89 lines
3.2 KiB
Diff
89 lines
3.2 KiB
Diff
|
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <f4bug@amsat.org>
|
||
|
|
Date: Sat, 5 Dec 2020 16:09:03 +0100
|
||
|
|
Subject: hw/timer/slavio_timer: Allow 64-bit accesses
|
||
|
|
MIME-Version: 1.0
|
||
|
|
Content-Type: text/plain; charset=UTF-8
|
||
|
|
Content-Transfer-Encoding: 8bit
|
||
|
|
|
||
|
|
Git-commit: 62a9b228b5fefe0f9e364dfeaf3c65022c63cdb9
|
||
|
|
|
||
|
|
Per the "NCR89C105 Chip Specification" referenced in the header:
|
||
|
|
|
||
|
|
Chip-level Address Map
|
||
|
|
|
||
|
|
------------------------------------------------------------------
|
||
|
|
| 1D0 0000 -> | Counter/Timers | W,D |
|
||
|
|
| 1DF FFFF | | |
|
||
|
|
...
|
||
|
|
|
||
|
|
The address map indicated the allowed accesses at each address.
|
||
|
|
[...] W indicates a word access, and D indicates a double-word
|
||
|
|
access.
|
||
|
|
|
||
|
|
The SLAVIO timer controller is implemented expecting 32-bit accesses.
|
||
|
|
Commit a3d12d073e1 restricted the memory accesses to 32-bit, while
|
||
|
|
the device allows 64-bit accesses.
|
||
|
|
|
||
|
|
This was not an issue until commit 5d971f9e67 which reverted
|
||
|
|
("memory: accept mismatching sizes in memory_region_access_valid").
|
||
|
|
|
||
|
|
Fix by renaming .valid MemoryRegionOps as .impl, and add the valid
|
||
|
|
access range (W -> 4, D -> 8).
|
||
|
|
|
||
|
|
Since commit 21786c7e598 ("memory: Log invalid memory accesses")
|
||
|
|
this class of bug can be quickly debugged displaying 'guest_errors'
|
||
|
|
accesses, as:
|
||
|
|
|
||
|
|
$ qemu-system-sparc -M SS-20 -m 256 -bios ss20_v2.25_rom -serial stdio -d guest_errors
|
||
|
|
|
||
|
|
Power-ON Reset
|
||
|
|
Invalid access at addr 0x0, size 8, region 'timer-1', reason: invalid size (min:4 max:4)
|
||
|
|
|
||
|
|
$ qemu-system-sparc -M SS-20 -m 256 -bios ss20_v2.25_rom -monitor stdio -S
|
||
|
|
(qemu) info mtree
|
||
|
|
address-space: memory
|
||
|
|
0000000000000000-ffffffffffffffff (prio 0, i/o): system
|
||
|
|
...
|
||
|
|
0000000ff1300000-0000000ff130000f (prio 0, i/o): timer-1
|
||
|
|
^^^^^^^^^ ^^^^^^^
|
||
|
|
\ memory region base address and name /
|
||
|
|
|
||
|
|
(qemu) info qtree
|
||
|
|
bus: main-system-bus
|
||
|
|
dev: slavio_timer, id "" <-- device type name
|
||
|
|
gpio-out "sysbus-irq" 17
|
||
|
|
num_cpus = 1 (0x1)
|
||
|
|
mmio 0000000ff1310000/0000000000000014
|
||
|
|
mmio 0000000ff1300000/0000000000000010 <--- base address
|
||
|
|
mmio 0000000ff1301000/0000000000000010
|
||
|
|
mmio 0000000ff1302000/0000000000000010
|
||
|
|
...
|
||
|
|
|
||
|
|
Reported-by: Yap KV <yapkv@yahoo.com>
|
||
|
|
Buglink: https://bugs.launchpad.net/bugs/1906905
|
||
|
|
Fixes: a3d12d073e1 ("slavio_timer: convert to memory API")
|
||
|
|
CC: qemu-stable@nongnu.org
|
||
|
|
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
|
||
|
|
Message-Id: <20201205150903.3062711-1-f4bug@amsat.org>
|
||
|
|
Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
|
||
|
|
Signed-off-by: Bruce Rogers <brogers@suse.com>
|
||
|
|
---
|
||
|
|
hw/timer/slavio_timer.c | 4 ++++
|
||
|
|
1 file changed, 4 insertions(+)
|
||
|
|
|
||
|
|
diff --git a/hw/timer/slavio_timer.c b/hw/timer/slavio_timer.c
|
||
|
|
index 5b2d20cb6a5a65a762e8021243cb..03e33fc592665360a72e87e1ac64 100644
|
||
|
|
--- a/hw/timer/slavio_timer.c
|
||
|
|
+++ b/hw/timer/slavio_timer.c
|
||
|
|
@@ -331,6 +331,10 @@ static const MemoryRegionOps slavio_timer_mem_ops = {
|
||
|
|
.write = slavio_timer_mem_writel,
|
||
|
|
.endianness = DEVICE_NATIVE_ENDIAN,
|
||
|
|
.valid = {
|
||
|
|
+ .min_access_size = 4,
|
||
|
|
+ .max_access_size = 8,
|
||
|
|
+ },
|
||
|
|
+ .impl = {
|
||
|
|
.min_access_size = 4,
|
||
|
|
.max_access_size = 4,
|
||
|
|
},
|