2 * Copyright (c) 2007, Neocleus Corporation.
4 * This work is licensed under the terms of the GNU GPL, version 2. See
5 * the COPYING file in the top-level directory.
8 * Assign a PCI device from the host to a guest VM.
10 * This implementation uses the classic device assignment interface of KVM
11 * and is only available on x86 hosts. It is expected to be obsoleted by VFIO
12 * based device assignment.
14 * Adapted for KVM (qemu-kvm) by Qumranet. QEMU version was based on qemu-kvm
15 * revision 4144fe9d48. See its repository for the history.
17 * Copyright (c) 2007, Neocleus, Alex Novik (alex@neocleus.com)
18 * Copyright (c) 2007, Neocleus, Guy Zana (guy@neocleus.com)
19 * Copyright (C) 2008, Qumranet, Amit Shah (amit.shah@qumranet.com)
20 * Copyright (C) 2008, Red Hat, Amit Shah (amit.shah@redhat.com)
21 * Copyright (C) 2008, IBM, Muli Ben-Yehuda (muli@il.ibm.com)
27 #include <sys/types.h>
30 #include "hw/i386/pc.h"
31 #include "qemu/error-report.h"
32 #include "ui/console.h"
33 #include "hw/loader.h"
34 #include "monitor/monitor.h"
35 #include "qemu/range.h"
36 #include "sysemu/sysemu.h"
37 #include "hw/pci/pci.h"
38 #include "hw/pci/msi.h"
41 #define MSIX_PAGE_SIZE 0x1000
43 /* From linux/ioport.h */
44 #define IORESOURCE_IO 0x00000100 /* Resource type */
45 #define IORESOURCE_MEM 0x00000200
46 #define IORESOURCE_IRQ 0x00000400
47 #define IORESOURCE_DMA 0x00000800
48 #define IORESOURCE_PREFETCH 0x00002000 /* No side effects */
49 #define IORESOURCE_MEM_64 0x00100000
51 //#define DEVICE_ASSIGNMENT_DEBUG
53 #ifdef DEVICE_ASSIGNMENT_DEBUG
54 #define DEBUG(fmt, ...) \
56 fprintf(stderr, "%s: " fmt, __func__ , __VA_ARGS__); \
59 #define DEBUG(fmt, ...)
62 typedef struct PCIRegion {
63 int type; /* Memory or port I/O */
66 uint64_t size; /* size of the region */
70 typedef struct PCIDevRegions {
71 uint8_t bus, dev, func; /* Bus inside domain, device and function */
72 int irq; /* IRQ number */
73 uint16_t region_number; /* number of active regions */
75 /* Port I/O or MMIO Regions */
76 PCIRegion regions[PCI_NUM_REGIONS - 1];
80 typedef struct AssignedDevRegion {
81 MemoryRegion container;
82 MemoryRegion real_iomem;
84 uint8_t *r_virtbase; /* mmapped access address for memory regions */
85 uint32_t r_baseport; /* the base guest port for I/O regions */
87 pcibus_t e_size; /* emulated size of region in bytes */
88 pcibus_t r_size; /* real size of region in bytes */
92 #define ASSIGNED_DEVICE_PREFER_MSI_BIT 0
93 #define ASSIGNED_DEVICE_SHARE_INTX_BIT 1
95 #define ASSIGNED_DEVICE_PREFER_MSI_MASK (1 << ASSIGNED_DEVICE_PREFER_MSI_BIT)
96 #define ASSIGNED_DEVICE_SHARE_INTX_MASK (1 << ASSIGNED_DEVICE_SHARE_INTX_BIT)
98 typedef struct MSIXTableEntry {
105 typedef enum AssignedIRQType {
106 ASSIGNED_IRQ_NONE = 0,
107 ASSIGNED_IRQ_INTX_HOST_INTX,
108 ASSIGNED_IRQ_INTX_HOST_MSI,
113 typedef struct AssignedDevice {
115 PCIHostDeviceAddress host;
119 AssignedDevRegion v_addrs[PCI_NUM_REGIONS - 1];
120 PCIDevRegions real_device;
121 PCIINTxRoute intx_route;
122 AssignedIRQType assigned_irq_type;
124 #define ASSIGNED_DEVICE_CAP_MSI (1 << 0)
125 #define ASSIGNED_DEVICE_CAP_MSIX (1 << 1)
