hw/misc/ivshmem.c

   1 /*
   2  * Inter-VM Shared Memory PCI device.
   3  *
   4  * Author:
   5  *      Cam Macdonell <cam@cs.ualberta.ca>
   6  *
   7  * Based On: cirrus_vga.c
   8  *          Copyright (c) 2004 Fabrice Bellard
   9  *          Copyright (c) 2004 Makoto Suzuki (suzu)
  10  *
  11  *      and rtl8139.c
  12  *          Copyright (c) 2006 Igor Kovalenko
  13  *
  14  * This code is licensed under the GNU GPL v2.
  15  *
  16  * Contributions after 2012-01-13 are licensed under the terms of the
  17  * GNU GPL, version 2 or (at your option) any later version.
  18  */
  19 #include "hw/hw.h"
  20 #include "hw/i386/pc.h"
  21 #include "hw/pci/pci.h"
  22 #include "hw/pci/msix.h"
  23 #include "sysemu/kvm.h"
  24 #include "migration/migration.h"
  25 #include "qemu/error-report.h"
  26 #include "qemu/event_notifier.h"
  27 #include "qemu/fifo8.h"
  28 #include "sysemu/char.h"
  29
  30 #include <sys/mman.h>
  31 #include <sys/types.h>
  32 #include <limits.h>
  33
  34 #define PCI_VENDOR_ID_IVSHMEM   PCI_VENDOR_ID_REDHAT_QUMRANET
  35 #define PCI_DEVICE_ID_IVSHMEM   0x1110
  36
  37 #define IVSHMEM_MAX_PEERS G_MAXUINT16
  38 #define IVSHMEM_IOEVENTFD   0
  39 #define IVSHMEM_MSI     1
  40
  41 #define IVSHMEM_PEER    0
  42 #define IVSHMEM_MASTER  1
  43
  44 #define IVSHMEM_REG_BAR_SIZE 0x100
  45
  46 //#define DEBUG_IVSHMEM
  47 #ifdef DEBUG_IVSHMEM
  48 #define IVSHMEM_DPRINTF(fmt, ...)        \
  49     do {printf("IVSHMEM: " fmt, ## __VA_ARGS__); } while (0)
  50 #else
  51 #define IVSHMEM_DPRINTF(fmt, ...)
  52 #endif
  53
  54 #define TYPE_IVSHMEM "ivshmem"
  55 #define IVSHMEM(obj) \
  56     OBJECT_CHECK(IVShmemState, (obj), TYPE_IVSHMEM)
  57
  58 typedef struct Peer {
  59     int nb_eventfds;
  60     EventNotifier *eventfds;
  61 } Peer;
  62
  63 typedef struct EventfdEntry {
  64     PCIDevice *pdev;
  65     int vector;
  66 } EventfdEntry;
  67
  68 typedef struct IVShmemState {
  69     /*< private >*/
  70     PCIDevice parent_obj;
  71     /*< public >*/
  72
  73     uint32_t intrmask;
  74     uint32_t intrstatus;
  75
  76     CharDriverState **eventfd_chr;
  77     CharDriverState *server_chr;
  78     Fifo8 incoming_fifo;
  79     MemoryRegion ivshmem_mmio;
  80
  81     /* We might need to register the BAR before we actually have the memory.
  82      * So prepare a container MemoryRegion for the BAR immediately and
  83      * add a subregion when we have the memory.
