2 * vfio based device assignment support
4 * Copyright Red Hat, Inc. 2012
7 * Alex Williamson <alex.williamson@redhat.com>
9 * This work is licensed under the terms of the GNU GPL, version 2. See
10 * the COPYING file in the top-level directory.
12 * Based on qemu-kvm device-assignment:
13 * Adapted for KVM by Qumranet.
14 * Copyright (c) 2007, Neocleus, Alex Novik (alex@neocleus.com)
15 * Copyright (c) 2007, Neocleus, Guy Zana (guy@neocleus.com)
16 * Copyright (C) 2008, Qumranet, Amit Shah (amit.shah@qumranet.com)
17 * Copyright (C) 2008, Red Hat, Amit Shah (amit.shah@redhat.com)
18 * Copyright (C) 2008, IBM, Muli Ben-Yehuda (muli@il.ibm.com)
22 #include <linux/vfio.h>
23 #include <sys/ioctl.h>
26 #include <sys/types.h>
30 #include "exec/address-spaces.h"
31 #include "exec/memory.h"
32 #include "hw/pci/msi.h"
33 #include "hw/pci/msix.h"
34 #include "hw/pci/pci.h"
35 #include "qemu-common.h"
36 #include "qemu/error-report.h"
37 #include "qemu/event_notifier.h"
38 #include "qemu/queue.h"
39 #include "qemu/range.h"
40 #include "sysemu/kvm.h"
41 #include "sysemu/sysemu.h"
43 /* #define DEBUG_VFIO */
45 #define DPRINTF(fmt, ...) \
46 do { fprintf(stderr, "vfio: " fmt, ## __VA_ARGS__); } while (0)
48 #define DPRINTF(fmt, ...) \
52 /* Extra debugging, trap acceleration paths for more logging */
53 #define VFIO_ALLOW_MMAP 1
54 #define VFIO_ALLOW_KVM_INTX 1
58 typedef struct VFIOQuirk
{
60 struct VFIODevice
*vdev
;
61 QLIST_ENTRY(VFIOQuirk
) next
;
63 uint32_t base_offset
:TARGET_PAGE_BITS
;
64 uint32_t address_offset
:TARGET_PAGE_BITS
;
65 uint32_t address_size
:3;
68 uint32_t address_match
;
69 uint32_t address_mask
;
71 uint32_t address_val
:TARGET_PAGE_BITS
;
72 uint32_t data_offset
:TARGET_PAGE_BITS
;
81 typedef struct VFIOBAR
{
82 off_t fd_offset
; /* offset of BAR within device fd */
83 int fd
; /* device fd, allows us to pass VFIOBAR as opaque data */
84 MemoryRegion mem
; /* slow, read/write access */
85 MemoryRegion mmap_mem
; /* direct mapped access */
88 uint32_t flags
; /* VFIO region flags (rd/wr/mmap) */
89 uint8_t nr
; /* cache the BAR number for debug */
92 QLIST_HEAD(, VFIOQuirk
) quirks
;
95 typedef struct VFIOVGARegion
{
99 QLIST_HEAD(, VFIOQuirk
) quirks
;
102 typedef struct VFIOVGA
{
105 VFIOVGARegion region
[QEMU_PCI_VGA_NUM_REGIONS
];
108 typedef struct VFIOINTx
{
109 bool pending
; /* interrupt pending */
110 bool kvm_accel
; /* set when QEMU bypass through KVM enabled */
111 uint8_t pin
; /* which pin to pull for qemu_set_irq */
112 EventNotifier interrupt
; /* eventfd triggered on interrupt */
113 EventNotifier unmask
; /* eventfd for unmask on QEMU bypass */
114 PCIINTxRoute route
; /* routing info for QEMU bypass */
115 uint32_t mmap_timeout
; /* delay to re-enable mmaps after interrupt */
116 QEMUTimer
*mmap_timer
; /* enable mmaps after periods w/o interrupts */
119 typedef struct VFIOMSIVector
{
120 EventNotifier interrupt
; /* eventfd triggered on interrupt */
121 struct VFIODevice
*vdev
; /* back pointer to device */
122 int virq
; /* KVM irqchip route for QEMU bypass */
135 typedef struct VFIOContainer
{
136 int fd
; /* /dev/vfio/vfio, empowered by the attached groups */
138 /* enable abstraction to support various iommu backends */
140 MemoryListener listener
; /* Used by type1 iommu */
142 void (*release
)(struct VFIOContainer
*);
144 QLIST_HEAD(, VFIOGroup
) group_list
;
145 QLIST_ENTRY(VFIOContainer
) next
;
148 /* Cache of MSI-X setup plus extra mmap and memory region for split BAR map */
149 typedef struct VFIOMSIXInfo
{
153 uint32_t table_offset
;
155 MemoryRegion mmap_mem
;
159 typedef struct VFIODevice
{
163 unsigned int config_size
;
164 uint8_t *emulated_config_bits
; /* QEMU emulated bits, little-endian */
165 off_t config_offset
; /* Offset of config space region within device fd */
166 unsigned int rom_size
;
167 off_t rom_offset
; /* Offset of ROM region within device fd */
169 VFIOMSIVector
*msi_vectors
;
171 int nr_vectors
; /* Number of MSI/MSIX vectors currently in use */
172 int interrupt
; /* Current interrupt type */
173 VFIOBAR bars
[PCI_NUM_REGIONS
- 1]; /* No ROM */
174 VFIOVGA vga
; /* 0xa0000, 0x3b0, 0x3c0 */
175 PCIHostDeviceAddress host
;
176 QLIST_ENTRY(VFIODevice
) next
;
177 struct VFIOGroup
*group
;
178 EventNotifier err_notifier
;
180 #define VFIO_FEATURE_ENABLE_VGA_BIT 0
181 #define VFIO_FEATURE_ENABLE_VGA (1 << VFIO_FEATURE_ENABLE_VGA_BIT)
189 typedef struct VFIOGroup
{
192 VFIOContainer
*container
;
193 QLIST_HEAD(, VFIODevice
) device_list
;
194 QLIST_ENTRY(VFIOGroup
) next
;
195 QLIST_ENTRY(VFIOGroup
) container_next
;
198 #define MSIX_CAP_LENGTH 12
200 static QLIST_HEAD(, VFIOContainer
)
201 container_list
= QLIST_HEAD_INITIALIZER(container_list
);
203 static QLIST_HEAD(, VFIOGroup
)
204 group_list
= QLIST_HEAD_INITIALIZER(group_list
);
206 static void vfio_disable_interrupts(VFIODevice
*vdev
);
207 static uint32_t vfio_pci_read_config(PCIDevice
*pdev
, uint32_t addr
, int len
);
208 static void vfio_pci_write_config(PCIDevice
*pdev
, uint32_t addr
,
209 uint32_t val
, int len
);
210 static void vfio_mmap_set_enabled(VFIODevice
*vdev
, bool enabled
);
213 * Common VFIO interrupt disable
215 static void vfio_disable_irqindex(VFIODevice
*vdev
, int index
)
217 struct vfio_irq_set irq_set
= {
218 .argsz
= sizeof(irq_set
),
219 .flags
= VFIO_IRQ_SET_DATA_NONE
| VFIO_IRQ_SET_ACTION_TRIGGER
,
225 ioctl(vdev
->fd
, VFIO_DEVICE_SET_IRQS
, &irq_set
);
231 static void vfio_unmask_intx(VFIODevice
*vdev
)
233 struct vfio_irq_set irq_set
= {
234 .argsz
= sizeof(irq_set
),
235 .flags
= VFIO_IRQ_SET_DATA_NONE
| VFIO_IRQ_SET_ACTION_UNMASK
,
236 .index
= VFIO_PCI_INTX_IRQ_INDEX
,
241 ioctl(vdev
->fd
, VFIO_DEVICE_SET_IRQS
, &irq_set
);
244 #ifdef CONFIG_KVM /* Unused outside of CONFIG_KVM code */
245 static void vfio_mask_intx(VFIODevice
*vdev
)
247 struct vfio_irq_set irq_set
= {
248 .argsz
= sizeof(irq_set
),
249 .flags
= VFIO_IRQ_SET_DATA_NONE
| VFIO_IRQ_SET_ACTION_MASK
,
250 .index
= VFIO_PCI_INTX_IRQ_INDEX
,
255 ioctl(vdev
->fd
, VFIO_DEVICE_SET_IRQS
, &irq_set
);
260 * Disabling BAR mmaping can be slow, but toggling it around INTx can
261 * also be a huge overhead. We try to get the best of both worlds by
262 * waiting until an interrupt to disable mmaps (subsequent transitions
263 * to the same state are effectively no overhead). If the interrupt has
264 * been serviced and the time gap is long enough, we re-enable mmaps for
265 * performance. This works well for things like graphics cards, which
266 * may not use their interrupt at all and are penalized to an unusable
267 * level by read/write BAR traps. Other devices, like NICs, have more
268 * regular interrupts and see much better latency by staying in non-mmap
269 * mode. We therefore set the default mmap_timeout such that a ping
270 * is just enough to keep the mmap disabled. Users can experiment with
271 * other options with the x-intx-mmap-timeout-ms parameter (a value of
272 * zero disables the timer).
274 static void vfio_intx_mmap_enable(void *opaque
)
276 VFIODevice
*vdev
= opaque
;
278 if (vdev
->intx
.pending
) {
279 timer_mod(vdev
->intx
.mmap_timer
,
280 qemu_clock_get_ms(QEMU_CLOCK_VIRTUAL
) + vdev
->intx
.mmap_timeout
);
284 vfio_mmap_set_enabled(vdev
, true);
287 static void vfio_intx_interrupt(void *opaque
)
289 VFIODevice
*vdev
= opaque
;
291 if (!event_notifier_test_and_clear(&vdev
->intx
.interrupt
)) {
295 DPRINTF("%s(%04x:%02x:%02x.%x) Pin %c\n", __func__
, vdev
->host
.domain
,
296 vdev
->host
.bus
, vdev
->host
.slot
, vdev
->host
.function
,
297 'A' + vdev
->intx
.pin
);
299 vdev
->intx
.pending
= true;
300 pci_irq_assert(&vdev
->pdev
);
301 vfio_mmap_set_enabled(vdev
, false);
302 if (vdev
->intx
.mmap_timeout
) {
303 timer_mod(vdev
->intx
.mmap_timer
,
304 qemu_clock_get_ms(QEMU_CLOCK_VIRTUAL
) + vdev
->intx
.mmap_timeout
);
308 static void vfio_eoi(VFIODevice
*vdev
)
310 if (!vdev
->intx
.pending
) {
314 DPRINTF("%s(%04x:%02x:%02x.%x) EOI\n", __func__
, vdev
->host
.domain
,
315 vdev
->host
.bus
, vdev
->host
.slot
, vdev
->host
.function
);
317 vdev
->intx
.pending
= false;
318 pci_irq_deassert(&vdev
->pdev
);
319 vfio_unmask_intx(vdev
);
322 static void vfio_enable_intx_kvm(VFIODevice
*vdev
)
325 struct kvm_irqfd irqfd
= {
326 .fd
= event_notifier_get_fd(&vdev
->intx
.interrupt
),
327 .gsi
= vdev
->intx
.route
.irq
,
328 .flags
= KVM_IRQFD_FLAG_RESAMPLE
,
330 struct vfio_irq_set
*irq_set
;
334 if (!VFIO_ALLOW_KVM_INTX
|| !kvm_irqfds_enabled() ||
335 vdev
->intx
.route
.mode
!= PCI_INTX_ENABLED
||
336 !kvm_check_extension(kvm_state
, KVM_CAP_IRQFD_RESAMPLE
)) {
340 /* Get to a known interrupt state */
341 qemu_set_fd_handler(irqfd
.fd
, NULL
, NULL
, vdev
);
342 vfio_mask_intx(vdev
);
343 vdev
->intx
.pending
= false;
344 pci_irq_deassert(&vdev
->pdev
);
346 /* Get an eventfd for resample/unmask */
347 if (event_notifier_init(&vdev
->intx
.unmask
, 0)) {
348 error_report("vfio: Error: event_notifier_init failed eoi");
352 /* KVM triggers it, VFIO listens for it */
353 irqfd
.resamplefd
= event_notifier_get_fd(&vdev
->intx
.unmask
);
355 if (kvm_vm_ioctl(kvm_state
, KVM_IRQFD
, &irqfd
)) {
356 error_report("vfio: Error: Failed to setup resample irqfd: %m");
360 argsz
= sizeof(*irq_set
) + sizeof(*pfd
);
362 irq_set
= g_malloc0(argsz
);
363 irq_set
->argsz
= argsz
;
364 irq_set
->flags
= VFIO_IRQ_SET_DATA_EVENTFD
| VFIO_IRQ_SET_ACTION_UNMASK
;
365 irq_set
->index
= VFIO_PCI_INTX_IRQ_INDEX
;
368 pfd
= (int32_t *)&irq_set
->data
;
370 *pfd
= irqfd
.resamplefd
;
372 ret
= ioctl(vdev
->fd
, VFIO_DEVICE_SET_IRQS
, irq_set
);
375 error_report("vfio: Error: Failed to setup INTx unmask fd: %m");
380 vfio_unmask_intx(vdev
);
382 vdev
->intx
.kvm_accel
= true;
384 DPRINTF("%s(%04x:%02x:%02x.%x) KVM INTx accel enabled\n",
385 __func__
, vdev
->host
.domain
, vdev
->host
.bus
,
386 vdev
->host
.slot
, vdev
->host
.function
);
391 irqfd
.flags
= KVM_IRQFD_FLAG_DEASSIGN
;
392 kvm_vm_ioctl(kvm_state
, KVM_IRQFD
, &irqfd
);
394 event_notifier_cleanup(&vdev
->intx
.unmask
);
396 qemu_set_fd_handler(irqfd
.fd
, vfio_intx_interrupt
, NULL
, vdev
);
397 vfio_unmask_intx(vdev
);
401 static void vfio_disable_intx_kvm(VFIODevice
*vdev
)
404 struct kvm_irqfd irqfd
= {
405 .fd
= event_notifier_get_fd(&vdev
->intx
.interrupt
),
406 .gsi
= vdev
->intx
.route
.irq
,
407 .flags
= KVM_IRQFD_FLAG_DEASSIGN
,
410 if (!vdev
->intx
.kvm_accel
) {
415 * Get to a known state, hardware masked, QEMU ready to accept new
416 * interrupts, QEMU IRQ de-asserted.
418 vfio_mask_intx(vdev
);
419 vdev
->intx
.pending
= false;
420 pci_irq_deassert(&vdev
->pdev
);
422 /* Tell KVM to stop listening for an INTx irqfd */
423 if (kvm_vm_ioctl(kvm_state
, KVM_IRQFD
, &irqfd
)) {
424 error_report("vfio: Error: Failed to disable INTx irqfd: %m");
427 /* We only need to close the eventfd for VFIO to cleanup the kernel side */
428 event_notifier_cleanup(&vdev
->intx
.unmask
);
430 /* QEMU starts listening for interrupt events. */
431 qemu_set_fd_handler(irqfd
.fd
, vfio_intx_interrupt
, NULL
, vdev
);
433 vdev
->intx
.kvm_accel
= false;
435 /* If we've missed an event, let it re-fire through QEMU */
436 vfio_unmask_intx(vdev
);
438 DPRINTF("%s(%04x:%02x:%02x.%x) KVM INTx accel disabled\n",
439 __func__
, vdev
->host
.domain
, vdev
->host
.bus
,
440 vdev
->host
.slot
, vdev
->host
.function
);
444 static void vfio_update_irq(PCIDevice
*pdev
)
446 VFIODevice
*vdev
= DO_UPCAST(VFIODevice
, pdev
, pdev
);
449 if (vdev
->interrupt
!= VFIO_INT_INTx
) {
453 route
= pci_device_route_intx_to_irq(&vdev
->pdev
, vdev
->intx
.pin
);
455 if (!pci_intx_route_changed(&vdev
->intx
.route
, &route
)) {
456 return; /* Nothing changed */
459 DPRINTF("%s(%04x:%02x:%02x.%x) IRQ moved %d -> %d\n", __func__
,
460 vdev
->host
.domain
, vdev
->host
.bus
, vdev
->host
.slot
,
461 vdev
->host
.function
, vdev
->intx
.route
.irq
, route
.irq
);
463 vfio_disable_intx_kvm(vdev
);
465 vdev
->intx
.route
= route
;
467 if (route
.mode
!= PCI_INTX_ENABLED
) {
471 vfio_enable_intx_kvm(vdev
);
473 /* Re-enable the interrupt in cased we missed an EOI */
477 static int vfio_enable_intx(VFIODevice
*vdev
)
479 uint8_t pin
= vfio_pci_read_config(&vdev
->pdev
, PCI_INTERRUPT_PIN
, 1);
481 struct vfio_irq_set
*irq_set
;
488 vfio_disable_interrupts(vdev
);
490 vdev
->intx
.pin
= pin
- 1; /* Pin A (1) -> irq[0] */
491 pci_config_set_interrupt_pin(vdev
->pdev
.config
, pin
);
495 * Only conditional to avoid generating error messages on platforms
496 * where we won't actually use the result anyway.
