exec.c

   1 /*
   2  *  Virtual page mapping
   3  *
   4  *  Copyright (c) 2003 Fabrice Bellard
   5  *
   6  * This library is free software; you can redistribute it and/or
   7  * modify it under the terms of the GNU Lesser General Public
   8  * License as published by the Free Software Foundation; either
   9  * version 2 of the License, or (at your option) any later version.
  10  *
  11  * This library is distributed in the hope that it will be useful,
  12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  14  * Lesser General Public License for more details.
  15  *
  16  * You should have received a copy of the GNU Lesser General Public
  17  * License along with this library; if not, see <http://www.gnu.org/licenses/>.
  18  */
  19 #include "config.h"
  20 #ifdef _WIN32
  21 #include <windows.h>
  22 #else
  23 #include <sys/types.h>
  24 #include <sys/mman.h>
  25 #endif
  26
  27 #include "qemu-common.h"
  28 #include "cpu.h"
  29 #include "tcg.h"
  30 #include "hw/hw.h"
  31 #include "hw/qdev.h"
  32 #include "qemu/osdep.h"
  33 #include "sysemu/kvm.h"
  34 #include "hw/xen/xen.h"
  35 #include "qemu/timer.h"
  36 #include "qemu/config-file.h"
  37 #include "exec/memory.h"
  38 #include "sysemu/dma.h"
  39 #include "exec/address-spaces.h"
  40 #if defined(CONFIG_USER_ONLY)
  41 #include <qemu.h>
  42 #else /* !CONFIG_USER_ONLY */
  43 #include "sysemu/xen-mapcache.h"
  44 #include "trace.h"
  45 #endif
  46 #include "exec/cpu-all.h"
  47
  48 #include "exec/cputlb.h"
  49 #include "translate-all.h"
  50
  51 #include "exec/memory-internal.h"
  52
  53 //#define DEBUG_SUBPAGE
  54
  55 #if !defined(CONFIG_USER_ONLY)
  56 int phys_ram_fd;
  57 static int in_migration;
  58
  59 RAMList ram_list = { .blocks = QTAILQ_HEAD_INITIALIZER(ram_list.blocks) };
  60
  61 static MemoryRegion *system_memory;
  62 static MemoryRegion *system_io;
  63
  64 AddressSpace address_space_io;
  65 AddressSpace address_space_memory;
  66
  67 MemoryRegion io_mem_rom, io_mem_notdirty;
  68 static MemoryRegion io_mem_unassigned;
  69
  70 #endif
  71
  72 CPUArchState *first_cpu;
  73 /* current CPU in the current thread. It is only valid inside
  74    cpu_exec() */
  75 DEFINE_TLS(CPUArchState *,cpu_single_env);
  76 /* 0 = Do not count executed instructions.
  77    1 = Precise instruction counting.
  78    2 = Adaptive rate instruction counting.  */
  79 int use_icount;
  80
  81 #if !defined(CONFIG_USER_ONLY)
  82
  83 typedef struct PhysPageEntry PhysPageEntry;
  84
  85 struct PhysPageEntry {
  86     uint16_t is_leaf : 1;
  87      /* index into phys_sections (is_leaf) or phys_map_nodes (!is_leaf) */
  88     uint16_t ptr : 15;
  89 };
  90
  91 struct AddressSpaceDispatch {
  92     /* This is a multi-level map on the physical address space.
  93      * The bottom level has pointers to MemoryRegionSections.
  94      */
  95     PhysPageEntry phys_map;
  96     MemoryListener listener;
  97     AddressSpace *as;
  98 };
  99
 100 #define SUBPAGE_IDX(addr) ((addr) & ~TARGET_PAGE_MASK)
 101 typedef struct subpage_t {
 102     MemoryRegion iomem;
 103     AddressSpace *as;
 104     hwaddr base;
 105     uint16_t sub_section[TARGET_PAGE_SIZE];
 106 } subpage_t;
 107
 108 static MemoryRegionSection *phys_sections;
 109 static unsigned phys_sections_nb, phys_sections_nb_alloc;
 110 static uint16_t phys_section_unassigned;
 111 static uint16_t phys_section_notdirty;
 112 static uint16_t phys_section_rom;
 113 static uint16_t phys_section_watch;
 114
 115 /* Simple allocator for PhysPageEntry nodes */
 116 static PhysPageEntry (*phys_map_nodes)[L2_SIZE];
 117 static unsigned phys_map_nodes_nb, phys_map_nodes_nb_alloc;
 118
 119 #define PHYS_MAP_NODE_NIL (((uint16_t)~0) >> 1)
 120
 121 static void io_mem_init(void);
 122 static void memory_map_init(void);
 123 static void *qemu_safe_ram_ptr(ram_addr_t addr);
 124
 125 static MemoryRegion io_mem_watch;
 126 #endif
 127
 128 #if !defined(CONFIG_USER_ONLY)
 129
 130 static void phys_map_node_reserve(unsigned nodes)
 131 {
 132     if (phys_map_nodes_nb + nodes > phys_map_nodes_nb_alloc) {
 133         typedef PhysPageEntry Node[L2_SIZE];
 134         phys_map_nodes_nb_alloc = MAX(phys_map_nodes_nb_alloc * 2, 16);
 135         phys_map_nodes_nb_alloc = MAX(phys_map_nodes_nb_alloc,
 136                                       phys_map_nodes_nb + nodes);
 137         phys_map_nodes = g_renew(Node, phys_map_nodes,
 138                                  phys_map_nodes_nb_alloc);
 139     }
 140 }
 141
 142 static uint16_t phys_map_node_alloc(void)
 143 {
 144     unsigned i;
 145     uint16_t ret;
 146
 147     ret = phys_map_nodes_nb++;
 148     assert(ret != PHYS_MAP_NODE_NIL);
 149     assert(ret != phys_map_nodes_nb_alloc);
 150     for (i = 0; i < L2_SIZE; ++i) {
 151         phys_map_nodes[ret][i].is_leaf = 0;
 152         phys_map_nodes[ret][i].ptr = PHYS_MAP_NODE_NIL;
 153     }
 154     return ret;
 155 }
 156
 157 static void phys_map_nodes_reset(void)
 158 {
 159     phys_map_nodes_nb = 0;
 160 }
 161
 162
 163 static void phys_page_set_level(PhysPageEntry *lp, hwaddr *index,
 164                                 hwaddr *nb, uint16_t leaf,
 165                                 int level)
 166 {
 167     PhysPageEntry *p;
 168     int i;
 169     hwaddr step = (hwaddr)1 << (level * L2_BITS);
 170
 171     if (!lp->is_leaf && lp->ptr == PHYS_MAP_NODE_NIL) {
 172         lp->ptr = phys_map_node_alloc();
 173         p = phys_map_nodes[lp->ptr];
 174         if (level == 0) {
 175             for (i = 0; i < L2_SIZE; i++) {
 176                 p[i].is_leaf = 1;
 177                 p[i].ptr = phys_section_unassigned;
 178             }
 179         }
 180     } else {
 181         p = phys_map_nodes[lp->ptr];
 182     }
 183     lp = &p[(*index >> (level * L2_BITS)) & (L2_SIZE - 1)];
 184
 185     while (*nb && lp < &p[L2_SIZE]) {
 186         if ((*index & (step - 1)) == 0 && *nb >= step) {
 187             lp->is_leaf = true;
 188             lp->ptr = leaf;
 189             *index += step;
 190             *nb -= step;
 191         } else {
 192             phys_page_set_level(lp, index, nb, leaf, level - 1);
 193         }
 194         ++lp;
 195     }
 196 }
 197
 198 static void phys_page_set(AddressSpaceDispatch *d,
 199                           hwaddr index, hwaddr nb,
 200                           uint16_t leaf)
 201 {
 202     /* Wildly overreserve - it doesn't matter much. */
 203     phys_map_node_reserve(3 * P_L2_LEVELS);
 204
 205     phys_page_set_level(&d->phys_map, &index, &nb, leaf, P_L2_LEVELS - 1);
 206 }
 207
 208 static MemoryRegionSection *phys_page_find(AddressSpaceDispatch *d, hwaddr index)
 209 {
 210     PhysPageEntry lp = d->phys_map;
 211     PhysPageEntry *p;
 212     int i;
 213
 214     for (i = P_L2_LEVELS - 1; i >= 0 && !lp.is_leaf; i--) {
 215         if (lp.ptr == PHYS_MAP_NODE_NIL) {
 216             return &phys_sections[phys_section_unassigned];
 217         }
 218         p = phys_map_nodes[lp.ptr];
 219         lp = p[(index >> (i * L2_BITS)) & (L2_SIZE - 1)];
 220     }
 221     return &phys_sections[lp.ptr];
 222 }
 223
 224 bool memory_region_is_unassigned(MemoryRegion *mr)
 225 {
 226     return mr != &io_mem_rom && mr != &io_mem_notdirty && !mr->rom_device
 227         && mr != &io_mem_watch;
 228 }
 229
 230 static MemoryRegionSection *address_space_lookup_region(AddressSpace *as,
 231                                                         hwaddr addr,
 232                                                         bool resolve_subpage)
 233 {
 234     MemoryRegionSection *section;
 235     subpage_t *subpage;
 236
 237     section = phys_page_find(as->dispatch, addr >> TARGET_PAGE_BITS);
 238     if (resolve_subpage && section->mr->subpage) {
 239         subpage = container_of(section->mr, subpage_t, iomem);
 240         section = &phys_sections[subpage->sub_section[SUBPAGE_IDX(addr)]];
 241     }
 242     return section;
 243 }
 244
 245 static MemoryRegionSection *
 246 address_space_translate_internal(AddressSpace *as, hwaddr addr, hwaddr *xlat,
 247                                  hwaddr *plen, bool resolve_subpage)
 248 {
 249     MemoryRegionSection *section;
 250     Int128 diff;
 251
 252     section = address_space_lookup_region(as, addr, resolve_subpage);
 253     /* Compute offset within MemoryRegionSection */
 254     addr -= section->offset_within_address_space;
 255
 256     /* Compute offset within MemoryRegion */
 257     *xlat = addr + section->offset_within_region;
 258
 259     diff = int128_sub(section->mr->size, int128_make64(addr));
 260     *plen = int128_get64(int128_min(diff, int128_make64(*plen)));
 261     return section;
 262 }
 263
 264 MemoryRegion *address_space_translate(AddressSpace *as, hwaddr addr,
 265                                       hwaddr *xlat, hwaddr *plen,
 266                                       bool is_write)
 267 {
 268     IOMMUTLBEntry iotlb;
 269     MemoryRegionSection *section;
 270     MemoryRegion *mr;
 271     hwaddr len = *plen;
 272
 273     for (;;) {
 274         section = address_space_translate_internal(as, addr, &addr, plen, true);
 275         mr = section->mr;
 276
 277         if (!mr->iommu_ops) {
 278             break;
 279         }
 280
 281         iotlb = mr->iommu_ops->translate(mr, addr);
 282         addr = ((iotlb.translated_addr & ~iotlb.addr_mask)
 283                 | (addr & iotlb.addr_mask));
 284         len = MIN(len, (addr | iotlb.addr_mask) - addr + 1);
 285         if (!(iotlb.perm & (1 << is_write))) {
 286             mr = &io_mem_unassigned;
 287             break;
 288         }
 289
 290         as = iotlb.target_as;
 291     }
 292
 293     *plen = len;
 294     *xlat = addr;
 295     return mr;
 296 }
 297
 298 MemoryRegionSection *
 299 address_space_translate_for_iotlb(AddressSpace *as, hwaddr addr, hwaddr *xlat,
 300                                   hwaddr *plen)
 301 {
 302     MemoryRegionSection *section;
 303     section = address_space_translate_internal(as, addr, xlat, plen, false);
 304
 305     assert(!section->mr->iommu_ops);
 306     return section;
 307 }
