hw/device-assignment.c

   1 /*
   2  * Copyright (c) 2007, Neocleus Corporation.
   3  *
   4  * This program is free software; you can redistribute it and/or modify it
   5  * under the terms and conditions of the GNU General Public License,
   6  * version 2, as published by the Free Software Foundation.
   7  *
   8  * This program is distributed in the hope it will be useful, but WITHOUT
   9  * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
  10  * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
  11  * more details.
  12  *
  13  * You should have received a copy of the GNU General Public License along with
  14  * this program; if not, write to the Free Software Foundation, Inc., 59 Temple
  15  * Place - Suite 330, Boston, MA 02111-1307 USA.
  16  *
  17  *
  18  *  Assign a PCI device from the host to a guest VM.
  19  *
  20  *  Adapted for KVM by Qumranet.
  21  *
  22  *  Copyright (c) 2007, Neocleus, Alex Novik (alex@neocleus.com)
  23  *  Copyright (c) 2007, Neocleus, Guy Zana (guy@neocleus.com)
  24  *  Copyright (C) 2008, Qumranet, Amit Shah (amit.shah@qumranet.com)
  25  *  Copyright (C) 2008, Red Hat, Amit Shah (amit.shah@redhat.com)
  26  *  Copyright (C) 2008, IBM, Muli Ben-Yehuda (muli@il.ibm.com)
  27  */
  28 #include <stdio.h>
  29 #include <sys/io.h>
  30 #include "qemu-kvm.h"
  31 #include "hw.h"
  32 #include "pc.h"
  33 #include "sysemu.h"
  34 #include "console.h"
  35 #include "device-assignment.h"
  36
  37 /* From linux/ioport.h */
  38 #define IORESOURCE_IO       0x00000100  /* Resource type */
  39 #define IORESOURCE_MEM      0x00000200
  40 #define IORESOURCE_IRQ      0x00000400
  41 #define IORESOURCE_DMA      0x00000800
  42 #define IORESOURCE_PREFETCH 0x00001000  /* No side effects */
  43
  44 /* #define DEVICE_ASSIGNMENT_DEBUG 1 */
  45
  46 #ifdef DEVICE_ASSIGNMENT_DEBUG
  47 #define DEBUG(fmt, ...)                                       \
  48     do {                                                      \
  49       fprintf(stderr, "%s: " fmt, __func__ , __VA_ARGS__);    \
  50     } while (0)
  51 #else
  52 #define DEBUG(fmt, ...) do { } while(0)
  53 #endif
  54
  55 static uint32_t guest_to_host_ioport(AssignedDevRegion *region, uint32_t addr)
  56 {
  57     return region->u.r_baseport + (addr - region->e_physbase);
  58 }
  59
  60 static void assigned_dev_ioport_writeb(void *opaque, uint32_t addr,
  61                                        uint32_t value)
  62 {
  63     AssignedDevRegion *r_access = opaque;
  64     uint32_t r_pio = guest_to_host_ioport(r_access, addr);
  65
  66     DEBUG("r_pio=%08x e_physbase=%08x r_baseport=%08lx value=%08x\n",
  67           r_pio, (int)r_access->e_physbase,
  68           (unsigned long)r_access->u.r_baseport, value);
  69
  70     outb(value, r_pio);
  71 }
  72
  73 static void assigned_dev_ioport_writew(void *opaque, uint32_t addr,
  74                                        uint32_t value)
  75 {
  76     AssignedDevRegion *r_access = opaque;
  77     uint32_t r_pio = guest_to_host_ioport(r_access, addr);
  78
  79     DEBUG("r_pio=%08x e_physbase=%08x r_baseport=%08lx value=%08x\n",
  80           r_pio, (int)r_access->e_physbase,
  81           (unsigned long)r_access->u.r_baseport, value);
  82
  83     outw(value, r_pio);
  84 }
  85
  86 static void assigned_dev_ioport_writel(void *opaque, uint32_t addr,
  87                        uint32_t value)
  88 {
  89     AssignedDevRegion *r_access = opaque;
  90     uint32_t r_pio = guest_to_host_ioport(r_access, addr);
  91
  92     DEBUG("r_pio=%08x e_physbase=%08x r_baseport=%08lx value=%08x\n",
  93           r_pio, (int)r_access->e_physbase,
  94           (unsigned long)r_access->u.r_baseport, value);
  95
  96     outl(value, r_pio);
  97 }
  98
  99 static uint32_t assigned_dev_ioport_readb(void *opaque, uint32_t addr)
 100 {
 101     AssignedDevRegion *r_access = opaque;
 102     uint32_t r_pio = guest_to_host_ioport(r_access, addr);
 103     uint32_t value;
 104
 105     value = inb(r_pio);
 106
 107     DEBUG("r_pio=%08x e_physbase=%08x r_=%08lx value=%08x\n",
 108           r_pio, (int)r_access->e_physbase,
 109           (unsigned long)r_access->u.r_baseport, value);