498 if (kvm_irqfds_enabled() &&
499 kvm_check_extension(kvm_state
, KVM_CAP_IRQFD_RESAMPLE
)) {
500 vdev
->intx
.route
= pci_device_route_intx_to_irq(&vdev
->pdev
,
505 ret
= event_notifier_init(&vdev
->intx
.interrupt
, 0);
507 error_report("vfio: Error: event_notifier_init failed");
511 argsz
= sizeof(*irq_set
) + sizeof(*pfd
);
513 irq_set
= g_malloc0(argsz
);
514 irq_set
->argsz
= argsz
;
515 irq_set
->flags
= VFIO_IRQ_SET_DATA_EVENTFD
| VFIO_IRQ_SET_ACTION_TRIGGER
;
516 irq_set
->index
= VFIO_PCI_INTX_IRQ_INDEX
;
519 pfd
= (int32_t *)&irq_set
->data
;
521 *pfd
= event_notifier_get_fd(&vdev
->intx
.interrupt
);
522 qemu_set_fd_handler(*pfd
, vfio_intx_interrupt
, NULL
, vdev
);
524 ret
= ioctl(vdev
->fd
, VFIO_DEVICE_SET_IRQS
, irq_set
);
527 error_report("vfio: Error: Failed to setup INTx fd: %m");
528 qemu_set_fd_handler(*pfd
, NULL
, NULL
, vdev
);
529 event_notifier_cleanup(&vdev
->intx
.interrupt
);
533 vfio_enable_intx_kvm(vdev
);
535 vdev
->interrupt
= VFIO_INT_INTx
;
537 DPRINTF("%s(%04x:%02x:%02x.%x)\n", __func__
, vdev
->host
.domain
,
538 vdev
->host
.bus
, vdev
->host
.slot
, vdev
->host
.function
);
543 static void vfio_disable_intx(VFIODevice
*vdev
)
547 timer_del(vdev
->intx
.mmap_timer
);
548 vfio_disable_intx_kvm(vdev
);
549 vfio_disable_irqindex(vdev
, VFIO_PCI_INTX_IRQ_INDEX
);
550 vdev
->intx
.pending
= false;
551 pci_irq_deassert(&vdev
->pdev
);
552 vfio_mmap_set_enabled(vdev
, true);
554 fd
= event_notifier_get_fd(&vdev
->intx
.interrupt
);
555 qemu_set_fd_handler(fd
, NULL
, NULL
, vdev
);
556 event_notifier_cleanup(&vdev
->intx
.interrupt
);
558 vdev
->interrupt
= VFIO_INT_NONE
;
560 DPRINTF("%s(%04x:%02x:%02x.%x)\n", __func__
, vdev
->host
.domain
,
561 vdev
->host
.bus
, vdev
->host
.slot
, vdev
->host
.function
);
567 static void vfio_msi_interrupt(void *opaque
)
569 VFIOMSIVector
*vector
= opaque
;
570 VFIODevice
*vdev
= vector
->vdev
;
571 int nr
= vector
- vdev
->msi_vectors
;
573 if (!event_notifier_test_and_clear(&vector
->interrupt
)) {
577 DPRINTF("%s(%04x:%02x:%02x.%x) vector %d\n", __func__
,
578 vdev
->host
.domain
, vdev
->host
.bus
, vdev
->host
.slot
,
579 vdev
->host
.function
, nr
);
581 if (vdev
->interrupt
== VFIO_INT_MSIX
) {
582 msix_notify(&vdev
->pdev
, nr
);
583 } else if (vdev
->interrupt
== VFIO_INT_MSI
) {
584 msi_notify(&vdev
->pdev
, nr
);
586 error_report("vfio: MSI interrupt receieved, but not enabled?");
590 static int vfio_enable_vectors(VFIODevice
*vdev
, bool msix
)
592 struct vfio_irq_set
*irq_set
;
593 int ret
= 0, i
, argsz
;
596 argsz
= sizeof(*irq_set
) + (vdev
->nr_vectors
* sizeof(*fds
));
598 irq_set
= g_malloc0(argsz
);
599 irq_set
->argsz
= argsz
;
600 irq_set
->flags
= VFIO_IRQ_SET_DATA_EVENTFD
| VFIO_IRQ_SET_ACTION_TRIGGER
;
601 irq_set
->index
= msix
? VFIO_PCI_MSIX_IRQ_INDEX
: VFIO_PCI_MSI_IRQ_INDEX
;
603 irq_set
->count
= vdev
->nr_vectors
;
604 fds
= (int32_t *)&irq_set
->data
;
606 for (i
= 0; i
< vdev
->nr_vectors
; i
++) {
607 if (!vdev
->msi_vectors
[i
].use
) {
612 fds
[i
] = event_notifier_get_fd(&vdev
->msi_vectors
[i
].interrupt
);
615 ret
= ioctl(vdev
->fd
, VFIO_DEVICE_SET_IRQS
, irq_set
);
622 static int vfio_msix_vector_do_use(PCIDevice
*pdev
, unsigned int nr
,
623 MSIMessage
*msg
, IOHandler
*handler
)
625 VFIODevice
*vdev
= DO_UPCAST(VFIODevice
, pdev
, pdev
);
626 VFIOMSIVector
*vector
;
629 DPRINTF("%s(%04x:%02x:%02x.%x) vector %d used\n", __func__
,
630 vdev
->host
.domain
, vdev
->host
.bus
, vdev
->host
.slot
,
631 vdev
->host
.function
, nr
);
633 vector
= &vdev
->msi_vectors
[nr
];
637 msix_vector_use(pdev
, nr
);
639 if (event_notifier_init(&vector
->interrupt
, 0)) {
640 error_report("vfio: Error: event_notifier_init failed");
644 * Attempt to enable route through KVM irqchip,
645 * default to userspace handling if unavailable.
647 vector
->virq
= msg
? kvm_irqchip_add_msi_route(kvm_state
, *msg
) : -1;
648 if (vector
->virq
< 0 ||
649 kvm_irqchip_add_irqfd_notifier(kvm_state
, &vector
->interrupt
,
650 NULL
, vector
->virq
) < 0) {
651 if (vector
->virq
>= 0) {
652 kvm_irqchip_release_virq(kvm_state
, vector
->virq
);
655 qemu_set_fd_handler(event_notifier_get_fd(&vector
->interrupt
),
656 handler
, NULL
, vector
);
660 * We don't want to have the host allocate all possible MSI vectors
661 * for a device if they're not in use, so we shutdown and incrementally
662 * increase them as needed.
664 if (vdev
->nr_vectors
< nr
+ 1) {
665 vfio_disable_irqindex(vdev
, VFIO_PCI_MSIX_IRQ_INDEX
);
666 vdev
->nr_vectors
= nr
+ 1;
667 ret
= vfio_enable_vectors(vdev
, true);
669 error_report("vfio: failed to enable vectors, %d", ret
);
673 struct vfio_irq_set
*irq_set
;
676 argsz
= sizeof(*irq_set
) + sizeof(*pfd
);
678 irq_set
= g_malloc0(argsz
);
679 irq_set
->argsz
= argsz
;
680 irq_set
->flags
= VFIO_IRQ_SET_DATA_EVENTFD
|
681 VFIO_IRQ_SET_ACTION_TRIGGER
;
682 irq_set
->index
= VFIO_PCI_MSIX_IRQ_INDEX
;
685 pfd
= (int32_t *)&irq_set
->data
;
687 *pfd
= event_notifier_get_fd(&vector
->interrupt
);
689 ret
= ioctl(vdev
->fd
, VFIO_DEVICE_SET_IRQS
, irq_set
);
692 error_report("vfio: failed to modify vector, %d", ret
);
699 static int vfio_msix_vector_use(PCIDevice
*pdev
,
700 unsigned int nr
, MSIMessage msg
)
702 return vfio_msix_vector_do_use(pdev
, nr
, &msg
, vfio_msi_interrupt
);
705 static void vfio_msix_vector_release(PCIDevice
*pdev
, unsigned int nr
)
707 VFIODevice
*vdev
= DO_UPCAST(VFIODevice
, pdev
, pdev
);
708 VFIOMSIVector
*vector
= &vdev
->msi_vectors
[nr
];
710 struct vfio_irq_set
*irq_set
;
713 DPRINTF("%s(%04x:%02x:%02x.%x) vector %d released\n", __func__
,
714 vdev
->host
.domain
, vdev
->host
.bus
, vdev
->host
.slot
,
715 vdev
->host
.function
, nr
);
718 * XXX What's the right thing to do here? This turns off the interrupt
719 * completely, but do we really just want to switch the interrupt to
720 * bouncing through userspace and let msix.c drop it? Not sure.
722 msix_vector_unuse(pdev
, nr
);
724 argsz
= sizeof(*irq_set
) + sizeof(*pfd
);
726 irq_set
= g_malloc0(argsz
);
727 irq_set
->argsz
= argsz
;
728 irq_set
->flags
= VFIO_IRQ_SET_DATA_EVENTFD
|
729 VFIO_IRQ_SET_ACTION_TRIGGER
;
730 irq_set
->index
= VFIO_PCI_MSIX_IRQ_INDEX
;
733 pfd
= (int32_t *)&irq_set
->data
;
737 ioctl(vdev
->fd
, VFIO_DEVICE_SET_IRQS
, irq_set
);
741 if (vector
->virq
< 0) {
742 qemu_set_fd_handler(event_notifier_get_fd(&vector
->interrupt
),
745 kvm_irqchip_remove_irqfd_notifier(kvm_state
, &vector
->interrupt
,
747 kvm_irqchip_release_virq(kvm_state
, vector
->virq
);
751 event_notifier_cleanup(&vector
->interrupt
);
755 static void vfio_enable_msix(VFIODevice
*vdev
)
757 vfio_disable_interrupts(vdev
);
759 vdev
->msi_vectors
= g_malloc0(vdev
->msix
->entries
* sizeof(VFIOMSIVector
));
761 vdev
->interrupt
= VFIO_INT_MSIX
;
764 * Some communication channels between VF & PF or PF & fw rely on the
765 * physical state of the device and expect that enabling MSI-X from the
766 * guest enables the same on the host. When our guest is Linux, the
767 * guest driver call to pci_enable_msix() sets the enabling bit in the
768 * MSI-X capability, but leaves the vector table masked. We therefore
769 * can't rely on a vector_use callback (from request_irq() in the guest)
770 * to switch the physical device into MSI-X mode because that may come a
771 * long time after pci_enable_msix(). This code enables vector 0 with
772 * triggering to userspace, then immediately release the vector, leaving
773 * the physical device with no vectors enabled, but MSI-X enabled, just
774 * like the guest view.
776 vfio_msix_vector_do_use(&vdev
->pdev
, 0, NULL
, NULL
);
777 vfio_msix_vector_release(&vdev
->pdev
, 0);
779 if (msix_set_vector_notifiers(&vdev
->pdev
, vfio_msix_vector_use
,
780 vfio_msix_vector_release
, NULL
)) {
781 error_report("vfio: msix_set_vector_notifiers failed");
784 DPRINTF("%s(%04x:%02x:%02x.%x)\n", __func__
, vdev
->host
.domain
,
785 vdev
->host
.bus
, vdev
->host
.slot
, vdev
->host
.function
);
788 static void vfio_enable_msi(VFIODevice
*vdev
)
792 vfio_disable_interrupts(vdev
);
794 vdev
->nr_vectors
= msi_nr_vectors_allocated(&vdev
->pdev
);
796 vdev
->msi_vectors
= g_malloc0(vdev
->nr_vectors
* sizeof(VFIOMSIVector
));
798 for (i
= 0; i
< vdev
->nr_vectors
; i
++) {
800 VFIOMSIVector
*vector
= &vdev
->msi_vectors
[i
];
805 if (event_notifier_init(&vector
->interrupt
, 0)) {
806 error_report("vfio: Error: event_notifier_init failed");
809 msg
= msi_get_message(&vdev
->pdev
, i
);
812 * Attempt to enable route through KVM irqchip,
813 * default to userspace handling if unavailable.
815 vector
->virq
= kvm_irqchip_add_msi_route(kvm_state
, msg
);
816 if (vector
->virq
< 0 ||
817 kvm_irqchip_add_irqfd_notifier(kvm_state
, &vector
->interrupt
,
818 NULL
, vector
->virq
) < 0) {
819 qemu_set_fd_handler(event_notifier_get_fd(&vector
->interrupt
),
820 vfio_msi_interrupt
, NULL
, vector
);
824 ret
= vfio_enable_vectors(vdev
, false);
827 error_report("vfio: Error: Failed to setup MSI fds: %m");
828 } else if (ret
!= vdev
->nr_vectors
) {
829 error_report("vfio: Error: Failed to enable %d "
830 "MSI vectors, retry with %d", vdev
->nr_vectors
, ret
);
833 for (i
= 0; i
< vdev
->nr_vectors
; i
++) {
834 VFIOMSIVector
*vector
= &vdev
->msi_vectors
[i
];
835 if (vector
->virq
>= 0) {
836 kvm_irqchip_remove_irqfd_notifier(kvm_state
, &vector
->interrupt
,
838 kvm_irqchip_release_virq(kvm_state
, vector
->virq
);
841 qemu_set_fd_handler(event_notifier_get_fd(&vector
->interrupt
),
844 event_notifier_cleanup(&vector
->interrupt
);
847 g_free(vdev
->msi_vectors
);
849 if (ret
> 0 && ret
!= vdev
->nr_vectors
) {
850 vdev
->nr_vectors
= ret
;
853 vdev
->nr_vectors
= 0;
858 vdev
->interrupt
= VFIO_INT_MSI
;
860 DPRINTF("%s(%04x:%02x:%02x.%x) Enabled %d MSI vectors\n", __func__
,
861 vdev
->host
.domain
, vdev
->host
.bus
, vdev
->host
.slot
,
862 vdev
->host
.function
, vdev
->nr_vectors
);
865 static void vfio_disable_msi_common(VFIODevice
*vdev
)
867 g_free(vdev
->msi_vectors
);
868 vdev
->msi_vectors
= NULL
;
869 vdev
->nr_vectors
= 0;
870 vdev
->interrupt
= VFIO_INT_NONE
;
872 vfio_enable_intx(vdev
);
875 static void vfio_disable_msix(VFIODevice
*vdev
)
877 msix_unset_vector_notifiers(&vdev
->pdev
);
879 if (vdev
->nr_vectors
) {
880 vfio_disable_irqindex(vdev
, VFIO_PCI_MSIX_IRQ_INDEX
);
883 vfio_disable_msi_common(vdev
);
885 DPRINTF("%s(%04x:%02x:%02x.%x)\n", __func__
, vdev
->host
.domain
,
886 vdev
->host
.bus
, vdev
->host
.slot
, vdev
->host
.function
);
889 static void vfio_disable_msi(VFIODevice
*vdev
)
893 vfio_disable_irqindex(vdev
, VFIO_PCI_MSI_IRQ_INDEX
);
895 for (i
= 0; i
< vdev
->nr_vectors
; i
++) {
896 VFIOMSIVector
*vector
= &vdev
->msi_vectors
[i
];
902 if (vector
->virq
>= 0) {
903 kvm_irqchip_remove_irqfd_notifier(kvm_state
,
904 &vector
->interrupt
, vector
->virq
);
905 kvm_irqchip_release_virq(kvm_state
, vector
->virq
);
908 qemu_set_fd_handler(event_notifier_get_fd(&vector
->interrupt
),
912 event_notifier_cleanup(&vector
->interrupt
);
915 vfio_disable_msi_common(vdev
);
917 DPRINTF("%s(%04x:%02x:%02x.%x)\n", __func__
, vdev
->host
.domain
,
918 vdev
->host
.bus
, vdev
->host
.slot
, vdev
->host
.function
);
922 * IO Port/MMIO - Beware of the endians, VFIO is always little endian
924 static void vfio_bar_write(void *opaque
, hwaddr addr
,
925 uint64_t data
, unsigned size
)
927 VFIOBAR
*bar
= opaque
;
940 buf
.word
= cpu_to_le16(data
);
943 buf
.dword
= cpu_to_le32(data
);
946 hw_error("vfio: unsupported write size, %d bytes\n", size
);
950 if (pwrite(bar
->fd
, &buf
, size
, bar
->fd_offset
+ addr
) != size
) {
951 error_report("%s(,0x%"HWADDR_PRIx
", 0x%"PRIx64
", %d) failed: %m",
952 __func__
, addr
, data
, size
);
957 VFIODevice
*vdev
= container_of(bar
, VFIODevice
, bars
[bar
->nr
]);
959 DPRINTF("%s(%04x:%02x:%02x.%x:BAR%d+0x%"HWADDR_PRIx
", 0x%"PRIx64
960 ", %d)\n", __func__
, vdev
->host
.domain
, vdev
->host
.bus
,
961 vdev
->host
.slot
, vdev
->host
.function
, bar
->nr
, addr
,
967 * A read or write to a BAR always signals an INTx EOI. This will
968 * do nothing if not pending (including not in INTx mode). We assume
969 * that a BAR access is in response to an interrupt and that BAR
970 * accesses will service the interrupt. Unfortunately, we don't know
971 * which access will service the interrupt, so we're potentially
972 * getting quite a few host interrupts per guest interrupt.
