exec.c

   1 /*
   2  *  Virtual page mapping
   3  *
   4  *  Copyright (c) 2003 Fabrice Bellard
   5  *
   6  * This library is free software; you can redistribute it and/or
   7  * modify it under the terms of the GNU Lesser General Public
   8  * License as published by the Free Software Foundation; either
   9  * version 2 of the License, or (at your option) any later version.
  10  *
  11  * This library is distributed in the hope that it will be useful,
  12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  14  * Lesser General Public License for more details.
  15  *
  16  * You should have received a copy of the GNU Lesser General Public
  17  * License along with this library; if not, see <http://www.gnu.org/licenses/>.
  18  */
  19 #include "config.h"
  20 #ifdef _WIN32
  21 #include <windows.h>
  22 #else
  23 #include <sys/types.h>
  24 #include <sys/mman.h>
  25 #endif
  26
  27 #include "qemu-common.h"
  28 #include "cpu.h"
  29 #include "tcg.h"
  30 #include "hw/hw.h"
  31 #include "hw/qdev.h"
  32 #include "qemu/osdep.h"
  33 #include "sysemu/kvm.h"
  34 #include "hw/xen/xen.h"
  35 #include "qemu/timer.h"
  36 #include "qemu/config-file.h"
  37 #include "exec/memory.h"
  38 #include "sysemu/dma.h"
  39 #include "exec/address-spaces.h"
  40 #if defined(CONFIG_USER_ONLY)
  41 #include <qemu.h>
  42 #else /* !CONFIG_USER_ONLY */
  43 #include "sysemu/xen-mapcache.h"
  44 #include "trace.h"
  45 #endif
  46 #include "exec/cpu-all.h"
  47
  48 #include "exec/cputlb.h"
  49 #include "translate-all.h"
  50
  51 #include "exec/memory-internal.h"
  52
  53 //#define DEBUG_SUBPAGE
  54
  55 #if !defined(CONFIG_USER_ONLY)
  56 int phys_ram_fd;
  57 static int in_migration;
  58
  59 RAMList ram_list = { .blocks = QTAILQ_HEAD_INITIALIZER(ram_list.blocks) };
  60
  61 static MemoryRegion *system_memory;
  62 static MemoryRegion *system_io;
  63
  64 AddressSpace address_space_io;
  65 AddressSpace address_space_memory;
  66
  67 MemoryRegion io_mem_rom, io_mem_notdirty;
  68 static MemoryRegion io_mem_unassigned;
  69
  70 #endif
  71
  72 CPUArchState *first_cpu;
  73 /* current CPU in the current thread. It is only valid inside
  74    cpu_exec() */
  75 DEFINE_TLS(CPUArchState *,cpu_single_env);
  76 /* 0 = Do not count executed instructions.
  77    1 = Precise instruction counting.
  78    2 = Adaptive rate instruction counting.  */
  79 int use_icount;
  80
  81 #if !defined(CONFIG_USER_ONLY)
  82
  83 typedef struct PhysPageEntry PhysPageEntry;
  84
  85 struct PhysPageEntry {
  86     uint16_t is_leaf : 1;
  87      /* index into phys_sections (is_leaf) or phys_map_nodes (!is_leaf) */
  88     uint16_t ptr : 15;
  89 };
  90
  91 typedef PhysPageEntry Node[L2_SIZE];
  92
  93 struct AddressSpaceDispatch {
  94     /* This is a multi-level map on the physical address space.
  95      * The bottom level has pointers to MemoryRegionSections.
  96      */
  97     PhysPageEntry phys_map;
  98     Node *nodes;
  99     MemoryRegionSection *sections;
 100     AddressSpace *as;
 101 };
 102
 103 #define SUBPAGE_IDX(addr) ((addr) & ~TARGET_PAGE_MASK)
 104 typedef struct subpage_t {
 105     MemoryRegion iomem;
 106     AddressSpace *as;
 107     hwaddr base;
 108     uint16_t sub_section[TARGET_PAGE_SIZE];
 109 } subpage_t;
 110
 111 #define PHYS_SECTION_UNASSIGNED 0
 112 #define PHYS_SECTION_NOTDIRTY 1
 113 #define PHYS_SECTION_ROM 2
 114 #define PHYS_SECTION_WATCH 3
 115
 116 typedef struct PhysPageMap {
 117     unsigned sections_nb;
 118     unsigned sections_nb_alloc;
 119     unsigned nodes_nb;
 120     unsigned nodes_nb_alloc;
 121     Node *nodes;
 122     MemoryRegionSection *sections;
 123 } PhysPageMap;
 124
 125 static PhysPageMap cur_map;
 126 static PhysPageMap next_map;
 127
 128 #define PHYS_MAP_NODE_NIL (((uint16_t)~0) >> 1)
 129
 130 static void io_mem_init(void);
 131 static void memory_map_init(void);
 132 static void *qemu_safe_ram_ptr(ram_addr_t addr);
 133
 134 static MemoryRegion io_mem_watch;
 135 #endif
 136
 137 #if !defined(CONFIG_USER_ONLY)
 138
 139 static void phys_map_node_reserve(unsigned nodes)
 140 {
 141     if (next_map.nodes_nb + nodes > next_map.nodes_nb_alloc) {
 142         next_map.nodes_nb_alloc = MAX(next_map.nodes_nb_alloc * 2,
 143                                             16);
 144         next_map.nodes_nb_alloc = MAX(next_map.nodes_nb_alloc,
 145                                       next_map.nodes_nb + nodes);
 146         next_map.nodes = g_renew(Node, next_map.nodes,
 147                                  next_map.nodes_nb_alloc);
 148     }
 149 }
 150
 151 static uint16_t phys_map_node_alloc(void)
 152 {
 153     unsigned i;
 154     uint16_t ret;
 155
 156     ret = next_map.nodes_nb++;
 157     assert(ret != PHYS_MAP_NODE_NIL);
 158     assert(ret != next_map.nodes_nb_alloc);
 159     for (i = 0; i < L2_SIZE; ++i) {
 160         next_map.nodes[ret][i].is_leaf = 0;
 161         next_map.nodes[ret][i].ptr = PHYS_MAP_NODE_NIL;
 162     }
 163     return ret;
 164 }
 165
 166 static void phys_page_set_level(PhysPageEntry *lp, hwaddr *index,
 167                                 hwaddr *nb, uint16_t leaf,
 168                                 int level)
 169 {
 170     PhysPageEntry *p;
 171     int i;
 172     hwaddr step = (hwaddr)1 << (level * L2_BITS);
 173
 174     if (!lp->is_leaf && lp->ptr == PHYS_MAP_NODE_NIL) {
 175         lp->ptr = phys_map_node_alloc();
 176         p = next_map.nodes[lp->ptr];
 177         if (level == 0) {
 178             for (i = 0; i < L2_SIZE; i++) {
 179                 p[i].is_leaf = 1;
 180                 p[i].ptr = PHYS_SECTION_UNASSIGNED;
 181             }
 182         }
 183     } else {
 184         p = next_map.nodes[lp->ptr];
 185     }
 186     lp = &p[(*index >> (level * L2_BITS)) & (L2_SIZE - 1)];
 187
 188     while (*nb && lp < &p[L2_SIZE]) {
 189         if ((*index & (step - 1)) == 0 && *nb >= step) {
 190             lp->is_leaf = true;
 191             lp->ptr = leaf;
 192             *index += step;
 193             *nb -= step;
 194         } else {
 195             phys_page_set_level(lp, index, nb, leaf, level - 1);
 196         }
 197         ++lp;
 198     }
 199 }
 200
 201 static void phys_page_set(AddressSpaceDispatch *d,
 202                           hwaddr index, hwaddr nb,
 203                           uint16_t leaf)
 204 {
 205     /* Wildly overreserve - it doesn't matter much. */
 206     phys_map_node_reserve(3 * P_L2_LEVELS);
 207
 208     phys_page_set_level(&d->phys_map, &index, &nb, leaf, P_L2_LEVELS - 1);
 209 }
 210
 211 static MemoryRegionSection *phys_page_find(PhysPageEntry lp, hwaddr index,
 212                                            Node *nodes, MemoryRegionSection *sections)
 213 {
 214     PhysPageEntry *p;
 215     int i;
 216
 217     for (i = P_L2_LEVELS - 1; i >= 0 && !lp.is_leaf; i--) {
 218         if (lp.ptr == PHYS_MAP_NODE_NIL) {
 219             return &sections[PHYS_SECTION_UNASSIGNED];
 220         }
 221         p = nodes[lp.ptr];
 222         lp = p[(index >> (i * L2_BITS)) & (L2_SIZE - 1)];
 223     }
 224     return &sections[lp.ptr];
 225 }
 226
 227 bool memory_region_is_unassigned(MemoryRegion *mr)
 228 {
 229     return mr != &io_mem_rom && mr != &io_mem_notdirty && !mr->rom_device
 230         && mr != &io_mem_watch;
 231 }
 232
 233 static MemoryRegionSection *address_space_lookup_region(AddressSpace *as,
 234                                                         hwaddr addr,
 235                                                         bool resolve_subpage)
 236 {
 237     AddressSpaceDispatch *d = as->dispatch;
 238     MemoryRegionSection *section;
 239     subpage_t *subpage;
 240
 241     section = phys_page_find(d->phys_map, addr >> TARGET_PAGE_BITS,
 242                              d->nodes, d->sections);
 243     if (resolve_subpage && section->mr->subpage) {
 244         subpage = container_of(section->mr, subpage_t, iomem);
 245         section = &d->sections[subpage->sub_section[SUBPAGE_IDX(addr)]];
 246     }
 247     return section;
 248 }
 249
 250 static MemoryRegionSection *
 251 address_space_translate_internal(AddressSpace *as, hwaddr addr, hwaddr *xlat,
 252                                  hwaddr *plen, bool resolve_subpage)
 253 {
 254     MemoryRegionSection *section;
 255     Int128 diff;
 256
 257     section = address_space_lookup_region(as, addr, resolve_subpage);
 258     /* Compute offset within MemoryRegionSection */
 259     addr -= section->offset_within_address_space;
 260
 261     /* Compute offset within MemoryRegion */
 262     *xlat = addr + section->offset_within_region;
 263
 264     diff = int128_sub(section->mr->size, int128_make64(addr));
 265     *plen = int128_get64(int128_min(diff, int128_make64(*plen)));
 266     return section;
 267 }
 268
 269 MemoryRegion *address_space_translate(AddressSpace *as, hwaddr addr,
 270                                       hwaddr *xlat, hwaddr *plen,
 271                                       bool is_write)
 272 {
 273     IOMMUTLBEntry iotlb;
 274     MemoryRegionSection *section;
 275     MemoryRegion *mr;
 276     hwaddr len = *plen;
 277
 278     for (;;) {
 279         section = address_space_translate_internal(as, addr, &addr, plen, true);
 280         mr = section->mr;
 281
 282         if (!mr->iommu_ops) {
 283             break;
 284         }
 285
 286         iotlb = mr->iommu_ops->translate(mr, addr);
 287         addr = ((iotlb.translated_addr & ~iotlb.addr_mask)
 288                 | (addr & iotlb.addr_mask));
 289         len = MIN(len, (addr | iotlb.addr_mask) - addr + 1);
 290         if (!(iotlb.perm & (1 << is_write))) {
 291             mr = &io_mem_unassigned;
 292             break;
 293         }
 294
 295         as = iotlb.target_as;
 296     }
 297
 298     *plen = len;
 299     *xlat = addr;
 300     return mr;
 301 }
 302
 303 MemoryRegionSection *
 304 address_space_translate_for_iotlb(AddressSpace *as, hwaddr addr, hwaddr *xlat,
 305                                   hwaddr *plen)
 306 {
 307     MemoryRegionSection *section;
 308     section = address_space_translate_internal(as, addr, xlat, plen, false);
 309
