From 024e5bb664bda54b393e405f425f10fa9d3fbd1a Mon Sep 17 00:00:00 2001
From: Avi Kivity <avi@redhat.com>
Date: Wed, 9 Nov 2011 18:22:37 +0200
Subject: [PATCH] dp8393x: convert to memory API

Fixes address space leak on hotunplug.

Signed-off-by: Avi Kivity <avi@redhat.com>
---
 hw/dp8393x.c   | 30 +++++++++++++++---------------
 hw/mips.h      |  1 +
 hw/mips_jazz.c |  2 +-
 3 files changed, 17 insertions(+), 16 deletions(-)

diff --git a/hw/dp8393x.c b/hw/dp8393x.c
index f66844b108..54f5864b43 100644
--- a/hw/dp8393x.c
+++ b/hw/dp8393x.c
@@ -156,7 +156,8 @@ typedef struct dp8393xState {
     int64_t wt_last_update;
     NICConf conf;
     NICState *nic;
-    int mmio_index;
+    MemoryRegion *address_space;
+    MemoryRegion mmio;
 
     /* Registers */
     uint8_t cam[16][6];
@@ -664,16 +665,12 @@ static void dp8393x_writel(void *opaque, target_phys_addr_t addr, uint32_t val)
     dp8393x_writew(opaque, addr + 2, (val >> 16) & 0xffff);
 }
 
-static CPUReadMemoryFunc * const dp8393x_read[3] = {
-    dp8393x_readb,
-    dp8393x_readw,
-    dp8393x_readl,
-};
-
-static CPUWriteMemoryFunc * const dp8393x_write[3] = {
-    dp8393x_writeb,
-    dp8393x_writew,
-    dp8393x_writel,
+static const MemoryRegionOps dp8393x_ops = {
+    .old_mmio = {
+        .read = { dp8393x_readb, dp8393x_readw, dp8393x_readl, },
+        .write = { dp8393x_writeb, dp8393x_writew, dp8393x_writel, },
+    },
+    .endianness = DEVICE_NATIVE_ENDIAN,
 };
 
 static int nic_can_receive(VLANClientState *nc)
@@ -865,7 +862,8 @@ static void nic_cleanup(VLANClientState *nc)
 {
     dp8393xState *s = DO_UPCAST(NICState, nc, nc)->opaque;
 
-    cpu_unregister_io_memory(s->mmio_index);
+    memory_region_del_subregion(s->address_space, &s->mmio);
+    memory_region_destroy(&s->mmio);
 
     qemu_del_timer(s->watchdog);
     qemu_free_timer(s->watchdog);
@@ -882,6 +880,7 @@ static NetClientInfo net_dp83932_info = {
 };
 
 void dp83932_init(NICInfo *nd, target_phys_addr_t base, int it_shift,
+                  MemoryRegion *address_space,
                   qemu_irq irq, void* mem_opaque,
                   void (*memory_rw)(void *opaque, target_phys_addr_t addr, uint8_t *buf, int len, int is_write))
 {
@@ -891,6 +890,7 @@ void dp83932_init(NICInfo *nd, target_phys_addr_t base, int it_shift,
 
     s = g_malloc0(sizeof(dp8393xState));
 
+    s->address_space = address_space;
     s->mem_opaque = mem_opaque;
     s->memory_rw = memory_rw;
     s->it_shift = it_shift;
@@ -908,7 +908,7 @@ void dp83932_init(NICInfo *nd, target_phys_addr_t base, int it_shift,
     qemu_register_reset(nic_reset, s);
     nic_reset(s);
 
-    s->mmio_index = cpu_register_io_memory(dp8393x_read, dp8393x_write, s,
-                                           DEVICE_NATIVE_ENDIAN);
-    cpu_register_physical_memory(base, 0x40 << it_shift, s->mmio_index);
+    memory_region_init_io(&s->mmio, &dp8393x_ops, s,
+                          "dp8393x", 0x40 << it_shift);
+    memory_region_add_subregion(address_space, base, &s->mmio);
 }
diff --git a/hw/mips.h b/hw/mips.h
index 84f4006c5f..22156fce53 100644
--- a/hw/mips.h
+++ b/hw/mips.h
@@ -25,6 +25,7 @@ void *rc4030_init(qemu_irq timer, qemu_irq jazz_bus,
 
 /* dp8393x.c */
 void dp83932_init(NICInfo *nd, target_phys_addr_t base, int it_shift,
+                  MemoryRegion *address_space,
                   qemu_irq irq, void* mem_opaque,
                   void (*memory_rw)(void *opaque, target_phys_addr_t addr, uint8_t *buf, int len, int is_write));
 
diff --git a/hw/mips_jazz.c b/hw/mips_jazz.c
index e1db841bf5..358de599b0 100644
--- a/hw/mips_jazz.c
+++ b/hw/mips_jazz.c
@@ -227,7 +227,7 @@ static void mips_jazz_init(MemoryRegion *address_space,
         if (!nd->model)
             nd->model = g_strdup("dp83932");
         if (strcmp(nd->model, "dp83932") == 0) {
-            dp83932_init(nd, 0x80001000, 2, rc4030[4],
+            dp83932_init(nd, 0x80001000, 2, get_system_memory(), rc4030[4],
                          rc4030_opaque, rc4030_dma_memory_rw);
             break;
         } else if (strcmp(nd->model, "?") == 0) {