 110
 111     return value;
 112 }
 113
 114 static uint32_t assigned_dev_ioport_readw(void *opaque, uint32_t addr)
 115 {
 116     AssignedDevRegion *r_access = opaque;
 117     uint32_t r_pio = guest_to_host_ioport(r_access, addr);
 118     uint32_t value;
 119
 120     value = inw(r_pio);
 121
 122     DEBUG("r_pio=%08x e_physbase=%08x r_baseport=%08lx value=%08x\n",
 123           r_pio, (int)r_access->e_physbase,
 124           (unsigned long)r_access->u.r_baseport, value);
 125
 126     return value;
 127 }
 128
 129 static uint32_t assigned_dev_ioport_readl(void *opaque, uint32_t addr)
 130 {
 131     AssignedDevRegion *r_access = opaque;
 132     uint32_t r_pio = guest_to_host_ioport(r_access, addr);
 133     uint32_t value;
 134
 135     value = inl(r_pio);
 136
 137     DEBUG("r_pio=%08x e_physbase=%08x r_baseport=%08lx value=%08x\n",
 138           r_pio, (int)r_access->e_physbase,
 139           (unsigned long)r_access->u.r_baseport, value);
 140
 141     return value;
 142 }
 143
 144 static void assigned_dev_iomem_map(PCIDevice *pci_dev, int region_num,
 145                                    uint32_t e_phys, uint32_t e_size, int type)
 146 {
 147     AssignedDevice *r_dev = (AssignedDevice *) pci_dev;
 148     AssignedDevRegion *region = &r_dev->v_addrs[region_num];
 149     uint32_t old_ephys = region->e_physbase;
 150     uint32_t old_esize = region->e_size;
 151     int first_map = (region->e_size == 0);
 152     int ret = 0;
 153
 154     DEBUG("e_phys=%08x r_virt=%p type=%d len=%08x region_num=%d \n",
 155           e_phys, region->u.r_virtbase, type, e_size, region_num);
 156
 157     region->e_physbase = e_phys;
 158     region->e_size = e_size;
 159
 160     if (!first_map)
 161         kvm_destroy_phys_mem(kvm_context, old_ephys,
 162                              TARGET_PAGE_ALIGN(old_esize));
 163
 164     if (e_size > 0)
 165         ret = kvm_register_phys_mem(kvm_context, e_phys,
 166                                     region->u.r_virtbase,
 167                                     TARGET_PAGE_ALIGN(e_size), 0);
 168
 169     if (ret != 0) {
 170         fprintf(stderr, "%s: Error: create new mapping failed\n", __func__);
 171         exit(1);
 172     }
 173 }
 174
 175 static void assigned_dev_ioport_map(PCIDevice *pci_dev, int region_num,
 176                                     uint32_t addr, uint32_t size, int type)
 177 {
 178     AssignedDevice *r_dev = (AssignedDevice *) pci_dev;
 179     AssignedDevRegion *region = &r_dev->v_addrs[region_num];
 180     int first_map = (region->e_size == 0);
 181     CPUState *env;
 182
 183     region->e_physbase = addr;
 184     region->e_size = size;
 185
 186     DEBUG("e_phys=0x%x r_baseport=%x type=0x%x len=%d region_num=%d \n",
 187           addr, region->u.r_baseport, type, size, region_num);
 188
 189     if (first_map) {
 190         struct ioperm_data *data;
 191
 192         data = qemu_mallocz(sizeof(struct ioperm_data));
 193         if (data == NULL) {
 194             fprintf(stderr, "%s: Out of memory\n", __func__);
 195             exit(1);
 196         }
 197
 198         data->start_port = region->u.r_baseport;
 199         data->num = region->r_size;
 200         data->turn_on = 1;
 201
 202         kvm_add_ioperm_data(data);
 203
 204         for (env = first_cpu; env; env = env->next_cpu)
 205             kvm_ioperm(env, data);
 206     }
 207
 208     register_ioport_read(addr, size, 1, assigned_dev_ioport_readb,
 209                          (r_dev->v_addrs + region_num));
 210     register_ioport_read(addr, size, 2, assigned_dev_ioport_readw,
 211                          (r_dev->v_addrs + region_num));
 212     register_ioport_read(addr, size, 4, assigned_dev_ioport_readl,
 213                          (r_dev->v_addrs + region_num));
 214     register_ioport_write(addr, size, 1, assigned_dev_ioport_writeb,
 215                           (r_dev->v_addrs + region_num));
 216     register_ioport_write(addr, size, 2, assigned_dev_ioport_writew,
 217                           (r_dev->v_addrs + region_num));
 218     register_ioport_write(addr, size, 4, assigned_dev_ioport_writel,
 219                           (r_dev->v_addrs + region_num));
