2 * Copyright (c) 2007, Neocleus Corporation.
4 * This work is licensed under the terms of the GNU GPL, version 2. See
5 * the COPYING file in the top-level directory.
8 * Assign a PCI device from the host to a guest VM.
10 * This implementation uses the classic device assignment interface of KVM
11 * and is only available on x86 hosts. It is expected to be obsoleted by VFIO
12 * based device assignment.
14 * Adapted for KVM (qemu-kvm) by Qumranet. QEMU version was based on qemu-kvm
15 * revision 4144fe9d48. See its repository for the history.
17 * Copyright (c) 2007, Neocleus, Alex Novik (alex@neocleus.com)
18 * Copyright (c) 2007, Neocleus, Guy Zana (guy@neocleus.com)
19 * Copyright (C) 2008, Qumranet, Amit Shah (amit.shah@qumranet.com)
20 * Copyright (C) 2008, Red Hat, Amit Shah (amit.shah@redhat.com)
21 * Copyright (C) 2008, IBM, Muli Ben-Yehuda (muli@il.ibm.com)
24 #include "qemu/osdep.h"
25 #include <linux/kvm.h>
26 #include "qapi/error.h"
28 #include "hw/i386/pc.h"
29 #include "qemu/error-report.h"
30 #include "ui/console.h"
31 #include "hw/loader.h"
32 #include "monitor/monitor.h"
33 #include "qemu/range.h"
34 #include "sysemu/sysemu.h"
35 #include "hw/pci/pci.h"
36 #include "hw/pci/msi.h"
38 #include "hw/pci/pci-assign.h"
40 /* From linux/ioport.h */
41 #define IORESOURCE_IO 0x00000100 /* Resource type */
42 #define IORESOURCE_MEM 0x00000200
43 #define IORESOURCE_IRQ 0x00000400
44 #define IORESOURCE_DMA 0x00000800
45 #define IORESOURCE_PREFETCH 0x00002000 /* No side effects */
46 #define IORESOURCE_MEM_64 0x00100000
48 typedef struct PCIRegion
{
49 int type
; /* Memory or port I/O */
52 uint64_t size
; /* size of the region */
56 typedef struct PCIDevRegions
{
57 uint8_t bus
, dev
, func
; /* Bus inside domain, device and function */
58 int irq
; /* IRQ number */
59 uint16_t region_number
; /* number of active regions */
61 /* Port I/O or MMIO Regions */
62 PCIRegion regions
[PCI_NUM_REGIONS
- 1];
66 typedef struct AssignedDevRegion
{
67 MemoryRegion container
;
68 MemoryRegion real_iomem
;
70 uint8_t *r_virtbase
; /* mmapped access address for memory regions */
71 uint32_t r_baseport
; /* the base guest port for I/O regions */
73 pcibus_t e_size
; /* emulated size of region in bytes */
74 pcibus_t r_size
; /* real size of region in bytes */
78 #define ASSIGNED_DEVICE_PREFER_MSI_BIT 0
79 #define ASSIGNED_DEVICE_SHARE_INTX_BIT 1
81 #define ASSIGNED_DEVICE_PREFER_MSI_MASK (1 << ASSIGNED_DEVICE_PREFER_MSI_BIT)
82 #define ASSIGNED_DEVICE_SHARE_INTX_MASK (1 << ASSIGNED_DEVICE_SHARE_INTX_BIT)
84 typedef struct MSIXTableEntry
{
91 typedef enum AssignedIRQType
{
92 ASSIGNED_IRQ_NONE
= 0,
93 ASSIGNED_IRQ_INTX_HOST_INTX
,
94 ASSIGNED_IRQ_INTX_HOST_MSI
,
99 typedef struct AssignedDevice
{
101 PCIHostDeviceAddress host
;
105 AssignedDevRegion v_addrs
[PCI_NUM_REGIONS
- 1];
106 PCIDevRegions real_device
;
107 PCIINTxRoute intx_route
;
108 AssignedIRQType assigned_irq_type
;
110 #define ASSIGNED_DEVICE_CAP_MSI (1 << 0)
111 #define ASSIGNED_DEVICE_CAP_MSIX (1 << 1)
113 #define ASSIGNED_DEVICE_MSI_ENABLED (1 << 0)
114 #define ASSIGNED_DEVICE_MSIX_ENABLED (1 << 1)
115 #define ASSIGNED_DEVICE_MSIX_MASKED (1 << 2)
118 uint8_t emulate_config_read
[PCI_CONFIG_SPACE_SIZE
];
119 uint8_t emulate_config_write
[PCI_CONFIG_SPACE_SIZE
];
122 MSIXTableEntry
*msix_table
;
123 hwaddr msix_table_addr
;
124 uint16_t msix_table_size
;
131 #define TYPE_PCI_ASSIGN "kvm-pci-assign"
132 #define PCI_ASSIGN(obj) OBJECT_CHECK(AssignedDevice, (obj), TYPE_PCI_ASSIGN)
134 static void assigned_dev_update_irq_routing(PCIDevice
*dev
);
136 static void assigned_dev_load_option_rom(AssignedDevice
*dev
);
138 static void assigned_dev_unregister_msix_mmio(AssignedDevice
*dev
);
140 static uint64_t assigned_dev_ioport_rw(AssignedDevRegion
*dev_region
,
141 hwaddr addr
, int size
,
145 int fd
= dev_region
->region
->resource_fd
;
148 DEBUG("pwrite data=%" PRIx64
", size=%d, e_phys=" TARGET_FMT_plx
149 ", addr="TARGET_FMT_plx
"\n", *data
, size
, addr
, addr
);
150 if (pwrite(fd
, data
, size
, addr
) != size
) {
151 error_report("%s - pwrite failed %s", __func__
, strerror(errno
));
154 if (pread(fd
, &val
, size
, addr
) != size
) {
155 error_report("%s - pread failed %s", __func__
, strerror(errno
));
156 val
= (1UL << (size
* 8)) - 1;
158 DEBUG("pread val=%" PRIx64
", size=%d, e_phys=" TARGET_FMT_plx
159 ", addr=" TARGET_FMT_plx
"\n", val
, size
, addr
, addr
);
164 static void assigned_dev_ioport_write(void *opaque
, hwaddr addr
,
165 uint64_t data
, unsigned size
)
167 assigned_dev_ioport_rw(opaque
, addr
, size
, &data
);
170 static uint64_t assigned_dev_ioport_read(void *opaque
,
171 hwaddr addr
, unsigned size
)
173 return assigned_dev_ioport_rw(opaque
, addr
, size
, NULL
);
176 static uint32_t slow_bar_readb(void *opaque
, hwaddr addr
)
178 AssignedDevRegion
*d
= opaque
;
179 uint8_t *in
= d
->u
.r_virtbase
+ addr
;
183 DEBUG("addr=0x" TARGET_FMT_plx
" val=0x%08x\n", addr
, r
);
188 static uint32_t slow_bar_readw(void *opaque
, hwaddr addr
)
190 AssignedDevRegion
*d
= opaque
;
191 uint16_t *in
= (uint16_t *)(d
->u
.r_virtbase
+ addr
);
195 DEBUG("addr=0x" TARGET_FMT_plx
" val=0x%08x\n", addr
, r
);
200 static uint32_t slow_bar_readl(void *opaque
, hwaddr addr
)
202 AssignedDevRegion
*d
= opaque
;
203 uint32_t *in
= (uint32_t *)(d
->u
.r_virtbase
+ addr
);
207 DEBUG("addr=0x" TARGET_FMT_plx
" val=0x%08x\n", addr
, r
);
212 static void slow_bar_writeb(void *opaque
, hwaddr addr
, uint32_t val
)
214 AssignedDevRegion
*d
= opaque
;
215 uint8_t *out
= d
->u
.r_virtbase
+ addr
;
217 DEBUG("addr=0x" TARGET_FMT_plx
" val=0x%02x\n", addr
, val
);
221 static void slow_bar_writew(void *opaque
, hwaddr addr
, uint32_t val
)
223 AssignedDevRegion
*d
= opaque
;
224 uint16_t *out
= (uint16_t *)(d
->u
.r_virtbase
+ addr
);
226 DEBUG("addr=0x" TARGET_FMT_plx
" val=0x%04x\n", addr
, val
);
230 static void slow_bar_writel(void *opaque
, hwaddr addr
, uint32_t val
)
232 AssignedDevRegion
*d
= opaque
;
233 uint32_t *out
= (uint32_t *)(d
->u
.r_virtbase
+ addr
);
235 DEBUG("addr=0x" TARGET_FMT_plx
" val=0x%08x\n", addr
, val
);
239 static const MemoryRegionOps slow_bar_ops
= {
241 .read
= { slow_bar_readb
, slow_bar_readw
, slow_bar_readl
, },
242 .write
= { slow_bar_writeb
, slow_bar_writew
, slow_bar_writel
, },
244 .endianness
= DEVICE_NATIVE_ENDIAN
,
247 static void assigned_dev_iomem_setup(PCIDevice
*pci_dev
, int region_num
,
250 AssignedDevice
*r_dev
= PCI_ASSIGN(pci_dev
);
251 AssignedDevRegion
*region
= &r_dev
->v_addrs
[region_num
];
252 PCIRegion
*real_region
= &r_dev
->real_device
.regions
[region_num
];
255 memory_region_init(®ion
->container
, OBJECT(pci_dev
),
256 "assigned-dev-container", e_size
);
257 memory_region_add_subregion(®ion
->container
, 0, ®ion
->real_iomem
);
259 /* deal with MSI-X MMIO page */
260 if (real_region
->base_addr
<= r_dev
->msix_table_addr
&&
261 real_region
->base_addr
+ real_region
->size
>
262 r_dev
->msix_table_addr
) {
263 uint64_t offset
= r_dev
->msix_table_addr
- real_region
->base_addr
;
265 memory_region_add_subregion_overlap(®ion
->container