 310     assert(!section->mr->iommu_ops);
 311     return section;
 312 }
 313 #endif
 314
 315 void cpu_exec_init_all(void)
 316 {
 317 #if !defined(CONFIG_USER_ONLY)
 318     qemu_mutex_init(&ram_list.mutex);
 319     memory_map_init();
 320     io_mem_init();
 321 #endif
 322 }
 323
 324 #if !defined(CONFIG_USER_ONLY)
 325
 326 static int cpu_common_post_load(void *opaque, int version_id)
 327 {
 328     CPUState *cpu = opaque;
 329
 330     /* 0x01 was CPU_INTERRUPT_EXIT. This line can be removed when the
 331        version_id is increased. */
 332     cpu->interrupt_request &= ~0x01;
 333     tlb_flush(cpu->env_ptr, 1);
 334
 335     return 0;
 336 }
 337
 338 const VMStateDescription vmstate_cpu_common = {
 339     .name = "cpu_common",
 340     .version_id = 1,
 341     .minimum_version_id = 1,
 342     .minimum_version_id_old = 1,
 343     .post_load = cpu_common_post_load,
 344     .fields      = (VMStateField []) {
 345         VMSTATE_UINT32(halted, CPUState),
 346         VMSTATE_UINT32(interrupt_request, CPUState),
 347         VMSTATE_END_OF_LIST()
 348     }
 349 };
 350
 351 #endif
 352
 353 CPUState *qemu_get_cpu(int index)
 354 {
 355     CPUArchState *env = first_cpu;
 356     CPUState *cpu = NULL;
 357
 358     while (env) {
 359         cpu = ENV_GET_CPU(env);
 360         if (cpu->cpu_index == index) {
 361             break;
 362         }
 363         env = env->next_cpu;
 364     }
 365
 366     return env ? cpu : NULL;
 367 }
 368
 369 void qemu_for_each_cpu(void (*func)(CPUState *cpu, void *data), void *data)
 370 {
 371     CPUArchState *env = first_cpu;
 372
 373     while (env) {
 374         func(ENV_GET_CPU(env), data);
 375         env = env->next_cpu;
 376     }
 377 }
 378
 379 void cpu_exec_init(CPUArchState *env)
 380 {
 381     CPUState *cpu = ENV_GET_CPU(env);
 382     CPUClass *cc = CPU_GET_CLASS(cpu);
 383     CPUArchState **penv;
 384     int cpu_index;
 385
 386 #if defined(CONFIG_USER_ONLY)
 387     cpu_list_lock();
 388 #endif
 389     env->next_cpu = NULL;
 390     penv = &first_cpu;
 391     cpu_index = 0;
 392     while (*penv != NULL) {
 393         penv = &(*penv)->next_cpu;
 394         cpu_index++;
 395     }
 396     cpu->cpu_index = cpu_index;
 397     cpu->numa_node = 0;
 398     QTAILQ_INIT(&env->breakpoints);
 399     QTAILQ_INIT(&env->watchpoints);
 400 #ifndef CONFIG_USER_ONLY
 401     cpu->thread_id = qemu_get_thread_id();
 402 #endif
 403     *penv = env;
 404 #if defined(CONFIG_USER_ONLY)
 405     cpu_list_unlock();
 406 #endif
 407     vmstate_register(NULL, cpu_index, &vmstate_cpu_common, cpu);
 408 #if defined(CPU_SAVE_VERSION) && !defined(CONFIG_USER_ONLY)
 409     register_savevm(NULL, "cpu", cpu_index, CPU_SAVE_VERSION,
 410                     cpu_save, cpu_load, env);
 411     assert(cc->vmsd == NULL);
 412 #endif
 413     if (cc->vmsd != NULL) {
 414         vmstate_register(NULL, cpu_index, cc->vmsd, cpu);
 415     }
 416 }
 417
 418 #if defined(TARGET_HAS_ICE)
 419 #if defined(CONFIG_USER_ONLY)
 420 static void breakpoint_invalidate(CPUArchState *env, target_ulong pc)
 421 {
 422     tb_invalidate_phys_page_range(pc, pc + 1, 0);
 423 }
 424 #else
 425 static void breakpoint_invalidate(CPUArchState *env, target_ulong pc)
 426 {
 427     tb_invalidate_phys_addr(cpu_get_phys_page_debug(env, pc) |
 428             (pc & ~TARGET_PAGE_MASK));
 429 }
 430 #endif
 431 #endif /* TARGET_HAS_ICE */
 432
 433 #if defined(CONFIG_USER_ONLY)
 434 void cpu_watchpoint_remove_all(CPUArchState *env, int mask)
 435
 436 {
 437 }
 438
 439 int cpu_watchpoint_insert(CPUArchState *env, target_ulong addr, target_ulong len,
 440                           int flags, CPUWatchpoint **watchpoint)
 441 {
 442     return -ENOSYS;
 443 }
 444 #else
 445 /* Add a watchpoint.  */
 446 int cpu_watchpoint_insert(CPUArchState *env, target_ulong addr, target_ulong len,
 447                           int flags, CPUWatchpoint **watchpoint)
 448 {
 449     target_ulong len_mask = ~(len - 1);
 450     CPUWatchpoint *wp;
 451
 452     /* sanity checks: allow power-of-2 lengths, deny unaligned watchpoints */
 453     if ((len & (len - 1)) || (addr & ~len_mask) ||
 454             len == 0 || len > TARGET_PAGE_SIZE) {
 455         fprintf(stderr, "qemu: tried to set invalid watchpoint at "
 456                 TARGET_FMT_lx ", len=" TARGET_FMT_lu "\n", addr, len);
 457         return -EINVAL;
 458     }
 459     wp = g_malloc(sizeof(*wp));
 460
 461     wp->vaddr = addr;
 462     wp->len_mask = len_mask;
 463     wp->flags = flags;
 464
 465     /* keep all GDB-injected watchpoints in front */
 466     if (flags & BP_GDB)
 467         QTAILQ_INSERT_HEAD(&env->watchpoints, wp, entry);
 468     else
 469         QTAILQ_INSERT_TAIL(&env->watchpoints, wp, entry);
 470
 471     tlb_flush_page(env, addr);
 472
 473     if (watchpoint)
 474         *watchpoint = wp;
 475     return 0;
 476 }
 477
 478 /* Remove a specific watchpoint.  */
 479 int cpu_watchpoint_remove(CPUArchState *env, target_ulong addr, target_ulong len,
 480                           int flags)
 481 {
 482     target_ulong len_mask = ~(len - 1);
 483     CPUWatchpoint *wp;
 484
 485     QTAILQ_FOREACH(wp, &env->watchpoints, entry) {
 486         if (addr == wp->vaddr && len_mask == wp->len_mask
 487                 && flags == (wp->flags & ~BP_WATCHPOINT_HIT)) {
 488             cpu_watchpoint_remove_by_ref(env, wp);
 489             return 0;
 490         }
 491     }
 492     return -ENOENT;
 493 }
 494
 495 /* Remove a specific watchpoint by reference.  */
 496 void cpu_watchpoint_remove_by_ref(CPUArchState *env, CPUWatchpoint *watchpoint)
 497 {
 498     QTAILQ_REMOVE(&env->watchpoints, watchpoint, entry);
 499
 500     tlb_flush_page(env, watchpoint->vaddr);
 501
 502     g_free(watchpoint);
 503 }
 504
 505 /* Remove all matching watchpoints.  */
 506 void cpu_watchpoint_remove_all(CPUArchState *env, int mask)
 507 {
 508     CPUWatchpoint *wp, *next;
 509
 510     QTAILQ_FOREACH_SAFE(wp, &env->watchpoints, entry, next) {
 511         if (wp->flags & mask)
 512             cpu_watchpoint_remove_by_ref(env, wp);
 513     }
 514 }
 515 #endif
 516
 517 /* Add a breakpoint.  */
 518 int cpu_breakpoint_insert(CPUArchState *env, target_ulong pc, int flags,
 519                           CPUBreakpoint **breakpoint)
 520 {
 521 #if defined(TARGET_HAS_ICE)
 522     CPUBreakpoint *bp;
 523
 524     bp = g_malloc(sizeof(*bp));
 525
 526     bp->pc = pc;
 527     bp->flags = flags;
 528
 529     /* keep all GDB-injected breakpoints in front */
 530     if (flags & BP_GDB)
 531         QTAILQ_INSERT_HEAD(&env->breakpoints, bp, entry);
 532     else
 533         QTAILQ_INSERT_TAIL(&env->breakpoints, bp, entry);
 534
 535     breakpoint_invalidate(env, pc);
 536
 537     if (breakpoint)
 538         *breakpoint = bp;
 539     return 0;
 540 #else
 541     return -ENOSYS;
 542 #endif
 543 }
 544
 545 /* Remove a specific breakpoint.  */
 546 int cpu_breakpoint_remove(CPUArchState *env, target_ulong pc, int flags)
 547 {
 548 #if defined(TARGET_HAS_ICE)
 549     CPUBreakpoint *bp;
 550
 551     QTAILQ_FOREACH(bp, &env->breakpoints, entry) {
 552         if (bp->pc == pc && bp->flags == flags) {
 553             cpu_breakpoint_remove_by_ref(env, bp);
 554             return 0;
 555         }
 556     }
 557     return -ENOENT;
 558 #else
 559     return -ENOSYS;
 560 #endif
 561 }
 562
 563 /* Remove a specific breakpoint by reference.  */
 564 void cpu_breakpoint_remove_by_ref(CPUArchState *env, CPUBreakpoint *breakpoint)
 565 {
 566 #if defined(TARGET_HAS_ICE)
 567     QTAILQ_REMOVE(&env->breakpoints, breakpoint, entry);
 568
 569     breakpoint_invalidate(env, breakpoint->pc);
 570
 571     g_free(breakpoint);
 572 #endif
 573 }
 574
 575 /* Remove all matching breakpoints. */
 576 void cpu_breakpoint_remove_all(CPUArchState *env, int mask)
 577 {
 578 #if defined(TARGET_HAS_ICE)
 579     CPUBreakpoint *bp, *next;
 580
 581     QTAILQ_FOREACH_SAFE(bp, &env->breakpoints, entry, next) {
 582         if (bp->flags & mask)
 583             cpu_breakpoint_remove_by_ref(env, bp);
 584     }
 585 #endif
 586 }
 587
 588 /* enable or disable single step mode. EXCP_DEBUG is returned by the
 589    CPU loop after each instruction */
 590 void cpu_single_step(CPUArchState *env, int enabled)
 591 {
 592 #if defined(TARGET_HAS_ICE)
 593     if (env->singlestep_enabled != enabled) {
 594         env->singlestep_enabled = enabled;
 595         if (kvm_enabled())
 596             kvm_update_guest_debug(env, 0);
 597         else {
 598             /* must flush all the translated code to avoid inconsistencies */
 599             /* XXX: only flush what is necessary */
 600             tb_flush(env);
 601         }
 602     }
 603 #endif
 604 }
 605
 606 void cpu_abort(CPUArchState *env, const char *fmt, ...)
 607 {
 608     CPUState *cpu = ENV_GET_CPU(env);
 609     va_list ap;
 610     va_list ap2;
 611
 612     va_start(ap, fmt);
 613     va_copy(ap2, ap);
 614     fprintf(stderr, "qemu: fatal: ");
 615     vfprintf(stderr, fmt, ap);
 616     fprintf(stderr, "\n");
 617     cpu_dump_state(cpu, stderr, fprintf, CPU_DUMP_FPU | CPU_DUMP_CCOP);
 618     if (qemu_log_enabled()) {
 619         qemu_log("qemu: fatal: ");
 620         qemu_log_vprintf(fmt, ap2);
 621         qemu_log("\n");
 622         log_cpu_state(env, CPU_DUMP_FPU | CPU_DUMP_CCOP);
 623         qemu_log_flush();
 624         qemu_log_close();
 625     }
 626     va_end(ap2);
 627     va_end(ap);
 628 #if defined(CONFIG_USER_ONLY)
 629     {
 630         struct sigaction act;
 631         sigfillset(&act.sa_mask);
 632         act.sa_handler = SIG_DFL;
 633         sigaction(SIGABRT, &act, NULL);
 634     }
 635 #endif
 636     abort();
 637 }
 638
 639 CPUArchState *cpu_copy(CPUArchState *env)
 640 {
 641     CPUArchState *new_env = cpu_init(env->cpu_model_str);
 642     CPUArchState *next_cpu = new_env->next_cpu;
 643 #if defined(TARGET_HAS_ICE)
 644     CPUBreakpoint *bp;
 645     CPUWatchpoint *wp;
 646 #endif
 647
 648     memcpy(new_env, env, sizeof(CPUArchState));
 649
 650     /* Preserve chaining. */
 651     new_env->next_cpu = next_cpu;
 652
 653     /* Clone all break/watchpoints.
