There is an issue when using memory_region_dispatch_read() or memory_region_dispatch_write() on RAM memory regions.
RAM memory regions are initialized as: memory_region_init_ram() -> memory_region_init_ram_nomigrate() -> memory_region_init_ram_shared_nomigrate() -> memory_region_init() -> object_initialize(TYPE_MEMORY_REGION) -> memory_region_initfn() -> mr->ops = &unassigned_mem_ops; Later when accessing the alias, the memory_region_dispatch_read() flow is: memory_region_dispatch_read() -> memory_region_dispatch_read1() -> if (mr->ops->read) { /* not taken */ } else ... -> access_with_adjusted_size -> memory_region_read_with_attrs_accessor -> memory_region_dispatch_read -> unassigned_mem_read <- MEMTX_DECODE_ERROR The caller gets a MEMTX_DECODE_ERROR while the access is OK. (Similar flow with memory_region_dispatch_write). Fix by initializing the MemoryRegionOps to ram_device_mem_ops, this way the memory accesses are properly dispatched using memory_region_ram_device_read() / memory_region_ram_device_write(). Fixes: 4a2e242bbb ("memory: Don't use memcpy for ram_device regions") Signed-off-by: Philippe Mathieu-Daudé <f4...@amsat.org> --- Since v1: Corrected description (PJP) --- softmmu/memory.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/softmmu/memory.c b/softmmu/memory.c index 23bdbfac079..99886886a22 100644 --- a/softmmu/memory.c +++ b/softmmu/memory.c @@ -1556,6 +1556,8 @@ void memory_region_init_ram_shared_nomigrate(MemoryRegion *mr, Error *err = NULL; memory_region_init(mr, owner, name, size); mr->ram = true; + mr->ops = &ram_device_mem_ops; + mr->opaque = mr; mr->terminates = true; mr->destructor = memory_region_destructor_ram; mr->ram_block = qemu_ram_alloc(size, share, mr, &err); @@ -1579,6 +1581,8 @@ void memory_region_init_resizeable_ram(MemoryRegion *mr, Error *err = NULL; memory_region_init(mr, owner, name, size); mr->ram = true; + mr->ops = &ram_device_mem_ops; + mr->opaque = mr; mr->terminates = true; mr->destructor = memory_region_destructor_ram; mr->ram_block = qemu_ram_alloc_resizeable(size, max_size, resized, @@ -1604,6 +1608,8 @@ void memory_region_init_ram_from_file(MemoryRegion *mr, Error *err = NULL; memory_region_init(mr, owner, name, size); mr->ram = true; + mr->ops = &ram_device_mem_ops; + mr->opaque = mr; mr->readonly = readonly; mr->terminates = true; mr->destructor = memory_region_destructor_ram; @@ -1629,6 +1635,8 @@ void memory_region_init_ram_from_fd(MemoryRegion *mr, Error *err = NULL; memory_region_init(mr, owner, name, size); mr->ram = true; + mr->ops = &ram_device_mem_ops; + mr->opaque = mr; mr->terminates = true; mr->destructor = memory_region_destructor_ram; mr->ram_block = qemu_ram_alloc_from_fd(size, mr, @@ -1650,6 +1658,8 @@ void memory_region_init_ram_ptr(MemoryRegion *mr, { memory_region_init(mr, owner, name, size); mr->ram = true; + mr->ops = &ram_device_mem_ops; + mr->opaque = mr; mr->terminates = true; mr->destructor = memory_region_destructor_ram; -- 2.26.3