,
273 static const MemoryRegionOps assigned_dev_ioport_ops
= {
274 .read
= assigned_dev_ioport_read
,
275 .write
= assigned_dev_ioport_write
,
276 .endianness
= DEVICE_NATIVE_ENDIAN
,
279 static void assigned_dev_ioport_setup(PCIDevice
*pci_dev
, int region_num
,
282 AssignedDevice
*r_dev
= PCI_ASSIGN(pci_dev
);
283 AssignedDevRegion
*region
= &r_dev
->v_addrs
[region_num
];
285 region
->e_size
= size
;
286 memory_region_init(®ion
->container
, OBJECT(pci_dev
),
287 "assigned-dev-container", size
);
288 memory_region_init_io(®ion
->real_iomem
, OBJECT(pci_dev
),
289 &assigned_dev_ioport_ops
, r_dev
->v_addrs
+ region_num
,
290 "assigned-dev-iomem", size
);
291 memory_region_add_subregion(®ion
->container
, 0, ®ion
->real_iomem
);
294 static uint32_t assigned_dev_pci_read(PCIDevice
*d
, int pos
, int len
)
296 AssignedDevice
*pci_dev
= PCI_ASSIGN(d
);
299 int fd
= pci_dev
->real_device
.config_fd
;
302 ret
= pread(fd
, &val
, len
, pos
);
304 if ((ret
< 0) && (errno
== EINTR
|| errno
== EAGAIN
)) {
308 hw_error("pci read failed, ret = %zd errno = %d\n", ret
, errno
);
314 static uint8_t assigned_dev_pci_read_byte(PCIDevice
*d
, int pos
)
316 return (uint8_t)assigned_dev_pci_read(d
, pos
, 1);
319 static void assigned_dev_pci_write(PCIDevice
*d
, int pos
, uint32_t val
, int len
)
321 AssignedDevice
*pci_dev
= PCI_ASSIGN(d
);
323 int fd
= pci_dev
->real_device
.config_fd
;
326 ret
= pwrite(fd
, &val
, len
, pos
);
328 if ((ret
< 0) && (errno
== EINTR
|| errno
== EAGAIN
)) {
332 hw_error("pci write failed, ret = %zd errno = %d\n", ret
, errno
);
336 static void assigned_dev_emulate_config_read(AssignedDevice
*dev
,
337 uint32_t offset
, uint32_t len
)
339 memset(dev
->emulate_config_read
+ offset
, 0xff, len
);
342 static void assigned_dev_direct_config_read(AssignedDevice
*dev
,
343 uint32_t offset
, uint32_t len
)
345 memset(dev
->emulate_config_read
+ offset
, 0, len
);
348 static void assigned_dev_direct_config_write(AssignedDevice
*dev
,
349 uint32_t offset
, uint32_t len
)
351 memset(dev
->emulate_config_write
+ offset
, 0, len
);
354 static uint8_t pci_find_cap_offset(PCIDevice
*d
, uint8_t cap
, uint8_t start
)
358 int pos
= start
? start
: PCI_CAPABILITY_LIST
;
361 status
= assigned_dev_pci_read_byte(d
, PCI_STATUS
);
362 if ((status
& PCI_STATUS_CAP_LIST
) == 0) {
367 pos
= assigned_dev_pci_read_byte(d
, pos
);
373 id
= assigned_dev_pci_read_byte(d
, pos
+ PCI_CAP_LIST_ID
);
382 pos
+= PCI_CAP_LIST_NEXT
;
387 static void assigned_dev_register_regions(PCIRegion
*io_regions
,
388 unsigned long regions_num
,
389 AssignedDevice
*pci_dev
,
393 PCIRegion
*cur_region
= io_regions
;
395 for (i
= 0; i
< regions_num
; i
++, cur_region
++) {
396 if (!cur_region
->valid
) {
400 /* handle memory io regions */
401 if (cur_region
->type
& IORESOURCE_MEM
) {
402 int t
= PCI_BASE_ADDRESS_SPACE_MEMORY
;
403 if (cur_region
->type
& IORESOURCE_PREFETCH
) {
404 t
|= PCI_BASE_ADDRESS_MEM_PREFETCH
;
406 if (cur_region
->type
& IORESOURCE_MEM_64
) {
407 t
|= PCI_BASE_ADDRESS_MEM_TYPE_64
;
410 /* map physical memory */
411 pci_dev
->v_addrs
[i
].u
.r_virtbase
= mmap(NULL
, cur_region
->size
,
412 PROT_WRITE
| PROT_READ
,
414 cur_region
->resource_fd
,
417 if (pci_dev
->v_addrs
[i
].u
.r_virtbase
== MAP_FAILED
) {
418 pci_dev
->v_addrs
[i
].u
.r_virtbase
= NULL
;
419 error_setg_errno(errp
, errno
, "Couldn't mmap 0x%" PRIx64
"!",
420 cur_region
->base_addr
);
424 pci_dev
->v_addrs
[i
].r_size
= cur_region
->size
;
425 pci_dev
->v_addrs
[i
].e_size
= 0;
428 pci_dev
->v_addrs
[i
].u
.r_virtbase
+=
429 (cur_region
->base_addr
& 0xFFF);
431 if (cur_region
->size
& 0xFFF) {
432 error_report("PCI region %d at address 0x%" PRIx64
" has "
433 "size 0x%" PRIx64
", which is not a multiple of "
434 "4K. You might experience some performance hit "
436 i
, cur_region
->base_addr
, cur_region
->size
);
437 memory_region_init_io(&pci_dev
->v_addrs
[i
].real_iomem
,
438 OBJECT(pci_dev
), &slow_bar_ops
,
439 &pci_dev
->v_addrs
[i
],
440 "assigned-dev-slow-bar",
443 void *virtbase
= pci_dev
->v_addrs
[i
].u
.r_virtbase
;
445 snprintf(name
, sizeof(name
), "%s.bar%d",
446 object_get_typename(OBJECT(pci_dev
)), i
);
447 memory_region_init_ram_ptr(&pci_dev
->v_addrs
[i
].real_iomem
,
448 OBJECT(pci_dev
), name
,
449 cur_region
->size
, virtbase
);
450 vmstate_register_ram(&pci_dev
->v_addrs
[i
].real_iomem
,
454 assigned_dev_iomem_setup(&pci_dev
->dev
, i
, cur_region
->size
);
455 pci_register_bar((PCIDevice
*) pci_dev
, i
, t
,
456 &pci_dev
->v_addrs
[i
].container
);
459 /* handle port io regions */
463 /* Test kernel support for ioport resource read/write. Old
464 * kernels return EIO. New kernels only allow 1/2/4 byte reads
465 * so should return EINVAL for a 3 byte read */
466 ret
= pread(pci_dev
->v_addrs
[i
].region
->resource_fd
, &val
, 3, 0);
468 error_report("Unexpected return from I/O port read: %d", ret
);
470 } else if (errno
!= EINVAL
) {
471 error_report("Kernel doesn't support ioport resource "
472 "access, hiding this region.");
473 close(pci_dev
->v_addrs
[i
].region
->resource_fd
);
474 cur_region
->valid
= 0;
478 pci_dev
->v_addrs
[i
].u
.r_baseport
= cur_region
->base_addr
;
479 pci_dev
->v_addrs
[i
].r_size
= cur_region
->size
;
480 pci_dev
->v_addrs
[i
].e_size
= 0;
482 assigned_dev_ioport_setup(&pci_dev
->dev
, i
, cur_region
->size
);
483 pci_register_bar((PCIDevice
*) pci_dev
, i
,
484 PCI_BASE_ADDRESS_SPACE_IO
,
485 &pci_dev
->v_addrs
[i
].container
);
492 static void get_real_id(const char *devpath
, const char *idname
, uint16_t *val
,
499 snprintf(name
, sizeof(name
), "%s%s", devpath
, idname
);
500 f
= fopen(name
, "r");
502 error_setg_file_open(errp
, errno
, name
);
505 if (fscanf(f
, "%li\n", &id
) == 1) {
508 error_setg(errp
, "Failed to parse contents of '%s'", name
);
513 static void get_real_vendor_id(const char *devpath
, uint16_t *val
,
516 get_real_id(devpath
, "vendor", val
, errp
);
519 static void get_real_device_id(const char *devpath
, uint16_t *val
,
522 get_real_id(devpath
, "device", val
, errp
);
525 static void get_real_device(AssignedDevice
*pci_dev
, Error
**errp
)
527 char dir
[128], name
[128];
530 uint64_t start
, end
, size
, flags
;
533 PCIDevRegions
*dev
= &pci_dev
->real_device
;
534 Error
*local_err
= NULL
;
536 dev
->region_number
= 0;
538 snprintf(dir
, sizeof(dir
), "/sys/bus/pci/devices/%04x:%02x:%02x.%x/",
539 pci_dev
->host
.domain
, pci_dev
->host
.bus
,
540 pci_dev
->host
.slot
, pci_dev
->host
.function
);
542 snprintf(name
, sizeof(name
), "%sconfig", dir
);
544 if (pci_dev
->configfd_name
&& *pci_dev
->configfd_name
) {
545 dev
->config_fd
= monitor_fd_param(cur_mon
, pci_dev
->configfd_name
,
548 error_propagate(errp
, local_err
);
552 dev
->config_fd
= open(name
, O_RDWR
);
554 if (dev
->config_fd
== -1) {
555 error_setg_file_open(errp
, errno
, name
);
560 r
= read(dev
->config_fd
, pci_dev
->dev
.config
,
561 pci_config_size(&pci_dev
->dev
));
563 if (errno
== EINTR
|| errno
== EAGAIN
) {
566 error_setg_errno(errp
, errno
, "read(\"%s\")",
567 (pci_dev
->configfd_name
&& *pci_dev
->configfd_name
) ?
