2 * Inter-VM Shared Memory PCI device.
5 * Cam Macdonell <cam@cs.ualberta.ca>
7 * Based On: cirrus_vga.c
8 * Copyright (c) 2004 Fabrice Bellard
9 * Copyright (c) 2004 Makoto Suzuki (suzu)
12 * Copyright (c) 2006 Igor Kovalenko
14 * This code is licensed under the GNU GPL v2.
23 #include <sys/types.h>
25 #define IVSHMEM_IOEVENTFD 0
28 #define IVSHMEM_PEER 0
29 #define IVSHMEM_MASTER 1
31 #define IVSHMEM_REG_BAR_SIZE 0x100
33 //#define DEBUG_IVSHMEM
35 #define IVSHMEM_DPRINTF(fmt, ...) \
36 do {printf("IVSHMEM: " fmt, ## __VA_ARGS__); } while (0)
38 #define IVSHMEM_DPRINTF(fmt, ...)
46 typedef struct EventfdEntry
{
51 typedef struct IVShmemState
{
57 CharDriverState
**eventfd_chr
;
58 CharDriverState
*server_chr
;
59 MemoryRegion ivshmem_mmio
;
62 /* We might need to register the BAR before we actually have the memory.
63 * So prepare a container MemoryRegion for the BAR immediately and
64 * add a subregion when we have the memory.
68 MemoryRegion msix_bar
;
69 uint64_t ivshmem_size
; /* size of shared memory region */
70 int shm_fd
; /* shared memory file descriptor */
73 int nb_peers
; /* how many guests we have space for */
74 int max_peer
; /* maximum numbered peer */
79 EventfdEntry
*eventfd_table
;
84 int role_val
; /* scalar to avoid multiple string comparisons */
87 /* registers for the Inter-VM shared memory device */
88 enum ivshmem_registers
{
95 static inline uint32_t ivshmem_has_feature(IVShmemState
*ivs
,
96 unsigned int feature
) {
97 return (ivs
->features
& (1 << feature
));
100 static inline bool is_power_of_two(uint64_t x
) {
101 return (x
& (x
- 1)) == 0;
104 /* accessing registers - based on rtl8139 */
105 static void ivshmem_update_irq(IVShmemState
*s
, int val
)
108 isr
= (s
->intrstatus
& s
->intrmask
) & 0xffffffff;
110 /* don't print ISR resets */
112 IVSHMEM_DPRINTF("Set IRQ to %d (%04x %04x)\n",
113 isr
? 1 : 0, s
->intrstatus
, s
->intrmask
);
116 qemu_set_irq(s
->dev
.irq
[0], (isr
!= 0));
119 static void ivshmem_IntrMask_write(IVShmemState
*s
, uint32_t val
)
121 IVSHMEM_DPRINTF("IntrMask write(w) val = 0x%04x\n", val
);
125 ivshmem_update_irq(s
, val
);
128 static uint32_t ivshmem_IntrMask_read(IVShmemState
*s
)
130 uint32_t ret
= s
->intrmask
;
132 IVSHMEM_DPRINTF("intrmask read(w) val = 0x%04x\n", ret
);
137 static void ivshmem_IntrStatus_write(IVShmemState
*s
, uint32_t val
)
139 IVSHMEM_DPRINTF("IntrStatus write(w) val = 0x%04x\n", val
);
143 ivshmem_update_irq(s
, val
);
147 static uint32_t ivshmem_IntrStatus_read(IVShmemState
*s
)
149 uint32_t ret
= s
->intrstatus
;
151 /* reading ISR clears all interrupts */
154 ivshmem_update_irq(s
, 0);
159 static void ivshmem_io_write(void *opaque
, target_phys_addr_t addr
,
160 uint64_t val
, unsigned size
)
162 IVShmemState
*s
= opaque
;
164 uint64_t write_one
= 1;
165 uint16_t dest
= val
>> 16;
166 uint16_t vector
= val
& 0xff;