 220 }
 221
 222 static void assigned_dev_pci_write_config(PCIDevice *d, uint32_t address,
 223                                           uint32_t val, int len)
 224 {
 225     int fd;
 226     ssize_t ret;
 227
 228     DEBUG("(%x.%x): address=%04x val=0x%08x len=%d\n",
 229           ((d->devfn >> 3) & 0x1F), (d->devfn & 0x7),
 230           (uint16_t) address, val, len);
 231
 232     if (address == 0x4) {
 233         pci_default_write_config(d, address, val, len);
 234         /* Continue to program the card */
 235     }
 236
 237     if ((address >= 0x10 && address <= 0x24) || address == 0x34 ||
 238         address == 0x3c || address == 0x3d) {
 239         /* used for update-mappings (BAR emulation) */
 240         pci_default_write_config(d, address, val, len);
 241         return;
 242     }
 243
 244     DEBUG("NON BAR (%x.%x): address=%04x val=0x%08x len=%d\n",
 245           ((d->devfn >> 3) & 0x1F), (d->devfn & 0x7),
 246           (uint16_t) address, val, len);
 247
 248     fd = ((AssignedDevice *)d)->real_device.config_fd;
 249
 250 again:
 251     ret = pwrite(fd, &val, len, address);
 252     if (ret != len) {
 253         if ((ret < 0) && (errno == EINTR || errno == EAGAIN))
 254             goto again;
 255
 256         fprintf(stderr, "%s: pwrite failed, ret = %zd errno = %d\n",
 257                 __func__, ret, errno);
 258
 259         exit(1);
 260     }
 261 }
 262
 263 static uint32_t assigned_dev_pci_read_config(PCIDevice *d, uint32_t address,
 264                                              int len)
 265 {
 266     uint32_t val = 0;
 267     int fd;
 268     ssize_t ret;
 269
 270     if ((address >= 0x10 && address <= 0x24) || address == 0x34 ||
 271         address == 0x3c || address == 0x3d) {
 272         val = pci_default_read_config(d, address, len);
 273         DEBUG("(%x.%x): address=%04x val=0x%08x len=%d\n",
 274               (d->devfn >> 3) & 0x1F, (d->devfn & 0x7), address, val, len);
 275         return val;
 276     }
 277
 278     /* vga specific, remove later */
 279     if (address == 0xFC)
 280         goto do_log;
 281
 282     fd = ((AssignedDevice *)d)->real_device.config_fd;
 283
 284 again:
 285     ret = pread(fd, &val, len, address);
 286     if (ret != len) {
 287         if ((ret < 0) && (errno == EINTR || errno == EAGAIN))
 288             goto again;
 289
 290         fprintf(stderr, "%s: pread failed, ret = %zd errno = %d\n",
 291                 __func__, ret, errno);
 292
 293         exit(1);
 294     }
 295
 296 do_log:
 297     DEBUG("(%x.%x): address=%04x val=0x%08x len=%d\n",
 298           (d->devfn >> 3) & 0x1F, (d->devfn & 0x7), address, val, len);
 299
 300     /* kill the special capabilities */
 301     if (address == 4 && len == 4)
 302         val &= ~0x100000;
 303     else if (address == 6)
 304         val &= ~0x10;
 305
 306     return val;
 307 }
 308
 309 static int assigned_dev_register_regions(PCIRegion *io_regions,
 310                                          unsigned long regions_num,
 311                                          AssignedDevice *pci_dev)
 312 {
 313     uint32_t i;
 314     PCIRegion *cur_region = io_regions;
 315
 316     for (i = 0; i < regions_num; i++, cur_region++) {
 317         if (!cur_region->valid)
 318             continue;
 319         pci_dev->v_addrs[i].num = i;
 320
 321         /* handle memory io regions */
 322         if (cur_region->type & IORESOURCE_MEM) {
 323             int t = cur_region->type & IORESOURCE_PREFETCH
 324                 ? PCI_ADDRESS_SPACE_MEM_PREFETCH
 325                 : PCI_ADDRESS_SPACE_MEM;
 326
 327             /* map physical memory */
 328             pci_dev->v_addrs[i].e_physbase = cur_region->base_addr;
 329             pci_dev->v_addrs[i].u.r_virtbase =
 330                 mmap(NULL,
 331                      (cur_region->size + 0xFFF) & 0xFFFFF000,
 332                      PROT_WRITE | PROT_READ, MAP_SHARED,
 333                      cur_region->resource_fd, (off_t) 0);
 334
 335             if (pci_dev->v_addrs[i].u.r_virtbase == MAP_FAILED) {
 336                 pci_dev->v_addrs[i].u.r_virtbase = NULL;
 337                 fprintf(stderr, "%s: Error: Couldn't mmap 0x%x!"
