From: Thomas Huth <thuth@redhat.com>

QEMU currently aborts when the guest writes to the MM_ITLB_DATA register:

 echo "writel 0xf3000000 0x11223344" | \
  ./qemu-system-sh4 -M r2d -display none -accel qtest -qtest stdio
 [I 0.000000] OPENED
 [R +0.004476] writel 0xf3000000 0x11223344
 Aborted                    (core dumped)

Looking at the history of the code, the abort() here has likely just
been forgotten when the register handler had been implemented (it used
to be a reminder about unimplemented functionality initially):

 https://gitlab.com/qemu-project/qemu/-/commit/9f97309a70f12df5f9104f1f

Thus simply remove the abort() now to get rid of the problem.

Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3420
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 hw/sh4/sh7750.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/hw/sh4/sh7750.c b/hw/sh4/sh7750.c
index 3ae71f99fe5..6aa7f637734 100644
--- a/hw/sh4/sh7750.c
+++ b/hw/sh4/sh7750.c
@@ -687,7 +687,6 @@ static void sh7750_mmct_write(void *opaque, hwaddr addr,
         break;
     case MM_ITLB_DATA:
         cpu_sh4_write_mmaped_itlb_data(&s->cpu->env, addr, mem_value);
-        abort();
         break;
     case MM_OCACHE_ADDR:
     case MM_OCACHE_DATA:
-- 
2.53.0

On 22.04.2026 10:54, Thomas Huth wrote:
> From: Thomas Huth <thuth@redhat.com>
> 
> QEMU currently aborts when the guest writes to the MM_ITLB_DATA register:
> 
>   echo "writel 0xf3000000 0x11223344" | \
>    ./qemu-system-sh4 -M r2d -display none -accel qtest -qtest stdio
>   [I 0.000000] OPENED
>   [R +0.004476] writel 0xf3000000 0x11223344
>   Aborted                    (core dumped)
> 
> Looking at the history of the code, the abort() here has likely just
> been forgotten when the register handler had been implemented (it used
> to be a reminder about unimplemented functionality initially):
> 
>   https://gitlab.com/qemu-project/qemu/-/commit/9f97309a70f12df5f9104f1f
> 
> Thus simply remove the abort() now to get rid of the problem.
> 
> Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3420

This too, seems to be a good candidate for the stable series, -
despite the issue is very old.  Picked it up now.

Thanks,

/mjt

On 22/4/26 09:54, Thomas Huth wrote:
> From: Thomas Huth <thuth@redhat.com>
> 
> QEMU currently aborts when the guest writes to the MM_ITLB_DATA register:
> 
>   echo "writel 0xf3000000 0x11223344" | \
>    ./qemu-system-sh4 -M r2d -display none -accel qtest -qtest stdio
>   [I 0.000000] OPENED
>   [R +0.004476] writel 0xf3000000 0x11223344
>   Aborted                    (core dumped)
> 
> Looking at the history of the code, the abort() here has likely just
> been forgotten when the register handler had been implemented (it used
> to be a reminder about unimplemented functionality initially):
> 
>   https://gitlab.com/qemu-project/qemu/-/commit/9f97309a70f12df5f9104f1f
> 
> Thus simply remove the abort() now to get rid of the problem.
> 
> Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3420
> Signed-off-by: Thomas Huth <thuth@redhat.com>
> ---
>   hw/sh4/sh7750.c | 1 -
>   1 file changed, 1 deletion(-)

Patch queued, thanks!

On 22/4/26 09:54, Thomas Huth wrote:
> From: Thomas Huth <thuth@redhat.com>
> 
> QEMU currently aborts when the guest writes to the MM_ITLB_DATA register:
> 
>   echo "writel 0xf3000000 0x11223344" | \
>    ./qemu-system-sh4 -M r2d -display none -accel qtest -qtest stdio
>   [I 0.000000] OPENED
>   [R +0.004476] writel 0xf3000000 0x11223344
>   Aborted                    (core dumped)
> 
> Looking at the history of the code, the abort() here has likely just
> been forgotten when the register handler had been implemented (it used
> to be a reminder about unimplemented functionality initially):
> 
>   https://gitlab.com/qemu-project/qemu/-/commit/9f97309a70f12df5f9104f1f
> 
> Thus simply remove the abort() now to get rid of the problem.
> 
> Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3420
> Signed-off-by: Thomas Huth <thuth@redhat.com>
> ---
>   hw/sh4/sh7750.c | 1 -
>   1 file changed, 1 deletion(-)

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>