2 * vfio based device assignment support
4 * Copyright Red Hat, Inc. 2012
7 * Alex Williamson <alex.williamson@redhat.com>
9 * This work is licensed under the terms of the GNU GPL, version 2. See
10 * the COPYING file in the top-level directory.
12 * Based on qemu-kvm device-assignment:
13 * Adapted for KVM by Qumranet.
14 * Copyright (c) 2007, Neocleus, Alex Novik (alex@neocleus.com)
15 * Copyright (c) 2007, Neocleus, Guy Zana (guy@neocleus.com)
16 * Copyright (C) 2008, Qumranet, Amit Shah (amit.shah@qumranet.com)
17 * Copyright (C) 2008, Red Hat, Amit Shah (amit.shah@redhat.com)
18 * Copyright (C) 2008, IBM, Muli Ben-Yehuda (muli@il.ibm.com)
21 #include "qemu/osdep.h"
22 #include <linux/vfio.h>
23 #include <sys/ioctl.h>
26 #include "hw/pci/msi.h"
27 #include "hw/pci/msix.h"
28 #include "hw/pci/pci_bridge.h"
29 #include "hw/qdev-properties.h"
30 #include "hw/qdev-properties-system.h"
31 #include "migration/vmstate.h"
32 #include "qapi/qmp/qdict.h"
33 #include "qemu/error-report.h"
34 #include "qemu/main-loop.h"
35 #include "qemu/module.h"
36 #include "qemu/range.h"
37 #include "qemu/units.h"
38 #include "sysemu/kvm.h"
39 #include "sysemu/runstate.h"
42 #include "qapi/error.h"
43 #include "migration/blocker.h"
44 #include "migration/qemu-file.h"
46 #define TYPE_VFIO_PCI_NOHOTPLUG "vfio-pci-nohotplug"
48 static void vfio_disable_interrupts(VFIOPCIDevice
*vdev
);
49 static void vfio_mmap_set_enabled(VFIOPCIDevice
*vdev
, bool enabled
);
52 * Disabling BAR mmaping can be slow, but toggling it around INTx can
53 * also be a huge overhead. We try to get the best of both worlds by
54 * waiting until an interrupt to disable mmaps (subsequent transitions
55 * to the same state are effectively no overhead). If the interrupt has
56 * been serviced and the time gap is long enough, we re-enable mmaps for
57 * performance. This works well for things like graphics cards, which
58 * may not use their interrupt at all and are penalized to an unusable
59 * level by read/write BAR traps. Other devices, like NICs, have more
60 * regular interrupts and see much better latency by staying in non-mmap
61 * mode. We therefore set the default mmap_timeout such that a ping
62 * is just enough to keep the mmap disabled. Users can experiment with
63 * other options with the x-intx-mmap-timeout-ms parameter (a value of
64 * zero disables the timer).
66 static void vfio_intx_mmap_enable(void *opaque
)
68 VFIOPCIDevice
*vdev
= opaque
;
70 if (vdev
->intx
.pending
) {
71 timer_mod(vdev
->intx
.mmap_timer
,
72 qemu_clock_get_ms(QEMU_CLOCK_VIRTUAL
) + vdev
->intx
.mmap_timeout
);
76 vfio_mmap_set_enabled(vdev
, true);
79 static void vfio_intx_interrupt(void *opaque
)
81 VFIOPCIDevice
*vdev
= opaque
;
83 if (!event_notifier_test_and_clear(&vdev
->intx
.interrupt
)) {
87 trace_vfio_intx_interrupt(vdev
->vbasedev
.name
, 'A' + vdev
->intx
.pin
);
89 vdev
->intx
.pending
= true;
90 pci_irq_assert(&vdev
->pdev
);
91 vfio_mmap_set_enabled(vdev
, false);
92 if (vdev
->intx
.mmap_timeout
) {
93 timer_mod(vdev
->intx
.mmap_timer
,
94 qemu_clock_get_ms(QEMU_CLOCK_VIRTUAL
) + vdev
->intx
.mmap_timeout
);
98 static void vfio_intx_eoi(VFIODevice
*vbasedev
)
100 VFIOPCIDevice
*vdev
= container_of(vbasedev
, VFIOPCIDevice
, vbasedev
);
102 if (!vdev
->intx
.pending
) {
106 trace_vfio_intx_eoi(vbasedev
->name
);
108 vdev
->intx
.pending
= false;
109 pci_irq_deassert(&vdev
->pdev
);
110 vfio_unmask_single_irqindex(vbasedev
, VFIO_PCI_INTX_IRQ_INDEX
);
113 static void vfio_intx_enable_kvm(VFIOPCIDevice
*vdev
, Error
**errp
)
116 int irq_fd
= event_notifier_get_fd(&vdev
->intx
.interrupt
);
118 if (vdev
->no_kvm_intx
|| !kvm_irqfds_enabled() ||
119 vdev
->intx
.route
.mode
!= PCI_INTX_ENABLED
||
120 !kvm_resamplefds_enabled()) {
124 /* Get to a known interrupt state */
125 qemu_set_fd_handler(irq_fd
, NULL
, NULL
, vdev
);
126 vfio_mask_single_irqindex(&vdev
->vbasedev
, VFIO_PCI_INTX_IRQ_INDEX
);
127 vdev
->intx
.pending
= false;
128 pci_irq_deassert(&vdev
->pdev
);
130 /* Get an eventfd for resample/unmask */
131 if (event_notifier_init(&vdev
->intx
.unmask
, 0)) {
132 error_setg(errp
, "event_notifier_init failed eoi");
136 if (kvm_irqchip_add_irqfd_notifier_gsi(kvm_state
,
137 &vdev
->intx
.interrupt
,
139 vdev
->intx
.route
.irq
)) {
140 error_setg_errno(errp
, errno
, "failed to setup resample irqfd");
144 if (vfio_set_irq_signaling(&vdev
->vbasedev
, VFIO_PCI_INTX_IRQ_INDEX
, 0,
145 VFIO_IRQ_SET_ACTION_UNMASK
,
146 event_notifier_get_fd(&vdev
->intx
.unmask
),
152 vfio_unmask_single_irqindex(&vdev
->vbasedev
, VFIO_PCI_INTX_IRQ_INDEX
);
154 vdev
->intx
.kvm_accel
= true;
156 trace_vfio_intx_enable_kvm(vdev
->vbasedev
.name
);
161 kvm_irqchip_remove_irqfd_notifier_gsi(kvm_state
, &vdev
->intx
.interrupt
,
162 vdev
->intx
.route
.irq
);
164 event_notifier_cleanup(&vdev
->intx
.unmask
);
166 qemu_set_fd_handler(irq_fd
, vfio_intx_interrupt
, NULL
, vdev
);
167 vfio_unmask_single_irqindex(&vdev
->vbasedev
, VFIO_PCI_INTX_IRQ_INDEX
);
171 static void vfio_intx_disable_kvm(VFIOPCIDevice
*vdev
)
174 if (!vdev
->intx
.kvm_accel
) {
179 * Get to a known state, hardware masked, QEMU ready to accept new
180 * interrupts, QEMU IRQ de-asserted.
182 vfio_mask_single_irqindex(&vdev
->vbasedev
, VFIO_PCI_INTX_IRQ_INDEX
);
183 vdev
->intx
.pending
= false;
184 pci_irq_deassert(&vdev
->pdev
);
186 /* Tell KVM to stop listening for an INTx irqfd */
187 if (kvm_irqchip_remove_irqfd_notifier_gsi(kvm_state
, &vdev
->intx
.interrupt
,
188 vdev
->intx
.route
.irq
)) {
189 error_report("vfio: Error: Failed to disable INTx irqfd: %m");
192 /* We only need to close the eventfd for VFIO to cleanup the kernel side */
193 event_notifier_cleanup(&vdev
->intx
.unmask
);
195 /* QEMU starts listening for interrupt events. */
196 qemu_set_fd_handler(event_notifier_get_fd(&vdev
->intx
.interrupt
),
197 vfio_intx_interrupt
, NULL
, vdev
);
199 vdev
->intx
.kvm_accel
= false;
201 /* If we've missed an event, let it re-fire through QEMU */
202 vfio_unmask_single_irqindex(&vdev
->vbasedev
, VFIO_PCI_INTX_IRQ_INDEX
);
204 trace_vfio_intx_disable_kvm(vdev
->vbasedev
.name
);
208 static void vfio_intx_update(VFIOPCIDevice
*vdev
, PCIINTxRoute
*route
)
212 trace_vfio_intx_update(vdev
->vbasedev
.name
,
213 vdev
->intx
.route
.irq
, route
->irq
);
215 vfio_intx_disable_kvm(vdev
);
217 vdev
->intx
.route
= *route
;
219 if (route
->mode
!= PCI_INTX_ENABLED
) {
223 vfio_intx_enable_kvm(vdev
, &err
);
225 warn_reportf_err(err
, VFIO_MSG_PREFIX
, vdev
->vbasedev
.name
);
228 /* Re-enable the interrupt in cased we missed an EOI */
229 vfio_intx_eoi(&vdev
->vbasedev
);
232 static void vfio_intx_routing_notifier(PCIDevice
*pdev
)
234 VFIOPCIDevice
*vdev
= VFIO_PCI(pdev
);
237 if (vdev
->interrupt
!= VFIO_INT_INTx
) {
241 route
= pci_device_route_intx_to_irq(&vdev
->pdev
, vdev
->intx
.pin
);
243 if (pci_intx_route_changed(&vdev
->intx
.route
, &route
)) {
244 vfio_intx_update(vdev
, &route
);
248 static void vfio_irqchip_change(Notifier
*notify
, void *data
)
250 VFIOPCIDevice
*vdev
= container_of(notify
, VFIOPCIDevice
,
251 irqchip_change_notifier
);
253 vfio_intx_update(vdev
, &vdev
->intx
.route
);
256 static int vfio_intx_enable(VFIOPCIDevice
*vdev
, Error
**errp
)
258 uint8_t pin
= vfio_pci_read_config(&vdev
->pdev
, PCI_INTERRUPT_PIN
, 1);
268 vfio_disable_interrupts(vdev
);
270 vdev
->intx
.pin
= pin
- 1; /* Pin A (1) -> irq[0] */
271 pci_config_set_interrupt_pin(vdev
->pdev
.config
, pin
);
275 * Only conditional to avoid generating error messages on platforms
276 * where we won't actually use the result anyway.
278 if (kvm_irqfds_enabled() && kvm_resamplefds_enabled()) {
279 vdev
->intx
.route
= pci_device_route_intx_to_irq(&vdev
->pdev
,
284 ret
= event_notifier_init(&vdev
->intx
.interrupt
, 0);
286 error_setg_errno(errp
, -ret
, "event_notifier_init failed");
289 fd
= event_notifier_get_fd(&vdev
->intx
.interrupt
);
290 qemu_set_fd_handler(fd
, vfio_intx_interrupt
, NULL
, vdev
);
292 if (vfio_set_irq_signaling(&vdev
->vbasedev
, VFIO_PCI_INTX_IRQ_INDEX
, 0,
293 VFIO_IRQ_SET_ACTION_TRIGGER
, fd
, errp
)) {
294 qemu_set_fd_handler(fd
, NULL
, NULL
, vdev
);
295 event_notifier_cleanup(&vdev
->intx
.interrupt
);
299 vfio_intx_enable_kvm(vdev
, &err
);
301 warn_reportf_err(err
, VFIO_MSG_PREFIX
, vdev
->vbasedev
.name
);
304 vdev
->interrupt
= VFIO_INT_INTx
;
306 trace_vfio_intx_enable(vdev
->vbasedev
.name
);
310 static void vfio_intx_disable(VFIOPCIDevice
*vdev
)
314 timer_del(vdev
->intx
.mmap_timer
);
315 vfio_intx_disable_kvm(vdev
);
316 vfio_disable_irqindex(&vdev
->vbasedev
, VFIO_PCI_INTX_IRQ_INDEX
);
317 vdev
->intx
.pending
= false;
318 pci_irq_deassert(&vdev
->pdev
);
319 vfio_mmap_set_enabled(vdev
, true);
321 fd
= event_notifier_get_fd(&vdev
->intx
.interrupt
);
322 qemu_set_fd_handler(fd
, NULL
, NULL
, vdev
);
323 event_notifier_cleanup(&vdev
->intx
.interrupt
);
325 vdev
->interrupt
= VFIO_INT_NONE
;
327 trace_vfio_intx_disable(vdev
->vbasedev
.name
);
333 static void vfio_msi_interrupt(void *opaque
)
335 VFIOMSIVector
*vector
= opaque
;
336 VFIOPCIDevice
*vdev
= vector
->vdev
;
337 MSIMessage (*get_msg
)(PCIDevice
*dev
, unsigned vector
);
338 void (*notify
)(PCIDevice
*dev
, unsigned vector
);
340 int nr
= vector
- vdev
->msi_vectors
;
342 if (!event_notifier_test_and_clear(&vector
->interrupt
)) {
346 if (vdev
->interrupt
== VFIO_INT_MSIX
) {
347 get_msg
= msix_get_message
;
348 notify
= msix_notify
;
350 /* A masked vector firing needs to use the PBA, enable it */
351 if (msix_is_masked(&vdev
->pdev
, nr
)) {
352 set_bit(nr
, vdev
->msix
->pending
);
353 memory_region_set_enabled(&vdev
->pdev
.msix_pba_mmio
, true);
354 trace_vfio_msix_pba_enable(vdev
->vbasedev
.name
);
356 } else if (vdev
->interrupt
== VFIO_INT_MSI
) {
357 get_msg
= msi_get_message
;
363 msg
= get_msg(&vdev
->pdev
, nr
);
364 trace_vfio_msi_interrupt(vdev
->vbasedev
.name
, nr
, msg
.address
, msg
.data
);
365 notify(&vdev
->pdev
, nr
);
368 static int vfio_enable_vectors(VFIOPCIDevice
*vdev
, bool msix
)
370 struct vfio_irq_set
*irq_set
;
371 int ret
= 0, i
, argsz
;
374 argsz
= sizeof(*irq_set
) + (vdev
->nr_vectors
* sizeof(*fds
));
376 irq_set
= g_malloc0(argsz
);
377 irq_set
->argsz
= argsz
;
378 irq_set
->flags
= VFIO_IRQ_SET_DATA_EVENTFD
| VFIO_IRQ_SET_ACTION_TRIGGER
;
379 irq_set
->index
= msix
? VFIO_PCI_MSIX_IRQ_INDEX
: VFIO_PCI_MSI_IRQ_INDEX
;
381 irq_set
->count
= vdev
->nr_vectors
;
382 fds
= (int32_t *)&irq_set
->data
;
384 for (i
= 0; i
< vdev
->nr_vectors
; i
++) {
388 * MSI vs MSI-X - The guest has direct access to MSI mask and pending
389 * bits, therefore we always use the KVM signaling path when setup.
390 * MSI-X mask and pending bits are emulated, so we want to use the
391 * KVM signaling path only when configured and unmasked.