 338                         "\n", __func__,
 339                         (uint32_t) (cur_region->base_addr));
 340                 return -1;
 341             }
 342             pci_dev->v_addrs[i].r_size = cur_region->size;
 343             pci_dev->v_addrs[i].e_size = 0;
 344
 345             /* add offset */
 346             pci_dev->v_addrs[i].u.r_virtbase +=
 347                 (cur_region->base_addr & 0xFFF);
 348
 349             pci_register_io_region((PCIDevice *) pci_dev, i,
 350                                    cur_region->size, t,
 351                                    assigned_dev_iomem_map);
 352             continue;
 353         }
 354         /* handle port io regions */
 355         pci_dev->v_addrs[i].e_physbase = cur_region->base_addr;
 356         pci_dev->v_addrs[i].u.r_baseport = cur_region->base_addr;
 357         pci_dev->v_addrs[i].r_size = cur_region->size;
 358         pci_dev->v_addrs[i].e_size = 0;
 359
 360         pci_register_io_region((PCIDevice *) pci_dev, i,
 361                                cur_region->size, PCI_ADDRESS_SPACE_IO,
 362                                assigned_dev_ioport_map);
 363
 364         /* not relevant for port io */
 365         pci_dev->v_addrs[i].memory_index = 0;
 366     }
 367
 368     /* success */
 369     return 0;
 370 }
 371
 372 static int get_real_device(AssignedDevice *pci_dev, uint8_t r_bus,
 373                            uint8_t r_dev, uint8_t r_func)
 374 {
 375     char dir[128], name[128];
 376     int fd, r = 0;
 377     FILE *f;
 378     unsigned long long start, end, size, flags;
 379     PCIRegion *rp;
 380     PCIDevRegions *dev = &pci_dev->real_device;
 381
 382     dev->region_number = 0;
 383
 384     snprintf(dir, sizeof(dir), "/sys/bus/pci/devices/0000:%02x:%02x.%x/",
 385              r_bus, r_dev, r_func);
 386
 387     snprintf(name, sizeof(name), "%sconfig", dir);
 388
 389     fd = open(name, O_RDWR);
 390     if (fd == -1) {
 391         fprintf(stderr, "%s: %s: %m\n", __func__, name);
 392         return 1;
 393     }
 394     dev->config_fd = fd;
 395 again:
 396     r = read(fd, pci_dev->dev.config, sizeof(pci_dev->dev.config));
 397     if (r < 0) {
 398         if (errno == EINTR || errno == EAGAIN)
 399             goto again;
 400         fprintf(stderr, "%s: read failed, errno = %d\n", __func__, errno);
 401     }
 402
 403     snprintf(name, sizeof(name), "%sresource", dir);
 404
 405     f = fopen(name, "r");
 406     if (f == NULL) {
 407         fprintf(stderr, "%s: %s: %m\n", __func__, name);
 408         return 1;
 409     }
 410
 411     for (r = 0; r < MAX_IO_REGIONS; r++) {
 412         if (fscanf(f, "%lli %lli %lli\n", &start, &end, &flags) != 3)
 413             break;
 414
 415         rp = dev->regions + r;
 416         rp->valid = 0;
 417         size = end - start + 1;
 418         flags &= IORESOURCE_IO | IORESOURCE_MEM | IORESOURCE_PREFETCH;
 419         if (size == 0 || (flags & ~IORESOURCE_PREFETCH) == 0)
 420             continue;
 421         if (flags & IORESOURCE_MEM) {
 422             flags &= ~IORESOURCE_IO;
 423             snprintf(name, sizeof(name), "%sresource%d", dir, r);
 424             fd = open(name, O_RDWR);
 425             if (fd == -1)
 426                 continue;       /* probably ROM */
 427             rp->resource_fd = fd;
 428         } else
 429             flags &= ~IORESOURCE_PREFETCH;
 430
 431         rp->type = flags;
 432         rp->valid = 1;
 433         rp->base_addr = start;
 434         rp->size = size;
 435         DEBUG("region %d size %d start 0x%llx type %d resource_fd %d\n",
 436               r, rp->size, start, rp->type, rp->resource_fd);
 437     }
 438     fclose(f);
 439
 440     dev->region_number = r;
 441     return 0;
 442 }
 443
 444 static LIST_HEAD(, AssignedDevInfo) adev_head;
 445
