On 8/23/19 3:07 AM, David Hildenbrand wrote: > @@ -1071,8 +1072,23 @@ void probe_write(CPUArchState *env, target_ulong addr, > if (!VICTIM_TLB_HIT(addr_write, addr)) { > tlb_fill(env_cpu(env), addr, size, MMU_DATA_STORE, > mmu_idx, retaddr); > + /* TLB resize via tlb_fill may have moved the entry. */ > + entry = tlb_entry(env, mmu_idx, addr); > } > } > + > + if (!size) { > + return; > + } > + tlb_addr = tlb_addr_write(entry); > + > + /* Watchpoints for this entry only apply if TLB_MMIO was set. */ > + if (tlb_addr & TLB_MMIO) { > + MemTxAttrs attrs = env_tlb(env)->d[mmu_idx].iotlb[index].attrs;
We need to recompute index above as well, since we use it here. Fixed up and applied to tcg-next. r~