commit 2627e4524ea6c6ba14f9d6b298e08c9d4d3cc4fe
author Richard Henderson <richard.henderson@linaro.org> Mon Feb 06 09:26:29 2023 -1000
committer Richard Henderson <richard.henderson@linaro.org> Tue Feb 21 08:44:13 2023 -1000
tree f41b2d92a51d05330104f1fa30c9df549f642b44
parent 79b677d658d3d35e1e776826ac4abb28cdce69b8

accel/tcg: Allow the second page of an instruction to be MMIO

If an instruction straddles a page boundary, and the first page
was ram, but the second page was MMIO, we would abort.  Handle
this as if both pages are MMIO, by setting the ram_addr_t for
the first page to -1.

Reported-by: Sid Manning <sidneym@quicinc.com>
Reported-by: Jørgen Hansen <Jorgen.Hansen@wdc.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>

accel/tcg/translator.c

diff --git a/accel/tcg/translator.c b/accel/tcg/translator.c
index ef5193c..1cf404c 100644
--- a/accel/tcg/translator.c
+++ b/accel/tcg/translator.c
@@ -176,8 +176,16 @@
         if (host == NULL) {
             tb_page_addr_t phys_page =
                 get_page_addr_code_hostp(env, base, &db->host_addr[1]);
-            /* We cannot handle MMIO as second page. */
-            assert(phys_page != -1);
+
+            /*
+             * If the second page is MMIO, treat as if the first page
+             * was MMIO as well, so that we do not cache the TB.
+             */
+            if (unlikely(phys_page == -1)) {
+                tb_set_page_addr0(tb, -1);
+                return NULL;
+            }
+
             tb_set_page_addr1(tb, phys_page);
 #ifdef CONFIG_USER_ONLY
             page_protect(end);