974 vfio_eoi(container_of(bar
, VFIODevice
, bars
[bar
->nr
]));
977 static uint64_t vfio_bar_read(void *opaque
,
978 hwaddr addr
, unsigned size
)
980 VFIOBAR
*bar
= opaque
;
989 if (pread(bar
->fd
, &buf
, size
, bar
->fd_offset
+ addr
) != size
) {
990 error_report("%s(,0x%"HWADDR_PRIx
", %d) failed: %m",
991 __func__
, addr
, size
);
1000 data
= le16_to_cpu(buf
.word
);
1003 data
= le32_to_cpu(buf
.dword
);
1006 hw_error("vfio: unsupported read size, %d bytes\n", size
);
1012 VFIODevice
*vdev
= container_of(bar
, VFIODevice
, bars
[bar
->nr
]);
1014 DPRINTF("%s(%04x:%02x:%02x.%x:BAR%d+0x%"HWADDR_PRIx
1015 ", %d) = 0x%"PRIx64
"\n", __func__
, vdev
->host
.domain
,
1016 vdev
->host
.bus
, vdev
->host
.slot
, vdev
->host
.function
,
1017 bar
->nr
, addr
, size
, data
);
1021 /* Same as write above */
1022 vfio_eoi(container_of(bar
, VFIODevice
, bars
[bar
->nr
]));
1027 static const MemoryRegionOps vfio_bar_ops
= {
1028 .read
= vfio_bar_read
,
1029 .write
= vfio_bar_write
,
1030 .endianness
= DEVICE_LITTLE_ENDIAN
,
1033 static void vfio_vga_write(void *opaque
, hwaddr addr
,
1034 uint64_t data
, unsigned size
)
1036 VFIOVGARegion
*region
= opaque
;
1037 VFIOVGA
*vga
= container_of(region
, VFIOVGA
, region
[region
->nr
]);
1044 off_t offset
= vga
->fd_offset
+ region
->offset
+ addr
;
1051 buf
.word
= cpu_to_le16(data
);
1054 buf
.dword
= cpu_to_le32(data
);
1057 hw_error("vfio: unsupported write size, %d bytes\n", size
);
1061 if (pwrite(vga
->fd
, &buf
, size
, offset
) != size
) {
1062 error_report("%s(,0x%"HWADDR_PRIx
", 0x%"PRIx64
", %d) failed: %m",
1063 __func__
, region
->offset
+ addr
, data
, size
);
1066 DPRINTF("%s(0x%"HWADDR_PRIx
", 0x%"PRIx64
", %d)\n",
1067 __func__
, region
->offset
+ addr
, data
, size
);
1070 static uint64_t vfio_vga_read(void *opaque
, hwaddr addr
, unsigned size
)
1072 VFIOVGARegion
*region
= opaque
;
1073 VFIOVGA
*vga
= container_of(region
, VFIOVGA
, region
[region
->nr
]);
1081 off_t offset
= vga
->fd_offset
+ region
->offset
+ addr
;
1083 if (pread(vga
->fd
, &buf
, size
, offset
) != size
) {
1084 error_report("%s(,0x%"HWADDR_PRIx
", %d) failed: %m",
1085 __func__
, region
->offset
+ addr
, size
);
1086 return (uint64_t)-1;
1094 data
= le16_to_cpu(buf
.word
);
1097 data
= le32_to_cpu(buf
.dword
);
1100 hw_error("vfio: unsupported read size, %d bytes\n", size
);
1104 DPRINTF("%s(0x%"HWADDR_PRIx
", %d) = 0x%"PRIx64
"\n",
1105 __func__
, region
->offset
+ addr
, size
, data
);
1110 static const MemoryRegionOps vfio_vga_ops
= {
1111 .read
= vfio_vga_read
,
1112 .write
= vfio_vga_write
,
1113 .endianness
= DEVICE_LITTLE_ENDIAN
,
1117 * Device specific quirks
1120 /* Is range1 fully contained within range2? */
1121 static bool vfio_range_contained(uint64_t first1
, uint64_t len1
,
1122 uint64_t first2
, uint64_t len2
) {
1123 return (first1
>= first2
&& first1
+ len1
<= first2
+ len2
);
1126 static bool vfio_flags_enabled(uint8_t flags
, uint8_t mask
)
1128 return (mask
&& (flags
& mask
) == mask
);
1131 static uint64_t vfio_generic_window_quirk_read(void *opaque
,
1132 hwaddr addr
, unsigned size
)
1134 VFIOQuirk
*quirk
= opaque
;
1135 VFIODevice
*vdev
= quirk
->vdev
;
1138 if (vfio_flags_enabled(quirk
->data
.flags
, quirk
->data
.read_flags
) &&
1139 ranges_overlap(addr
, size
,
1140 quirk
->data
.data_offset
, quirk
->data
.data_size
)) {
1141 hwaddr offset
= addr
- quirk
->data
.data_offset
;
1143 if (!vfio_range_contained(addr
, size
, quirk
->data
.data_offset
,
1144 quirk
->data
.data_size
)) {
1145 hw_error("%s: window data read not fully contained: %s\n",
1146 __func__
, memory_region_name(&quirk
->mem
));
1149 data
= vfio_pci_read_config(&vdev
->pdev
,
1150 quirk
->data
.address_val
+ offset
, size
);
1152 DPRINTF("%s read(%04x:%02x:%02x.%x:BAR%d+0x%"HWADDR_PRIx
", %d) = 0x%"
1153 PRIx64
"\n", memory_region_name(&quirk
->mem
), vdev
->host
.domain
,
1154 vdev
->host
.bus
, vdev
->host
.slot
, vdev
->host
.function
,
1155 quirk
->data
.bar
, addr
, size
, data
);
1157 data
= vfio_bar_read(&vdev
->bars
[quirk
->data
.bar
],
1158 addr
+ quirk
->data
.base_offset
, size
);
1164 static void vfio_generic_window_quirk_write(void *opaque
, hwaddr addr
,
1165 uint64_t data
, unsigned size
)
1167 VFIOQuirk
*quirk
= opaque
;
1168 VFIODevice
*vdev
= quirk
->vdev
;
1170 if (ranges_overlap(addr
, size
,
1171 quirk
->data
.address_offset
, quirk
->data
.address_size
)) {
1173 if (addr
!= quirk
->data
.address_offset
) {
1174 hw_error("%s: offset write into address window: %s\n",
1175 __func__
, memory_region_name(&quirk
->mem
));
1178 if ((data
& ~quirk
->data
.address_mask
) == quirk
->data
.address_match
) {
1179 quirk
->data
.flags
|= quirk
->data
.write_flags
|
1180 quirk
->data
.read_flags
;
1181 quirk
->data
.address_val
= data
& quirk
->data
.address_mask
;
1183 quirk
->data
.flags
&= ~(quirk
->data
.write_flags
|
1184 quirk
->data
.read_flags
);
1188 if (vfio_flags_enabled(quirk
->data
.flags
, quirk
->data
.write_flags
) &&
1189 ranges_overlap(addr
, size
,
1190 quirk
->data
.data_offset
, quirk
->data
.data_size
)) {
1191 hwaddr offset
= addr
- quirk
->data
.data_offset
;
1193 if (!vfio_range_contained(addr
, size
, quirk
->data
.data_offset
,
1194 quirk
->data
.data_size
)) {
1195 hw_error("%s: window data write not fully contained: %s\n",
1196 __func__
, memory_region_name(&quirk
->mem
));
1199 vfio_pci_write_config(&vdev
->pdev
,
1200 quirk
->data
.address_val
+ offset
, data
, size
);
1201 DPRINTF("%s write(%04x:%02x:%02x.%x:BAR%d+0x%"HWADDR_PRIx
", 0x%"
1202 PRIx64
", %d)\n", memory_region_name(&quirk
->mem
),
1203 vdev
->host
.domain
, vdev
->host
.bus
, vdev
->host
.slot
,
1204 vdev
->host
.function
, quirk
->data
.bar
, addr
, data
, size
);
1208 vfio_bar_write(&vdev
->bars
[quirk
->data
.bar
],
1209 addr
+ quirk
->data
.base_offset
, data
, size
);
1212 static const MemoryRegionOps vfio_generic_window_quirk
= {
1213 .read
= vfio_generic_window_quirk_read
,
1214 .write
= vfio_generic_window_quirk_write
,
1215 .endianness
= DEVICE_LITTLE_ENDIAN
,
1218 static uint64_t vfio_generic_quirk_read(void *opaque
,
1219 hwaddr addr
, unsigned size
)
1221 VFIOQuirk
*quirk
= opaque
;
1222 VFIODevice
*vdev
= quirk
->vdev
;
1223 hwaddr base
= quirk
->data
.address_match
& TARGET_PAGE_MASK
;
1224 hwaddr offset
= quirk
->data
.address_match
& ~TARGET_PAGE_MASK
;
1227 if (vfio_flags_enabled(quirk
->data
.flags
, quirk
->data
.read_flags
) &&
1228 ranges_overlap(addr
, size
, offset
, quirk
->data
.address_mask
+ 1)) {
1229 if (!vfio_range_contained(addr
, size
, offset
,
1230 quirk
->data
.address_mask
+ 1)) {
1231 hw_error("%s: read not fully contained: %s\n",
1232 __func__
, memory_region_name(&quirk
->mem
));
1235 data
= vfio_pci_read_config(&vdev
->pdev
, addr
- offset
, size
);
1237 DPRINTF("%s read(%04x:%02x:%02x.%x:BAR%d+0x%"HWADDR_PRIx
", %d) = 0x%"
1238 PRIx64
"\n", memory_region_name(&quirk
->mem
), vdev
->host
.domain
,
1239 vdev
->host
.bus
, vdev
->host
.slot
, vdev
->host
.function
,
1240 quirk
->data
.bar
, addr
+ base
, size
, data
);
1242 data
= vfio_bar_read(&vdev
->bars
[quirk
->data
.bar
], addr
+ base
, size
);
1248 static void vfio_generic_quirk_write(void *opaque
, hwaddr addr
,
1249 uint64_t data
, unsigned size
)
1251 VFIOQuirk
*quirk
= opaque
;
1252 VFIODevice
*vdev
= quirk
->vdev
;
1253 hwaddr base
= quirk
->data
.address_match
& TARGET_PAGE_MASK
;
1254 hwaddr offset
= quirk
->data
.address_match
& ~TARGET_PAGE_MASK
;
1256 if (vfio_flags_enabled(quirk
->data
.flags
, quirk
->data
.write_flags
) &&
1257 ranges_overlap(addr
, size
, offset
, quirk
->data
.address_mask
+ 1)) {
1258 if (!vfio_range_contained(addr
, size
, offset
,
1259 quirk
->data
.address_mask
+ 1)) {
1260 hw_error("%s: write not fully contained: %s\n",
1261 __func__
, memory_region_name(&quirk
->mem
));
1264 vfio_pci_write_config(&vdev
->pdev
, addr
- offset
, data
, size
);
1266 DPRINTF("%s write(%04x:%02x:%02x.%x:BAR%d+0x%"HWADDR_PRIx
", 0x%"
1267 PRIx64
", %d)\n", memory_region_name(&quirk
->mem
),
1268 vdev
->host
.domain
, vdev
->host
.bus
, vdev
->host
.slot
,
1269 vdev
->host
.function
, quirk
->data
.bar
, addr
+ base
, data
, size
);
1271 vfio_bar_write(&vdev
->bars
[quirk
->data
.bar
], addr
+ base
, data
, size
);
1275 static const MemoryRegionOps vfio_generic_quirk
= {
1276 .read
= vfio_generic_quirk_read
,
1277 .write
= vfio_generic_quirk_write
,
1278 .endianness
= DEVICE_LITTLE_ENDIAN
,
1281 #define PCI_VENDOR_ID_ATI 0x1002
1284 * Radeon HD cards (HD5450 & HD7850) report the upper byte of the I/O port BAR
1285 * through VGA register 0x3c3. On newer cards, the I/O port BAR is always
1286 * BAR4 (older cards like the X550 used BAR1, but we don't care to support
1287 * those). Note that on bare metal, a read of 0x3c3 doesn't always return the
1288 * I/O port BAR address. Originally this was coded to return the virtual BAR
1289 * address only if the physical register read returns the actual BAR address,
1290 * but users have reported greater success if we return the virtual address
1293 static uint64_t vfio_ati_3c3_quirk_read(void *opaque
,
1294 hwaddr addr
, unsigned size
)
1296 VFIOQuirk
*quirk
= opaque
;
1297 VFIODevice
*vdev
= quirk
->vdev
;
1298 uint64_t data
= vfio_pci_read_config(&vdev
->pdev
,
1299 PCI_BASE_ADDRESS_0
+ (4 * 4) + 1,
1301 DPRINTF("%s(0x3c3, 1) = 0x%"PRIx64
"\n", __func__
, data
);
1306 static const MemoryRegionOps vfio_ati_3c3_quirk
= {
1307 .read
= vfio_ati_3c3_quirk_read
,
1308 .endianness
= DEVICE_LITTLE_ENDIAN
,
1311 static void vfio_vga_probe_ati_3c3_quirk(VFIODevice
*vdev
)
1313 PCIDevice
*pdev
= &vdev
->pdev
;
1316 if (pci_get_word(pdev
->config
+ PCI_VENDOR_ID
) != PCI_VENDOR_ID_ATI
) {
1321 * As long as the BAR is >= 256 bytes it will be aligned such that the
1322 * lower byte is always zero. Filter out anything else, if it exists.