 446 static void free_assigned_device(AssignedDevInfo *adev)
 447 {
 448     AssignedDevice *dev = adev->assigned_dev;
 449
 450     if (dev) {
 451         int i;
 452
 453         for (i = 0; i < dev->real_device.region_number; i++) {
 454             PCIRegion *pci_region = &dev->real_device.regions[i];
 455             AssignedDevRegion *region = &dev->v_addrs[i];
 456
 457             if (!pci_region->valid || !(pci_region->type & IORESOURCE_MEM))
 458                 continue;
 459
 460             kvm_remove_ioperm_data(region->u.r_baseport, region->r_size);
 461
 462             if (region->u.r_virtbase) {
 463                 int ret = munmap(region->u.r_virtbase,
 464                                  (pci_region->size + 0xFFF) & 0xFFFFF000);
 465                 if (ret != 0)
 466                     fprintf(stderr,
 467                             "Failed to unmap assigned device region: %s\n",
 468                             strerror(errno));
 469             }
 470         }
 471
 472         if (dev->real_device.config_fd) {
 473             close(dev->real_device.config_fd);
 474             dev->real_device.config_fd = 0;
 475         }
 476
 477         pci_unregister_device(&dev->dev);
 478         adev->assigned_dev = dev = NULL;
 479     }
 480
 481     LIST_REMOVE(adev, next);
 482     qemu_free(adev);
 483 }
 484
 485 static uint32_t calc_assigned_dev_id(uint8_t bus, uint8_t devfn)
 486 {
 487     return (uint32_t)bus << 8 | (uint32_t)devfn;
 488 }
 489
 490 static int assign_device(AssignedDevInfo *adev)
 491 {
 492     struct kvm_assigned_pci_dev assigned_dev_data;
 493     AssignedDevice *dev = adev->assigned_dev;
 494     int r;
 495
 496     memset(&assigned_dev_data, 0, sizeof(assigned_dev_data));
 497     assigned_dev_data.assigned_dev_id  =
 498         calc_assigned_dev_id(dev->h_busnr, dev->h_devfn);
 499     assigned_dev_data.busnr = dev->h_busnr;
 500     assigned_dev_data.devfn = dev->h_devfn;
 501
 502 #ifdef KVM_CAP_IOMMU
 503     /* We always enable the IOMMU if present
 504      * (or when not disabled on the command line)
 505      */
 506     r = kvm_check_extension(kvm_context, KVM_CAP_IOMMU);
 507     if (r && !adev->disable_iommu)
 508         assigned_dev_data.flags |= KVM_DEV_ASSIGN_ENABLE_IOMMU;
 509 #endif
 510
 511     r = kvm_assign_pci_device(kvm_context, &assigned_dev_data);
 512     if (r < 0)
 513         fprintf(stderr, "Failed to assign device \"%s\" : %s\n",
 514                 adev->name, strerror(-r));
 515     return r;
 516 }
 517
 518 static int assign_irq(AssignedDevInfo *adev)
 519 {
 520     struct kvm_assigned_irq assigned_irq_data;
 521     AssignedDevice *dev = adev->assigned_dev;
 522     int irq, r = 0;
 523
 524     irq = pci_map_irq(&dev->dev, dev->intpin);
 525     irq = piix_get_irq(irq);
 526
 527 #ifdef TARGET_IA64
 528     irq = ipf_map_irq(&dev->dev, irq);
 529 #endif
 530
 531     if (dev->girq == irq)
 532         return r;
 533
 534     memset(&assigned_irq_data, 0, sizeof(assigned_irq_data));
 535     assigned_irq_data.assigned_dev_id =
 536         calc_assigned_dev_id(dev->h_busnr, dev->h_devfn);
 537     assigned_irq_data.guest_irq = irq;
 538     assigned_irq_data.host_irq = dev->real_device.irq;
 539     r = kvm_assign_irq(kvm_context, &assigned_irq_data);
 540     if (r < 0) {
 541         fprintf(stderr, "Failed to assign irq for \"%s\": %s\n",
 542                 adev->name, strerror(-r));
 543         fprintf(stderr, "Perhaps you are assigning a device "
 544                 "that shares an IRQ with another device?\n");
 545         return r;
 546     }
 547
 548     dev->girq = irq;
 549     return r;
 550 }
 551
 552 static void deassign_device(AssignedDevInfo *adev)
 553 {
 554     struct kvm_assigned_pci_dev assigned_dev_data;
 555     AssignedDevice *dev = adev->assigned_dev;
 556     int r;
