The tb_flush within write_misa was incorrect. It assumed that we could adjust the ISA of the current processor and discard all TB and all would be well. But MISA is per vcpu, so globally flushing TB does not mean that the TB matches the MISA of any given vcpu.
By recording misa in the tb state, we ensure that the code generated matches the vcpu. Signed-off-by: Richard Henderson <richard.hender...@linaro.org> --- target/riscv/csr.c | 3 --- target/riscv/tcg/tcg-cpu.c | 3 ++- 2 files changed, 2 insertions(+), 4 deletions(-) diff --git a/target/riscv/csr.c b/target/riscv/csr.c index 8842e07a73..3c8989f522 100644 --- a/target/riscv/csr.c +++ b/target/riscv/csr.c @@ -25,7 +25,6 @@ #include "pmu.h" #include "time_helper.h" #include "exec/cputlb.h" -#include "exec/tb-flush.h" #include "exec/icount.h" #include "accel/tcg/getpc.h" #include "qemu/guest-random.h" @@ -2173,8 +2172,6 @@ static RISCVException write_misa(CPURISCVState *env, int csrno, env->mstatus &= ~MSTATUS_FS; } - /* flush translation cache */ - tb_flush(env_cpu(env)); env->xl = riscv_cpu_mxl(env); return RISCV_EXCP_NONE; } diff --git a/target/riscv/tcg/tcg-cpu.c b/target/riscv/tcg/tcg-cpu.c index 78fb279184..143ab079d4 100644 --- a/target/riscv/tcg/tcg-cpu.c +++ b/target/riscv/tcg/tcg-cpu.c @@ -191,7 +191,8 @@ static TCGTBCPUState riscv_get_tb_cpu_state(CPUState *cs) return (TCGTBCPUState){ .pc = env->xl == MXL_RV32 ? env->pc & UINT32_MAX : env->pc, - .flags = flags + .flags = flags, + .cs_base = env->misa_ext, }; } -- 2.43.0