1324 if (!vdev
->bars
[4].ioport
|| vdev
->bars
[4].size
< 256) {
1328 quirk
= g_malloc0(sizeof(*quirk
));
1331 memory_region_init_io(&quirk
->mem
, OBJECT(vdev
), &vfio_ati_3c3_quirk
, quirk
,
1332 "vfio-ati-3c3-quirk", 1);
1333 memory_region_add_subregion(&vdev
->vga
.region
[QEMU_PCI_VGA_IO_HI
].mem
,
1334 3 /* offset 3 bytes from 0x3c0 */, &quirk
->mem
);
1336 QLIST_INSERT_HEAD(&vdev
->vga
.region
[QEMU_PCI_VGA_IO_HI
].quirks
,
1339 DPRINTF("Enabled ATI/AMD quirk 0x3c3 BAR4for device %04x:%02x:%02x.%x\n",
1340 vdev
->host
.domain
, vdev
->host
.bus
, vdev
->host
.slot
,
1341 vdev
->host
.function
);
1345 * Newer ATI/AMD devices, including HD5450 and HD7850, have a window to PCI
1346 * config space through MMIO BAR2 at offset 0x4000. Nothing seems to access
1347 * the MMIO space directly, but a window to this space is provided through
1348 * I/O port BAR4. Offset 0x0 is the address register and offset 0x4 is the
1349 * data register. When the address is programmed to a range of 0x4000-0x4fff
1350 * PCI configuration space is available. Experimentation seems to indicate
1351 * that only read-only access is provided, but we drop writes when the window
1352 * is enabled to config space nonetheless.
1354 static void vfio_probe_ati_bar4_window_quirk(VFIODevice
*vdev
, int nr
)
1356 PCIDevice
*pdev
= &vdev
->pdev
;
1359 if (!vdev
->has_vga
|| nr
!= 4 ||
1360 pci_get_word(pdev
->config
+ PCI_VENDOR_ID
) != PCI_VENDOR_ID_ATI
) {
1364 quirk
= g_malloc0(sizeof(*quirk
));
1366 quirk
->data
.address_size
= 4;
1367 quirk
->data
.data_offset
= 4;
1368 quirk
->data
.data_size
= 4;
1369 quirk
->data
.address_match
= 0x4000;
1370 quirk
->data
.address_mask
= PCIE_CONFIG_SPACE_SIZE
- 1;
1371 quirk
->data
.bar
= nr
;
1372 quirk
->data
.read_flags
= quirk
->data
.write_flags
= 1;
1374 memory_region_init_io(&quirk
->mem
, OBJECT(vdev
),
1375 &vfio_generic_window_quirk
, quirk
,
1376 "vfio-ati-bar4-window-quirk", 8);
1377 memory_region_add_subregion_overlap(&vdev
->bars
[nr
].mem
,
1378 quirk
->data
.base_offset
, &quirk
->mem
, 1);
1380 QLIST_INSERT_HEAD(&vdev
->bars
[nr
].quirks
, quirk
, next
);
1382 DPRINTF("Enabled ATI/AMD BAR4 window quirk for device %04x:%02x:%02x.%x\n",
1383 vdev
->host
.domain
, vdev
->host
.bus
, vdev
->host
.slot
,
1384 vdev
->host
.function
);
1388 * Trap the BAR2 MMIO window to config space as well.
1390 static void vfio_probe_ati_bar2_4000_quirk(VFIODevice
*vdev
, int nr
)
1392 PCIDevice
*pdev
= &vdev
->pdev
;
1395 /* Only enable on newer devices where BAR2 is 64bit */
1396 if (!vdev
->has_vga
|| nr
!= 2 || !vdev
->bars
[2].mem64
||
1397 pci_get_word(pdev
->config
+ PCI_VENDOR_ID
) != PCI_VENDOR_ID_ATI
) {
1401 quirk
= g_malloc0(sizeof(*quirk
));
1403 quirk
->data
.flags
= quirk
->data
.read_flags
= quirk
->data
.write_flags
= 1;
1404 quirk
->data
.address_match
= 0x4000;
1405 quirk
->data
.address_mask
= PCIE_CONFIG_SPACE_SIZE
- 1;
1406 quirk
->data
.bar
= nr
;
1408 memory_region_init_io(&quirk
->mem
, OBJECT(vdev
), &vfio_generic_quirk
, quirk
,
1409 "vfio-ati-bar2-4000-quirk",
1410 TARGET_PAGE_ALIGN(quirk
->data
.address_mask
+ 1));
1411 memory_region_add_subregion_overlap(&vdev
->bars
[nr
].mem
,
1412 quirk
->data
.address_match
& TARGET_PAGE_MASK
,
1415 QLIST_INSERT_HEAD(&vdev
->bars
[nr
].quirks
, quirk
, next
);
1417 DPRINTF("Enabled ATI/AMD BAR2 0x4000 quirk for device %04x:%02x:%02x.%x\n",
1418 vdev
->host
.domain
, vdev
->host
.bus
, vdev
->host
.slot
,
1419 vdev
->host
.function
);
1423 * Older ATI/AMD cards like the X550 have a similar window to that above.
1424 * I/O port BAR1 provides a window to a mirror of PCI config space located
1425 * in BAR2 at offset 0xf00. We don't care to support such older cards, but
1426 * note it for future reference.
1429 #define PCI_VENDOR_ID_NVIDIA 0x10de
1432 * Nvidia has several different methods to get to config space, the
1433 * nouveu project has several of these documented here:
1434 * https://github.com/pathscale/envytools/tree/master/hwdocs
1436 * The first quirk is actually not documented in envytools and is found
1437 * on 10de:01d1 (NVIDIA Corporation G72 [GeForce 7300 LE]). This is an
1438 * NV46 chipset. The backdoor uses the legacy VGA I/O ports to access
1439 * the mirror of PCI config space found at BAR0 offset 0x1800. The access
1440 * sequence first writes 0x338 to I/O port 0x3d4. The target offset is
1441 * then written to 0x3d0. Finally 0x538 is written for a read and 0x738
1442 * is written for a write to 0x3d4. The BAR0 offset is then accessible
1443 * through 0x3d0. This quirk doesn't seem to be necessary on newer cards
1444 * that use the I/O port BAR5 window but it doesn't hurt to leave it.
1454 static uint64_t vfio_nvidia_3d0_quirk_read(void *opaque
,
1455 hwaddr addr
, unsigned size
)
1457 VFIOQuirk
*quirk
= opaque
;
1458 VFIODevice
*vdev
= quirk
->vdev
;
1459 PCIDevice
*pdev
= &vdev
->pdev
;
1460 uint64_t data
= vfio_vga_read(&vdev
->vga
.region
[QEMU_PCI_VGA_IO_HI
],
1461 addr
+ quirk
->data
.base_offset
, size
);
1463 if (quirk
->data
.flags
== NV_3D0_READ
&& addr
== quirk
->data
.data_offset
) {
1464 data
= vfio_pci_read_config(pdev
, quirk
->data
.address_val
, size
);
1465 DPRINTF("%s(0x3d0, %d) = 0x%"PRIx64
"\n", __func__
, size
, data
);
1468 quirk
->data
.flags
= NV_3D0_NONE
;
1473 static void vfio_nvidia_3d0_quirk_write(void *opaque
, hwaddr addr
,
1474 uint64_t data
, unsigned size
)
1476 VFIOQuirk
*quirk
= opaque
;
1477 VFIODevice
*vdev
= quirk
->vdev
;
1478 PCIDevice
*pdev
= &vdev
->pdev
;
1480 switch (quirk
->data
.flags
) {
1482 if (addr
== quirk
->data
.address_offset
&& data
== 0x338) {
1483 quirk
->data
.flags
= NV_3D0_SELECT
;
1487 quirk
->data
.flags
= NV_3D0_NONE
;
1488 if (addr
== quirk
->data
.data_offset
&&
1489 (data
& ~quirk
->data
.address_mask
) == quirk
->data
.address_match
) {
1490 quirk
->data
.flags
= NV_3D0_WINDOW
;
1491 quirk
->data
.address_val
= data
& quirk
->data
.address_mask
;
1495 quirk
->data
.flags
= NV_3D0_NONE
;
1496 if (addr
== quirk
->data
.address_offset
) {
1497 if (data
== 0x538) {
1498 quirk
->data
.flags
= NV_3D0_READ
;
1499 } else if (data
== 0x738) {
1500 quirk
->data
.flags
= NV_3D0_WRITE
;
1505 quirk
->data
.flags
= NV_3D0_NONE
;
1506 if (addr
== quirk
->data
.data_offset
) {
1507 vfio_pci_write_config(pdev
, quirk
->data
.address_val
, data
, size
);
1508 DPRINTF("%s(0x3d0, 0x%"PRIx64
", %d)\n", __func__
, data
, size
);
1514 vfio_vga_write(&vdev
->vga
.region
[QEMU_PCI_VGA_IO_HI
],
1515 addr
+ quirk
->data
.base_offset
, data
, size
);
1518 static const MemoryRegionOps vfio_nvidia_3d0_quirk
= {
1519 .read
= vfio_nvidia_3d0_quirk_read
,
1520 .write
= vfio_nvidia_3d0_quirk_write
,
1521 .endianness
= DEVICE_LITTLE_ENDIAN
,
1524 static void vfio_vga_probe_nvidia_3d0_quirk(VFIODevice
*vdev
)
1526 PCIDevice
*pdev
= &vdev
->pdev
;
1529 if (pci_get_word(pdev
->config
+ PCI_VENDOR_ID
) != PCI_VENDOR_ID_NVIDIA
||
1530 !vdev
->bars
[1].size
) {
1534 quirk
= g_malloc0(sizeof(*quirk
));
1536 quirk
->data
.base_offset
= 0x10;
1537 quirk
->data
.address_offset
= 4;
1538 quirk
->data
.address_size
= 2;
1539 quirk
->data
.address_match
= 0x1800;
1540 quirk
->data
.address_mask
= PCI_CONFIG_SPACE_SIZE
- 1;
1541 quirk
->data
.data_offset
= 0;
1542 quirk
->data
.data_size
= 4;
1544 memory_region_init_io(&quirk
->mem
, OBJECT(vdev
), &vfio_nvidia_3d0_quirk
,
1545 quirk
, "vfio-nvidia-3d0-quirk", 6);
1546 memory_region_add_subregion(&vdev
->vga
.region
[QEMU_PCI_VGA_IO_HI
].mem
,
1547 quirk
->data
.base_offset
, &quirk
->mem
);
1549 QLIST_INSERT_HEAD(&vdev
->vga
.region
[QEMU_PCI_VGA_IO_HI
].quirks
,
1552 DPRINTF("Enabled NVIDIA VGA 0x3d0 quirk for device %04x:%02x:%02x.%x\n",
1553 vdev
->host
.domain
, vdev
->host
.bus
, vdev
->host
.slot
,
1554 vdev
->host
.function
);
1558 * The second quirk is documented in envytools. The I/O port BAR5 is just
1559 * a set of address/data ports to the MMIO BARs. The BAR we care about is
1560 * again BAR0. This backdoor is apparently a bit newer than the one above
1561 * so we need to not only trap 256 bytes @0x1800, but all of PCI config
1562 * space, including extended space is available at the 4k @0x88000.
1565 NV_BAR5_ADDRESS
= 0x1,
1566 NV_BAR5_ENABLE
= 0x2,
1567 NV_BAR5_MASTER
= 0x4,
1568 NV_BAR5_VALID
= 0x7,
1571 static void vfio_nvidia_bar5_window_quirk_write(void *opaque
, hwaddr addr
,
1572 uint64_t data
, unsigned size
)
1574 VFIOQuirk
*quirk
= opaque
;
1579 quirk
->data
.flags
|= NV_BAR5_MASTER
;
1581 quirk
->data
.flags
&= ~NV_BAR5_MASTER
;
1586 quirk
->data
.flags
|= NV_BAR5_ENABLE
;
1588 quirk
->data
.flags
&= ~NV_BAR5_ENABLE
;
1592 if (quirk
->data
.flags
& NV_BAR5_MASTER
) {
1593 if ((data
& ~0xfff) == 0x88000) {
1594 quirk
->data
.flags
|= NV_BAR5_ADDRESS
;
1595 quirk
->data
.address_val
= data
& 0xfff;
1596 } else if ((data
& ~0xff) == 0x1800) {
1597 quirk
->data
.flags
|= NV_BAR5_ADDRESS
;
1598 quirk
->data
.address_val
= data
& 0xff;
1600 quirk
->data
.flags
&= ~NV_BAR5_ADDRESS
;
1606 vfio_generic_window_quirk_write(opaque
, addr
, data
, size
);
1609 static const MemoryRegionOps vfio_nvidia_bar5_window_quirk
= {
1610 .read
= vfio_generic_window_quirk_read
,
1611 .write
= vfio_nvidia_bar5_window_quirk_write
,
1612 .valid
.min_access_size
= 4,
1613 .endianness
= DEVICE_LITTLE_ENDIAN
,
1616 static void vfio_probe_nvidia_bar5_window_quirk(VFIODevice
*vdev
, int nr
)
1618 PCIDevice
*pdev
= &vdev
->pdev
;
1621 if (!vdev
->has_vga
|| nr
!= 5 ||
1622 pci_get_word(pdev
->config
+ PCI_VENDOR_ID
) != PCI_VENDOR_ID_NVIDIA
) {
1626 quirk
= g_malloc0(sizeof(*quirk
));
1628 quirk
->data
.read_flags
= quirk
->data
.write_flags
= NV_BAR5_VALID
;
1629 quirk
->data
.address_offset
= 0x8;
1630 quirk
->data
.address_size
= 0; /* actually 4, but avoids generic code */
1631 quirk
->data
.data_offset
= 0xc;
1632 quirk
->data
.data_size
= 4;
1633 quirk
->data
.bar
= nr
;
1635 memory_region_init_io(&quirk
->mem
, OBJECT(vdev
),
1636 &vfio_nvidia_bar5_window_quirk
, quirk
,
1637 "vfio-nvidia-bar5-window-quirk", 16);
1638 memory_region_add_subregion_overlap(&vdev
->bars
[nr
].mem
, 0, &quirk
->mem
, 1);
1640 QLIST_INSERT_HEAD(&vdev
->bars
[nr
].quirks
, quirk
, next
);
1642 DPRINTF("Enabled NVIDIA BAR5 window quirk for device %04x:%02x:%02x.%x\n",
1643 vdev
->host
.domain
, vdev
->host
.bus
, vdev
->host
.slot
,
1644 vdev
->host
.function
);
1648 * Finally, BAR0 itself. We want to redirect any accesses to either
1649 * 0x1800 or 0x88000 through the PCI config space access functions.
1651 * NB - quirk at a page granularity or else they don't seem to work when
1654 * Here's offset 0x88000...
1656 static void vfio_probe_nvidia_bar0_88000_quirk(VFIODevice
*vdev
, int nr
)
1658 PCIDevice
*pdev
= &vdev
->pdev
;
1661 if (!vdev
->has_vga
|| nr
!= 0 ||
1662 pci_get_word(pdev
->config
+ PCI_VENDOR_ID
) != PCI_VENDOR_ID_NVIDIA
) {
1666 quirk
= g_malloc0(sizeof(*quirk
));
1668 quirk
->data
.flags
= quirk
->data
.read_flags
= quirk
->data
.write_flags
= 1;
1669 quirk
->data
.address_match
= 0x88000;
1670 quirk
->data
.address_mask
= PCIE_CONFIG_SPACE_SIZE
- 1;
1671 quirk
->data
.bar
= nr
;
1673 memory_region_init_io(&quirk
->mem
, OBJECT(vdev
), &vfio_generic_quirk
,
1674 quirk
, "vfio-nvidia-bar0-88000-quirk",
1675 TARGET_PAGE_ALIGN(quirk
->data
.address_mask
+ 1));
1676 memory_region_add_subregion_overlap(&vdev
->bars
[nr
].mem
,
1677 quirk
->data
.address_match
& TARGET_PAGE_MASK
,
1680 QLIST_INSERT_HEAD(&vdev
->bars
[nr
].quirks
, quirk
, next
);
1682 DPRINTF("Enabled NVIDIA BAR0 0x88000 quirk for device %04x:%02x:%02x.%x\n",
1683 vdev
->host
.domain
, vdev
->host
.bus
, vdev
->host
.slot
,
1684 vdev
->host
.function
);
1688 * And here's the same for BAR0 offset 0x1800...
