A copy-paste bug had us looking at the victim cache for writes.

Reported-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---

To be inserted before patch 3 in 

https://lore.kernel.org/qemu-devel/45cba357-ba20-399a-27e6-5e99741179d0@linaro.org/T/#m5dc55cf04d564f4a8f97bc95e7f0e427c24a4f0b

r~

---
 accel/tcg/cputlb.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index 3117886af1..0b8a5f93d2 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -1835,7 +1835,7 @@ static void *atomic_mmu_lookup(CPUArchState *env, target_ulong addr,
     } else /* if (prot & PAGE_READ) */ {
         tlb_addr = tlbe->addr_read;
         if (!tlb_hit(tlb_addr, addr)) {
-            if (!VICTIM_TLB_HIT(addr_write, addr)) {
+            if (!VICTIM_TLB_HIT(addr_read, addr)) {
                 tlb_fill(env_cpu(env), addr, size,
                          MMU_DATA_LOAD, mmu_idx, retaddr);
                 index = tlb_index(env, mmu_idx, addr);
-- 
2.34.1

On 5/5/23 22:40, Richard Henderson wrote:
> A copy-paste bug had us looking at the victim cache for writes.
> 
> Reported-by: Peter Maydell <peter.maydell@linaro.org>
> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>

Fixes: 08dff435e2 ("tcg: Probe the proper permissions for atomic ops")
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>

> ---
> 
> To be inserted before patch 3 in
> 
> https://lore.kernel.org/qemu-devel/45cba357-ba20-399a-27e6-5e99741179d0@linaro.org/T/#m5dc55cf04d564f4a8f97bc95e7f0e427c24a4f0b
> 
> r~
> 
> ---
>   accel/tcg/cputlb.c | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
> index 3117886af1..0b8a5f93d2 100644
> --- a/accel/tcg/cputlb.c
> +++ b/accel/tcg/cputlb.c
> @@ -1835,7 +1835,7 @@ static void *atomic_mmu_lookup(CPUArchState *env, target_ulong addr,
>       } else /* if (prot & PAGE_READ) */ {
>           tlb_addr = tlbe->addr_read;
>           if (!tlb_hit(tlb_addr, addr)) {
> -            if (!VICTIM_TLB_HIT(addr_write, addr)) {
> +            if (!VICTIM_TLB_HIT(addr_read, addr)) {
>                   tlb_fill(env_cpu(env), addr, size,
>                            MMU_DATA_LOAD, mmu_idx, retaddr);
>                   index = tlb_index(env, mmu_idx, addr);

On Fri, 5 May 2023 at 21:40, Richard Henderson
<richard.henderson@linaro.org> wrote:
>
> A copy-paste bug had us looking at the victim cache for writes.
>
> Reported-by: Peter Maydell <peter.maydell@linaro.org>
> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
> ---
>
> To be inserted before patch 3 in
>
> https://lore.kernel.org/qemu-devel/45cba357-ba20-399a-27e6-5e99741179d0@linaro.org/T/#m5dc55cf04d564f4a8f97bc95e7f0e427c24a4f0b
>
> r~

Should we cc qemu-stable on this one?

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

thanks
-- PMM

On 5/9/23 14:14, Peter Maydell wrote:
> On Fri, 5 May 2023 at 21:40, Richard Henderson
> <richard.henderson@linaro.org> wrote:
>>
>> A copy-paste bug had us looking at the victim cache for writes.
>>
>> Reported-by: Peter Maydell <peter.maydell@linaro.org>
>> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
>> ---
>>
>> To be inserted before patch 3 in
>>
>> https://lore.kernel.org/qemu-devel/45cba357-ba20-399a-27e6-5e99741179d0@linaro.org/T/#m5dc55cf04d564f4a8f97bc95e7f0e427c24a4f0b
>>
>> r~
> 
> Should we cc qemu-stable on this one?
> 
> Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

Could do, though it's been broken for a while.
I guess we do little enough testing on read-only pages.


r~