Re: [PATCH 2/4] xen/arm: guest_walk: refuse an address outside both halves of the range

["Grall, Julien" <julien@xxxxxxx>]

Hi Stefano,

On 07/11/2026 02:14, Stefano Stabellini wrote:
> The bits of an input address from its top bit (bit 63, or bit 55 with
> the top byte ignored) down to the input address size must be all 0 for
> TTBR0 and all 1 for TTBR1, else the walk faults (ARM DDI 0487A.k
> J1.1.5). guest_walk_ld() chose the base from the top bit alone and
Similar to your first patch, the specification is quite old. Please 
quote a more recent one (e.g. M.d).
> translated such an address. Refuse it before reading any table.
>
> Fixes: 7d623b358a45 ("arm/mem_access: Add long-descriptor based gpt")
> Signed-off-by: Stefano Stabellini <stefano.stabellini@xxxxxxx>
> Cc: Julien Grall <julien@xxxxxxx>
> Cc: Bertrand Marquis <bertrand.marquis@xxxxxxx>
> Cc: Michal Orzel <michal.orzel@xxxxxxx>
> Cc: Volodymyr Babchuk <Volodymyr_Babchuk@xxxxxxxx>
> ---
>   xen/arch/arm/guest_walk.c | 9 +++++++++
>   1 file changed, 9 insertions(+)
>
> diff --git a/xen/arch/arm/guest_walk.c b/xen/arch/arm/guest_walk.c
> index e23457869b..a8f8530683 100644
> --- a/xen/arch/arm/guest_walk.c
> +++ b/xen/arch/arm/guest_walk.c
> @@ -407,6 +407,15 @@ static bool guest_walk_ld(const struct vcpu *v,
>           if ( (input_size > TCR_EL1_IPS_48_BIT_VAL) ||
>                (input_size < TCR_EL1_IPS_MIN_VAL) )
>               return false;
> +
> +        /*
> +         * The bits of the GVA from the top bit down to the input size must
> +         * all be 0 for TTBR0 and all 1 for TTBR1, or the translation faults
> +         * (ARM DDI 0487A.k AArch64.TranslationTableWalk(), J1.1.5).
> +         */
Regardless what I wrote above, I checked the algorithm in A.k and I 
can't find the logic suggesting for a fault. Instead it seems to be:

if inputaddr<top> == '0' then
  inputsize = 64 - UInt(TCR_EL1.T0SZ);
  [...]
else
  inputsize = 64 - UInt(TCR_EL1.T1SZ);
  [...]

And this seems right to me because the be used for tagging. So they are 
not guarantee to be all 1s or all 0s. Can you point me to the part of 
the algorithm that says otherwise?
Cheers,

--
Julien Grall