568 pci_dev
->configfd_name
: name
);
572 /* Restore or clear multifunction, this is always controlled by qemu */
573 if (pci_dev
->dev
.cap_present
& QEMU_PCI_CAP_MULTIFUNCTION
) {
574 pci_dev
->dev
.config
[PCI_HEADER_TYPE
] |= PCI_HEADER_TYPE_MULTI_FUNCTION
;
576 pci_dev
->dev
.config
[PCI_HEADER_TYPE
] &= ~PCI_HEADER_TYPE_MULTI_FUNCTION
;
579 /* Clear host resource mapping info. If we choose not to register a
580 * BAR, such as might be the case with the option ROM, we can get
581 * confusing, unwritable, residual addresses from the host here. */
582 memset(&pci_dev
->dev
.config
[PCI_BASE_ADDRESS_0
], 0, 24);
583 memset(&pci_dev
->dev
.config
[PCI_ROM_ADDRESS
], 0, 4);
585 snprintf(name
, sizeof(name
), "%sresource", dir
);
587 f
= fopen(name
, "r");
589 error_setg_file_open(errp
, errno
, name
);
593 for (r
= 0; r
< PCI_ROM_SLOT
; r
++) {
594 if (fscanf(f
, "%" SCNi64
" %" SCNi64
" %" SCNi64
"\n",
595 &start
, &end
, &flags
) != 3) {
599 rp
= dev
->regions
+ r
;
601 rp
->resource_fd
= -1;
602 size
= end
- start
+ 1;
603 flags
&= IORESOURCE_IO
| IORESOURCE_MEM
| IORESOURCE_PREFETCH
605 if (size
== 0 || (flags
& ~IORESOURCE_PREFETCH
) == 0) {
608 if (flags
& IORESOURCE_MEM
) {
609 flags
&= ~IORESOURCE_IO
;
611 flags
&= ~IORESOURCE_PREFETCH
;
613 snprintf(name
, sizeof(name
), "%sresource%d", dir
, r
);
614 fd
= open(name
, O_RDWR
);
618 rp
->resource_fd
= fd
;
622 rp
->base_addr
= start
;
624 pci_dev
->v_addrs
[r
].region
= rp
;
625 DEBUG("region %d size %" PRIu64
" start 0x%" PRIx64
626 " type %d resource_fd %d\n",
627 r
, rp
->size
, start
, rp
->type
, rp
->resource_fd
);
632 /* read and fill vendor ID */
633 get_real_vendor_id(dir
, &id
, &local_err
);
635 error_propagate(errp
, local_err
);
638 pci_dev
->dev
.config
[0] = id
& 0xff;
639 pci_dev
->dev
.config
[1] = (id
& 0xff00) >> 8;
641 /* read and fill device ID */
642 get_real_device_id(dir
, &id
, &local_err
);
644 error_propagate(errp
, local_err
);
647 pci_dev
->dev
.config
[2] = id
& 0xff;
648 pci_dev
->dev
.config
[3] = (id
& 0xff00) >> 8;
650 pci_word_test_and_clear_mask(pci_dev
->emulate_config_write
+ PCI_COMMAND
,
651 PCI_COMMAND_MASTER
| PCI_COMMAND_INTX_DISABLE
);
653 dev
->region_number
= r
;
656 static void free_msi_virqs(AssignedDevice
*dev
)
660 for (i
= 0; i
< dev
->msi_virq_nr
; i
++) {
661 if (dev
->msi_virq
[i
] >= 0) {
662 kvm_irqchip_release_virq(kvm_state
, dev
->msi_virq
[i
]);
663 dev
->msi_virq
[i
] = -1;
666 g_free(dev
->msi_virq
);
667 dev
->msi_virq
= NULL
;
668 dev
->msi_virq_nr
= 0;
671 static void free_assigned_device(AssignedDevice
*dev
)
675 if (dev
->cap
.available
& ASSIGNED_DEVICE_CAP_MSIX
) {
676 assigned_dev_unregister_msix_mmio(dev
);
678 for (i
= 0; i
< dev
->real_device
.region_number
; i
++) {
679 PCIRegion
*pci_region
= &dev
->real_device
.regions
[i
];
680 AssignedDevRegion
*region
= &dev
->v_addrs
[i
];
682 if (!pci_region
->valid
) {
685 if (pci_region
->type
& IORESOURCE_IO
) {
686 if (region
->u
.r_baseport
) {
687 memory_region_del_subregion(®ion
->container
,
688 ®ion
->real_iomem
);
690 } else if (pci_region
->type
& IORESOURCE_MEM
) {
691 if (region
->u
.r_virtbase
) {
692 memory_region_del_subregion(®ion
->container
,
693 ®ion
->real_iomem
);
695 /* Remove MSI-X table subregion */
696 if (pci_region
->base_addr
<= dev
->msix_table_addr
&&
697 pci_region
->base_addr
+ pci_region
->size
>
698 dev
->msix_table_addr
) {
699 memory_region_del_subregion(®ion
->container
,
702 if (munmap(region
->u
.r_virtbase
,
703 (pci_region
->size
+ 0xFFF) & 0xFFFFF000)) {
704 error_report("Failed to unmap assigned device region: %s",
709 if (pci_region
->resource_fd
>= 0) {
710 close(pci_region
->resource_fd
);
714 if (dev
->real_device
.config_fd
>= 0) {
715 close(dev
->real_device
.config_fd
);
721 /* This function tries to determine the cause of the PCI assignment failure. It
722 * always returns the cause as a dynamically allocated, human readable string.
723 * If the function fails to determine the cause for any internal reason, then
724 * the returned string will state that fact.
726 static char *assign_failed_examine(const AssignedDevice
*dev
)
728 char name
[PATH_MAX
], dir
[PATH_MAX
], driver
[PATH_MAX
] = {}, *ns
;
729 uint16_t vendor_id
, device_id
;
731 Error
*local_err
= NULL
;
733 snprintf(dir
, sizeof(dir
), "/sys/bus/pci/devices/%04x:%02x:%02x.%01x/",
734 dev
->host
.domain
, dev
->host
.bus
, dev
->host
.slot
,
737 snprintf(name
, sizeof(name
), "%sdriver", dir
);
739 r
= readlink(name
, driver
, sizeof(driver
));
740 if ((r
<= 0) || r
>= sizeof(driver
)) {
745 ns
= strrchr(driver
, '/');
752 if ((get_real_vendor_id(dir
, &vendor_id
, &local_err
), local_err
) ||
753 (get_real_device_id(dir
, &device_id
, &local_err
), local_err
)) {
754 /* We're already analyzing an assignment error, so we suppress this
755 * one just like the others above.