 557
 558     memset(&assigned_dev_data, 0, sizeof(assigned_dev_data));
 559     assigned_dev_data.assigned_dev_id  =
 560         calc_assigned_dev_id(dev->h_busnr, dev->h_devfn);
 561
 562     r = kvm_deassign_pci_device(kvm_context, &assigned_dev_data);
 563     if (r < 0)
 564         fprintf(stderr, "Failed to deassign device \"%s\" : %s\n",
 565                 adev->name, strerror(-r));
 566 }
 567
 568 void remove_assigned_device(AssignedDevInfo *adev)
 569 {
 570     deassign_device(adev);
 571     free_assigned_device(adev);
 572 }
 573
 574 AssignedDevInfo *get_assigned_device(int pcibus, int slot)
 575 {
 576     AssignedDevice *assigned_dev = NULL;
 577     AssignedDevInfo *adev = NULL;
 578
 579     LIST_FOREACH(adev, &adev_head, next) {
 580         assigned_dev = adev->assigned_dev;
 581         if (pci_bus_num(assigned_dev->dev.bus) == pcibus &&
 582             PCI_SLOT(assigned_dev->dev.devfn) == slot)
 583             return adev;
 584     }
 585
 586     return NULL;
 587 }
 588
 589 /* The pci config space got updated. Check if irq numbers have changed
 590  * for our devices
 591  */
 592 void assigned_dev_update_irqs()
 593 {
 594     AssignedDevInfo *adev;
 595
 596     adev = LIST_FIRST(&adev_head);
 597     while (adev) {
 598         AssignedDevInfo *next = LIST_NEXT(adev, next);
 599         int r;
 600
 601         r = assign_irq(adev);
 602         if (r < 0)
 603             remove_assigned_device(adev);
 604
 605         adev = next;
 606     }
 607 }
 608
 609 struct PCIDevice *init_assigned_device(AssignedDevInfo *adev, PCIBus *bus)
 610 {
 611     int r;
 612     AssignedDevice *dev;
 613     uint8_t e_device, e_intx;
 614     struct kvm_assigned_pci_dev assigned_dev_data;
 615
 616     DEBUG("Registering real physical device %s (bus=%x dev=%x func=%x)\n",
 617           adev->name, adev->bus, adev->dev, adev->func);
 618
 619     dev = (AssignedDevice *)
 620         pci_register_device(bus, adev->name, sizeof(AssignedDevice),
 621                             -1, assigned_dev_pci_read_config,
 622                             assigned_dev_pci_write_config);
 623     if (NULL == dev) {
 624         fprintf(stderr, "%s: Error: Couldn't register real device %s\n",
 625                 __func__, adev->name);
 626         return NULL;
 627     }
 628
 629     adev->assigned_dev = dev;
 630
 631     if (get_real_device(dev, adev->bus, adev->dev, adev->func)) {
 632         fprintf(stderr, "%s: Error: Couldn't get real device (%s)!\n",
 633                 __func__, adev->name);
 634         goto out;
 635     }
 636
 637     /* handle real device's MMIO/PIO BARs */
 638     if (assigned_dev_register_regions(dev->real_device.regions,
 639                                       dev->real_device.region_number,
 640                                       dev))
 641         goto out;
 642
 643     /* handle interrupt routing */
 644     e_device = (dev->dev.devfn >> 3) & 0x1f;
 645     e_intx = dev->dev.config[0x3d] - 1;
 646     dev->intpin = e_intx;
 647     dev->run = 0;
 648     dev->girq = 0;
 649     dev->h_busnr = adev->bus;
 650     dev->h_devfn = PCI_DEVFN(adev->dev, adev->func);
 651
 652     /* assign device to guest */
 653     r = assign_device(adev);
 654     if (r < 0)
 655         goto assigned_out;
 656
 657     /* assign irq for the device */
 658     r = assign_irq(adev);
 659     if (r < 0)
 660         goto assigned_out;
 661
 662     return &dev->dev;
 663
 664 assigned_out:
 665     deassign_device(adev);
 666 out:
 667     free_assigned_device(adev);
 668     return NULL;
 669 }
 670
 671 /*
 672  * Syntax to assign device:
 673  *
 674  * -pcidevice host=bus:dev.func[,dma=none][,name=Foo]
 675  *
 676  * Example:
 677  * -pcidevice host=00:13.0,dma=pvdma
 678  *
 679  * dma can currently only be 'none' to disable iommu support.