 308 #endif
 309
 310 void cpu_exec_init_all(void)
 311 {
 312 #if !defined(CONFIG_USER_ONLY)
 313     qemu_mutex_init(&ram_list.mutex);
 314     memory_map_init();
 315     io_mem_init();
 316 #endif
 317 }
 318
 319 #if !defined(CONFIG_USER_ONLY)
 320
 321 static int cpu_common_post_load(void *opaque, int version_id)
 322 {
 323     CPUState *cpu = opaque;
 324
 325     /* 0x01 was CPU_INTERRUPT_EXIT. This line can be removed when the
 326        version_id is increased. */
 327     cpu->interrupt_request &= ~0x01;
 328     tlb_flush(cpu->env_ptr, 1);
 329
 330     return 0;
 331 }
 332
 333 const VMStateDescription vmstate_cpu_common = {
 334     .name = "cpu_common",
 335     .version_id = 1,
 336     .minimum_version_id = 1,
 337     .minimum_version_id_old = 1,
 338     .post_load = cpu_common_post_load,
 339     .fields      = (VMStateField []) {
 340         VMSTATE_UINT32(halted, CPUState),
 341         VMSTATE_UINT32(interrupt_request, CPUState),
 342         VMSTATE_END_OF_LIST()
 343     }
 344 };
 345
 346 #endif
 347
 348 CPUState *qemu_get_cpu(int index)
 349 {
 350     CPUArchState *env = first_cpu;
 351     CPUState *cpu = NULL;
 352
 353     while (env) {
 354         cpu = ENV_GET_CPU(env);
 355         if (cpu->cpu_index == index) {
 356             break;
 357         }
 358         env = env->next_cpu;
 359     }
 360
 361     return env ? cpu : NULL;
 362 }
 363
 364 void qemu_for_each_cpu(void (*func)(CPUState *cpu, void *data), void *data)
 365 {
 366     CPUArchState *env = first_cpu;
 367
 368     while (env) {
 369         func(ENV_GET_CPU(env), data);
 370         env = env->next_cpu;
 371     }
 372 }
 373
 374 void cpu_exec_init(CPUArchState *env)
 375 {
 376     CPUState *cpu = ENV_GET_CPU(env);
 377     CPUClass *cc = CPU_GET_CLASS(cpu);
 378     CPUArchState **penv;
 379     int cpu_index;
 380
 381 #if defined(CONFIG_USER_ONLY)
 382     cpu_list_lock();
 383 #endif
 384     env->next_cpu = NULL;
 385     penv = &first_cpu;
 386     cpu_index = 0;
 387     while (*penv != NULL) {
 388         penv = &(*penv)->next_cpu;
 389         cpu_index++;
 390     }
 391     cpu->cpu_index = cpu_index;
 392     cpu->numa_node = 0;
 393     QTAILQ_INIT(&env->breakpoints);
 394     QTAILQ_INIT(&env->watchpoints);
 395 #ifndef CONFIG_USER_ONLY
 396     cpu->thread_id = qemu_get_thread_id();
 397 #endif
 398     *penv = env;
 399 #if defined(CONFIG_USER_ONLY)
 400     cpu_list_unlock();
 401 #endif
 402     vmstate_register(NULL, cpu_index, &vmstate_cpu_common, cpu);
 403 #if defined(CPU_SAVE_VERSION) && !defined(CONFIG_USER_ONLY)
 404     register_savevm(NULL, "cpu", cpu_index, CPU_SAVE_VERSION,
 405                     cpu_save, cpu_load, env);
 406     assert(cc->vmsd == NULL);
 407 #endif
 408     if (cc->vmsd != NULL) {
 409         vmstate_register(NULL, cpu_index, cc->vmsd, cpu);
 410     }
 411 }
 412
 413 #if defined(TARGET_HAS_ICE)
 414 #if defined(CONFIG_USER_ONLY)
 415 static void breakpoint_invalidate(CPUArchState *env, target_ulong pc)
 416 {
 417     tb_invalidate_phys_page_range(pc, pc + 1, 0);
 418 }
 419 #else
 420 static void breakpoint_invalidate(CPUArchState *env, target_ulong pc)
 421 {
 422     tb_invalidate_phys_addr(cpu_get_phys_page_debug(env, pc) |
 423             (pc & ~TARGET_PAGE_MASK));
 424 }
 425 #endif
 426 #endif /* TARGET_HAS_ICE */
 427
 428 #if defined(CONFIG_USER_ONLY)
 429 void cpu_watchpoint_remove_all(CPUArchState *env, int mask)
 430
 431 {
 432 }
 433
 434 int cpu_watchpoint_insert(CPUArchState *env, target_ulong addr, target_ulong len,
 435                           int flags, CPUWatchpoint **watchpoint)
 436 {
 437     return -ENOSYS;
 438 }
 439 #else
 440 /* Add a watchpoint.  */
 441 int cpu_watchpoint_insert(CPUArchState *env, target_ulong addr, target_ulong len,
 442                           int flags, CPUWatchpoint **watchpoint)
 443 {
 444     target_ulong len_mask = ~(len - 1);
 445     CPUWatchpoint *wp;
 446
 447     /* sanity checks: allow power-of-2 lengths, deny unaligned watchpoints */
 448     if ((len & (len - 1)) || (addr & ~len_mask) ||
 449             len == 0 || len > TARGET_PAGE_SIZE) {
 450         fprintf(stderr, "qemu: tried to set invalid watchpoint at "
 451                 TARGET_FMT_lx ", len=" TARGET_FMT_lu "\n", addr, len);
 452         return -EINVAL;
 453     }
 454     wp = g_malloc(sizeof(*wp));
 455
 456     wp->vaddr = addr;
 457     wp->len_mask = len_mask;
 458     wp->flags = flags;
 459
 460     /* keep all GDB-injected watchpoints in front */
 461     if (flags & BP_GDB)
 462         QTAILQ_INSERT_HEAD(&env->watchpoints, wp, entry);
 463     else
 464         QTAILQ_INSERT_TAIL(&env->watchpoints, wp, entry);
 465
 466     tlb_flush_page(env, addr);
 467
 468     if (watchpoint)
 469         *watchpoint = wp;
 470     return 0;
 471 }
 472
 473 /* Remove a specific watchpoint.  */
 474 int cpu_watchpoint_remove(CPUArchState *env, target_ulong addr, target_ulong len,
 475                           int flags)
 476 {
 477     target_ulong len_mask = ~(len - 1);
 478     CPUWatchpoint *wp;
 479
 480     QTAILQ_FOREACH(wp, &env->watchpoints, entry) {
 481         if (addr == wp->vaddr && len_mask == wp->len_mask
 482                 && flags == (wp->flags & ~BP_WATCHPOINT_HIT)) {
 483             cpu_watchpoint_remove_by_ref(env, wp);
 484             return 0;
 485         }
 486     }
 487     return -ENOENT;
 488 }
 489
 490 /* Remove a specific watchpoint by reference.  */
 491 void cpu_watchpoint_remove_by_ref(CPUArchState *env, CPUWatchpoint *watchpoint)
 492 {
 493     QTAILQ_REMOVE(&env->watchpoints, watchpoint, entry);
 494
 495     tlb_flush_page(env, watchpoint->vaddr);
 496
 497     g_free(watchpoint);
 498 }
 499
 500 /* Remove all matching watchpoints.  */
 501 void cpu_watchpoint_remove_all(CPUArchState *env, int mask)
 502 {
 503     CPUWatchpoint *wp, *next;
 504
 505     QTAILQ_FOREACH_SAFE(wp, &env->watchpoints, entry, next) {
 506         if (wp->flags & mask)
 507             cpu_watchpoint_remove_by_ref(env, wp);
 508     }
 509 }
 510 #endif
 511
 512 /* Add a breakpoint.  */
 513 int cpu_breakpoint_insert(CPUArchState *env, target_ulong pc, int flags,
 514                           CPUBreakpoint **breakpoint)
 515 {
 516 #if defined(TARGET_HAS_ICE)
 517     CPUBreakpoint *bp;
 518
 519     bp = g_malloc(sizeof(*bp));
 520
 521     bp->pc = pc;
 522     bp->flags = flags;
 523
 524     /* keep all GDB-injected breakpoints in front */
 525     if (flags & BP_GDB)
 526         QTAILQ_INSERT_HEAD(&env->breakpoints, bp, entry);
 527     else
 528         QTAILQ_INSERT_TAIL(&env->breakpoints, bp, entry);
 529
 530     breakpoint_invalidate(env, pc);
 531
 532     if (breakpoint)
 533         *breakpoint = bp;
 534     return 0;
 535 #else
 536     return -ENOSYS;
 537 #endif
 538 }
 539
 540 /* Remove a specific breakpoint.  */
 541 int cpu_breakpoint_remove(CPUArchState *env, target_ulong pc, int flags)
 542 {
 543 #if defined(TARGET_HAS_ICE)
 544     CPUBreakpoint *bp;
 545
 546     QTAILQ_FOREACH(bp, &env->breakpoints, entry) {
 547         if (bp->pc == pc && bp->flags == flags) {
 548             cpu_breakpoint_remove_by_ref(env, bp);
 549             return 0;
 550         }
 551     }
 552     return -ENOENT;
 553 #else
 554     return -ENOSYS;
 555 #endif
 556 }
 557
 558 /* Remove a specific breakpoint by reference.  */
 559 void cpu_breakpoint_remove_by_ref(CPUArchState *env, CPUBreakpoint *breakpoint)
 560 {
 561 #if defined(TARGET_HAS_ICE)
 562     QTAILQ_REMOVE(&env->breakpoints, breakpoint, entry);
 563
 564     breakpoint_invalidate(env, breakpoint->pc);
 565
 566     g_free(breakpoint);
 567 #endif
 568 }
 569
 570 /* Remove all matching breakpoints. */
 571 void cpu_breakpoint_remove_all(CPUArchState *env, int mask)
 572 {
 573 #if defined(TARGET_HAS_ICE)
 574     CPUBreakpoint *bp, *next;
 575
 576     QTAILQ_FOREACH_SAFE(bp, &env->breakpoints, entry, next) {
 577         if (bp->flags & mask)
 578             cpu_breakpoint_remove_by_ref(env, bp);
 579     }
 580 #endif
 581 }
 582
 583 /* enable or disable single step mode. EXCP_DEBUG is returned by the
 584    CPU loop after each instruction */
 585 void cpu_single_step(CPUArchState *env, int enabled)
 586 {
 587 #if defined(TARGET_HAS_ICE)
 588     if (env->singlestep_enabled != enabled) {
 589         env->singlestep_enabled = enabled;
 590         if (kvm_enabled())
 591             kvm_update_guest_debug(env, 0);
 592         else {
 593             /* must flush all the translated code to avoid inconsistencies */
 594             /* XXX: only flush what is necessary */
 595             tb_flush(env);
 596         }
 597     }
 598 #endif
 599 }
 600
 601 void cpu_abort(CPUArchState *env, const char *fmt, ...)
 602 {
 603     CPUState *cpu = ENV_GET_CPU(env);
 604     va_list ap;
 605     va_list ap2;
 606
 607     va_start(ap, fmt);
 608     va_copy(ap2, ap);
 609     fprintf(stderr, "qemu: fatal: ");
 610     vfprintf(stderr, fmt, ap);
 611     fprintf(stderr, "\n");
 612     cpu_dump_state(cpu, stderr, fprintf, CPU_DUMP_FPU | CPU_DUMP_CCOP);
 613     if (qemu_log_enabled()) {
 614         qemu_log("qemu: fatal: ");
 615         qemu_log_vprintf(fmt, ap2);
 616         qemu_log("\n");
 617         log_cpu_state(env, CPU_DUMP_FPU | CPU_DUMP_CCOP);
 618         qemu_log_flush();
 619         qemu_log_close();
 620     }
 621     va_end(ap2);
 622     va_end(ap);
 623 #if defined(CONFIG_USER_ONLY)
 624     {
 625         struct sigaction act;
 626         sigfillset(&act.sa_mask);
 627         act.sa_handler = SIG_DFL;
 628         sigaction(SIGABRT, &act, NULL);
 629     }
 630 #endif
 631     abort();
 632 }
 633
 634 CPUArchState *cpu_copy(CPUArchState *env)
 635 {
 636     CPUArchState *new_env = cpu_init(env->cpu_model_str);
 637     CPUArchState *next_cpu = new_env->next_cpu;
 638 #if defined(TARGET_HAS_ICE)
 639     CPUBreakpoint *bp;
 640     CPUWatchpoint *wp;
 641 #endif
 642
 643     memcpy(new_env, env, sizeof(CPUArchState));
 644
 645     /* Preserve chaining. */
 646     new_env->next_cpu = next_cpu;
 647
 648     /* Clone all break/watchpoints.