393 if (vdev
->msi_vectors
[i
].use
) {
394 if (vdev
->msi_vectors
[i
].virq
< 0 ||
395 (msix
&& msix_is_masked(&vdev
->pdev
, i
))) {
396 fd
= event_notifier_get_fd(&vdev
->msi_vectors
[i
].interrupt
);
398 fd
= event_notifier_get_fd(&vdev
->msi_vectors
[i
].kvm_interrupt
);
405 ret
= ioctl(vdev
->vbasedev
.fd
, VFIO_DEVICE_SET_IRQS
, irq_set
);
412 static void vfio_add_kvm_msi_virq(VFIOPCIDevice
*vdev
, VFIOMSIVector
*vector
,
413 int vector_n
, bool msix
)
417 if ((msix
&& vdev
->no_kvm_msix
) || (!msix
&& vdev
->no_kvm_msi
)) {
421 if (event_notifier_init(&vector
->kvm_interrupt
, 0)) {
425 virq
= kvm_irqchip_add_msi_route(kvm_state
, vector_n
, &vdev
->pdev
);
427 event_notifier_cleanup(&vector
->kvm_interrupt
);
431 if (kvm_irqchip_add_irqfd_notifier_gsi(kvm_state
, &vector
->kvm_interrupt
,
433 kvm_irqchip_release_virq(kvm_state
, virq
);
434 event_notifier_cleanup(&vector
->kvm_interrupt
);
441 static void vfio_remove_kvm_msi_virq(VFIOMSIVector
*vector
)
443 kvm_irqchip_remove_irqfd_notifier_gsi(kvm_state
, &vector
->kvm_interrupt
,
445 kvm_irqchip_release_virq(kvm_state
, vector
->virq
);
447 event_notifier_cleanup(&vector
->kvm_interrupt
);
450 static void vfio_update_kvm_msi_virq(VFIOMSIVector
*vector
, MSIMessage msg
,
453 kvm_irqchip_update_msi_route(kvm_state
, vector
->virq
, msg
, pdev
);
454 kvm_irqchip_commit_routes(kvm_state
);
457 static int vfio_msix_vector_do_use(PCIDevice
*pdev
, unsigned int nr
,
458 MSIMessage
*msg
, IOHandler
*handler
)
460 VFIOPCIDevice
*vdev
= VFIO_PCI(pdev
);
461 VFIOMSIVector
*vector
;
464 trace_vfio_msix_vector_do_use(vdev
->vbasedev
.name
, nr
);
466 vector
= &vdev
->msi_vectors
[nr
];
471 if (event_notifier_init(&vector
->interrupt
, 0)) {
472 error_report("vfio: Error: event_notifier_init failed");
475 msix_vector_use(pdev
, nr
);
478 qemu_set_fd_handler(event_notifier_get_fd(&vector
->interrupt
),
479 handler
, NULL
, vector
);
482 * Attempt to enable route through KVM irqchip,
483 * default to userspace handling if unavailable.
485 if (vector
->virq
>= 0) {
487 vfio_remove_kvm_msi_virq(vector
);
489 vfio_update_kvm_msi_virq(vector
, *msg
, pdev
);
493 vfio_add_kvm_msi_virq(vdev
, vector
, nr
, true);
498 * We don't want to have the host allocate all possible MSI vectors
499 * for a device if they're not in use, so we shutdown and incrementally
500 * increase them as needed.
502 if (vdev
->nr_vectors
< nr
+ 1) {
503 vfio_disable_irqindex(&vdev
->vbasedev
, VFIO_PCI_MSIX_IRQ_INDEX
);
504 vdev
->nr_vectors
= nr
+ 1;
505 ret
= vfio_enable_vectors(vdev
, true);
507 error_report("vfio: failed to enable vectors, %d", ret
);
513 if (vector
->virq
>= 0) {
514 fd
= event_notifier_get_fd(&vector
->kvm_interrupt
);
516 fd
= event_notifier_get_fd(&vector
->interrupt
);
519 if (vfio_set_irq_signaling(&vdev
->vbasedev
,
520 VFIO_PCI_MSIX_IRQ_INDEX
, nr
,
521 VFIO_IRQ_SET_ACTION_TRIGGER
, fd
, &err
)) {
522 error_reportf_err(err
, VFIO_MSG_PREFIX
, vdev
->vbasedev
.name
);
526 /* Disable PBA emulation when nothing more is pending. */
527 clear_bit(nr
, vdev
->msix
->pending
);
528 if (find_first_bit(vdev
->msix
->pending
,
529 vdev
->nr_vectors
) == vdev
->nr_vectors
) {
530 memory_region_set_enabled(&vdev
->pdev
.msix_pba_mmio
, false);
531 trace_vfio_msix_pba_disable(vdev
->vbasedev
.name
);
537 static int vfio_msix_vector_use(PCIDevice
*pdev
,
538 unsigned int nr
, MSIMessage msg
)
540 return vfio_msix_vector_do_use(pdev
, nr
, &msg
, vfio_msi_interrupt
);
543 static void vfio_msix_vector_release(PCIDevice
*pdev
, unsigned int nr
)
545 VFIOPCIDevice
*vdev
= VFIO_PCI(pdev
);
546 VFIOMSIVector
*vector
= &vdev
->msi_vectors
[nr
];
548 trace_vfio_msix_vector_release(vdev
->vbasedev
.name
, nr
);
551 * There are still old guests that mask and unmask vectors on every
552 * interrupt. If we're using QEMU bypass with a KVM irqfd, leave all of
553 * the KVM setup in place, simply switch VFIO to use the non-bypass
554 * eventfd. We'll then fire the interrupt through QEMU and the MSI-X
555 * core will mask the interrupt and set pending bits, allowing it to
556 * be re-asserted on unmask. Nothing to do if already using QEMU mode.
558 if (vector
->virq
>= 0) {
559 int32_t fd
= event_notifier_get_fd(&vector
->interrupt
);
562 if (vfio_set_irq_signaling(&vdev
->vbasedev
, VFIO_PCI_MSIX_IRQ_INDEX
, nr
,
563 VFIO_IRQ_SET_ACTION_TRIGGER
, fd
, &err
)) {
564 error_reportf_err(err
, VFIO_MSG_PREFIX
, vdev
->vbasedev
.name
);
569 static void vfio_msix_enable(VFIOPCIDevice
*vdev
)
571 PCIDevice
*pdev
= &vdev
->pdev
;
572 unsigned int nr
, max_vec
= 0;
574 vfio_disable_interrupts(vdev
);
576 vdev
->msi_vectors
= g_new0(VFIOMSIVector
, vdev
->msix
->entries
);
578 vdev
->interrupt
= VFIO_INT_MSIX
;
581 * Some communication channels between VF & PF or PF & fw rely on the
582 * physical state of the device and expect that enabling MSI-X from the
583 * guest enables the same on the host. When our guest is Linux, the
584 * guest driver call to pci_enable_msix() sets the enabling bit in the
585 * MSI-X capability, but leaves the vector table masked. We therefore
586 * can't rely on a vector_use callback (from request_irq() in the guest)
587 * to switch the physical device into MSI-X mode because that may come a
588 * long time after pci_enable_msix(). This code enables vector 0 with
589 * triggering to userspace, then immediately release the vector, leaving
590 * the physical device with no vectors enabled, but MSI-X enabled, just
591 * like the guest view.
592 * If there are already unmasked vectors (in migration resume phase and
593 * some guest startups) which will be enabled soon, we can allocate all
594 * of them here to avoid inefficiently disabling and enabling vectors
597 if (!pdev
->msix_function_masked
) {
598 for (nr
= 0; nr
< msix_nr_vectors_allocated(pdev
); nr
++) {
599 if (!msix_is_masked(pdev
, nr
)) {
604 vfio_msix_vector_do_use(pdev
, max_vec
, NULL
, NULL
);
605 vfio_msix_vector_release(pdev
, max_vec
);
607 if (msix_set_vector_notifiers(pdev
, vfio_msix_vector_use
,
608 vfio_msix_vector_release
, NULL
)) {
609 error_report("vfio: msix_set_vector_notifiers failed");
612 trace_vfio_msix_enable(vdev
->vbasedev
.name
);
615 static void vfio_msi_enable(VFIOPCIDevice
*vdev
)
619 vfio_disable_interrupts(vdev
);
621 vdev
->nr_vectors
= msi_nr_vectors_allocated(&vdev
->pdev
);
623 vdev
->msi_vectors
= g_new0(VFIOMSIVector
, vdev
->nr_vectors
);
625 for (i
= 0; i
< vdev
->nr_vectors
; i
++) {
626 VFIOMSIVector
*vector
= &vdev
->msi_vectors
[i
];
632 if (event_notifier_init(&vector
->interrupt
, 0)) {
633 error_report("vfio: Error: event_notifier_init failed");
636 qemu_set_fd_handler(event_notifier_get_fd(&vector
->interrupt
),
637 vfio_msi_interrupt
, NULL
, vector
);
640 * Attempt to enable route through KVM irqchip,
641 * default to userspace handling if unavailable.
643 vfio_add_kvm_msi_virq(vdev
, vector
, i
, false);
646 /* Set interrupt type prior to possible interrupts */
647 vdev
->interrupt
= VFIO_INT_MSI
;
649 ret
= vfio_enable_vectors(vdev
, false);
652 error_report("vfio: Error: Failed to setup MSI fds: %m");
653 } else if (ret
!= vdev
->nr_vectors
) {
654 error_report("vfio: Error: Failed to enable %d "
655 "MSI vectors, retry with %d", vdev
->nr_vectors
, ret
);
658 for (i
= 0; i
< vdev
->nr_vectors
; i
++) {
659 VFIOMSIVector
*vector
= &vdev
->msi_vectors
[i
];
660 if (vector
->virq
>= 0) {
661 vfio_remove_kvm_msi_virq(vector
);
663 qemu_set_fd_handler(event_notifier_get_fd(&vector
->interrupt
),
665 event_notifier_cleanup(&vector
->interrupt
);
668 g_free(vdev
->msi_vectors
);
669 vdev
->msi_vectors
= NULL
;
671 if (ret
> 0 && ret
!= vdev
->nr_vectors
) {
672 vdev
->nr_vectors
= ret
;
675 vdev
->nr_vectors
= 0;
678 * Failing to setup MSI doesn't really fall within any specification.
679 * Let's try leaving interrupts disabled and hope the guest figures
680 * out to fall back to INTx for this device.
682 error_report("vfio: Error: Failed to enable MSI");
683 vdev
->interrupt
= VFIO_INT_NONE
;
688 trace_vfio_msi_enable(vdev
->vbasedev
.name
, vdev
->nr_vectors
);
691 static void vfio_msi_disable_common(VFIOPCIDevice
*vdev
)
696 for (i
= 0; i
< vdev
->nr_vectors
; i
++) {
697 VFIOMSIVector
*vector
= &vdev
->msi_vectors
[i
];
698 if (vdev
->msi_vectors
[i
].use
) {
699 if (vector
->virq
>= 0) {
700 vfio_remove_kvm_msi_virq(vector
);
702 qemu_set_fd_handler(event_notifier_get_fd(&vector
->interrupt
),
704 event_notifier_cleanup(&vector
->interrupt
);
708 g_free(vdev
->msi_vectors
);
709 vdev
->msi_vectors
= NULL
;
710 vdev
->nr_vectors
= 0;
711 vdev
->interrupt
= VFIO_INT_NONE
;
713 vfio_intx_enable(vdev
, &err
);
715 error_reportf_err(err
, VFIO_MSG_PREFIX
, vdev
->vbasedev
.name
);
719 static void vfio_msix_disable(VFIOPCIDevice
*vdev
)
723 msix_unset_vector_notifiers(&vdev
->pdev
);
726 * MSI-X will only release vectors if MSI-X is still enabled on the
727 * device, check through the rest and release it ourselves if necessary.
729 for (i
= 0; i
< vdev
->nr_vectors
; i
++) {
730 if (vdev
->msi_vectors
[i
].use
) {
731 vfio_msix_vector_release(&vdev
->pdev
, i
);
732 msix_vector_unuse(&vdev
->pdev
, i
);
736 if (vdev
->nr_vectors
) {
737 vfio_disable_irqindex(&vdev
->vbasedev
, VFIO_PCI_MSIX_IRQ_INDEX
);
740 vfio_msi_disable_common(vdev
);
742 memset(vdev
->msix
->pending
, 0,
743 BITS_TO_LONGS(vdev
->msix
->entries
) * sizeof(unsigned long));
745 trace_vfio_msix_disable(vdev
->vbasedev
.name
);
748 static void vfio_msi_disable(VFIOPCIDevice
*vdev
)
750 vfio_disable_irqindex(&vdev
->vbasedev
, VFIO_PCI_MSI_IRQ_INDEX
);
751 vfio_msi_disable_common(vdev
);
753 trace_vfio_msi_disable(vdev
->vbasedev
.name
);
756 static void vfio_update_msi(VFIOPCIDevice
*vdev
)
760 for (i
= 0; i
< vdev
->nr_vectors
; i
++) {
761 VFIOMSIVector
*vector
= &vdev
->msi_vectors
[i
];
764 if (!vector
->use
|| vector
->virq
< 0) {
768 msg
= msi_get_message(&vdev
->pdev
, i
);
769 vfio_update_kvm_msi_virq(vector
, msg
, &vdev
->pdev
);
773 static void vfio_pci_load_rom(VFIOPCIDevice
*vdev
)
775 struct vfio_region_info
*reg_info
;
780 if (vfio_get_region_info(&vdev
->vbasedev
,
781 VFIO_PCI_ROM_REGION_INDEX
, ®_info
)) {
782 error_report("vfio: Error getting ROM info: %m");
786 trace_vfio_pci_load_rom(vdev
->vbasedev
.name
, (unsigned long)reg_info
->size
,
787 (unsigned long)reg_info
->offset
,
788 (unsigned long)reg_info
->flags
);
790 vdev
->rom_size
= size
= reg_info
->size
;
791 vdev
->rom_offset
= reg_info
->offset
;
795 if (!vdev
->rom_size
) {
796 vdev
->rom_read_failed
= true;
797 error_report("vfio-pci: Cannot read device rom at "
798 "%s", vdev
->vbasedev
.name
);
799 error_printf("Device option ROM contents are probably invalid "
800 "(check dmesg).\nSkip option ROM probe with rombar=0, "
801 "or load from file with romfile=\n");
805 vdev
->rom
= g_malloc(size
);
806 memset(vdev
->rom
, 0xff, size
);
809 bytes
= pread(vdev
->vbasedev
.fd
, vdev
->rom
+ off
,
810 size
, vdev
->rom_offset
+ off
);
813 } else if (bytes
> 0) {
817 if (errno
== EINTR
|| errno
== EAGAIN
) {
820 error_report("vfio: Error reading device ROM: %m");
826 * Test the ROM signature against our device, if the vendor is correct
827 * but the device ID doesn't match, store the correct device ID and
828 * recompute the checksum. Intel IGD devices need this and are known
829 * to have bogus checksums so we can't simply adjust the checksum.
831 if (pci_get_word(vdev
->rom
) == 0xaa55 &&
832 pci_get_word(vdev
->rom
+ 0x18) + 8 < vdev
->rom_size
&&
833 !memcmp(vdev
->rom
+ pci_get_word(vdev
->rom
+ 0x18), "PCIR", 4)) {
836 vid
= pci_get_word(vdev
->rom
+ pci_get_word(vdev
->rom
+ 0x18) + 4);
837 did
= pci_get_word(vdev
->rom
+ pci_get_word(vdev
->rom
+ 0x18) + 6);
839 if (vid
== vdev
->vendor_id
&& did
!= vdev
->device_id
) {
841 uint8_t csum
, *data
= vdev
->rom
;
843 pci_set_word(vdev
->rom
+ pci_get_word(vdev
->rom
+ 0x18) + 6,
847 for (csum
= 0, i
= 0; i
< vdev
->rom_size
; i
++) {
856 static uint64_t vfio_rom_read(void *opaque
, hwaddr addr
, unsigned size
)
858 VFIOPCIDevice
*vdev
= opaque
;
867 /* Load the ROM lazily when the guest tries to read it */
868 if (unlikely(!vdev
->rom
&& !vdev
->rom_read_failed
)) {
869 vfio_pci_load_rom(vdev
);
872 memcpy(&val
, vdev
->rom
+ addr
,
873 (addr
< vdev
->rom_size
) ? MIN(size
, vdev
->rom_size
- addr
) : 0);
880 data
= le16_to_cpu(val
.word
);
883 data
= le32_to_cpu(val
.dword
);
886 hw_error("vfio: unsupported read size, %d bytes\n", size
);
890 trace_vfio_rom_read(vdev
->vbasedev
.name
, addr
, size
, data
);
895 static void vfio_rom_write(void *opaque
, hwaddr addr
,
896 uint64_t data
, unsigned size
)
900 static const MemoryRegionOps vfio_rom_ops
= {
901 .read
= vfio_rom_read
,
902 .write
= vfio_rom_write
,
903 .endianness
= DEVICE_LITTLE_ENDIAN
,
906 static void vfio_pci_size_rom(VFIOPCIDevice
*vdev
)
908 uint32_t orig
, size
= cpu_to_le32((uint32_t)PCI_ROM_ADDRESS_MASK
);
909 off_t offset
= vdev
->config_offset
+ PCI_ROM_ADDRESS
;
910 DeviceState
*dev
= DEVICE(vdev
);
912 int fd
= vdev
->vbasedev
.fd
;
914 if (vdev
->pdev
.romfile
|| !vdev
->pdev
.rom_bar
) {
915 /* Since pci handles romfile, just print a message and return */
916 if (vfio_opt_rom_in_denylist(vdev
) && vdev
->pdev
.romfile
) {
917 warn_report("Device at %s is known to cause system instability"
918 " issues during option rom execution",
919 vdev
->vbasedev
.name
);
920 error_printf("Proceeding anyway since user specified romfile\n");
926 * Use the same size ROM BAR as the physical device. The contents
927 * will get filled in later when the guest tries to read it.