170 IVSHMEM_DPRINTF("writing to addr " TARGET_FMT_plx
"\n", addr
);
174 ivshmem_IntrMask_write(s
, val
);
178 ivshmem_IntrStatus_write(s
, val
);
182 /* check that dest VM ID is reasonable */
183 if (dest
> s
->max_peer
) {
184 IVSHMEM_DPRINTF("Invalid destination VM ID (%d)\n", dest
);
188 /* check doorbell range */
189 if (vector
< s
->peers
[dest
].nb_eventfds
) {
190 IVSHMEM_DPRINTF("Writing %" PRId64
" to VM %d on vector %d\n",
191 write_one
, dest
, vector
);
192 if (write(s
->peers
[dest
].eventfds
[vector
],
193 &(write_one
), 8) != 8) {
194 IVSHMEM_DPRINTF("error writing to eventfd\n");
199 IVSHMEM_DPRINTF("Invalid VM Doorbell VM %d\n", dest
);
203 static uint64_t ivshmem_io_read(void *opaque
, target_phys_addr_t addr
,
207 IVShmemState
*s
= opaque
;
213 ret
= ivshmem_IntrMask_read(s
);
217 ret
= ivshmem_IntrStatus_read(s
);
221 /* return my VM ID if the memory is mapped */
230 IVSHMEM_DPRINTF("why are we reading " TARGET_FMT_plx
"\n", addr
);
237 static const MemoryRegionOps ivshmem_mmio_ops
= {
238 .read
= ivshmem_io_read
,
239 .write
= ivshmem_io_write
,
240 .endianness
= DEVICE_NATIVE_ENDIAN
,
242 .min_access_size
= 4,
243 .max_access_size
= 4,
247 static void ivshmem_receive(void *opaque
, const uint8_t *buf
, int size
)
249 IVShmemState
*s
= opaque
;
251 ivshmem_IntrStatus_write(s
, *buf
);
253 IVSHMEM_DPRINTF("ivshmem_receive 0x%02x\n", *buf
);
256 static int ivshmem_can_receive(void * opaque
)
261 static void ivshmem_event(void *opaque
, int event
)
263 IVSHMEM_DPRINTF("ivshmem_event %d\n", event
);
266 static void fake_irqfd(void *opaque
, const uint8_t *buf
, int size
) {
268 EventfdEntry
*entry
= opaque
;
269 PCIDevice
*pdev
= entry
->pdev
;
271 IVSHMEM_DPRINTF("interrupt on vector %p %d\n", pdev
, entry
->vector
);
272 msix_notify(pdev
, entry
->vector
);
275 static CharDriverState
* create_eventfd_chr_device(void * opaque
, int eventfd
,
278 /* create a event character device based on the passed eventfd */
279 IVShmemState
*s
= opaque
;
280 CharDriverState
* chr
;
282 chr
= qemu_chr_open_eventfd(eventfd
);
285 fprintf(stderr
, "creating eventfd for eventfd %d failed\n", eventfd
);
289 /* if MSI is supported we need multiple interrupts */
290 if (ivshmem_has_feature(s
, IVSHMEM_MSI
)) {
291 s
->eventfd_table
[vector
].pdev
= &s
->dev
;
292 s
->eventfd_table
[vector
].vector
= vector
;
294 qemu_chr_add_handlers(chr
, ivshmem_can_receive
, fake_irqfd
,
295 ivshmem_event
, &s
->eventfd_table
[vector
]);
297 qemu_chr_add_handlers(chr
, ivshmem_can_receive
, ivshmem_receive
,
305 static int check_shm_size(IVShmemState
*s
, int fd
) {
306 /* check that the guest isn't going to try and map more memory than the
307 * the object has allocated return -1 to indicate error */
313 if (s
->ivshmem_size
> buf
.st_size
) {
315 "IVSHMEM ERROR: Requested memory size greater"
316 " than shared object size (%" PRIu64
