[v2,1/3] accel/tcg: Set can_do_io at at start of lookup_tb_ptr helper

Commit Message

Jonathan Cameron Feb. 19, 2024, 5:31 p.m. UTC

From: Peter Maydell <[e-mail]>

If a page table is in IO memory and lookup_tb_ptr probes
the TLB it can result in a page table walk for the instruction
fetch.  If this hits IO memory and io_prepare falsely assumes
it needs to do a TLB recompile.

Avoid that by setting can_do_io at the start of lookup_tb_ptr.

Link: https://lore.kernel.org/qemu-devel/CAFEAcA_a_AyQ=[e-mail]/#t

Reviewed-by: Richard Henderson <[e-mail]>
Signed-off-by: Peter Maydell <[e-mail]>
Signed-off-by: Jonathan Cameron <[e-mail]>
---
v2: Picked up tags and adjusted patch description as question now
    resolved (whether Peter was happy to give SoB)
 accel/tcg/cpu-exec.c | 8 ++++++++
 1 file changed, 8 insertions(+)

Patch

diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
index 977576ca14..52239a441f 100644
--- a/accel/tcg/cpu-exec.c
+++ b/accel/tcg/cpu-exec.c
@@ -396,6 +396,14 @@  const void *HELPER(lookup_tb_ptr)(CPUArchState *env)
     uint64_t cs_base;
     uint32_t flags, cflags;
 
+    /*
+     * By definition we've just finished a TB, so I/O is OK.
+     * Avoid the possibility of calling cpu_io_recompile() if
+     * a page table walk triggered by tb_lookup() calling
+     * probe_access_internal() happens to touch an MMIO device.
+     * The next TB, if we chain to it, will clear the flag again.
+     */
+    cpu->neg.can_do_io = true;
     cpu_get_tb_cpu_state(env, &pc, &cs_base, &flags);
 
     cflags = curr_cflags(cpu);