929 if (pread(fd
, &orig
, 4, offset
) != 4 ||
930 pwrite(fd
, &size
, 4, offset
) != 4 ||
931 pread(fd
, &size
, 4, offset
) != 4 ||
932 pwrite(fd
, &orig
, 4, offset
) != 4) {
933 error_report("%s(%s) failed: %m", __func__
, vdev
->vbasedev
.name
);
937 size
= ~(le32_to_cpu(size
) & PCI_ROM_ADDRESS_MASK
) + 1;
943 if (vfio_opt_rom_in_denylist(vdev
)) {
944 if (dev
->opts
&& qdict_haskey(dev
->opts
, "rombar")) {
945 warn_report("Device at %s is known to cause system instability"
946 " issues during option rom execution",
947 vdev
->vbasedev
.name
);
948 error_printf("Proceeding anyway since user specified"
949 " non zero value for rombar\n");
951 warn_report("Rom loading for device at %s has been disabled"
952 " due to system instability issues",
953 vdev
->vbasedev
.name
);
954 error_printf("Specify rombar=1 or romfile to force\n");
959 trace_vfio_pci_size_rom(vdev
->vbasedev
.name
, size
);
961 name
= g_strdup_printf("vfio[%s].rom", vdev
->vbasedev
.name
);
963 memory_region_init_io(&vdev
->pdev
.rom
, OBJECT(vdev
),
964 &vfio_rom_ops
, vdev
, name
, size
);
967 pci_register_bar(&vdev
->pdev
, PCI_ROM_SLOT
,
968 PCI_BASE_ADDRESS_SPACE_MEMORY
, &vdev
->pdev
.rom
);
970 vdev
->rom_read_failed
= false;
973 void vfio_vga_write(void *opaque
, hwaddr addr
,
974 uint64_t data
, unsigned size
)
976 VFIOVGARegion
*region
= opaque
;
977 VFIOVGA
*vga
= container_of(region
, VFIOVGA
, region
[region
->nr
]);
984 off_t offset
= vga
->fd_offset
+ region
->offset
+ addr
;
991 buf
.word
= cpu_to_le16(data
);
994 buf
.dword
= cpu_to_le32(data
);
997 hw_error("vfio: unsupported write size, %d bytes", size
);
1001 if (pwrite(vga
->fd
, &buf
, size
, offset
) != size
) {
1002 error_report("%s(,0x%"HWADDR_PRIx
", 0x%"PRIx64
", %d) failed: %m",
1003 __func__
, region
->offset
+ addr
, data
, size
);
1006 trace_vfio_vga_write(region
->offset
+ addr
, data
, size
);
1009 uint64_t vfio_vga_read(void *opaque
, hwaddr addr
, unsigned size
)
1011 VFIOVGARegion
*region
= opaque
;
1012 VFIOVGA
*vga
= container_of(region
, VFIOVGA
, region
[region
->nr
]);
1020 off_t offset
= vga
->fd_offset
+ region
->offset
+ addr
;
1022 if (pread(vga
->fd
, &buf
, size
, offset
) != size
) {
1023 error_report("%s(,0x%"HWADDR_PRIx
", %d) failed: %m",
1024 __func__
, region
->offset
+ addr
, size
);
1025 return (uint64_t)-1;
1033 data
= le16_to_cpu(buf
.word
);
1036 data
= le32_to_cpu(buf
.dword
);
1039 hw_error("vfio: unsupported read size, %d bytes", size
);
1043 trace_vfio_vga_read(region
->offset
+ addr
, size
, data
);
1048 static const MemoryRegionOps vfio_vga_ops
= {
1049 .read
= vfio_vga_read
,
1050 .write
= vfio_vga_write
,
1051 .endianness
= DEVICE_LITTLE_ENDIAN
,
1055 * Expand memory region of sub-page(size < PAGE_SIZE) MMIO BAR to page
1056 * size if the BAR is in an exclusive page in host so that we could map
1057 * this BAR to guest. But this sub-page BAR may not occupy an exclusive
1058 * page in guest. So we should set the priority of the expanded memory
1059 * region to zero in case of overlap with BARs which share the same page
1060 * with the sub-page BAR in guest. Besides, we should also recover the
1061 * size of this sub-page BAR when its base address is changed in guest
1062 * and not page aligned any more.
1064 static void vfio_sub_page_bar_update_mapping(PCIDevice
*pdev
, int bar
)
1066 VFIOPCIDevice
*vdev
= VFIO_PCI(pdev
);
1067 VFIORegion
*region
= &vdev
->bars
[bar
].region
;
1068 MemoryRegion
*mmap_mr
, *region_mr
, *base_mr
;
1071 uint64_t size
= region
->size
;
1073 /* Make sure that the whole region is allowed to be mmapped */
1074 if (region
->nr_mmaps
!= 1 || !region
->mmaps
[0].mmap
||
1075 region
->mmaps
[0].size
!= region
->size
) {
1079 r
= &pdev
->io_regions
[bar
];
1081 base_mr
= vdev
->bars
[bar
].mr
;
1082 region_mr
= region
->mem
;
1083 mmap_mr
= ®ion
->mmaps
[0].mem
;
1085 /* If BAR is mapped and page aligned, update to fill PAGE_SIZE */
1086 if (bar_addr
!= PCI_BAR_UNMAPPED
&&
1087 !(bar_addr
& ~qemu_real_host_page_mask
)) {
1088 size
= qemu_real_host_page_size
;
1091 memory_region_transaction_begin();
1093 if (vdev
->bars
[bar
].size
< size
) {
1094 memory_region_set_size(base_mr
, size
);
1096 memory_region_set_size(region_mr
, size
);
1097 memory_region_set_size(mmap_mr
, size
);
1098 if (size
!= vdev
->bars
[bar
].size
&& memory_region_is_mapped(base_mr
)) {
1099 memory_region_del_subregion(r
->address_space
, base_mr
);
1100 memory_region_add_subregion_overlap(r
->address_space
,
1101 bar_addr
, base_mr
, 0);
1104 memory_region_transaction_commit();
1110 uint32_t vfio_pci_read_config(PCIDevice
*pdev
, uint32_t addr
, int len
)
1112 VFIOPCIDevice
*vdev
= VFIO_PCI(pdev
);
1113 uint32_t emu_bits
= 0, emu_val
= 0, phys_val
= 0, val
;
1115 memcpy(&emu_bits
, vdev
->emulated_config_bits
+ addr
, len
);
1116 emu_bits
= le32_to_cpu(emu_bits
);
1119 emu_val
= pci_default_read_config(pdev
, addr
, len
);
1122 if (~emu_bits
& (0xffffffffU
>> (32 - len
* 8))) {
1125 ret
= pread(vdev
->vbasedev
.fd
, &phys_val
, len
,
1126 vdev
->config_offset
+ addr
);
1128 error_report("%s(%s, 0x%x, 0x%x) failed: %m",
1129 __func__
, vdev
->vbasedev
.name
, addr
, len
);
1132 phys_val
= le32_to_cpu(phys_val
);
1135 val
= (emu_val
& emu_bits
) | (phys_val
& ~emu_bits
);
1137 trace_vfio_pci_read_config(vdev
->vbasedev
.name
, addr
, len
, val
);
1142 void vfio_pci_write_config(PCIDevice
*pdev
,
1143 uint32_t addr
, uint32_t val
, int len
)
1145 VFIOPCIDevice
*vdev
= VFIO_PCI(pdev
);
1146 uint32_t val_le
= cpu_to_le32(val
);
1148 trace_vfio_pci_write_config(vdev
->vbasedev
.name
, addr
, val
, len
);
1150 /* Write everything to VFIO, let it filter out what we can't write */
1151 if (pwrite(vdev
->vbasedev
.fd
, &val_le
, len
, vdev
->config_offset
+ addr
)
1153 error_report("%s(%s, 0x%x, 0x%x, 0x%x) failed: %m",
1154 __func__
, vdev
->vbasedev
.name
, addr
, val
, len
);
1157 /* MSI/MSI-X Enabling/Disabling */
1158 if (pdev
->cap_present
& QEMU_PCI_CAP_MSI
&&
1159 ranges_overlap(addr
, len
, pdev
->msi_cap
, vdev
->msi_cap_size
)) {
1160 int is_enabled
, was_enabled
= msi_enabled(pdev
);
1162 pci_default_write_config(pdev
, addr
, val
, len
);
1164 is_enabled
= msi_enabled(pdev
);
1168 vfio_msi_enable(vdev
);
1172 vfio_msi_disable(vdev
);
1174 vfio_update_msi(vdev
);
1177 } else if (pdev
->cap_present
& QEMU_PCI_CAP_MSIX
&&
1178 ranges_overlap(addr
, len
, pdev
->msix_cap
, MSIX_CAP_LENGTH
)) {
1179 int is_enabled
, was_enabled
= msix_enabled(pdev
);
1181 pci_default_write_config(pdev
, addr
, val
, len
);
1183 is_enabled
= msix_enabled(pdev
);
1185 if (!was_enabled
&& is_enabled
) {
1186 vfio_msix_enable(vdev
);
1187 } else if (was_enabled
&& !is_enabled
) {
1188 vfio_msix_disable(vdev
);
1190 } else if (ranges_overlap(addr
, len
, PCI_BASE_ADDRESS_0
, 24) ||
1191 range_covers_byte(addr
, len
, PCI_COMMAND
)) {
1192 pcibus_t old_addr
[PCI_NUM_REGIONS
- 1];
1195 for (bar
= 0; bar
< PCI_ROM_SLOT
; bar
++) {
1196 old_addr
[bar
] = pdev
->io_regions
[bar
].addr
;
1199 pci_default_write_config(pdev
, addr
, val
, len
);
1201 for (bar
= 0; bar
< PCI_ROM_SLOT
; bar
++) {
1202 if (old_addr
[bar
] != pdev
->io_regions
[bar
].addr
&&
1203 vdev
->bars
[bar
].region
.size
> 0 &&
1204 vdev
->bars
[bar
].region
.size
< qemu_real_host_page_size
) {
1205 vfio_sub_page_bar_update_mapping(pdev
, bar
);
1209 /* Write everything to QEMU to keep emulated bits correct */
1210 pci_default_write_config(pdev
, addr
, val
, len
);
1217 static void vfio_disable_interrupts(VFIOPCIDevice
*vdev
)
1220 * More complicated than it looks. Disabling MSI/X transitions the
1221 * device to INTx mode (if supported). Therefore we need to first
1222 * disable MSI/X and then cleanup by disabling INTx.
1224 if (vdev
->interrupt
== VFIO_INT_MSIX
) {
1225 vfio_msix_disable(vdev
);
1226 } else if (vdev
->interrupt
== VFIO_INT_MSI
) {
1227 vfio_msi_disable(vdev
);
1230 if (vdev
->interrupt
== VFIO_INT_INTx
) {
1231 vfio_intx_disable(vdev
);
1235 static int vfio_msi_setup(VFIOPCIDevice
*vdev
, int pos
, Error
**errp
)
1238 bool msi_64bit
, msi_maskbit
;
1242 if (pread(vdev
->vbasedev
.fd
, &ctrl
, sizeof(ctrl
),
1243 vdev
->config_offset
+ pos
+ PCI_CAP_FLAGS
) != sizeof(ctrl
)) {
1244 error_setg_errno(errp
, errno
, "failed reading MSI PCI_CAP_FLAGS");
1247 ctrl
= le16_to_cpu(ctrl
);
1249 msi_64bit
= !!(ctrl
& PCI_MSI_FLAGS_64BIT
);
1250 msi_maskbit
= !!(ctrl
& PCI_MSI_FLAGS_MASKBIT
);
1251 entries
= 1 << ((ctrl
& PCI_MSI_FLAGS_QMASK
) >> 1);
1253 trace_vfio_msi_setup(vdev
->vbasedev
.name
, pos
);
1255 ret
= msi_init(&vdev
->pdev
, pos
, entries
, msi_64bit
, msi_maskbit
, &err
);
1257 if (ret
== -ENOTSUP
) {
1260 error_propagate_prepend(errp
, err
, "msi_init failed: ");
1263 vdev
->msi_cap_size
= 0xa + (msi_maskbit
? 0xa : 0) + (msi_64bit
? 0x4 : 0);
1268 static void vfio_pci_fixup_msix_region(VFIOPCIDevice
*vdev
)
1271 VFIORegion
*region
= &vdev
->bars
[vdev
->msix
->table_bar
].region
;
1274 * If the host driver allows mapping of a MSIX data, we are going to
1275 * do map the entire BAR and emulate MSIX table on top of that.
1277 if (vfio_has_region_cap(&vdev
->vbasedev
, region
->nr
,
1278 VFIO_REGION_INFO_CAP_MSIX_MAPPABLE
)) {
1283 * We expect to find a single mmap covering the whole BAR, anything else
1284 * means it's either unsupported or already setup.
1286 if (region
->nr_mmaps
!= 1 || region
->mmaps
[0].offset
||
1287 region
->size
!= region
->mmaps
[0].size
) {
1291 /* MSI-X table start and end aligned to host page size */
1292 start
= vdev
->msix
->table_offset
& qemu_real_host_page_mask
;
1293 end
= REAL_HOST_PAGE_ALIGN((uint64_t)vdev
->msix
->table_offset
+
1294 (vdev
->msix
->entries
* PCI_MSIX_ENTRY_SIZE
));
1297 * Does the MSI-X table cover the beginning of the BAR? The whole BAR?
1298 * NB - Host page size is necessarily a power of two and so is the PCI
1299 * BAR (not counting EA yet), therefore if we have host page aligned
1300 * @start and @end, then any remainder of the BAR before or after those
1301 * must be at least host page sized and therefore mmap'able.
1304 if (end
>= region
->size
) {
1305 region
->nr_mmaps
= 0;
1306 g_free(region
->mmaps
);
1307 region
->mmaps
= NULL
;
1308 trace_vfio_msix_fixup(vdev
->vbasedev
.name
,
1309 vdev
->msix
->table_bar
, 0, 0);
1311 region
->mmaps
[0].offset
= end
;
1312 region
->mmaps
[0].size
= region
->size
- end
;
1313 trace_vfio_msix_fixup(vdev
->vbasedev
.name
,
1314 vdev
->msix
->table_bar
, region
->mmaps
[0].offset
,
1315 region
->mmaps
[0].offset
+ region
->mmaps
[0].size
);
1318 /* Maybe it's aligned at the end of the BAR */
1319 } else if (end
>= region
->size
) {
1320 region
->mmaps
[0].size
= start
;
1321 trace_vfio_msix_fixup(vdev
->vbasedev
.name
,
1322 vdev
->msix
->table_bar
, region
->mmaps
[0].offset
,
1323 region
->mmaps
[0].offset
+ region
->mmaps
[0].size
);
1325 /* Otherwise it must split the BAR */
1327 region
->nr_mmaps
= 2;
1328 region
->mmaps
= g_renew(VFIOMmap
, region
->mmaps
, 2);
1330 memcpy(®ion
->mmaps
[1], ®ion
->mmaps
[0], sizeof(VFIOMmap
));
1332 region
->mmaps
[0].size
= start
;
1333 trace_vfio_msix_fixup(vdev
->vbasedev
.name
,
1334 vdev
->msix
->table_bar
, region
->mmaps
[0].offset
,
1335 region
->mmaps
[0].offset
+ region
->mmaps
[0].size
);
1337 region
->mmaps
[1].offset
= end
;
1338 region
->mmaps
[1].size
= region
->size
- end
;
1339 trace_vfio_msix_fixup(vdev
->vbasedev
.name
,
1340 vdev
->msix
->table_bar
, region
->mmaps
[1].offset
,
1341 region
->mmaps
[1].offset
+ region
->mmaps
[1].size
);
1345 static void vfio_pci_relocate_msix(VFIOPCIDevice
*vdev
, Error
**errp
)
1347 int target_bar
= -1;
1350 if (!vdev
->msix
|| vdev
->msix_relo
== OFF_AUTOPCIBAR_OFF
) {
1354 /* The actual minimum size of MSI-X structures */
1355 msix_sz
= (vdev
->msix
->entries
* PCI_MSIX_ENTRY_SIZE
) +
1356 (QEMU_ALIGN_UP(vdev
->msix
->entries
, 64) / 8);
1357 /* Round up to host pages, we don't want to share a page */
1358 msix_sz
= REAL_HOST_PAGE_ALIGN(msix_sz
);
1359 /* PCI BARs must be a power of 2 */
1360 msix_sz
= pow2ceil(msix_sz
);
1362 if (vdev
->msix_relo
== OFF_AUTOPCIBAR_AUTO
) {
1364 * TODO: Lookup table for known devices.
