mirror of
https://github.com/apache/nuttx.git
synced 2026-10-23 06:48:44 +00:00
baeedc5009
mmu_write_ttbr0() writes TTBR0_EL1 and then invalidates the TLB. A write to TTBR0_EL1 takes effect only at the next context synchronization event, so until the ISB at the end of the invalidation, a table walk can still use the old table. The instruction fetches of the invalidation sequence itself do such walks. An entry that they cache after the TLBI completes stays valid: walk cache entries are not tagged with the table base, and the kernel and every process use ASID 0. A kernel build then translates a user address of the new process through a level 0 entry of the old table, and gets a level 1 translation fault. Under QEMU with HVF on Apple silicon this happens on every boot of qemu-armv8a:knsh: up_addrenv_va_to_pa() fails for the first user buffer, and virtio gets a descriptor with address 0. TCG has no walk caches, so it does not show the problem. Add an ISB after the write, as the Arm ARM sequence for a TTBR change without an ASID change requires: write, ISB, TLBI, DSB, ISB. Assisted-by: Claude Code:claude-opus-5-5 Signed-off-by: Marco Casaroli <marco.casaroli@gmail.com> |
||
|---|---|---|
| .. | ||
| a64 | ||
| a527 | ||
| am62x | ||
| bcm2711 | ||
| cmake | ||
| common | ||
| fvp-v8r | ||
| goldfish | ||
| imx8 | ||
| imx9 | ||
| qemu | ||
| rk3399 | ||
| rk3588 | ||
| zynq-mpsoc | ||
| .gitignore | ||
| CMakeLists.txt | ||
| Makefile | ||
| Toolchain.defs | ||