 654        Note: Once we support ptrace with hw-debug register access, make sure
 655        BP_CPU break/watchpoints are handled correctly on clone. */
 656     QTAILQ_INIT(&env->breakpoints);
 657     QTAILQ_INIT(&env->watchpoints);
 658 #if defined(TARGET_HAS_ICE)
 659     QTAILQ_FOREACH(bp, &env->breakpoints, entry) {
 660         cpu_breakpoint_insert(new_env, bp->pc, bp->flags, NULL);
 661     }
 662     QTAILQ_FOREACH(wp, &env->watchpoints, entry) {
 663         cpu_watchpoint_insert(new_env, wp->vaddr, (~wp->len_mask) + 1,
 664                               wp->flags, NULL);
 665     }
 666 #endif
 667
 668     return new_env;
 669 }
 670
 671 #if !defined(CONFIG_USER_ONLY)
 672 static void tlb_reset_dirty_range_all(ram_addr_t start, ram_addr_t end,
 673                                       uintptr_t length)
 674 {
 675     uintptr_t start1;
 676
 677     /* we modify the TLB cache so that the dirty bit will be set again
 678        when accessing the range */
 679     start1 = (uintptr_t)qemu_safe_ram_ptr(start);
 680     /* Check that we don't span multiple blocks - this breaks the
 681        address comparisons below.  */
 682     if ((uintptr_t)qemu_safe_ram_ptr(end - 1) - start1
 683             != (end - 1) - start) {
 684         abort();
 685     }
 686     cpu_tlb_reset_dirty_all(start1, length);
 687
 688 }
 689
 690 /* Note: start and end must be within the same ram block.  */
 691 void cpu_physical_memory_reset_dirty(ram_addr_t start, ram_addr_t end,
 692                                      int dirty_flags)
 693 {
 694     uintptr_t length;
 695
 696     start &= TARGET_PAGE_MASK;
 697     end = TARGET_PAGE_ALIGN(end);
 698
 699     length = end - start;
 700     if (length == 0)
 701         return;
 702     cpu_physical_memory_mask_dirty_range(start, length, dirty_flags);
 703
 704     if (tcg_enabled()) {
 705         tlb_reset_dirty_range_all(start, end, length);
 706     }
 707 }
 708
 709 static int cpu_physical_memory_set_dirty_tracking(int enable)
 710 {
 711     int ret = 0;
 712     in_migration = enable;
 713     return ret;
 714 }
 715
 716 hwaddr memory_region_section_get_iotlb(CPUArchState *env,
 717                                        MemoryRegionSection *section,
 718                                        target_ulong vaddr,
 719                                        hwaddr paddr, hwaddr xlat,
 720                                        int prot,
 721                                        target_ulong *address)
 722 {
 723     hwaddr iotlb;
 724     CPUWatchpoint *wp;
 725
 726     if (memory_region_is_ram(section->mr)) {
 727         /* Normal RAM.  */
 728         iotlb = (memory_region_get_ram_addr(section->mr) & TARGET_PAGE_MASK)
 729             + xlat;
 730         if (!section->readonly) {
 731             iotlb |= PHYS_SECTION_NOTDIRTY;
 732         } else {
 733             iotlb |= PHYS_SECTION_ROM;
 734         }
 735     } else {
 736         iotlb = section - address_space_memory.dispatch->sections;
 737         iotlb += xlat;
 738     }
 739
 740     /* Make accesses to pages with watchpoints go via the
 741        watchpoint trap routines.  */
 742     QTAILQ_FOREACH(wp, &env->watchpoints, entry) {
 743         if (vaddr == (wp->vaddr & TARGET_PAGE_MASK)) {
 744             /* Avoid trapping reads of pages with a write breakpoint. */
 745             if ((prot & PAGE_WRITE) || (wp->flags & BP_MEM_READ)) {
 746                 iotlb = PHYS_SECTION_WATCH + paddr;
 747                 *address |= TLB_MMIO;
 748                 break;
 749             }
 750         }
 751     }
 752
 753     return iotlb;
 754 }
 755 #endif /* defined(CONFIG_USER_ONLY) */
 756
 757 #if !defined(CONFIG_USER_ONLY)
 758
 759 static int subpage_register (subpage_t *mmio, uint32_t start, uint32_t end,
 760                              uint16_t section);
 761 static subpage_t *subpage_init(AddressSpace *as, hwaddr base);
 762
 763 static uint16_t phys_section_add(MemoryRegionSection *section)
 764 {
 765     /* The physical section number is ORed with a page-aligned
 766      * pointer to produce the iotlb entries.  Thus it should
 767      * never overflow into the page-aligned value.
 768      */
 769     assert(next_map.sections_nb < TARGET_PAGE_SIZE);
 770
 771     if (next_map.sections_nb == next_map.sections_nb_alloc) {
 772         next_map.sections_nb_alloc = MAX(next_map.sections_nb_alloc * 2,
 773                                          16);
 774         next_map.sections = g_renew(MemoryRegionSection, next_map.sections,
 775                                     next_map.sections_nb_alloc);
 776     }
 777     next_map.sections[next_map.sections_nb] = *section;
 778     memory_region_ref(section->mr);
 779     return next_map.sections_nb++;
 780 }
 781
 782 static void phys_section_destroy(MemoryRegion *mr)
 783 {
 784     memory_region_unref(mr);
 785
 786     if (mr->subpage) {
 787         subpage_t *subpage = container_of(mr, subpage_t, iomem);
 788         memory_region_destroy(&subpage->iomem);
 789         g_free(subpage);
 790     }
 791 }
 792
 793 static void phys_sections_clear(PhysPageMap *map)
 794 {
 795     while (map->sections_nb > 0) {
 796         MemoryRegionSection *section = &map->sections[--map->sections_nb];
 797         phys_section_destroy(section->mr);
 798     }
 799     g_free(map->sections);
 800     g_free(map->nodes);
 801 }
 802
 803 static void register_subpage(AddressSpaceDispatch *d, MemoryRegionSection *section)
 804 {
 805     subpage_t *subpage;
 806     hwaddr base = section->offset_within_address_space
 807         & TARGET_PAGE_MASK;
 808     MemoryRegionSection *existing = phys_page_find(d->phys_map, base >> TARGET_PAGE_BITS,
 809                                                    next_map.nodes, next_map.sections);
 810     MemoryRegionSection subsection = {
 811         .offset_within_address_space = base,
 812         .size = int128_make64(TARGET_PAGE_SIZE),
 813     };
 814     hwaddr start, end;
 815
 816     assert(existing->mr->subpage || existing->mr == &io_mem_unassigned);
 817
 818     if (!(existing->mr->subpage)) {
 819         subpage = subpage_init(d->as, base);
 820         subsection.mr = &subpage->iomem;
 821         phys_page_set(d, base >> TARGET_PAGE_BITS, 1,
 822                       phys_section_add(&subsection));
 823     } else {
 824         subpage = container_of(existing->mr, subpage_t, iomem);
 825     }
 826     start = section->offset_within_address_space & ~TARGET_PAGE_MASK;
 827     end = start + int128_get64(section->size) - 1;
 828     subpage_register(subpage, start, end, phys_section_add(section));
 829 }
 830
 831
 832 static void register_multipage(AddressSpaceDispatch *d,
 833                                MemoryRegionSection *section)
 834 {
 835     hwaddr start_addr = section->offset_within_address_space;
 836     uint16_t section_index = phys_section_add(section);
 837     uint64_t num_pages = int128_get64(int128_rshift(section->size,
 838                                                     TARGET_PAGE_BITS));
 839
 840     assert(num_pages);
 841     phys_page_set(d, start_addr >> TARGET_PAGE_BITS, num_pages, section_index);
 842 }
 843
 844 static void mem_add(MemoryListener *listener, MemoryRegionSection *section)
 845 {
 846     AddressSpace *as = container_of(listener, AddressSpace, dispatch_listener);
 847     AddressSpaceDispatch *d = as->next_dispatch;
 848     MemoryRegionSection now = *section, remain = *section;
 849     Int128 page_size = int128_make64(TARGET_PAGE_SIZE);
 850
 851     if (now.offset_within_address_space & ~TARGET_PAGE_MASK) {
 852         uint64_t left = TARGET_PAGE_ALIGN(now.offset_within_address_space)
 853                        - now.offset_within_address_space;
 854
 855         now.size = int128_min(int128_make64(left), now.size);
 856         register_subpage(d, &now);
 857     } else {
 858         now.size = int128_zero();
 859     }
 860     while (int128_ne(remain.size, now.size)) {
 861         remain.size = int128_sub(remain.size, now.size);
 862         remain.offset_within_address_space += int128_get64(now.size);
 863         remain.offset_within_region += int128_get64(now.size);
 864         now = remain;
 865         if (int128_lt(remain.size, page_size)) {
 866             register_subpage(d, &now);
 867         } else if (remain.offset_within_region & ~TARGET_PAGE_MASK) {
 868             now.size = page_size;
 869             register_subpage(d, &now);
 870         } else {
 871             now.size = int128_and(now.size, int128_neg(page_size));
 872             register_multipage(d, &now);
 873         }
 874     }
 875 }
 876
 877 void qemu_flush_coalesced_mmio_buffer(void)
 878 {
 879     if (kvm_enabled())
 880         kvm_flush_coalesced_mmio_buffer();
 881 }
 882
 883 void qemu_mutex_lock_ramlist(void)
 884 {
 885     qemu_mutex_lock(&ram_list.mutex);
 886 }
 887
 888 void qemu_mutex_unlock_ramlist(void)
 889 {
 890     qemu_mutex_unlock(&ram_list.mutex);
 891 }
 892
 893 #if defined(__linux__) && !defined(TARGET_S390X)
 894
 895 #include <sys/vfs.h>
 896
 897 #define HUGETLBFS_MAGIC       0x958458f6
 898
 899 static long gethugepagesize(const char *path)
 900 {
 901     struct statfs fs;
 902     int ret;
 903
 904     do {
 905         ret = statfs(path, &fs);
 906     } while (ret != 0 && errno == EINTR);
 907
 908     if (ret != 0) {
 909         perror(path);
 910         return 0;
 911     }
 912
 913     if (fs.f_type != HUGETLBFS_MAGIC)
 914         fprintf(stderr, "Warning: path not on HugeTLBFS: %s\n", path);
 915
 916     return fs.f_bsize;
 917 }
 918
 919 static void *file_ram_alloc(RAMBlock *block,
 920                             ram_addr_t memory,
 921                             const char *path)
 922 {
 923     char *filename;
 924     char *sanitized_name;
 925     char *c;
 926     void *area;
 927     int fd;
 928 #ifdef MAP_POPULATE
 929     int flags;
 930 #endif
 931     unsigned long hpagesize;
 932
 933     hpagesize = gethugepagesize(path);
 934     if (!hpagesize) {
 935         return NULL;
 936     }
 937
 938     if (memory < hpagesize) {
 939         return NULL;
 940     }
 941
 942     if (kvm_enabled() && !kvm_has_sync_mmu()) {
 943         fprintf(stderr, "host lacks kvm mmu notifiers, -mem-path unsupported\n");
 944         return NULL;
 945     }
 946
 947     /* Make name safe to use with mkstemp by replacing '/' with '_'. */
 948     sanitized_name = g_strdup(block->mr->name);
 949     for (c = sanitized_name; *c != '\0'; c++) {
 950         if (*c == '/')
 951             *c = '_';
 952     }
 953
 954     filename = g_strdup_printf("%s/qemu_back_mem.%s.XXXXXX", path,
 955                                sanitized_name);
 956     g_free(sanitized_name);
 957
 958     fd = mkstemp(filename);
 959     if (fd < 0) {
 960         perror("unable to create backing store for hugepages");
 961         g_free(filename);
 962         return NULL;
 963     }
 964     unlink(filename);
 965     g_free(filename);
 966
 967     memory = (memory+hpagesize-1) & ~(hpagesize-1);
 968
 969     /*
 970      * ftruncate is not supported by hugetlbfs in older
 971      * hosts, so don't bother bailing out on errors.