1366 * Logically we might use an algorithm here to select the BAR adding
1367 * the least additional MMIO space, but we cannot programmatically
1368 * predict the driver dependency on BAR ordering or sizing, therefore
1369 * 'auto' becomes a lookup for combinations reported to work.
1371 if (target_bar
< 0) {
1372 error_setg(errp
, "No automatic MSI-X relocation available for "
1373 "device %04x:%04x", vdev
->vendor_id
, vdev
->device_id
);
1377 target_bar
= (int)(vdev
->msix_relo
- OFF_AUTOPCIBAR_BAR0
);
1380 /* I/O port BARs cannot host MSI-X structures */
1381 if (vdev
->bars
[target_bar
].ioport
) {
1382 error_setg(errp
, "Invalid MSI-X relocation BAR %d, "
1383 "I/O port BAR", target_bar
);
1387 /* Cannot use a BAR in the "shadow" of a 64-bit BAR */
1388 if (!vdev
->bars
[target_bar
].size
&&
1389 target_bar
> 0 && vdev
->bars
[target_bar
- 1].mem64
) {
1390 error_setg(errp
, "Invalid MSI-X relocation BAR %d, "
1391 "consumed by 64-bit BAR %d", target_bar
, target_bar
- 1);
1395 /* 2GB max size for 32-bit BARs, cannot double if already > 1G */
1396 if (vdev
->bars
[target_bar
].size
> 1 * GiB
&&
1397 !vdev
->bars
[target_bar
].mem64
) {
1398 error_setg(errp
, "Invalid MSI-X relocation BAR %d, "
1399 "no space to extend 32-bit BAR", target_bar
);
1404 * If adding a new BAR, test if we can make it 64bit. We make it
1405 * prefetchable since QEMU MSI-X emulation has no read side effects
1406 * and doing so makes mapping more flexible.
1408 if (!vdev
->bars
[target_bar
].size
) {
1409 if (target_bar
< (PCI_ROM_SLOT
- 1) &&
1410 !vdev
->bars
[target_bar
+ 1].size
) {
1411 vdev
->bars
[target_bar
].mem64
= true;
1412 vdev
->bars
[target_bar
].type
= PCI_BASE_ADDRESS_MEM_TYPE_64
;
1414 vdev
->bars
[target_bar
].type
|= PCI_BASE_ADDRESS_MEM_PREFETCH
;
1415 vdev
->bars
[target_bar
].size
= msix_sz
;
1416 vdev
->msix
->table_offset
= 0;
1418 vdev
->bars
[target_bar
].size
= MAX(vdev
->bars
[target_bar
].size
* 2,
1421 * Due to above size calc, MSI-X always starts halfway into the BAR,
1422 * which will always be a separate host page.
1424 vdev
->msix
->table_offset
= vdev
->bars
[target_bar
].size
/ 2;
1427 vdev
->msix
->table_bar
= target_bar
;
1428 vdev
->msix
->pba_bar
= target_bar
;
1429 /* Requires 8-byte alignment, but PCI_MSIX_ENTRY_SIZE guarantees that */
1430 vdev
->msix
->pba_offset
= vdev
->msix
->table_offset
+
1431 (vdev
->msix
->entries
* PCI_MSIX_ENTRY_SIZE
);
1433 trace_vfio_msix_relo(vdev
->vbasedev
.name
,
1434 vdev
->msix
->table_bar
, vdev
->msix
->table_offset
);
1438 * We don't have any control over how pci_add_capability() inserts
1439 * capabilities into the chain. In order to setup MSI-X we need a
1440 * MemoryRegion for the BAR. In order to setup the BAR and not
1441 * attempt to mmap the MSI-X table area, which VFIO won't allow, we
1442 * need to first look for where the MSI-X table lives. So we
1443 * unfortunately split MSI-X setup across two functions.
1445 static void vfio_msix_early_setup(VFIOPCIDevice
*vdev
, Error
**errp
)
1449 uint32_t table
, pba
;
1450 int fd
= vdev
->vbasedev
.fd
;
1453 pos
= pci_find_capability(&vdev
->pdev
, PCI_CAP_ID_MSIX
);
1458 if (pread(fd
, &ctrl
, sizeof(ctrl
),
1459 vdev
->config_offset
+ pos
+ PCI_MSIX_FLAGS
) != sizeof(ctrl
)) {
1460 error_setg_errno(errp
, errno
, "failed to read PCI MSIX FLAGS");
1464 if (pread(fd
, &table
, sizeof(table
),
1465 vdev
->config_offset
+ pos
+ PCI_MSIX_TABLE
) != sizeof(table
)) {
1466 error_setg_errno(errp
, errno
, "failed to read PCI MSIX TABLE");
1470 if (pread(fd
, &pba
, sizeof(pba
),
1471 vdev
->config_offset
+ pos
+ PCI_MSIX_PBA
) != sizeof(pba
)) {
1472 error_setg_errno(errp
, errno
, "failed to read PCI MSIX PBA");
1476 ctrl
= le16_to_cpu(ctrl
);
1477 table
= le32_to_cpu(table
);
1478 pba
= le32_to_cpu(pba
);
1480 msix
= g_malloc0(sizeof(*msix
));
1481 msix
->table_bar
= table
& PCI_MSIX_FLAGS_BIRMASK
;
1482 msix
->table_offset
= table
& ~PCI_MSIX_FLAGS_BIRMASK
;
1483 msix
->pba_bar
= pba
& PCI_MSIX_FLAGS_BIRMASK
;
1484 msix
->pba_offset
= pba
& ~PCI_MSIX_FLAGS_BIRMASK
;
1485 msix
->entries
= (ctrl
& PCI_MSIX_FLAGS_QSIZE
) + 1;
1488 * Test the size of the pba_offset variable and catch if it extends outside
1489 * of the specified BAR. If it is the case, we need to apply a hardware
1490 * specific quirk if the device is known or we have a broken configuration.
1492 if (msix
->pba_offset
>= vdev
->bars
[msix
->pba_bar
].region
.size
) {
1494 * Chelsio T5 Virtual Function devices are encoded as 0x58xx for T5
1495 * adapters. The T5 hardware returns an incorrect value of 0x8000 for
1496 * the VF PBA offset while the BAR itself is only 8k. The correct value
1497 * is 0x1000, so we hard code that here.
1499 if (vdev
->vendor_id
== PCI_VENDOR_ID_CHELSIO
&&
1500 (vdev
->device_id
& 0xff00) == 0x5800) {
1501 msix
->pba_offset
= 0x1000;
1503 * BAIDU KUNLUN Virtual Function devices for KUNLUN AI processor
1504 * return an incorrect value of 0x460000 for the VF PBA offset while
1505 * the BAR itself is only 0x10000. The correct value is 0xb400.
1507 } else if (vfio_pci_is(vdev
, PCI_VENDOR_ID_BAIDU
,
1508 PCI_DEVICE_ID_KUNLUN_VF
)) {
1509 msix
->pba_offset
= 0xb400;
1510 } else if (vdev
->msix_relo
== OFF_AUTOPCIBAR_OFF
) {
1511 error_setg(errp
, "hardware reports invalid configuration, "
1512 "MSIX PBA outside of specified BAR");
1518 trace_vfio_msix_early_setup(vdev
->vbasedev
.name
, pos
, msix
->table_bar
,
1519 msix
->table_offset
, msix
->entries
);
1522 vfio_pci_fixup_msix_region(vdev
);
1524 vfio_pci_relocate_msix(vdev
, errp
);
1527 static int vfio_msix_setup(VFIOPCIDevice
*vdev
, int pos
, Error
**errp
)
1532 vdev
->msix
->pending
= g_malloc0(BITS_TO_LONGS(vdev
->msix
->entries
) *
1533 sizeof(unsigned long));
1534 ret
= msix_init(&vdev
->pdev
, vdev
->msix
->entries
,
1535 vdev
->bars
[vdev
->msix
->table_bar
].mr
,
1536 vdev
->msix
->table_bar
, vdev
->msix
->table_offset
,
1537 vdev
->bars
[vdev
->msix
->pba_bar
].mr
,
1538 vdev
->msix
->pba_bar
, vdev
->msix
->pba_offset
, pos
,
1541 if (ret
== -ENOTSUP
) {
1542 warn_report_err(err
);
1546 error_propagate(errp
, err
);
1551 * The PCI spec suggests that devices provide additional alignment for
1552 * MSI-X structures and avoid overlapping non-MSI-X related registers.
1553 * For an assigned device, this hopefully means that emulation of MSI-X
1554 * structures does not affect the performance of the device. If devices
1555 * fail to provide that alignment, a significant performance penalty may
1556 * result, for instance Mellanox MT27500 VFs:
1557 * http://www.spinics.net/lists/kvm/msg125881.html
1559 * The PBA is simply not that important for such a serious regression and
1560 * most drivers do not appear to look at it. The solution for this is to
1561 * disable the PBA MemoryRegion unless it's being used. We disable it
1562 * here and only enable it if a masked vector fires through QEMU. As the
1563 * vector-use notifier is called, which occurs on unmask, we test whether
1564 * PBA emulation is needed and again disable if not.
1566 memory_region_set_enabled(&vdev
->pdev
.msix_pba_mmio
, false);
1569 * The emulated machine may provide a paravirt interface for MSIX setup
1570 * so it is not strictly necessary to emulate MSIX here. This becomes
1571 * helpful when frequently accessed MMIO registers are located in
1572 * subpages adjacent to the MSIX table but the MSIX data containing page
1573 * cannot be mapped because of a host page size bigger than the MSIX table
1576 if (object_property_get_bool(OBJECT(qdev_get_machine()),
1577 "vfio-no-msix-emulation", NULL
)) {
1578 memory_region_set_enabled(&vdev
->pdev
.msix_table_mmio
, false);
1584 static void vfio_teardown_msi(VFIOPCIDevice
*vdev
)
1586 msi_uninit(&vdev
->pdev
);
1589 msix_uninit(&vdev
->pdev
,
1590 vdev
->bars
[vdev
->msix
->table_bar
].mr
,
1591 vdev
->bars
[vdev
->msix
->pba_bar
].mr
);
1592 g_free(vdev
->msix
->pending
);
1599 static void vfio_mmap_set_enabled(VFIOPCIDevice
*vdev
, bool enabled
)
1603 for (i
= 0; i
< PCI_ROM_SLOT
; i
++) {
1604 vfio_region_mmaps_set_enabled(&vdev
->bars
[i
].region
, enabled
);
1608 static void vfio_bar_prepare(VFIOPCIDevice
*vdev
, int nr
)
1610 VFIOBAR
*bar
= &vdev
->bars
[nr
];
1615 /* Skip both unimplemented BARs and the upper half of 64bit BARS. */
1616 if (!bar
->region
.size
) {
1620 /* Determine what type of BAR this is for registration */
1621 ret
= pread(vdev
->vbasedev
.fd
, &pci_bar
, sizeof(pci_bar
),
1622 vdev
->config_offset
+ PCI_BASE_ADDRESS_0
+ (4 * nr
));
1623 if (ret
!= sizeof(pci_bar
)) {
1624 error_report("vfio: Failed to read BAR %d (%m)", nr
);
1628 pci_bar
= le32_to_cpu(pci_bar
);
1629 bar
->ioport
= (pci_bar
& PCI_BASE_ADDRESS_SPACE_IO
);
1630 bar
->mem64
= bar
->ioport
? 0 : (pci_bar
& PCI_BASE_ADDRESS_MEM_TYPE_64
);
1631 bar
->type
= pci_bar
& (bar
->ioport
? ~PCI_BASE_ADDRESS_IO_MASK
:
1632 ~PCI_BASE_ADDRESS_MEM_MASK
);
1633 bar
->size
= bar
->region
.size
;
1636 static void vfio_bars_prepare(VFIOPCIDevice
*vdev
)
1640 for (i
= 0; i
< PCI_ROM_SLOT
; i
++) {
1641 vfio_bar_prepare(vdev
, i
);
1645 static void vfio_bar_register(VFIOPCIDevice
*vdev
, int nr
)
1647 VFIOBAR
*bar
= &vdev
->bars
[nr
];
1654 bar
->mr
= g_new0(MemoryRegion
, 1);
1655 name
= g_strdup_printf("%s base BAR %d", vdev
->vbasedev
.name
, nr
);
1656 memory_region_init_io(bar
->mr
, OBJECT(vdev
), NULL
, NULL
, name
, bar
->size
);
1659 if (bar
->region
.size
) {
1660 memory_region_add_subregion(bar
->mr
, 0, bar
->region
.mem
);
1662 if (vfio_region_mmap(&bar
->region
)) {
1663 error_report("Failed to mmap %s BAR %d. Performance may be slow",
1664 vdev
->vbasedev
.name
, nr
);
1668 pci_register_bar(&vdev
->pdev
, nr
, bar
->type
, bar
->mr
);
1671 static void vfio_bars_register(VFIOPCIDevice
*vdev
)
1675 for (i
= 0; i
< PCI_ROM_SLOT
; i
++) {
1676 vfio_bar_register(vdev
, i
);
1680 static void vfio_bars_exit(VFIOPCIDevice
*vdev
)
1684 for (i
= 0; i
< PCI_ROM_SLOT
; i
++) {
1685 VFIOBAR
*bar
= &vdev
->bars
[i
];
1687 vfio_bar_quirk_exit(vdev
, i
);
1688 vfio_region_exit(&bar
->region
);
1689 if (bar
->region
.size
) {
1690 memory_region_del_subregion(bar
->mr
, bar
->region
.mem
);
1695 pci_unregister_vga(&vdev
->pdev
);
1696 vfio_vga_quirk_exit(vdev
);
1700 static void vfio_bars_finalize(VFIOPCIDevice
*vdev
)
1704 for (i
= 0; i
< PCI_ROM_SLOT
; i
++) {
1705 VFIOBAR
*bar
= &vdev
->bars
[i
];
1707 vfio_bar_quirk_finalize(vdev
, i
);
1708 vfio_region_finalize(&bar
->region
);
1710 object_unparent(OBJECT(bar
->mr
));
1716 vfio_vga_quirk_finalize(vdev
);
1717 for (i
= 0; i
< ARRAY_SIZE(vdev
->vga
->region
); i
++) {
1718 object_unparent(OBJECT(&vdev
->vga
->region
[i
].mem
));
1727 static uint8_t vfio_std_cap_max_size(PCIDevice
*pdev
, uint8_t pos
)
1730 uint16_t next
= PCI_CONFIG_SPACE_SIZE
;
1732 for (tmp
= pdev
->config
[PCI_CAPABILITY_LIST
]; tmp
;
1733 tmp
= pdev
->config
[tmp
+ PCI_CAP_LIST_NEXT
]) {
1734 if (tmp
> pos
&& tmp
< next
) {
1743 static uint16_t vfio_ext_cap_max_size(const uint8_t *config
, uint16_t pos
)
1745 uint16_t tmp
, next
= PCIE_CONFIG_SPACE_SIZE
;
1747 for (tmp
= PCI_CONFIG_SPACE_SIZE
; tmp
;
1748 tmp
= PCI_EXT_CAP_NEXT(pci_get_long(config
+ tmp
))) {
1749 if (tmp
> pos
&& tmp
< next
) {
1757 static void vfio_set_word_bits(uint8_t *buf
, uint16_t val
, uint16_t mask
)
1759 pci_set_word(buf
, (pci_get_word(buf
) & ~mask
) | val
);
1762 static void vfio_add_emulated_word(VFIOPCIDevice
*vdev
, int pos
,
1763 uint16_t val
, uint16_t mask
)
1765 vfio_set_word_bits(vdev
->pdev
.config
+ pos
, val
, mask
);
1766 vfio_set_word_bits(vdev
->pdev
.wmask
+ pos
, ~mask
, mask
);
1767 vfio_set_word_bits(vdev
->emulated_config_bits
+ pos
, mask
, mask
);
1770 static void vfio_set_long_bits(uint8_t *buf
, uint32_t val
, uint32_t mask
)
1772 pci_set_long(buf
, (pci_get_long(buf
) & ~mask
) | val
);
1775 static void vfio_add_emulated_long(VFIOPCIDevice
*vdev
, int pos
,
1776 uint32_t val
, uint32_t mask
)
1778 vfio_set_long_bits(vdev
->pdev
.config
+ pos
, val
, mask
);
1779 vfio_set_long_bits(vdev
->pdev
.wmask
+ pos
, ~mask
, mask
);
1780 vfio_set_long_bits(vdev
->emulated_config_bits
+ pos
, mask
, mask
);
1783 static int vfio_setup_pcie_cap(VFIOPCIDevice
*vdev
, int pos
, uint8_t size
,
1789 flags
= pci_get_word(vdev
->pdev
.config
+ pos
+ PCI_CAP_FLAGS
);
1790 type
= (flags
& PCI_EXP_FLAGS_TYPE
) >> 4;
1792 if (type
!= PCI_EXP_TYPE_ENDPOINT
&&
1793 type
!= PCI_EXP_TYPE_LEG_END
&&
1794 type
!= PCI_EXP_TYPE_RC_END
) {
1796 error_setg(errp
, "assignment of PCIe type 0x%x "
1797 "devices is not currently supported", type
);
1801 if (!pci_bus_is_express(pci_get_bus(&vdev
->pdev
))) {
1802 PCIBus
*bus
= pci_get_bus(&vdev
->pdev
);
1806 * Traditionally PCI device assignment exposes the PCIe capability
1807 * as-is on non-express buses. The reason being that some drivers
1808 * simply assume that it's there, for example tg3. However when
1809 * we're running on a native PCIe machine type, like Q35, we need
1810 * to hide the PCIe capability. The reason for this is twofold;
1811 * first Windows guests get a Code 10 error when the PCIe capability
1812 * is exposed in this configuration. Therefore express devices won't
1813 * work at all unless they're attached to express buses in the VM.