" > %" PRIu64
")\n",
317 s
->ivshmem_size
, (uint64_t)buf
.st_size
);
324 /* create the shared memory BAR when we are not using the server, so we can
325 * create the BAR and map the memory immediately */
326 static void create_shared_memory_BAR(IVShmemState
*s
, int fd
) {
332 ptr
= mmap(0, s
->ivshmem_size
, PROT_READ
|PROT_WRITE
, MAP_SHARED
, fd
, 0);
334 memory_region_init_ram_ptr(&s
->ivshmem
, &s
->dev
.qdev
, "ivshmem.bar2",
335 s
->ivshmem_size
, ptr
);
336 memory_region_add_subregion(&s
->bar
, 0, &s
->ivshmem
);
338 /* region for shared memory */
339 pci_register_bar(&s
->dev
, 2, PCI_BASE_ADDRESS_SPACE_MEMORY
, &s
->bar
);
342 static void close_guest_eventfds(IVShmemState
*s
, int posn
)
344 int i
, guest_curr_max
;
346 guest_curr_max
= s
->peers
[posn
].nb_eventfds
;
348 for (i
= 0; i
< guest_curr_max
; i
++) {
349 kvm_set_ioeventfd_mmio_long(s
->peers
[posn
].eventfds
[i
],
350 s
->mmio_addr
+ DOORBELL
, (posn
<< 16) | i
, 0);
351 close(s
->peers
[posn
].eventfds
[i
]);
354 g_free(s
->peers
[posn
].eventfds
);
355 s
->peers
[posn
].nb_eventfds
= 0;
358 static void setup_ioeventfds(IVShmemState
*s
) {
362 for (i
= 0; i
<= s
->max_peer
; i
++) {
363 for (j
= 0; j
< s
->peers
[i
].nb_eventfds
; j
++) {
364 memory_region_add_eventfd(&s
->ivshmem_mmio
,
369 s
->peers
[i
].eventfds
[j
]);
374 /* this function increase the dynamic storage need to store data about other
376 static void increase_dynamic_storage(IVShmemState
*s
, int new_min_size
) {
380 old_nb_alloc
= s
->nb_peers
;
382 while (new_min_size
>= s
->nb_peers
)
383 s
->nb_peers
= s
->nb_peers
* 2;
385 IVSHMEM_DPRINTF("bumping storage to %d guests\n", s
->nb_peers
);
386 s
->peers
= g_realloc(s
->peers
, s
->nb_peers
* sizeof(Peer
));
388 /* zero out new pointers */
389 for (j
= old_nb_alloc
; j
< s
->nb_peers
; j
++) {
390 s
->peers
[j
].eventfds
= NULL
;
391 s
->peers
[j
].nb_eventfds
= 0;
395 static void ivshmem_read(void *opaque
, const uint8_t * buf
, int flags
)
397 IVShmemState
*s
= opaque
;
398 int incoming_fd
, tmp_fd
;
399 int guest_max_eventfd
;
402 memcpy(&incoming_posn
, buf
, sizeof(long));
403 /* pick off s->server_chr->msgfd and store it, posn should accompany msg */
404 tmp_fd
= qemu_chr_fe_get_msgfd(s
->server_chr
);
405 IVSHMEM_DPRINTF("posn is %ld, fd is %d\n", incoming_posn
, tmp_fd
);
407 /* make sure we have enough space for this guest */
408 if (incoming_posn
>= s
->nb_peers
) {
409 increase_dynamic_storage(s
, incoming_posn
);
413 /* if posn is positive and unseen before then this is our posn*/
414 if ((incoming_posn
>= 0) &&
415 (s
->peers
[incoming_posn
].eventfds
== NULL
)) {
416 /* receive our posn */
417 s
->vm_id
= incoming_posn
;
420 /* otherwise an fd == -1 means an existing guest has gone away */
421 IVSHMEM_DPRINTF("posn %ld has gone away\n", incoming_posn
);
422 close_guest_eventfds(s
, incoming_posn
);
