The acc_flag check for write should have been against PAGE_WRITE_ORG,
not PAGE_WRITE.  But it is better to combine two acc_flag checks
to a single check against access_type.  This matches the system code
in cputlb.c.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2647
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/user-exec.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/accel/tcg/user-exec.c b/accel/tcg/user-exec.c
index aa8af52cc3..06016eb030 100644
--- a/accel/tcg/user-exec.c
+++ b/accel/tcg/user-exec.c
@@ -800,7 +800,7 @@ static int probe_access_internal(CPUArchState *env, vaddr addr,
     if (guest_addr_valid_untagged(addr)) {
         int page_flags = page_get_flags(addr);
         if (page_flags & acc_flag) {
-            if ((acc_flag == PAGE_READ || acc_flag == PAGE_WRITE)
+            if (access_type != MMU_INST_FETCH
                 && cpu_plugin_mem_cbs_enabled(env_cpu(env))) {
                 return TLB_MMIO;
             }
-- 
2.43.0

Richard Henderson <richard.henderson@linaro.org> writes:

> The acc_flag check for write should have been against PAGE_WRITE_ORG,
> not PAGE_WRITE.  But it is better to combine two acc_flag checks
> to a single check against access_type.  This matches the system code
> in cputlb.c.
>
> Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2647
> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
> ---
>  accel/tcg/user-exec.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/accel/tcg/user-exec.c b/accel/tcg/user-exec.c
> index aa8af52cc3..06016eb030 100644
> --- a/accel/tcg/user-exec.c
> +++ b/accel/tcg/user-exec.c
> @@ -800,7 +800,7 @@ static int probe_access_internal(CPUArchState *env, vaddr addr,
>      if (guest_addr_valid_untagged(addr)) {
>          int page_flags = page_get_flags(addr);
>          if (page_flags & acc_flag) {
> -            if ((acc_flag == PAGE_READ || acc_flag == PAGE_WRITE)
> +            if (access_type != MMU_INST_FETCH
>                  && cpu_plugin_mem_cbs_enabled(env_cpu(env))) {
>                  return TLB_MMIO;
>              }

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>


-- 
Alex Bennée
Virtualisation Tech Lead @ Linaro