 680  */
 681 AssignedDevInfo *add_assigned_device(const char *arg)
 682 {
 683     char *cp, *cp1;
 684     char device[8];
 685     char dma[6];
 686     int r;
 687     AssignedDevInfo *adev;
 688
 689     adev = qemu_mallocz(sizeof(AssignedDevInfo));
 690     if (adev == NULL) {
 691         fprintf(stderr, "%s: Out of memory\n", __func__);
 692         return NULL;
 693     }
 694     r = get_param_value(device, sizeof(device), "host", arg);
 695     r = get_param_value(adev->name, sizeof(adev->name), "name", arg);
 696     if (!r)
 697         snprintf(adev->name, sizeof(adev->name), "%s", device);
 698
 699 #ifdef KVM_CAP_IOMMU
 700     r = get_param_value(dma, sizeof(dma), "dma", arg);
 701     if (r && !strncmp(dma, "none", 4))
 702         adev->disable_iommu = 1;
 703 #endif
 704     cp = device;
 705     adev->bus = strtoul(cp, &cp1, 16);
 706     if (*cp1 != ':')
 707         goto bad;
 708     cp = cp1 + 1;
 709
 710     adev->dev = strtoul(cp, &cp1, 16);
 711     if (*cp1 != '.')
 712         goto bad;
 713     cp = cp1 + 1;
 714
 715     adev->func = strtoul(cp, &cp1, 16);
 716
 717     LIST_INSERT_HEAD(&adev_head, adev, next);
 718     return adev;
 719 bad:
 720     fprintf(stderr, "pcidevice argument parse error; "
 721             "please check the help text for usage\n");
 722     qemu_free(adev);
 723     return NULL;
 724 }
 725
 726 void add_assigned_devices(PCIBus *bus, const char **devices, int n_devices)
 727 {
 728     int i;
 729
 730     for (i = 0; i < n_devices; i++) {
 731         struct AssignedDevInfo *adev;
 732
 733         adev = add_assigned_device(devices[i]);
 734         if (!adev) {
 735             fprintf(stderr, "Could not add assigned device %s\n", devices[i]);
 736             exit(1);
 737         }
 738
 739         if (!init_assigned_device(adev, bus)) {
 740             fprintf(stderr, "Failed to initialize assigned device %s\n",
 741                     devices[i]);
 742             exit(1);
 743         }
 744     }
 745 }
 746
 747 /* Option ROM header */
 748 struct option_rom_header {
 749     uint8_t signature[2];
 750     uint8_t rom_size;
 751     uint32_t entry_point;
 752     uint8_t reserved[17];
 753     uint16_t pci_header_offset;
 754     uint16_t expansion_header_offset;
 755 } __attribute__ ((packed));
 756
 757 /* Option ROM PCI data structure */
 758 struct option_rom_pci_header {
 759     uint8_t signature[4];
 760     uint16_t vendor_id;
 761     uint16_t device_id;
 762     uint16_t vital_product_data_offset;
 763     uint16_t structure_length;
 764     uint8_t structure_revision;
 765     uint8_t class_code[3];
 766     uint16_t image_length;
 767     uint16_t image_revision;
 768     uint8_t code_type;
 769     uint8_t indicator;
 770     uint16_t reserved;
 771 } __attribute__ ((packed));
 772
 773 /*
 774  * Scan the list of Option ROMs at roms. If a suitable Option ROM is found,
 775  * allocate a ram space and copy it there. Then return its size aligned to
 776  * both 2KB and target page size.