1690 static void vfio_probe_nvidia_bar0_1800_quirk(VFIODevice
*vdev
, int nr
)
1692 PCIDevice
*pdev
= &vdev
->pdev
;
1695 if (!vdev
->has_vga
|| nr
!= 0 ||
1696 pci_get_word(pdev
->config
+ PCI_VENDOR_ID
) != PCI_VENDOR_ID_NVIDIA
) {
1700 /* Log the chipset ID */
1701 DPRINTF("Nvidia NV%02x\n",
1702 (unsigned int)(vfio_bar_read(&vdev
->bars
[0], 0, 4) >> 20) & 0xff);
1704 quirk
= g_malloc0(sizeof(*quirk
));
1706 quirk
->data
.flags
= quirk
->data
.read_flags
= quirk
->data
.write_flags
= 1;
1707 quirk
->data
.address_match
= 0x1800;
1708 quirk
->data
.address_mask
= PCI_CONFIG_SPACE_SIZE
- 1;
1709 quirk
->data
.bar
= nr
;
1711 memory_region_init_io(&quirk
->mem
, OBJECT(vdev
), &vfio_generic_quirk
, quirk
,
1712 "vfio-nvidia-bar0-1800-quirk",
1713 TARGET_PAGE_ALIGN(quirk
->data
.address_mask
+ 1));
1714 memory_region_add_subregion_overlap(&vdev
->bars
[nr
].mem
,
1715 quirk
->data
.address_match
& TARGET_PAGE_MASK
,
1718 QLIST_INSERT_HEAD(&vdev
->bars
[nr
].quirks
, quirk
, next
);
1720 DPRINTF("Enabled NVIDIA BAR0 0x1800 quirk for device %04x:%02x:%02x.%x\n",
1721 vdev
->host
.domain
, vdev
->host
.bus
, vdev
->host
.slot
,
1722 vdev
->host
.function
);
1726 * TODO - Some Nvidia devices provide config access to their companion HDA
1727 * device and even to their parent bridge via these config space mirrors.
1728 * Add quirks for those regions.
1732 * Common quirk probe entry points.
1734 static void vfio_vga_quirk_setup(VFIODevice
*vdev
)
1736 vfio_vga_probe_ati_3c3_quirk(vdev
);
1737 vfio_vga_probe_nvidia_3d0_quirk(vdev
);
1740 static void vfio_vga_quirk_teardown(VFIODevice
*vdev
)
1744 for (i
= 0; i
< ARRAY_SIZE(vdev
->vga
.region
); i
++) {
1745 while (!QLIST_EMPTY(&vdev
->vga
.region
[i
].quirks
)) {
1746 VFIOQuirk
*quirk
= QLIST_FIRST(&vdev
->vga
.region
[i
].quirks
);
1747 memory_region_del_subregion(&vdev
->vga
.region
[i
].mem
, &quirk
->mem
);
1748 QLIST_REMOVE(quirk
, next
);
1754 static void vfio_bar_quirk_setup(VFIODevice
*vdev
, int nr
)
1756 vfio_probe_ati_bar4_window_quirk(vdev
, nr
);
1757 vfio_probe_ati_bar2_4000_quirk(vdev
, nr
);
1758 vfio_probe_nvidia_bar5_window_quirk(vdev
, nr
);
1759 vfio_probe_nvidia_bar0_88000_quirk(vdev
, nr
);
1760 vfio_probe_nvidia_bar0_1800_quirk(vdev
, nr
);
1763 static void vfio_bar_quirk_teardown(VFIODevice
*vdev
, int nr
)
1765 VFIOBAR
*bar
= &vdev
->bars
[nr
];
1767 while (!QLIST_EMPTY(&bar
->quirks
)) {
1768 VFIOQuirk
*quirk
= QLIST_FIRST(&bar
->quirks
);
1769 memory_region_del_subregion(&bar
->mem
, &quirk
->mem
);
1770 QLIST_REMOVE(quirk
, next
);
1778 static uint32_t vfio_pci_read_config(PCIDevice
*pdev
, uint32_t addr
, int len
)
1780 VFIODevice
*vdev
= DO_UPCAST(VFIODevice
, pdev
, pdev
);
1781 uint32_t emu_bits
= 0, emu_val
= 0, phys_val
= 0, val
;
1783 memcpy(&emu_bits
, vdev
->emulated_config_bits
+ addr
, len
);
1784 emu_bits
= le32_to_cpu(emu_bits
);
1787 emu_val
= pci_default_read_config(pdev
, addr
, len
);
1790 if (~emu_bits
& (0xffffffffU
>> (32 - len
* 8))) {
1793 ret
= pread(vdev
->fd
, &phys_val
, len
, vdev
->config_offset
+ addr
);
1795 error_report("%s(%04x:%02x:%02x.%x, 0x%x, 0x%x) failed: %m",
1796 __func__
, vdev
->host
.domain
, vdev
->host
.bus
,
1797 vdev
->host
.slot
, vdev
->host
.function
, addr
, len
);
1800 phys_val
= le32_to_cpu(phys_val
);
1803 val
= (emu_val
& emu_bits
) | (phys_val
& ~emu_bits
);
1805 DPRINTF("%s(%04x:%02x:%02x.%x, @0x%x, len=0x%x) %x\n", __func__
,
1806 vdev
->host
.domain
, vdev
->host
.bus
, vdev
->host
.slot
,
1807 vdev
->host
.function
, addr
, len
, val
);
1812 static void vfio_pci_write_config(PCIDevice
*pdev
, uint32_t addr
,
1813 uint32_t val
, int len
)
1815 VFIODevice
*vdev
= DO_UPCAST(VFIODevice
, pdev
, pdev
);
1816 uint32_t val_le
= cpu_to_le32(val
);
1818 DPRINTF("%s(%04x:%02x:%02x.%x, @0x%x, 0x%x, len=0x%x)\n", __func__
,
1819 vdev
->host
.domain
, vdev
->host
.bus
, vdev
->host
.slot
,
1820 vdev
->host
.function
, addr
, val
, len
);
1822 /* Write everything to VFIO, let it filter out what we can't write */
1823 if (pwrite(vdev
->fd
, &val_le
, len
, vdev
->config_offset
+ addr
) != len
) {
1824 error_report("%s(%04x:%02x:%02x.%x, 0x%x, 0x%x, 0x%x) failed: %m",
1825 __func__
, vdev
->host
.domain
, vdev
->host
.bus
,
1826 vdev
->host
.slot
, vdev
->host
.function
, addr
, val
, len
);
1829 /* MSI/MSI-X Enabling/Disabling */
1830 if (pdev
->cap_present
& QEMU_PCI_CAP_MSI
&&
1831 ranges_overlap(addr
, len
, pdev
->msi_cap
, vdev
->msi_cap_size
)) {
1832 int is_enabled
, was_enabled
= msi_enabled(pdev
);
1834 pci_default_write_config(pdev
, addr
, val
, len
);
1836 is_enabled
= msi_enabled(pdev
);
1838 if (!was_enabled
&& is_enabled
) {
1839 vfio_enable_msi(vdev
);
1840 } else if (was_enabled
&& !is_enabled
) {
1841 vfio_disable_msi(vdev
);
1843 } else if (pdev
->cap_present
& QEMU_PCI_CAP_MSIX
&&
1844 ranges_overlap(addr
, len
, pdev
->msix_cap
, MSIX_CAP_LENGTH
)) {
1845 int is_enabled
, was_enabled
= msix_enabled(pdev
);
1847 pci_default_write_config(pdev
, addr
, val
, len
);
1849 is_enabled
= msix_enabled(pdev
);
1851 if (!was_enabled
&& is_enabled
) {
1852 vfio_enable_msix(vdev
);
1853 } else if (was_enabled
&& !is_enabled
) {
1854 vfio_disable_msix(vdev
);
1857 /* Write everything to QEMU to keep emulated bits correct */
1858 pci_default_write_config(pdev
, addr
, val
, len
);
1863 * DMA - Mapping and unmapping for the "type1" IOMMU interface used on x86
1865 static int vfio_dma_unmap(VFIOContainer
*container
,
1866 hwaddr iova
, ram_addr_t size
)
1868 struct vfio_iommu_type1_dma_unmap unmap
= {
1869 .argsz
= sizeof(unmap
),
1875 if (ioctl(container
->fd
, VFIO_IOMMU_UNMAP_DMA
, &unmap
)) {
1876 DPRINTF("VFIO_UNMAP_DMA: %d\n", -errno
);
1883 static int vfio_dma_map(VFIOContainer
*container
, hwaddr iova
,
1884 ram_addr_t size
, void *vaddr
, bool readonly
)
1886 struct vfio_iommu_type1_dma_map map
= {
1887 .argsz
= sizeof(map
),
1888 .flags
= VFIO_DMA_MAP_FLAG_READ
,
1889 .vaddr
= (__u64
)(uintptr_t)vaddr
,
1895 map
.flags
|= VFIO_DMA_MAP_FLAG_WRITE
;
1899 * Try the mapping, if it fails with EBUSY, unmap the region and try
1900 * again. This shouldn't be necessary, but we sometimes see it in
1901 * the the VGA ROM space.
1903 if (ioctl(container
->fd
, VFIO_IOMMU_MAP_DMA
, &map
) == 0 ||
1904 (errno
== EBUSY
&& vfio_dma_unmap(container
, iova
, size
) == 0 &&
1905 ioctl(container
->fd
, VFIO_IOMMU_MAP_DMA
, &map
) == 0)) {
1909 DPRINTF("VFIO_MAP_DMA: %d\n", -errno
);
1913 static bool vfio_listener_skipped_section(MemoryRegionSection
*section
)
1915 return !memory_region_is_ram(section
->mr
);
1918 static void vfio_listener_region_add(MemoryListener
*listener
,
1919 MemoryRegionSection
*section
)
1921 VFIOContainer
*container
= container_of(listener
, VFIOContainer
,
1922 iommu_data
.listener
);
1927 assert(!memory_region_is_iommu(section
->mr
));
1929 if (vfio_listener_skipped_section(section
)) {
1930 DPRINTF("SKIPPING region_add %"HWADDR_PRIx
" - %"PRIx64
"\n",
1931 section
->offset_within_address_space
,
1932 section
->offset_within_address_space
+ section
->size
- 1);
1936 if (unlikely((section
->offset_within_address_space
& ~TARGET_PAGE_MASK
) !=
1937 (section
->offset_within_region
& ~TARGET_PAGE_MASK
))) {
1938 error_report("%s received unaligned region", __func__
);
1942 iova
= TARGET_PAGE_ALIGN(section
->offset_within_address_space
);
1943 end
= (section
->offset_within_address_space
+ int128_get64(section
->size
)) &
1950 vaddr
= memory_region_get_ram_ptr(section
->mr
) +
1951 section
->offset_within_region
+
1952 (iova
- section
->offset_within_address_space
);
1954 DPRINTF("region_add %"HWADDR_PRIx
" - %"HWADDR_PRIx
" [%p]\n",
1955 iova
, end
- 1, vaddr
);
1957 memory_region_ref(section
->mr
);
1958 ret
= vfio_dma_map(container
, iova
, end
- iova
, vaddr
, section
->readonly
);
1960 error_report("vfio_dma_map(%p, 0x%"HWADDR_PRIx
", "
1961 "0x%"HWADDR_PRIx
", %p) = %d (%m)",
1962 container
, iova
, end
- iova
, vaddr
, ret
);
1966 static void vfio_listener_region_del(MemoryListener
*listener
,
1967 MemoryRegionSection
*section
)
1969 VFIOContainer
*container
= container_of(listener
, VFIOContainer
,
1970 iommu_data
.listener
);
1974 if (vfio_listener_skipped_section(section
)) {
1975 DPRINTF("SKIPPING region_del %"HWADDR_PRIx
" - %"PRIx64
"\n",
1976 section
->offset_within_address_space
,
1977 section
->offset_within_address_space
+ section
->size
- 1);
1981 if (unlikely((section
->offset_within_address_space
& ~TARGET_PAGE_MASK
) !=
1982 (section
->offset_within_region
& ~TARGET_PAGE_MASK
))) {
1983 error_report("%s received unaligned region", __func__
);
1987 iova
= TARGET_PAGE_ALIGN(section
->offset_within_address_space
);
1988 end
= (section
->offset_within_address_space
+ int128_get64(section
->size
)) &
1995 DPRINTF("region_del %"HWADDR_PRIx
" - %"HWADDR_PRIx
"\n",
1998 ret
= vfio_dma_unmap(container
, iova
, end
- iova
);
1999 memory_region_unref(section
->mr
);
2001 error_report("vfio_dma_unmap(%p, 0x%"HWADDR_PRIx
", "
2002 "0x%"HWADDR_PRIx
") = %d (%m)",
2003 container
, iova
, end
- iova
, ret
);
2007 static MemoryListener vfio_memory_listener
= {
2008 .region_add
= vfio_listener_region_add
,
2009 .region_del
= vfio_listener_region_del
,
2012 static void vfio_listener_release(VFIOContainer
*container
)
2014 memory_listener_unregister(&container
->iommu_data
.listener
);
2020 static void vfio_disable_interrupts(VFIODevice
*vdev
)
2022 switch (vdev
->interrupt
) {
2024 vfio_disable_intx(vdev
);
2027 vfio_disable_msi(vdev
);
2030 vfio_disable_msix(vdev
);
2035 static int vfio_setup_msi(VFIODevice
*vdev
, int pos
)
2038 bool msi_64bit
, msi_maskbit
;
2041 if (pread(vdev
->fd
, &ctrl
, sizeof(ctrl
),
2042 vdev
->config_offset
+ pos
+ PCI_CAP_FLAGS
) != sizeof(ctrl
)) {
2045 ctrl
= le16_to_cpu(ctrl
);
2047 msi_64bit
= !!(ctrl
& PCI_MSI_FLAGS_64BIT
);
2048 msi_maskbit
= !!(ctrl
& PCI_MSI_FLAGS_MASKBIT
);
2049 entries
= 1 << ((ctrl
& PCI_MSI_FLAGS_QMASK
) >> 1);
2051 DPRINTF("%04x:%02x:%02x.%x PCI MSI CAP @0x%x\n", vdev
->host
.domain
,
2052 vdev
->host
.bus
, vdev
->host
.slot
, vdev
->host
.function
, pos
);
2054 ret
= msi_init(&vdev
->pdev
, pos
, entries
, msi_64bit
, msi_maskbit
);
2056 if (ret
== -ENOTSUP
) {
2059 error_report("vfio: msi_init failed");
2062 vdev
->msi_cap_size
= 0xa + (msi_maskbit
? 0xa : 0) + (msi_64bit
? 0x4 : 0);
2068 * We don't have any control over how pci_add_capability() inserts
2069 * capabilities into the chain. In order to setup MSI-X we need a
2070 * MemoryRegion for the BAR. In order to setup the BAR and not
2071 * attempt to mmap the MSI-X table area, which VFIO won't allow, we
2072 * need to first look for where the MSI-X table lives. So we
2073 * unfortunately split MSI-X setup across two functions.