  84      */
  85     MemoryRegion bar;
  86     MemoryRegion ivshmem;
  87     uint64_t ivshmem_size; /* size of shared memory region */
  88     uint32_t ivshmem_64bit;
  89     int shm_fd; /* shared memory file descriptor */
  90
  91     Peer *peers;
  92     int nb_peers; /* how many guests we have space for */
  93
  94     int vm_id;
  95     uint32_t vectors;
  96     uint32_t features;
  97     EventfdEntry *eventfd_table;
  98
  99     Error *migration_blocker;
 100
 101     char * shmobj;
 102     char * sizearg;
 103     char * role;
 104     int role_val;   /* scalar to avoid multiple string comparisons */
 105 } IVShmemState;
 106
 107 /* registers for the Inter-VM shared memory device */
 108 enum ivshmem_registers {
 109     INTRMASK = 0,
 110     INTRSTATUS = 4,
 111     IVPOSITION = 8,
 112     DOORBELL = 12,
 113 };
 114
 115 static inline uint32_t ivshmem_has_feature(IVShmemState *ivs,
 116                                                     unsigned int feature) {
 117     return (ivs->features & (1 << feature));
 118 }
 119
 120 /* accessing registers - based on rtl8139 */
 121 static void ivshmem_update_irq(IVShmemState *s)
 122 {
 123     PCIDevice *d = PCI_DEVICE(s);
 124     int isr;
 125     isr = (s->intrstatus & s->intrmask) & 0xffffffff;
 126
 127     /* don't print ISR resets */
 128     if (isr) {
 129         IVSHMEM_DPRINTF("Set IRQ to %d (%04x %04x)\n",
 130                         isr ? 1 : 0, s->intrstatus, s->intrmask);
 131     }
 132
 133     pci_set_irq(d, (isr != 0));
 134 }
 135
 136 static void ivshmem_IntrMask_write(IVShmemState *s, uint32_t val)
 137 {
 138     IVSHMEM_DPRINTF("IntrMask write(w) val = 0x%04x\n", val);
 139
 140     s->intrmask = val;
 141
 142     ivshmem_update_irq(s);
 143 }
 144
 145 static uint32_t ivshmem_IntrMask_read(IVShmemState *s)
 146 {
 147     uint32_t ret = s->intrmask;
 148
 149     IVSHMEM_DPRINTF("intrmask read(w) val = 0x%04x\n", ret);
 150
 151     return ret;
 152 }
 153
 154 static void ivshmem_IntrStatus_write(IVShmemState *s, uint32_t val)
 155 {
 156     IVSHMEM_DPRINTF("IntrStatus write(w) val = 0x%04x\n", val);
 157
 158     s->intrstatus = val;
 159
 160     ivshmem_update_irq(s);
 161 }
 162
 163 static uint32_t ivshmem_IntrStatus_read(IVShmemState *s)
 164 {
 165     uint32_t ret = s->intrstatus;
 166
 167     /* reading ISR clears all interrupts */
 168     s->intrstatus = 0;
 169
 170     ivshmem_update_irq(s);
 171
 172     return ret;
 173 }
 174
 175 static void ivshmem_io_write(void *opaque, hwaddr addr,
 176                              uint64_t val, unsigned size)
 177 {
 178     IVShmemState *s = opaque;
 179
 180     uint16_t dest = val >> 16;
 181     uint16_t vector = val & 0xff;
 182
 183     addr &= 0xfc;
 184
 185     IVSHMEM_DPRINTF("writing to addr " TARGET_FMT_plx "\n", addr);
 186     switch (addr)
 187     {
 188         case INTRMASK:
 189             ivshmem_IntrMask_write(s, val);
 190             break;
 191
 192         case INTRSTATUS:
 193             ivshmem_IntrStatus_write(s, val);
 194             break;
 195
 196         case DOORBELL:
 197             /* check that dest VM ID is reasonable */
 198             if (dest >= s->nb_peers) {
 199                 IVSHMEM_DPRINTF("Invalid destination VM ID (%d)\n", dest);
 200                 break;
 201             }
 202
 203             /* check doorbell range */
 204             if (vector < s->peers[dest].nb_eventfds) {
 205                 IVSHMEM_DPRINTF("Notifying VM %d on vector %d\n", dest, vector);
 206                 event_notifier_set(&s->peers[dest].eventfds[vector]);
 207             } else {
 208                 IVSHMEM_DPRINTF("Invalid destination vector %d on VM %d\n",
 209                                 vector, dest);
 210             }
 211             break;
 212         default:
 213             IVSHMEM_DPRINTF("Unhandled write " TARGET_FMT_plx "\n", addr);
 214     }
 215 }
 216
 217 static uint64_t ivshmem_io_read(void *opaque, hwaddr addr,
 218                                 unsigned size)
 219 {
 220