 777  */
 778 #define OPTION_ROM_ALIGN(x) (((x) + 2047) & ~2047)
 779 static int scan_option_rom(uint8_t devfn, void *roms, ram_addr_t offset)
 780 {
 781     int i, size, total_size;
 782     uint8_t csum;
 783     ram_addr_t addr;
 784     struct option_rom_header *rom;
 785     struct option_rom_pci_header *pcih;
 786
 787     rom = roms;
 788
 789     for ( ; ; ) {
 790         /* Invalid signature means we're out of option ROMs. */
 791         if (strncmp((char *)rom->signature, "\x55\xaa", 2) ||
 792              (rom->rom_size == 0))
 793             break;
 794
 795         size = rom->rom_size * 512;
 796         /* Invalid checksum means we're out of option ROMs. */
 797         csum = 0;
 798         for (i = 0; i < size; i++)
 799             csum += ((uint8_t *)rom)[i];
 800         if (csum != 0)
 801             break;
 802
 803         /* Check the PCI header (if any) for a match. */
 804         pcih = (struct option_rom_pci_header *)
 805                 ((char *)rom + rom->pci_header_offset);
 806         if ((rom->pci_header_offset != 0) &&
 807              !strncmp((char *)pcih->signature, "PCIR", 4))
 808             goto found;
 809
 810         rom = (struct option_rom_header *)((char *)rom + size);
 811     }
 812
 813     return 0;
 814
 815  found:
 816     /* The size should be both 2K-aligned and page-aligned */
 817     total_size = (TARGET_PAGE_SIZE < 2048)
 818                   ? OPTION_ROM_ALIGN(size + 1)
 819                   : TARGET_PAGE_ALIGN(size + 1);
 820
 821     /* Size of all available ram space is 0x10000 (0xd0000 to 0xe0000) */
 822     if ((offset + total_size) > 0x10000u) {
 823         fprintf(stderr, "Option ROM size %x exceeds available space\n", size);
 824         return 0;
 825     }
 826
 827     addr = qemu_ram_alloc(total_size);
 828     cpu_register_physical_memory(0xd0000 + offset, total_size, addr | IO_MEM_ROM);
 829
 830     /* Write ROM data and devfn to phys_addr */
 831     cpu_physical_memory_write_rom(0xd0000 + offset, (uint8_t *)rom, size);
 832     cpu_physical_memory_write_rom(0xd0000 + offset + size, &devfn, 1);
 833
 834     return total_size;
 835 }
 836
 837 /*
 838  * Scan the assigned devices for the devices that have an option ROM, and then
 839  * load the corresponding ROM data to RAM. If an error occurs while loading an
 840  * option ROM, we just ignore that option ROM and continue with the next one.
 841  */
 842 ram_addr_t assigned_dev_load_option_roms(ram_addr_t rom_base_offset)
 843 {
 844     ram_addr_t offset = rom_base_offset;
 845     AssignedDevInfo *adev;
 846
 847     LIST_FOREACH(adev, &adev_head, next) {
 848         int size, len;
 849         void *buf;
 850         FILE *fp;
 851         uint8_t i = 1;
 852         char rom_file[64];
 853
 854         snprintf(rom_file, sizeof(rom_file),
 855                  "/sys/bus/pci/devices/0000:%02x:%02x.%01x/rom",
 856                  adev->bus, adev->dev, adev->func);
 857
 858         if (access(rom_file, F_OK))
 859             continue;
 860
 861         /* Write something to the ROM file to enable it */
 862         fp = fopen(rom_file, "wb");
 863         if (fp == NULL)
 864             continue;
 865         len = fwrite(&i, 1, 1, fp);
 866         fclose(fp);
 867         if (len != 1)
 868             continue;
 869
 870         /* The file has to be closed and reopened, otherwise it won't work */
 871         fp = fopen(rom_file, "rb");
 872         if (fp == NULL)
 873             continue;
 874
 875         fseek(fp, 0, SEEK_END);
 876         size = ftell(fp);
 877         fseek(fp, 0, SEEK_SET);
 878
 879         buf = malloc(size);
 880         if (buf == NULL) {
 881             fclose(fp);
 882             continue;
 883         }
 884
 885         fread(buf, size, 1, fp);
 886         if (!feof(fp) || ferror(fp)) {
 887             free(buf);
 888             fclose(fp);
 889             continue;
 890         }
 891
 892         /* Scan the buffer for suitable ROMs and increase the offset */
 893         offset += scan_option_rom(adev->assigned_dev->dev.devfn, buf, offset);
 894
 895         free(buf);
 896         fclose(fp);
 897     }
 898
 899     return offset;
 900 }