 649        Note: Once we support ptrace with hw-debug register access, make sure
 650        BP_CPU break/watchpoints are handled correctly on clone. */
 651     QTAILQ_INIT(&env->breakpoints);
 652     QTAILQ_INIT(&env->watchpoints);
 653 #if defined(TARGET_HAS_ICE)
 654     QTAILQ_FOREACH(bp, &env->breakpoints, entry) {
 655         cpu_breakpoint_insert(new_env, bp->pc, bp->flags, NULL);
 656     }
 657     QTAILQ_FOREACH(wp, &env->watchpoints, entry) {
 658         cpu_watchpoint_insert(new_env, wp->vaddr, (~wp->len_mask) + 1,
 659                               wp->flags, NULL);
 660     }
 661 #endif
 662
 663     return new_env;
 664 }
 665
 666 #if !defined(CONFIG_USER_ONLY)
 667 static void tlb_reset_dirty_range_all(ram_addr_t start, ram_addr_t end,
 668                                       uintptr_t length)
 669 {
 670     uintptr_t start1;
 671
 672     /* we modify the TLB cache so that the dirty bit will be set again
 673        when accessing the range */
 674     start1 = (uintptr_t)qemu_safe_ram_ptr(start);
 675     /* Check that we don't span multiple blocks - this breaks the
 676        address comparisons below.  */
 677     if ((uintptr_t)qemu_safe_ram_ptr(end - 1) - start1
 678             != (end - 1) - start) {
 679         abort();
 680     }
 681     cpu_tlb_reset_dirty_all(start1, length);
 682
 683 }
 684
 685 /* Note: start and end must be within the same ram block.  */
 686 void cpu_physical_memory_reset_dirty(ram_addr_t start, ram_addr_t end,
 687                                      int dirty_flags)
 688 {
 689     uintptr_t length;
 690
 691     start &= TARGET_PAGE_MASK;
 692     end = TARGET_PAGE_ALIGN(end);
 693
 694     length = end - start;
 695     if (length == 0)
 696         return;
 697     cpu_physical_memory_mask_dirty_range(start, length, dirty_flags);
 698
 699     if (tcg_enabled()) {
 700         tlb_reset_dirty_range_all(start, end, length);
 701     }
 702 }
 703
 704 static int cpu_physical_memory_set_dirty_tracking(int enable)
 705 {
 706     int ret = 0;
 707     in_migration = enable;
 708     return ret;
 709 }
 710
 711 hwaddr memory_region_section_get_iotlb(CPUArchState *env,
 712                                        MemoryRegionSection *section,
 713                                        target_ulong vaddr,
 714                                        hwaddr paddr, hwaddr xlat,
 715                                        int prot,
 716                                        target_ulong *address)
 717 {
 718     hwaddr iotlb;
 719     CPUWatchpoint *wp;
 720
 721     if (memory_region_is_ram(section->mr)) {
 722         /* Normal RAM.  */
 723         iotlb = (memory_region_get_ram_addr(section->mr) & TARGET_PAGE_MASK)
 724             + xlat;
 725         if (!section->readonly) {
 726             iotlb |= phys_section_notdirty;
 727         } else {
 728             iotlb |= phys_section_rom;
 729         }
 730     } else {
 731         iotlb = section - phys_sections;
 732         iotlb += xlat;
 733     }
 734
 735     /* Make accesses to pages with watchpoints go via the
 736        watchpoint trap routines.  */
 737     QTAILQ_FOREACH(wp, &env->watchpoints, entry) {
 738         if (vaddr == (wp->vaddr & TARGET_PAGE_MASK)) {
 739             /* Avoid trapping reads of pages with a write breakpoint. */
 740             if ((prot & PAGE_WRITE) || (wp->flags & BP_MEM_READ)) {
 741                 iotlb = phys_section_watch + paddr;
 742                 *address |= TLB_MMIO;
 743                 break;
 744             }
 745         }
 746     }
 747
 748     return iotlb;
 749 }
 750 #endif /* defined(CONFIG_USER_ONLY) */
 751
 752 #if !defined(CONFIG_USER_ONLY)
 753
 754 static int subpage_register (subpage_t *mmio, uint32_t start, uint32_t end,
 755                              uint16_t section);
 756 static subpage_t *subpage_init(AddressSpace *as, hwaddr base);
 757 static void destroy_page_desc(uint16_t section_index)
 758 {
 759     MemoryRegionSection *section = &phys_sections[section_index];
 760     MemoryRegion *mr = section->mr;
 761
 762     if (mr->subpage) {
 763         subpage_t *subpage = container_of(mr, subpage_t, iomem);
 764         memory_region_destroy(&subpage->iomem);
 765         g_free(subpage);
 766     }
 767 }
 768
 769 static void destroy_l2_mapping(PhysPageEntry *lp, unsigned level)
 770 {
 771     unsigned i;
 772     PhysPageEntry *p;
 773
 774     if (lp->ptr == PHYS_MAP_NODE_NIL) {
 775         return;
 776     }
 777
 778     p = phys_map_nodes[lp->ptr];
 779     for (i = 0; i < L2_SIZE; ++i) {
 780         if (!p[i].is_leaf) {
 781             destroy_l2_mapping(&p[i], level - 1);
 782         } else {
 783             destroy_page_desc(p[i].ptr);
 784         }
 785     }
 786     lp->is_leaf = 0;
 787     lp->ptr = PHYS_MAP_NODE_NIL;
 788 }
 789
 790 static void destroy_all_mappings(AddressSpaceDispatch *d)
 791 {
 792     destroy_l2_mapping(&d->phys_map, P_L2_LEVELS - 1);
 793     phys_map_nodes_reset();
 794 }
 795
 796 static uint16_t phys_section_add(MemoryRegionSection *section)
 797 {
 798     /* The physical section number is ORed with a page-aligned
 799      * pointer to produce the iotlb entries.  Thus it should
 800      * never overflow into the page-aligned value.
 801      */
 802     assert(phys_sections_nb < TARGET_PAGE_SIZE);
 803
 804     if (phys_sections_nb == phys_sections_nb_alloc) {
 805         phys_sections_nb_alloc = MAX(phys_sections_nb_alloc * 2, 16);
 806         phys_sections = g_renew(MemoryRegionSection, phys_sections,
 807                                 phys_sections_nb_alloc);
 808     }
 809     phys_sections[phys_sections_nb] = *section;
 810     return phys_sections_nb++;
 811 }
 812
 813 static void phys_sections_clear(void)
 814 {
 815     phys_sections_nb = 0;
 816 }
 817
 818 static void register_subpage(AddressSpaceDispatch *d, MemoryRegionSection *section)
 819 {
 820     subpage_t *subpage;
 821     hwaddr base = section->offset_within_address_space
 822         & TARGET_PAGE_MASK;
 823     MemoryRegionSection *existing = phys_page_find(d, base >> TARGET_PAGE_BITS);
 824     MemoryRegionSection subsection = {
 825         .offset_within_address_space = base,
 826         .size = int128_make64(TARGET_PAGE_SIZE),
 827     };
 828     hwaddr start, end;
 829
 830     assert(existing->mr->subpage || existing->mr == &io_mem_unassigned);
 831
 832     if (!(existing->mr->subpage)) {
 833         subpage = subpage_init(d->as, base);
 834         subsection.mr = &subpage->iomem;
 835         phys_page_set(d, base >> TARGET_PAGE_BITS, 1,
 836                       phys_section_add(&subsection));
 837     } else {
 838         subpage = container_of(existing->mr, subpage_t, iomem);
 839     }
 840     start = section->offset_within_address_space & ~TARGET_PAGE_MASK;
 841     end = start + int128_get64(section->size) - 1;
 842     subpage_register(subpage, start, end, phys_section_add(section));
 843 }
 844
 845
 846 static void register_multipage(AddressSpaceDispatch *d,
 847                                MemoryRegionSection *section)
 848 {
 849     hwaddr start_addr = section->offset_within_address_space;
 850     uint16_t section_index = phys_section_add(section);
 851     uint64_t num_pages = int128_get64(int128_rshift(section->size,
 852                                                     TARGET_PAGE_BITS));
 853
 854     assert(num_pages);
 855     phys_page_set(d, start_addr >> TARGET_PAGE_BITS, num_pages, section_index);
 856 }
 857
 858 static void mem_add(MemoryListener *listener, MemoryRegionSection *section)
 859 {
 860     AddressSpaceDispatch *d = container_of(listener, AddressSpaceDispatch, listener);
 861     MemoryRegionSection now = *section, remain = *section;
 862     Int128 page_size = int128_make64(TARGET_PAGE_SIZE);
 863
 864     if (now.offset_within_address_space & ~TARGET_PAGE_MASK) {
 865         uint64_t left = TARGET_PAGE_ALIGN(now.offset_within_address_space)
 866                        - now.offset_within_address_space;
 867
 868         now.size = int128_min(int128_make64(left), now.size);
 869         register_subpage(d, &now);
 870     } else {
 871         now.size = int128_zero();
 872     }
 873     while (int128_ne(remain.size, now.size)) {
 874         remain.size = int128_sub(remain.size, now.size);
 875         remain.offset_within_address_space += int128_get64(now.size);
 876         remain.offset_within_region += int128_get64(now.size);
 877         now = remain;
 878         if (int128_lt(remain.size, page_size)) {
 879             register_subpage(d, &now);
 880         } else if (remain.offset_within_region & ~TARGET_PAGE_MASK) {
 881             now.size = page_size;
 882             register_subpage(d, &now);
 883         } else {
 884             now.size = int128_and(now.size, int128_neg(page_size));
 885             register_multipage(d, &now);
 886         }
 887     }
 888 }
 889
 890 void qemu_flush_coalesced_mmio_buffer(void)
 891 {
 892     if (kvm_enabled())
 893         kvm_flush_coalesced_mmio_buffer();
 894 }
 895
 896 void qemu_mutex_lock_ramlist(void)
 897 {
 898     qemu_mutex_lock(&ram_list.mutex);
 899 }
 900
 901 void qemu_mutex_unlock_ramlist(void)
 902 {
 903     qemu_mutex_unlock(&ram_list.mutex);
 904 }
 905
 906 #if defined(__linux__) && !defined(TARGET_S390X)
 907
 908 #include <sys/vfs.h>
 909
 910 #define HUGETLBFS_MAGIC       0x958458f6
 911
 912 static long gethugepagesize(const char *path)
 913 {
 914     struct statfs fs;
 915     int ret;
 916
 917     do {
 918         ret = statfs(path, &fs);
 919     } while (ret != 0 && errno == EINTR);
 920
 921     if (ret != 0) {
 922         perror(path);
 923         return 0;
 924     }
 925
 926     if (fs.f_type != HUGETLBFS_MAGIC)
 927         fprintf(stderr, "Warning: path not on HugeTLBFS: %s\n", path);
 928
 929     return fs.f_bsize;
 930 }
 931
 932 static void *file_ram_alloc(RAMBlock *block,
 933                             ram_addr_t memory,
 934                             const char *path)
 935 {
 936     char *filename;
 937     char *sanitized_name;
 938     char *c;
 939     void *area;
 940     int fd;
 941 #ifdef MAP_POPULATE
 942     int flags;
 943 #endif
 944     unsigned long hpagesize;
 945
 946     hpagesize = gethugepagesize(path);
 947     if (!hpagesize) {
 948         return NULL;
 949     }
 950
 951     if (memory < hpagesize) {
 952         return NULL;
 953     }
 954
 955     if (kvm_enabled() && !kvm_has_sync_mmu()) {
 956         fprintf(stderr, "host lacks kvm mmu notifiers, -mem-path unsupported\n");
 957         return NULL;
 958     }
 959
 960     /* Make name safe to use with mkstemp by replacing '/' with '_'. */
 961     sanitized_name = g_strdup(block->mr->name);
 962     for (c = sanitized_name; *c != '\0'; c++) {
 963         if (*c == '/')
 964             *c = '_';
 965     }
 966
 967     filename = g_strdup_printf("%s/qemu_back_mem.%s.XXXXXX", path,
 968                                sanitized_name);
 969     g_free(sanitized_name);
 970
 971     fd = mkstemp(filename);
 972     if (fd < 0) {
 973         perror("unable to create backing store for hugepages");
 974         g_free(filename);
 975         return NULL;
 976     }
 977     unlink(filename);
 978     g_free(filename);
 979
 980     memory = (memory+hpagesize-1) & ~(hpagesize-1);
 981
 982     /*
 983      * ftruncate is not supported by hugetlbfs in older
 984      * hosts, so don't bother bailing out on errors.
