On Sat, 15 Aug 2026 at 21:38, Richard Henderson <[email protected]> wrote: > > Signed-off-by: Richard Henderson <[email protected]> > --- > include/accel/tcg/probe.h | 24 +++++++++++++++++------- > accel/tcg/cputlb.c | 15 ++++++++------- > accel/tcg/user-exec.c | 7 +++++-- > semihosting/uaccess.c | 10 ++++------ > target/arm/tcg/sve_helper.c | 5 ++++- > target/riscv/tcg/op_helper.c | 4 ++-- > target/riscv/tcg/vector_helper.c | 21 ++++++++++++--------- > target/s390x/tcg/mem_helper.c | 4 ++-- > 8 files changed, 54 insertions(+), 36 deletions(-) > > diff --git a/include/accel/tcg/probe.h b/include/accel/tcg/probe.h > index e3068a79de..06faf1269d 100644 > --- a/include/accel/tcg/probe.h > +++ b/include/accel/tcg/probe.h > @@ -49,23 +49,33 @@ static inline void *probe_read(CPUArchState *env, vaddr > addr, int size, > /** > * probe_access_flags: > * @env: CPUArchState > - * @addr: guest virtual address to look up > - * @size: size of the access > + * @addr: virtual address > + * @first: beginning of virtual address range > + * @last: end of virtual address range > * @access_type: read, write or execute permission > * @mmu_idx: MMU index to use for lookup > * @nonfault: suppress the fault > * @phost: return value for host address > * @retaddr: return address for unwinding > * > - * Similar to probe_access, loosely returning the TLB_FLAGS_MASK for > - * the page, and storing the host address for RAM in @phost. > + * Probe an access for [@first, @last], where @addr is somewhere > + * in that range. Normally @addr == @first, but some targets have > + * accesses which are forcibly aligned after an initial fault for an > + * inaccessible page (e.g. Arm DC_ZVA, where [@first, @last] will be > + * the bounds of the cacheline containing @addr). > + * > + * If the access does not satisfy @access_type: > + * - if @nonfault is false, raise an exception at @addr > + * - otherwise return TLB_INVALID_MASK. > + * > + * Otherwise, return the TLB_FLAGS_MASK for the page, and set @phost: > + * - host address for @addr, if direct host accesses are allowed, > + * - otherwise NULL. > * > - * If @nonfault is set, do not raise an exception but return > TLB_INVALID_MASK. > * Do not handle watchpoints, but include TLB_WATCHPOINT in the returned > flags. > * Do handle clean pages, so exclude TLB_NOTDIRY from the returned flags. > - * For simplicity, all "mmio-like" flags are folded to TLB_MMIO. > */
We should mention in here somewhere that it's a bug in the caller if first/last aren't on the same page (and we assert that). > diff --git a/target/riscv/tcg/vector_helper.c > b/target/riscv/tcg/vector_helper.c > index b7b3805a6d..87f2196bc7 100644 > --- a/target/riscv/tcg/vector_helper.c > +++ b/target/riscv/tcg/vector_helper.c I don't understand the code in these riscv vector functions well enough to have been able to check whether we have "calculation of 'last' might wrap around to 0" issues here. The other changes in this patch look OK on that front. -- PMM
