id = 1417
title = "QEMU fails an assertion when hitting a breakpoint that is set on a tlb-missed 2-stage translated AArch64 memory"
state = "closed"
created_at = "2023-01-05T11:06:04.428Z"
closed_at = "2023-01-23T15:16:56.306Z"
labels = ["Closed::Fixed", "accel: TCG", "target: arm"]
url = "https://gitlab.com/qemu-project/qemu/-/issues/1417"
host-os = "Fedora 36"
host-arch = "x86"
qemu-version = "7.2.0"
guest-os = "n/a"
guest-arch = "AArch64"
description = """After upgrading to QEMU v7.2.0 from v7.1.0, when hitting an instruction breakpoint on a memory address that is translated by 2 stages of translation, and is not already cached in the TLB, QEMU fails the assertion at target/arm/ptw.c:301 (`assert(fi->type != ARMFault_None);`).

I believe this was introduced in f3639a64f602ea5c1436eb9c9b89f42028e3a4a8 (@rth7680), since in that commit the failure check for the return value of `get_phys_addr_lpae()` changed from checking for true (meaning failure) to checking for false (which actually means success)."""
reproduce = "n/a"
additional = "n/a"