 985      * If anything goes wrong with it under other filesystems,
 986      * mmap will fail.
 987      */
 988     if (ftruncate(fd, memory))
 989         perror("ftruncate");
 990
 991 #ifdef MAP_POPULATE
 992     /* NB: MAP_POPULATE won't exhaustively alloc all phys pages in the case
 993      * MAP_PRIVATE is requested.  For mem_prealloc we mmap as MAP_SHARED
 994      * to sidestep this quirk.
 995      */
 996     flags = mem_prealloc ? MAP_POPULATE | MAP_SHARED : MAP_PRIVATE;
 997     area = mmap(0, memory, PROT_READ | PROT_WRITE, flags, fd, 0);
 998 #else
 999     area = mmap(0, memory, PROT_READ | PROT_WRITE, MAP_PRIVATE, fd, 0);
1000 #endif
1001     if (area == MAP_FAILED) {
1002         perror("file_ram_alloc: can't mmap RAM pages");
1003         close(fd);
1004         return (NULL);
1005     }
1006     block->fd = fd;
1007     return area;
1008 }
1009 #endif
1010
1011 static ram_addr_t find_ram_offset(ram_addr_t size)
1012 {
1013     RAMBlock *block, *next_block;
1014     ram_addr_t offset = RAM_ADDR_MAX, mingap = RAM_ADDR_MAX;
1015
1016     assert(size != 0); /* it would hand out same offset multiple times */
1017
1018     if (QTAILQ_EMPTY(&ram_list.blocks))
1019         return 0;
1020
1021     QTAILQ_FOREACH(block, &ram_list.blocks, next) {
1022         ram_addr_t end, next = RAM_ADDR_MAX;
1023
1024         end = block->offset + block->length;
1025
1026         QTAILQ_FOREACH(next_block, &ram_list.blocks, next) {
1027             if (next_block->offset >= end) {
1028                 next = MIN(next, next_block->offset);
1029             }
1030         }
1031         if (next - end >= size && next - end < mingap) {
1032             offset = end;
1033             mingap = next - end;
1034         }
1035     }
1036
1037     if (offset == RAM_ADDR_MAX) {
1038         fprintf(stderr, "Failed to find gap of requested size: %" PRIu64 "\n",
1039                 (uint64_t)size);
1040         abort();
1041     }
1042
1043     return offset;
1044 }
1045
1046 ram_addr_t last_ram_offset(void)
1047 {
1048     RAMBlock *block;
1049     ram_addr_t last = 0;
1050
1051     QTAILQ_FOREACH(block, &ram_list.blocks, next)
1052         last = MAX(last, block->offset + block->length);
1053
1054     return last;
1055 }
1056
1057 static void qemu_ram_setup_dump(void *addr, ram_addr_t size)
1058 {
1059     int ret;
1060     QemuOpts *machine_opts;
1061
1062     /* Use MADV_DONTDUMP, if user doesn't want the guest memory in the core */
1063     machine_opts = qemu_opts_find(qemu_find_opts("machine"), 0);
1064     if (machine_opts &&
1065         !qemu_opt_get_bool(machine_opts, "dump-guest-core", true)) {
1066         ret = qemu_madvise(addr, size, QEMU_MADV_DONTDUMP);
1067         if (ret) {
1068             perror("qemu_madvise");
1069             fprintf(stderr, "madvise doesn't support MADV_DONTDUMP, "
1070                             "but dump_guest_core=off specified\n");
1071         }
1072     }
1073 }
1074
1075 void qemu_ram_set_idstr(ram_addr_t addr, const char *name, DeviceState *dev)
1076 {
1077     RAMBlock *new_block, *block;
1078
1079     new_block = NULL;
1080     QTAILQ_FOREACH(block, &ram_list.blocks, next) {
1081         if (block->offset == addr) {
1082             new_block = block;
1083             break;
1084         }
1085     }
1086     assert(new_block);
1087     assert(!new_block->idstr[0]);
1088
1089     if (dev) {
1090         char *id = qdev_get_dev_path(dev);
1091         if (id) {
1092             snprintf(new_block->idstr, sizeof(new_block->idstr), "%s/", id);
1093             g_free(id);
1094         }
1095     }
1096     pstrcat(new_block->idstr, sizeof(new_block->idstr), name);
1097
1098     /* This assumes the iothread lock is taken here too.  */
1099     qemu_mutex_lock_ramlist();
1100     QTAILQ_FOREACH(block, &ram_list.blocks, next) {
1101         if (block != new_block && !strcmp(block->idstr, new_block->idstr)) {
1102             fprintf(stderr, "RAMBlock \"%s\" already registered, abort!\n",
1103                     new_block->idstr);
1104             abort();
1105         }
1106     }
1107     qemu_mutex_unlock_ramlist();
1108 }
1109
1110 static int memory_try_enable_merging(void *addr, size_t len)
1111 {
1112     QemuOpts *opts;
1113
1114     opts = qemu_opts_find(qemu_find_opts("machine"), 0);
1115     if (opts && !qemu_opt_get_bool(opts, "mem-merge", true)) {
1116         /* disabled by the user */
1117         return 0;
1118     }
1119
1120     return qemu_madvise(addr, len, QEMU_MADV_MERGEABLE);
1121 }
1122
1123 ram_addr_t qemu_ram_alloc_from_ptr(ram_addr_t size, void *host,
1124                                    MemoryRegion *mr)
1125 {
1126     RAMBlock *block, *new_block;
1127
1128     size = TARGET_PAGE_ALIGN(size);
1129     new_block = g_malloc0(sizeof(*new_block));
1130
1131     /* This assumes the iothread lock is taken here too.  */
1132     qemu_mutex_lock_ramlist();
1133     new_block->mr = mr;
1134     new_block->offset = find_ram_offset(size);
1135     if (host) {
1136         new_block->host = host;
1137         new_block->flags |= RAM_PREALLOC_MASK;
1138     } else {
1139         if (mem_path) {
1140 #if defined (__linux__) && !defined(TARGET_S390X)
1141             new_block->host = file_ram_alloc(new_block, size, mem_path);
1142             if (!new_block->host) {
1143                 new_block->host = qemu_anon_ram_alloc(size);
1144                 memory_try_enable_merging(new_block->host, size);
1145             }
1146 #else
1147             fprintf(stderr, "-mem-path option unsupported\n");
1148             exit(1);
1149 #endif
1150         } else {
1151             if (xen_enabled()) {
1152                 xen_ram_alloc(new_block->offset, size, mr);
1153             } else if (kvm_enabled()) {
1154                 /* some s390/kvm configurations have special constraints */
1155                 new_block->host = kvm_ram_alloc(size);
1156             } else {
1157                 new_block->host = qemu_anon_ram_alloc(size);
1158             }
1159             memory_try_enable_merging(new_block->host, size);
1160         }
1161     }
1162     new_block->length = size;
1163
1164     /* Keep the list sorted from biggest to smallest block.  */
1165     QTAILQ_FOREACH(block, &ram_list.blocks, next) {
1166         if (block->length < new_block->length) {
1167             break;
1168         }
1169     }
1170     if (block) {
1171         QTAILQ_INSERT_BEFORE(block, new_block, next);
1172     } else {
1173         QTAILQ_INSERT_TAIL(&ram_list.blocks, new_block, next);
1174     }
1175     ram_list.mru_block = NULL;
1176
1177     ram_list.version++;
1178     qemu_mutex_unlock_ramlist();
1179
1180     ram_list.phys_dirty = g_realloc(ram_list.phys_dirty,
1181                                        last_ram_offset() >> TARGET_PAGE_BITS);
1182     memset(ram_list.phys_dirty + (new_block->offset >> TARGET_PAGE_BITS),
1183            0, size >> TARGET_PAGE_BITS);
1184     cpu_physical_memory_set_dirty_range(new_block->offset, size, 0xff);
1185
1186     qemu_ram_setup_dump(new_block->host, size);
1187     qemu_madvise(new_block->host, size, QEMU_MADV_HUGEPAGE);
1188
1189     if (kvm_enabled())
1190         kvm_setup_guest_memory(new_block->host, size);
1191
1192     return new_block->offset;
1193 }
1194
1195 ram_addr_t qemu_ram_alloc(ram_addr_t size, MemoryRegion *mr)
1196 {
1197     return qemu_ram_alloc_from_ptr(size, NULL, mr);
1198 }
1199
1200 void qemu_ram_free_from_ptr(ram_addr_t addr)
1201 {
1202     RAMBlock *block;
1203
1204     /* This assumes the iothread lock is taken here too.  */
1205     qemu_mutex_lock_ramlist();
1206     QTAILQ_FOREACH(block, &ram_list.blocks, next) {
1207         if (addr == block->offset) {
1208             QTAILQ_REMOVE(&ram_list.blocks, block, next);
1209             ram_list.mru_block = NULL;
1210             ram_list.version++;
1211             g_free(block);
1212             break;
1213         }
1214     }
1215     qemu_mutex_unlock_ramlist();
1216 }
1217
1218 void qemu_ram_free(ram_addr_t addr)
1219 {
1220     RAMBlock *block;
1221
1222     /* This assumes the iothread lock is taken here too.  */
1223     qemu_mutex_lock_ramlist();
1224     QTAILQ_FOREACH(block, &ram_list.blocks, next) {
1225         if (addr == block->offset) {
1226             QTAILQ_REMOVE(&ram_list.blocks, block, next);
1227             ram_list.mru_block = NULL;
1228             ram_list.version++;
1229             if (block->flags & RAM_PREALLOC_MASK) {
1230                 ;
1231             } else if (mem_path) {
1232 #if defined (__linux__) && !defined(TARGET_S390X)
1233                 if (block->fd) {
1234                     munmap(block->host, block->length);
1235                     close(block->fd);
1236                 } else {
1237                     qemu_anon_ram_free(block->host, block->length);
1238                 }
1239 #else
1240                 abort();
1241 #endif
1242             } else {
1243                 if (xen_enabled()) {
1244                     xen_invalidate_map_cache_entry(block->host);
1245                 } else {
1246                     qemu_anon_ram_free(block->host, block->length);
1247                 }
1248             }
1249             g_free(block);
1250             break;
1251         }
1252     }
1253     qemu_mutex_unlock_ramlist();
1254
1255 }
1256
1257 #ifndef _WIN32
1258 void qemu_ram_remap(ram_addr_t addr, ram_addr_t length)
1259 {
1260     RAMBlock *block;
1261     ram_addr_t offset;
1262     int flags;
1263     void *area, *vaddr;
1264
1265     QTAILQ_FOREACH(block, &ram_list.blocks, next) {
1266         offset = addr - block->offset;
1267         if (offset < block->length) {
1268             vaddr = block->host + offset;
1269             if (block->flags & RAM_PREALLOC_MASK) {
1270                 ;
1271             } else {
1272                 flags = MAP_FIXED;
1273                 munmap(vaddr, length);
1274                 if (mem_path) {
1275 #if defined(__linux__) && !defined(TARGET_S390X)
1276                     if (block->fd) {
1277 #ifdef MAP_POPULATE
1278                         flags |= mem_prealloc ? MAP_POPULATE | MAP_SHARED :
1279                             MAP_PRIVATE;
1280 #else
1281                         flags |= MAP_PRIVATE;
1282 #endif
1283                         area = mmap(vaddr, length, PROT_READ | PROT_WRITE,
1284                                     flags, block->fd, offset);
1285                     } else {
1286                         flags |= MAP_PRIVATE | MAP_ANONYMOUS;
1287                         area = mmap(vaddr, length, PROT_READ | PROT_WRITE,
1288                                     flags, -1, 0);
1289                     }
1290 #else
1291                     abort();
1292 #endif
1293                 } else {
1294 #if defined(TARGET_S390X) && defined(CONFIG_KVM)
1295                     flags |= MAP_SHARED | MAP_ANONYMOUS;
1296                     area = mmap(vaddr, length, PROT_EXEC|PROT_READ|PROT_WRITE,
1297                                 flags, -1, 0);
1298 #else
1299                     flags |= MAP_PRIVATE | MAP_ANONYMOUS;
1300                     area = mmap(vaddr, length, PROT_READ | PROT_WRITE,
1301                                 flags, -1, 0);
1302 #endif
1303                 }
1304                 if (area != vaddr) {
1305                     fprintf(stderr, "Could not remap addr: "
1306                             RAM_ADDR_FMT "@" RAM_ADDR_FMT "\n",
1307                             length, addr);
1308                     exit(1);
1309                 }
1310                 memory_try_enable_merging(vaddr, length);
1311                 qemu_ram_setup_dump(vaddr, length);
1312             }
1313             return;
1314         }
1315     }
1316 }
1317 #endif /* !_WIN32 */
1318
1319 /* Return a host pointer to ram allocated with qemu_ram_alloc.