 972      * If anything goes wrong with it under other filesystems,
 973      * mmap will fail.
 974      */
 975     if (ftruncate(fd, memory))
 976         perror("ftruncate");
 977
 978 #ifdef MAP_POPULATE
 979     /* NB: MAP_POPULATE won't exhaustively alloc all phys pages in the case
 980      * MAP_PRIVATE is requested.  For mem_prealloc we mmap as MAP_SHARED
 981      * to sidestep this quirk.
 982      */
 983     flags = mem_prealloc ? MAP_POPULATE | MAP_SHARED : MAP_PRIVATE;
 984     area = mmap(0, memory, PROT_READ | PROT_WRITE, flags, fd, 0);
 985 #else
 986     area = mmap(0, memory, PROT_READ | PROT_WRITE, MAP_PRIVATE, fd, 0);
 987 #endif
 988     if (area == MAP_FAILED) {
 989         perror("file_ram_alloc: can't mmap RAM pages");
 990         close(fd);
 991         return (NULL);
 992     }
 993     block->fd = fd;
 994     return area;
 995 }
 996 #endif
 997
 998 static ram_addr_t find_ram_offset(ram_addr_t size)
 999 {
1000     RAMBlock *block, *next_block;
1001     ram_addr_t offset = RAM_ADDR_MAX, mingap = RAM_ADDR_MAX;
1002
1003     assert(size != 0); /* it would hand out same offset multiple times */
1004
1005     if (QTAILQ_EMPTY(&ram_list.blocks))
1006         return 0;
1007
1008     QTAILQ_FOREACH(block, &ram_list.blocks, next) {
1009         ram_addr_t end, next = RAM_ADDR_MAX;
1010
1011         end = block->offset + block->length;
1012
1013         QTAILQ_FOREACH(next_block, &ram_list.blocks, next) {
1014             if (next_block->offset >= end) {
1015                 next = MIN(next, next_block->offset);
1016             }
1017         }
1018         if (next - end >= size && next - end < mingap) {
1019             offset = end;
1020             mingap = next - end;
1021         }
1022     }
1023
1024     if (offset == RAM_ADDR_MAX) {
1025         fprintf(stderr, "Failed to find gap of requested size: %" PRIu64 "\n",
1026                 (uint64_t)size);
1027         abort();
1028     }
1029
1030     return offset;
1031 }
1032
1033 ram_addr_t last_ram_offset(void)
1034 {
1035     RAMBlock *block;
1036     ram_addr_t last = 0;
1037
1038     QTAILQ_FOREACH(block, &ram_list.blocks, next)
1039         last = MAX(last, block->offset + block->length);
1040
1041     return last;
1042 }
1043
1044 static void qemu_ram_setup_dump(void *addr, ram_addr_t size)
1045 {
1046     int ret;
1047     QemuOpts *machine_opts;
1048
1049     /* Use MADV_DONTDUMP, if user doesn't want the guest memory in the core */
1050     machine_opts = qemu_opts_find(qemu_find_opts("machine"), 0);
1051     if (machine_opts &&
1052         !qemu_opt_get_bool(machine_opts, "dump-guest-core", true)) {
1053         ret = qemu_madvise(addr, size, QEMU_MADV_DONTDUMP);
1054         if (ret) {
1055             perror("qemu_madvise");
1056             fprintf(stderr, "madvise doesn't support MADV_DONTDUMP, "
1057                             "but dump_guest_core=off specified\n");
1058         }
1059     }
1060 }
1061
1062 void qemu_ram_set_idstr(ram_addr_t addr, const char *name, DeviceState *dev)
1063 {
1064     RAMBlock *new_block, *block;
1065
1066     new_block = NULL;
1067     QTAILQ_FOREACH(block, &ram_list.blocks, next) {
1068         if (block->offset == addr) {
1069             new_block = block;
1070             break;
1071         }
1072     }
1073     assert(new_block);
1074     assert(!new_block->idstr[0]);
1075
1076     if (dev) {
1077         char *id = qdev_get_dev_path(dev);
1078         if (id) {
1079             snprintf(new_block->idstr, sizeof(new_block->idstr), "%s/", id);
1080             g_free(id);
1081         }
1082     }
1083     pstrcat(new_block->idstr, sizeof(new_block->idstr), name);
1084
1085     /* This assumes the iothread lock is taken here too.  */
1086     qemu_mutex_lock_ramlist();
1087     QTAILQ_FOREACH(block, &ram_list.blocks, next) {
1088         if (block != new_block && !strcmp(block->idstr, new_block->idstr)) {
1089             fprintf(stderr, "RAMBlock \"%s\" already registered, abort!\n",
1090                     new_block->idstr);
1091             abort();
1092         }
1093     }
1094     qemu_mutex_unlock_ramlist();
1095 }
1096
1097 static int memory_try_enable_merging(void *addr, size_t len)
1098 {
1099     QemuOpts *opts;
1100
1101     opts = qemu_opts_find(qemu_find_opts("machine"), 0);
1102     if (opts && !qemu_opt_get_bool(opts, "mem-merge", true)) {
1103         /* disabled by the user */
1104         return 0;
1105     }
1106
1107     return qemu_madvise(addr, len, QEMU_MADV_MERGEABLE);
1108 }
1109
1110 ram_addr_t qemu_ram_alloc_from_ptr(ram_addr_t size, void *host,
1111                                    MemoryRegion *mr)
1112 {
1113     RAMBlock *block, *new_block;
1114
1115     size = TARGET_PAGE_ALIGN(size);
1116     new_block = g_malloc0(sizeof(*new_block));
1117
1118     /* This assumes the iothread lock is taken here too.  */
1119     qemu_mutex_lock_ramlist();
1120     new_block->mr = mr;
1121     new_block->offset = find_ram_offset(size);
1122     if (host) {
1123         new_block->host = host;
1124         new_block->flags |= RAM_PREALLOC_MASK;
1125     } else {
1126         if (mem_path) {
1127 #if defined (__linux__) && !defined(TARGET_S390X)
1128             new_block->host = file_ram_alloc(new_block, size, mem_path);
1129             if (!new_block->host) {
1130                 new_block->host = qemu_anon_ram_alloc(size);
1131                 memory_try_enable_merging(new_block->host, size);
1132             }
1133 #else
1134             fprintf(stderr, "-mem-path option unsupported\n");
1135             exit(1);
1136 #endif
1137         } else {
1138             if (xen_enabled()) {
1139                 xen_ram_alloc(new_block->offset, size, mr);
1140             } else if (kvm_enabled()) {
1141                 /* some s390/kvm configurations have special constraints */
1142                 new_block->host = kvm_ram_alloc(size);
1143             } else {
1144                 new_block->host = qemu_anon_ram_alloc(size);
1145             }
1146             memory_try_enable_merging(new_block->host, size);
1147         }
1148     }
1149     new_block->length = size;
1150
1151     /* Keep the list sorted from biggest to smallest block.  */
1152     QTAILQ_FOREACH(block, &ram_list.blocks, next) {
1153         if (block->length < new_block->length) {
1154             break;
1155         }
1156     }
1157     if (block) {
1158         QTAILQ_INSERT_BEFORE(block, new_block, next);
1159     } else {
1160         QTAILQ_INSERT_TAIL(&ram_list.blocks, new_block, next);
1161     }
1162     ram_list.mru_block = NULL;
1163
1164     ram_list.version++;
1165     qemu_mutex_unlock_ramlist();
1166
1167     ram_list.phys_dirty = g_realloc(ram_list.phys_dirty,
1168                                        last_ram_offset() >> TARGET_PAGE_BITS);
1169     memset(ram_list.phys_dirty + (new_block->offset >> TARGET_PAGE_BITS),
1170            0, size >> TARGET_PAGE_BITS);
1171     cpu_physical_memory_set_dirty_range(new_block->offset, size, 0xff);
1172
1173     qemu_ram_setup_dump(new_block->host, size);
1174     qemu_madvise(new_block->host, size, QEMU_MADV_HUGEPAGE);
1175
1176     if (kvm_enabled())
1177         kvm_setup_guest_memory(new_block->host, size);
1178
1179     return new_block->offset;
1180 }
1181
1182 ram_addr_t qemu_ram_alloc(ram_addr_t size, MemoryRegion *mr)
1183 {
1184     return qemu_ram_alloc_from_ptr(size, NULL, mr);
1185 }
1186
1187 void qemu_ram_free_from_ptr(ram_addr_t addr)
1188 {
1189     RAMBlock *block;
1190
1191     /* This assumes the iothread lock is taken here too.  */
1192     qemu_mutex_lock_ramlist();
1193     QTAILQ_FOREACH(block, &ram_list.blocks, next) {
1194         if (addr == block->offset) {
1195             QTAILQ_REMOVE(&ram_list.blocks, block, next);
1196             ram_list.mru_block = NULL;
1197             ram_list.version++;
1198             g_free(block);
1199             break;
1200         }
1201     }
1202     qemu_mutex_unlock_ramlist();
1203 }
1204
1205 void qemu_ram_free(ram_addr_t addr)
1206 {
1207     RAMBlock *block;
1208
1209     /* This assumes the iothread lock is taken here too.  */
1210     qemu_mutex_lock_ramlist();
1211     QTAILQ_FOREACH(block, &ram_list.blocks, next) {
1212         if (addr == block->offset) {
1213             QTAILQ_REMOVE(&ram_list.blocks, block, next);
1214             ram_list.mru_block = NULL;
1215             ram_list.version++;
1216             if (block->flags & RAM_PREALLOC_MASK) {
1217                 ;
1218             } else if (mem_path) {
1219 #if defined (__linux__) && !defined(TARGET_S390X)
1220                 if (block->fd) {
1221                     munmap(block->host, block->length);
1222                     close(block->fd);
1223                 } else {
1224                     qemu_anon_ram_free(block->host, block->length);
1225                 }
1226 #else
1227                 abort();
1228 #endif
1229             } else {
1230                 if (xen_enabled()) {
1231                     xen_invalidate_map_cache_entry(block->host);
1232                 } else {
1233                     qemu_anon_ram_free(block->host, block->length);
1234                 }
1235             }
1236             g_free(block);
1237             break;
1238         }
1239     }
1240     qemu_mutex_unlock_ramlist();
1241
1242 }
1243
1244 #ifndef _WIN32
1245 void qemu_ram_remap(ram_addr_t addr, ram_addr_t length)
1246 {
1247     RAMBlock *block;
1248     ram_addr_t offset;
1249     int flags;
1250     void *area, *vaddr;
1251
1252     QTAILQ_FOREACH(block, &ram_list.blocks, next) {
1253         offset = addr - block->offset;
1254         if (offset < block->length) {
1255             vaddr = block->host + offset;
1256             if (block->flags & RAM_PREALLOC_MASK) {
1257                 ;
1258             } else {
1259                 flags = MAP_FIXED;
1260                 munmap(vaddr, length);
1261                 if (mem_path) {
1262 #if defined(__linux__) && !defined(TARGET_S390X)
1263                     if (block->fd) {
1264 #ifdef MAP_POPULATE
1265                         flags |= mem_prealloc ? MAP_POPULATE | MAP_SHARED :
1266                             MAP_PRIVATE;
1267 #else
1268                         flags |= MAP_PRIVATE;
1269 #endif
1270                         area = mmap(vaddr, length, PROT_READ | PROT_WRITE,
1271                                     flags, block->fd, offset);
1272                     } else {
1273                         flags |= MAP_PRIVATE | MAP_ANONYMOUS;
1274                         area = mmap(vaddr, length, PROT_READ | PROT_WRITE,
1275                                     flags, -1, 0);
1276                     }
1277 #else
1278                     abort();
1279 #endif
1280                 } else {
1281 #if defined(TARGET_S390X) && defined(CONFIG_KVM)
1282                     flags |= MAP_SHARED | MAP_ANONYMOUS;
1283                     area = mmap(vaddr, length, PROT_EXEC|PROT_READ|PROT_WRITE,
1284                                 flags, -1, 0);
1285 #else
1286                     flags |= MAP_PRIVATE | MAP_ANONYMOUS;
1287                     area = mmap(vaddr, length, PROT_READ | PROT_WRITE,
1288                                 flags, -1, 0);
1289 #endif
1290                 }
1291                 if (area != vaddr) {
1292                     fprintf(stderr, "Could not remap addr: "
1293                             RAM_ADDR_FMT "@" RAM_ADDR_FMT "\n",
1294                             length, addr);
1295                     exit(1);
1296                 }
1297                 memory_try_enable_merging(vaddr, length);
1298                 qemu_ram_setup_dump(vaddr, length);
1299             }
1300             return;
1301         }
1302     }
1303 }
1304 #endif /* !_WIN32 */
1305
1306 static RAMBlock *qemu_get_ram_block(ram_addr_t addr)
1307 {
1308     RAMBlock *block;
1309
1310     /* The list is protected by the iothread lock here.  */
1311     block = ram_list.mru_block;
1312     if (block && addr - block->offset < block->length) {
1313         goto found;
1314     }
1315     QTAILQ_FOREACH(block, &ram_list.blocks, next) {
1316         if (addr - block->offset < block->length) {
1317             goto found;
1318         }
1319     }
1320
1321     fprintf(stderr, "Bad ram offset %" PRIx64 "\n", (uint64_t)addr);
1322     abort();
1323
1324 found:
1325     ram_list.mru_block = block;
1326     return block;
1327 }
1328
1329 /* Return a host pointer to ram allocated with qemu_ram_alloc.