2075 static int vfio_early_setup_msix(VFIODevice
*vdev
)
2079 uint32_t table
, pba
;
2081 pos
= pci_find_capability(&vdev
->pdev
, PCI_CAP_ID_MSIX
);
2086 if (pread(vdev
->fd
, &ctrl
, sizeof(ctrl
),
2087 vdev
->config_offset
+ pos
+ PCI_CAP_FLAGS
) != sizeof(ctrl
)) {
2091 if (pread(vdev
->fd
, &table
, sizeof(table
),
2092 vdev
->config_offset
+ pos
+ PCI_MSIX_TABLE
) != sizeof(table
)) {
2096 if (pread(vdev
->fd
, &pba
, sizeof(pba
),
2097 vdev
->config_offset
+ pos
+ PCI_MSIX_PBA
) != sizeof(pba
)) {
2101 ctrl
= le16_to_cpu(ctrl
);
2102 table
= le32_to_cpu(table
);
2103 pba
= le32_to_cpu(pba
);
2105 vdev
->msix
= g_malloc0(sizeof(*(vdev
->msix
)));
2106 vdev
->msix
->table_bar
= table
& PCI_MSIX_FLAGS_BIRMASK
;
2107 vdev
->msix
->table_offset
= table
& ~PCI_MSIX_FLAGS_BIRMASK
;
2108 vdev
->msix
->pba_bar
= pba
& PCI_MSIX_FLAGS_BIRMASK
;
2109 vdev
->msix
->pba_offset
= pba
& ~PCI_MSIX_FLAGS_BIRMASK
;
2110 vdev
->msix
->entries
= (ctrl
& PCI_MSIX_FLAGS_QSIZE
) + 1;
2112 DPRINTF("%04x:%02x:%02x.%x "
2113 "PCI MSI-X CAP @0x%x, BAR %d, offset 0x%x, entries %d\n",
2114 vdev
->host
.domain
, vdev
->host
.bus
, vdev
->host
.slot
,
2115 vdev
->host
.function
, pos
, vdev
->msix
->table_bar
,
2116 vdev
->msix
->table_offset
, vdev
->msix
->entries
);
2121 static int vfio_setup_msix(VFIODevice
*vdev
, int pos
)
2125 ret
= msix_init(&vdev
->pdev
, vdev
->msix
->entries
,
2126 &vdev
->bars
[vdev
->msix
->table_bar
].mem
,
2127 vdev
->msix
->table_bar
, vdev
->msix
->table_offset
,
2128 &vdev
->bars
[vdev
->msix
->pba_bar
].mem
,
2129 vdev
->msix
->pba_bar
, vdev
->msix
->pba_offset
, pos
);
2131 if (ret
== -ENOTSUP
) {
2134 error_report("vfio: msix_init failed");
2141 static void vfio_teardown_msi(VFIODevice
*vdev
)
2143 msi_uninit(&vdev
->pdev
);
2146 msix_uninit(&vdev
->pdev
, &vdev
->bars
[vdev
->msix
->table_bar
].mem
,
2147 &vdev
->bars
[vdev
->msix
->pba_bar
].mem
);
2154 static void vfio_mmap_set_enabled(VFIODevice
*vdev
, bool enabled
)
2158 for (i
= 0; i
< PCI_ROM_SLOT
; i
++) {
2159 VFIOBAR
*bar
= &vdev
->bars
[i
];
2165 memory_region_set_enabled(&bar
->mmap_mem
, enabled
);
2166 if (vdev
->msix
&& vdev
->msix
->table_bar
== i
) {
2167 memory_region_set_enabled(&vdev
->msix
->mmap_mem
, enabled
);
2172 static void vfio_unmap_bar(VFIODevice
*vdev
, int nr
)
2174 VFIOBAR
*bar
= &vdev
->bars
[nr
];
2180 vfio_bar_quirk_teardown(vdev
, nr
);
2182 memory_region_del_subregion(&bar
->mem
, &bar
->mmap_mem
);
2183 munmap(bar
->mmap
, memory_region_size(&bar
->mmap_mem
));
2185 if (vdev
->msix
&& vdev
->msix
->table_bar
== nr
) {
2186 memory_region_del_subregion(&bar
->mem
, &vdev
->msix
->mmap_mem
);
2187 munmap(vdev
->msix
->mmap
, memory_region_size(&vdev
->msix
->mmap_mem
));
2190 memory_region_destroy(&bar
->mem
);
2193 static int vfio_mmap_bar(VFIODevice
*vdev
, VFIOBAR
*bar
,
2194 MemoryRegion
*mem
, MemoryRegion
*submem
,
2195 void **map
, size_t size
, off_t offset
,
2200 if (VFIO_ALLOW_MMAP
&& size
&& bar
->flags
& VFIO_REGION_INFO_FLAG_MMAP
) {
2203 if (bar
->flags
& VFIO_REGION_INFO_FLAG_READ
) {
2207 if (bar
->flags
& VFIO_REGION_INFO_FLAG_WRITE
) {
2211 *map
= mmap(NULL
, size
, prot
, MAP_SHARED
,
2212 bar
->fd
, bar
->fd_offset
+ offset
);
2213 if (*map
== MAP_FAILED
) {
2219 memory_region_init_ram_ptr(submem
, OBJECT(vdev
), name
, size
, *map
);
2222 /* Create a zero sized sub-region to make cleanup easy. */
2223 memory_region_init(submem
, OBJECT(vdev
), name
, 0);
2226 memory_region_add_subregion(mem
, offset
, submem
);
2231 static void vfio_map_bar(VFIODevice
*vdev
, int nr
)
2233 VFIOBAR
*bar
= &vdev
->bars
[nr
];
2234 unsigned size
= bar
->size
;
2240 /* Skip both unimplemented BARs and the upper half of 64bit BARS. */
2245 snprintf(name
, sizeof(name
), "VFIO %04x:%02x:%02x.%x BAR %d",
2246 vdev
->host
.domain
, vdev
->host
.bus
, vdev
->host
.slot
,
2247 vdev
->host
.function
, nr
);
2249 /* Determine what type of BAR this is for registration */
2250 ret
= pread(vdev
->fd
, &pci_bar
, sizeof(pci_bar
),
2251 vdev
->config_offset
+ PCI_BASE_ADDRESS_0
+ (4 * nr
));
2252 if (ret
!= sizeof(pci_bar
)) {
2253 error_report("vfio: Failed to read BAR %d (%m)", nr
);
2257 pci_bar
= le32_to_cpu(pci_bar
);
2258 bar
->ioport
= (pci_bar
& PCI_BASE_ADDRESS_SPACE_IO
);
2259 bar
->mem64
= bar
->ioport
? 0 : (pci_bar
& PCI_BASE_ADDRESS_MEM_TYPE_64
);
2260 type
= pci_bar
& (bar
->ioport
? ~PCI_BASE_ADDRESS_IO_MASK
:
2261 ~PCI_BASE_ADDRESS_MEM_MASK
);
2263 /* A "slow" read/write mapping underlies all BARs */
2264 memory_region_init_io(&bar
->mem
, OBJECT(vdev
), &vfio_bar_ops
,
2266 pci_register_bar(&vdev
->pdev
, nr
, type
, &bar
->mem
);
2269 * We can't mmap areas overlapping the MSIX vector table, so we
2270 * potentially insert a direct-mapped subregion before and after it.
2272 if (vdev
->msix
&& vdev
->msix
->table_bar
== nr
) {
2273 size
= vdev
->msix
->table_offset
& TARGET_PAGE_MASK
;
2276 strncat(name
, " mmap", sizeof(name
) - strlen(name
) - 1);
2277 if (vfio_mmap_bar(vdev
, bar
, &bar
->mem
,
2278 &bar
->mmap_mem
, &bar
->mmap
, size
, 0, name
)) {
2279 error_report("%s unsupported. Performance may be slow", name
);
2282 if (vdev
->msix
&& vdev
->msix
->table_bar
== nr
) {
2285 start
= TARGET_PAGE_ALIGN(vdev
->msix
->table_offset
+
2286 (vdev
->msix
->entries
* PCI_MSIX_ENTRY_SIZE
));
2288 size
= start
< bar
->size
? bar
->size
- start
: 0;
2289 strncat(name
, " msix-hi", sizeof(name
) - strlen(name
) - 1);
2290 /* VFIOMSIXInfo contains another MemoryRegion for this mapping */
2291 if (vfio_mmap_bar(vdev
, bar
, &bar
->mem
, &vdev
->msix
->mmap_mem
,
2292 &vdev
->msix
->mmap
, size
, start
, name
)) {
2293 error_report("%s unsupported. Performance may be slow", name
);
2297 vfio_bar_quirk_setup(vdev
, nr
);
2300 static void vfio_map_bars(VFIODevice
*vdev
)
2304 for (i
= 0; i
< PCI_ROM_SLOT
; i
++) {
2305 vfio_map_bar(vdev
, i
);
2308 if (vdev
->has_vga
) {
2309 memory_region_init_io(&vdev
->vga
.region
[QEMU_PCI_VGA_MEM
].mem
,
2310 OBJECT(vdev
), &vfio_vga_ops
,
2311 &vdev
->vga
.region
[QEMU_PCI_VGA_MEM
],
2312 "vfio-vga-mmio@0xa0000",
2313 QEMU_PCI_VGA_MEM_SIZE
);
2314 memory_region_init_io(&vdev
->vga
.region
[QEMU_PCI_VGA_IO_LO
].mem
,
2315 OBJECT(vdev
), &vfio_vga_ops
,
2316 &vdev
->vga
.region
[QEMU_PCI_VGA_IO_LO
],
2317 "vfio-vga-io@0x3b0",
2318 QEMU_PCI_VGA_IO_LO_SIZE
);
2319 memory_region_init_io(&vdev
->vga
.region
[QEMU_PCI_VGA_IO_HI
].mem
,
2320 OBJECT(vdev
), &vfio_vga_ops
,
2321 &vdev
->vga
.region
[QEMU_PCI_VGA_IO_HI
],
2322 "vfio-vga-io@0x3c0",
2323 QEMU_PCI_VGA_IO_HI_SIZE
);
2325 pci_register_vga(&vdev
->pdev
, &vdev
->vga
.region
[QEMU_PCI_VGA_MEM
].mem
,
2326 &vdev
->vga
.region
[QEMU_PCI_VGA_IO_LO
].mem
,
2327 &vdev
->vga
.region
[QEMU_PCI_VGA_IO_HI
].mem
);
2328 vfio_vga_quirk_setup(vdev
);
2332 static void vfio_unmap_bars(VFIODevice
*vdev
)
2336 for (i
= 0; i
< PCI_ROM_SLOT
; i
++) {
2337 vfio_unmap_bar(vdev
, i
);
2340 if (vdev
->has_vga
) {
2341 vfio_vga_quirk_teardown(vdev
);
2342 pci_unregister_vga(&vdev
->pdev
);
2343 memory_region_destroy(&vdev
->vga
.region
[QEMU_PCI_VGA_MEM
].mem
);
2344 memory_region_destroy(&vdev
->vga
.region
[QEMU_PCI_VGA_IO_LO
].mem
);
2345 memory_region_destroy(&vdev
->vga
.region
[QEMU_PCI_VGA_IO_HI
].mem
);
2352 static uint8_t vfio_std_cap_max_size(PCIDevice
*pdev
, uint8_t pos
)
2354 uint8_t tmp
, next
= 0xff;
2356 for (tmp
= pdev
->config
[PCI_CAPABILITY_LIST
]; tmp
;
2357 tmp
= pdev
->config
[tmp
+ 1]) {
2358 if (tmp
> pos
&& tmp
< next
) {
2366 static void vfio_set_word_bits(uint8_t *buf
, uint16_t val
, uint16_t mask
)
2368 pci_set_word(buf
, (pci_get_word(buf
) & ~mask
) | val
);
2371 static void vfio_add_emulated_word(VFIODevice
*vdev
, int pos
,
2372 uint16_t val
, uint16_t mask
)
2374 vfio_set_word_bits(vdev
->pdev
.config
+ pos
, val
, mask
);
2375 vfio_set_word_bits(vdev
->pdev
.wmask
+ pos
, ~mask
, mask
);
2376 vfio_set_word_bits(vdev
->emulated_config_bits
+ pos
, mask
, mask
);
2379 static void vfio_set_long_bits(uint8_t *buf
, uint32_t val
, uint32_t mask
)
2381 pci_set_long(buf
, (pci_get_long(buf
) & ~mask
) | val
);
2384 static void vfio_add_emulated_long(VFIODevice
*vdev
, int pos
,
2385 uint32_t val
, uint32_t mask
)
2387 vfio_set_long_bits(vdev
->pdev
.config
+ pos
, val
, mask
);
2388 vfio_set_long_bits(vdev
->pdev
.wmask
+ pos
, ~mask
, mask
);
2389 vfio_set_long_bits(vdev
->emulated_config_bits
+ pos
, mask
, mask
);
2392 static int vfio_setup_pcie_cap(VFIODevice
*vdev
, int pos
, uint8_t size
)
2397 flags
= pci_get_word(vdev
->pdev
.config
+ pos
+ PCI_CAP_FLAGS
);
2398 type
= (flags
& PCI_EXP_FLAGS_TYPE
) >> 4;
2400 if (type
!= PCI_EXP_TYPE_ENDPOINT
&&
2401 type
!= PCI_EXP_TYPE_LEG_END
&&
2402 type
!= PCI_EXP_TYPE_RC_END
) {
2404 error_report("vfio: Assignment of PCIe type 0x%x "
2405 "devices is not currently supported", type
);
2409 if (!pci_bus_is_express(vdev
->pdev
.bus
)) {
2411 * Use express capability as-is on PCI bus. It doesn't make much
2412 * sense to even expose, but some drivers (ex. tg3) depend on it
2413 * and guests don't seem to be particular about it. We'll need
2414 * to revist this or force express devices to express buses if we
2415 * ever expose an IOMMU to the guest.
2417 } else if (pci_bus_is_root(vdev
->pdev
.bus
)) {
2419 * On a Root Complex bus Endpoints become Root Complex Integrated
2420 * Endpoints, which changes the type and clears the LNK & LNK2 fields.
2422 if (type
== PCI_EXP_TYPE_ENDPOINT
) {
2423 vfio_add_emulated_word(vdev
, pos
+ PCI_CAP_FLAGS
,
2424 PCI_EXP_TYPE_RC_END
<< 4,
2425 PCI_EXP_FLAGS_TYPE
);
2427 /* Link Capabilities, Status, and Control goes away */
2428 if (size
> PCI_EXP_LNKCTL
) {
2429 vfio_add_emulated_long(vdev
, pos
+ PCI_EXP_LNKCAP
, 0, ~0);
2430 vfio_add_emulated_word(vdev
, pos
+ PCI_EXP_LNKCTL
, 0, ~0);
2431 vfio_add_emulated_word(vdev
, pos
+ PCI_EXP_LNKSTA
, 0, ~0);
2433 #ifndef PCI_EXP_LNKCAP2
2434 #define PCI_EXP_LNKCAP2 44
2436 #ifndef PCI_EXP_LNKSTA2
2437 #define PCI_EXP_LNKSTA2 50
2439 /* Link 2 Capabilities, Status, and Control goes away */
2440 if (size
> PCI_EXP_LNKCAP2
) {
2441 vfio_add_emulated_long(vdev
, pos
+ PCI_EXP_LNKCAP2
, 0, ~0);
2442 vfio_add_emulated_word(vdev
, pos
+ PCI_EXP_LNKCTL2
, 0, ~0);
2443 vfio_add_emulated_word(vdev
, pos
+ PCI_EXP_LNKSTA2
, 0, ~0);
2447 } else if (type
== PCI_EXP_TYPE_LEG_END
) {
2449 * Legacy endpoints don't belong on the root complex. Windows
2450 * seems to be happier with devices if we skip the capability.
2457 * Convert Root Complex Integrated Endpoints to regular endpoints.
2458 * These devices don't support LNK/LNK2 capabilities, so make them up.