 221     IVShmemState *s = opaque;
 222     uint32_t ret;
 223
 224     switch (addr)
 225     {
 226         case INTRMASK:
 227             ret = ivshmem_IntrMask_read(s);
 228             break;
 229
 230         case INTRSTATUS:
 231             ret = ivshmem_IntrStatus_read(s);
 232             break;
 233
 234         case IVPOSITION:
 235             /* return my VM ID if the memory is mapped */
 236             if (s->shm_fd > 0) {
 237                 ret = s->vm_id;
 238             } else {
 239                 ret = -1;
 240             }
 241             break;
 242
 243         default:
 244             IVSHMEM_DPRINTF("why are we reading " TARGET_FMT_plx "\n", addr);
 245             ret = 0;
 246     }
 247
 248     return ret;
 249 }
 250
 251 static const MemoryRegionOps ivshmem_mmio_ops = {
 252     .read = ivshmem_io_read,
 253     .write = ivshmem_io_write,
 254     .endianness = DEVICE_NATIVE_ENDIAN,
 255     .impl = {
 256         .min_access_size = 4,
 257         .max_access_size = 4,
 258     },
 259 };
 260
 261 static void ivshmem_receive(void *opaque, const uint8_t *buf, int size)
 262 {
 263     IVShmemState *s = opaque;
 264
 265     IVSHMEM_DPRINTF("ivshmem_receive 0x%02x size: %d\n", *buf, size);
 266
 267     ivshmem_IntrStatus_write(s, *buf);
 268 }
 269
 270 static int ivshmem_can_receive(void * opaque)
 271 {
 272     return sizeof(long);
 273 }
 274
 275 static void ivshmem_event(void *opaque, int event)
 276 {
 277     IVSHMEM_DPRINTF("ivshmem_event %d\n", event);
 278 }
 279
 280 static void fake_irqfd(void *opaque, const uint8_t *buf, int size) {
 281
 282     EventfdEntry *entry = opaque;
 283     PCIDevice *pdev = entry->pdev;
 284
 285     IVSHMEM_DPRINTF("interrupt on vector %p %d\n", pdev, entry->vector);
 286     msix_notify(pdev, entry->vector);
 287 }
 288
 289 static CharDriverState* create_eventfd_chr_device(void * opaque, EventNotifier *n,
 290                                                   int vector)
 291 {
 292     /* create a event character device based on the passed eventfd */
 293     IVShmemState *s = opaque;
 294     CharDriverState * chr;
 295     int eventfd = event_notifier_get_fd(n);
 296
 297     chr = qemu_chr_open_eventfd(eventfd);
 298
 299     if (chr == NULL) {
 300         error_report("creating chardriver for eventfd %d failed", eventfd);
 301         return NULL;
 302     }
 303     qemu_chr_fe_claim_no_fail(chr);
 304
 305     /* if MSI is supported we need multiple interrupts */
 306     if (ivshmem_has_feature(s, IVSHMEM_MSI)) {
 307         s->eventfd_table[vector].pdev = PCI_DEVICE(s);
 308         s->eventfd_table[vector].vector = vector;
 309
 310         qemu_chr_add_handlers(chr, ivshmem_can_receive, fake_irqfd,
 311                       ivshmem_event, &s->eventfd_table[vector]);
 312     } else {
 313         qemu_chr_add_handlers(chr, ivshmem_can_receive, ivshmem_receive,
 314                       ivshmem_event, s);
 315     }
 316
 317     return chr;
 318
 319 }
 320
 321 static int check_shm_size(IVShmemState *s, int fd, Error **errp)
 322 {
 323     /* check that the guest isn't going to try and map more memory than the
 324      * the object has allocated return -1 to indicate error */
 325
 326     struct stat buf;
 327
 328     if (fstat(fd, &buf) < 0) {
 329         error_setg(errp, "exiting: fstat on fd %d failed: %s",
 330                    fd, strerror(errno));
 331         return -1;
 332     }
 333
 334     if (s->ivshmem_size > buf.st_size) {
 335         error_setg(errp, "Requested memory size greater"
 336                    " than shared object size (%" PRIu64 " > %" PRIu64")",
 337                    s->ivshmem_size, (uint64_t)buf.st_size);
 338         return -1;
 339     } else {
 340         return 0;
 341     }
 342 }
 343
 344 /* create the shared memory BAR when we are not using the server, so we can
 345  * create the BAR and map the memory immediately */
 346 static int create_shared_memory_BAR(IVShmemState *s, int fd, uint8_t attr,
 347                                     Error **errp)
 348 {
 349     void * ptr;