1814 * Second, a native PCIe machine introduces the possibility of fine
1815 * granularity IOMMUs supporting both translation and isolation.
1816 * Guest code to discover the IOMMU visibility of a device, such as
1817 * IOMMU grouping code on Linux, is very aware of device types and
1818 * valid transitions between bus types. An express device on a non-
1819 * express bus is not a valid combination on bare metal systems.
1821 * Drivers that require a PCIe capability to make the device
1822 * functional are simply going to need to have their devices placed
1823 * on a PCIe bus in the VM.
1825 while (!pci_bus_is_root(bus
)) {
1826 bridge
= pci_bridge_get_device(bus
);
1827 bus
= pci_get_bus(bridge
);
1830 if (pci_bus_is_express(bus
)) {
1834 } else if (pci_bus_is_root(pci_get_bus(&vdev
->pdev
))) {
1836 * On a Root Complex bus Endpoints become Root Complex Integrated
1837 * Endpoints, which changes the type and clears the LNK & LNK2 fields.
1839 if (type
== PCI_EXP_TYPE_ENDPOINT
) {
1840 vfio_add_emulated_word(vdev
, pos
+ PCI_CAP_FLAGS
,
1841 PCI_EXP_TYPE_RC_END
<< 4,
1842 PCI_EXP_FLAGS_TYPE
);
1844 /* Link Capabilities, Status, and Control goes away */
1845 if (size
> PCI_EXP_LNKCTL
) {
1846 vfio_add_emulated_long(vdev
, pos
+ PCI_EXP_LNKCAP
, 0, ~0);
1847 vfio_add_emulated_word(vdev
, pos
+ PCI_EXP_LNKCTL
, 0, ~0);
1848 vfio_add_emulated_word(vdev
, pos
+ PCI_EXP_LNKSTA
, 0, ~0);
1850 #ifndef PCI_EXP_LNKCAP2
1851 #define PCI_EXP_LNKCAP2 44
1853 #ifndef PCI_EXP_LNKSTA2
1854 #define PCI_EXP_LNKSTA2 50
1856 /* Link 2 Capabilities, Status, and Control goes away */
1857 if (size
> PCI_EXP_LNKCAP2
) {
1858 vfio_add_emulated_long(vdev
, pos
+ PCI_EXP_LNKCAP2
, 0, ~0);
1859 vfio_add_emulated_word(vdev
, pos
+ PCI_EXP_LNKCTL2
, 0, ~0);
1860 vfio_add_emulated_word(vdev
, pos
+ PCI_EXP_LNKSTA2
, 0, ~0);
1864 } else if (type
== PCI_EXP_TYPE_LEG_END
) {
1866 * Legacy endpoints don't belong on the root complex. Windows
1867 * seems to be happier with devices if we skip the capability.
1874 * Convert Root Complex Integrated Endpoints to regular endpoints.
1875 * These devices don't support LNK/LNK2 capabilities, so make them up.
1877 if (type
== PCI_EXP_TYPE_RC_END
) {
1878 vfio_add_emulated_word(vdev
, pos
+ PCI_CAP_FLAGS
,
1879 PCI_EXP_TYPE_ENDPOINT
<< 4,
1880 PCI_EXP_FLAGS_TYPE
);
1881 vfio_add_emulated_long(vdev
, pos
+ PCI_EXP_LNKCAP
,
1882 QEMU_PCI_EXP_LNKCAP_MLW(QEMU_PCI_EXP_LNK_X1
) |
1883 QEMU_PCI_EXP_LNKCAP_MLS(QEMU_PCI_EXP_LNK_2_5GT
), ~0);
1884 vfio_add_emulated_word(vdev
, pos
+ PCI_EXP_LNKCTL
, 0, ~0);
1889 * Intel 82599 SR-IOV VFs report an invalid PCIe capability version 0
1890 * (Niantic errate #35) causing Windows to error with a Code 10 for the
1891 * device on Q35. Fixup any such devices to report version 1. If we
1892 * were to remove the capability entirely the guest would lose extended
1895 if ((flags
& PCI_EXP_FLAGS_VERS
) == 0) {
1896 vfio_add_emulated_word(vdev
, pos
+ PCI_CAP_FLAGS
,
1897 1, PCI_EXP_FLAGS_VERS
);
1900 pos
= pci_add_capability(&vdev
->pdev
, PCI_CAP_ID_EXP
, pos
, size
,
1906 vdev
->pdev
.exp
.exp_cap
= pos
;
1911 static void vfio_check_pcie_flr(VFIOPCIDevice
*vdev
, uint8_t pos
)
1913 uint32_t cap
= pci_get_long(vdev
->pdev
.config
+ pos
+ PCI_EXP_DEVCAP
);
1915 if (cap
& PCI_EXP_DEVCAP_FLR
) {
1916 trace_vfio_check_pcie_flr(vdev
->vbasedev
.name
);
1917 vdev
->has_flr
= true;
1921 static void vfio_check_pm_reset(VFIOPCIDevice
*vdev
, uint8_t pos
)
1923 uint16_t csr
= pci_get_word(vdev
->pdev
.config
+ pos
+ PCI_PM_CTRL
);
1925 if (!(csr
& PCI_PM_CTRL_NO_SOFT_RESET
)) {
1926 trace_vfio_check_pm_reset(vdev
->vbasedev
.name
);
1927 vdev
->has_pm_reset
= true;
1931 static void vfio_check_af_flr(VFIOPCIDevice
*vdev
, uint8_t pos
)
1933 uint8_t cap
= pci_get_byte(vdev
->pdev
.config
+ pos
+ PCI_AF_CAP
);
1935 if ((cap
& PCI_AF_CAP_TP
) && (cap
& PCI_AF_CAP_FLR
)) {
1936 trace_vfio_check_af_flr(vdev
->vbasedev
.name
);
1937 vdev
->has_flr
= true;
1941 static int vfio_add_std_cap(VFIOPCIDevice
*vdev
, uint8_t pos
, Error
**errp
)
1943 PCIDevice
*pdev
= &vdev
->pdev
;
1944 uint8_t cap_id
, next
, size
;
1947 cap_id
= pdev
->config
[pos
];
1948 next
= pdev
->config
[pos
+ PCI_CAP_LIST_NEXT
];
1951 * If it becomes important to configure capabilities to their actual
1952 * size, use this as the default when it's something we don't recognize.
1953 * Since QEMU doesn't actually handle many of the config accesses,
1954 * exact size doesn't seem worthwhile.
1956 size
= vfio_std_cap_max_size(pdev
, pos
);
1959 * pci_add_capability always inserts the new capability at the head
1960 * of the chain. Therefore to end up with a chain that matches the
1961 * physical device, we insert from the end by making this recursive.
1962 * This is also why we pre-calculate size above as cached config space
1963 * will be changed as we unwind the stack.
1966 ret
= vfio_add_std_cap(vdev
, next
, errp
);
1971 /* Begin the rebuild, use QEMU emulated list bits */
1972 pdev
->config
[PCI_CAPABILITY_LIST
] = 0;
1973 vdev
->emulated_config_bits
[PCI_CAPABILITY_LIST
] = 0xff;
1974 vdev
->emulated_config_bits
[PCI_STATUS
] |= PCI_STATUS_CAP_LIST
;
1976 ret
= vfio_add_virt_caps(vdev
, errp
);
1982 /* Scale down size, esp in case virt caps were added above */
1983 size
= MIN(size
, vfio_std_cap_max_size(pdev
, pos
));
1985 /* Use emulated next pointer to allow dropping caps */
1986 pci_set_byte(vdev
->emulated_config_bits
+ pos
+ PCI_CAP_LIST_NEXT
, 0xff);
1989 case PCI_CAP_ID_MSI
:
1990 ret
= vfio_msi_setup(vdev
, pos
, errp
);
1992 case PCI_CAP_ID_EXP
:
1993 vfio_check_pcie_flr(vdev
, pos
);
1994 ret
= vfio_setup_pcie_cap(vdev
, pos
, size
, errp
);
1996 case PCI_CAP_ID_MSIX
:
1997 ret
= vfio_msix_setup(vdev
, pos
, errp
);
2000 vfio_check_pm_reset(vdev
, pos
);
2002 ret
= pci_add_capability(pdev
, cap_id
, pos
, size
, errp
);
2005 vfio_check_af_flr(vdev
, pos
);
2006 ret
= pci_add_capability(pdev
, cap_id
, pos
, size
, errp
);
2009 ret
= pci_add_capability(pdev
, cap_id
, pos
, size
, errp
);
2015 "failed to add PCI capability 0x%x[0x%x]@0x%x: ",
2023 static void vfio_add_ext_cap(VFIOPCIDevice
*vdev
)
2025 PCIDevice
*pdev
= &vdev
->pdev
;
2027 uint16_t cap_id
, next
, size
;
2031 /* Only add extended caps if we have them and the guest can see them */
2032 if (!pci_is_express(pdev
) || !pci_bus_is_express(pci_get_bus(pdev
)) ||
2033 !pci_get_long(pdev
->config
+ PCI_CONFIG_SPACE_SIZE
)) {
2038 * pcie_add_capability always inserts the new capability at the tail
2039 * of the chain. Therefore to end up with a chain that matches the
2040 * physical device, we cache the config space to avoid overwriting
2041 * the original config space when we parse the extended capabilities.
2043 config
= g_memdup(pdev
->config
, vdev
->config_size
);
2046 * Extended capabilities are chained with each pointing to the next, so we
2047 * can drop anything other than the head of the chain simply by modifying
2048 * the previous next pointer. Seed the head of the chain here such that
2049 * we can simply skip any capabilities we want to drop below, regardless
2050 * of their position in the chain. If this stub capability still exists
2051 * after we add the capabilities we want to expose, update the capability
2052 * ID to zero. Note that we cannot seed with the capability header being
2053 * zero as this conflicts with definition of an absent capability chain
2054 * and prevents capabilities beyond the head of the list from being added.
2055 * By replacing the dummy capability ID with zero after walking the device
2056 * chain, we also transparently mark extended capabilities as absent if
2057 * no capabilities were added. Note that the PCIe spec defines an absence
2058 * of extended capabilities to be determined by a value of zero for the
2059 * capability ID, version, AND next pointer. A non-zero next pointer
2060 * should be sufficient to indicate additional capabilities are present,
2061 * which will occur if we call pcie_add_capability() below. The entire
2062 * first dword is emulated to support this.
2064 * NB. The kernel side does similar masking, so be prepared that our
2065 * view of the device may also contain a capability ID zero in the head
2066 * of the chain. Skip it for the same reason that we cannot seed the
2067 * chain with a zero capability.
2069 pci_set_long(pdev
->config
+ PCI_CONFIG_SPACE_SIZE
,
2070 PCI_EXT_CAP(0xFFFF, 0, 0));
2071 pci_set_long(pdev
->wmask
+ PCI_CONFIG_SPACE_SIZE
, 0);
2072 pci_set_long(vdev
->emulated_config_bits
+ PCI_CONFIG_SPACE_SIZE
, ~0);
2074 for (next
= PCI_CONFIG_SPACE_SIZE
; next
;
2075 next
= PCI_EXT_CAP_NEXT(pci_get_long(config
+ next
))) {
2076 header
= pci_get_long(config
+ next
);
2077 cap_id
= PCI_EXT_CAP_ID(header
);
2078 cap_ver
= PCI_EXT_CAP_VER(header
);
2081 * If it becomes important to configure extended capabilities to their
2082 * actual size, use this as the default when it's something we don't
2083 * recognize. Since QEMU doesn't actually handle many of the config
2084 * accesses, exact size doesn't seem worthwhile.
2086 size
= vfio_ext_cap_max_size(config
, next
);
2088 /* Use emulated next pointer to allow dropping extended caps */
2089 pci_long_test_and_set_mask(vdev
->emulated_config_bits
+ next
,
2090 PCI_EXT_CAP_NEXT_MASK
);
2093 case 0: /* kernel masked capability */
2094 case PCI_EXT_CAP_ID_SRIOV
: /* Read-only VF BARs confuse OVMF */
2095 case PCI_EXT_CAP_ID_ARI
: /* XXX Needs next function virtualization */
2096 case PCI_EXT_CAP_ID_REBAR
: /* Can't expose read-only */
2097 trace_vfio_add_ext_cap_dropped(vdev
->vbasedev
.name
, cap_id
, next
);
2100 pcie_add_capability(pdev
, cap_id
, cap_ver
, next
, size
);
2105 /* Cleanup chain head ID if necessary */
2106 if (pci_get_word(pdev
->config
+ PCI_CONFIG_SPACE_SIZE
) == 0xFFFF) {
2107 pci_set_word(pdev
->config
+ PCI_CONFIG_SPACE_SIZE
, 0);
2114 static int vfio_add_capabilities(VFIOPCIDevice
*vdev
, Error
**errp
)
2116 PCIDevice
*pdev
= &vdev
->pdev
;
2119 if (!(pdev
->config
[PCI_STATUS
] & PCI_STATUS_CAP_LIST
) ||
2120 !pdev
->config
[PCI_CAPABILITY_LIST
]) {
2121 return 0; /* Nothing to add */
2124 ret
= vfio_add_std_cap(vdev
, pdev
->config
[PCI_CAPABILITY_LIST
], errp
);
2129 vfio_add_ext_cap(vdev
);
2133 static void vfio_pci_pre_reset(VFIOPCIDevice
*vdev
)
2135 PCIDevice
*pdev
= &vdev
->pdev
;
2138 vfio_disable_interrupts(vdev
);
2140 /* Make sure the device is in D0 */
2145 pmcsr
= vfio_pci_read_config(pdev
, vdev
->pm_cap
+ PCI_PM_CTRL
, 2);
2146 state
= pmcsr
& PCI_PM_CTRL_STATE_MASK
;
2148 pmcsr
&= ~PCI_PM_CTRL_STATE_MASK
;
2149 vfio_pci_write_config(pdev
, vdev
->pm_cap
+ PCI_PM_CTRL
, pmcsr
, 2);
2150 /* vfio handles the necessary delay here */
2151 pmcsr
= vfio_pci_read_config(pdev
, vdev
->pm_cap
+ PCI_PM_CTRL
, 2);
2152 state
= pmcsr
& PCI_PM_CTRL_STATE_MASK
;
2154 error_report("vfio: Unable to power on device, stuck in D%d",
2161 * Stop any ongoing DMA by disconnecting I/O, MMIO, and bus master.