2460 if (type
== PCI_EXP_TYPE_RC_END
) {
2461 vfio_add_emulated_word(vdev
, pos
+ PCI_CAP_FLAGS
,
2462 PCI_EXP_TYPE_ENDPOINT
<< 4,
2463 PCI_EXP_FLAGS_TYPE
);
2464 vfio_add_emulated_long(vdev
, pos
+ PCI_EXP_LNKCAP
,
2465 PCI_EXP_LNK_MLW_1
| PCI_EXP_LNK_LS_25
, ~0);
2466 vfio_add_emulated_word(vdev
, pos
+ PCI_EXP_LNKCTL
, 0, ~0);
2469 /* Mark the Link Status bits as emulated to allow virtual negotiation */
2470 vfio_add_emulated_word(vdev
, pos
+ PCI_EXP_LNKSTA
,
2471 pci_get_word(vdev
->pdev
.config
+ pos
+
2473 PCI_EXP_LNKCAP_MLW
| PCI_EXP_LNKCAP_SLS
);
2476 pos
= pci_add_capability(&vdev
->pdev
, PCI_CAP_ID_EXP
, pos
, size
);
2478 vdev
->pdev
.exp
.exp_cap
= pos
;
2484 static int vfio_add_std_cap(VFIODevice
*vdev
, uint8_t pos
)
2486 PCIDevice
*pdev
= &vdev
->pdev
;
2487 uint8_t cap_id
, next
, size
;
2490 cap_id
= pdev
->config
[pos
];
2491 next
= pdev
->config
[pos
+ 1];
2494 * If it becomes important to configure capabilities to their actual
2495 * size, use this as the default when it's something we don't recognize.
2496 * Since QEMU doesn't actually handle many of the config accesses,
2497 * exact size doesn't seem worthwhile.
2499 size
= vfio_std_cap_max_size(pdev
, pos
);
2502 * pci_add_capability always inserts the new capability at the head
2503 * of the chain. Therefore to end up with a chain that matches the
2504 * physical device, we insert from the end by making this recursive.
2505 * This is also why we pre-caclulate size above as cached config space
2506 * will be changed as we unwind the stack.
2509 ret
= vfio_add_std_cap(vdev
, next
);
2514 /* Begin the rebuild, use QEMU emulated list bits */
2515 pdev
->config
[PCI_CAPABILITY_LIST
] = 0;
2516 vdev
->emulated_config_bits
[PCI_CAPABILITY_LIST
] = 0xff;
2517 vdev
->emulated_config_bits
[PCI_STATUS
] |= PCI_STATUS_CAP_LIST
;
2520 /* Use emulated next pointer to allow dropping caps */
2521 pci_set_byte(vdev
->emulated_config_bits
+ pos
+ 1, 0xff);
2524 case PCI_CAP_ID_MSI
:
2525 ret
= vfio_setup_msi(vdev
, pos
);
2527 case PCI_CAP_ID_EXP
:
2528 ret
= vfio_setup_pcie_cap(vdev
, pos
, size
);
2530 case PCI_CAP_ID_MSIX
:
2531 ret
= vfio_setup_msix(vdev
, pos
);
2536 ret
= pci_add_capability(pdev
, cap_id
, pos
, size
);
2541 error_report("vfio: %04x:%02x:%02x.%x Error adding PCI capability "
2542 "0x%x[0x%x]@0x%x: %d", vdev
->host
.domain
,
2543 vdev
->host
.bus
, vdev
->host
.slot
, vdev
->host
.function
,
2544 cap_id
, size
, pos
, ret
);
2551 static int vfio_add_capabilities(VFIODevice
*vdev
)
2553 PCIDevice
*pdev
= &vdev
->pdev
;
2555 if (!(pdev
->config
[PCI_STATUS
] & PCI_STATUS_CAP_LIST
) ||
2556 !pdev
->config
[PCI_CAPABILITY_LIST
]) {
2557 return 0; /* Nothing to add */
2560 return vfio_add_std_cap(vdev
, pdev
->config
[PCI_CAPABILITY_LIST
]);
2563 static int vfio_load_rom(VFIODevice
*vdev
)
2565 uint64_t size
= vdev
->rom_size
;
2567 off_t off
= 0, voff
= vdev
->rom_offset
;
2571 /* If loading ROM from file, pci handles it */
2572 if (vdev
->pdev
.romfile
|| !vdev
->pdev
.rom_bar
|| !size
) {
2576 DPRINTF("%s(%04x:%02x:%02x.%x)\n", __func__
, vdev
->host
.domain
,
2577 vdev
->host
.bus
, vdev
->host
.slot
, vdev
->host
.function
);
2579 snprintf(name
, sizeof(name
), "vfio[%04x:%02x:%02x.%x].rom",
2580 vdev
->host
.domain
, vdev
->host
.bus
, vdev
->host
.slot
,
2581 vdev
->host
.function
);
2582 memory_region_init_ram(&vdev
->pdev
.rom
, OBJECT(vdev
), name
, size
);
2583 ptr
= memory_region_get_ram_ptr(&vdev
->pdev
.rom
);
2584 memset(ptr
, 0xff, size
);
2587 bytes
= pread(vdev
->fd
, ptr
+ off
, size
, voff
+ off
);
2589 break; /* expect that we could get back less than the ROM BAR */
2590 } else if (bytes
> 0) {
2594 if (errno
== EINTR
|| errno
== EAGAIN
) {
2597 error_report("vfio: Error reading device ROM: %m");
2598 memory_region_destroy(&vdev
->pdev
.rom
);
2603 pci_register_bar(&vdev
->pdev
, PCI_ROM_SLOT
, 0, &vdev
->pdev
.rom
);
2604 vdev
->pdev
.has_rom
= true;
2608 static int vfio_connect_container(VFIOGroup
*group
)
2610 VFIOContainer
*container
;
2613 if (group
->container
) {
2617 QLIST_FOREACH(container
, &container_list
, next
) {
2618 if (!ioctl(group
->fd
, VFIO_GROUP_SET_CONTAINER
, &container
->fd
)) {
2619 group
->container
= container
;
2620 QLIST_INSERT_HEAD(&container
->group_list
, group
, container_next
);
2625 fd
= qemu_open("/dev/vfio/vfio", O_RDWR
);
2627 error_report("vfio: failed to open /dev/vfio/vfio: %m");
2631 ret
= ioctl(fd
, VFIO_GET_API_VERSION
);
2632 if (ret
!= VFIO_API_VERSION
) {
2633 error_report("vfio: supported vfio version: %d, "
2634 "reported version: %d", VFIO_API_VERSION
, ret
);
2639 container
= g_malloc0(sizeof(*container
));
2642 if (ioctl(fd
, VFIO_CHECK_EXTENSION
, VFIO_TYPE1_IOMMU
)) {
2643 ret
= ioctl(group
->fd
, VFIO_GROUP_SET_CONTAINER
, &fd
);
2645 error_report("vfio: failed to set group container: %m");
2651 ret
= ioctl(fd
, VFIO_SET_IOMMU
, VFIO_TYPE1_IOMMU
);
2653 error_report("vfio: failed to set iommu for container: %m");
2659 container
->iommu_data
.listener
= vfio_memory_listener
;
2660 container
->iommu_data
.release
= vfio_listener_release
;
2662 memory_listener_register(&container
->iommu_data
.listener
, &address_space_memory
);
2664 error_report("vfio: No available IOMMU models");
2670 QLIST_INIT(&container
->group_list
);
2671 QLIST_INSERT_HEAD(&container_list
, container
, next
);
2673 group
->container
= container
;
2674 QLIST_INSERT_HEAD(&container
->group_list
, group
, container_next
);
2679 static void vfio_disconnect_container(VFIOGroup
*group
)
2681 VFIOContainer
*container
= group
->container
;
2683 if (ioctl(group
->fd
, VFIO_GROUP_UNSET_CONTAINER
, &container
->fd
)) {
2684 error_report("vfio: error disconnecting group %d from container",
2688 QLIST_REMOVE(group
, container_next
);
2689 group
->container
= NULL
;
2691 if (QLIST_EMPTY(&container
->group_list
)) {
2692 if (container
->iommu_data
.release
) {
2693 container
->iommu_data
.release(container
);
2695 QLIST_REMOVE(container
, next
);
2696 DPRINTF("vfio_disconnect_container: close container->fd\n");
2697 close(container
->fd
);
2702 static VFIOGroup
*vfio_get_group(int groupid
)
2706 struct vfio_group_status status
= { .argsz
= sizeof(status
) };
2708 QLIST_FOREACH(group
, &group_list
, next
) {
2709 if (group
->groupid
== groupid
) {
2714 group
= g_malloc0(sizeof(*group
));
2716 snprintf(path
, sizeof(path
), "/dev/vfio/%d", groupid
);
2717 group
->fd
= qemu_open(path
, O_RDWR
);
2718 if (group
->fd
< 0) {
2719 error_report("vfio: error opening %s: %m", path
);
2724 if (ioctl(group
->fd
, VFIO_GROUP_GET_STATUS
, &status
)) {
2725 error_report("vfio: error getting group status: %m");
2731 if (!(status
.flags
& VFIO_GROUP_FLAGS_VIABLE
)) {
2732 error_report("vfio: error, group %d is not viable, please ensure "
2733 "all devices within the iommu_group are bound to their "
2734 "vfio bus driver.", groupid
);
2740 group
->groupid
= groupid
;
2741 QLIST_INIT(&group
->device_list
);
2743 if (vfio_connect_container(group
)) {
2744 error_report("vfio: failed to setup container for group %d", groupid
);
2750 QLIST_INSERT_HEAD(&group_list
, group
, next
);
2755 static void vfio_put_group(VFIOGroup
*group
)
2757 if (!QLIST_EMPTY(&group
->device_list
)) {
2761 vfio_disconnect_container(group
);
2762 QLIST_REMOVE(group
, next
);
2763 DPRINTF("vfio_put_group: close group->fd\n");
2768 static int vfio_get_device(VFIOGroup
*group
, const char *name
, VFIODevice
*vdev
)
2770 struct vfio_device_info dev_info
= { .argsz
= sizeof(dev_info
) };
2771 struct vfio_region_info reg_info
= { .argsz
= sizeof(reg_info
) };
2772 struct vfio_irq_info irq_info
= { .argsz
= sizeof(irq_info
) };
2775 ret
= ioctl(group
->fd
, VFIO_GROUP_GET_DEVICE_FD
, name
);
2777 error_report("vfio: error getting device %s from group %d: %m",
2778 name
, group
->groupid
);
2779 error_printf("Verify all devices in group %d are bound to vfio-pci "
2780 "or pci-stub and not already in use\n", group
->groupid
);
2785 vdev
->group
= group
;
2786 QLIST_INSERT_HEAD(&group
->device_list
, vdev
, next
);
2788 /* Sanity check device */
2789 ret
= ioctl(vdev
->fd
, VFIO_DEVICE_GET_INFO
, &dev_info
);
2791 error_report("vfio: error getting device info: %m");
2795 DPRINTF("Device %s flags: %u, regions: %u, irgs: %u\n", name
,
2796 dev_info
.flags
, dev_info
.num_regions
, dev_info
.num_irqs
);
2798 if (!(dev_info
.flags
& VFIO_DEVICE_FLAGS_PCI
)) {
2799 error_report("vfio: Um, this isn't a PCI device");
2803 vdev
->reset_works
= !!(dev_info
.flags
& VFIO_DEVICE_FLAGS_RESET
);
2804 if (!vdev
->reset_works
) {
2805 error_report("Warning, device %s does not support reset", name
);
2808 if (dev_info
.num_regions
< VFIO_PCI_CONFIG_REGION_INDEX
+ 1) {
2809 error_report("vfio: unexpected number of io regions %u",
2810 dev_info
.num_regions
);
2814 if (dev_info
.num_irqs
< VFIO_PCI_MSIX_IRQ_INDEX
+ 1) {
2815 error_report("vfio: unexpected number of irqs %u", dev_info
.num_irqs
);
2819 for (i
= VFIO_PCI_BAR0_REGION_INDEX
; i
< VFIO_PCI_ROM_REGION_INDEX
; i
++) {
2822 ret
= ioctl(vdev
->fd
, VFIO_DEVICE_GET_REGION_INFO
, ®_info
);
2824 error_report("vfio: Error getting region %d info: %m", i
);
2828 DPRINTF("Device %s region %d:\n", name
, i
);
2829 DPRINTF(" size: 0x%lx, offset: 0x%lx, flags: 0x%lx\n",
2830 (unsigned long)reg_info
.size
, (unsigned long)reg_info
.offset
,
2831 (unsigned long)reg_info
.flags
);
2833 vdev
->bars
[i
].flags
= reg_info
.flags
;
2834 vdev
->bars
[i
].size
= reg_info
.size
;
2835 vdev
->bars
[i
].fd_offset
= reg_info
.offset
;
2836 vdev
->bars
[i
].fd
= vdev
->fd
;
2837 vdev
->bars
[i
].nr
= i
;
2838 QLIST_INIT(&vdev
->bars
[i
].quirks
);
2841 reg_info
.index
= VFIO_PCI_ROM_REGION_INDEX
;
2843 ret
= ioctl(vdev
->fd
, VFIO_DEVICE_GET_REGION_INFO
, ®_info
);
2845 error_report("vfio: Error getting ROM info: %m");
2849 DPRINTF("Device %s ROM:\n", name
);
2850 DPRINTF(" size: 0x%lx, offset: 0x%lx, flags: 0x%lx\n",
2851 (unsigned long)reg_info
.size
, (unsigned long)reg_info
.offset
,
2852 (unsigned long)reg_info
.flags
);
2854 vdev
->rom_size
= reg_info
.size
;
2855 vdev
->rom_offset
= reg_info
.offset
;
2857 reg_info
.index
= VFIO_PCI_CONFIG_REGION_INDEX
;
2859 ret
= ioctl(vdev
->fd
, VFIO_DEVICE_GET_REGION_INFO
, ®_info
);
2861 error_report("vfio: Error getting config info: %m");
2865 DPRINTF("Device %s config:\n", name
);
2866 DPRINTF(" size: 0x%lx, offset: 0x%lx, flags: 0x%lx\n",
2867 (unsigned long)reg_info
.size
, (unsigned long)reg_info
.offset
,
2868 (unsigned long)reg_info
.flags
);
2870 vdev
->config_size
= reg_info
.size
;
2871 if (vdev
->config_size
== PCI_CONFIG_SPACE_SIZE
) {
2872 vdev
->pdev
.cap_present
&= ~QEMU_PCI_CAP_EXPRESS
;
2874 vdev
->config_offset
= reg_info
.offset
;
2876 if ((vdev
->features
& VFIO_FEATURE_ENABLE_VGA
) &&
2877 dev_info
.num_regions
> VFIO_PCI_VGA_REGION_INDEX
) {
2878 struct vfio_region_info vga_info
= {
2879 .argsz
= sizeof(vga_info
),
2880 .index
= VFIO_PCI_VGA_REGION_INDEX
,
2883 ret
= ioctl(vdev
->fd
, VFIO_DEVICE_GET_REGION_INFO
, &vga_info
);
2886 "vfio: Device does not support requested feature x-vga");
2890 if (!(vga_info
.flags
& VFIO_REGION_INFO_FLAG_READ
) ||
2891 !(vga_info
.flags
& VFIO_REGION_INFO_FLAG_WRITE
) ||
2892 vga_info
.size
< 0xbffff + 1) {
2893 error_report("vfio: Unexpected VGA info, flags 0x%lx, size 0x%lx",
2894 (unsigned long)vga_info
.flags
,
2895 (unsigned long)vga_info
.size
);
2899 vdev
->vga
.fd_offset
= vga_info
.offset
;
2900 vdev
->vga
.fd
= vdev
->fd
;
2902 vdev
->vga
.region
[QEMU_PCI_VGA_MEM
].offset
= QEMU_PCI_VGA_MEM_BASE
;
2903 vdev
->vga
.region
[QEMU_PCI_VGA_MEM
].nr
= QEMU_PCI_VGA_MEM
;
2904 QLIST_INIT(&vdev
->vga
.region
[QEMU_PCI_VGA_MEM
].quirks
);
2906 vdev
->vga
.region
[QEMU_PCI_VGA_IO_LO
].offset
= QEMU_PCI_VGA_IO_LO_BASE
;
2907 vdev
->vga
.region
[QEMU_PCI_VGA_IO_LO
].nr
= QEMU_PCI_VGA_IO_LO
;
2908 QLIST_INIT(&vdev
->vga
.region
[QEMU_PCI_VGA_IO_LO
].quirks
);
2910 vdev
->vga
.region
[QEMU_PCI_VGA_IO_HI
].offset
= QEMU_PCI_VGA_IO_HI_BASE
;
2911 vdev
->vga
.region
[QEMU_PCI_VGA_IO_HI
].nr
= QEMU_PCI_VGA_IO_HI
;
2912 QLIST_INIT(&vdev
->vga
.region
[QEMU_PCI_VGA_IO_HI
].quirks
);
2914 vdev
->has_vga
= true;
2916 irq_info
.index
= VFIO_PCI_ERR_IRQ_INDEX
;
2918 ret
= ioctl(vdev
->fd
, VFIO_DEVICE_GET_IRQ_INFO
, &irq_info
);
2920 /* This can fail for an old kernel or legacy PCI dev */
2921 DPRINTF("VFIO_DEVICE_GET_IRQ_INFO failure ret=%d\n", ret
);
2923 } else if (irq_info
.count
== 1) {
2924 vdev
->pci_aer
= true;
2926 error_report("vfio: Warning: "
2927 "Could not enable error recovery for the device\n");
2932 QLIST_REMOVE(vdev
, next
);
2939 static void vfio_put_device(VFIODevice
*vdev
)
2941 QLIST_REMOVE(vdev
, next
);
2943 DPRINTF("vfio_put_device: close vdev->fd\n");
2951 static void vfio_err_notifier_handler(void *opaque
)
2953 VFIODevice
*vdev
= opaque
;
2955 if (!event_notifier_test_and_clear(&vdev
->err_notifier
)) {
2960 * TBD. Retrieve the error details and decide what action
2961 * needs to be taken. One of the actions could be to pass
2962 * the error to the guest and have the guest driver recover
2963 * from the error. This requires that PCIe capabilities be
2964 * exposed to the guest. For now, we just terminate the
2965 * guest to contain the error.
