Hello everyone.I'm creating a single-core kernel for RPi 4B (ARMv8, BCM2711). I've successfully mapped the kernel in high memory, using TTBR1. TTBR0 stays on identity mapping until the load of the user process. For the last week I'm fighting with the following issue: after switching the TTBR0 table from identity to user process, the memory becomes inaccessible, and a translation fault level 0 is triggered at access.Any clues as to what is happening are greatly appreciated, I've run out of ideas for what to check.The old mapping works up until the switch, so that leads me to believe that the MMU is set up correctly. After the switch, the memory addresses that are mapped there are inaccessible, even when using GDB via JTAG.My intuition tells me that I'm missing something about TLB maintenance, but I don't know what. The code that I'm using to invalidate TLB is the following:
dsb ish isb sy msr ttbr0_el1, x20 ic iallu dsb sy isb sy tlbi vmalle1 dmb sy isb sy
TTBR0: 0x100010000 TTBR1: 0xa5000
(gdb) x/2gx 0xffff000100010000 0xffff000100010000: 0x0000000100012003 0x0000000000000000 (gdb) x/16gx 0xffff000100012000 0xffff000100012000: 0x0000000100013403 0x0000000000000000 0xffff000100012010: 0x0000000000000000 0x0000000000000000 0xffff000100012020: 0x0000000000000000 0x0000000000000000 0xffff000100012030: 0x0000000000000000 0x0000000000000000 0xffff000100012040: 0x0000000000000000 0x0000000000000000 0xffff000100012050: 0x0000000000000000 0x0000000000000000 0xffff000100012060: 0x0000000100016403 0x0000000000000000 0xffff000100012070: 0x0000000000000000 0x0000000000000000 (gdb) x/2gx 0xffff000100010000 0xffff000100010000: 0x0000000100012003 0x0000000000000000 (gdb) x/14gx 0xffff000100012000 0xffff000100012000: 0x0000000100013403 0x0000000000000000 0xffff000100012010: 0x0000000000000000 0x0000000000000000 0xffff000100012020: 0x0000000000000000 0x0000000000000000 0xffff000100012030: 0x0000000000000000 0x0000000000000000 0xffff000100012040: 0x0000000000000000 0x0000000000000000 0xffff000100012050: 0x0000000000000000 0x0000000000000000 0xffff000100012060: 0x0000000100016403 0x0000000000000000 (gdb) x/2gx 0xffff000100013000 0xffff000100013000: 0x0000000100014403 0x0000000000000000 (gdb) x/2gx 0xffff000100014000 0xffff000100014000: 0x00200001000114c1 0x0000000000000000 (gdb) x/2gx 0xffff000100016000 0xffff000100016000: 0x0000000100017403 0x0000000000000000 (gdb) x/2gx 0xffff000100017000 0xffff000100017000: 0x0060000100015441 0x0000000000000000
The reads in low memory work if I reassign the identity map to TTBR0. I've switched all of the flags in the new mapping to the same as in the identity map, and it still aborts after putting it on.The identity mapping is done via 2MB blocks. If I modify the TTBR0 to map via 2MB blocks too, the abort goes away. Any clues as to why this is?————The only way I got it running on QEMU was by compiling rpi4 branch with WIP support, but so far it has proven inconclusive, because there's a lot that of things that just do not work properly.————
Edit: for the interest of keeping problems separate, I'm going to move this to another thread. This one has been solved by setting proper shareability / IRG & ORG in TCR_EL1. See community.arm.com/.../ttbr0_el1-translation-fault-level-3-on-4kib-blocks---2mib-works