id = 2585
title = "qemu-system-arm highmem support broken with TCG"
state = "closed"
created_at = "2024-09-23T06:17:54.581Z"
closed_at = "2024-11-01T15:55:23.465Z"
labels = ["accel: TCG", "target: arm", "workflow::Patch available"]
url = "https://gitlab.com/qemu-project/qemu/-/issues/2585"
host-os = "Debian 12"
host-arch = "arm64"
qemu-version = "7.2 through 9.1"
guest-os = "Debian 12"
guest-arch = "arm"
description = "n/a"
reproduce = "n/a"
additional = """I initially bisected this to commit 39a1fd25287f ("target/arm: Fix handling of LPAE block descriptors"), which introduced an identical bug by masking the wrong address bits due to a type mismatch, but this was in turn fixed by commit c2360eaa0262 ("target/arm: Fix qemu-system-arm handling of LPAE block descriptors for highmem"). The bug resurfaced between qemu-7.1.0 and qemu-7.2.0 after commit f3639a64f602 ("target/arm: Use softmmu tlbs for page table walking"), but may be caused by the preceding 4a35855682ce ("target/arm: Plumb debug into S1Translate") which fails to boot for an unrelated reason.

I reproduced this on qemu-7.2 as shipped by Debian as well as on qemu-9.1 (built locally).

Part of this problem appeared to be hidden by the 'highmem=on' argument not having the intended effect during parts of the bisection, which I worked around by overriding the 'pa_bits' variable in machvirt_init()."""