427 /* because of the implementation of get_msgfd, we need a dup */
428 incoming_fd
= dup(tmp_fd
);
430 if (incoming_fd
== -1) {
431 fprintf(stderr
, "could not allocate file descriptor %s\n",
436 /* if the position is -1, then it's shared memory region fd */
437 if (incoming_posn
== -1) {
443 if (check_shm_size(s
, incoming_fd
) == -1) {
447 /* mmap the region and map into the BAR2 */
448 map_ptr
= mmap(0, s
->ivshmem_size
, PROT_READ
|PROT_WRITE
, MAP_SHARED
,
450 memory_region_init_ram_ptr(&s
->ivshmem
, &s
->dev
.qdev
,
451 "ivshmem.bar2", s
->ivshmem_size
, map_ptr
);
453 IVSHMEM_DPRINTF("guest h/w addr = %" PRIu64
", size = %" PRIu64
"\n",
454 s
->ivshmem_offset
, s
->ivshmem_size
);
456 memory_region_add_subregion(&s
->bar
, 0, &s
->ivshmem
);
458 /* only store the fd if it is successfully mapped */
459 s
->shm_fd
= incoming_fd
;
464 /* each guest has an array of eventfds, and we keep track of how many
465 * guests for each VM */
466 guest_max_eventfd
= s
->peers
[incoming_posn
].nb_eventfds
;
468 if (guest_max_eventfd
== 0) {
469 /* one eventfd per MSI vector */
470 s
->peers
[incoming_posn
].eventfds
= (int *) g_malloc(s
->vectors
*
474 /* this is an eventfd for a particular guest VM */
475 IVSHMEM_DPRINTF("eventfds[%ld][%d] = %d\n", incoming_posn
,
476 guest_max_eventfd
, incoming_fd
);
477 s
->peers
[incoming_posn
].eventfds
[guest_max_eventfd
] = incoming_fd
;
479 /* increment count for particular guest */
480 s
->peers
[incoming_posn
].nb_eventfds
++;
482 /* keep track of the maximum VM ID */
483 if (incoming_posn
> s
->max_peer
) {
484 s
->max_peer
= incoming_posn
;
487 if (incoming_posn
== s
->vm_id
) {
488 s
->eventfd_chr
[guest_max_eventfd
] = create_eventfd_chr_device(s
,
489 s
->peers
[s
->vm_id
].eventfds
[guest_max_eventfd
],
493 if (ivshmem_has_feature(s
, IVSHMEM_IOEVENTFD
)) {
494 if (kvm_set_ioeventfd_mmio_long(incoming_fd
, s
->mmio_addr
+ DOORBELL
,
495 (incoming_posn
<< 16) | guest_max_eventfd
, 1) < 0) {
496 fprintf(stderr
, "ivshmem: ioeventfd not available\n");
503 static void ivshmem_reset(DeviceState
*d
)
505 IVShmemState
*s
= DO_UPCAST(IVShmemState
, dev
.qdev
, d
);
511 static uint64_t ivshmem_get_size(IVShmemState
* s
) {
516 value
= strtoull(s
->sizearg
, &ptr
, 10);
518 case 0: case 'M': case 'm':
525 fprintf(stderr
, "qemu: invalid ram size: %s\n", s
->sizearg
);
529 /* BARs must be a power of 2 */
530 if (!is_power_of_two(value
)) {
531 fprintf(stderr
, "ivshmem: size must be power of 2\n");
538 static void ivshmem_setup_msi(IVShmemState
* s
) {
542 /* allocate the MSI-X vectors */
544 memory_region_init(&s
->msix_bar
, "ivshmem-msix", 4096);
545 if (!msix_init(&s
->dev
, s
->vectors
, &s
->msix_bar
, 1, 0)) {
546 pci_register_bar(&s
->dev
, 1, PCI_BASE_ADDRESS_SPACE_MEMORY
,
548 IVSHMEM_DPRINTF("msix initialized (%d vectors)\n", s
->vectors
);
550 IVSHMEM_DPRINTF("msix initialization failed\n");
