All the uses of the gen_{ld,st}* functions are gone now, so remove
the functions themselves.
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Reviewed-by: NRichard Henderson <rth@twiddle.net>
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

gen_ld64() and gen_st64() are used only in one place, so just
expand them out.
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Reviewed-by: NRichard Henderson <rth@twiddle.net>
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

TCGv changes size depending on the compile time value of
TARGET_LONG_BITS.  This is useful for generating code for MIPS style
"instructions are the same but the register width changes" CPUs, and
also for the generic bits of QEMU which operate on "width of a
virtual address" values, but mostly in the ARM target code we were
using it purely as a shorthand for "any 32 bit value".

This needs to change in preparation for AArch64 support, since an
AArch64-capable v8 core will have 64 bit virtual addresses but still
use 32 bit values for the 32 bit instruction set.

This patch mechanically converts all the occurrences of TCGv,
tcg_temp_new(), tcg_temp_free(), tcg_temp_local_new() and
TCGV_UNUSED() to their explicitly 32 bit counterparts.  This is
correct for everything except the arguments to tcg_gen_qemu_{ld,st}*,
which really do need to be TCGv and so will require a 32-to-64
conversion when building the 32 bit code for AArch64.  Those changes
will be in a separate patch for easier review.
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Reviewed-by: NRichard Henderson <rth@twiddle.net>
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

# By Paolo Bonzini (11) and others
# Via Paolo Bonzini
* bonzini/iommu-for-anthony:
  memory: clean up phys_page_find
  memory: populate FlatView for new address spaces
  memory: limit sections in the radix tree to the actual address space size
  s390x: reduce TARGET_PHYS_ADDR_SPACE_BITS to 62
  memory: fix address space initialization/destruction
  memory: make memory_global_sync_dirty_bitmap take an AddressSpace
  memory: do not duplicate memory_region_destructor_none
  memory: Rename readable flag to romd_mode
  memory: Replace open-coded memory_region_is_romd
  memory: allow memory_region_find() to run on non-root memory regions
  memory: assert that PhysPageEntry's ptr does not overflow
  exec: eliminate stq_phys_notdirty
  exec: make qemu_get_ram_ptr private
  exec: eliminate qemu_put_ram_ptr
  exec: remove obsolete comment

Message-id: 1369414987-8839-1-git-send-email-pbonzini@redhat.com
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

# By Alasdair McLeay (1) and Stefan Hajnoczi (1)
# Via Stefan Hajnoczi
* stefanha/net:
  rtl8139: flush queued packets when RxBufPtr is written
  net: support for bridged networking on Mac OS X

Message-id: 1369406295-20411-1-git-send-email-stefanha@redhat.com
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

# By Wenchao Xia (5) and others
# Via Stefan Hajnoczi
* stefanha/block:
  coroutine: stop using AioContext in CoQueue
  coroutine: protect global pool with a mutex
  qemu-iotests: Try creating huge qcow2 image
  qcow2.py: Subcommand for changing header fields
  qemu-io: Fix 'map' output
  blockdev: Rename BlockdevAction -> TransactionAction
  block: make all steps in qmp_transaction() as callback
  block: package rollback code in qmp_transaction()
  block: package committing code in qmp_transaction()
  block: move input parsing code in qmp_transaction()
  block: package preparation code in qmp_transaction()

Message-id: 1369405947-14818-1-git-send-email-stefanha@redhat.com
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Remove the goto.
Reviewed-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

Even a new address space might have a non-empty FlatView.  In order
to initialize it properly, address_space_init should (a) call
memory_region_transaction_commit after the address space is inserted
into the list; (b) force memory_region_transaction_commit to do something.

This bug was latent so far because all address spaces started empty, including
the PCI address space where the bus master region is initially disabled.
However, the target address space of an IOMMU is usually rooted at
get_system_memory(), which might not be empty at the time the IOMMU is created.
Reviewed-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

The radix tree is statically sized to fit TARGET_PHYS_ADDR_SPACE_BITS.
If a larger memory region is registered, it will overflow.

Fix by limiting any section in the radix tree to the supported size.

This problem was not observed earlier since artificial regions (containers
and aliases) are eliminated by the memory core, leaving only device regions
which have reasonable sizes.  An IOMMU however cannot be eliminated by the
memory core, and may have an artificial size.
Reviewed-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NAvi Kivity <avi.kivity@gmail.com>
[ Fail the build if TARGET_PHYS_ADDR_SPACE_BITS is too large - Paolo ]
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

With the next patch, the memory API will complain if the
TARGET_PHYS_ADDR_SPACE_BITS gets dangerously close to an
overflow.  s390x can handle up to 64 bit of physical address
space from its page tables, but we never use that much.  Just
decrease the value.

Cc: Alexander Graf <agraf@suse.de>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

A couple of fields were left uninitialized.  This was not observed earlier
because all address spaces were statically allocated.  Also free allocation
for those fields.
Reviewed-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NAvi Kivity <avi.kivity@gmail.com>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

Since this is a MemoryListener operation, it only makes sense
on an AddressSpace granularity.
Suggested-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

Reviewed-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

"Readable" is a very unfortunate name for this flag because even a
rom_device region will always be readable from the guest POV. What
differs is the mapping, just like the comments had to explain already.
Also, readable could currently be understood as being a generic region
flag, but it only applies to rom_device regions.