 350
 351     ptr = mmap(0, s->ivshmem_size, PROT_READ|PROT_WRITE, MAP_SHARED, fd, 0);
 352     if (ptr == MAP_FAILED) {
 353         error_setg_errno(errp, errno, "Failed to mmap shared memory");
 354         return -1;
 355     }
 356
 357     s->shm_fd = fd;
 358
 359     memory_region_init_ram_ptr(&s->ivshmem, OBJECT(s), "ivshmem.bar2",
 360                                s->ivshmem_size, ptr);
 361     vmstate_register_ram(&s->ivshmem, DEVICE(s));
 362     memory_region_add_subregion(&s->bar, 0, &s->ivshmem);
 363
 364     /* region for shared memory */
 365     pci_register_bar(PCI_DEVICE(s), 2, attr, &s->bar);
 366
 367     return 0;
 368 }
 369
 370 static void ivshmem_add_eventfd(IVShmemState *s, int posn, int i)
 371 {
 372     memory_region_add_eventfd(&s->ivshmem_mmio,
 373                               DOORBELL,
 374                               4,
 375                               true,
 376                               (posn << 16) | i,
 377                               &s->peers[posn].eventfds[i]);
 378 }
 379
 380 static void ivshmem_del_eventfd(IVShmemState *s, int posn, int i)
 381 {
 382     memory_region_del_eventfd(&s->ivshmem_mmio,
 383                               DOORBELL,
 384                               4,
 385                               true,
 386                               (posn << 16) | i,
 387                               &s->peers[posn].eventfds[i]);
 388 }
 389
 390 static void close_guest_eventfds(IVShmemState *s, int posn)
 391 {
 392     int i, guest_curr_max;
 393
 394     if (!ivshmem_has_feature(s, IVSHMEM_IOEVENTFD)) {
 395         return;
 396     }
 397     if (posn < 0 || posn >= s->nb_peers) {
 398         error_report("invalid peer %d", posn);
 399         return;
 400     }
 401
 402     guest_curr_max = s->peers[posn].nb_eventfds;
 403
 404     memory_region_transaction_begin();
 405     for (i = 0; i < guest_curr_max; i++) {
 406         ivshmem_del_eventfd(s, posn, i);
 407     }
 408     memory_region_transaction_commit();
 409     for (i = 0; i < guest_curr_max; i++) {
 410         event_notifier_cleanup(&s->peers[posn].eventfds[i]);
 411     }
 412
 413     g_free(s->peers[posn].eventfds);
 414     s->peers[posn].nb_eventfds = 0;
 415 }
 416
 417 /* this function increase the dynamic storage need to store data about other
 418  * guests */
 419 static int resize_peers(IVShmemState *s, int new_min_size)
 420 {
 421
 422     int j, old_size;
 423
 424     /* limit number of max peers */
 425     if (new_min_size <= 0 || new_min_size > IVSHMEM_MAX_PEERS) {
 426         return -1;
 427     }
 428     if (new_min_size <= s->nb_peers) {
 429         return 0;
 430     }
 431
 432     old_size = s->nb_peers;
 433     s->nb_peers = new_min_size;
 434
 435     IVSHMEM_DPRINTF("bumping storage to %d guests\n", s->nb_peers);
 436
 437     s->peers = g_realloc(s->peers, s->nb_peers * sizeof(Peer));
 438
 439     for (j = old_size; j < s->nb_peers; j++) {
 440         s->peers[j].eventfds = g_new0(EventNotifier, s->vectors);
 441         s->peers[j].nb_eventfds = 0;
 442     }
 443
 444     return 0;
 445 }
 446
 447 static bool fifo_update_and_get(IVShmemState *s, const uint8_t *buf, int size,
 448                                 void *data, size_t len)
 449 {
 450     const uint8_t *p;
 451     uint32_t num;
 452
 453     assert(len <= sizeof(long)); /* limitation of the fifo */
 454     if (fifo8_is_empty(&s->incoming_fifo) && size == len) {
 455         memcpy(data, buf, size);
 456         return true;
 457     }
 458
 459     IVSHMEM_DPRINTF("short read of %d bytes\n", size);
 460
 461     num = MIN(size, sizeof(long) - fifo8_num_used(&s->incoming_fifo));
 462     fifo8_push_all(&s->incoming_fifo, buf, num);
 463
 464     if (fifo8_num_used(&s->incoming_fifo) < len) {
 465         assert(num == 0);
 466         return false;
 467     }
 468
 469     size -= num;
 470     buf += num;
 471     p = fifo8_pop_buf(&s->incoming_fifo, len, &num);
 472     assert(num == len);
 473
 474     memcpy(data, p, len);
 475
 476     if (size > 0) {