757 error_free(local_err
);
761 return g_strdup_printf(
762 "*** The driver '%s' is occupying your device %04x:%02x:%02x.%x.\n"
764 "*** You can try the following commands to free it:\n"
766 "*** $ echo \"%04x %04x\" > /sys/bus/pci/drivers/pci-stub/new_id\n"
767 "*** $ echo \"%04x:%02x:%02x.%x\" > /sys/bus/pci/drivers/%s/unbind\n"
768 "*** $ echo \"%04x:%02x:%02x.%x\" > /sys/bus/pci/drivers/"
770 "*** $ echo \"%04x %04x\" > /sys/bus/pci/drivers/pci-stub/remove_id\n"
772 ns
, dev
->host
.domain
, dev
->host
.bus
, dev
->host
.slot
,
773 dev
->host
.function
, vendor_id
, device_id
,
774 dev
->host
.domain
, dev
->host
.bus
, dev
->host
.slot
, dev
->host
.function
,
775 ns
, dev
->host
.domain
, dev
->host
.bus
, dev
->host
.slot
,
776 dev
->host
.function
, vendor_id
, device_id
);
779 return g_strdup("Couldn't find out why.\n");
782 static void assign_device(AssignedDevice
*dev
, Error
**errp
)
784 uint32_t flags
= KVM_DEV_ASSIGN_ENABLE_IOMMU
;
787 /* Only pass non-zero PCI segment to capable module */
788 if (!kvm_check_extension(kvm_state
, KVM_CAP_PCI_SEGMENT
) &&
790 error_setg(errp
, "Can't assign device inside non-zero PCI segment "
791 "as this KVM module doesn't support it.");
795 if (!kvm_check_extension(kvm_state
, KVM_CAP_IOMMU
)) {
796 error_setg(errp
, "No IOMMU found. Unable to assign device \"%s\"",
801 if (dev
->features
& ASSIGNED_DEVICE_SHARE_INTX_MASK
&&
802 kvm_has_intx_set_mask()) {
803 flags
|= KVM_DEV_ASSIGN_PCI_2_3
;
806 r
= kvm_device_pci_assign(kvm_state
, &dev
->host
, flags
, &dev
->dev_id
);
812 cause
= assign_failed_examine(dev
);
813 error_setg_errno(errp
, -r
, "Failed to assign device \"%s\"",
815 error_append_hint(errp
, "%s", cause
);
820 error_setg_errno(errp
, -r
, "Failed to assign device \"%s\"",
827 static void verify_irqchip_in_kernel(Error
**errp
)
829 if (kvm_irqchip_in_kernel()) {
832 error_setg(errp
, "pci-assign requires KVM with in-kernel irqchip enabled");
835 static int assign_intx(AssignedDevice
*dev
, Error
**errp
)
837 AssignedIRQType new_type
;
838 PCIINTxRoute intx_route
;
841 Error
*local_err
= NULL
;
843 /* Interrupt PIN 0 means don't use INTx */
844 if (assigned_dev_pci_read_byte(&dev
->dev
, PCI_INTERRUPT_PIN
) == 0) {
845 pci_device_set_intx_routing_notifier(&dev
->dev
, NULL
);
849 verify_irqchip_in_kernel(&local_err
);
851 error_propagate(errp
, local_err
);
855 pci_device_set_intx_routing_notifier(&dev
->dev
,
856 assigned_dev_update_irq_routing
);
858 intx_route
= pci_device_route_intx_to_irq(&dev
->dev
, dev
->intpin
);
859 assert(intx_route
.mode
!= PCI_INTX_INVERTED
);
861 if (!pci_intx_route_changed(&dev
->intx_route
, &intx_route
)) {
865 switch (dev
->assigned_irq_type
) {
866 case ASSIGNED_IRQ_INTX_HOST_INTX
:
867 case ASSIGNED_IRQ_INTX_HOST_MSI
:
868 intx_host_msi
= dev
->assigned_irq_type
== ASSIGNED_IRQ_INTX_HOST_MSI
;
869 r
= kvm_device_intx_deassign(kvm_state
, dev
->dev_id
, intx_host_msi
);
871 case ASSIGNED_IRQ_MSI
:
872 r
= kvm_device_msi_deassign(kvm_state
, dev
->dev_id
);
874 case ASSIGNED_IRQ_MSIX
:
875 r
= kvm_device_msix_deassign(kvm_state
, dev
->dev_id
);
882 perror("assign_intx: deassignment of previous interrupt failed");
884 dev
->assigned_irq_type
= ASSIGNED_IRQ_NONE
;
886 if (intx_route
.mode
== PCI_INTX_DISABLED
) {
887 dev
->intx_route
= intx_route
;
892 if (dev
->features
& ASSIGNED_DEVICE_PREFER_MSI_MASK
&&
893 dev
->cap
.available
& ASSIGNED_DEVICE_CAP_MSI
) {
894 intx_host_msi
= true;
895 new_type
= ASSIGNED_IRQ_INTX_HOST_MSI
;
897 intx_host_msi
= false;
898 new_type
= ASSIGNED_IRQ_INTX_HOST_INTX
;
901 r
= kvm_device_intx_assign(kvm_state
, dev
->dev_id
, intx_host_msi
,
904 if (r
== -EIO
&& !(dev
->features
& ASSIGNED_DEVICE_PREFER_MSI_MASK
) &&
905 dev
->cap
.available
& ASSIGNED_DEVICE_CAP_MSI
) {
906 /* Retry with host-side MSI. There might be an IRQ conflict and
907 * either the kernel or the device doesn't support sharing. */
908 error_report("Host-side INTx sharing not supported, "
909 "using MSI instead");
910 error_printf("Some devices do not work properly in this mode.\n");
911 dev
->features
|= ASSIGNED_DEVICE_PREFER_MSI_MASK
;
914 error_setg_errno(errp
, -r
, "Failed to assign irq for \"%s\"",
916 error_append_hint(errp
, "Perhaps you are assigning a device "
917 "that shares an IRQ with another device?\n");
921 dev
->intx_route
= intx_route
;
922 dev
->assigned_irq_type
= new_type
;
926 static void deassign_device(AssignedDevice
*dev
)
930 r
= kvm_device_pci_deassign(kvm_state
, dev
->dev_id
);
934 /* The pci config space got updated. Check if irq numbers have changed
937 static void assigned_dev_update_irq_routing(PCIDevice
*dev
)
939 AssignedDevice
*assigned_dev
= PCI_ASSIGN(dev
);
943 r
= assign_intx(assigned_dev
, &err
);
945 error_report_err(err
);
947 qdev_unplug(&dev
->qdev
, &err
);
952 static void assigned_dev_update_msi(PCIDevice
*pci_dev
)
954 AssignedDevice
*assigned_dev
= PCI_ASSIGN(pci_dev
);
955 uint8_t ctrl_byte
= pci_get_byte(pci_dev
->config
+ pci_dev
->msi_cap
+
959 /* Some guests gratuitously disable MSI even if they're not using it,
960 * try to catch this by only deassigning irqs if the guest is using
961 * MSI or intends to start. */
962 if (assigned_dev
->assigned_irq_type
== ASSIGNED_IRQ_MSI
||
963 (ctrl_byte
& PCI_MSI_FLAGS_ENABLE
)) {
964 r
= kvm_device_msi_deassign(kvm_state
, assigned_dev
->dev_id
);
965 /* -ENXIO means no assigned irq */
966 if (r
&& r
!= -ENXIO
) {
967 perror("assigned_dev_update_msi: deassign irq");
970 free_msi_virqs(assigned_dev
);
972 assigned_dev
->assigned_irq_type
= ASSIGNED_IRQ_NONE
;
973 pci_device_set_intx_routing_notifier(pci_dev
, NULL
);
976 if (ctrl_byte
& PCI_MSI_FLAGS_ENABLE
) {
979 virq
= kvm_irqchip_add_msi_route(kvm_state
, 0, pci_dev
);
981 perror("assigned_dev_update_msi: kvm_irqchip_add_msi_route");
985 assigned_dev
->msi_virq
= g_malloc(sizeof(*assigned_dev
->msi_virq
));
986 assigned_dev
->msi_virq_nr
= 1;
987 assigned_dev
->msi_virq
[0] = virq
;
988 if (kvm_device_msi_assign(kvm_state
, assigned_dev
->dev_id
, virq
) < 0) {
989 perror("assigned_dev_update_msi: kvm_device_msi_assign");
992 assigned_dev
->intx_route
.mode
= PCI_INTX_DISABLED
;
993 assigned_dev
->intx_route
.irq
= -1;
994 assigned_dev
->assigned_irq_type
= ASSIGNED_IRQ_MSI
;
996 Error
*local_err
= NULL
;
998 assign_intx(assigned_dev
, &local_err
);
1000 error_report_err(local_err
);
1005 static void assigned_dev_update_msi_msg(PCIDevice
*pci_dev
)
1007 AssignedDevice
*assigned_dev
= PCI_ASSIGN(pci_dev
);
1008 uint8_t ctrl_byte
= pci_get_byte(pci_dev
->config
+ pci_dev
->msi_cap
+
1011 if (assigned_dev
->assigned_irq_type
!= ASSIGNED_IRQ_MSI
||
1012 !(ctrl_byte
& PCI_MSI_FLAGS_ENABLE
)) {
1016 kvm_irqchip_update_msi_route(kvm_state
, assigned_dev
->msi_virq
[0],
1017 msi_get_message(pci_dev
, 0), pci_dev
);
1018 kvm_irqchip_commit_routes(kvm_state
);
1021 static bool assigned_dev_msix_masked(MSIXTableEntry
*entry
)
1023 return (entry
->ctrl
& cpu_to_le32(0x1)) != 0;
1027 * When MSI-X is first enabled the vector table typically has all the
1028 * vectors masked, so we can't use that as the obvious test to figure out
1029 * how many vectors to initially enable. Instead we look at the data field
1030 * because this is what worked for pci-assign for a long time. This makes
1031 * sure the physical MSI-X state tracks the guest's view, which is important
1032 * for some VF/PF and PF/fw communication channels.