1320    With the exception of the softmmu code in this file, this should
1321    only be used for local memory (e.g. video ram) that the device owns,
1322    and knows it isn't going to access beyond the end of the block.
1323
1324    It should not be used for general purpose DMA.
1325    Use cpu_physical_memory_map/cpu_physical_memory_rw instead.
1326  */
1327 void *qemu_get_ram_ptr(ram_addr_t addr)
1328 {
1329     RAMBlock *block;
1330
1331     /* The list is protected by the iothread lock here.  */
1332     block = ram_list.mru_block;
1333     if (block && addr - block->offset < block->length) {
1334         goto found;
1335     }
1336     QTAILQ_FOREACH(block, &ram_list.blocks, next) {
1337         if (addr - block->offset < block->length) {
1338             goto found;
1339         }
1340     }
1341
1342     fprintf(stderr, "Bad ram offset %" PRIx64 "\n", (uint64_t)addr);
1343     abort();
1344
1345 found:
1346     ram_list.mru_block = block;
1347     if (xen_enabled()) {
1348         /* We need to check if the requested address is in the RAM
1349          * because we don't want to map the entire memory in QEMU.
1350          * In that case just map until the end of the page.
1351          */
1352         if (block->offset == 0) {
1353             return xen_map_cache(addr, 0, 0);
1354         } else if (block->host == NULL) {
1355             block->host =
1356                 xen_map_cache(block->offset, block->length, 1);
1357         }
1358     }
1359     return block->host + (addr - block->offset);
1360 }
1361
1362 /* Return a host pointer to ram allocated with qemu_ram_alloc.  Same as
1363  * qemu_get_ram_ptr but do not touch ram_list.mru_block.
1364  *
1365  * ??? Is this still necessary?
1366  */
1367 static void *qemu_safe_ram_ptr(ram_addr_t addr)
1368 {
1369     RAMBlock *block;
1370
1371     /* The list is protected by the iothread lock here.  */
1372     QTAILQ_FOREACH(block, &ram_list.blocks, next) {
1373         if (addr - block->offset < block->length) {
1374             if (xen_enabled()) {
1375                 /* We need to check if the requested address is in the RAM
1376                  * because we don't want to map the entire memory in QEMU.
1377                  * In that case just map until the end of the page.
1378                  */
1379                 if (block->offset == 0) {
1380                     return xen_map_cache(addr, 0, 0);
1381                 } else if (block->host == NULL) {
1382                     block->host =
1383                         xen_map_cache(block->offset, block->length, 1);
1384                 }
1385             }
1386             return block->host + (addr - block->offset);
1387         }
1388     }
1389
1390     fprintf(stderr, "Bad ram offset %" PRIx64 "\n", (uint64_t)addr);
1391     abort();
1392
1393     return NULL;
1394 }
1395
1396 /* Return a host pointer to guest's ram. Similar to qemu_get_ram_ptr
1397  * but takes a size argument */
1398 static void *qemu_ram_ptr_length(ram_addr_t addr, ram_addr_t *size)
1399 {
1400     if (*size == 0) {
1401         return NULL;
1402     }
1403     if (xen_enabled()) {
1404         return xen_map_cache(addr, *size, 1);
1405     } else {
1406         RAMBlock *block;
1407
1408         QTAILQ_FOREACH(block, &ram_list.blocks, next) {
1409             if (addr - block->offset < block->length) {
1410                 if (addr - block->offset + *size > block->length)
1411                     *size = block->length - addr + block->offset;
1412                 return block->host + (addr - block->offset);
1413             }
1414         }
1415
1416         fprintf(stderr, "Bad ram offset %" PRIx64 "\n", (uint64_t)addr);
1417         abort();
1418     }
1419 }
1420
1421 int qemu_ram_addr_from_host(void *ptr, ram_addr_t *ram_addr)
1422 {
1423     RAMBlock *block;
1424     uint8_t *host = ptr;
1425
1426     if (xen_enabled()) {
1427         *ram_addr = xen_ram_addr_from_mapcache(ptr);
1428         return 0;
1429     }
1430
1431     QTAILQ_FOREACH(block, &ram_list.blocks, next) {
1432         /* This case append when the block is not mapped. */
1433         if (block->host == NULL) {
1434             continue;
1435         }
1436         if (host - block->host < block->length) {
1437             *ram_addr = block->offset + (host - block->host);
1438             return 0;
1439         }
1440     }
1441
1442     return -1;
1443 }
1444
1445 /* Some of the softmmu routines need to translate from a host pointer
1446    (typically a TLB entry) back to a ram offset.  */
1447 ram_addr_t qemu_ram_addr_from_host_nofail(void *ptr)
1448 {
1449     ram_addr_t ram_addr;
1450
1451     if (qemu_ram_addr_from_host(ptr, &ram_addr)) {
1452         fprintf(stderr, "Bad ram pointer %p\n", ptr);
1453         abort();
1454     }
1455     return ram_addr;
1456 }
1457
1458 static void notdirty_mem_write(void *opaque, hwaddr ram_addr,
1459                                uint64_t val, unsigned size)
1460 {
1461     int dirty_flags;
1462     dirty_flags = cpu_physical_memory_get_dirty_flags(ram_addr);
1463     if (!(dirty_flags & CODE_DIRTY_FLAG)) {
1464         tb_invalidate_phys_page_fast(ram_addr, size);
1465         dirty_flags = cpu_physical_memory_get_dirty_flags(ram_addr);
1466     }
1467     switch (size) {
1468     case 1:
1469         stb_p(qemu_get_ram_ptr(ram_addr), val);
1470         break;
1471     case 2:
1472         stw_p(qemu_get_ram_ptr(ram_addr), val);
1473         break;
1474     case 4:
1475         stl_p(qemu_get_ram_ptr(ram_addr), val);
1476         break;
1477     default:
1478         abort();
1479     }
1480     dirty_flags |= (0xff & ~CODE_DIRTY_FLAG);
1481     cpu_physical_memory_set_dirty_flags(ram_addr, dirty_flags);
1482     /* we remove the notdirty callback only if the code has been
1483        flushed */
1484     if (dirty_flags == 0xff)
1485         tlb_set_dirty(cpu_single_env, cpu_single_env->mem_io_vaddr);
1486 }
1487
1488 static bool notdirty_mem_accepts(void *opaque, hwaddr addr,
1489                                  unsigned size, bool is_write)
1490 {
1491     return is_write;
1492 }
1493
1494 static const MemoryRegionOps notdirty_mem_ops = {
1495     .write = notdirty_mem_write,
1496     .valid.accepts = notdirty_mem_accepts,
1497     .endianness = DEVICE_NATIVE_ENDIAN,
1498 };
1499
1500 /* Generate a debug exception if a watchpoint has been hit.  */
1501 static void check_watchpoint(int offset, int len_mask, int flags)
1502 {
1503     CPUArchState *env = cpu_single_env;
1504     target_ulong pc, cs_base;
1505     target_ulong vaddr;
1506     CPUWatchpoint *wp;
1507     int cpu_flags;
1508
1509     if (env->watchpoint_hit) {
1510         /* We re-entered the check after replacing the TB. Now raise
1511          * the debug interrupt so that is will trigger after the
1512          * current instruction. */
1513         cpu_interrupt(ENV_GET_CPU(env), CPU_INTERRUPT_DEBUG);
1514         return;
1515     }
1516     vaddr = (env->mem_io_vaddr & TARGET_PAGE_MASK) + offset;
1517     QTAILQ_FOREACH(wp, &env->watchpoints, entry) {
1518         if ((vaddr == (wp->vaddr & len_mask) ||
1519              (vaddr & wp->len_mask) == wp->vaddr) && (wp->flags & flags)) {
1520             wp->flags |= BP_WATCHPOINT_HIT;
1521             if (!env->watchpoint_hit) {
1522                 env->watchpoint_hit = wp;
1523                 tb_check_watchpoint(env);
1524                 if (wp->flags & BP_STOP_BEFORE_ACCESS) {
1525                     env->exception_index = EXCP_DEBUG;
1526                     cpu_loop_exit(env);
1527                 } else {
1528                     cpu_get_tb_cpu_state(env, &pc, &cs_base, &cpu_flags);
1529                     tb_gen_code(env, pc, cs_base, cpu_flags, 1);
1530                     cpu_resume_from_signal(env, NULL);
1531                 }
1532             }
1533         } else {
1534             wp->flags &= ~BP_WATCHPOINT_HIT;
1535         }
1536     }
1537 }
1538
1539 /* Watchpoint access routines.  Watchpoints are inserted using TLB tricks,
1540    so these check for a hit then pass through to the normal out-of-line
1541    phys routines.  */
1542 static uint64_t watch_mem_read(void *opaque, hwaddr addr,
1543                                unsigned size)
1544 {
1545     check_watchpoint(addr & ~TARGET_PAGE_MASK, ~(size - 1), BP_MEM_READ);
1546     switch (size) {
1547     case 1: return ldub_phys(addr);
1548     case 2: return lduw_phys(addr);
1549     case 4: return ldl_phys(addr);
1550     default: abort();
1551     }
1552 }
1553
1554 static void watch_mem_write(void *opaque, hwaddr addr,
1555                             uint64_t val, unsigned size)
1556 {
1557     check_watchpoint(addr & ~TARGET_PAGE_MASK, ~(size - 1), BP_MEM_WRITE);
1558     switch (size) {
1559     case 1:
1560         stb_phys(addr, val);
1561         break;
1562     case 2:
1563         stw_phys(addr, val);
1564         break;
1565     case 4:
1566         stl_phys(addr, val);
1567         break;
1568     default: abort();
1569     }
1570 }
1571
1572 static const MemoryRegionOps watch_mem_ops = {
1573     .read = watch_mem_read,
1574     .write = watch_mem_write,
1575     .endianness = DEVICE_NATIVE_ENDIAN,
1576 };
1577
1578 static uint64_t subpage_read(void *opaque, hwaddr addr,
1579                              unsigned len)
1580 {
1581     subpage_t *subpage = opaque;
1582     uint8_t buf[4];
1583
1584 #if defined(DEBUG_SUBPAGE)
1585     printf("%s: subpage %p len %d addr " TARGET_FMT_plx "\n", __func__,
1586            subpage, len, addr);
1587 #endif
1588     address_space_read(subpage->as, addr + subpage->base, buf, len);
1589     switch (len) {
1590     case 1:
1591         return ldub_p(buf);
1592     case 2:
1593         return lduw_p(buf);
1594     case 4:
1595         return ldl_p(buf);
1596     default:
1597         abort();
1598     }
1599 }
1600
1601 static void subpage_write(void *opaque, hwaddr addr,
1602                           uint64_t value, unsigned len)
1603 {
1604     subpage_t *subpage = opaque;
1605     uint8_t buf[4];
1606
1607 #if defined(DEBUG_SUBPAGE)
1608     printf("%s: subpage %p len %d addr " TARGET_FMT_plx
1609            " value %"PRIx64"\n",
1610            __func__, subpage, len, addr, value);
1611 #endif
1612     switch (len) {
1613     case 1:
1614         stb_p(buf, value);
1615         break;
1616     case 2:
1617         stw_p(buf, value);
1618         break;
1619     case 4:
1620         stl_p(buf, value);
1621         break;
1622     default:
1623         abort();
1624     }