 477         fifo8_push_all(&s->incoming_fifo, buf, size);
 478     }
 479
 480     return true;
 481 }
 482
 483 static void ivshmem_read(void *opaque, const uint8_t *buf, int size)
 484 {
 485     IVShmemState *s = opaque;
 486     int incoming_fd;
 487     int new_eventfd;
 488     long incoming_posn;
 489     Error *err = NULL;
 490     Peer *peer;
 491
 492     if (!fifo_update_and_get(s, buf, size,
 493                              &incoming_posn, sizeof(incoming_posn))) {
 494         return;
 495     }
 496
 497     if (incoming_posn < -1) {
 498         IVSHMEM_DPRINTF("invalid incoming_posn %ld\n", incoming_posn);
 499         return;
 500     }
 501
 502     /* pick off s->server_chr->msgfd and store it, posn should accompany msg */
 503     incoming_fd = qemu_chr_fe_get_msgfd(s->server_chr);
 504     IVSHMEM_DPRINTF("posn is %ld, fd is %d\n", incoming_posn, incoming_fd);
 505
 506     /* make sure we have enough space for this guest */
 507     if (incoming_posn >= s->nb_peers) {
 508         if (resize_peers(s, incoming_posn + 1) < 0) {
 509             error_report("failed to resize peers array");
 510             if (incoming_fd != -1) {
 511                 close(incoming_fd);
 512             }
 513             return;
 514         }
 515     }
 516
 517     peer = &s->peers[incoming_posn];
 518
 519     if (incoming_fd == -1) {
 520         /* if posn is positive and unseen before then this is our posn*/
 521         if (incoming_posn >= 0 && s->vm_id == -1) {
 522             /* receive our posn */
 523             s->vm_id = incoming_posn;
 524         } else {
 525             /* otherwise an fd == -1 means an existing guest has gone away */
 526             IVSHMEM_DPRINTF("posn %ld has gone away\n", incoming_posn);
 527             close_guest_eventfds(s, incoming_posn);
 528         }
 529         return;
 530     }
 531
 532     /* if the position is -1, then it's shared memory region fd */
 533     if (incoming_posn == -1) {
 534         void * map_ptr;
 535
 536         if (check_shm_size(s, incoming_fd, &err) == -1) {
 537             error_report_err(err);
 538             close(incoming_fd);
 539             return;
 540         }
 541
 542         /* mmap the region and map into the BAR2 */
 543         map_ptr = mmap(0, s->ivshmem_size, PROT_READ|PROT_WRITE, MAP_SHARED,
 544                                                             incoming_fd, 0);
 545         if (map_ptr == MAP_FAILED) {
 546             error_report("Failed to mmap shared memory %s", strerror(errno));
 547             close(incoming_fd);
 548             return;
 549         }
 550         memory_region_init_ram_ptr(&s->ivshmem, OBJECT(s),
 551                                    "ivshmem.bar2", s->ivshmem_size, map_ptr);
 552         vmstate_register_ram(&s->ivshmem, DEVICE(s));
 553
 554         IVSHMEM_DPRINTF("guest h/w addr = %p, size = %" PRIu64 "\n",
 555                         map_ptr, s->ivshmem_size);
 556
 557         memory_region_add_subregion(&s->bar, 0, &s->ivshmem);
 558
 559         /* only store the fd if it is successfully mapped */
 560         s->shm_fd = incoming_fd;
 561
 562         return;
 563     }
 564
 565     /* each peer has an associated array of eventfds, and we keep
 566      * track of how many eventfds received so far */
 567     /* get a new eventfd: */
 568     new_eventfd = peer->nb_eventfds++;
 569
 570     /* this is an eventfd for a particular guest VM */
 571     IVSHMEM_DPRINTF("eventfds[%ld][%d] = %d\n", incoming_posn,
 572                     new_eventfd, incoming_fd);
 573     event_notifier_init_fd(&peer->eventfds[new_eventfd], incoming_fd);
 574
 575     if (incoming_posn == s->vm_id) {
 576         s->eventfd_chr[new_eventfd] = create_eventfd_chr_device(s,
 577                    &s->peers[s->vm_id].eventfds[new_eventfd],
 578                    new_eventfd);
 579     }
 580
 581     if (ivshmem_has_feature(s, IVSHMEM_IOEVENTFD)) {
 582         ivshmem_add_eventfd(s, incoming_posn, new_eventfd);
 583     }
 584 }
 585
 586 /* Select the MSI-X vectors used by device.