1034 static bool assigned_dev_msix_skipped(MSIXTableEntry
*entry
)
1036 return !entry
->data
;
1039 static int assigned_dev_update_msix_mmio(PCIDevice
*pci_dev
)
1041 AssignedDevice
*adev
= PCI_ASSIGN(pci_dev
);
1042 uint16_t entries_nr
= 0;
1044 MSIXTableEntry
*entry
= adev
->msix_table
;
1046 /* Get the usable entry number for allocating */
1047 for (i
= 0; i
< adev
->msix_max
; i
++, entry
++) {
1048 if (assigned_dev_msix_skipped(entry
)) {
1054 DEBUG("MSI-X entries: %d\n", entries_nr
);
1056 /* It's valid to enable MSI-X with all entries masked */
1061 r
= kvm_device_msix_init_vectors(kvm_state
, adev
->dev_id
, entries_nr
);
1063 error_report("fail to set MSI-X entry number for MSIX! %s",
1068 free_msi_virqs(adev
);
1070 adev
->msi_virq_nr
= adev
->msix_max
;
1071 adev
->msi_virq
= g_malloc(adev
->msix_max
* sizeof(*adev
->msi_virq
));
1073 entry
= adev
->msix_table
;
1074 for (i
= 0; i
< adev
->msix_max
; i
++, entry
++) {
1075 adev
->msi_virq
[i
] = -1;
1077 if (assigned_dev_msix_skipped(entry
)) {
1081 r
= kvm_irqchip_add_msi_route(kvm_state
, i
, pci_dev
);
1085 adev
->msi_virq
[i
] = r
;
1087 DEBUG("MSI-X vector %d, gsi %d, addr %08x_%08x, data %08x\n", i
,
1088 r
, entry
->addr_hi
, entry
->addr_lo
, entry
->data
);
1090 r
= kvm_device_msix_set_vector(kvm_state
, adev
->dev_id
, i
,
1093 error_report("fail to set MSI-X entry! %s", strerror(-r
));
1101 static void assigned_dev_update_msix(PCIDevice
*pci_dev
)
1103 AssignedDevice
*assigned_dev
= PCI_ASSIGN(pci_dev
);
1104 uint16_t ctrl_word
= pci_get_word(pci_dev
->config
+ pci_dev
->msix_cap
+
1108 /* Some guests gratuitously disable MSIX even if they're not using it,
1109 * try to catch this by only deassigning irqs if the guest is using
1110 * MSIX or intends to start. */
1111 if ((assigned_dev
->assigned_irq_type
== ASSIGNED_IRQ_MSIX
) ||
1112 (ctrl_word
& PCI_MSIX_FLAGS_ENABLE
)) {
1113 r
= kvm_device_msix_deassign(kvm_state
, assigned_dev
->dev_id
);
1114 /* -ENXIO means no assigned irq */
1115 if (r
&& r
!= -ENXIO
) {
1116 perror("assigned_dev_update_msix: deassign irq");
1119 free_msi_virqs(assigned_dev
);
1121 assigned_dev
->assigned_irq_type
= ASSIGNED_IRQ_NONE
;
1122 pci_device_set_intx_routing_notifier(pci_dev
, NULL
);
1125 if (ctrl_word
& PCI_MSIX_FLAGS_ENABLE
) {
1126 if (assigned_dev_update_msix_mmio(pci_dev
) < 0) {
1127 perror("assigned_dev_update_msix_mmio");
1131 if (assigned_dev
->msi_virq_nr
> 0) {
1132 if (kvm_device_msix_assign(kvm_state
, assigned_dev
->dev_id
) < 0) {
1133 perror("assigned_dev_enable_msix: assign irq");
1137 assigned_dev
->intx_route
.mode
= PCI_INTX_DISABLED
;
1138 assigned_dev
->intx_route
.irq
= -1;
1139 assigned_dev
->assigned_irq_type
= ASSIGNED_IRQ_MSIX
;
1141 Error
*local_err
= NULL
;
1143 assign_intx(assigned_dev
, &local_err
);
1145 error_report_err(local_err
);
1150 static uint32_t assigned_dev_pci_read_config(PCIDevice
*pci_dev
,
1151 uint32_t address
, int len
)
1153 AssignedDevice
*assigned_dev
= PCI_ASSIGN(pci_dev
);
1154 uint32_t virt_val
= pci_default_read_config(pci_dev
, address
, len
);
1155 uint32_t real_val
, emulate_mask
, full_emulation_mask
;
1158 memcpy(&emulate_mask
, assigned_dev
->emulate_config_read
+ address
, len
);
1159 emulate_mask
= le32_to_cpu(emulate_mask
);
1161 full_emulation_mask
= 0xffffffff >> (32 - len
* 8);
1163 if (emulate_mask
!= full_emulation_mask
) {
1164 real_val
= assigned_dev_pci_read(pci_dev
, address
, len
);
1165 return (virt_val
& emulate_mask
) | (real_val
& ~emulate_mask
);
1171 static void assigned_dev_pci_write_config(PCIDevice
*pci_dev
, uint32_t address
,
1172 uint32_t val
, int len
)
1174 AssignedDevice
*assigned_dev
= PCI_ASSIGN(pci_dev
);
1175 uint16_t old_cmd
= pci_get_word(pci_dev
->config
+ PCI_COMMAND
);
1176 uint32_t emulate_mask
, full_emulation_mask
;
1179 pci_default_write_config(pci_dev
, address
, val
, len
);
1181 if (kvm_has_intx_set_mask() &&
1182 range_covers_byte(address
, len
, PCI_COMMAND
+ 1)) {
1183 bool intx_masked
= (pci_get_word(pci_dev
->config
+ PCI_COMMAND
) &
1184 PCI_COMMAND_INTX_DISABLE
);
1186 if (intx_masked
!= !!(old_cmd
& PCI_COMMAND_INTX_DISABLE
)) {
1187 ret
= kvm_device_intx_set_mask(kvm_state
, assigned_dev
->dev_id
,
1190 perror("assigned_dev_pci_write_config: set intx mask");
1194 if (assigned_dev
->cap
.available
& ASSIGNED_DEVICE_CAP_MSI
) {
1195 if (range_covers_byte(address
, len
,
1196 pci_dev
->msi_cap
+ PCI_MSI_FLAGS
)) {
1197 assigned_dev_update_msi(pci_dev
);
1198 } else if (ranges_overlap(address
, len
, /* 32bit MSI only */
1199 pci_dev
->msi_cap
+ PCI_MSI_ADDRESS_LO
, 6)) {
1200 assigned_dev_update_msi_msg(pci_dev
);
1203 if (assigned_dev
->cap
.available
& ASSIGNED_DEVICE_CAP_MSIX
) {
1204 if (range_covers_byte(address
, len
,
1205 pci_dev
->msix_cap
+ PCI_MSIX_FLAGS
+ 1)) {
1206 assigned_dev_update_msix(pci_dev
);
1211 memcpy(&emulate_mask
, assigned_dev
->emulate_config_write
+ address
, len
);
1212 emulate_mask
= le32_to_cpu(emulate_mask
);
1214 full_emulation_mask
= 0xffffffff >> (32 - len
* 8);
1216 if (emulate_mask
!= full_emulation_mask
) {
1218 val
&= ~emulate_mask
;
1219 val
|= assigned_dev_pci_read(pci_dev
, address
, len
) & emulate_mask
;
1221 assigned_dev_pci_write(pci_dev
, address
, val
, len
);
1225 static void assigned_dev_setup_cap_read(AssignedDevice
*dev
, uint32_t offset
,
1228 assigned_dev_direct_config_read(dev
, offset
, len
);
1229 assigned_dev_emulate_config_read(dev
, offset
+ PCI_CAP_LIST_NEXT
, 1);
1232 static int assigned_device_pci_cap_init(PCIDevice
*pci_dev
, Error
**errp
)
1234 AssignedDevice
*dev
= PCI_ASSIGN(pci_dev
);
1235 PCIRegion
*pci_region
= dev
->real_device
.regions
;
1237 Error
*local_err
= NULL
;
1239 /* Clear initial capabilities pointer and status copied from hw */
1240 pci_set_byte(pci_dev
