We are using the same struct name for two devices.  8250 is widespread
enough that this causes some confusion, rename the other instance.
Reviewed-by: NAndreas Faerber <afaerber@suse.de>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

The iothread mutex might be released between map and unmap, so the
mapped region might disappear.
Reviewed-by: NJan Kiszka <jan.kiszka@siemens.com>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

First of all, rename "todo" to "done".

Second, clearly separate the case of done == 0 with the case of done != 0.
This will help handling reference counting in the next patch.

Third, this test:

             if (memory_region_get_ram_addr(mr) + xlat != raddr + todo) {

does not guarantee that the memory region is the same across two iterations
of the while loop.  For example, you could have two blocks:

A) size 640 K, mapped at physical address 0, ram_addr_t 0
B) size 64 K, mapped at physical address 0xa0000, ram_addr_t 0xa0000

then mapping 1 M starting at physical address zero will erroneously treat
B as the continuation of block A.  qemu_ram_ptr_length ensures that no
invalid memory is accessed, but it is still a pointless complication of
the algorithm.  The patch makes the logic clearer with an explicit test
that the memory region is the same.
Reviewed-by: NJan Kiszka <jan.kiszka@siemens.com>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

It will be needed in the next patch.
Reviewed-by: NJan Kiszka <jan.kiszka@siemens.com>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

After the next patch it would not be used elsewhere anyway.  Also,
the _nofail and the standard versions of this function return different
things, which is confusing.  Removing the function from the public headers
limits the confusion.
Reviewed-by: NJan Kiszka <jan.kiszka@siemens.com>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

This function is not used outside the iothread mutex, so it
can use ram_list.mru_block.
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

Add ref/unref calls at the following places:

- places where memory regions are stashed by a listener and
  used outside the BQL (including in Xen or KVM).

- memory_region_find callsites

- creation of aliases and containers (only the aliased/contained
  region gets a reference to avoid loops)

- around calls to del_subregion/add_subregion, where the region
  could disappear after the first call
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

This new API will avoid having too many memory_region_ref/unref
in paths that currently use memory_region_find.
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

Reviewed-by: NJan Kiszka <jan.kiszka@siemens.com>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

Whenever memory regions are accessed outside the BQL, they need to be
preserved against hot-unplug.  MemoryRegions actually do not have their
own reference count; they piggyback on a QOM object, their "owner".
The owner is set at creation time, and there is a function to retrieve
the owner.
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

Do not bother visiting the radix tree when an address space is destroyed.
After the previous patch, this has become a pointless exercise.  When
called from address_space_destroy_dispatch, all you're doing is zeroing
out a structure that will be freed as soon as you come back.  When called
from mem_begin, when phys_page_set_level will call phys_map_node_alloc the
radix tree's array will be zeroed too.
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

phys_sections_clear is invoked after the dispatch tree has been
destroyed.  This leaves a window where phys_sections_nb > 0 but the
subpages are not valid anymore, which is a recipe for use-after-free
bugs.

Move the destruction of subpages in phys_sections_clear.  We will
still destroy the subpages when an address space is cleaned up,
because address_space_destroy will clear as->root and commit the
change before it calls address_space_destroy_dispatch.
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

This decouples memory.h from ioport.h, concentrating all portio related
types in a single header.
Signed-off-by: NJan Kiszka <jan.kiszka@siemens.com>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

In case the latter may vanish one day, make sure the vmport read handler
type will remain unaffected. This is also conceptually cleaner.
Signed-off-by: NJan Kiszka <jan.kiszka@siemens.com>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

Remove unused ioport_register and isa_unassign_ioport along with
everything that only those services used.
Signed-off-by: NJan Kiszka <jan.kiszka@siemens.com>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

The current ioport dispatcher is a complex beast, mostly due to the
need to deal with old portio interface users. But we can overcome it
without converting all portio users by embedding the required base
address of a MemoryRegionPortio access into that data structure. That
removes the need to have the additional MemoryRegionIORange structure
in the loop on every access.

To handle old portio memory ops, we simply install dispatching handlers
for portio memory regions when registering them with the memory core.
This removes the need for the old_portio field.

We can drop the additional aliasing of ioport regions and also the
special address space listener. cpu_in and cpu_out now simply call
address_space_read/write. And we can concentrate portio handling in a
single source file.
Signed-off-by: NJan Kiszka <jan.kiszka@siemens.com>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

Before switching to the memory core dispatcher, we need to make sure
that this pv-device will continue to receive unaligned portio accesses.
Signed-off-by: NJan Kiszka <jan.kiszka@siemens.com>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

Before switching to the memory core dispatcher, we need to make sure
that this pv-device will continue to receive unaligned portio accesses.
Signed-off-by: NJan Kiszka <jan.kiszka@siemens.com>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

Open-code isa_is_ioport_assigned via a memory region lookup. As all IO
ports are now directly or indirectly registered via the memory API, this
becomes possible and will finally allow us to drop the ioport tables.
Signed-off-by: NJan Kiszka <jan.kiszka@siemens.com>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

No more users outside of ioport.c.
Signed-off-by: NJan Kiszka <jan.kiszka@siemens.com>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

Convert over to memory regions to obsolete register_ioport*.
Signed-off-by: NJan Kiszka <jan.kiszka@siemens.com>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

Convert over to memory regions to obsolete register_ioport*.
Signed-off-by: NJan Kiszka <jan.kiszka@siemens.com>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

Convert over to memory regions to obsolete register_ioport*.
Signed-off-by: NJan Kiszka <jan.kiszka@siemens.com>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

Convert over to memory regions to obsolete register_ioport*.
Signed-off-by: NJan Kiszka <jan.kiszka@siemens.com>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

Convert over to memory regions to obsolete register_ioport*.
Signed-off-by: NJan Kiszka <jan.kiszka@siemens.com>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

Convert over to memory regions to obsolete register_ioport*.