 587  * ivshmem maps events to vectors statically, so
 588  * we just enable all vectors on init and after reset. */
 589 static void ivshmem_use_msix(IVShmemState * s)
 590 {
 591     PCIDevice *d = PCI_DEVICE(s);
 592     int i;
 593
 594     IVSHMEM_DPRINTF("%s, msix present: %d\n", __func__, msix_present(d));
 595     if (!msix_present(d)) {
 596         return;
 597     }
 598
 599     for (i = 0; i < s->vectors; i++) {
 600         msix_vector_use(d, i);
 601     }
 602 }
 603
 604 static void ivshmem_reset(DeviceState *d)
 605 {
 606     IVShmemState *s = IVSHMEM(d);
 607
 608     s->intrstatus = 0;
 609     ivshmem_use_msix(s);
 610 }
 611
 612 static uint64_t ivshmem_get_size(IVShmemState * s, Error **errp) {
 613
 614     uint64_t value;
 615     char *ptr;
 616
 617     value = strtoull(s->sizearg, &ptr, 10);
 618     switch (*ptr) {
 619         case 0: case 'M': case 'm':
 620             value <<= 20;
 621             break;
 622         case 'G': case 'g':
 623             value <<= 30;
 624             break;
 625         default:
 626             error_setg(errp, "invalid ram size: %s", s->sizearg);
 627             return 0;
 628     }
 629
 630     /* BARs must be a power of 2 */
 631     if (!is_power_of_2(value)) {
 632         error_setg(errp, "size must be power of 2");
 633         return 0;
 634     }
 635
 636     return value;
 637 }
 638
 639 static int ivshmem_setup_msi(IVShmemState * s)
 640 {
 641     if (msix_init_exclusive_bar(PCI_DEVICE(s), s->vectors, 1)) {
 642         return -1;
 643     }
 644
 645     IVSHMEM_DPRINTF("msix initialized (%d vectors)\n", s->vectors);
 646
 647     /* allocate QEMU char devices for receiving interrupts */
 648     s->eventfd_table = g_malloc0(s->vectors * sizeof(EventfdEntry));
 649
 650     ivshmem_use_msix(s);
 651     return 0;
 652 }
 653
 654 static void ivshmem_write_config(PCIDevice *pci_dev, uint32_t address,
 655                                  uint32_t val, int len)
 656 {
 657     pci_default_write_config(pci_dev, address, val, len);
 658 }
 659
 660 static void pci_ivshmem_realize(PCIDevice *dev, Error **errp)
 661 {
 662     IVShmemState *s = IVSHMEM(dev);
 663     uint8_t *pci_conf;
 664     uint8_t attr = PCI_BASE_ADDRESS_SPACE_MEMORY |
 665         PCI_BASE_ADDRESS_MEM_PREFETCH;
 666     Error *local_err = NULL;
 667
 668     if (s->sizearg == NULL) {
 669         s->ivshmem_size = 4 << 20; /* 4 MB default */
 670     } else {
 671         s->ivshmem_size = ivshmem_get_size(s, &local_err);
 672         if (local_err) {
 673             error_propagate(errp, local_err);
 674             return;
 675         }
 676     }
 677
 678     fifo8_create(&s->incoming_fifo, sizeof(long));
 679
 680     /* IRQFD requires MSI */
 681     if (ivshmem_has_feature(s, IVSHMEM_IOEVENTFD) &&
 682         !ivshmem_has_feature(s, IVSHMEM_MSI)) {
 683         error_setg(errp, "ioeventfd/irqfd requires MSI");
 684         return;
 685     }
 686
 687     /* check that role is reasonable */
 688     if (s->role) {
 689         if (strncmp(s->role, "peer", 5) == 0) {
 690             s->role_val = IVSHMEM_PEER;
 691         } else if (strncmp(s->role, "master", 7) == 0) {
 692             s->role_val = IVSHMEM_MASTER;
 693         } else {
 694             error_setg(errp, "'role' must be 'peer' or 'master'");
 695             return;
 696         }
 697     } else {
 698         s->role_val = IVSHMEM_MASTER; /* default */
 699     }
 700
 701     if (s->role_val == IVSHMEM_PEER) {
 702         error_setg(&s->migration_blocker,
 703                    "Migration is disabled when using feature 'peer mode' in device 'ivshmem'");
 704         migrate_add_blocker(s->migration_blocker);
 705     }
 706
 707     pci_conf = dev->config;
 708     pci_conf[PCI_COMMAND] = PCI_COMMAND_IO | PCI_COMMAND_MEMORY;