So rename the flag and the function to modify it after the original term
"ROMD" which could also be interpreted as "ROM direct", i.e. ROM mode
with direct access. In any case, the scope of the flag is clearer now.
Signed-off-by: NJan Kiszka <jan.kiszka@siemens.com>
Reviewed-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

Improves readability.
Reviewed-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NJan Kiszka <jan.kiszka@siemens.com>

memory_region_find() is similar to registering a MemoryListener and
checking for the MemoryRegionSections that come from a particular
region.  There is no reason for this to be limited to a root memory
region.
Reviewed-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

While sized to 15 bits in PhysPageEntry, the ptr field is ORed into the
iotlb entries together with a page-aligned pointer.  The ptr field must
not overflow into this page-aligned value, assert that it is smaller than
the page size.
Reviewed-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

It is not used anywhere.
Reviewed-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

It is a private interface between exec.c and memory.c.
Reviewed-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

Reviewed-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

See how we call memory_region_section_addr two lines below to
convert a physical address to a base address in the region.
Reviewed-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

Net queues support efficient "receive disable".  For example, tap's file
descriptor will not be polled while its peer has receive disabled.  This
saves CPU cycles for needlessly copying and then dropping packets which
the peer cannot receive.

rtl8139 is missing the qemu_flush_queued_packets() call that wakes the
queue up when receive becomes possible again.

As a result, the Windows 7 guest driver reaches a state where the
rtl8139 cannot receive packets.  The driver has actually refilled the
receive buffer but we never resume reception.

The bug can be reproduced by running a large FTP 'get' inside a Windows
7 guest:

  $ qemu -netdev tap,id=tap0,...
         -device rtl8139,netdev=tap0

The Linux guest driver does not trigger the bug, probably due to a
different buffer management strategy.
Reported-by: NOliver Francke <oliver.francke@filoo.de>
Signed-off-by: NStefan Hajnoczi <stefanha@redhat.com>

tun tap can be implemented on Mac OS X using
http://tuntaposx.sourceforge.net

It behaves in the same way as FreeBSD/OpenBSD implementations, but Qemu
needs a patch to use the OpenBS/FreeBSD code.

As per the patch listed in this forum thread:
http://forum.gns3.net/post17679.html#p17679

And also as used in the MacPorts installation:
https://trac.macports.org/browser/trunk/dports/emulators/qemu/files/patch-net-tap-interface.diffSigned-off-by: NAlasdair McLeay <alasdair.mcleay@me.com>
Signed-off-by: NStefan Hajnoczi <stefanha@redhat.com>

qemu_co_queue_next(&queue) arranges that the next queued coroutine is
run at a later point in time.  This deferred restart is useful because
the caller may not want to transfer control yet.

This behavior was implemented using QEMUBH in the past, which meant that
CoQueue (and hence CoMutex and CoRwlock) had a dependency on the
AioContext event loop.  This hidden dependency causes trouble when we
move to a world with multiple event loops - now qemu_co_queue_next()
needs to know which event loop to schedule the QEMUBH in.

After pondering how to stash AioContext I realized the best solution is
to not use AioContext at all.  This patch implements the deferred
restart behavior purely in terms of coroutines and no longer uses
QEMUBH.

Here is how it works:

Each Coroutine has a wakeup queue that starts out empty.  When
qemu_co_queue_next() is called, the next coroutine is added to our
wakeup queue.  The wakeup queue is processed when we yield or terminate.
Signed-off-by: NStefan Hajnoczi <stefanha@redhat.com>

The coroutine freelist is a global pool of unused coroutines.  It avoids
the setup/teardown overhead associated with the coroutine lifecycle.
Since the pool is global, we need to synchronize access so that
coroutines can be used outside the BQL.
Signed-off-by: NStefan Hajnoczi <stefanha@redhat.com>

It's supposed to fail gracefully instead of segfaulting.
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

Signed-off-by: NKevin Wolf <kwolf@redhat.com>

The output of the 'map' command in qemu-io used to directly resemble
bdrv_is_allocated() and could contain many lines for small chunks that
all have the same allocation status. After this patch, they will be
coalesced into a single output line for a large chunk.

As a side effect, the command gains some error handling.
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

There's no reason to restrict transactions to operations related to
block devices, so rename the type now before schema introspection stops
us from doing so.

Also change the schema documentation of 'transaction' to not refer to
block devices or snapshots any more.
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

Make it easier to add other operations to qmp_transaction() by using
callbacks, with external snapshots serving as an example implementation
of the callbacks.
Signed-off-by: NWenchao Xia <xiawenc@linux.vnet.ibm.com>
Reviewed-by: NKevin Wolf <kwolf@redhat.com>
Reviewed-by: NStefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: NEric Blake <eblake@redhat.com>
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

Signed-off-by: NWenchao Xia <xiawenc@linux.vnet.ibm.com>
Reviewed-by: NKevin Wolf <kwolf@redhat.com>
Reviewed-by: NStefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: NEric Blake <eblake@redhat.com>
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

The code is simply moved into a separate function.
Signed-off-by: NWenchao Xia <xiawenc@linux.vnet.ibm.com>
Reviewed-by: NKevin Wolf <kwolf@redhat.com>
Reviewed-by: NStefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: NEric Blake <eblake@redhat.com>
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

The code is moved into preparation function, and changed
a bit to tip more clearly what it is doing.
Signed-off-by: NWenchao Xia <xiawenc@linux.vnet.ibm.com>
Reviewed-by: NKevin Wolf <kwolf@redhat.com>
Reviewed-by: NStefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: NEric Blake <eblake@redhat.com>
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

The code before really committing is moved into a function. Most
code is simply moved from qmp_transaction(), except that on fail it
just returns now. Other code such as input parsing is not touched,
to make it easier in review.
Signed-off-by: NWenchao Xia <xiawenc@linux.vnet.ibm.com>
Reviewed-by: NKevin Wolf <kwolf@redhat.com>
Reviewed-by: NStefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: NEric Blake <eblake@redhat.com>
Signed-off-by: NKevin Wolf <kwolf@redhat.com>