554 /* 'activate' the vectors */
555 for (i
= 0; i
< s
->vectors
; i
++) {
556 msix_vector_use(&s
->dev
, i
);
559 /* allocate Qemu char devices for receiving interrupts */
560 s
->eventfd_table
= g_malloc0(s
->vectors
* sizeof(EventfdEntry
));
563 static void ivshmem_save(QEMUFile
* f
, void *opaque
)
565 IVShmemState
*proxy
= opaque
;
567 IVSHMEM_DPRINTF("ivshmem_save\n");
568 pci_device_save(&proxy
->dev
, f
);
570 if (ivshmem_has_feature(proxy
, IVSHMEM_MSI
)) {
571 msix_save(&proxy
->dev
, f
);
573 qemu_put_be32(f
, proxy
->intrstatus
);
574 qemu_put_be32(f
, proxy
->intrmask
);
579 static int ivshmem_load(QEMUFile
* f
, void *opaque
, int version_id
)
581 IVSHMEM_DPRINTF("ivshmem_load\n");
583 IVShmemState
*proxy
= opaque
;
586 if (version_id
> 0) {
590 if (proxy
->role_val
== IVSHMEM_PEER
) {
591 fprintf(stderr
, "ivshmem: 'peer' devices are not migratable\n");
595 ret
= pci_device_load(&proxy
->dev
, f
);
600 if (ivshmem_has_feature(proxy
, IVSHMEM_MSI
)) {
601 msix_load(&proxy
->dev
, f
);
602 for (i
= 0; i
< proxy
->vectors
; i
++) {
603 msix_vector_use(&proxy
->dev
, i
);
606 proxy
->intrstatus
= qemu_get_be32(f
);
607 proxy
->intrmask
= qemu_get_be32(f
);
613 static int pci_ivshmem_init(PCIDevice
*dev
)
615 IVShmemState
*s
= DO_UPCAST(IVShmemState
, dev
, dev
);
618 if (s
->sizearg
== NULL
)
619 s
->ivshmem_size
= 4 << 20; /* 4 MB default */
621 s
->ivshmem_size
= ivshmem_get_size(s
);
624 register_savevm(&s
->dev
.qdev
, "ivshmem", 0, 0, ivshmem_save
, ivshmem_load
,
627 /* IRQFD requires MSI */
628 if (ivshmem_has_feature(s
, IVSHMEM_IOEVENTFD
) &&
629 !ivshmem_has_feature(s
, IVSHMEM_MSI
)) {
630 fprintf(stderr
, "ivshmem: ioeventfd/irqfd requires MSI\n");
634 /* check that role is reasonable */
636 if (strncmp(s
->role
, "peer", 5) == 0) {
637 s
->role_val
= IVSHMEM_PEER
;
638 } else if (strncmp(s
->role
, "master", 7) == 0) {
639 s
->role_val
= IVSHMEM_MASTER
;
641 fprintf(stderr
, "ivshmem: 'role' must be 'peer' or 'master'\n");
645 s
->role_val
= IVSHMEM_MASTER
; /* default */
648 if (s
->role_val
== IVSHMEM_PEER
) {
649 register_device_unmigratable(&s
->dev
.qdev
, "ivshmem", s
);
652 pci_conf
= s
->dev
.config
;
653 pci_conf
[PCI_COMMAND
] = PCI_COMMAND_IO
| PCI_COMMAND_MEMORY
;
655 pci_config_set_interrupt_pin(pci_conf
, 1);
659 memory_region_init_io(&s
->ivshmem_mmio
, &ivshmem_mmio_ops
, s
,
660 "ivshmem-mmio", IVSHMEM_REG_BAR_SIZE
);
662 if (ivshmem_has_feature(s
, IVSHMEM_IOEVENTFD
)) {
666 /* region for registers*/
667 pci_register_bar(&s
->dev
, 0, PCI_BASE_ADDRESS_SPACE_MEMORY
,
670 memory_region_init(&s
->bar
, "ivshmem-bar2-container", s
->ivshmem_size
);
672 if ((s
->server_chr
!= NULL
) &&
673 (strncmp(s
->server_chr
->filename
, "unix:", 5) == 0)) {
674 /* if we get a UNIX socket as the parameter we will talk
675 * to the ivshmem server to receive the memory region */
