From: Tim <mdspan.github@gmail.com>
To: qemu-devel@nongnu.org
Cc: pbonzini@redhat.com, richard.henderson@linaro.org, zhao1.liu@intel.com,
 Tim <mdspan.github@gmail.com>
Subject: [PATCH 0/4] target/i386: emulate LAM in TCG
Date: Tue, 10 Nov 2026 13:01:04 +0000
Message-ID: <20261110130108.706228-1-mdspan.github@gmail.com>
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
Received-SPF: pass client-ip=2607:f8b0:4864:39::9;
 envelope-from=mdspan.github@gmail.com; helo=mail-pj2-x09.google.com
X-Spam_score_int: -20
X-Spam_score: -2.1
X-Spam_bar: --
X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1,
 DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001,
 RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001,
 SPF_PASS=-0.001 autolearn=ham autolearn_force=no
X-Spam_action: no action
X-BeenThere: qemu-devel@nongnu.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: qemu development <qemu-devel.nongnu.org>
List-Archive: <https://lists.nongnu.org/archive/html/qemu-devel>
List-Post: <mailto:qemu-devel@nongnu.org>
List-Help: <mailto:qemu-devel-request@nongnu.org?subject=help>
List-Subscribe: <https://lists.nongnu.org/mailman/listinfo/qemu-devel>,
 <mailto:qemu-devel-request@nongnu.org?subject=subscribe>
Sender: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org
X-Spam-Status: No, score=-10.8 required=3.0 tests=BAYES_00,DKIM_SIGNED,
	DKIM_VALID,DKIM_VALID_AU,FREEMAIL_FORGED_FROMDOMAIN,FREEMAIL_FROM,
	HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH,MAILING_LIST_MULTI,
	SPF_HELO_PASS,SPF_PASS,USER_AGENT_GIT autolearn=ham autolearn_force=no
	version=4.0.1
X-Spam-Checker-Version: SpamAssassin 4.0.1 (2024-03-26) on
	aws-us-west-2-korg-listserv-alma10-1

This series emulates LAM in TCG for x86_64 system mode and reports it
in "-cpu max". linux-user support will follow in a separate series.

Patch 1 keeps the CR3 LAM bits out of the PML5 table address. Patch 2
makes the large-page check in tlb_flush_range_locked() compare under
the flush mask, as agreed in [2]. Patch 3 is the LAM emulation, and
patch 4 adds a system-mode test.

The design follows the RFC thread [1]:

- On a TLB miss, get_physical_address() masks the address and runs
  the canonical check and the page walk on the result. The entry is
  installed under the tagged address, so each tag of a page has its
  own entry. INVLPG and INVLPGA flush every tagged alias with
  tlb_flush_page_bits_by_mmuidx(), and a change of CR4.LAM_SUP
  flushes the TLB.

- Instruction fetches are not masked. If masking changes the address,
  an entry filled by a data access is not executable, and an entry filled
  by a fetch is not readable or writable.

- Exceptions do not report the tagged address, which answers
  Richard's question [3]. On #PF, CR2 receives the masked address
  (SDM Vol. 3A, section 4.4.3), and #GP reports no address.

- gdbstub, monitor, and qemu_plugin_translate_vaddr() translate a
  tagged address as a data access does.

Known gaps:

- Data breakpoints on an untagged address do not fire for accesses
  through a tagged alias.

- With LAM_U48 and 5-level paging, gdbstub, monitor, and
  qemu_plugin_translate_vaddr() translate an instruction address at
  or above 2^47 as a data address, not as a fetch does.

[1] https://lists.nongnu.org/archive/html/qemu-devel/2026-10/msg01840.html
[2] https://lists.nongnu.org/archive/html/qemu-devel/2026-11/msg01599.html
[3] https://lists.nongnu.org/archive/html/qemu-devel/2026-10/msg05620.html

Tim (4):
  target/i386: mask the PML5 table address taken from CR3
  accel/tcg: compare large pages under the flush mask
  target/i386: emulate LAM in TCG
  tests/tcg/x86_64: add a LAM system test

 accel/tcg/cputlb.c                   |   4 +-
 target/i386/cpu.c                    |   2 +-
 target/i386/cpu.h                    |  46 ++
 target/i386/helper.c                 |   8 +-
 target/i386/tcg/system/excp_helper.c |  33 +-
 target/i386/tcg/system/misc_helper.c |  24 +-
 target/i386/tcg/system/svm_helper.c  |   3 +-
 tests/tcg/x86_64/system/boot.S       |  14 +
 tests/tcg/x86_64/system/lam.c        | 797 +++++++++++++++++++++++++++
 tests/tcg/x86_64/system/meson.build  |  15 +
 10 files changed, 934 insertions(+), 12 deletions(-)
 create mode 100644 tests/tcg/x86_64/system/lam.c

-- 
2.47.3