1625     address_space_write(subpage->as, addr + subpage->base, buf, len);
1626 }
1627
1628 static bool subpage_accepts(void *opaque, hwaddr addr,
1629                             unsigned size, bool is_write)
1630 {
1631     subpage_t *subpage = opaque;
1632 #if defined(DEBUG_SUBPAGE)
1633     printf("%s: subpage %p %c len %d addr " TARGET_FMT_plx "\n",
1634            __func__, subpage, is_write ? 'w' : 'r', len, addr);
1635 #endif
1636
1637     return address_space_access_valid(subpage->as, addr + subpage->base,
1638                                       size, is_write);
1639 }
1640
1641 static const MemoryRegionOps subpage_ops = {
1642     .read = subpage_read,
1643     .write = subpage_write,
1644     .valid.accepts = subpage_accepts,
1645     .endianness = DEVICE_NATIVE_ENDIAN,
1646 };
1647
1648 static int subpage_register (subpage_t *mmio, uint32_t start, uint32_t end,
1649                              uint16_t section)
1650 {
1651     int idx, eidx;
1652
1653     if (start >= TARGET_PAGE_SIZE || end >= TARGET_PAGE_SIZE)
1654         return -1;
1655     idx = SUBPAGE_IDX(start);
1656     eidx = SUBPAGE_IDX(end);
1657 #if defined(DEBUG_SUBPAGE)
1658     printf("%s: %p start %08x end %08x idx %08x eidx %08x mem %ld\n", __func__,
1659            mmio, start, end, idx, eidx, memory);
1660 #endif
1661     for (; idx <= eidx; idx++) {
1662         mmio->sub_section[idx] = section;
1663     }
1664
1665     return 0;
1666 }
1667
1668 static subpage_t *subpage_init(AddressSpace *as, hwaddr base)
1669 {
1670     subpage_t *mmio;
1671
1672     mmio = g_malloc0(sizeof(subpage_t));
1673
1674     mmio->as = as;
1675     mmio->base = base;
1676     memory_region_init_io(&mmio->iomem, NULL, &subpage_ops, mmio,
1677                           "subpage", TARGET_PAGE_SIZE);
1678     mmio->iomem.subpage = true;
1679 #if defined(DEBUG_SUBPAGE)
1680     printf("%s: %p base " TARGET_FMT_plx " len %08x %d\n", __func__,
1681            mmio, base, TARGET_PAGE_SIZE, subpage_memory);
1682 #endif
1683     subpage_register(mmio, 0, TARGET_PAGE_SIZE-1, phys_section_unassigned);
1684
1685     return mmio;
1686 }
1687
1688 static uint16_t dummy_section(MemoryRegion *mr)
1689 {
1690     MemoryRegionSection section = {
1691         .mr = mr,
1692         .offset_within_address_space = 0,
1693         .offset_within_region = 0,
1694         .size = int128_2_64(),
1695     };
1696
1697     return phys_section_add(&section);
1698 }
1699
1700 MemoryRegion *iotlb_to_region(hwaddr index)
1701 {
1702     return phys_sections[index & ~TARGET_PAGE_MASK].mr;
1703 }
1704
1705 static void io_mem_init(void)
1706 {
1707     memory_region_init_io(&io_mem_rom, NULL, &unassigned_mem_ops, NULL, "rom", UINT64_MAX);
1708     memory_region_init_io(&io_mem_unassigned, NULL, &unassigned_mem_ops, NULL,
1709                           "unassigned", UINT64_MAX);
1710     memory_region_init_io(&io_mem_notdirty, NULL, &notdirty_mem_ops, NULL,
1711                           "notdirty", UINT64_MAX);
1712     memory_region_init_io(&io_mem_watch, NULL, &watch_mem_ops, NULL,
1713                           "watch", UINT64_MAX);
1714 }
1715
1716 static void mem_begin(MemoryListener *listener)
1717 {
1718     AddressSpaceDispatch *d = container_of(listener, AddressSpaceDispatch, listener);
1719
1720     destroy_all_mappings(d);
1721     d->phys_map.ptr = PHYS_MAP_NODE_NIL;
1722 }
1723
1724 static void core_begin(MemoryListener *listener)
1725 {
1726     phys_sections_clear();
1727     phys_section_unassigned = dummy_section(&io_mem_unassigned);
1728     phys_section_notdirty = dummy_section(&io_mem_notdirty);
1729     phys_section_rom = dummy_section(&io_mem_rom);
1730     phys_section_watch = dummy_section(&io_mem_watch);
1731 }
1732
1733 static void tcg_commit(MemoryListener *listener)
1734 {
1735     CPUArchState *env;
1736
1737     /* since each CPU stores ram addresses in its TLB cache, we must
1738        reset the modified entries */
1739     /* XXX: slow ! */
1740     for(env = first_cpu; env != NULL; env = env->next_cpu) {
1741         tlb_flush(env, 1);
1742     }
1743 }
1744
1745 static void core_log_global_start(MemoryListener *listener)
1746 {
1747     cpu_physical_memory_set_dirty_tracking(1);
1748 }
1749
1750 static void core_log_global_stop(MemoryListener *listener)
1751 {
1752     cpu_physical_memory_set_dirty_tracking(0);
1753 }
1754
1755 static MemoryListener core_memory_listener = {
1756     .begin = core_begin,
1757     .log_global_start = core_log_global_start,
1758     .log_global_stop = core_log_global_stop,
1759     .priority = 1,
1760 };
1761
1762 static MemoryListener tcg_memory_listener = {
1763     .commit = tcg_commit,
1764 };
1765
1766 void address_space_init_dispatch(AddressSpace *as)
1767 {
1768     AddressSpaceDispatch *d = g_new(AddressSpaceDispatch, 1);
1769
1770     d->phys_map  = (PhysPageEntry) { .ptr = PHYS_MAP_NODE_NIL, .is_leaf = 0 };
1771     d->listener = (MemoryListener) {
1772         .begin = mem_begin,
1773         .region_add = mem_add,
1774         .region_nop = mem_add,
1775         .priority = 0,
1776     };
1777     d->as = as;
1778     as->dispatch = d;
1779     memory_listener_register(&d->listener, as);
1780 }
1781
1782 void address_space_destroy_dispatch(AddressSpace *as)
1783 {
1784     AddressSpaceDispatch *d = as->dispatch;
1785
1786     memory_listener_unregister(&d->listener);
1787     destroy_l2_mapping(&d->phys_map, P_L2_LEVELS - 1);
1788     g_free(d);
1789     as->dispatch = NULL;
1790 }
1791
1792 static void memory_map_init(void)
1793 {
1794     system_memory = g_malloc(sizeof(*system_memory));
1795     memory_region_init(system_memory, NULL, "system", INT64_MAX);
1796     address_space_init(&address_space_memory, system_memory, "memory");
1797
1798     system_io = g_malloc(sizeof(*system_io));
1799     memory_region_init(system_io, NULL, "io", 65536);
1800     address_space_init(&address_space_io, system_io, "I/O");
1801
1802     memory_listener_register(&core_memory_listener, &address_space_memory);
1803     memory_listener_register(&tcg_memory_listener, &address_space_memory);
1804 }
1805
1806 MemoryRegion *get_system_memory(void)
1807 {
1808     return system_memory;
1809 }
1810
1811 MemoryRegion *get_system_io(void)
1812 {
1813     return system_io;
1814 }
1815
1816 #endif /* !defined(CONFIG_USER_ONLY) */
1817
1818 /* physical memory access (slow version, mainly for debug) */
1819 #if defined(CONFIG_USER_ONLY)
1820 int cpu_memory_rw_debug(CPUArchState *env, target_ulong addr,
1821                         uint8_t *buf, int len, int is_write)
1822 {
1823     int l, flags;
1824     target_ulong page;
1825     void * p;
1826
1827     while (len > 0) {
1828         page = addr & TARGET_PAGE_MASK;
1829         l = (page + TARGET_PAGE_SIZE) - addr;
1830         if (l > len)
1831             l = len;
1832         flags = page_get_flags(page);
1833         if (!(flags & PAGE_VALID))
1834             return -1;
1835         if (is_write) {
1836             if (!(flags & PAGE_WRITE))
1837                 return -1;
1838             /* XXX: this code should not depend on lock_user */
1839             if (!(p = lock_user(VERIFY_WRITE, addr, l, 0)))
1840                 return -1;
1841             memcpy(p, buf, l);
1842             unlock_user(p, addr, l);
1843         } else {
1844             if (!(flags & PAGE_READ))
1845                 return -1;
1846             /* XXX: this code should not depend on lock_user */
1847             if (!(p = lock_user(VERIFY_READ, addr, l, 1)))
1848                 return -1;
1849             memcpy(buf, p, l);
1850             unlock_user(p, addr, 0);
1851         }
1852         len -= l;
1853         buf += l;
1854         addr += l;
1855     }
1856     return 0;
1857 }
1858
1859 #else
1860
1861 static void invalidate_and_set_dirty(hwaddr addr,
1862                                      hwaddr length)
1863 {
1864     if (!cpu_physical_memory_is_dirty(addr)) {
1865         /* invalidate code */
1866         tb_invalidate_phys_page_range(addr, addr + length, 0);
1867         /* set dirty bit */
1868         cpu_physical_memory_set_dirty_flags(addr, (0xff & ~CODE_DIRTY_FLAG));
1869     }
1870     xen_modified_memory(addr, length);
1871 }
1872
1873 static inline bool memory_access_is_direct(MemoryRegion *mr, bool is_write)
1874 {
1875     if (memory_region_is_ram(mr)) {
1876         return !(is_write && mr->readonly);
1877     }
1878     if (memory_region_is_romd(mr)) {
1879         return !is_write;
1880     }
1881
1882     return false;
1883 }
1884
1885 static inline int memory_access_size(MemoryRegion *mr, int l, hwaddr addr)
1886 {
1887     if (l >= 4 && (((addr & 3) == 0 || mr->ops->impl.unaligned))) {
1888         return 4;
1889     }
1890     if (l >= 2 && (((addr & 1) == 0) || mr->ops->impl.unaligned)) {
1891         return 2;
1892     }
1893     return 1;
1894 }
1895
1896 bool address_space_rw(AddressSpace *as, hwaddr addr, uint8_t *buf,
1897                       int len, bool is_write)
1898 {
1899     hwaddr l;
1900     uint8_t *ptr;
1901     uint64_t val;
1902     hwaddr addr1;
1903     MemoryRegion *mr;
1904     bool error = false;
1905
1906     while (len > 0) {
1907         l = len;
1908         mr = address_space_translate(as, addr, &addr1, &l, is_write);
1909
1910         if (is_write) {
1911             if (!memory_access_is_direct(mr, is_write)) {
1912                 l = memory_access_size(mr, l, addr1);
1913                 /* XXX: could force cpu_single_env to NULL to avoid
1914                    potential bugs */
1915                 if (l == 4) {
1916                     /* 32 bit write access */
1917                     val = ldl_p(buf);
1918                     error |= io_mem_write(mr, addr1, val, 4);
1919                 } else if (l == 2) {
1920                     /* 16 bit write access */
1921                     val = lduw_p(buf);
1922                     error |= io_mem_write(mr, addr1, val, 2);
1923                 } else {
1924                     /* 8 bit write access */
1925                     val = ldub_p(buf);
1926                     error |= io_mem_write(mr, addr1, val, 1);
1927                 }
1928             } else {
1929                 addr1 += memory_region_get_ram_addr(mr);
1930                 /* RAM case */
1931                 ptr = qemu_get_ram_ptr(addr1);
1932                 memcpy(ptr, buf, l);
1933                 invalidate_and_set_dirty(addr1, l);
1934             }
1935         } else {
1936             if (!memory_access_is_direct(mr, is_write)) {