 709
 710     pci_config_set_interrupt_pin(pci_conf, 1);
 711
 712     s->shm_fd = 0;
 713
 714     memory_region_init_io(&s->ivshmem_mmio, OBJECT(s), &ivshmem_mmio_ops, s,
 715                           "ivshmem-mmio", IVSHMEM_REG_BAR_SIZE);
 716
 717     /* region for registers*/
 718     pci_register_bar(dev, 0, PCI_BASE_ADDRESS_SPACE_MEMORY,
 719                      &s->ivshmem_mmio);
 720
 721     memory_region_init(&s->bar, OBJECT(s), "ivshmem-bar2-container", s->ivshmem_size);
 722     if (s->ivshmem_64bit) {
 723         attr |= PCI_BASE_ADDRESS_MEM_TYPE_64;
 724     }
 725
 726     if (s->server_chr != NULL) {
 727         if (strncmp(s->server_chr->filename, "unix:", 5)) {
 728             error_setg(errp, "chardev is not a unix client socket");
 729             return;
 730         }
 731
 732         /* if we get a UNIX socket as the parameter we will talk
 733          * to the ivshmem server to receive the memory region */
 734
 735         if (s->shmobj != NULL) {
 736             error_setg(errp, "do not specify both 'chardev' "
 737                        "and 'shm' with ivshmem");
 738             return;
 739         }
 740
 741         IVSHMEM_DPRINTF("using shared memory server (socket = %s)\n",
 742                         s->server_chr->filename);
 743
 744         if (ivshmem_has_feature(s, IVSHMEM_MSI) &&
 745             ivshmem_setup_msi(s)) {
 746             error_setg(errp, "msix initialization failed");
 747             return;
 748         }
 749
 750         /* we allocate enough space for 16 guests and grow as needed */
 751         resize_peers(s, 16);
 752         s->vm_id = -1;
 753
 754         pci_register_bar(dev, 2, attr, &s->bar);
 755
 756         s->eventfd_chr = g_malloc0(s->vectors * sizeof(CharDriverState *));
 757
 758         qemu_chr_add_handlers(s->server_chr, ivshmem_can_receive, ivshmem_read,
 759                      ivshmem_event, s);
 760     } else {
 761         /* just map the file immediately, we're not using a server */
 762         int fd;
 763
 764         if (s->shmobj == NULL) {
 765             error_setg(errp, "Must specify 'chardev' or 'shm' to ivshmem");
 766             return;
 767         }
 768
 769         IVSHMEM_DPRINTF("using shm_open (shm object = %s)\n", s->shmobj);
 770
 771         /* try opening with O_EXCL and if it succeeds zero the memory
 772          * by truncating to 0 */
 773         if ((fd = shm_open(s->shmobj, O_CREAT|O_RDWR|O_EXCL,
 774                         S_IRWXU|S_IRWXG|S_IRWXO)) > 0) {
 775            /* truncate file to length PCI device's memory */
 776             if (ftruncate(fd, s->ivshmem_size) != 0) {
 777                 error_report("could not truncate shared file");
 778             }
 779
 780         } else if ((fd = shm_open(s->shmobj, O_CREAT|O_RDWR,
 781                         S_IRWXU|S_IRWXG|S_IRWXO)) < 0) {
 782             error_setg(errp, "could not open shared file");
 783             return;
 784         }
 785
 786         if (check_shm_size(s, fd, errp) == -1) {
 787             return;
 788         }
 789
 790         create_shared_memory_BAR(s, fd, attr, errp);
 791     }
 792 }
 793
 794 static void pci_ivshmem_exit(PCIDevice *dev)
 795 {
 796     IVShmemState *s = IVSHMEM(dev);
 797
 798     if (s->migration_blocker) {
 799         migrate_del_blocker(s->migration_blocker);
 800         error_free(s->migration_blocker);
 801     }
 802
 803     memory_region_del_subregion(&s->bar, &s->ivshmem);
 804     vmstate_unregister_ram(&s->ivshmem, DEVICE(dev));
 805     fifo8_destroy(&s->incoming_fifo);
 806 }
 807
 808 static bool test_msix(void *opaque, int version_id)
 809 {
 810     IVShmemState *s = opaque;
 811
 812     return ivshmem_has_feature(s, IVSHMEM_MSI);
 813 }
 814