1330    With the exception of the softmmu code in this file, this should
1331    only be used for local memory (e.g. video ram) that the device owns,
1332    and knows it isn't going to access beyond the end of the block.
1333
1334    It should not be used for general purpose DMA.
1335    Use cpu_physical_memory_map/cpu_physical_memory_rw instead.
1336  */
1337 void *qemu_get_ram_ptr(ram_addr_t addr)
1338 {
1339     RAMBlock *block = qemu_get_ram_block(addr);
1340
1341     if (xen_enabled()) {
1342         /* We need to check if the requested address is in the RAM
1343          * because we don't want to map the entire memory in QEMU.
1344          * In that case just map until the end of the page.
1345          */
1346         if (block->offset == 0) {
1347             return xen_map_cache(addr, 0, 0);
1348         } else if (block->host == NULL) {
1349             block->host =
1350                 xen_map_cache(block->offset, block->length, 1);
1351         }
1352     }
1353     return block->host + (addr - block->offset);
1354 }
1355
1356 /* Return a host pointer to ram allocated with qemu_ram_alloc.  Same as
1357  * qemu_get_ram_ptr but do not touch ram_list.mru_block.
1358  *
1359  * ??? Is this still necessary?
1360  */
1361 static void *qemu_safe_ram_ptr(ram_addr_t addr)
1362 {
1363     RAMBlock *block;
1364
1365     /* The list is protected by the iothread lock here.  */
1366     QTAILQ_FOREACH(block, &ram_list.blocks, next) {
1367         if (addr - block->offset < block->length) {
1368             if (xen_enabled()) {
1369                 /* We need to check if the requested address is in the RAM
1370                  * because we don't want to map the entire memory in QEMU.
1371                  * In that case just map until the end of the page.
1372                  */
1373                 if (block->offset == 0) {
1374                     return xen_map_cache(addr, 0, 0);
1375                 } else if (block->host == NULL) {
1376                     block->host =
1377                         xen_map_cache(block->offset, block->length, 1);
1378                 }
1379             }
1380             return block->host + (addr - block->offset);
1381         }
1382     }
1383
1384     fprintf(stderr, "Bad ram offset %" PRIx64 "\n", (uint64_t)addr);
1385     abort();
1386
1387     return NULL;
1388 }
1389
1390 /* Return a host pointer to guest's ram. Similar to qemu_get_ram_ptr
1391  * but takes a size argument */
1392 static void *qemu_ram_ptr_length(ram_addr_t addr, ram_addr_t *size)
1393 {
1394     if (*size == 0) {
1395         return NULL;
1396     }
1397     if (xen_enabled()) {
1398         return xen_map_cache(addr, *size, 1);
1399     } else {
1400         RAMBlock *block;
1401
1402         QTAILQ_FOREACH(block, &ram_list.blocks, next) {
1403             if (addr - block->offset < block->length) {
1404                 if (addr - block->offset + *size > block->length)
1405                     *size = block->length - addr + block->offset;
1406                 return block->host + (addr - block->offset);
1407             }
1408         }
1409
1410         fprintf(stderr, "Bad ram offset %" PRIx64 "\n", (uint64_t)addr);
1411         abort();
1412     }
1413 }
1414
1415 /* Some of the softmmu routines need to translate from a host pointer
1416    (typically a TLB entry) back to a ram offset.  */
1417 MemoryRegion *qemu_ram_addr_from_host(void *ptr, ram_addr_t *ram_addr)
1418 {
1419     RAMBlock *block;
1420     uint8_t *host = ptr;
1421
1422     if (xen_enabled()) {
1423         *ram_addr = xen_ram_addr_from_mapcache(ptr);
1424         return qemu_get_ram_block(*ram_addr)->mr;
1425     }
1426
1427     block = ram_list.mru_block;
1428     if (block && block->host && host - block->host < block->length) {
1429         goto found;
1430     }
1431
1432     QTAILQ_FOREACH(block, &ram_list.blocks, next) {
1433         /* This case append when the block is not mapped. */
1434         if (block->host == NULL) {
1435             continue;
1436         }
1437         if (host - block->host < block->length) {
1438             goto found;
1439         }
1440     }
1441
1442     return NULL;
1443
1444 found:
1445     *ram_addr = block->offset + (host - block->host);
1446     return block->mr;
1447 }
1448
1449 static void notdirty_mem_write(void *opaque, hwaddr ram_addr,
1450                                uint64_t val, unsigned size)
1451 {
1452     int dirty_flags;
1453     dirty_flags = cpu_physical_memory_get_dirty_flags(ram_addr);
1454     if (!(dirty_flags & CODE_DIRTY_FLAG)) {
1455         tb_invalidate_phys_page_fast(ram_addr, size);
1456         dirty_flags = cpu_physical_memory_get_dirty_flags(ram_addr);
1457     }
1458     switch (size) {
1459     case 1:
1460         stb_p(qemu_get_ram_ptr(ram_addr), val);
1461         break;
1462     case 2:
1463         stw_p(qemu_get_ram_ptr(ram_addr), val);
1464         break;
1465     case 4:
1466         stl_p(qemu_get_ram_ptr(ram_addr), val);
1467         break;
1468     default:
1469         abort();
1470     }
1471     dirty_flags |= (0xff & ~CODE_DIRTY_FLAG);
1472     cpu_physical_memory_set_dirty_flags(ram_addr, dirty_flags);
1473     /* we remove the notdirty callback only if the code has been
1474        flushed */
1475     if (dirty_flags == 0xff)
1476         tlb_set_dirty(cpu_single_env, cpu_single_env->mem_io_vaddr);
1477 }
1478
1479 static bool notdirty_mem_accepts(void *opaque, hwaddr addr,
1480                                  unsigned size, bool is_write)
1481 {
1482     return is_write;
1483 }
1484
1485 static const MemoryRegionOps notdirty_mem_ops = {
1486     .write = notdirty_mem_write,
1487     .valid.accepts = notdirty_mem_accepts,
1488     .endianness = DEVICE_NATIVE_ENDIAN,
1489 };
1490
1491 /* Generate a debug exception if a watchpoint has been hit.  */
1492 static void check_watchpoint(int offset, int len_mask, int flags)
1493 {
1494     CPUArchState *env = cpu_single_env;
1495     target_ulong pc, cs_base;
1496     target_ulong vaddr;
1497     CPUWatchpoint *wp;
1498     int cpu_flags;
1499
1500     if (env->watchpoint_hit) {
1501         /* We re-entered the check after replacing the TB. Now raise
1502          * the debug interrupt so that is will trigger after the
1503          * current instruction. */
1504         cpu_interrupt(ENV_GET_CPU(env), CPU_INTERRUPT_DEBUG);
1505         return;
1506     }
1507     vaddr = (env->mem_io_vaddr & TARGET_PAGE_MASK) + offset;
1508     QTAILQ_FOREACH(wp, &env->watchpoints, entry) {
1509         if ((vaddr == (wp->vaddr & len_mask) ||
1510              (vaddr & wp->len_mask) == wp->vaddr) && (wp->flags & flags)) {
1511             wp->flags |= BP_WATCHPOINT_HIT;
1512             if (!env->watchpoint_hit) {
1513                 env->watchpoint_hit = wp;
1514                 tb_check_watchpoint(env);
1515                 if (wp->flags & BP_STOP_BEFORE_ACCESS) {
1516                     env->exception_index = EXCP_DEBUG;
1517                     cpu_loop_exit(env);
1518                 } else {
1519                     cpu_get_tb_cpu_state(env, &pc, &cs_base, &cpu_flags);
1520                     tb_gen_code(env, pc, cs_base, cpu_flags, 1);
1521                     cpu_resume_from_signal(env, NULL);
1522                 }
1523             }
1524         } else {
1525             wp->flags &= ~BP_WATCHPOINT_HIT;
1526         }
1527     }
1528 }
1529
1530 /* Watchpoint access routines.  Watchpoints are inserted using TLB tricks,
1531    so these check for a hit then pass through to the normal out-of-line
1532    phys routines.  */
1533 static uint64_t watch_mem_read(void *opaque, hwaddr addr,
1534                                unsigned size)
1535 {
1536     check_watchpoint(addr & ~TARGET_PAGE_MASK, ~(size - 1), BP_MEM_READ);
1537     switch (size) {
1538     case 1: return ldub_phys(addr);
1539     case 2: return lduw_phys(addr);
1540     case 4: return ldl_phys(addr);
1541     default: abort();
1542     }
1543 }
1544
1545 static void watch_mem_write(void *opaque, hwaddr addr,
1546                             uint64_t val, unsigned size)
1547 {
1548     check_watchpoint(addr & ~TARGET_PAGE_MASK, ~(size - 1), BP_MEM_WRITE);
1549     switch (size) {
1550     case 1:
1551         stb_phys(addr, val);
1552         break;
1553     case 2:
1554         stw_phys(addr, val);
1555         break;
1556     case 4:
1557         stl_phys(addr, val);
1558         break;
1559     default: abort();
1560     }
1561 }
1562
1563 static const MemoryRegionOps watch_mem_ops = {
1564     .read = watch_mem_read,
1565     .write = watch_mem_write,
1566     .endianness = DEVICE_NATIVE_ENDIAN,
1567 };
1568
1569 static uint64_t subpage_read(void *opaque, hwaddr addr,
1570                              unsigned len)
1571 {
1572     subpage_t *subpage = opaque;
1573     uint8_t buf[4];
1574
1575 #if defined(DEBUG_SUBPAGE)
1576     printf("%s: subpage %p len %d addr " TARGET_FMT_plx "\n", __func__,
1577            subpage, len, addr);
1578 #endif
1579     address_space_read(subpage->as, addr + subpage->base, buf, len);
1580     switch (len) {
1581     case 1:
1582         return ldub_p(buf);
1583     case 2:
1584         return lduw_p(buf);
1585     case 4:
1586         return ldl_p(buf);
1587     default:
1588         abort();
1589     }
1590 }
1591
1592 static void subpage_write(void *opaque, hwaddr addr,
1593                           uint64_t value, unsigned len)
1594 {
1595     subpage_t *subpage = opaque;
1596     uint8_t buf[4];
1597
1598 #if defined(DEBUG_SUBPAGE)
1599     printf("%s: subpage %p len %d addr " TARGET_FMT_plx
1600            " value %"PRIx64"\n",
1601            __func__, subpage, len, addr, value);
1602 #endif
1603     switch (len) {
1604     case 1:
1605         stb_p(buf, value);
1606         break;
1607     case 2:
1608         stw_p(buf, value);
1609         break;
1610     case 4:
1611         stl_p(buf, value);
1612         break;
1613     default:
1614         abort();
1615     }
1616     address_space_write(subpage->as, addr + subpage->base, buf, len);
1617 }
1618
1619 static bool subpage_accepts(void *opaque, hwaddr addr,
1620                             unsigned size, bool is_write)
1621 {
1622     subpage_t *subpage = opaque;
1623 #if defined(DEBUG_SUBPAGE)
1624     printf("%s: subpage %p %c len %d addr " TARGET_FMT_plx "\n",
1625            __func__, subpage, is_write ? 'w' : 'r', len, addr);
1626 #endif
1627
1628     return address_space_access_valid(subpage->as, addr + subpage->base,
1629                                       size, is_write);
1630 }
1631
1632 static const MemoryRegionOps subpage_ops = {
1633     .read = subpage_read,
1634     .write = subpage_write,