127 #define ASSIGNED_DEVICE_MSI_ENABLED (1 << 0)
128 #define ASSIGNED_DEVICE_MSIX_ENABLED (1 << 1)
129 #define ASSIGNED_DEVICE_MSIX_MASKED (1 << 2)
132 uint8_t emulate_config_read[PCI_CONFIG_SPACE_SIZE];
133 uint8_t emulate_config_write[PCI_CONFIG_SPACE_SIZE];
136 MSIXTableEntry *msix_table;
137 hwaddr msix_table_addr;
144 #define TYPE_PCI_ASSIGN "kvm-pci-assign"
145 #define PCI_ASSIGN(obj) OBJECT_CHECK(AssignedDevice, (obj), TYPE_PCI_ASSIGN)
147 static void assigned_dev_update_irq_routing(PCIDevice *dev);
149 static void assigned_dev_load_option_rom(AssignedDevice *dev);
151 static void assigned_dev_unregister_msix_mmio(AssignedDevice *dev);
153 static uint64_t assigned_dev_ioport_rw(AssignedDevRegion *dev_region,
154 hwaddr addr, int size,
158 int fd = dev_region->region->resource_fd;
161 DEBUG("pwrite data=%" PRIx64 ", size=%d, e_phys=" TARGET_FMT_plx
162 ", addr="TARGET_FMT_plx"\n", *data, size, addr, addr);
163 if (pwrite(fd, data, size, addr) != size) {
164 error_report("%s - pwrite failed %s", __func__, strerror(errno));
167 if (pread(fd, &val, size, addr) != size) {
168 error_report("%s - pread failed %s", __func__, strerror(errno));
169 val = (1UL << (size * 8)) - 1;
171 DEBUG("pread val=%" PRIx64 ", size=%d, e_phys=" TARGET_FMT_plx
172 ", addr=" TARGET_FMT_plx "\n", val, size, addr, addr);
177 static void assigned_dev_ioport_write(void *opaque, hwaddr addr,
178 uint64_t data, unsigned size)
180 assigned_dev_ioport_rw(opaque, addr, size, &data);
183 static uint64_t assigned_dev_ioport_read(void *opaque,
184 hwaddr addr, unsigned size)
186 return assigned_dev_ioport_rw(opaque, addr, size, NULL);
189 static uint32_t slow_bar_readb(void *opaque, hwaddr addr)
191 AssignedDevRegion *d = opaque;
192 uint8_t *in = d->u.r_virtbase + addr;
196 DEBUG("addr=0x" TARGET_FMT_plx " val=0x%08x\n", addr, r);
201 static uint32_t slow_bar_readw(void *opaque, hwaddr addr)
203 AssignedDevRegion *d = opaque;
204 uint16_t *in = (uint16_t *)(d->u.r_virtbase + addr);
208 DEBUG("addr=0x" TARGET_FMT_plx " val=0x%08x\n", addr, r);
213 static uint32_t slow_bar_readl(void *opaque, hwaddr addr)
215 AssignedDevRegion *d = opaque;
216 uint32_t *in = (uint32_t *)(d->u.r_virtbase + addr);
220 DEBUG("addr=0x" TARGET_FMT_plx " val=0x%08x\n", addr, r);
225 static void slow_bar_writeb(void *opaque, hwaddr addr, uint32_t val)
227 AssignedDevRegion *d = opaque;
228 uint8_t *out = d->u.r_virtbase + addr;
230 DEBUG("addr=0x" TARGET_FMT_plx " val=0x%02x\n", addr, val);
234 static void slow_bar_writew(void *opaque, hwaddr addr, uint32_t val)
236 AssignedDevRegion *d = opaque;
237 uint16_t *out = (uint16_t *)(d->u.r_virtbase + addr);
239 DEBUG("addr=0x" TARGET_FMT_plx " val=0x%04x\n", addr, val);
243 static void slow_bar_writel(void *opaque, hwaddr addr, uint32_t val)
245 AssignedDevRegion *d = opaque;
246 uint32_t *out = (uint32_t *)(d->u.r_virtbase + addr);
248 DEBUG("addr=0x" TARGET_FMT_plx " val=0x%08x\n", addr, val);
252 static const MemoryRegionOps slow_bar_ops = {
254 .read = { slow_bar_readb, slow_bar_readw, slow_bar_readl, },
255 .write = { slow_bar_writeb, slow_bar_writew, slow_bar_writel, },