677 if (s
->shmobj
!= NULL
) {
678 fprintf(stderr
, "WARNING: do not specify both 'chardev' "
679 "and 'shm' with ivshmem\n");
682 IVSHMEM_DPRINTF("using shared memory server (socket = %s)\n",
683 s
->server_chr
->filename
);
685 if (ivshmem_has_feature(s
, IVSHMEM_MSI
)) {
686 ivshmem_setup_msi(s
);
689 /* we allocate enough space for 16 guests and grow as needed */
693 /* allocate/initialize space for interrupt handling */
694 s
->peers
= g_malloc0(s
->nb_peers
* sizeof(Peer
));
696 pci_register_bar(&s
->dev
, 2,
697 PCI_BASE_ADDRESS_SPACE_MEMORY
, &s
->ivshmem
);
699 s
->eventfd_chr
= g_malloc0(s
->vectors
* sizeof(CharDriverState
*));
701 qemu_chr_add_handlers(s
->server_chr
, ivshmem_can_receive
, ivshmem_read
,
704 /* just map the file immediately, we're not using a server */
707 if (s
->shmobj
== NULL
) {
708 fprintf(stderr
, "Must specify 'chardev' or 'shm' to ivshmem\n");
711 IVSHMEM_DPRINTF("using shm_open (shm object = %s)\n", s
->shmobj
);
713 /* try opening with O_EXCL and if it succeeds zero the memory
714 * by truncating to 0 */
715 if ((fd
= shm_open(s
->shmobj
, O_CREAT
|O_RDWR
|O_EXCL
,
716 S_IRWXU
|S_IRWXG
|S_IRWXO
)) > 0) {
717 /* truncate file to length PCI device's memory */
718 if (ftruncate(fd
, s
->ivshmem_size
) != 0) {
719 fprintf(stderr
, "ivshmem: could not truncate shared file\n");
722 } else if ((fd
= shm_open(s
->shmobj
, O_CREAT
|O_RDWR
,
723 S_IRWXU
|S_IRWXG
|S_IRWXO
)) < 0) {
724 fprintf(stderr
, "ivshmem: could not open shared file\n");
729 if (check_shm_size(s
, fd
) == -1) {
733 create_shared_memory_BAR(s
, fd
);
740 static int pci_ivshmem_uninit(PCIDevice
*dev
)
742 IVShmemState
*s
= DO_UPCAST(IVShmemState
, dev
, dev
);
744 memory_region_destroy(&s
->ivshmem_mmio
);
745 memory_region_del_subregion(&s
->bar
, &s
->ivshmem
);
746 memory_region_destroy(&s
->ivshmem
);
747 memory_region_destroy(&s
->bar
);
748 unregister_savevm(&dev
->qdev
, "ivshmem", s
);
753 static PCIDeviceInfo ivshmem_info
= {
754 .qdev
.name
= "ivshmem",
755 .qdev
.size
= sizeof(IVShmemState
),
756 .qdev
.reset
= ivshmem_reset
,
757 .init
= pci_ivshmem_init
,
758 .exit
= pci_ivshmem_uninit
,
759 .vendor_id
= PCI_VENDOR_ID_REDHAT_QUMRANET
,
761 .class_id
= PCI_CLASS_MEMORY_RAM
,
762 .qdev
.props
= (Property
[]) {
763 DEFINE_PROP_CHR("chardev", IVShmemState
, server_chr
),
764 DEFINE_PROP_STRING("size", IVShmemState
, sizearg
),
765 DEFINE_PROP_UINT32("vectors", IVShmemState
, vectors
, 1),
766 DEFINE_PROP_BIT("ioeventfd", IVShmemState
, features
, IVSHMEM_IOEVENTFD
, false),
767 DEFINE_PROP_BIT("msi", IVShmemState
, features
, IVSHMEM_MSI
, true),
768 DEFINE_PROP_STRING("shm", IVShmemState
, shmobj
),
769 DEFINE_PROP_STRING("role", IVShmemState
, role
),
770 DEFINE_PROP_END_OF_LIST(),
774 static void ivshmem_register_devices(void)
776 pci_qdev_register(&ivshmem_info
);
779 device_init(ivshmem_register_devices
)