CC: malc <av1474@comtv.ru>
Signed-off-by: NJan Kiszka <jan.kiszka@siemens.com>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

Reviewed-by: NAnthony Liguori <aliguori@redhat.com>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

Reviewed-by: NAnthony Liguori <aliguori@us.ibm.com>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

For add, the carry only requires checking one of the arguments.
For sub and neg, we can similarly optimize computation of the
carry.

For ge, we can just do lexicographic order.
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

# By Alexander Graf (12) and others
# Via Alexander Graf
* agraf/ppc-for-upstream: (32 commits)
  PPC: Ignore writes to L2CR
  mac-io: Add escc-legacy memory alias region
  PPC: Newworld: Add second uninorth control register set
  PPC: Newworld: Add uninorth token register
  PPC: Add clock-frequency export for Mac machines
  PPC: Introduce an alias cache for faster lookups
  PPC: Fix GDB read on code area for PPC6xx
  PPC: Add dump_mmu() for 6xx
  target-ppc: Introduce unrealizefn for PowerPCCPU
  booke_ppc: limit booke timer to max when timeout overflow
  Graphics: Switch to 800x600x32 as default mode
  pseries: Update MAINTAINERS information
  target-ppc kvm: save cr register
  pseries: Fix compiler warning (conversion of pointer to integral value)
  spapr-rtas: add CPU argument to RTAS calls
  target-ppc: Change default machine for 64-bit
  ppc: do not register IABR SPR twice for 603e
  target-ppc: Drop redundant flags assignments from CPU families
  mpc8544_guts: Turn qdev initfn into instance_init
  mpc8544_guts: QOM'ify
  ...

Message-id: 1372556709-23868-1-git-send-email-agraf@suse.de
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

# By Cornelia Huck
# Via Cornelia Huck
* cohuck/virtio-ccw-upstr:
  virtio-ccw: fix build breakage on windows

Message-id: 1372669523-4039-1-git-send-email-cornelia.huck@de.ibm.com
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

# By Kevin Wolf
# Via Luiz Capitulino
* luiz/queue/qmp:
  hmp: Make "info block" output more readable

Message-id: 1372452199-23237-1-git-send-email-lcapitulino@redhat.com
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

event_notifier_get_fd() is not available on windows hosts. Fix this by
moving the calls to event_notifier_get_fd() to the kvm code.
Reported-by: NStefan Weil <sw@weilnetz.de>
Reviewed-by: NPaolo Bonzini <pbonzini@redhat.com>
Signed-off-by: NCornelia Huck <cornelia.huck@de.ibm.com>

The L2CR register contains a number of bits that either impose configuration
which we can't deal with or mean "something is in progress until the bit is
0 again".

Since we don't model the former and we do want to accomodate guests using the
latter semantics, let's just ignore writes to L2CR. That way guests always read
back 0 and are usually happy with that.
Signed-off-by: NAlexander Graf <agraf@suse.de>

Mac OS X's debugging serial driver accesses the ESCC through a different
register layout, called "escc-legacy". This layout differs from the normal
escc register layout purely by the location of the respective registers.

This patch adds a memory alias region that takes normal escc registers and
maps them into the escc-legacy register space.

With this patch applied, a Mac OS X guest successfully emits debug output
on the serial port when run with debug parameters set, for example by running:

  $ qemu-system-ppc -prom-env -'boot-args=-v debug=0x8 io=0xff serial=0x3' \
                    -cdrom 10.4.iso -boot d
Signed-off-by: NAlexander Graf <agraf@suse.de>

Mac OS X requires a second uninorth register set to be mapped a few
bytes above the first one. Let's just expose it to make it happy.
Signed-off-by: NAlexander Graf <agraf@suse.de>

Mac OS X expects the uninorth control register set to contain one
register that always reads back what it writes in. Expose that.

This is just a temporary hack. Eventually, we want to expose the
uninorth (/uni-n in device tree) as a separate QOM device.
Signed-off-by: NAlexander Graf <agraf@suse.de>

Support in fwcfg has been around for exposure of the clock-frequency
CPU property. OpenBIOS reads it, we just never exposed it.

Since Mac OS X is very picky about its clock frequency values, let's
just take a known good value and always expose that.
Reported-by: NMark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Signed-off-by: NAlexander Graf <agraf@suse.de>

When running QEMU with "-cpu ?" we walk through every alias for every
target CPU we know about. This takes several seconds on my very fast
host system.

Let's introduce a class object cache in the alias table. Using that we
don't have to go through the tedious work of finding our target class.
Instead, we can just go directly from the alias name to the target class
pointer.

This patch brings -cpu "?" to reasonable times again.

Before:
  real    0m4.716s

After:
  real    0m0.025s
Signed-off-by: NAlexander Graf <agraf@suse.de>