257 .endianness = DEVICE_NATIVE_ENDIAN,
260 static void assigned_dev_iomem_setup(PCIDevice *pci_dev, int region_num,
263 AssignedDevice *r_dev = PCI_ASSIGN(pci_dev);
264 AssignedDevRegion *region = &r_dev->v_addrs[region_num];
265 PCIRegion *real_region = &r_dev->real_device.regions[region_num];
268 memory_region_init(®ion->container, OBJECT(pci_dev),
269 "assigned-dev-container", e_size);
270 memory_region_add_subregion(®ion->container, 0, ®ion->real_iomem);
272 /* deal with MSI-X MMIO page */
273 if (real_region->base_addr <= r_dev->msix_table_addr &&
274 real_region->base_addr + real_region->size >
275 r_dev->msix_table_addr) {
276 uint64_t offset = r_dev->msix_table_addr - real_region->base_addr;
278 memory_region_add_subregion_overlap(®ion->container,
286 static const MemoryRegionOps assigned_dev_ioport_ops = {
287 .read = assigned_dev_ioport_read,
288 .write = assigned_dev_ioport_write,
289 .endianness = DEVICE_NATIVE_ENDIAN,
292 static void assigned_dev_ioport_setup(PCIDevice *pci_dev, int region_num,
295 AssignedDevice *r_dev = PCI_ASSIGN(pci_dev);
296 AssignedDevRegion *region = &r_dev->v_addrs[region_num];
298 region->e_size = size;
299 memory_region_init(®ion->container, OBJECT(pci_dev),
300 "assigned-dev-container", size);
301 memory_region_init_io(®ion->real_iomem, OBJECT(pci_dev),
302 &assigned_dev_ioport_ops, r_dev->v_addrs + region_num,
303 "assigned-dev-iomem", size);
304 memory_region_add_subregion(®ion->container, 0, ®ion->real_iomem);
307 static uint32_t assigned_dev_pci_read(PCIDevice *d, int pos, int len)
309 AssignedDevice *pci_dev = PCI_ASSIGN(d);
312 int fd = pci_dev->real_device.config_fd;
315 ret = pread(fd, &val, len, pos);
317 if ((ret < 0) && (errno == EINTR || errno == EAGAIN)) {
321 hw_error("pci read failed, ret = %zd errno = %d\n", ret, errno);
327 static uint8_t assigned_dev_pci_read_byte(PCIDevice *d, int pos)
329 return (uint8_t)assigned_dev_pci_read(d, pos, 1);
332 static void assigned_dev_pci_write(PCIDevice *d, int pos, uint32_t val, int len)
334 AssignedDevice *pci_dev = PCI_ASSIGN(d);
336 int fd = pci_dev->real_device.config_fd;
339 ret = pwrite(fd, &val, len, pos);
341 if ((ret < 0) && (errno == EINTR || errno == EAGAIN)) {
345 hw_error("pci write failed, ret = %zd errno = %d\n", ret, errno);
349 static void assigned_dev_emulate_config_read(AssignedDevice *dev,
350 uint32_t offset, uint32_t len)
352 memset(dev->emulate_config_read + offset, 0xff, len);
355 static void assigned_dev_direct_config_read(AssignedDevice *dev,
356 uint32_t offset, uint32_t len)
358 memset(dev->emulate_config_read + offset, 0, len);
361 static void assigned_dev_direct_config_write(AssignedDevice *dev,
362 uint32_t offset, uint32_t len)
364 memset(dev->emulate_config_write + offset, 0, len);
367 static uint8_t pci_find_cap_offset(PCIDevice *d, uint8_t cap, uint8_t start)
371 int pos = start ? start : PCI_CAPABILITY_LIST;
374 status = assigned_dev_pci_read_byte(d, PCI_STATUS);
375 if ((status & PCI_STATUS_CAP_LIST) == 0) {
380 pos = assigned_dev_pci_read_byte(d, pos);
386 id = assigned_dev_pci_read_byte(d, pos + PCI_CAP_LIST_ID);
395 pos += PCI_CAP_LIST_NEXT;