->config
+ PCI_CAPABILITY_LIST
, 0);
1241 pci_set_word(pci_dev
->config
+ PCI_STATUS
,
1242 pci_get_word(pci_dev
->config
+ PCI_STATUS
) &
1243 ~PCI_STATUS_CAP_LIST
);
1245 /* Expose MSI capability
1246 * MSI capability is the 1st capability in capability config */
1247 pos
= pci_find_cap_offset(pci_dev
, PCI_CAP_ID_MSI
, 0);
1248 if (pos
!= 0 && kvm_check_extension(kvm_state
, KVM_CAP_ASSIGN_DEV_IRQ
)) {
1249 verify_irqchip_in_kernel(&local_err
);
1251 error_propagate(errp
, local_err
);
1254 dev
->dev
.cap_present
|= QEMU_PCI_CAP_MSI
;
1255 dev
->cap
.available
|= ASSIGNED_DEVICE_CAP_MSI
;
1256 /* Only 32-bit/no-mask currently supported */
1257 ret
= pci_add_capability2(pci_dev
, PCI_CAP_ID_MSI
, pos
, 10,
1260 error_propagate(errp
, local_err
);
1263 pci_dev
->msi_cap
= pos
;
1265 pci_set_word(pci_dev
->config
+ pos
+ PCI_MSI_FLAGS
,
1266 pci_get_word(pci_dev
->config
+ pos
+ PCI_MSI_FLAGS
) &
1267 PCI_MSI_FLAGS_QMASK
);
1268 pci_set_long(pci_dev
->config
+ pos
+ PCI_MSI_ADDRESS_LO
, 0);
1269 pci_set_word(pci_dev
->config
+ pos
+ PCI_MSI_DATA_32
, 0);
1271 /* Set writable fields */
1272 pci_set_word(pci_dev
->wmask
+ pos
+ PCI_MSI_FLAGS
,
1273 PCI_MSI_FLAGS_QSIZE
| PCI_MSI_FLAGS_ENABLE
);
1274 pci_set_long(pci_dev
->wmask
+ pos
+ PCI_MSI_ADDRESS_LO
, 0xfffffffc);
1275 pci_set_word(pci_dev
->wmask
+ pos
+ PCI_MSI_DATA_32
, 0xffff);
1277 /* Expose MSI-X capability */
1278 pos
= pci_find_cap_offset(pci_dev
, PCI_CAP_ID_MSIX
, 0);
1279 if (pos
!= 0 && kvm_device_msix_supported(kvm_state
)) {
1281 uint32_t msix_table_entry
;
1284 verify_irqchip_in_kernel(&local_err
);
1286 error_propagate(errp
, local_err
);
1289 dev
->dev
.cap_present
|= QEMU_PCI_CAP_MSIX
;
1290 dev
->cap
.available
|= ASSIGNED_DEVICE_CAP_MSIX
;
1291 ret
= pci_add_capability2(pci_dev
, PCI_CAP_ID_MSIX
, pos
, 12,
1294 error_propagate(errp
, local_err
);
1297 pci_dev
->msix_cap
= pos
;
1299 msix_max
= (pci_get_word(pci_dev
->config
+ pos
+ PCI_MSIX_FLAGS
) &
1300 PCI_MSIX_FLAGS_QSIZE
) + 1;
1301 msix_max
= MIN(msix_max
, KVM_MAX_MSIX_PER_DEV
);
1302 pci_set_word(pci_dev
->config
+ pos
+ PCI_MSIX_FLAGS
, msix_max
- 1);
1304 /* Only enable and function mask bits are writable */
1305 pci_set_word(pci_dev
->wmask
+ pos
+ PCI_MSIX_FLAGS
,
1306 PCI_MSIX_FLAGS_ENABLE
| PCI_MSIX_FLAGS_MASKALL
);
1308 msix_table_entry
= pci_get_long(pci_dev
->config
+ pos
+ PCI_MSIX_TABLE
);
1309 bar_nr
= msix_table_entry
& PCI_MSIX_FLAGS_BIRMASK
;
1310 msix_table_entry
&= ~PCI_MSIX_FLAGS_BIRMASK
;
1311 dev
->msix_table_addr
= pci_region
[bar_nr
].base_addr
+ msix_table_entry
;
1312 dev
->msix_table_size
= msix_max
* sizeof(MSIXTableEntry
);
1313 dev
->msix_max
= msix_max
;
1316 /* Minimal PM support, nothing writable, device appears to NAK changes */
1317 pos
= pci_find_cap_offset(pci_dev
, PCI_CAP_ID_PM
, 0);
1321 ret
= pci_add_capability2(pci_dev
, PCI_CAP_ID_PM
, pos
, PCI_PM_SIZEOF
,
1324 error_propagate(errp
, local_err
);
1328 assigned_dev_setup_cap_read(dev
, pos
, PCI_PM_SIZEOF
);
1330 pmc
= pci_get_word(pci_dev
->config
+ pos
+ PCI_CAP_FLAGS
);
1331 pmc
&= (PCI_PM_CAP_VER_MASK
| PCI_PM_CAP_DSI
);
1332 pci_set_word(pci_dev
->config
+ pos
+ PCI_CAP_FLAGS
, pmc
);
1334 /* assign_device will bring the device up to D0, so we don't need
1335 * to worry about doing that ourselves here. */
1336 pci_set_word(pci_dev
->config
+ pos
+ PCI_PM_CTRL
,
1337 PCI_PM_CTRL_NO_SOFT_RESET
);
1339 pci_set_byte(pci_dev
->config
+ pos
+ PCI_PM_PPB_EXTENSIONS
, 0);
1340 pci_set_byte(pci_dev
->config
+ pos
+ PCI_PM_DATA_REGISTER
, 0);
1343 pos
= pci_find_cap_offset(pci_dev
, PCI_CAP_ID_EXP
, 0);
1345 uint8_t version
, size
= 0;
1346 uint16_t type
, devctl
, lnksta
;
1347 uint32_t devcap
, lnkcap
;
1349 version
= pci_get_byte(pci_dev
->config
+ pos
+ PCI_EXP_FLAGS
);
1350 version
&= PCI_EXP_FLAGS_VERS
;
1353 } else if (version
== 2) {
1355 * Check for non-std size, accept reduced size to 0x34,
1356 * which is what bcm5761 implemented, violating the
1357 * PCIe v3.0 spec that regs should exist and be read as 0,
1358 * not optionally provided and shorten the struct size.
1360 size
= MIN(0x3c, PCI_CONFIG_SPACE_SIZE
- pos
);
1362 error_setg(errp
, "Invalid size PCIe cap-id 0x%x",
1365 } else if (size
!= 0x3c) {
1366 error_report("WARNING, %s: PCIe cap-id 0x%x has "
1367 "non-standard size 0x%x; std size should be 0x3c",
1368 __func__
, PCI_CAP_ID_EXP
, size
);
1370 } else if (version
== 0) {
1372 vid
= pci_get_word(pci_dev
->config
+ PCI_VENDOR_ID
);
1373 did
= pci_get_word(pci_dev
->config
+ PCI_DEVICE_ID
);
1374 if (vid
== PCI_VENDOR_ID_INTEL
&& did
== 0x10ed) {
1376 * quirk for Intel 82599 VF with invalid PCIe capability
1377 * version, should really be version 2 (same as PF)
1384 error_setg(errp
, "Unsupported PCI express capability version %d",
1389 ret
= pci_add_capability2(pci_dev
, PCI_CAP_ID_EXP
, pos
, size
,
1392 error_propagate(errp
, local_err
);
1396 assigned_dev_setup_cap_read(dev
, pos
, size
);
1398 type
= pci_get_word(pci_dev
->config
+ pos
+ PCI_EXP_FLAGS
);
1399 type
= (type
& PCI_EXP_FLAGS_TYPE
) >> 4;
1400 if (type
!= PCI_EXP_TYPE_ENDPOINT
&&
1401 type
!= PCI_EXP_TYPE_LEG_END
&& type
!= PCI_EXP_TYPE_RC_END
) {
1402 error_setg(errp
, "Device assignment only supports endpoint "
1403 "assignment, device type %d", type
);
1407 /* capabilities, pass existing read-only copy
1408 * PCI_EXP_FLAGS_IRQ: updated by hardware, should be direct read */
1410 /* device capabilities: hide FLR */
1411 devcap
= pci_get_long(pci_dev
->config
+ pos
+ PCI_EXP_DEVCAP
);
1412 devcap
&= ~PCI_EXP_DEVCAP_FLR
;
1413 pci_set_long(pci_dev
->config
+ pos
+ PCI_EXP_DEVCAP
, devcap
);
1415 /* device control: clear all error reporting enable bits, leaving
1416 * only a few host values. Note, these are
1417 * all writable, but not passed to hw.