1635     .valid.accepts = subpage_accepts,
1636     .endianness = DEVICE_NATIVE_ENDIAN,
1637 };
1638
1639 static int subpage_register (subpage_t *mmio, uint32_t start, uint32_t end,
1640                              uint16_t section)
1641 {
1642     int idx, eidx;
1643
1644     if (start >= TARGET_PAGE_SIZE || end >= TARGET_PAGE_SIZE)
1645         return -1;
1646     idx = SUBPAGE_IDX(start);
1647     eidx = SUBPAGE_IDX(end);
1648 #if defined(DEBUG_SUBPAGE)
1649     printf("%s: %p start %08x end %08x idx %08x eidx %08x mem %ld\n", __func__,
1650            mmio, start, end, idx, eidx, memory);
1651 #endif
1652     for (; idx <= eidx; idx++) {
1653         mmio->sub_section[idx] = section;
1654     }
1655
1656     return 0;
1657 }
1658
1659 static subpage_t *subpage_init(AddressSpace *as, hwaddr base)
1660 {
1661     subpage_t *mmio;
1662
1663     mmio = g_malloc0(sizeof(subpage_t));
1664
1665     mmio->as = as;
1666     mmio->base = base;
1667     memory_region_init_io(&mmio->iomem, NULL, &subpage_ops, mmio,
1668                           "subpage", TARGET_PAGE_SIZE);
1669     mmio->iomem.subpage = true;
1670 #if defined(DEBUG_SUBPAGE)
1671     printf("%s: %p base " TARGET_FMT_plx " len %08x %d\n", __func__,
1672            mmio, base, TARGET_PAGE_SIZE, subpage_memory);
1673 #endif
1674     subpage_register(mmio, 0, TARGET_PAGE_SIZE-1, PHYS_SECTION_UNASSIGNED);
1675
1676     return mmio;
1677 }
1678
1679 static uint16_t dummy_section(MemoryRegion *mr)
1680 {
1681     MemoryRegionSection section = {
1682         .mr = mr,
1683         .offset_within_address_space = 0,
1684         .offset_within_region = 0,
1685         .size = int128_2_64(),
1686     };
1687
1688     return phys_section_add(&section);
1689 }
1690
1691 MemoryRegion *iotlb_to_region(hwaddr index)
1692 {
1693     return address_space_memory.dispatch->sections[index & ~TARGET_PAGE_MASK].mr;
1694 }
1695
1696 static void io_mem_init(void)
1697 {
1698     memory_region_init_io(&io_mem_rom, NULL, &unassigned_mem_ops, NULL, "rom", UINT64_MAX);
1699     memory_region_init_io(&io_mem_unassigned, NULL, &unassigned_mem_ops, NULL,
1700                           "unassigned", UINT64_MAX);
1701     memory_region_init_io(&io_mem_notdirty, NULL, &notdirty_mem_ops, NULL,
1702                           "notdirty", UINT64_MAX);
1703     memory_region_init_io(&io_mem_watch, NULL, &watch_mem_ops, NULL,
1704                           "watch", UINT64_MAX);
1705 }
1706
1707 static void mem_begin(MemoryListener *listener)
1708 {
1709     AddressSpace *as = container_of(listener, AddressSpace, dispatch_listener);
1710     AddressSpaceDispatch *d = g_new(AddressSpaceDispatch, 1);
1711
1712     d->phys_map  = (PhysPageEntry) { .ptr = PHYS_MAP_NODE_NIL, .is_leaf = 0 };
1713     d->as = as;
1714     as->next_dispatch = d;
1715 }
1716
1717 static void mem_commit(MemoryListener *listener)
1718 {
1719     AddressSpace *as = container_of(listener, AddressSpace, dispatch_listener);
1720     AddressSpaceDispatch *cur = as->dispatch;
1721     AddressSpaceDispatch *next = as->next_dispatch;
1722
1723     next->nodes = next_map.nodes;
1724     next->sections = next_map.sections;
1725
1726     as->dispatch = next;
1727     g_free(cur);
1728 }
1729
1730 static void core_begin(MemoryListener *listener)
1731 {
1732     uint16_t n;
1733
1734     memset(&next_map, 0, sizeof(next_map));
1735     n = dummy_section(&io_mem_unassigned);
1736     assert(n == PHYS_SECTION_UNASSIGNED);
1737     n = dummy_section(&io_mem_notdirty);
1738     assert(n == PHYS_SECTION_NOTDIRTY);
1739     n = dummy_section(&io_mem_rom);
1740     assert(n == PHYS_SECTION_ROM);
1741     n = dummy_section(&io_mem_watch);
1742     assert(n == PHYS_SECTION_WATCH);
1743 }
1744
1745 /* This listener's commit run after the other AddressSpaceDispatch listeners'.
1746  * All AddressSpaceDispatch instances have switched to the next map.
1747  */
1748 static void core_commit(MemoryListener *listener)
1749 {
1750     PhysPageMap info = cur_map;
1751     cur_map = next_map;
1752     phys_sections_clear(&info);
1753 }
1754
1755 static void tcg_commit(MemoryListener *listener)
1756 {
1757     CPUArchState *env;
1758
1759     /* since each CPU stores ram addresses in its TLB cache, we must
1760        reset the modified entries */
1761     /* XXX: slow ! */
1762     for(env = first_cpu; env != NULL; env = env->next_cpu) {
1763         tlb_flush(env, 1);
1764     }
1765 }
1766
1767 static void core_log_global_start(MemoryListener *listener)
1768 {
1769     cpu_physical_memory_set_dirty_tracking(1);
1770 }
1771
1772 static void core_log_global_stop(MemoryListener *listener)
1773 {
1774     cpu_physical_memory_set_dirty_tracking(0);
1775 }
1776
1777 static MemoryListener core_memory_listener = {
1778     .begin = core_begin,
1779     .commit = core_commit,
1780     .log_global_start = core_log_global_start,
1781     .log_global_stop = core_log_global_stop,
1782     .priority = 1,
1783 };
1784
1785 static MemoryListener tcg_memory_listener = {
1786     .commit = tcg_commit,
1787 };
1788
1789 void address_space_init_dispatch(AddressSpace *as)
1790 {
1791     as->dispatch = NULL;
1792     as->dispatch_listener = (MemoryListener) {
1793         .begin = mem_begin,
1794         .commit = mem_commit,
1795         .region_add = mem_add,
1796         .region_nop = mem_add,
1797         .priority = 0,
1798     };
1799     memory_listener_register(&as->dispatch_listener, as);
1800 }
1801
1802 void address_space_destroy_dispatch(AddressSpace *as)
1803 {
1804     AddressSpaceDispatch *d = as->dispatch;
1805
1806     memory_listener_unregister(&as->dispatch_listener);
1807     g_free(d);
1808     as->dispatch = NULL;
1809 }
1810
1811 static void memory_map_init(void)
1812 {
1813     system_memory = g_malloc(sizeof(*system_memory));
1814     memory_region_init(system_memory, NULL, "system", INT64_MAX);
1815     address_space_init(&address_space_memory, system_memory, "memory");
1816
1817     system_io = g_malloc(sizeof(*system_io));
1818     memory_region_init(system_io, NULL, "io", 65536);
1819     address_space_init(&address_space_io, system_io, "I/O");
1820
1821     memory_listener_register(&core_memory_listener, &address_space_memory);
1822     memory_listener_register(&tcg_memory_listener, &address_space_memory);
1823 }
1824
1825 MemoryRegion *get_system_memory(void)
1826 {
1827     return system_memory;
1828 }
1829
1830 MemoryRegion *get_system_io(void)
1831 {
1832     return system_io;
1833 }
1834
1835 #endif /* !defined(CONFIG_USER_ONLY) */
1836
1837 /* physical memory access (slow version, mainly for debug) */
1838 #if defined(CONFIG_USER_ONLY)
1839 int cpu_memory_rw_debug(CPUArchState *env, target_ulong addr,
1840                         uint8_t *buf, int len, int is_write)
1841 {
1842     int l, flags;
1843     target_ulong page;
1844     void * p;
1845
1846     while (len > 0) {
1847         page = addr & TARGET_PAGE_MASK;
1848         l = (page + TARGET_PAGE_SIZE) - addr;
1849         if (l > len)
1850             l = len;
1851         flags = page_get_flags(page);
1852         if (!(flags & PAGE_VALID))
1853             return -1;
1854         if (is_write) {
1855             if (!(flags & PAGE_WRITE))
1856                 return -1;
1857             /* XXX: this code should not depend on lock_user */
1858             if (!(p = lock_user(VERIFY_WRITE, addr, l, 0)))
1859                 return -1;
1860             memcpy(p, buf, l);
1861             unlock_user(p, addr, l);
1862         } else {
1863             if (!(flags & PAGE_READ))
1864                 return -1;
1865             /* XXX: this code should not depend on lock_user */
1866             if (!(p = lock_user(VERIFY_READ, addr, l, 1)))
1867                 return -1;
1868             memcpy(buf, p, l);
1869             unlock_user(p, addr, 0);
1870         }
1871         len -= l;
1872         buf += l;
1873         addr += l;
1874     }
1875     return 0;
1876 }
1877
1878 #else
1879
1880 static void invalidate_and_set_dirty(hwaddr addr,
1881                                      hwaddr length)
1882 {
1883     if (!cpu_physical_memory_is_dirty(addr)) {
1884         /* invalidate code */
1885         tb_invalidate_phys_page_range(addr, addr + length, 0);
1886         /* set dirty bit */
1887         cpu_physical_memory_set_dirty_flags(addr, (0xff & ~CODE_DIRTY_FLAG));
1888     }
1889     xen_modified_memory(addr, length);
1890 }
1891
1892 static inline bool memory_access_is_direct(MemoryRegion *mr, bool is_write)
1893 {
1894     if (memory_region_is_ram(mr)) {
1895         return !(is_write && mr->readonly);
1896     }
1897     if (memory_region_is_romd(mr)) {
1898         return !is_write;
1899     }
1900
1901     return false;
1902 }
1903
1904 static inline int memory_access_size(MemoryRegion *mr, int l, hwaddr addr)
1905 {
1906     if (l >= 4 && (((addr & 3) == 0 || mr->ops->impl.unaligned))) {
1907         return 4;
1908     }
1909     if (l >= 2 && (((addr & 1) == 0) || mr->ops->impl.unaligned)) {
1910         return 2;
1911     }
1912     return 1;
1913 }
1914
1915 bool address_space_rw(AddressSpace *as, hwaddr addr, uint8_t *buf,
1916                       int len, bool is_write)
1917 {
1918     hwaddr l;
1919     uint8_t *ptr;
1920     uint64_t val;
1921     hwaddr addr1;
1922     MemoryRegion *mr;
1923     bool error = false;
1924
1925     while (len > 0) {
1926         l = len;
1927         mr = address_space_translate(as, addr, &addr1, &l, is_write);
1928
1929         if (is_write) {
1930             if (!memory_access_is_direct(mr, is_write)) {
1931                 l = memory_access_size(mr, l, addr1);
1932                 /* XXX: could force cpu_single_env to NULL to avoid
1933                    potential bugs */
1934                 if (l == 4) {
1935                     /* 32 bit write access */
1936                     val = ldl_p(buf);
1937                     error |= io_mem_write(mr, addr1, val, 4);
1938                 } else if (l == 2) {
1939                     /* 16 bit write access */
1940                     val = lduw_p(buf);
1941                     error |= io_mem_write(mr, addr1, val, 2);
1942                 } else {
1943                     /* 8 bit write access */
1944                     val = ldub_p(buf);
1945                     error |= io_mem_write(mr, addr1, val, 1);
1946                 }
1947             } else {
1948                 addr1 += memory_region_get_ram_addr(mr);
1949                 /* RAM case */
1950                 ptr = qemu_get_ram_ptr(addr1);
1951                 memcpy(ptr, buf, l);
1952                 invalidate_and_set_dirty(addr1, l);
1953             }
1954         } else {
