The address map indicated the allowed accesses at each address.
[...] W indicates a word access, and D indicates a double-word
access.
The SLAVIO timer controller is implemented expecting 32-bit accesses.
Commit a3d12d073e1 restricted the memory accesses to 32-bit, while
the device allows 64-bit accesses.
This was not an issue until commit 5d971f9e67 which reverted
("memory: accept mismatching sizes in memory_region_access_valid").
Fix by renaming .valid MemoryRegionOps as .impl, and add the valid
access range (W -> 4, D -> 8).
Since commit 21786c7e598 ("memory: Log invalid memory accesses")
this class of bug can be quickly debugged displaying 'guest_errors'
accesses, as:
Per the "NCR89C105 Chip Specification" referenced in the header:
----- ------- ------- ------- ------- ------- ------- ------- ------- -----
| 1D0 0000 -> | Counter/Timers | W,D |
| 1DF FFFF | | |
...
The address map indicated the allowed accesses at each address.
[...] W indicates a word access, and D indicates a double-word
access.
The SLAVIO timer controller is implemented expecting 32-bit accesses.
Commit a3d12d073e1 restricted the memory accesses to 32-bit, while
the device allows 64-bit accesses.
This was not an issue until commit 5d971f9e67 which reverted region_ access_ valid") .
("memory: accept mismatching sizes in memory_
Fix by renaming .valid MemoryRegionOps as .impl, and add the valid
access range (W -> 4, D -> 8).
Since commit 21786c7e598 ("memory: Log invalid memory accesses")
this class of bug can be quickly debugged displaying 'guest_errors'
accesses, as:
$ qemu-system-sparc -M SS-20 -m 256 -bios ss20_v2.25_rom -serial stdio -d guest_errors
Power-ON Reset
Invalid access at addr 0x0, size 8, region 'timer-1', reason: invalid size (min:4 max:4)
$ qemu-system-sparc -M SS-20 -m 256 -bios ss20_v2.25_rom -monitor stdio -S 00000-fffffffff fffffff (prio 0, i/o): system 1300000- 0000000ff130000 f (prio 0, i/o): timer-1
^ ^^^^^^^ ^ ^^^^^^^
\ memory region base address and name /
(qemu) info mtree
address-space: memory
00000000000
...
0000000ff
(qemu) info qtree 0/0000000000000 014 0/0000000000000 010 <--- base address 0/0000000000000 010 0/0000000000000 010
bus: main-system-bus
dev: slavio_timer, id "" <-- device type name
gpio-out "sysbus-irq" 17
num_cpus = 1 (0x1)
mmio 0000000ff131000
mmio 0000000ff130000
mmio 0000000ff130100
mmio 0000000ff130200
...
Reported-by: Yap KV <email address hidden> /bugs.launchpad .net/bugs/ 1906905 slavio_ timer.c | 4 ++++
Buglink: https:/
Fixes: a3d12d073e1 ("slavio_timer: convert to memory API")
Signed-off-by: Philippe Mathieu-Daudé <email address hidden>
---
Cc: Benoit Canet <email address hidden>
Cc: <email address hidden>
Signed-off-by: Philippe Mathieu-Daudé <email address hidden>
---
hw/timer/
1 file changed, 4 insertions(+)
diff --git a/hw/timer/ slavio_ timer.c b/hw/timer/ slavio_ timer.c .03e33fc5926 100644 slavio_ timer.c slavio_ timer.c timer_mem_ ops = { timer_mem_ writel, NATIVE_ ENDIAN,
.min_ access_ size = 4,
.max_ access_ size = 4,
index 5b2d20cb6a5.
--- a/hw/timer/
+++ b/hw/timer/
@@ -331,6 +331,10 @@ static const MemoryRegionOps slavio_
.write = slavio_
.endianness = DEVICE_
.valid = {
+ .min_access_size = 4,
+ .max_access_size = 8,
+ },
+ .impl = {
},
--
2.26.2