1937                 /* I/O case */
1938                 l = memory_access_size(mr, l, addr1);
1939                 if (l == 4) {
1940                     /* 32 bit read access */
1941                     error |= io_mem_read(mr, addr1, &val, 4);
1942                     stl_p(buf, val);
1943                 } else if (l == 2) {
1944                     /* 16 bit read access */
1945                     error |= io_mem_read(mr, addr1, &val, 2);
1946                     stw_p(buf, val);
1947                 } else {
1948                     /* 8 bit read access */
1949                     error |= io_mem_read(mr, addr1, &val, 1);
1950                     stb_p(buf, val);
1951                 }
1952             } else {
1953                 /* RAM case */
1954                 ptr = qemu_get_ram_ptr(mr->ram_addr + addr1);
1955                 memcpy(buf, ptr, l);
1956             }
1957         }
1958         len -= l;
1959         buf += l;
1960         addr += l;
1961     }
1962
1963     return error;
1964 }
1965
1966 bool address_space_write(AddressSpace *as, hwaddr addr,
1967                          const uint8_t *buf, int len)
1968 {
1969     return address_space_rw(as, addr, (uint8_t *)buf, len, true);
1970 }
1971
1972 bool address_space_read(AddressSpace *as, hwaddr addr, uint8_t *buf, int len)
1973 {
1974     return address_space_rw(as, addr, buf, len, false);
1975 }
1976
1977
1978 void cpu_physical_memory_rw(hwaddr addr, uint8_t *buf,
1979                             int len, int is_write)
1980 {
1981     address_space_rw(&address_space_memory, addr, buf, len, is_write);
1982 }
1983
1984 /* used for ROM loading : can write in RAM and ROM */
1985 void cpu_physical_memory_write_rom(hwaddr addr,
1986                                    const uint8_t *buf, int len)
1987 {
1988     hwaddr l;
1989     uint8_t *ptr;
1990     hwaddr addr1;
1991     MemoryRegion *mr;
1992
1993     while (len > 0) {
1994         l = len;
1995         mr = address_space_translate(&address_space_memory,
1996                                      addr, &addr1, &l, true);
1997
1998         if (!(memory_region_is_ram(mr) ||
1999               memory_region_is_romd(mr))) {
2000             /* do nothing */
2001         } else {
2002             addr1 += memory_region_get_ram_addr(mr);
2003             /* ROM/RAM case */
2004             ptr = qemu_get_ram_ptr(addr1);
2005             memcpy(ptr, buf, l);
2006             invalidate_and_set_dirty(addr1, l);
2007         }
2008         len -= l;
2009         buf += l;
2010         addr += l;
2011     }
2012 }
2013
2014 typedef struct {
2015     void *buffer;
2016     hwaddr addr;
2017     hwaddr len;
2018 } BounceBuffer;
2019
2020 static BounceBuffer bounce;
2021
2022 typedef struct MapClient {
2023     void *opaque;
2024     void (*callback)(void *opaque);
2025     QLIST_ENTRY(MapClient) link;
2026 } MapClient;
2027
2028 static QLIST_HEAD(map_client_list, MapClient) map_client_list
2029     = QLIST_HEAD_INITIALIZER(map_client_list);
2030
2031 void *cpu_register_map_client(void *opaque, void (*callback)(void *opaque))
2032 {
2033     MapClient *client = g_malloc(sizeof(*client));
2034
2035     client->opaque = opaque;
2036     client->callback = callback;
2037     QLIST_INSERT_HEAD(&map_client_list, client, link);
2038     return client;
2039 }
2040
2041 static void cpu_unregister_map_client(void *_client)
2042 {
2043     MapClient *client = (MapClient *)_client;
2044
2045     QLIST_REMOVE(client, link);
2046     g_free(client);
2047 }
2048
2049 static void cpu_notify_map_clients(void)
2050 {
2051     MapClient *client;
2052
2053     while (!QLIST_EMPTY(&map_client_list)) {
2054         client = QLIST_FIRST(&map_client_list);
2055         client->callback(client->opaque);
2056         cpu_unregister_map_client(client);
2057     }
2058 }
2059
2060 bool address_space_access_valid(AddressSpace *as, hwaddr addr, int len, bool is_write)
2061 {
2062     MemoryRegion *mr;
2063     hwaddr l, xlat;
2064
2065     while (len > 0) {
2066         l = len;
2067         mr = address_space_translate(as, addr, &xlat, &l, is_write);
2068         if (!memory_access_is_direct(mr, is_write)) {
2069             l = memory_access_size(mr, l, addr);
2070             if (!memory_region_access_valid(mr, xlat, l, is_write)) {
2071                 return false;
2072             }
2073         }
2074
2075         len -= l;
2076         addr += l;
2077     }
2078     return true;
2079 }
2080
2081 /* Map a physical memory region into a host virtual address.
2082  * May map a subset of the requested range, given by and returned in *plen.
2083  * May return NULL if resources needed to perform the mapping are exhausted.
2084  * Use only for reads OR writes - not for read-modify-write operations.
2085  * Use cpu_register_map_client() to know when retrying the map operation is
2086  * likely to succeed.
2087  */
2088 void *address_space_map(AddressSpace *as,
2089                         hwaddr addr,
2090                         hwaddr *plen,
2091                         bool is_write)
2092 {
2093     hwaddr len = *plen;
2094     hwaddr todo = 0;
2095     hwaddr l, xlat;
2096     MemoryRegion *mr;
2097     ram_addr_t raddr = RAM_ADDR_MAX;
2098     ram_addr_t rlen;
2099     void *ret;
2100
2101     while (len > 0) {
2102         l = len;
2103         mr = address_space_translate(as, addr, &xlat, &l, is_write);
2104
2105         if (!memory_access_is_direct(mr, is_write)) {
2106             if (todo || bounce.buffer) {
2107                 break;
2108             }
2109             bounce.buffer = qemu_memalign(TARGET_PAGE_SIZE, TARGET_PAGE_SIZE);
2110             bounce.addr = addr;
2111             bounce.len = l;
2112             if (!is_write) {
2113                 address_space_read(as, addr, bounce.buffer, l);
2114             }
2115
2116             *plen = l;
2117             return bounce.buffer;
2118         }
2119         if (!todo) {
2120             raddr = memory_region_get_ram_addr(mr) + xlat;
2121         } else {
2122             if (memory_region_get_ram_addr(mr) + xlat != raddr + todo) {
2123                 break;
2124             }
2125         }
2126
2127         len -= l;
2128         addr += l;
2129         todo += l;
2130     }
2131     rlen = todo;
2132     ret = qemu_ram_ptr_length(raddr, &rlen);
2133     *plen = rlen;
2134     return ret;
2135 }
2136
2137 /* Unmaps a memory region previously mapped by address_space_map().
2138  * Will also mark the memory as dirty if is_write == 1.  access_len gives
2139  * the amount of memory that was actually read or written by the caller.
2140  */
2141 void address_space_unmap(AddressSpace *as, void *buffer, hwaddr len,
2142                          int is_write, hwaddr access_len)
2143 {
2144     if (buffer != bounce.buffer) {
2145         if (is_write) {
2146             ram_addr_t addr1 = qemu_ram_addr_from_host_nofail(buffer);
2147             while (access_len) {
2148                 unsigned l;
2149                 l = TARGET_PAGE_SIZE;
2150                 if (l > access_len)
2151                     l = access_len;
2152                 invalidate_and_set_dirty(addr1, l);
2153                 addr1 += l;
2154                 access_len -= l;
2155             }
2156         }
2157         if (xen_enabled()) {
2158             xen_invalidate_map_cache_entry(buffer);
2159         }
2160         return;
2161     }
2162     if (is_write) {
2163         address_space_write(as, bounce.addr, bounce.buffer, access_len);
2164     }
2165     qemu_vfree(bounce.buffer);
2166     bounce.buffer = NULL;
2167     cpu_notify_map_clients();
2168 }
2169
2170 void *cpu_physical_memory_map(hwaddr addr,
2171                               hwaddr *plen,
2172                               int is_write)
2173 {
2174     return address_space_map(&address_space_memory, addr, plen, is_write);
2175 }
2176
2177 void cpu_physical_memory_unmap(void *buffer, hwaddr len,
2178                                int is_write, hwaddr access_len)
2179 {
2180     return address_space_unmap(&address_space_memory, buffer, len, is_write, access_len);
2181 }
2182
2183 /* warning: addr must be aligned */
2184 static inline uint32_t ldl_phys_internal(hwaddr addr,
2185                                          enum device_endian endian)
2186 {
2187     uint8_t *ptr;
2188     uint64_t val;
2189     MemoryRegion *mr;
2190     hwaddr l = 4;
2191     hwaddr addr1;
2192
2193     mr = address_space_translate(&address_space_memory, addr, &addr1, &l,
2194                                  false);
2195     if (l < 4 || !memory_access_is_direct(mr, false)) {
2196         /* I/O case */
2197         io_mem_read(mr, addr1, &val, 4);
2198 #if defined(TARGET_WORDS_BIGENDIAN)
2199         if (endian == DEVICE_LITTLE_ENDIAN) {
2200             val = bswap32(val);
2201         }
2202 #else
2203         if (endian == DEVICE_BIG_ENDIAN) {
2204             val = bswap32(val);
2205         }
2206 #endif
2207     } else {
2208         /* RAM case */
2209         ptr = qemu_get_ram_ptr((memory_region_get_ram_addr(mr)
2210                                 & TARGET_PAGE_MASK)
2211                                + addr1);
2212         switch (endian) {
2213         case DEVICE_LITTLE_ENDIAN:
2214             val = ldl_le_p(ptr);
2215             break;
2216         case DEVICE_BIG_ENDIAN:
2217             val = ldl_be_p(ptr);
2218             break;
2219         default:
2220             val = ldl_p(ptr);
2221             break;
2222         }
2223     }
2224     return val;
2225 }
2226
2227 uint32_t ldl_phys(hwaddr addr)
2228 {
2229     return ldl_phys_internal(addr, DEVICE_NATIVE_ENDIAN);
2230 }
2231
2232 uint32_t ldl_le_phys(hwaddr addr)
2233 {
2234     return ldl_phys_internal(addr, DEVICE_LITTLE_ENDIAN);
2235 }
2236
2237 uint32_t ldl_be_phys(hwaddr addr)
2238 {
2239     return ldl_phys_internal(addr, DEVICE_BIG_ENDIAN);
2240 }
2241
2242 /* warning: addr must be aligned */
2243 static inline uint64_t ldq_phys_internal(hwaddr addr,
2244                                          enum device_endian endian)
2245 {
2246     uint8_t *ptr;
2247     uint64_t val;
2248     MemoryRegion *mr;
2249     hwaddr l = 8;
2250     hwaddr addr1;
2251
2252     mr = address_space_translate(&address_space_memory, addr, &addr1, &l,
2253                                  false);
2254     if (l < 8 || !memory_access_is_direct(mr, false)) {
2255         /* I/O case */
2256         io_mem_read(mr, addr1, &val, 8);
2257 #if defined(TARGET_WORDS_BIGENDIAN)