1955             if (!memory_access_is_direct(mr, is_write)) {
1956                 /* I/O case */
1957                 l = memory_access_size(mr, l, addr1);
1958                 if (l == 4) {
1959                     /* 32 bit read access */
1960                     error |= io_mem_read(mr, addr1, &val, 4);
1961                     stl_p(buf, val);
1962                 } else if (l == 2) {
1963                     /* 16 bit read access */
1964                     error |= io_mem_read(mr, addr1, &val, 2);
1965                     stw_p(buf, val);
1966                 } else {
1967                     /* 8 bit read access */
1968                     error |= io_mem_read(mr, addr1, &val, 1);
1969                     stb_p(buf, val);
1970                 }
1971             } else {
1972                 /* RAM case */
1973                 ptr = qemu_get_ram_ptr(mr->ram_addr + addr1);
1974                 memcpy(buf, ptr, l);
1975             }
1976         }
1977         len -= l;
1978         buf += l;
1979         addr += l;
1980     }
1981
1982     return error;
1983 }
1984
1985 bool address_space_write(AddressSpace *as, hwaddr addr,
1986                          const uint8_t *buf, int len)
1987 {
1988     return address_space_rw(as, addr, (uint8_t *)buf, len, true);
1989 }
1990
1991 bool address_space_read(AddressSpace *as, hwaddr addr, uint8_t *buf, int len)
1992 {
1993     return address_space_rw(as, addr, buf, len, false);
1994 }
1995
1996
1997 void cpu_physical_memory_rw(hwaddr addr, uint8_t *buf,
1998                             int len, int is_write)
1999 {
2000     address_space_rw(&address_space_memory, addr, buf, len, is_write);
2001 }
2002
2003 /* used for ROM loading : can write in RAM and ROM */
2004 void cpu_physical_memory_write_rom(hwaddr addr,
2005                                    const uint8_t *buf, int len)
2006 {
2007     hwaddr l;
2008     uint8_t *ptr;
2009     hwaddr addr1;
2010     MemoryRegion *mr;
2011
2012     while (len > 0) {
2013         l = len;
2014         mr = address_space_translate(&address_space_memory,
2015                                      addr, &addr1, &l, true);
2016
2017         if (!(memory_region_is_ram(mr) ||
2018               memory_region_is_romd(mr))) {
2019             /* do nothing */
2020         } else {
2021             addr1 += memory_region_get_ram_addr(mr);
2022             /* ROM/RAM case */
2023             ptr = qemu_get_ram_ptr(addr1);
2024             memcpy(ptr, buf, l);
2025             invalidate_and_set_dirty(addr1, l);
2026         }
2027         len -= l;
2028         buf += l;
2029         addr += l;
2030     }
2031 }
2032
2033 typedef struct {
2034     MemoryRegion *mr;
2035     void *buffer;
2036     hwaddr addr;
2037     hwaddr len;
2038 } BounceBuffer;
2039
2040 static BounceBuffer bounce;
2041
2042 typedef struct MapClient {
2043     void *opaque;
2044     void (*callback)(void *opaque);
2045     QLIST_ENTRY(MapClient) link;
2046 } MapClient;
2047
2048 static QLIST_HEAD(map_client_list, MapClient) map_client_list
2049     = QLIST_HEAD_INITIALIZER(map_client_list);
2050
2051 void *cpu_register_map_client(void *opaque, void (*callback)(void *opaque))
2052 {
2053     MapClient *client = g_malloc(sizeof(*client));
2054
2055     client->opaque = opaque;
2056     client->callback = callback;
2057     QLIST_INSERT_HEAD(&map_client_list, client, link);
2058     return client;
2059 }
2060
2061 static void cpu_unregister_map_client(void *_client)
2062 {
2063     MapClient *client = (MapClient *)_client;
2064
2065     QLIST_REMOVE(client, link);
2066     g_free(client);
2067 }
2068
2069 static void cpu_notify_map_clients(void)
2070 {
2071     MapClient *client;
2072
2073     while (!QLIST_EMPTY(&map_client_list)) {
2074         client = QLIST_FIRST(&map_client_list);
2075         client->callback(client->opaque);
2076         cpu_unregister_map_client(client);
2077     }
2078 }
2079
2080 bool address_space_access_valid(AddressSpace *as, hwaddr addr, int len, bool is_write)
2081 {
2082     MemoryRegion *mr;
2083     hwaddr l, xlat;
2084
2085     while (len > 0) {
2086         l = len;
2087         mr = address_space_translate(as, addr, &xlat, &l, is_write);
2088         if (!memory_access_is_direct(mr, is_write)) {
2089             l = memory_access_size(mr, l, addr);
2090             if (!memory_region_access_valid(mr, xlat, l, is_write)) {
2091                 return false;
2092             }
2093         }
2094
2095         len -= l;
2096         addr += l;
2097     }
2098     return true;
2099 }
2100
2101 /* Map a physical memory region into a host virtual address.
2102  * May map a subset of the requested range, given by and returned in *plen.
2103  * May return NULL if resources needed to perform the mapping are exhausted.
2104  * Use only for reads OR writes - not for read-modify-write operations.
2105  * Use cpu_register_map_client() to know when retrying the map operation is
2106  * likely to succeed.
2107  */
2108 void *address_space_map(AddressSpace *as,
2109                         hwaddr addr,
2110                         hwaddr *plen,
2111                         bool is_write)
2112 {
2113     hwaddr len = *plen;
2114     hwaddr done = 0;
2115     hwaddr l, xlat, base;
2116     MemoryRegion *mr, *this_mr;
2117     ram_addr_t raddr;
2118
2119     if (len == 0) {
2120         return NULL;
2121     }
2122
2123     l = len;
2124     mr = address_space_translate(as, addr, &xlat, &l, is_write);
2125     if (!memory_access_is_direct(mr, is_write)) {
2126         if (bounce.buffer) {
2127             return NULL;
2128         }
2129         bounce.buffer = qemu_memalign(TARGET_PAGE_SIZE, TARGET_PAGE_SIZE);
2130         bounce.addr = addr;
2131         bounce.len = l;
2132
2133         memory_region_ref(mr);
2134         bounce.mr = mr;
2135         if (!is_write) {
2136             address_space_read(as, addr, bounce.buffer, l);
2137         }
2138
2139         *plen = l;
2140         return bounce.buffer;
2141     }
2142
2143     base = xlat;
2144     raddr = memory_region_get_ram_addr(mr);
2145
2146     for (;;) {
2147         len -= l;
2148         addr += l;
2149         done += l;
2150         if (len == 0) {
2151             break;
2152         }
2153
2154         l = len;
2155         this_mr = address_space_translate(as, addr, &xlat, &l, is_write);
2156         if (this_mr != mr || xlat != base + done) {
2157             break;
2158         }
2159     }
2160
2161     memory_region_ref(mr);
2162     *plen = done;
2163     return qemu_ram_ptr_length(raddr + base, plen);
2164 }
2165
2166 /* Unmaps a memory region previously mapped by address_space_map().
2167  * Will also mark the memory as dirty if is_write == 1.  access_len gives
2168  * the amount of memory that was actually read or written by the caller.
2169  */
2170 void address_space_unmap(AddressSpace *as, void *buffer, hwaddr len,
2171                          int is_write, hwaddr access_len)
2172 {
2173     if (buffer != bounce.buffer) {
2174         MemoryRegion *mr;
2175         ram_addr_t addr1;
2176
2177         mr = qemu_ram_addr_from_host(buffer, &addr1);
2178         assert(mr != NULL);
2179         if (is_write) {
2180             while (access_len) {
2181                 unsigned l;
2182                 l = TARGET_PAGE_SIZE;
2183                 if (l > access_len)
2184                     l = access_len;
2185                 invalidate_and_set_dirty(addr1, l);
2186                 addr1 += l;
2187                 access_len -= l;
2188             }
2189         }
2190         if (xen_enabled()) {
2191             xen_invalidate_map_cache_entry(buffer);
2192         }
2193         memory_region_unref(mr);
2194         return;
2195     }
2196     if (is_write) {
2197         address_space_write(as, bounce.addr, bounce.buffer, access_len);
2198     }
2199     qemu_vfree(bounce.buffer);
2200     bounce.buffer = NULL;
2201     memory_region_unref(bounce.mr);
2202     cpu_notify_map_clients();
2203 }
2204
2205 void *cpu_physical_memory_map(hwaddr addr,
2206                               hwaddr *plen,
2207                               int is_write)
2208 {
2209     return address_space_map(&address_space_memory, addr, plen, is_write);
2210 }
2211
2212 void cpu_physical_memory_unmap(void *buffer, hwaddr len,
2213                                int is_write, hwaddr access_len)
2214 {
2215     return address_space_unmap(&address_space_memory, buffer, len, is_write, access_len);
2216 }
2217
2218 /* warning: addr must be aligned */
2219 static inline uint32_t ldl_phys_internal(hwaddr addr,
2220                                          enum device_endian endian)
2221 {
2222     uint8_t *ptr;
2223     uint64_t val;
2224     MemoryRegion *mr;
2225     hwaddr l = 4;
2226     hwaddr addr1;
2227
2228     mr = address_space_translate(&address_space_memory, addr, &addr1, &l,
2229                                  false);
2230     if (l < 4 || !memory_access_is_direct(mr, false)) {
2231         /* I/O case */
2232         io_mem_read(mr, addr1, &val, 4);
2233 #if defined(TARGET_WORDS_BIGENDIAN)
2234         if (endian == DEVICE_LITTLE_ENDIAN) {
2235             val = bswap32(val);
2236         }
2237 #else
2238         if (endian == DEVICE_BIG_ENDIAN) {
2239             val = bswap32(val);
2240         }
2241 #endif
2242     } else {
2243         /* RAM case */
2244         ptr = qemu_get_ram_ptr((memory_region_get_ram_addr(mr)
2245                                 & TARGET_PAGE_MASK)
2246                                + addr1);
2247         switch (endian) {
2248         case DEVICE_LITTLE_ENDIAN:
2249             val = ldl_le_p(ptr);
2250             break;
2251         case DEVICE_BIG_ENDIAN:
2252             val = ldl_be_p(ptr);
2253             break;
2254         default:
2255             val = ldl_p(ptr);
2256             break;
2257         }
2258     }
2259     return val;
2260 }
2261
2262 uint32_t ldl_phys(hwaddr addr)
2263 {
2264     return ldl_phys_internal(addr, DEVICE_NATIVE_ENDIAN);
2265 }
2266
2267 uint32_t ldl_le_phys(hwaddr addr)
2268 {
2269     return ldl_phys_internal(addr, DEVICE_LITTLE_ENDIAN);
2270 }
2271
2272 uint32_t ldl_be_phys(hwaddr addr)
2273 {
2274     return ldl_phys_internal(addr, DEVICE_BIG_ENDIAN);
2275 }
2276
2277 /* warning: addr must be aligned */
2278 static inline uint64_t ldq_phys_internal(hwaddr addr,
2279                                          enum device_endian endian)
2280 {
2281     uint8_t *ptr;
2282     uint64_t val;
2283     MemoryRegion *mr;
2284     hwaddr l = 8;
2285     hwaddr addr1;
2286
2287     mr = address_space_translate(&address_space_memory, addr, &addr1, &l,
2288                                  false);