2162 * Also put INTx Disable in known state.
2164 cmd
= vfio_pci_read_config(pdev
, PCI_COMMAND
, 2);
2165 cmd
&= ~(PCI_COMMAND_IO
| PCI_COMMAND_MEMORY
| PCI_COMMAND_MASTER
|
2166 PCI_COMMAND_INTX_DISABLE
);
2167 vfio_pci_write_config(pdev
, PCI_COMMAND
, cmd
, 2);
2170 static void vfio_pci_post_reset(VFIOPCIDevice
*vdev
)
2175 vfio_intx_enable(vdev
, &err
);
2177 error_reportf_err(err
, VFIO_MSG_PREFIX
, vdev
->vbasedev
.name
);
2180 for (nr
= 0; nr
< PCI_NUM_REGIONS
- 1; ++nr
) {
2181 off_t addr
= vdev
->config_offset
+ PCI_BASE_ADDRESS_0
+ (4 * nr
);
2183 uint32_t len
= sizeof(val
);
2185 if (pwrite(vdev
->vbasedev
.fd
, &val
, len
, addr
) != len
) {
2186 error_report("%s(%s) reset bar %d failed: %m", __func__
,
2187 vdev
->vbasedev
.name
, nr
);
2191 vfio_quirk_reset(vdev
);
2194 static bool vfio_pci_host_match(PCIHostDeviceAddress
*addr
, const char *name
)
2198 sprintf(tmp
, "%04x:%02x:%02x.%1x", addr
->domain
,
2199 addr
->bus
, addr
->slot
, addr
->function
);
2201 return (strcmp(tmp
, name
) == 0);
2204 static int vfio_pci_hot_reset(VFIOPCIDevice
*vdev
, bool single
)
2207 struct vfio_pci_hot_reset_info
*info
;
2208 struct vfio_pci_dependent_device
*devices
;
2209 struct vfio_pci_hot_reset
*reset
;
2214 trace_vfio_pci_hot_reset(vdev
->vbasedev
.name
, single
? "one" : "multi");
2217 vfio_pci_pre_reset(vdev
);
2219 vdev
->vbasedev
.needs_reset
= false;
2221 info
= g_malloc0(sizeof(*info
));
2222 info
->argsz
= sizeof(*info
);
2224 ret
= ioctl(vdev
->vbasedev
.fd
, VFIO_DEVICE_GET_PCI_HOT_RESET_INFO
, info
);
2225 if (ret
&& errno
!= ENOSPC
) {
2227 if (!vdev
->has_pm_reset
) {
2228 error_report("vfio: Cannot reset device %s, "
2229 "no available reset mechanism.", vdev
->vbasedev
.name
);
2234 count
= info
->count
;
2235 info
= g_realloc(info
, sizeof(*info
) + (count
* sizeof(*devices
)));
2236 info
->argsz
= sizeof(*info
) + (count
* sizeof(*devices
));
2237 devices
= &info
->devices
[0];
2239 ret
= ioctl(vdev
->vbasedev
.fd
, VFIO_DEVICE_GET_PCI_HOT_RESET_INFO
, info
);
2242 error_report("vfio: hot reset info failed: %m");
2246 trace_vfio_pci_hot_reset_has_dep_devices(vdev
->vbasedev
.name
);
2248 /* Verify that we have all the groups required */
2249 for (i
= 0; i
< info
->count
; i
++) {
2250 PCIHostDeviceAddress host
;
2252 VFIODevice
*vbasedev_iter
;
2254 host
.domain
= devices
[i
].segment
;
2255 host
.bus
= devices
[i
].bus
;
2256 host
.slot
= PCI_SLOT(devices
[i
].devfn
);
2257 host
.function
= PCI_FUNC(devices
[i
].devfn
);
2259 trace_vfio_pci_hot_reset_dep_devices(host
.domain
,
2260 host
.bus
, host
.slot
, host
.function
, devices
[i
].group_id
);
2262 if (vfio_pci_host_match(&host
, vdev
->vbasedev
.name
)) {
2266 QLIST_FOREACH(group
, &vfio_group_list
, next
) {
2267 if (group
->groupid
== devices
[i
].group_id
) {
2273 if (!vdev
->has_pm_reset
) {
2274 error_report("vfio: Cannot reset device %s, "
2275 "depends on group %d which is not owned.",
2276 vdev
->vbasedev
.name
, devices
[i
].group_id
);
2282 /* Prep dependent devices for reset and clear our marker. */
2283 QLIST_FOREACH(vbasedev_iter
, &group
->device_list
, next
) {
2284 if (!vbasedev_iter
->dev
->realized
||
2285 vbasedev_iter
->type
!= VFIO_DEVICE_TYPE_PCI
) {
2288 tmp
= container_of(vbasedev_iter
, VFIOPCIDevice
, vbasedev
);
2289 if (vfio_pci_host_match(&host
, tmp
->vbasedev
.name
)) {
2294 vfio_pci_pre_reset(tmp
);
2295 tmp
->vbasedev
.needs_reset
= false;
2302 if (!single
&& !multi
) {
2307 /* Determine how many group fds need to be passed */
2309 QLIST_FOREACH(group
, &vfio_group_list
, next
) {
2310 for (i
= 0; i
< info
->count
; i
++) {
2311 if (group
->groupid
== devices
[i
].group_id
) {
2318 reset
= g_malloc0(sizeof(*reset
) + (count
* sizeof(*fds
)));
2319 reset
->argsz
= sizeof(*reset
) + (count
* sizeof(*fds
));
2320 fds
= &reset
->group_fds
[0];
2322 /* Fill in group fds */
2323 QLIST_FOREACH(group
, &vfio_group_list
, next
) {
2324 for (i
= 0; i
< info
->count
; i
++) {
2325 if (group
->groupid
== devices
[i
].group_id
) {
2326 fds
[reset
->count
++] = group
->fd
;
2333 ret
= ioctl(vdev
->vbasedev
.fd
, VFIO_DEVICE_PCI_HOT_RESET
, reset
);
2336 trace_vfio_pci_hot_reset_result(vdev
->vbasedev
.name
,
2337 ret
? "%m" : "Success");
2340 /* Re-enable INTx on affected devices */
2341 for (i
= 0; i
< info
->count
; i
++) {
2342 PCIHostDeviceAddress host
;
2344 VFIODevice
*vbasedev_iter
;
2346 host
.domain
= devices
[i
].segment
;
2347 host
.bus
= devices
[i
].bus
;
2348 host
.slot
= PCI_SLOT(devices
[i
].devfn
);
2349 host
.function
= PCI_FUNC(devices
[i
].devfn
);
2351 if (vfio_pci_host_match(&host
, vdev
->vbasedev
.name
)) {
2355 QLIST_FOREACH(group
, &vfio_group_list
, next
) {
2356 if (group
->groupid
== devices
[i
].group_id
) {
2365 QLIST_FOREACH(vbasedev_iter
, &group
->device_list
, next
) {
2366 if (!vbasedev_iter
->dev
->realized
||
2367 vbasedev_iter
->type
!= VFIO_DEVICE_TYPE_PCI
) {
2370 tmp
= container_of(vbasedev_iter
, VFIOPCIDevice
, vbasedev
);
2371 if (vfio_pci_host_match(&host
, tmp
->vbasedev
.name
)) {
2372 vfio_pci_post_reset(tmp
);
2379 vfio_pci_post_reset(vdev
);
2387 * We want to differentiate hot reset of multiple in-use devices vs hot reset
2388 * of a single in-use device. VFIO_DEVICE_RESET will already handle the case
2389 * of doing hot resets when there is only a single device per bus. The in-use
2390 * here refers to how many VFIODevices are affected. A hot reset that affects
2391 * multiple devices, but only a single in-use device, means that we can call
2392 * it from our bus ->reset() callback since the extent is effectively a single
2393 * device. This allows us to make use of it in the hotplug path. When there
2394 * are multiple in-use devices, we can only trigger the hot reset during a
2395 * system reset and thus from our reset handler. We separate _one vs _multi
2396 * here so that we don't overlap and do a double reset on the system reset
2397 * path where both our reset handler and ->reset() callback are used. Calling
2398 * _one() will only do a hot reset for the one in-use devices case, calling
2399 * _multi() will do nothing if a _one() would have been sufficient.
2401 static int vfio_pci_hot_reset_one(VFIOPCIDevice
*vdev
)
2403 return vfio_pci_hot_reset(vdev
, true);
2406 static int vfio_pci_hot_reset_multi(VFIODevice
*vbasedev
)
2408 VFIOPCIDevice
*vdev
= container_of(vbasedev
, VFIOPCIDevice
, vbasedev
);
2409 return vfio_pci_hot_reset(vdev
, false);
2412 static void vfio_pci_compute_needs_reset(VFIODevice
*vbasedev
)
2414 VFIOPCIDevice
*vdev
= container_of(vbasedev
, VFIOPCIDevice
, vbasedev
);
2415 if (!vbasedev
->reset_works
|| (!vdev
->has_flr
&& vdev
->has_pm_reset
)) {
2416 vbasedev
->needs_reset
= true;
2420 static Object
*vfio_pci_get_object(VFIODevice
*vbasedev
)
2422 VFIOPCIDevice
*vdev
= container_of(vbasedev
, VFIOPCIDevice
, vbasedev
);
2424 return OBJECT(vdev
);
2427 static bool vfio_msix_present(void *opaque
, int version_id
)
2429 PCIDevice
*pdev
= opaque
;
2431 return msix_present(pdev
);
2434 const VMStateDescription vmstate_vfio_pci_config
= {
2435 .name
= "VFIOPCIDevice",
2437 .minimum_version_id
= 1,
2438 .fields
= (VMStateField
[]) {
2439 VMSTATE_PCI_DEVICE(pdev
, VFIOPCIDevice
),
2440 VMSTATE_MSIX_TEST(pdev
, VFIOPCIDevice
, vfio_msix_present
),
2441 VMSTATE_END_OF_LIST()
2445 static void vfio_pci_save_config(VFIODevice
*vbasedev
, QEMUFile
*f
)
2447 VFIOPCIDevice
*vdev
= container_of(vbasedev
, VFIOPCIDevice
, vbasedev
);
2449 vmstate_save_state(f
, &vmstate_vfio_pci_config
, vdev
, NULL
);
2452 static int vfio_pci_load_config(VFIODevice
*vbasedev
, QEMUFile
*f
)
2454 VFIOPCIDevice
*vdev
= container_of(vbasedev
, VFIOPCIDevice
, vbasedev
);
2455 PCIDevice
*pdev
= &vdev
->pdev
;
2456 pcibus_t old_addr
[PCI_NUM_REGIONS
- 1];
2459 for (bar
= 0; bar
< PCI_ROM_SLOT
; bar
++) {
2460 old_addr
[bar
] = pdev
->io_regions
[bar
].addr
;
2463 ret
= vmstate_load_state(f
, &vmstate_vfio_pci_config
, vdev
, 1);
2468 vfio_pci_write_config(pdev
, PCI_COMMAND
,
2469 pci_get_word(pdev
->config
+ PCI_COMMAND
), 2);
2471 for (bar
= 0; bar
< PCI_ROM_SLOT
; bar
++) {
2473 * The address may not be changed in some scenarios
2474 * (e.g. the VF driver isn't loaded in VM).
2476 if (old_addr
[bar
] != pdev
->io_regions
[bar
].addr
&&
2477 vdev
->bars
[bar
].region
.size
> 0 &&
2478 vdev
->bars
[bar
].region
.size
< qemu_real_host_page_size
) {
2479 vfio_sub_page_bar_update_mapping(pdev
, bar
);
2483 if (msi_enabled(pdev
)) {
2484 vfio_msi_enable(vdev
);
2485 } else if (msix_enabled(pdev
)) {
2486 vfio_msix_enable(vdev
);
2492 static VFIODeviceOps vfio_pci_ops
= {
2493 .vfio_compute_needs_reset
= vfio_pci_compute_needs_reset
,
2494 .vfio_hot_reset_multi
= vfio_pci_hot_reset_multi
,
2495 .vfio_eoi
= vfio_intx_eoi
,
2496 .vfio_get_object
= vfio_pci_get_object
,
2497 .vfio_save_config
= vfio_pci_save_config
,
2498 .vfio_load_config
= vfio_pci_load_config
,
2501 int vfio_populate_vga(VFIOPCIDevice
*vdev
, Error
**errp
)
2503 VFIODevice
*vbasedev
= &vdev
->vbasedev
;
2504 struct vfio_region_info
*reg_info
;
2507 ret
= vfio_get_region_info(vbasedev
, VFIO_PCI_VGA_REGION_INDEX
, ®_info
);
2509 error_setg_errno(errp
, -ret
,
2510 "failed getting region info for VGA region index %d",
2511 VFIO_PCI_VGA_REGION_INDEX
);
2515 if (!(reg_info
->flags
& VFIO_REGION_INFO_FLAG_READ
) ||
2516 !(reg_info
->flags
& VFIO_REGION_INFO_FLAG_WRITE
) ||
2517 reg_info
->size
< 0xbffff + 1) {
2518 error_setg(errp
, "unexpected VGA info, flags 0x%lx, size 0x%lx",
2519 (unsigned long)reg_info
->flags
,
2520 (unsigned long)reg_info
->size
);
2525 vdev
->vga
= g_new0(VFIOVGA
, 1);
2527 vdev
->vga
->fd_offset
= reg_info
->offset
;
2528 vdev
->vga
->fd
= vdev
->vbasedev
.fd
;
2532 vdev
->vga
->region
[QEMU_PCI_VGA_MEM
].offset
= QEMU_PCI_VGA_MEM_BASE
;
2533 vdev
->vga
->region
[QEMU_PCI_VGA_MEM
].nr
= QEMU_PCI_VGA_MEM
;
2534 QLIST_INIT(&vdev
->vga
->region
[QEMU_PCI_VGA_MEM
].quirks
);
2536 memory_region_init_io(&vdev
->vga
->region
[QEMU_PCI_VGA_MEM
].mem
,
2537 OBJECT(vdev
), &vfio_vga_ops
,
2538 &vdev
->vga
->region
[QEMU_PCI_VGA_MEM
],
2539 "vfio-vga-mmio@0xa0000",
2540 QEMU_PCI_VGA_MEM_SIZE
);
2542 vdev
->vga
->region
[QEMU_PCI_VGA_IO_LO
].offset
= QEMU_PCI_VGA_IO_LO_BASE
;
2543 vdev
->vga
->region
[QEMU_PCI_VGA_IO_LO
].nr
= QEMU_PCI_VGA_IO_LO
;
2544 QLIST_INIT(&vdev
->vga
->region
[QEMU_PCI_VGA_IO_LO
].quirks
);
2546 memory_region_init_io(&vdev
->vga
->region
[QEMU_PCI_VGA_IO_LO
].mem
,
2547 OBJECT(vdev
), &vfio_vga_ops
,
2548 &vdev
->vga
->region
[QEMU_PCI_VGA_IO_LO
],
2549 "vfio-vga-io@0x3b0",
2550 QEMU_PCI_VGA_IO_LO_SIZE
);
2552 vdev
->vga
->region
[QEMU_PCI_VGA_IO_HI
].offset
= QEMU_PCI_VGA_IO_HI_BASE
;
2553 vdev
->vga
->region
[QEMU_PCI_VGA_IO_HI
].nr
= QEMU_PCI_VGA_IO_HI
;
2554 QLIST_INIT(&vdev
->vga
->region
[QEMU_PCI_VGA_IO_HI
].quirks
);
2556 memory_region_init_io(&vdev
->vga
->region
[QEMU_PCI_VGA_IO_HI
].mem
,
2557 OBJECT(vdev
), &vfio_vga_ops
,
2558 &vdev
->vga
->region
[QEMU_PCI_VGA_IO_HI
],
2559 "vfio-vga-io@0x3c0",
2560 QEMU_PCI_VGA_IO_HI_SIZE
);
2562 pci_register_vga(&vdev
->pdev
, &vdev
->vga
->region
[QEMU_PCI_VGA_MEM
].mem
,
2563 &vdev
->vga
->region
[QEMU_PCI_VGA_IO_LO
].mem
,
2564 &vdev
->vga
->region
[QEMU_PCI_VGA_IO_HI
].mem
);
2569 static void vfio_populate_device(VFIOPCIDevice
*vdev
, Error
**errp
)
2571 VFIODevice
*vbasedev
= &vdev
->vbasedev
;
2572 struct vfio_region_info
*reg_info
;
2573 struct vfio_irq_info irq_info
= { .argsz
= sizeof(irq_info
) };
2576 /* Sanity check device */
2577 if (!(vbasedev
->flags
& VFIO_DEVICE_FLAGS_PCI
)) {
2578 error_setg(errp
, "this isn't a PCI device");
2582 if (vbasedev
->num_regions
< VFIO_PCI_CONFIG_REGION_INDEX
+ 1) {
2583 error_setg(errp
, "unexpected number of io regions %u",
2584 vbasedev
->num_regions
);
2588 if (vbasedev
->num_irqs
< VFIO_PCI_MSIX_IRQ_INDEX
+ 1) {
2589 error_setg(errp
, "unexpected number of irqs %u", vbasedev
->num_irqs
);
2593 for (i
= VFIO_PCI_BAR0_REGION_INDEX
; i
< VFIO_PCI_ROM_REGION_INDEX
; i
++) {
2594 char *name
= g_strdup_printf("%s BAR %d", vbasedev
->name
, i
);
2596 ret
= vfio_region_setup(OBJECT(vdev
), vbasedev
,
2597 &vdev
->bars
[i
].region
, i
, name
);
2601 error_setg_errno(errp
, -ret
, "failed to get region %d info", i
);
2605 QLIST_INIT(&vdev
->bars
[i
].quirks
);
2608 ret
= vfio_get_region_info(vbasedev
,
2609 VFIO_PCI_CONFIG_REGION_INDEX
, ®_info
);
2611 error_setg_errno(errp
, -ret
, "failed to get config info");
2615 trace_vfio_populate_device_config(vdev
->vbasedev
.name
,
2616 (unsigned long)reg_info
->size
,
2617 (unsigned long)reg_info
->offset
,
2618 (unsigned long)reg_info
->flags
);
2620 vdev
->config_size
= reg_info
->size
;
2621 if (vdev
->config_size
== PCI_CONFIG_SPACE_SIZE
) {
2622 vdev
->pdev
.cap_present
&= ~QEMU_PCI_CAP_EXPRESS
;
2624 vdev
->config_offset
= reg_info
->offset
;
2628 if (vdev
->features
& VFIO_FEATURE_ENABLE_VGA
) {
2629 ret
= vfio_populate_vga(vdev
, errp
);
2631 error_append_hint(errp
, "device does not support "
2632 "requested feature x-vga\n");
2637 irq_info
.index
= VFIO_PCI_ERR_IRQ_INDEX
;
2639 ret
= ioctl(vdev
->vbasedev
.fd
, VFIO_DEVICE_GET_IRQ_INFO
, &irq_info
);
2641 /* This can fail for an old kernel or legacy PCI dev */
2642 trace_vfio_populate_device_get_irq_info_failure(strerror(errno
));
2643 } else if (irq_info
.count
== 1) {
2644 vdev
->pci_aer
= true;
2646 warn_report(VFIO_MSG_PREFIX
2647 "Could not enable error recovery for the device",
2652 static void vfio_put_device(VFIOPCIDevice
*vdev
)
2654 g_free(vdev
->vbasedev
.name
);
2657 vfio_put_base_device(&vdev
->vbasedev
);
2660 static void vfio_err_notifier_handler(void *opaque
)
2662 VFIOPCIDevice
*vdev
= opaque
;
2664 if (!event_notifier_test_and_clear(&vdev
->err_notifier
)) {
2669 * TBD. Retrieve the error details and decide what action
2670 * needs to be taken. One of the actions could be to pass
2671 * the error to the guest and have the guest driver recover
2672 * from the error. This requires that PCIe capabilities be
2673 * exposed to the guest. For now, we just terminate the
2674 * guest to contain the error.