1419 devctl
= pci_get_word(pci_dev
->config
+ pos
+ PCI_EXP_DEVCTL
);
1420 devctl
= (devctl
& (PCI_EXP_DEVCTL_READRQ
| PCI_EXP_DEVCTL_PAYLOAD
)) |
1421 PCI_EXP_DEVCTL_RELAX_EN
| PCI_EXP_DEVCTL_NOSNOOP_EN
;
1422 pci_set_word(pci_dev
->config
+ pos
+ PCI_EXP_DEVCTL
, devctl
);
1423 devctl
= PCI_EXP_DEVCTL_BCR_FLR
| PCI_EXP_DEVCTL_AUX_PME
;
1424 pci_set_word(pci_dev
->wmask
+ pos
+ PCI_EXP_DEVCTL
, ~devctl
);
1426 /* Clear device status */
1427 pci_set_word(pci_dev
->config
+ pos
+ PCI_EXP_DEVSTA
, 0);
1429 /* Link capabilities, expose links and latencues, clear reporting */
1430 lnkcap
= pci_get_long(pci_dev
->config
+ pos
+ PCI_EXP_LNKCAP
);
1431 lnkcap
&= (PCI_EXP_LNKCAP_SLS
| PCI_EXP_LNKCAP_MLW
|
1432 PCI_EXP_LNKCAP_ASPMS
| PCI_EXP_LNKCAP_L0SEL
|
1433 PCI_EXP_LNKCAP_L1EL
);
1434 pci_set_long(pci_dev
->config
+ pos
+ PCI_EXP_LNKCAP
, lnkcap
);
1436 /* Link control, pass existing read-only copy. Should be writable? */
1438 /* Link status, only expose current speed and width */
1439 lnksta
= pci_get_word(pci_dev
->config
+ pos
+ PCI_EXP_LNKSTA
);
1440 lnksta
&= (PCI_EXP_LNKSTA_CLS
| PCI_EXP_LNKSTA_NLW
);
1441 pci_set_word(pci_dev
->config
+ pos
+ PCI_EXP_LNKSTA
, lnksta
);
1444 /* Slot capabilities, control, status - not needed for endpoints */
1445 pci_set_long(pci_dev
->config
+ pos
+ PCI_EXP_SLTCAP
, 0);
1446 pci_set_word(pci_dev
->config
+ pos
+ PCI_EXP_SLTCTL
, 0);
1447 pci_set_word(pci_dev
->config
+ pos
+ PCI_EXP_SLTSTA
, 0);
1449 /* Root control, capabilities, status - not needed for endpoints */
1450 pci_set_word(pci_dev
->config
+ pos
+ PCI_EXP_RTCTL
, 0);
1451 pci_set_word(pci_dev
->config
+ pos
+ PCI_EXP_RTCAP
, 0);
1452 pci_set_long(pci_dev
->config
+ pos
+ PCI_EXP_RTSTA
, 0);
1454 /* Device capabilities/control 2, pass existing read-only copy */
1455 /* Link control 2, pass existing read-only copy */
1459 pos
= pci_find_cap_offset(pci_dev
, PCI_CAP_ID_PCIX
, 0);
1464 /* Only expose the minimum, 8 byte capability */
1465 ret
= pci_add_capability2(pci_dev
, PCI_CAP_ID_PCIX
, pos
, 8,
1468 error_propagate(errp
, local_err
);
1472 assigned_dev_setup_cap_read(dev
, pos
, 8);
1474 /* Command register, clear upper bits, including extended modes */
1475 cmd
= pci_get_word(pci_dev
->config
+ pos
+ PCI_X_CMD
);
1476 cmd
&= (PCI_X_CMD_DPERR_E
| PCI_X_CMD_ERO
| PCI_X_CMD_MAX_READ
|
1477 PCI_X_CMD_MAX_SPLIT
);
1478 pci_set_word(pci_dev
->config
+ pos
+ PCI_X_CMD
, cmd
);
1480 /* Status register, update with emulated PCI bus location, clear
1481 * error bits, leave the rest. */
1482 status
= pci_get_long(pci_dev
->config
+ pos
+ PCI_X_STATUS
);
1483 status
&= ~(PCI_X_STATUS_BUS
| PCI_X_STATUS_DEVFN
);
1484 status
|= pci_get_bdf(pci_dev
);
1485 status
&= ~(PCI_X_STATUS_SPL_DISC
| PCI_X_STATUS_UNX_SPL
|
1486 PCI_X_STATUS_SPL_ERR
);
1487 pci_set_long(pci_dev
->config
+ pos
+ PCI_X_STATUS
, status
);
1490 pos
= pci_find_cap_offset(pci_dev
, PCI_CAP_ID_VPD
, 0);
1492 /* Direct R/W passthrough */
1493 ret
= pci_add_capability2(pci_dev
, PCI_CAP_ID_VPD
, pos
, 8,
1496 error_propagate(errp
, local_err
);
1500 assigned_dev_setup_cap_read(dev
, pos
, 8);
1502 /* direct write for cap content */
1503 assigned_dev_direct_config_write(dev
, pos
+ 2, 6);
1506 /* Devices can have multiple vendor capabilities, get them all */
1507 for (pos
= 0; (pos
= pci_find_cap_offset(pci_dev
, PCI_CAP_ID_VNDR
, pos
));
1508 pos
+= PCI_CAP_LIST_NEXT
) {
1509 uint8_t len
= pci_get_byte(pci_dev
->config
+ pos
+ PCI_CAP_FLAGS
);
1510 /* Direct R/W passthrough */
1511 ret
= pci_add_capability2(pci_dev
, PCI_CAP_ID_VNDR
, pos
, len
,
1514 error_propagate(errp
, local_err
);
1518 assigned_dev_setup_cap_read(dev
, pos
, len
);
1520 /* direct write for cap content */
1521 assigned_dev_direct_config_write(dev
, pos
+ 2, len
- 2);
1524 /* If real and virtual capability list status bits differ, virtualize the
1526 if ((pci_get_word(pci_dev
->config
+ PCI_STATUS
) & PCI_STATUS_CAP_LIST
) !=
1527 (assigned_dev_pci_read_byte(pci_dev
, PCI_STATUS
) &
1528 PCI_STATUS_CAP_LIST
)) {
1529 dev
->emulate_config_read
[PCI_STATUS
] |= PCI_STATUS_CAP_LIST
;
1536 assigned_dev_msix_mmio_read(void *opaque
, hwaddr addr
,
1539 AssignedDevice
*adev
= opaque
;
1542 memcpy(&val
, (void *)((uint8_t *)adev
->msix_table
+ addr
), size
);
1547 static void assigned_dev_msix_mmio_write(void *opaque
, hwaddr addr
,
1548 uint64_t val
, unsigned size
)
1550 AssignedDevice
*adev
= opaque
;
1551 PCIDevice
*pdev
= &adev
->dev
;
1553 MSIXTableEntry orig
;
1556 if (i
>= adev
->msix_max
) {
1557 return; /* Drop write */
1560 ctrl
= pci_get_word(pdev
->config
+ pdev
->msix_cap
+ PCI_MSIX_FLAGS
);
1562 DEBUG("write to MSI-X table offset 0x%lx, val 0x%lx\n", addr
, val
);
1564 if (ctrl
& PCI_MSIX_FLAGS_ENABLE
) {
1565 orig
= adev
->msix_table
[i
];
1568 memcpy((uint8_t *)adev
->msix_table
+ addr
, &val
, size
);
1570 if (ctrl
& PCI_MSIX_FLAGS_ENABLE
) {
1571 MSIXTableEntry
*entry
= &adev
->msix_table
[i
];
1573 if (!assigned_dev_msix_masked(&orig
) &&
1574 assigned_dev_msix_masked(entry
)) {
1576 * Vector masked, disable it
1578 * XXX It's not clear if we can or should actually attempt
1579 * to mask or disable the interrupt. KVM doesn't have
1580 * support for pending bits and kvm_assign_set_msix_entry
1581 * doesn't modify the device hardware mask. Interrupts
1582 * while masked are simply not injected to the guest, so
1583 * are lost. Can we get away with always injecting an
1584 * interrupt on unmask?
1586 } else if (assigned_dev_msix_masked(&orig
) &&
1587 !assigned_dev_msix_masked(entry
)) {
1588 /* Vector unmasked */
1589 if (i
>= adev
->msi_virq_nr
|| adev
->msi_virq
[i
] < 0) {
1590 /* Previously unassigned vector, start from scratch */
1591 assigned_dev_update_msix(pdev
);
1594 /* Update an existing, previously masked vector */
1598 msg
.address
= entry
->addr_lo
|
1599 ((uint64_t)entry
->addr_hi
<< 32);
1600 msg
.data
= entry
->data
;
1602 ret
= kvm_irqchip_update_msi_route(kvm_state
,
1603 adev
->msi_virq
[i
], msg
,
1606 error_report("Error updating irq routing entry (%d)", ret
);
1608 kvm_irqchip_commit_routes(kvm_state
);
1614 static const MemoryRegionOps assigned_dev_msix_mmio_ops
= {
1615 .read
= assigned_dev_msix_mmio_read
,
1616 .write
= assigned_dev_msix_mmio_write
,
1617 .endianness
= DEVICE_NATIVE_ENDIAN
,
1619 .min_access_size
= 4,
1620 .max_access_size
= 8,
1623 .min_access_size
= 4,
1624 .max_access_size
= 8,
1628 static void assigned_dev_msix_reset(AssignedDevice
*dev
)
1630 MSIXTableEntry
*entry
;
1633 if (!dev
->msix_table
) {
1637 memset(dev
->msix_table
, 0, dev
->msix_table_size
);
1639 for (i
= 0, entry
= dev
->msix_table
; i
< dev
->msix_max
; i
++, entry
++) {
1640 entry
->ctrl
= cpu_to_le32(0x1); /* Masked */
1644 static void assigned_dev_register_msix_mmio(AssignedDevice
*dev
, Error
**errp
)
1646 dev
->msix_table
= mmap(NULL
, dev
->msix_table_size
, PROT_READ
| PROT_WRITE
,
1647 MAP_ANONYMOUS
| MAP_PRIVATE
, 0, 0);
1648 if (dev
->msix_table
== MAP_FAILED
) {
1649 error_setg_errno(errp
, errno
, "failed to allocate msix_table");
1650 dev
->msix_table
= NULL
;
1653 dev
->dev
.msix_table
= (uint8_t *)dev
->msix_table
;
1655 assigned_dev_msix_reset(dev
);
1657 memory_region_init_io(&dev
->mmio
, OBJECT(dev
), &assigned_dev_msix_mmio_ops
,
1658 dev
, "assigned-dev-msix", dev
->msix_table_size
);
1661 static void assigned_dev_unregister_msix_mmio(AssignedDevice
*dev
)
1663 if (!dev
->msix_table
) {
1667 if (munmap(dev
->msix_table
, dev
->msix_table_size
) == -1) {
1668 error_report("error unmapping msix_table! %s", strerror(errno
));
1670 dev
->msix_table
= NULL
;
1671 dev
->dev
.msix_table
= NULL
;
1674 static const VMStateDescription vmstate_assigned_device
= {
1675 .name
= "pci-assign",
1679 static void reset_assigned_device(DeviceState
*dev
)
1681 PCIDevice
*pci_dev
= PCI_DEVICE(dev
);
1682 AssignedDevice
*adev
= PCI_ASSIGN(pci_dev
);
1683 char reset_file
[64];
1684 const char reset
[] = "1";
1688 * If a guest is reset without being shutdown, MSI/MSI-X can still
1689 * be running. We want to return the device to a known state on
1690 * reset, so disable those here. We especially do not want MSI-X
1691 * enabled since it lives in MMIO space, which is about to get
1694 if (adev
->assigned_irq_type
== ASSIGNED_IRQ_MSIX
) {
1695 uint16_t ctrl
= pci_get_word(pci_dev
->config
+
1696 pci_dev
->msix_cap
+ PCI_MSIX_FLAGS
);
1698 pci_set_word(pci_dev
->config
+ pci_dev
->msix_cap
+ PCI_MSIX_FLAGS
,
1699 ctrl
& ~PCI_MSIX_FLAGS_ENABLE
);
1700 assigned_dev_update_msix(pci_dev
);
1701 } else if (adev
->assigned_irq_type
== ASSIGNED_IRQ_MSI
) {
1702 uint8_t ctrl
= pci_get_byte(pci_dev
->config
+
1703 pci_dev
->msi_cap
+ PCI_MSI_FLAGS
);
1705 pci_set_byte(pci_dev
->config
+ pci_dev
->msi_cap
+ PCI_MSI_FLAGS
,
1706 ctrl
& ~PCI_MSI_FLAGS_ENABLE
);
1707 assigned_dev_update_msi(pci_dev
);
1710 snprintf(reset_file
, sizeof(reset_file
),
1711 "/sys/bus/pci/devices/%04x:%02x:%02x.%01x/reset",
1712 adev
->host
.domain
, adev
->host
.bus
, adev
->host
.slot
,
1713 adev
->host
.function
);
1716 * Issue a device reset via pci-sysfs. Note that we use write(2) here
1717 * and ignore the return value because some kernels have a bug that
1718 * returns 0 rather than bytes written on success, sending us into an
1719 * infinite retry loop using other write mechanisms.
