24, then the maximum value of iasize
is 64-24=40
so the following comparison would be more appropriate (I replaces <
by >
):
if (iasize > 40 && !arm_el_is_aa64(&cpu->env, 1)) {
goto fail;
}
However, the minimum value of VTCR_EL2.T0SZ
is either 16 or 12, see VTCR_EL2.DS
:
-
VTCR_EL2.DS=0b0
: minimum value ofVTCR_EL2.T0SZ
is 16 => maximum value ofiasize
is 48, -
VTCR_EL2.DS=0b1
: minimum value ofVTCR_EL2.T0SZ
is 12 => maximum value ofiasize
is 52.
Regarding the minimum of iasize
/ maximum of VTCR_EL2.T0SZ
, see ID_AA64MMFR_EL1.ST
:
-
ID_AA64MMFR2_EL1.ST=0b0000
: maximum value ofVTCR_EL2.T0SZ
is 39 => minimum value ofiasize
is 25, -
ID_AA64MMFR2_EL1.ST=0b0001
: maximum value ofVTCR_EL2.T0SZ
is 48 => minimum value ofiasize
is 16 (or 47/17 for 64KiB granules).
Our system executes Aarch32 EL1 code fine on Aarch64 EL2 if I weaken the comparison.
Additional information
Sorry for not providing a test build but I'm not sure if it's worth to provide a custom build of our L4Re system, but I will happily provide one if you insist.