2677 error_report("%s(%s) Unrecoverable error detected. Please collect any data possible and then kill the guest", __func__
, vdev
->vbasedev
.name
);
2679 vm_stop(RUN_STATE_INTERNAL_ERROR
);
2683 * Registers error notifier for devices supporting error recovery.
2684 * If we encounter a failure in this function, we report an error
2685 * and continue after disabling error recovery support for the
2688 static void vfio_register_err_notifier(VFIOPCIDevice
*vdev
)
2693 if (!vdev
->pci_aer
) {
2697 if (event_notifier_init(&vdev
->err_notifier
, 0)) {
2698 error_report("vfio: Unable to init event notifier for error detection");
2699 vdev
->pci_aer
= false;
2703 fd
= event_notifier_get_fd(&vdev
->err_notifier
);
2704 qemu_set_fd_handler(fd
, vfio_err_notifier_handler
, NULL
, vdev
);
2706 if (vfio_set_irq_signaling(&vdev
->vbasedev
, VFIO_PCI_ERR_IRQ_INDEX
, 0,
2707 VFIO_IRQ_SET_ACTION_TRIGGER
, fd
, &err
)) {
2708 error_reportf_err(err
, VFIO_MSG_PREFIX
, vdev
->vbasedev
.name
);
2709 qemu_set_fd_handler(fd
, NULL
, NULL
, vdev
);
2710 event_notifier_cleanup(&vdev
->err_notifier
);
2711 vdev
->pci_aer
= false;
2715 static void vfio_unregister_err_notifier(VFIOPCIDevice
*vdev
)
2719 if (!vdev
->pci_aer
) {
2723 if (vfio_set_irq_signaling(&vdev
->vbasedev
, VFIO_PCI_ERR_IRQ_INDEX
, 0,
2724 VFIO_IRQ_SET_ACTION_TRIGGER
, -1, &err
)) {
2725 error_reportf_err(err
, VFIO_MSG_PREFIX
, vdev
->vbasedev
.name
);
2727 qemu_set_fd_handler(event_notifier_get_fd(&vdev
->err_notifier
),
2729 event_notifier_cleanup(&vdev
->err_notifier
);
2732 static void vfio_req_notifier_handler(void *opaque
)
2734 VFIOPCIDevice
*vdev
= opaque
;
2737 if (!event_notifier_test_and_clear(&vdev
->req_notifier
)) {
2741 qdev_unplug(DEVICE(vdev
), &err
);
2743 warn_reportf_err(err
, VFIO_MSG_PREFIX
, vdev
->vbasedev
.name
);
2747 static void vfio_register_req_notifier(VFIOPCIDevice
*vdev
)
2749 struct vfio_irq_info irq_info
= { .argsz
= sizeof(irq_info
),
2750 .index
= VFIO_PCI_REQ_IRQ_INDEX
};
2754 if (!(vdev
->features
& VFIO_FEATURE_ENABLE_REQ
)) {
2758 if (ioctl(vdev
->vbasedev
.fd
,
2759 VFIO_DEVICE_GET_IRQ_INFO
, &irq_info
) < 0 || irq_info
.count
< 1) {
2763 if (event_notifier_init(&vdev
->req_notifier
, 0)) {
2764 error_report("vfio: Unable to init event notifier for device request");
2768 fd
= event_notifier_get_fd(&vdev
->req_notifier
);
2769 qemu_set_fd_handler(fd
, vfio_req_notifier_handler
, NULL
, vdev
);
2771 if (vfio_set_irq_signaling(&vdev
->vbasedev
, VFIO_PCI_REQ_IRQ_INDEX
, 0,
2772 VFIO_IRQ_SET_ACTION_TRIGGER
, fd
, &err
)) {
2773 error_reportf_err(err
, VFIO_MSG_PREFIX
, vdev
->vbasedev
.name
);
2774 qemu_set_fd_handler(fd
, NULL
, NULL
, vdev
);
2775 event_notifier_cleanup(&vdev
->req_notifier
);
2777 vdev
->req_enabled
= true;
2781 static void vfio_unregister_req_notifier(VFIOPCIDevice
*vdev
)
2785 if (!vdev
->req_enabled
) {
2789 if (vfio_set_irq_signaling(&vdev
->vbasedev
, VFIO_PCI_REQ_IRQ_INDEX
, 0,
2790 VFIO_IRQ_SET_ACTION_TRIGGER
, -1, &err
)) {
2791 error_reportf_err(err
, VFIO_MSG_PREFIX
, vdev
->vbasedev
.name
);
2793 qemu_set_fd_handler(event_notifier_get_fd(&vdev
->req_notifier
),
2795 event_notifier_cleanup(&vdev
->req_notifier
);
2797 vdev
->req_enabled
= false;
2800 static void vfio_realize(PCIDevice
*pdev
, Error
**errp
)
2802 VFIOPCIDevice
*vdev
= VFIO_PCI(pdev
);
2803 VFIODevice
*vbasedev_iter
;
2805 char *tmp
, *subsys
, group_path
[PATH_MAX
], *group_name
;
2813 if (!vdev
->vbasedev
.sysfsdev
) {
2814 if (!(~vdev
->host
.domain
|| ~vdev
->host
.bus
||
2815 ~vdev
->host
.slot
|| ~vdev
->host
.function
)) {
2816 error_setg(errp
, "No provided host device");
2817 error_append_hint(errp
, "Use -device vfio-pci,host=DDDD:BB:DD.F "
2818 "or -device vfio-pci,sysfsdev=PATH_TO_DEVICE\n");
2821 vdev
->vbasedev
.sysfsdev
=
2822 g_strdup_printf("/sys/bus/pci/devices/%04x:%02x:%02x.%01x",
2823 vdev
->host
.domain
, vdev
->host
.bus
,
2824 vdev
->host
.slot
, vdev
->host
.function
);
2827 if (stat(vdev
->vbasedev
.sysfsdev
, &st
) < 0) {
2828 error_setg_errno(errp
, errno
, "no such host device");
2829 error_prepend(errp
, VFIO_MSG_PREFIX
, vdev
->vbasedev
.sysfsdev
);
2833 vdev
->vbasedev
.name
= g_path_get_basename(vdev
->vbasedev
.sysfsdev
);
2834 vdev
->vbasedev
.ops
= &vfio_pci_ops
;
2835 vdev
->vbasedev
.type
= VFIO_DEVICE_TYPE_PCI
;
2836 vdev
->vbasedev
.dev
= DEVICE(vdev
);
2838 tmp
= g_strdup_printf("%s/iommu_group", vdev
->vbasedev
.sysfsdev
);
2839 len
= readlink(tmp
, group_path
, sizeof(group_path
));
2842 if (len
<= 0 || len
>= sizeof(group_path
)) {
2843 error_setg_errno(errp
, len
< 0 ? errno
: ENAMETOOLONG
,
2844 "no iommu_group found");
2848 group_path
[len
] = 0;
2850 group_name
= basename(group_path
);
2851 if (sscanf(group_name
, "%d", &groupid
) != 1) {
2852 error_setg_errno(errp
, errno
, "failed to read %s", group_path
);
2856 trace_vfio_realize(vdev
->vbasedev
.name
, groupid
);
2858 group
= vfio_get_group(groupid
, pci_device_iommu_address_space(pdev
), errp
);
2863 QLIST_FOREACH(vbasedev_iter
, &group
->device_list
, next
) {
2864 if (strcmp(vbasedev_iter
->name
, vdev
->vbasedev
.name
) == 0) {
2865 error_setg(errp
, "device is already attached");
2866 vfio_put_group(group
);
2872 * Mediated devices *might* operate compatibly with discarding of RAM, but
2873 * we cannot know for certain, it depends on whether the mdev vendor driver
2874 * stays in sync with the active working set of the guest driver. Prevent
2875 * the x-balloon-allowed option unless this is minimally an mdev device.
2877 tmp
= g_strdup_printf("%s/subsystem", vdev
->vbasedev
.sysfsdev
);
2878 subsys
= realpath(tmp
, NULL
);
2880 is_mdev
= subsys
&& (strcmp(subsys
, "/sys/bus/mdev") == 0);
2883 trace_vfio_mdev(vdev
->vbasedev
.name
, is_mdev
);
2885 if (vdev
->vbasedev
.ram_block_discard_allowed
&& !is_mdev
) {
2886 error_setg(errp
, "x-balloon-allowed only potentially compatible "
2887 "with mdev devices");
2888 vfio_put_group(group
);
2892 ret
= vfio_get_device(group
, vdev
->vbasedev
.name
, &vdev
->vbasedev
, errp
);
2894 vfio_put_group(group
);
2898 vfio_populate_device(vdev
, &err
);
2900 error_propagate(errp
, err
);
2904 /* Get a copy of config space */
2905 ret
= pread(vdev
->vbasedev
.fd
, vdev
->pdev
.config
,
2906 MIN(pci_config_size(&vdev
->pdev
), vdev
->config_size
),
2907 vdev
->config_offset
);
2908 if (ret
< (int)MIN(pci_config_size(&vdev
->pdev
), vdev
->config_size
)) {
2909 ret
= ret
< 0 ? -errno
: -EFAULT
;
2910 error_setg_errno(errp
, -ret
, "failed to read device config space");
2914 /* vfio emulates a lot for us, but some bits need extra love */
2915 vdev
->emulated_config_bits
= g_malloc0(vdev
->config_size
);
2917 /* QEMU can choose to expose the ROM or not */
2918 memset(vdev
->emulated_config_bits
+ PCI_ROM_ADDRESS
, 0xff, 4);
2919 /* QEMU can also add or extend BARs */
2920 memset(vdev
->emulated_config_bits
+ PCI_BASE_ADDRESS_0
, 0xff, 6 * 4);
2923 * The PCI spec reserves vendor ID 0xffff as an invalid value. The
2924 * device ID is managed by the vendor and need only be a 16-bit value.
2925 * Allow any 16-bit value for subsystem so they can be hidden or changed.
2927 if (vdev
->vendor_id
!= PCI_ANY_ID
) {
2928 if (vdev
->vendor_id
>= 0xffff) {
2929 error_setg(errp
, "invalid PCI vendor ID provided");
2932 vfio_add_emulated_word(vdev
, PCI_VENDOR_ID
, vdev
->vendor_id
, ~0);
2933 trace_vfio_pci_emulated_vendor_id(vdev
->vbasedev
.name
, vdev
->vendor_id
);
2935 vdev
->vendor_id
= pci_get_word(pdev
->config
+ PCI_VENDOR_ID
);
2938 if (vdev
->device_id
!= PCI_ANY_ID
) {
2939 if (vdev
->device_id
> 0xffff) {
2940 error_setg(errp
, "invalid PCI device ID provided");
2943 vfio_add_emulated_word(vdev
, PCI_DEVICE_ID
, vdev
->device_id
, ~0);
2944 trace_vfio_pci_emulated_device_id(vdev
->vbasedev
.name
, vdev
->device_id
);
2946 vdev
->device_id
= pci_get_word(pdev
->config
+ PCI_DEVICE_ID
);
2949 if (vdev
->sub_vendor_id
!= PCI_ANY_ID
) {
2950 if (vdev
->sub_vendor_id
> 0xffff) {
2951 error_setg(errp
, "invalid PCI subsystem vendor ID provided");
2954 vfio_add_emulated_word(vdev
, PCI_SUBSYSTEM_VENDOR_ID
,
2955 vdev
->sub_vendor_id
, ~0);
2956 trace_vfio_pci_emulated_sub_vendor_id(vdev
->vbasedev
.name
,
2957 vdev
->sub_vendor_id
);
2960 if (vdev
->sub_device_id
!= PCI_ANY_ID
) {
2961 if (vdev
->sub_device_id
> 0xffff) {
2962 error_setg(errp
, "invalid PCI subsystem device ID provided");
2965 vfio_add_emulated_word(vdev
, PCI_SUBSYSTEM_ID
, vdev
->sub_device_id
, ~0);
2966 trace_vfio_pci_emulated_sub_device_id(vdev
->vbasedev
.name
,
2967 vdev
->sub_device_id
);
2970 /* QEMU can change multi-function devices to single function, or reverse */
2971 vdev
->emulated_config_bits
[PCI_HEADER_TYPE
] =
2972 PCI_HEADER_TYPE_MULTI_FUNCTION
;
2974 /* Restore or clear multifunction, this is always controlled by QEMU */
2975 if (vdev
->pdev
.cap_present
& QEMU_PCI_CAP_MULTIFUNCTION
) {
2976 vdev
->pdev
.config
[PCI_HEADER_TYPE
] |= PCI_HEADER_TYPE_MULTI_FUNCTION
;
2978 vdev
->pdev
.config
[PCI_HEADER_TYPE
] &= ~PCI_HEADER_TYPE_MULTI_FUNCTION
;
2982 * Clear host resource mapping info. If we choose not to register a
2983 * BAR, such as might be the case with the option ROM, we can get
2984 * confusing, unwritable, residual addresses from the host here.