2258         if (endian == DEVICE_LITTLE_ENDIAN) {
2259             val = bswap64(val);
2260         }
2261 #else
2262         if (endian == DEVICE_BIG_ENDIAN) {
2263             val = bswap64(val);
2264         }
2265 #endif
2266     } else {
2267         /* RAM case */
2268         ptr = qemu_get_ram_ptr((memory_region_get_ram_addr(mr)
2269                                 & TARGET_PAGE_MASK)
2270                                + addr1);
2271         switch (endian) {
2272         case DEVICE_LITTLE_ENDIAN:
2273             val = ldq_le_p(ptr);
2274             break;
2275         case DEVICE_BIG_ENDIAN:
2276             val = ldq_be_p(ptr);
2277             break;
2278         default:
2279             val = ldq_p(ptr);
2280             break;
2281         }
2282     }
2283     return val;
2284 }
2285
2286 uint64_t ldq_phys(hwaddr addr)
2287 {
2288     return ldq_phys_internal(addr, DEVICE_NATIVE_ENDIAN);
2289 }
2290
2291 uint64_t ldq_le_phys(hwaddr addr)
2292 {
2293     return ldq_phys_internal(addr, DEVICE_LITTLE_ENDIAN);
2294 }
2295
2296 uint64_t ldq_be_phys(hwaddr addr)
2297 {
2298     return ldq_phys_internal(addr, DEVICE_BIG_ENDIAN);
2299 }
2300
2301 /* XXX: optimize */
2302 uint32_t ldub_phys(hwaddr addr)
2303 {
2304     uint8_t val;
2305     cpu_physical_memory_read(addr, &val, 1);
2306     return val;
2307 }
2308
2309 /* warning: addr must be aligned */
2310 static inline uint32_t lduw_phys_internal(hwaddr addr,
2311                                           enum device_endian endian)
2312 {
2313     uint8_t *ptr;
2314     uint64_t val;
2315     MemoryRegion *mr;
2316     hwaddr l = 2;
2317     hwaddr addr1;
2318
2319     mr = address_space_translate(&address_space_memory, addr, &addr1, &l,
2320                                  false);
2321     if (l < 2 || !memory_access_is_direct(mr, false)) {
2322         /* I/O case */
2323         io_mem_read(mr, addr1, &val, 2);
2324 #if defined(TARGET_WORDS_BIGENDIAN)
2325         if (endian == DEVICE_LITTLE_ENDIAN) {
2326             val = bswap16(val);
2327         }
2328 #else
2329         if (endian == DEVICE_BIG_ENDIAN) {
2330             val = bswap16(val);
2331         }
2332 #endif
2333     } else {
2334         /* RAM case */
2335         ptr = qemu_get_ram_ptr((memory_region_get_ram_addr(mr)
2336                                 & TARGET_PAGE_MASK)
2337                                + addr1);
2338         switch (endian) {
2339         case DEVICE_LITTLE_ENDIAN:
2340             val = lduw_le_p(ptr);
2341             break;
2342         case DEVICE_BIG_ENDIAN:
2343             val = lduw_be_p(ptr);
2344             break;
2345         default:
2346             val = lduw_p(ptr);
2347             break;
2348         }
2349     }
2350     return val;
2351 }
2352
2353 uint32_t lduw_phys(hwaddr addr)
2354 {
2355     return lduw_phys_internal(addr, DEVICE_NATIVE_ENDIAN);
2356 }
2357
2358 uint32_t lduw_le_phys(hwaddr addr)
2359 {
2360     return lduw_phys_internal(addr, DEVICE_LITTLE_ENDIAN);
2361 }
2362
2363 uint32_t lduw_be_phys(hwaddr addr)
2364 {
2365     return lduw_phys_internal(addr, DEVICE_BIG_ENDIAN);
2366 }
2367
2368 /* warning: addr must be aligned. The ram page is not masked as dirty
2369    and the code inside is not invalidated. It is useful if the dirty
2370    bits are used to track modified PTEs */
2371 void stl_phys_notdirty(hwaddr addr, uint32_t val)
2372 {
2373     uint8_t *ptr;
2374     MemoryRegion *mr;
2375     hwaddr l = 4;
2376     hwaddr addr1;
2377
2378     mr = address_space_translate(&address_space_memory, addr, &addr1, &l,
2379                                  true);
2380     if (l < 4 || !memory_access_is_direct(mr, true)) {
2381         io_mem_write(mr, addr1, val, 4);
2382     } else {
2383         addr1 += memory_region_get_ram_addr(mr) & TARGET_PAGE_MASK;
2384         ptr = qemu_get_ram_ptr(addr1);
2385         stl_p(ptr, val);
2386
2387         if (unlikely(in_migration)) {
2388             if (!cpu_physical_memory_is_dirty(addr1)) {
2389                 /* invalidate code */
2390                 tb_invalidate_phys_page_range(addr1, addr1 + 4, 0);
2391                 /* set dirty bit */
2392                 cpu_physical_memory_set_dirty_flags(
2393                     addr1, (0xff & ~CODE_DIRTY_FLAG));
2394             }
2395         }
2396     }
2397 }
2398
2399 /* warning: addr must be aligned */
2400 static inline void stl_phys_internal(hwaddr addr, uint32_t val,
2401                                      enum device_endian endian)
2402 {
2403     uint8_t *ptr;
2404     MemoryRegion *mr;
2405     hwaddr l = 4;
2406     hwaddr addr1;
2407
2408     mr = address_space_translate(&address_space_memory, addr, &addr1, &l,
2409                                  true);
2410     if (l < 4 || !memory_access_is_direct(mr, true)) {
2411 #if defined(TARGET_WORDS_BIGENDIAN)
2412         if (endian == DEVICE_LITTLE_ENDIAN) {
2413             val = bswap32(val);
2414         }
2415 #else
2416         if (endian == DEVICE_BIG_ENDIAN) {
2417             val = bswap32(val);
2418         }
2419 #endif
2420         io_mem_write(mr, addr1, val, 4);
2421     } else {
2422         /* RAM case */
2423         addr1 += memory_region_get_ram_addr(mr) & TARGET_PAGE_MASK;
2424         ptr = qemu_get_ram_ptr(addr1);
2425         switch (endian) {
2426         case DEVICE_LITTLE_ENDIAN:
2427             stl_le_p(ptr, val);
2428             break;
2429         case DEVICE_BIG_ENDIAN:
2430             stl_be_p(ptr, val);
2431             break;
2432         default:
2433             stl_p(ptr, val);
2434             break;
2435         }
2436         invalidate_and_set_dirty(addr1, 4);
2437     }
2438 }
2439
2440 void stl_phys(hwaddr addr, uint32_t val)
2441 {
2442     stl_phys_internal(addr, val, DEVICE_NATIVE_ENDIAN);
2443 }
2444
2445 void stl_le_phys(hwaddr addr, uint32_t val)
2446 {
2447     stl_phys_internal(addr, val, DEVICE_LITTLE_ENDIAN);
2448 }
2449
2450 void stl_be_phys(hwaddr addr, uint32_t val)
2451 {
2452     stl_phys_internal(addr, val, DEVICE_BIG_ENDIAN);
2453 }
2454
2455 /* XXX: optimize */
2456 void stb_phys(hwaddr addr, uint32_t val)
2457 {
2458     uint8_t v = val;
2459     cpu_physical_memory_write(addr, &v, 1);
2460 }
2461
2462 /* warning: addr must be aligned */
2463 static inline void stw_phys_internal(hwaddr addr, uint32_t val,
2464                                      enum device_endian endian)
2465 {
2466     uint8_t *ptr;
2467     MemoryRegion *mr;
2468     hwaddr l = 2;
2469     hwaddr addr1;
2470
2471     mr = address_space_translate(&address_space_memory, addr, &addr1, &l,
2472                                  true);
2473     if (l < 2 || !memory_access_is_direct(mr, true)) {
2474 #if defined(TARGET_WORDS_BIGENDIAN)
2475         if (endian == DEVICE_LITTLE_ENDIAN) {
2476             val = bswap16(val);
2477         }
2478 #else
2479         if (endian == DEVICE_BIG_ENDIAN) {
2480             val = bswap16(val);
2481         }
2482 #endif
2483         io_mem_write(mr, addr1, val, 2);
2484     } else {
2485         /* RAM case */
2486         addr1 += memory_region_get_ram_addr(mr) & TARGET_PAGE_MASK;
2487         ptr = qemu_get_ram_ptr(addr1);
2488         switch (endian) {
2489         case DEVICE_LITTLE_ENDIAN:
2490             stw_le_p(ptr, val);
2491             break;
2492         case DEVICE_BIG_ENDIAN:
2493             stw_be_p(ptr, val);
2494             break;
2495         default:
2496             stw_p(ptr, val);
2497             break;
2498         }
2499         invalidate_and_set_dirty(addr1, 2);
2500     }
2501 }
2502
2503 void stw_phys(hwaddr addr, uint32_t val)
2504 {
2505     stw_phys_internal(addr, val, DEVICE_NATIVE_ENDIAN);
2506 }
2507
2508 void stw_le_phys(hwaddr addr, uint32_t val)
2509 {
2510     stw_phys_internal(addr, val, DEVICE_LITTLE_ENDIAN);
2511 }
2512
2513 void stw_be_phys(hwaddr addr, uint32_t val)
2514 {
2515     stw_phys_internal(addr, val, DEVICE_BIG_ENDIAN);
2516 }
2517
2518 /* XXX: optimize */
2519 void stq_phys(hwaddr addr, uint64_t val)
2520 {
2521     val = tswap64(val);
2522     cpu_physical_memory_write(addr, &val, 8);
2523 }
2524
2525 void stq_le_phys(hwaddr addr, uint64_t val)
2526 {
2527     val = cpu_to_le64(val);
2528     cpu_physical_memory_write(addr, &val, 8);
2529 }
2530
2531 void stq_be_phys(hwaddr addr, uint64_t val)
2532 {
2533     val = cpu_to_be64(val);
2534     cpu_physical_memory_write(addr, &val, 8);
2535 }
2536
2537 /* virtual memory access for debug (includes writing to ROM) */
2538 int cpu_memory_rw_debug(CPUArchState *env, target_ulong addr,
2539                         uint8_t *buf, int len, int is_write)
2540 {
2541     int l;
2542     hwaddr phys_addr;
2543     target_ulong page;
2544
2545     while (len > 0) {
2546         page = addr & TARGET_PAGE_MASK;
2547         phys_addr = cpu_get_phys_page_debug(env, page);
2548         /* if no physical page mapped, return an error */
2549         if (phys_addr == -1)
2550             return -1;
2551         l = (page + TARGET_PAGE_SIZE) - addr;
2552         if (l > len)
2553             l = len;
2554         phys_addr += (addr & ~TARGET_PAGE_MASK);
2555         if (is_write)
2556             cpu_physical_memory_write_rom(phys_addr, buf, l);
2557         else
2558             cpu_physical_memory_rw(phys_addr, buf, l, is_write);
2559         len -= l;
2560         buf += l;
2561         addr += l;
2562     }
2563     return 0;
2564 }
2565 #endif
2566
2567 #if !defined(CONFIG_USER_ONLY)
2568
2569 /*
2570  * A helper function for the _utterly broken_ virtio device model to find out if
2571  * it's running on a big endian machine. Don't do this at home kids!
2572  */
2573 bool virtio_is_big_endian(void);
2574 bool virtio_is_big_endian(void)
2575 {
2576 #if defined(TARGET_WORDS_BIGENDIAN)
2577     return true;
2578 #else
2579     return false;
2580 #endif
2581 }
2582
2583 #endif
2584
2585 #ifndef CONFIG_USER_ONLY
2586 bool cpu_physical_memory_is_io(hwaddr phys_addr)
2587 {
2588     MemoryRegion*mr;
2589     hwaddr l = 1;
2590
2591     mr = address_space_translate(&address_space_memory,
2592                                  phys_addr, &phys_addr, &l, false);
2593
2594     return !(memory_region_is_ram(mr) ||
2595              memory_region_is_romd(mr));
2596 }
2597
2598 void qemu_ram_foreach_block(RAMBlockIterFunc func, void *opaque)
2599 {
2600     RAMBlock *block;
2601
2602     QTAILQ_FOREACH(block, &ram_list.blocks, next) {
2603         func(block->host, block->offset, block->length, opaque);
2604     }
2605 }
2606 #endif