1721 fd
= open(reset_file
, O_WRONLY
);
1723 ret
= write(fd
, reset
, strlen(reset
));
1729 * When a 0 is written to the bus master register, the device is logically
1730 * disconnected from the PCI bus. This avoids further DMA transfers.
1732 assigned_dev_pci_write_config(pci_dev
, PCI_COMMAND
, 0, 1);
1735 static void assigned_realize(struct PCIDevice
*pci_dev
, Error
**errp
)
1737 AssignedDevice
*dev
= PCI_ASSIGN(pci_dev
);
1740 Error
*local_err
= NULL
;
1742 if (!kvm_enabled()) {
1743 error_setg(&local_err
, "pci-assign requires KVM support");
1744 goto exit_with_error
;
1747 if (!dev
->host
.domain
&& !dev
->host
.bus
&& !dev
->host
.slot
&&
1748 !dev
->host
.function
) {
1749 error_setg(&local_err
, "no host device specified");
1750 goto exit_with_error
;
1754 * Set up basic config space access control. Will be further refined during
1755 * device initialization.
1757 assigned_dev_emulate_config_read(dev
, 0, PCI_CONFIG_SPACE_SIZE
);
1758 assigned_dev_direct_config_read(dev
, PCI_STATUS
, 2);
1759 assigned_dev_direct_config_read(dev
, PCI_REVISION_ID
, 1);
1760 assigned_dev_direct_config_read(dev
, PCI_CLASS_PROG
, 3);
1761 assigned_dev_direct_config_read(dev
, PCI_CACHE_LINE_SIZE
, 1);
1762 assigned_dev_direct_config_read(dev
, PCI_LATENCY_TIMER
, 1);
1763 assigned_dev_direct_config_read(dev
, PCI_BIST
, 1);
1764 assigned_dev_direct_config_read(dev
, PCI_CARDBUS_CIS
, 4);
1765 assigned_dev_direct_config_read(dev
, PCI_SUBSYSTEM_VENDOR_ID
, 2);
1766 assigned_dev_direct_config_read(dev
, PCI_SUBSYSTEM_ID
, 2);
1767 assigned_dev_direct_config_read(dev
, PCI_CAPABILITY_LIST
+ 1, 7);
1768 assigned_dev_direct_config_read(dev
, PCI_MIN_GNT
, 1);
1769 assigned_dev_direct_config_read(dev
, PCI_MAX_LAT
, 1);
1770 memcpy(dev
->emulate_config_write
, dev
->emulate_config_read
,
1771 sizeof(dev
->emulate_config_read
));
1773 get_real_device(dev
, &local_err
);
1778 if (assigned_device_pci_cap_init(pci_dev
, &local_err
) < 0) {
1782 /* intercept MSI-X entry page in the MMIO */
1783 if (dev
->cap
.available
& ASSIGNED_DEVICE_CAP_MSIX
) {
1784 assigned_dev_register_msix_mmio(dev
, &local_err
);
1790 /* handle real device's MMIO/PIO BARs */
1791 assigned_dev_register_regions(dev
->real_device
.regions
,
1792 dev
->real_device
.region_number
, dev
,
1798 /* handle interrupt routing */
1799 e_intx
= dev
->dev
.config
[PCI_INTERRUPT_PIN
] - 1;
1800 dev
->intpin
= e_intx
;
1801 dev
->intx_route
.mode
= PCI_INTX_DISABLED
;
1802 dev
->intx_route
.irq
= -1;
1804 /* assign device to guest */
1805 assign_device(dev
, &local_err
);
1810 /* assign legacy INTx to the device */
1811 r
= assign_intx(dev
, &local_err
);
1816 assigned_dev_load_option_rom(dev
);
1821 deassign_device(dev
);
1824 free_assigned_device(dev
);
1828 error_propagate(errp
, local_err
);
1831 static void assigned_exitfn(struct PCIDevice
*pci_dev
)
1833 AssignedDevice
*dev
= PCI_ASSIGN(pci_dev
);
1835 deassign_device(dev
);
1836 free_assigned_device(dev
);
1839 static void assigned_dev_instance_init(Object
*obj
)
1841 PCIDevice
*pci_dev
= PCI_DEVICE(obj
);
1842 AssignedDevice
*d
= PCI_ASSIGN(pci_dev
);
1844 device_add_bootindex_property(obj
, &d
->bootindex
,
1846 &pci_dev
->qdev
, NULL
);
1849 static Property assigned_dev_properties
[] = {
1850 DEFINE_PROP_PCI_HOST_DEVADDR("host", AssignedDevice
, host
),
1851 DEFINE_PROP_BIT("prefer_msi", AssignedDevice
, features
,
1852 ASSIGNED_DEVICE_PREFER_MSI_BIT
, false),
1853 DEFINE_PROP_BIT("share_intx", AssignedDevice
, features
,
1854 ASSIGNED_DEVICE_SHARE_INTX_BIT
, true),
1855 DEFINE_PROP_STRING("configfd", AssignedDevice
, configfd_name
),
1856 DEFINE_PROP_END_OF_LIST(),
1859 static void assign_class_init(ObjectClass
*klass
, void *data
)
1861 PCIDeviceClass
*k
= PCI_DEVICE_CLASS(klass
);
1862 DeviceClass
*dc
= DEVICE_CLASS(klass
);
1864 k
->realize
= assigned_realize
;
1865 k
->exit
= assigned_exitfn
;
1866 k
->config_read
= assigned_dev_pci_read_config
;
1867 k
->config_write
= assigned_dev_pci_write_config
;
1868 dc
->props
= assigned_dev_properties
;
1869 dc
->vmsd
= &vmstate_assigned_device
;
1870 dc
->reset
= reset_assigned_device
;
1871 set_bit(DEVICE_CATEGORY_MISC
, dc
->categories
);
1872 dc
->desc
= "KVM-based PCI passthrough";
1875 static const TypeInfo assign_info
= {
1876 .name
= TYPE_PCI_ASSIGN
,
1877 .parent
= TYPE_PCI_DEVICE
,
1878 .instance_size
= sizeof(AssignedDevice
),
1879 .class_init
= assign_class_init
,
1880 .instance_init
= assigned_dev_instance_init
,
1883 static void assign_register_types(void)
1885 type_register_static(&assign_info
);
1888 type_init(assign_register_types
)
1890 static void assigned_dev_load_option_rom(AssignedDevice
*dev
)
1894 pci_assign_dev_load_option_rom(&dev
->dev
, OBJECT(dev
), &size
,
1895 dev
->host
.domain
, dev
->host
.bus
,
1896 dev
->host
.slot
, dev
->host
.function
);