2968 error_report("%s (%04x:%02x:%02x.%x)"
2969 "Unrecoverable error detected...\n"
2970 "Please collect any data possible and then kill the guest",
2971 __func__
, vdev
->host
.domain
, vdev
->host
.bus
,
2972 vdev
->host
.slot
, vdev
->host
.function
);
2974 vm_stop(RUN_STATE_IO_ERROR
);
2978 * Registers error notifier for devices supporting error recovery.
2979 * If we encounter a failure in this function, we report an error
2980 * and continue after disabling error recovery support for the
2983 static void vfio_register_err_notifier(VFIODevice
*vdev
)
2987 struct vfio_irq_set
*irq_set
;
2990 if (!vdev
->pci_aer
) {
2994 if (event_notifier_init(&vdev
->err_notifier
, 0)) {
2995 error_report("vfio: Warning: "
2996 "Unable to init event notifier for error detection\n");
2997 vdev
->pci_aer
= false;
3001 argsz
= sizeof(*irq_set
) + sizeof(*pfd
);
3003 irq_set
= g_malloc0(argsz
);
3004 irq_set
->argsz
= argsz
;
3005 irq_set
->flags
= VFIO_IRQ_SET_DATA_EVENTFD
|
3006 VFIO_IRQ_SET_ACTION_TRIGGER
;
3007 irq_set
->index
= VFIO_PCI_ERR_IRQ_INDEX
;
3010 pfd
= (int32_t *)&irq_set
->data
;
3012 *pfd
= event_notifier_get_fd(&vdev
->err_notifier
);
3013 qemu_set_fd_handler(*pfd
, vfio_err_notifier_handler
, NULL
, vdev
);
3015 ret
= ioctl(vdev
->fd
, VFIO_DEVICE_SET_IRQS
, irq_set
);
3017 error_report("vfio: Failed to set up error notification\n");
3018 qemu_set_fd_handler(*pfd
, NULL
, NULL
, vdev
);
3019 event_notifier_cleanup(&vdev
->err_notifier
);
3020 vdev
->pci_aer
= false;
3025 static void vfio_unregister_err_notifier(VFIODevice
*vdev
)
3028 struct vfio_irq_set
*irq_set
;
3032 if (!vdev
->pci_aer
) {
3036 argsz
= sizeof(*irq_set
) + sizeof(*pfd
);
3038 irq_set
= g_malloc0(argsz
);
3039 irq_set
->argsz
= argsz
;
3040 irq_set
->flags
= VFIO_IRQ_SET_DATA_EVENTFD
|
3041 VFIO_IRQ_SET_ACTION_TRIGGER
;
3042 irq_set
->index
= VFIO_PCI_ERR_IRQ_INDEX
;
3045 pfd
= (int32_t *)&irq_set
->data
;
3048 ret
= ioctl(vdev
->fd
, VFIO_DEVICE_SET_IRQS
, irq_set
);
3050 error_report("vfio: Failed to de-assign error fd: %d\n", ret
);
3053 qemu_set_fd_handler(event_notifier_get_fd(&vdev
->err_notifier
),
3055 event_notifier_cleanup(&vdev
->err_notifier
);
3058 static int vfio_initfn(PCIDevice
*pdev
)
3060 VFIODevice
*pvdev
, *vdev
= DO_UPCAST(VFIODevice
, pdev
, pdev
);
3062 char path
[PATH_MAX
], iommu_group_path
[PATH_MAX
], *group_name
;
3068 /* Check that the host device exists */
3069 snprintf(path
, sizeof(path
),
3070 "/sys/bus/pci/devices/%04x:%02x:%02x.%01x/",
3071 vdev
->host
.domain
, vdev
->host
.bus
, vdev
->host
.slot
,
3072 vdev
->host
.function
);
3073 if (stat(path
, &st
) < 0) {
3074 error_report("vfio: error: no such host device: %s", path
);
3078 strncat(path
, "iommu_group", sizeof(path
) - strlen(path
) - 1);
3080 len
= readlink(path
, iommu_group_path
, PATH_MAX
);
3082 error_report("vfio: error no iommu_group for device");
3086 iommu_group_path
[len
] = 0;
3087 group_name
= basename(iommu_group_path
);
3089 if (sscanf(group_name
, "%d", &groupid
) != 1) {
3090 error_report("vfio: error reading %s: %m", path
);
3094 DPRINTF("%s(%04x:%02x:%02x.%x) group %d\n", __func__
, vdev
->host
.domain
,
3095 vdev
->host
.bus
, vdev
->host
.slot
, vdev
->host
.function
, groupid
);
3097 group
= vfio_get_group(groupid
);
3099 error_report("vfio: failed to get group %d", groupid
);
3103 snprintf(path
, sizeof(path
), "%04x:%02x:%02x.%01x",
3104 vdev
->host
.domain
, vdev
->host
.bus
, vdev
->host
.slot
,
3105 vdev
->host
.function
);
3107 QLIST_FOREACH(pvdev
, &group
->device_list
, next
) {
3108 if (pvdev
->host
.domain
== vdev
->host
.domain
&&
3109 pvdev
->host
.bus
== vdev
->host
.bus
&&
3110 pvdev
->host
.slot
== vdev
->host
.slot
&&
3111 pvdev
->host
.function
== vdev
->host
.function
) {
3113 error_report("vfio: error: device %s is already attached", path
);
3114 vfio_put_group(group
);
3119 ret
= vfio_get_device(group
, path
, vdev
);
3121 error_report("vfio: failed to get device %s", path
);
3122 vfio_put_group(group
);
3126 /* Get a copy of config space */
3127 ret
= pread(vdev
->fd
, vdev
->pdev
.config
,
3128 MIN(pci_config_size(&vdev
->pdev
), vdev
->config_size
),
3129 vdev
->config_offset
);
3130 if (ret
< (int)MIN(pci_config_size(&vdev
->pdev
), vdev
->config_size
)) {
3131 ret
= ret
< 0 ? -errno
: -EFAULT
;
3132 error_report("vfio: Failed to read device config space");
3136 /* vfio emulates a lot for us, but some bits need extra love */
3137 vdev
->emulated_config_bits
= g_malloc0(vdev
->config_size
);
3139 /* QEMU can choose to expose the ROM or not */
3140 memset(vdev
->emulated_config_bits
+ PCI_ROM_ADDRESS
, 0xff, 4);
3142 /* QEMU can change multi-function devices to single function, or reverse */
3143 vdev
->emulated_config_bits
[PCI_HEADER_TYPE
] =
3144 PCI_HEADER_TYPE_MULTI_FUNCTION
;
3147 * Clear host resource mapping info. If we choose not to register a
3148 * BAR, such as might be the case with the option ROM, we can get
3149 * confusing, unwritable, residual addresses from the host here.
3151 memset(&vdev
->pdev
.config
[PCI_BASE_ADDRESS_0
], 0, 24);
3152 memset(&vdev
->pdev
.config
[PCI_ROM_ADDRESS
], 0, 4);
3154 vfio_load_rom(vdev
);
3156 ret
= vfio_early_setup_msix(vdev
);
3161 vfio_map_bars(vdev
);
3163 ret
= vfio_add_capabilities(vdev
);
3168 /* QEMU emulates all of MSI & MSIX */
3169 if (pdev
->cap_present
& QEMU_PCI_CAP_MSIX
) {
3170 memset(vdev
->emulated_config_bits
+ pdev
->msix_cap
, 0xff,
3174 if (pdev
->cap_present
& QEMU_PCI_CAP_MSI
) {
3175 memset(vdev
->emulated_config_bits
+ pdev
->msi_cap
, 0xff,
3176 vdev
->msi_cap_size
);
3179 if (vfio_pci_read_config(&vdev
->pdev
, PCI_INTERRUPT_PIN
, 1)) {
3180 vdev
->intx
.mmap_timer
= timer_new_ms(QEMU_CLOCK_VIRTUAL
,
3181 vfio_intx_mmap_enable
, vdev
);
3182 pci_device_set_intx_routing_notifier(&vdev
->pdev
, vfio_update_irq
);
3183 ret
= vfio_enable_intx(vdev
);
3189 add_boot_device_path(vdev
->bootindex
, &pdev
->qdev
, NULL
);
3190 vfio_register_err_notifier(vdev
);
3195 pci_device_set_intx_routing_notifier(&vdev
->pdev
, NULL
);
3196 vfio_teardown_msi(vdev
);
3197 vfio_unmap_bars(vdev
);
3199 g_free(vdev
->emulated_config_bits
);
3200 vfio_put_device(vdev
);
3201 vfio_put_group(group
);
3205 static void vfio_exitfn(PCIDevice
*pdev
)
3207 VFIODevice
*vdev
= DO_UPCAST(VFIODevice
, pdev
, pdev
);
3208 VFIOGroup
*group
= vdev
->group
;
3210 vfio_unregister_err_notifier(vdev
);
3211 pci_device_set_intx_routing_notifier(&vdev
->pdev
, NULL
);
3212 vfio_disable_interrupts(vdev
);
3213 if (vdev
->intx
.mmap_timer
) {
3214 timer_free(vdev
->intx
.mmap_timer
);
3216 vfio_teardown_msi(vdev
);
3217 vfio_unmap_bars(vdev
);
3218 g_free(vdev
->emulated_config_bits
);
3219 vfio_put_device(vdev
);
3220 vfio_put_group(group
);
3223 static void vfio_pci_reset(DeviceState
*dev
)
3225 PCIDevice
*pdev
= DO_UPCAST(PCIDevice
, qdev
, dev
);
3226 VFIODevice
*vdev
= DO_UPCAST(VFIODevice
, pdev
, pdev
);
3229 DPRINTF("%s(%04x:%02x:%02x.%x)\n", __func__
, vdev
->host
.domain
,
3230 vdev
->host
.bus
, vdev
->host
.slot
, vdev
->host
.function
);
3232 vfio_disable_interrupts(vdev
);
3234 /* Make sure the device is in D0 */
3239 pmcsr
= vfio_pci_read_config(pdev
, vdev
->pm_cap
+ PCI_PM_CTRL
, 2);
3240 state
= pmcsr
& PCI_PM_CTRL_STATE_MASK
;
3242 pmcsr
&= ~PCI_PM_CTRL_STATE_MASK
;
3243 vfio_pci_write_config(pdev
, vdev
->pm_cap
+ PCI_PM_CTRL
, pmcsr
, 2);
3244 /* vfio handles the necessary delay here */
3245 pmcsr
= vfio_pci_read_config(pdev
, vdev
->pm_cap
+ PCI_PM_CTRL
, 2);
3246 state
= pmcsr
& PCI_PM_CTRL_STATE_MASK
;
3248 error_report("vfio: Unable to power on device, stuck in D%d\n",
3255 * Stop any ongoing DMA by disconecting I/O, MMIO, and bus master.
3256 * Also put INTx Disable in known state.
3258 cmd
= vfio_pci_read_config(pdev
, PCI_COMMAND
, 2);
3259 cmd
&= ~(PCI_COMMAND_IO
| PCI_COMMAND_MEMORY
| PCI_COMMAND_MASTER
|
3260 PCI_COMMAND_INTX_DISABLE
);
3261 vfio_pci_write_config(pdev
, PCI_COMMAND
, cmd
, 2);
3263 if (vdev
->reset_works
) {
3264 if (ioctl(vdev
->fd
, VFIO_DEVICE_RESET
)) {
3265 error_report("vfio: Error unable to reset physical device "
3266 "(%04x:%02x:%02x.%x): %m", vdev
->host
.domain
,
3267 vdev
->host
.bus
, vdev
->host
.slot
, vdev
->host
.function
);
3271 vfio_enable_intx(vdev
);
3274 static Property vfio_pci_dev_properties
[] = {
3275 DEFINE_PROP_PCI_HOST_DEVADDR("host", VFIODevice
, host
),
3276 DEFINE_PROP_UINT32("x-intx-mmap-timeout-ms", VFIODevice
,
3277 intx
.mmap_timeout
, 1100),
3278 DEFINE_PROP_BIT("x-vga", VFIODevice
, features
,
3279 VFIO_FEATURE_ENABLE_VGA_BIT
, false),
3280 DEFINE_PROP_INT32("bootindex", VFIODevice
, bootindex
, -1),
3282 * TODO - support passed fds... is this necessary?
3283 * DEFINE_PROP_STRING("vfiofd", VFIODevice, vfiofd_name),
3284 * DEFINE_PROP_STRING("vfiogroupfd, VFIODevice, vfiogroupfd_name),
3286 DEFINE_PROP_END_OF_LIST(),
3289 static const VMStateDescription vfio_pci_vmstate
= {
3294 static void vfio_pci_dev_class_init(ObjectClass
*klass
, void *data
)
3296 DeviceClass
*dc
= DEVICE_CLASS(klass
);
3297 PCIDeviceClass
*pdc
= PCI_DEVICE_CLASS(klass
);
3299 dc
->reset
= vfio_pci_reset
;
3300 dc
->props
= vfio_pci_dev_properties
;
3301 dc
->vmsd
= &vfio_pci_vmstate
;
3302 dc
->desc
= "VFIO-based PCI device assignment";
3303 set_bit(DEVICE_CATEGORY_MISC
, dc
->categories
);
3304 pdc
->init
= vfio_initfn
;
3305 pdc
->exit
= vfio_exitfn
;
3306 pdc
->config_read
= vfio_pci_read_config
;
3307 pdc
->config_write
= vfio_pci_write_config
;
3308 pdc
->is_express
= 1; /* We might be */
3311 static const TypeInfo vfio_pci_dev_info
= {
3313 .parent
= TYPE_PCI_DEVICE
,
3314 .instance_size
= sizeof(VFIODevice
),
3315 .class_init
= vfio_pci_dev_class_init
,
3318 static void register_vfio_pci_dev_type(void)
3320 type_register_static(&vfio_pci_dev_info
);
3323 type_init(register_vfio_pci_dev_type
)