2986 memset(&vdev
->pdev
.config
[PCI_BASE_ADDRESS_0
], 0, 24);
2987 memset(&vdev
->pdev
.config
[PCI_ROM_ADDRESS
], 0, 4);
2989 vfio_pci_size_rom(vdev
);
2991 vfio_bars_prepare(vdev
);
2993 vfio_msix_early_setup(vdev
, &err
);
2995 error_propagate(errp
, err
);
2999 vfio_bars_register(vdev
);
3001 ret
= vfio_add_capabilities(vdev
, errp
);
3007 vfio_vga_quirk_setup(vdev
);
3010 for (i
= 0; i
< PCI_ROM_SLOT
; i
++) {
3011 vfio_bar_quirk_setup(vdev
, i
);
3014 if (!vdev
->igd_opregion
&&
3015 vdev
->features
& VFIO_FEATURE_ENABLE_IGD_OPREGION
) {
3016 struct vfio_region_info
*opregion
;
3018 if (vdev
->pdev
.qdev
.hotplugged
) {
3020 "cannot support IGD OpRegion feature on hotplugged "
3025 ret
= vfio_get_dev_region_info(&vdev
->vbasedev
,
3026 VFIO_REGION_TYPE_PCI_VENDOR_TYPE
| PCI_VENDOR_ID_INTEL
,
3027 VFIO_REGION_SUBTYPE_INTEL_IGD_OPREGION
, &opregion
);
3029 error_setg_errno(errp
, -ret
,
3030 "does not support requested IGD OpRegion feature");
3034 ret
= vfio_pci_igd_opregion_init(vdev
, opregion
, errp
);
3041 /* QEMU emulates all of MSI & MSIX */
3042 if (pdev
->cap_present
& QEMU_PCI_CAP_MSIX
) {
3043 memset(vdev
->emulated_config_bits
+ pdev
->msix_cap
, 0xff,
3047 if (pdev
->cap_present
& QEMU_PCI_CAP_MSI
) {
3048 memset(vdev
->emulated_config_bits
+ pdev
->msi_cap
, 0xff,
3049 vdev
->msi_cap_size
);
3052 if (vfio_pci_read_config(&vdev
->pdev
, PCI_INTERRUPT_PIN
, 1)) {
3053 vdev
->intx
.mmap_timer
= timer_new_ms(QEMU_CLOCK_VIRTUAL
,
3054 vfio_intx_mmap_enable
, vdev
);
3055 pci_device_set_intx_routing_notifier(&vdev
->pdev
,
3056 vfio_intx_routing_notifier
);
3057 vdev
->irqchip_change_notifier
.notify
= vfio_irqchip_change
;
3058 kvm_irqchip_add_change_notifier(&vdev
->irqchip_change_notifier
);
3059 ret
= vfio_intx_enable(vdev
, errp
);
3061 goto out_deregister
;
3065 if (vdev
->display
!= ON_OFF_AUTO_OFF
) {
3066 ret
= vfio_display_probe(vdev
, errp
);
3068 goto out_deregister
;
3071 if (vdev
->enable_ramfb
&& vdev
->dpy
== NULL
) {
3072 error_setg(errp
, "ramfb=on requires display=on");
3073 goto out_deregister
;
3075 if (vdev
->display_xres
|| vdev
->display_yres
) {
3076 if (vdev
->dpy
== NULL
) {
3077 error_setg(errp
, "xres and yres properties require display=on");
3078 goto out_deregister
;
3080 if (vdev
->dpy
->edid_regs
== NULL
) {
3081 error_setg(errp
, "xres and yres properties need edid support");
3082 goto out_deregister
;
3086 if (vfio_pci_is(vdev
, PCI_VENDOR_ID_NVIDIA
, PCI_ANY_ID
)) {
3087 ret
= vfio_pci_nvidia_v100_ram_init(vdev
, errp
);
3088 if (ret
&& ret
!= -ENODEV
) {
3089 error_report("Failed to setup NVIDIA V100 GPU RAM");
3093 if (vfio_pci_is(vdev
, PCI_VENDOR_ID_IBM
, PCI_ANY_ID
)) {
3094 ret
= vfio_pci_nvlink2_init(vdev
, errp
);
3095 if (ret
&& ret
!= -ENODEV
) {
3096 error_report("Failed to setup NVlink2 bridge");
3100 if (!pdev
->failover_pair_id
) {
3101 ret
= vfio_migration_probe(&vdev
->vbasedev
, errp
);
3103 error_report("%s: Migration disabled", vdev
->vbasedev
.name
);
3107 vfio_register_err_notifier(vdev
);
3108 vfio_register_req_notifier(vdev
);
3109 vfio_setup_resetfn_quirk(vdev
);
3114 pci_device_set_intx_routing_notifier(&vdev
->pdev
, NULL
);
3115 kvm_irqchip_remove_change_notifier(&vdev
->irqchip_change_notifier
);
3117 vfio_teardown_msi(vdev
);
3118 vfio_bars_exit(vdev
);
3120 error_prepend(errp
, VFIO_MSG_PREFIX
, vdev
->vbasedev
.name
);
3123 static void vfio_instance_finalize(Object
*obj
)
3125 VFIOPCIDevice
*vdev
= VFIO_PCI(obj
);
3126 VFIOGroup
*group
= vdev
->vbasedev
.group
;
3128 vfio_display_finalize(vdev
);
3129 vfio_bars_finalize(vdev
);
3130 g_free(vdev
->emulated_config_bits
);
3133 * XXX Leaking igd_opregion is not an oversight, we can't remove the
3134 * fw_cfg entry therefore leaking this allocation seems like the safest
3137 * g_free(vdev->igd_opregion);
3139 vfio_put_device(vdev
);
3140 vfio_put_group(group
);
3143 static void vfio_exitfn(PCIDevice
*pdev
)
3145 VFIOPCIDevice
*vdev
= VFIO_PCI(pdev
);
3147 vfio_unregister_req_notifier(vdev
);
3148 vfio_unregister_err_notifier(vdev
);
3149 pci_device_set_intx_routing_notifier(&vdev
->pdev
, NULL
);
3150 if (vdev
->irqchip_change_notifier
.notify
) {
3151 kvm_irqchip_remove_change_notifier(&vdev
->irqchip_change_notifier
);
3153 vfio_disable_interrupts(vdev
);
3154 if (vdev
->intx
.mmap_timer
) {
3155 timer_free(vdev
->intx
.mmap_timer
);
3157 vfio_teardown_msi(vdev
);
3158 vfio_bars_exit(vdev
);
3159 vfio_migration_finalize(&vdev
->vbasedev
);
3162 static void vfio_pci_reset(DeviceState
*dev
)
3164 VFIOPCIDevice
*vdev
= VFIO_PCI(dev
);
3166 trace_vfio_pci_reset(vdev
->vbasedev
.name
);
3168 vfio_pci_pre_reset(vdev
);
3170 if (vdev
->display
!= ON_OFF_AUTO_OFF
) {
3171 vfio_display_reset(vdev
);
3174 if (vdev
->resetfn
&& !vdev
->resetfn(vdev
)) {
3178 if (vdev
->vbasedev
.reset_works
&&
3179 (vdev
->has_flr
|| !vdev
->has_pm_reset
) &&
3180 !ioctl(vdev
->vbasedev
.fd
, VFIO_DEVICE_RESET
)) {
3181 trace_vfio_pci_reset_flr(vdev
->vbasedev
.name
);
3185 /* See if we can do our own bus reset */
3186 if (!vfio_pci_hot_reset_one(vdev
)) {
3190 /* If nothing else works and the device supports PM reset, use it */
3191 if (vdev
->vbasedev
.reset_works
&& vdev
->has_pm_reset
&&
3192 !ioctl(vdev
->vbasedev
.fd
, VFIO_DEVICE_RESET
)) {
3193 trace_vfio_pci_reset_pm(vdev
->vbasedev
.name
);
3198 vfio_pci_post_reset(vdev
);
3201 static void vfio_instance_init(Object
*obj
)
3203 PCIDevice
*pci_dev
= PCI_DEVICE(obj
);
3204 VFIOPCIDevice
*vdev
= VFIO_PCI(obj
);
3206 device_add_bootindex_property(obj
, &vdev
->bootindex
,
3209 vdev
->host
.domain
= ~0U;
3210 vdev
->host
.bus
= ~0U;
3211 vdev
->host
.slot
= ~0U;
3212 vdev
->host
.function
= ~0U;
3214 vdev
->nv_gpudirect_clique
= 0xFF;
3216 /* QEMU_PCI_CAP_EXPRESS initialization does not depend on QEMU command
3217 * line, therefore, no need to wait to realize like other devices */
3218 pci_dev
->cap_present
|= QEMU_PCI_CAP_EXPRESS
;
3221 static Property vfio_pci_dev_properties
[] = {
3222 DEFINE_PROP_PCI_HOST_DEVADDR("host", VFIOPCIDevice
, host
),
3223 DEFINE_PROP_STRING("sysfsdev", VFIOPCIDevice
, vbasedev
.sysfsdev
),
3224 DEFINE_PROP_ON_OFF_AUTO("x-pre-copy-dirty-page-tracking", VFIOPCIDevice
,
3225 vbasedev
.pre_copy_dirty_page_tracking
,
3227 DEFINE_PROP_ON_OFF_AUTO("display", VFIOPCIDevice
,
3228 display
, ON_OFF_AUTO_OFF
),
3229 DEFINE_PROP_UINT32("xres", VFIOPCIDevice
, display_xres
, 0),
3230 DEFINE_PROP_UINT32("yres", VFIOPCIDevice
, display_yres
, 0),
3231 DEFINE_PROP_UINT32("x-intx-mmap-timeout-ms", VFIOPCIDevice
,
3232 intx
.mmap_timeout
, 1100),
3233 DEFINE_PROP_BIT("x-vga", VFIOPCIDevice
, features
,
3234 VFIO_FEATURE_ENABLE_VGA_BIT
, false),
3235 DEFINE_PROP_BIT("x-req", VFIOPCIDevice
, features
,
3236 VFIO_FEATURE_ENABLE_REQ_BIT
, true),
3237 DEFINE_PROP_BIT("x-igd-opregion", VFIOPCIDevice
, features
,
3238 VFIO_FEATURE_ENABLE_IGD_OPREGION_BIT
, false),
3239 DEFINE_PROP_BOOL("x-enable-migration", VFIOPCIDevice
,
3240 vbasedev
.enable_migration
, false),
3241 DEFINE_PROP_BOOL("x-no-mmap", VFIOPCIDevice
, vbasedev
.no_mmap
, false),
3242 DEFINE_PROP_BOOL("x-balloon-allowed", VFIOPCIDevice
,
3243 vbasedev
.ram_block_discard_allowed
, false),
3244 DEFINE_PROP_BOOL("x-no-kvm-intx", VFIOPCIDevice
, no_kvm_intx
, false),
3245 DEFINE_PROP_BOOL("x-no-kvm-msi", VFIOPCIDevice
, no_kvm_msi
, false),
3246 DEFINE_PROP_BOOL("x-no-kvm-msix", VFIOPCIDevice
, no_kvm_msix
, false),
3247 DEFINE_PROP_BOOL("x-no-geforce-quirks", VFIOPCIDevice
,
3248 no_geforce_quirks
, false),
3249 DEFINE_PROP_BOOL("x-no-kvm-ioeventfd", VFIOPCIDevice
, no_kvm_ioeventfd
,
3251 DEFINE_PROP_BOOL("x-no-vfio-ioeventfd", VFIOPCIDevice
, no_vfio_ioeventfd
,
3253 DEFINE_PROP_UINT32("x-pci-vendor-id", VFIOPCIDevice
, vendor_id
, PCI_ANY_ID
),
3254 DEFINE_PROP_UINT32("x-pci-device-id", VFIOPCIDevice
, device_id
, PCI_ANY_ID
),
3255 DEFINE_PROP_UINT32("x-pci-sub-vendor-id", VFIOPCIDevice
,
3256 sub_vendor_id
, PCI_ANY_ID
),
3257 DEFINE_PROP_UINT32("x-pci-sub-device-id", VFIOPCIDevice
,
3258 sub_device_id
, PCI_ANY_ID
),
3259 DEFINE_PROP_UINT32("x-igd-gms", VFIOPCIDevice
, igd_gms
, 0),
3260 DEFINE_PROP_UNSIGNED_NODEFAULT("x-nv-gpudirect-clique", VFIOPCIDevice
,
3261 nv_gpudirect_clique
,
3262 qdev_prop_nv_gpudirect_clique
, uint8_t),
3263 DEFINE_PROP_OFF_AUTO_PCIBAR("x-msix-relocation", VFIOPCIDevice
, msix_relo
,
3264 OFF_AUTOPCIBAR_OFF
),
3266 * TODO - support passed fds... is this necessary?
3267 * DEFINE_PROP_STRING("vfiofd", VFIOPCIDevice, vfiofd_name),
3268 * DEFINE_PROP_STRING("vfiogroupfd, VFIOPCIDevice, vfiogroupfd_name),
3270 DEFINE_PROP_END_OF_LIST(),
3273 static void vfio_pci_dev_class_init(ObjectClass
*klass
, void *data
)
3275 DeviceClass
*dc
= DEVICE_CLASS(klass
);
3276 PCIDeviceClass
*pdc
= PCI_DEVICE_CLASS(klass
);
3278 dc
->reset
= vfio_pci_reset
;
3279 device_class_set_props(dc
, vfio_pci_dev_properties
);
3280 dc
->desc
= "VFIO-based PCI device assignment";
3281 set_bit(DEVICE_CATEGORY_MISC
, dc
->categories
);
3282 pdc
->realize
= vfio_realize
;
3283 pdc
->exit
= vfio_exitfn
;
3284 pdc
->config_read
= vfio_pci_read_config
;
3285 pdc
->config_write
= vfio_pci_write_config
;
3288 static const TypeInfo vfio_pci_dev_info
= {
3289 .name
= TYPE_VFIO_PCI
,
3290 .parent
= TYPE_PCI_DEVICE
,
3291 .instance_size
= sizeof(VFIOPCIDevice
),
3292 .class_init
= vfio_pci_dev_class_init
,
3293 .instance_init
= vfio_instance_init
,
3294 .instance_finalize
= vfio_instance_finalize
,
3295 .interfaces
= (InterfaceInfo
[]) {
3296 { INTERFACE_PCIE_DEVICE
},
3297 { INTERFACE_CONVENTIONAL_PCI_DEVICE
},
3302 static Property vfio_pci_dev_nohotplug_properties
[] = {
3303 DEFINE_PROP_BOOL("ramfb", VFIOPCIDevice
, enable_ramfb
, false),
3304 DEFINE_PROP_END_OF_LIST(),
3307 static void vfio_pci_nohotplug_dev_class_init(ObjectClass
*klass
, void *data
)
3309 DeviceClass
*dc
= DEVICE_CLASS(klass
);
3311 device_class_set_props(dc
, vfio_pci_dev_nohotplug_properties
);
3312 dc
->hotpluggable
= false;
3315 static const TypeInfo vfio_pci_nohotplug_dev_info
= {
3316 .name
= TYPE_VFIO_PCI_NOHOTPLUG
,
3317 .parent
= TYPE_VFIO_PCI
,
3318 .instance_size
= sizeof(VFIOPCIDevice
),
3319 .class_init
= vfio_pci_nohotplug_dev_class_init
,
3322 static void register_vfio_pci_dev_type(void)
3324 type_register_static(&vfio_pci_dev_info
);
3325 type_register_static(&vfio_pci_nohotplug_dev_info
);
3328 type_init(register_vfio_pci_dev_type
)