400 static void assigned_dev_register_regions(PCIRegion *io_regions,
401 unsigned long regions_num,
402 AssignedDevice *pci_dev,
406 PCIRegion *cur_region = io_regions;
408 for (i = 0; i < regions_num; i++, cur_region++) {
409 if (!cur_region->valid) {
413 /* handle memory io regions */
414 if (cur_region->type & IORESOURCE_MEM) {
415 int t = PCI_BASE_ADDRESS_SPACE_MEMORY;
416 if (cur_region->type & IORESOURCE_PREFETCH) {
417 t |= PCI_BASE_ADDRESS_MEM_PREFETCH;
419 if (cur_region->type & IORESOURCE_MEM_64) {
420 t |= PCI_BASE_ADDRESS_MEM_TYPE_64;
423 /* map physical memory */
424 pci_dev->v_addrs[i].u.r_virtbase = mmap(NULL, cur_region->size,
425 PROT_WRITE | PROT_READ,
427 cur_region->resource_fd,
430 if (pci_dev->v_addrs[i].u.r_virtbase == MAP_FAILED) {
431 pci_dev->v_addrs[i].u.r_virtbase = NULL;
432 error_setg_errno(errp, errno, "Couldn't mmap 0x%" PRIx64 "!",
433 cur_region->base_addr);
437 pci_dev->v_addrs[i].r_size = cur_region->size;
438 pci_dev->v_addrs[i].e_size = 0;
441 pci_dev->v_addrs[i].u.r_virtbase +=
442 (cur_region->base_addr & 0xFFF);
444 if (cur_region->size & 0xFFF) {
445 error_report("PCI region %d at address 0x%" PRIx64 " has "
446 "size 0x%" PRIx64 ", which is not a multiple of "
447 "4K. You might experience some performance hit "
449 i, cur_region->base_addr, cur_region->size);
450 memory_region_init_io(&pci_dev->v_addrs[i].real_iomem,
451 OBJECT(pci_dev), &slow_bar_ops,
452 &pci_dev->v_addrs[i],
453 "assigned-dev-slow-bar",
456 void *virtbase = pci_dev->v_addrs[i].u.r_virtbase;
458 snprintf(name, sizeof(name), "%s.bar%d",
459 object_get_typename(OBJECT(pci_dev)), i);
460 memory_region_init_ram_ptr(&pci_dev->v_addrs[i].real_iomem,
461 OBJECT(pci_dev), name,
462 cur_region->size, virtbase);
463 vmstate_register_ram(&pci_dev->v_addrs[i].real_iomem,
467 assigned_dev_iomem_setup(&pci_dev->dev, i, cur_region->size);
468 pci_register_bar((PCIDevice *) pci_dev, i, t,
469 &pci_dev->v_addrs[i].container);
472 /* handle port io regions */
476 /* Test kernel support for ioport resource read/write. Old
477 * kernels return EIO. New kernels only allow 1/2/4 byte reads
478 * so should return EINVAL for a 3 byte read */
479 ret = pread(pci_dev->v_addrs[i].region->resource_fd, &val, 3, 0);
481 error_report("Unexpected return from I/O port read: %d", ret);
483 } else if (errno != EINVAL) {
484 error_report("Kernel doesn't support ioport resource "
485 "access, hiding this region.");
486 close(pci_dev->v_addrs[i].region->resource_fd);
487 cur_region->valid = 0;
491 pci_dev->v_addrs[i].u.r_baseport = cur_region->base_addr;
492 pci_dev->v_addrs[i].r_size = cur_region->size;
493 pci_dev->v_addrs[i].e_size = 0;
495 assigned_dev_ioport_setup(&pci_dev->dev, i, cur_region->size);
496 pci_register_bar((PCIDevice *) pci_dev, i,
497 PCI_BASE_ADDRESS_SPACE_IO,
498 &pci_dev->v_addrs[i].container);
505 static void get_real_id(const char *devpath, const char *idname, uint16_t *val,
512 snprintf(name, sizeof(name), "%s%s", devpath, idname);
513 f = fopen(name, "r");
515 error_setg_file_open(errp, errno, name);
518 if (fscanf(f, "%li\n", &id) == 1) {
521 error_setg(errp, "Failed to parse contents of '%s'", name);
