>> [For those not immersed in ppc64, in real mode, the top nibble or 2 bits >> (depending on radix/hash mmu) of the address is ignored. The linear >> mapping is placed at 0xc000000000000000. This means that a pointer to >> part of the linear mapping will work both in real mode, where it will be >> interpreted as a physical address of the form 0x000..., and out of real >> mode, where it will go via the linear mapping.] >> > > How does hash or radix mmu mode effect how many bits are ignored in real mode? Bah, you're picking on details that I picked up from random conversations in the office rather than from reading the spec! :P The ISA suggests that real addresses space is limited to at most 64 bits. ISAv3, Book III s5.7: | * Host real address space size is 2^m bytes, m <= 60; | see Note 1. | * Guest real address space size is 2 m bytes, m <= 60; | see Notes 1 and 2. ... | Notes: | 1. The value of m is implementation-dependent (sub- | ject to the maximum given above). When used to | address storage or to represent a guest real | address, the high-order 60-m bits of the “60-bit” | real address must be zeros. | 2. The hypervisor may assign a guest real address | space size for each partition that uses Radix Tree | translation. Accesses to guest real storage out- | side this range but still mappable by the second | level Radix Tree will cause an HISI or HDSI. | Accesses to storage outside the mappable range | will have boundedly undefined results. However, it doesn't follow from that passage that the top 4 bits are always ignored when translations are off ('real mode'): see for example the discussion of the HRMOR in s 5.7.3 and s 5.7.3.1. I think I got the 'top 2 bits on radix' thing from the discussion of 'quadrants' in arch/powerpc/include/asm/book3s/64/radix.h, which in turn is discussed in s 5.7.5.1. Table 20 in particular is really helpful for understanding it. But it's not especially relevant to what I'm actually doing here. I think to fully understand all of what's going on I would need to spend some serious time with the entirety of s5.7, because there a lot of quirks about how storage works! But I think for our purposes it suffices to say: The kernel installs a linear mapping at effective address c000... onward. This is a one-to-one mapping with physical memory from 0000... onward. Because of how memory accesses work on powerpc 64-bit Book3S, a kernel pointer in the linear map accesses the same memory both with translations on (accessing as an 'effective address'), and with translations off (accessing as a 'real address'). This works in both guests and the hypervisor. For more details, see s5.7 of Book III of version 3 of the ISA, in particular the Storage Control Overview, s5.7.3, and s5.7.5 - noting that this KASAN implementation currently only supports Radix. Thanks for your attention to detail! Regards, Daniel