 815 static bool test_no_msix(void *opaque, int version_id)
 816 {
 817     return !test_msix(opaque, version_id);
 818 }
 819
 820 static int ivshmem_pre_load(void *opaque)
 821 {
 822     IVShmemState *s = opaque;
 823
 824     if (s->role_val == IVSHMEM_PEER) {
 825         error_report("'peer' devices are not migratable");
 826         return -EINVAL;
 827     }
 828
 829     return 0;
 830 }
 831
 832 static int ivshmem_post_load(void *opaque, int version_id)
 833 {
 834     IVShmemState *s = opaque;
 835
 836     if (ivshmem_has_feature(s, IVSHMEM_MSI)) {
 837         ivshmem_use_msix(s);
 838     }
 839
 840     return 0;
 841 }
 842
 843 static int ivshmem_load_old(QEMUFile *f, void *opaque, int version_id)
 844 {
 845     IVShmemState *s = opaque;
 846     PCIDevice *pdev = PCI_DEVICE(s);
 847     int ret;
 848
 849     IVSHMEM_DPRINTF("ivshmem_load_old\n");
 850
 851     if (version_id != 0) {
 852         return -EINVAL;
 853     }
 854
 855     if (s->role_val == IVSHMEM_PEER) {
 856         error_report("'peer' devices are not migratable");
 857         return -EINVAL;
 858     }
 859
 860     ret = pci_device_load(pdev, f);
 861     if (ret) {
 862         return ret;
 863     }
 864
 865     if (ivshmem_has_feature(s, IVSHMEM_MSI)) {
 866         msix_load(pdev, f);
 867         ivshmem_use_msix(s);
 868     } else {
 869         s->intrstatus = qemu_get_be32(f);
 870         s->intrmask = qemu_get_be32(f);
 871     }
 872
 873     return 0;
 874 }
 875
 876 static const VMStateDescription ivshmem_vmsd = {
 877     .name = "ivshmem",
 878     .version_id = 1,
 879     .minimum_version_id = 1,
 880     .pre_load = ivshmem_pre_load,
 881     .post_load = ivshmem_post_load,
 882     .fields = (VMStateField[]) {
 883         VMSTATE_PCI_DEVICE(parent_obj, IVShmemState),
 884
 885         VMSTATE_MSIX_TEST(parent_obj, IVShmemState, test_msix),
 886         VMSTATE_UINT32_TEST(intrstatus, IVShmemState, test_no_msix),
 887         VMSTATE_UINT32_TEST(intrmask, IVShmemState, test_no_msix),
 888
 889         VMSTATE_END_OF_LIST()
 890     },
 891     .load_state_old = ivshmem_load_old,
 892     .minimum_version_id_old = 0
 893 };
 894
 895 static Property ivshmem_properties[] = {
 896     DEFINE_PROP_CHR("chardev", IVShmemState, server_chr),
 897     DEFINE_PROP_STRING("size", IVShmemState, sizearg),
 898     DEFINE_PROP_UINT32("vectors", IVShmemState, vectors, 1),
 899     DEFINE_PROP_BIT("ioeventfd", IVShmemState, features, IVSHMEM_IOEVENTFD, false),
 900     DEFINE_PROP_BIT("msi", IVShmemState, features, IVSHMEM_MSI, true),
 901     DEFINE_PROP_STRING("shm", IVShmemState, shmobj),
 902     DEFINE_PROP_STRING("role", IVShmemState, role),
 903     DEFINE_PROP_UINT32("use64", IVShmemState, ivshmem_64bit, 1),
 904     DEFINE_PROP_END_OF_LIST(),
 905 };
 906
 907 static void ivshmem_class_init(ObjectClass *klass, void *data)
 908 {
 909     DeviceClass *dc = DEVICE_CLASS(klass);
 910     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
 911
 912     k->realize = pci_ivshmem_realize;
 913     k->exit = pci_ivshmem_exit;
 914     k->config_write = ivshmem_write_config;
 915     k->vendor_id = PCI_VENDOR_ID_IVSHMEM;
 916     k->device_id = PCI_DEVICE_ID_IVSHMEM;
 917     k->class_id = PCI_CLASS_MEMORY_RAM;
 918     dc->reset = ivshmem_reset;
 919     dc->props = ivshmem_properties;
 920     dc->vmsd = &ivshmem_vmsd;
 921     set_bit(DEVICE_CATEGORY_MISC, dc->categories);
 922 }
 923
 924 static const TypeInfo ivshmem_info = {
 925     .name          = TYPE_IVSHMEM,
 926     .parent        = TYPE_PCI_DEVICE,
 927     .instance_size = sizeof(IVShmemState),
 928     .class_init    = ivshmem_class_init,
 929 };
 930
 931 static void ivshmem_register_types(void)
 932 {
 933     type_register_static(&ivshmem_info);
 934 }
 935
 936 type_init(ivshmem_register_types)