526 static void get_real_vendor_id(const char *devpath, uint16_t *val,
529 get_real_id(devpath, "vendor", val, errp);
532 static void get_real_device_id(const char *devpath, uint16_t *val,
535 get_real_id(devpath, "device", val, errp);
538 static void get_real_device(AssignedDevice *pci_dev, Error **errp)
540 char dir[128], name[128];
543 uint64_t start, end, size, flags;
546 PCIDevRegions *dev = &pci_dev->real_device;
547 Error *local_err = NULL;
549 dev->region_number = 0;
551 snprintf(dir, sizeof(dir), "/sys/bus/pci/devices/%04x:%02x:%02x.%x/",
552 pci_dev->host.domain, pci_dev->host.bus,
553 pci_dev->host.slot, pci_dev->host.function);
555 snprintf(name, sizeof(name), "%sconfig", dir);
557 if (pci_dev->configfd_name && *pci_dev->configfd_name) {
558 dev->config_fd = monitor_fd_param(cur_mon, pci_dev->configfd_name,
561 error_propagate(errp, local_err);
565 dev->config_fd = open(name, O_RDWR);
567 if (dev->config_fd == -1) {
568 error_setg_file_open(errp, errno, name);
573 r = read(dev->config_fd, pci_dev->dev.config,
574 pci_config_size(&pci_dev->dev));
576 if (errno == EINTR || errno == EAGAIN) {
579 error_setg_errno(errp, errno, "read(\"%s\")",
580 (pci_dev->configfd_name && *pci_dev->configfd_name) ?
581 pci_dev->configfd_name : name);
585 /* Restore or clear multifunction, this is always controlled by qemu */
586 if (pci_dev->dev.cap_present & QEMU_PCI_CAP_MULTIFUNCTION) {
587 pci_dev->dev.config[PCI_HEADER_TYPE] |= PCI_HEADER_TYPE_MULTI_FUNCTION;
589 pci_dev->dev.config[PCI_HEADER_TYPE] &= ~PCI_HEADER_TYPE_MULTI_FUNCTION;
592 /* Clear host resource mapping info. If we choose not to register a
593 * BAR, such as might be the case with the option ROM, we can get
594 * confusing, unwritable, residual addresses from the host here. */
595 memset(&pci_dev->dev.config[PCI_BASE_ADDRESS_0], 0, 24);
596 memset(&pci_dev->dev.config[PCI_ROM_ADDRESS], 0, 4);
598 snprintf(name, sizeof(name), "%sresource", dir);
600 f = fopen(name, "r");
602 error_setg_file_open(errp, errno, name);
606 for (r = 0; r < PCI_ROM_SLOT; r++) {
607 if (fscanf(f, "%" SCNi64 " %" SCNi64 " %" SCNi64 "\n",
608 &start, &end, &flags) != 3) {
612 rp = dev->regions + r;
614 rp->resource_fd = -1;
615 size = end - start + 1;
616 flags &= IORESOURCE_IO | IORESOURCE_MEM | IORESOURCE_PREFETCH
618 if (size == 0 || (flags & ~IORESOURCE_PREFETCH) == 0) {
621 if (flags & IORESOURCE_MEM) {
622 flags &= ~IORESOURCE_IO;
624 flags &= ~IORESOURCE_PREFETCH;
626 snprintf(name, sizeof(name), "%sresource%d", dir, r);
627 fd = open(name, O_RDWR);
631 rp->resource_fd = fd;
635 rp->base_addr = start;
637 pci_dev->v_addrs[r].region = rp;
638 DEBUG("region %d size %" PRIu64 " start 0x%" PRIx64
639 " type %d resource_fd %d\n",
640 r, rp->size, start, rp->type, rp->resource_fd);
645 /* read and fill vendor ID */
646 get_real_vendor_id(dir, &id, &local_err);
648 error_propagate(errp, local_err);
651 pci_dev->dev.config[0] = id & 0xff;
652 pci_dev->dev.config[1] = (id & 0xff00) >> 8;
654 /* read and fill device ID */
655 get_real_device_id(dir, &id, &local_err);
657 error_propagate(errp, local_err);
660 pci_dev->dev.config[2] = id & 0xff;
