On Sat, 15 Aug 2026 at 21:39, Richard Henderson
<[email protected]> wrote:
>
> Propagate the API change down one step further within cputlb.c.
>
> Signed-off-by: Richard Henderson <[email protected]>
> @@ -1664,8 +1665,8 @@ static bool mmu_lookup1(CPUState *cpu,
> MMULookupPageData *data, MemOp memop,
> if (!tlb_hit(tlb_addr, addr)) {
> if (!victim_tlb_hit(cpu, mmu_idx, index, access_type,
> addr & TARGET_PAGE_MASK)) {
> - tlb_fill_align(cpu, addr, access_type, mmu_idx,
> - memop, data->size, false, ra);
> + tlb_fill_align(cpu, addr, addr, addr + data->size - 1,
> + access_type, mmu_idx, memop, false, ra);
Can the "addr + data->size - 1" in these mmu lookup functions overflow?
> maybe_resized = true;
> index = tlb_index(cpu, mmu_idx, addr);
> entry = tlb_entry(cpu, mmu_idx, addr);
> @@ -1833,8 +1834,8 @@ static void *atomic_mmu_lookup(CPUState *cpu, vaddr
> addr, MemOpIdx oi,
> if (!tlb_hit(tlb_addr, addr)) {
> if (!victim_tlb_hit(cpu, mmu_idx, index, MMU_DATA_STORE,
> addr & TARGET_PAGE_MASK)) {
> - tlb_fill_align(cpu, addr, MMU_DATA_STORE, mmu_idx,
> - mop, size, false, retaddr);
> + tlb_fill_align(cpu, addr, addr, addr + size - 1,
> + MMU_DATA_STORE, mmu_idx, mop, false, retaddr);
> did_tlb_fill = true;
> index = tlb_index(cpu, mmu_idx, addr);
> tlbe = tlb_entry(cpu, mmu_idx, addr);
> @@ -1849,8 +1850,8 @@ static void *atomic_mmu_lookup(CPUState *cpu, vaddr
> addr, MemOpIdx oi,
> * but addr_read will only be -1 if PAGE_READ was unset.
> */
> if (unlikely(tlbe->addr_read == -1)) {
> - tlb_fill_align(cpu, addr, MMU_DATA_LOAD, mmu_idx,
> - 0, size, false, retaddr);
> + tlb_fill_align(cpu, addr, addr, addr + size - 1,
> + MMU_DATA_LOAD, mmu_idx, 0, false, retaddr);
thanks
-- PMM