2289     if (l < 8 || !memory_access_is_direct(mr, false)) {
2290         /* I/O case */
2291         io_mem_read(mr, addr1, &val, 8);
2292 #if defined(TARGET_WORDS_BIGENDIAN)
2293         if (endian == DEVICE_LITTLE_ENDIAN) {
2294             val = bswap64(val);
2295         }
2296 #else
2297         if (endian == DEVICE_BIG_ENDIAN) {
2298             val = bswap64(val);
2299         }
2300 #endif
2301     } else {
2302         /* RAM case */
2303         ptr = qemu_get_ram_ptr((memory_region_get_ram_addr(mr)
2304                                 & TARGET_PAGE_MASK)
2305                                + addr1);
2306         switch (endian) {
2307         case DEVICE_LITTLE_ENDIAN:
2308             val = ldq_le_p(ptr);
2309             break;
2310         case DEVICE_BIG_ENDIAN:
2311             val = ldq_be_p(ptr);
2312             break;
2313         default:
2314             val = ldq_p(ptr);
2315             break;
2316         }
2317     }
2318     return val;
2319 }
2320
2321 uint64_t ldq_phys(hwaddr addr)
2322 {
2323     return ldq_phys_internal(addr, DEVICE_NATIVE_ENDIAN);
2324 }
2325
2326 uint64_t ldq_le_phys(hwaddr addr)
2327 {
2328     return ldq_phys_internal(addr, DEVICE_LITTLE_ENDIAN);
2329 }
2330
2331 uint64_t ldq_be_phys(hwaddr addr)
2332 {
2333     return ldq_phys_internal(addr, DEVICE_BIG_ENDIAN);
2334 }
2335
2336 /* XXX: optimize */
2337 uint32_t ldub_phys(hwaddr addr)
2338 {
2339     uint8_t val;
2340     cpu_physical_memory_read(addr, &val, 1);
2341     return val;
2342 }
2343
2344 /* warning: addr must be aligned */
2345 static inline uint32_t lduw_phys_internal(hwaddr addr,
2346                                           enum device_endian endian)
2347 {
2348     uint8_t *ptr;
2349     uint64_t val;
2350     MemoryRegion *mr;
2351     hwaddr l = 2;
2352     hwaddr addr1;
2353
2354     mr = address_space_translate(&address_space_memory, addr, &addr1, &l,
2355                                  false);
2356     if (l < 2 || !memory_access_is_direct(mr, false)) {
2357         /* I/O case */
2358         io_mem_read(mr, addr1, &val, 2);
2359 #if defined(TARGET_WORDS_BIGENDIAN)
2360         if (endian == DEVICE_LITTLE_ENDIAN) {
2361             val = bswap16(val);
2362         }
2363 #else
2364         if (endian == DEVICE_BIG_ENDIAN) {
2365             val = bswap16(val);
2366         }
2367 #endif
2368     } else {
2369         /* RAM case */
2370         ptr = qemu_get_ram_ptr((memory_region_get_ram_addr(mr)
2371                                 & TARGET_PAGE_MASK)
2372                                + addr1);
2373         switch (endian) {
2374         case DEVICE_LITTLE_ENDIAN:
2375             val = lduw_le_p(ptr);
2376             break;
2377         case DEVICE_BIG_ENDIAN:
2378             val = lduw_be_p(ptr);
2379             break;
2380         default:
2381             val = lduw_p(ptr);
2382             break;
2383         }
2384     }
2385     return val;
2386 }
2387
2388 uint32_t lduw_phys(hwaddr addr)
2389 {
2390     return lduw_phys_internal(addr, DEVICE_NATIVE_ENDIAN);
2391 }
2392
2393 uint32_t lduw_le_phys(hwaddr addr)
2394 {
2395     return lduw_phys_internal(addr, DEVICE_LITTLE_ENDIAN);
2396 }
2397
2398 uint32_t lduw_be_phys(hwaddr addr)
2399 {
2400     return lduw_phys_internal(addr, DEVICE_BIG_ENDIAN);
2401 }
2402
2403 /* warning: addr must be aligned. The ram page is not masked as dirty
2404    and the code inside is not invalidated. It is useful if the dirty
2405    bits are used to track modified PTEs */
2406 void stl_phys_notdirty(hwaddr addr, uint32_t val)
2407 {
2408     uint8_t *ptr;
2409     MemoryRegion *mr;
2410     hwaddr l = 4;
2411     hwaddr addr1;
2412
2413     mr = address_space_translate(&address_space_memory, addr, &addr1, &l,
2414                                  true);
2415     if (l < 4 || !memory_access_is_direct(mr, true)) {
2416         io_mem_write(mr, addr1, val, 4);
2417     } else {
2418         addr1 += memory_region_get_ram_addr(mr) & TARGET_PAGE_MASK;
2419         ptr = qemu_get_ram_ptr(addr1);
2420         stl_p(ptr, val);
2421
2422         if (unlikely(in_migration)) {
2423             if (!cpu_physical_memory_is_dirty(addr1)) {
2424                 /* invalidate code */
2425                 tb_invalidate_phys_page_range(addr1, addr1 + 4, 0);
2426                 /* set dirty bit */
2427                 cpu_physical_memory_set_dirty_flags(
2428                     addr1, (0xff & ~CODE_DIRTY_FLAG));
2429             }
2430         }
2431     }
2432 }
2433
2434 /* warning: addr must be aligned */
2435 static inline void stl_phys_internal(hwaddr addr, uint32_t val,
2436                                      enum device_endian endian)
2437 {
2438     uint8_t *ptr;
2439     MemoryRegion *mr;
2440     hwaddr l = 4;
2441     hwaddr addr1;
2442
2443     mr = address_space_translate(&address_space_memory, addr, &addr1, &l,
2444                                  true);
2445     if (l < 4 || !memory_access_is_direct(mr, true)) {
2446 #if defined(TARGET_WORDS_BIGENDIAN)
2447         if (endian == DEVICE_LITTLE_ENDIAN) {
2448             val = bswap32(val);
2449         }
2450 #else
2451         if (endian == DEVICE_BIG_ENDIAN) {
2452             val = bswap32(val);
2453         }
2454 #endif
2455         io_mem_write(mr, addr1, val, 4);
2456     } else {
2457         /* RAM case */
2458         addr1 += memory_region_get_ram_addr(mr) & TARGET_PAGE_MASK;
2459         ptr = qemu_get_ram_ptr(addr1);
2460         switch (endian) {
2461         case DEVICE_LITTLE_ENDIAN:
2462             stl_le_p(ptr, val);
2463             break;
2464         case DEVICE_BIG_ENDIAN:
2465             stl_be_p(ptr, val);
2466             break;
2467         default:
2468             stl_p(ptr, val);
2469             break;
2470         }
2471         invalidate_and_set_dirty(addr1, 4);
2472     }
2473 }
2474
2475 void stl_phys(hwaddr addr, uint32_t val)
2476 {
2477     stl_phys_internal(addr, val, DEVICE_NATIVE_ENDIAN);
2478 }
2479
2480 void stl_le_phys(hwaddr addr, uint32_t val)
2481 {
2482     stl_phys_internal(addr, val, DEVICE_LITTLE_ENDIAN);
2483 }
2484
2485 void stl_be_phys(hwaddr addr, uint32_t val)
2486 {
2487     stl_phys_internal(addr, val, DEVICE_BIG_ENDIAN);
2488 }
2489
2490 /* XXX: optimize */
2491 void stb_phys(hwaddr addr, uint32_t val)
2492 {
2493     uint8_t v = val;
2494     cpu_physical_memory_write(addr, &v, 1);
2495 }
2496
2497 /* warning: addr must be aligned */
2498 static inline void stw_phys_internal(hwaddr addr, uint32_t val,
2499                                      enum device_endian endian)
2500 {
2501     uint8_t *ptr;
2502     MemoryRegion *mr;
2503     hwaddr l = 2;
2504     hwaddr addr1;
2505
2506     mr = address_space_translate(&address_space_memory, addr, &addr1, &l,
2507                                  true);
2508     if (l < 2 || !memory_access_is_direct(mr, true)) {
2509 #if defined(TARGET_WORDS_BIGENDIAN)
2510         if (endian == DEVICE_LITTLE_ENDIAN) {
2511             val = bswap16(val);
2512         }
2513 #else
2514         if (endian == DEVICE_BIG_ENDIAN) {
2515             val = bswap16(val);
2516         }
2517 #endif
2518         io_mem_write(mr, addr1, val, 2);
2519     } else {
2520         /* RAM case */
2521         addr1 += memory_region_get_ram_addr(mr) & TARGET_PAGE_MASK;
2522         ptr = qemu_get_ram_ptr(addr1);
2523         switch (endian) {
2524         case DEVICE_LITTLE_ENDIAN:
2525             stw_le_p(ptr, val);
2526             break;
2527         case DEVICE_BIG_ENDIAN:
2528             stw_be_p(ptr, val);
2529             break;
2530         default:
2531             stw_p(ptr, val);
2532             break;
2533         }
2534         invalidate_and_set_dirty(addr1, 2);
2535     }
2536 }
2537
2538 void stw_phys(hwaddr addr, uint32_t val)
2539 {
2540     stw_phys_internal(addr, val, DEVICE_NATIVE_ENDIAN);
2541 }
2542
2543 void stw_le_phys(hwaddr addr, uint32_t val)
2544 {
2545     stw_phys_internal(addr, val, DEVICE_LITTLE_ENDIAN);
2546 }
2547
2548 void stw_be_phys(hwaddr addr, uint32_t val)
2549 {
2550     stw_phys_internal(addr, val, DEVICE_BIG_ENDIAN);
2551 }
2552
2553 /* XXX: optimize */
2554 void stq_phys(hwaddr addr, uint64_t val)
2555 {
2556     val = tswap64(val);
2557     cpu_physical_memory_write(addr, &val, 8);
2558 }
2559
2560 void stq_le_phys(hwaddr addr, uint64_t val)
2561 {
2562     val = cpu_to_le64(val);
2563     cpu_physical_memory_write(addr, &val, 8);
2564 }
2565
2566 void stq_be_phys(hwaddr addr, uint64_t val)
2567 {
2568     val = cpu_to_be64(val);
2569     cpu_physical_memory_write(addr, &val, 8);
2570 }
2571
2572 /* virtual memory access for debug (includes writing to ROM) */
2573 int cpu_memory_rw_debug(CPUArchState *env, target_ulong addr,
2574                         uint8_t *buf, int len, int is_write)
2575 {
2576     int l;
2577     hwaddr phys_addr;
2578     target_ulong page;
2579
2580     while (len > 0) {
2581         page = addr & TARGET_PAGE_MASK;
2582         phys_addr = cpu_get_phys_page_debug(env, page);
2583         /* if no physical page mapped, return an error */
2584         if (phys_addr == -1)
2585             return -1;
2586         l = (page + TARGET_PAGE_SIZE) - addr;
2587         if (l > len)
2588             l = len;
2589         phys_addr += (addr & ~TARGET_PAGE_MASK);
2590         if (is_write)
2591             cpu_physical_memory_write_rom(phys_addr, buf, l);
2592         else
2593             cpu_physical_memory_rw(phys_addr, buf, l, is_write);
2594         len -= l;
2595         buf += l;
2596         addr += l;
2597     }
2598     return 0;
2599 }
2600 #endif
2601
2602 #if !defined(CONFIG_USER_ONLY)
2603
2604 /*
2605  * A helper function for the _utterly broken_ virtio device model to find out if
2606  * it's running on a big endian machine. Don't do this at home kids!
2607  */
2608 bool virtio_is_big_endian(void);
2609 bool virtio_is_big_endian(void)
2610 {
2611 #if defined(TARGET_WORDS_BIGENDIAN)
2612     return true;
2613 #else
2614     return false;
2615 #endif
2616 }
2617
2618 #endif
2619
2620 #ifndef CONFIG_USER_ONLY
2621 bool cpu_physical_memory_is_io(hwaddr phys_addr)
2622 {
2623     MemoryRegion*mr;
2624     hwaddr l = 1;
2625
2626     mr = address_space_translate(&address_space_memory,
2627                                  phys_addr, &phys_addr, &l, false);
2628
2629     return !(memory_region_is_ram(mr) ||
2630              memory_region_is_romd(mr));
2631 }
2632
2633 void qemu_ram_foreach_block(RAMBlockIterFunc func, void *opaque)
2634 {
2635     RAMBlock *block;
2636
2637     QTAILQ_FOREACH(block, &ram_list.blocks, next) {
2638         func(block->host, block->offset, block->length, opaque);
2639     }
2640 }
2641 #endif