661 pci_dev->dev.config[3] = (id & 0xff00) >> 8;
663 pci_word_test_and_clear_mask(pci_dev->emulate_config_write + PCI_COMMAND,
664 PCI_COMMAND_MASTER | PCI_COMMAND_INTX_DISABLE);
666 dev->region_number = r;
669 static void free_msi_virqs(AssignedDevice *dev)
673 for (i = 0; i < dev->msi_virq_nr; i++) {
674 if (dev->msi_virq[i] >= 0) {
675 kvm_irqchip_release_virq(kvm_state, dev->msi_virq[i]);
676 dev->msi_virq[i] = -1;
679 g_free(dev->msi_virq);
680 dev->msi_virq = NULL;
681 dev->msi_virq_nr = 0;
684 static void free_assigned_device(AssignedDevice *dev)
688 if (dev->cap.available & ASSIGNED_DEVICE_CAP_MSIX) {
689 assigned_dev_unregister_msix_mmio(dev);
691 for (i = 0; i < dev->real_device.region_number; i++) {
692 PCIRegion *pci_region = &dev->real_device.regions[i];
693 AssignedDevRegion *region = &dev->v_addrs[i];
695 if (!pci_region->valid) {
698 if (pci_region->type & IORESOURCE_IO) {
699 if (region->u.r_baseport) {
700 memory_region_del_subregion(®ion->container,
701 ®ion->real_iomem);
703 } else if (pci_region->type & IORESOURCE_MEM) {
704 if (region->u.r_virtbase) {
705 memory_region_del_subregion(®ion->container,
706 ®ion->real_iomem);
708 /* Remove MSI-X table subregion */
709 if (pci_region->base_addr <= dev->msix_table_addr &&
710 pci_region->base_addr + pci_region->size >
711 dev->msix_table_addr) {
712 memory_region_del_subregion(®ion->container,
715 if (munmap(region->u.r_virtbase,
716 (pci_region->size + 0xFFF) & 0xFFFFF000)) {
717 error_report("Failed to unmap assigned device region: %s",
722 if (pci_region->resource_fd >= 0) {
723 close(pci_region->resource_fd);
727 if (dev->real_device.config_fd >= 0) {
728 close(dev->real_device.config_fd);
734 /* This function tries to determine the cause of the PCI assignment failure. It
735 * always returns the cause as a dynamically allocated, human readable string.
736 * If the function fails to determine the cause for any internal reason, then
737 * the returned string will state that fact.
739 static char *assign_failed_examine(const AssignedDevice *dev)
741 char name[PATH_MAX], dir[PATH_MAX], driver[PATH_MAX] = {}, *ns;
742 uint16_t vendor_id, device_id;
744 Error *local_err = NULL;
746 snprintf(dir, sizeof(dir), "/sys/bus/pci/devices/%04x:%02x:%02x.%01x/",
747 dev->host.domain, dev->host.bus, dev->host.slot,
750 snprintf(name, sizeof(name), "%sdriver", dir);
752 r = readlink(name, driver, sizeof(driver));
753 if ((r <= 0) || r >= sizeof(driver)) {
758 ns = strrchr(driver, '/');
765 if ((get_real_vendor_id(dir, &vendor_id, &local_err), local_err) ||
766 (get_real_device_id(dir, &device_id, &local_err), local_err)) {
767 /* We're already analyzing an assignment error, so we suppress this
768 * one just like the others above.
770 error_free(local_err);
774 return g_strdup_printf(
775 "*** The driver '%s' is occupying your device %04x:%02x:%02x.%x.\n"
777 "*** You can try the following commands to free it:\n"
779 "*** $ echo \"%04x %04x\" > /sys/bus/pci/drivers/pci-stub/new_id\n"
780 "*** $ echo \"%04x:%02x:%02x.%x\" > /sys/bus/pci/drivers/%s/unbind\n"
781 "*** $ echo \"%04x:%02x:%02x.%x\" > /sys/bus/pci/drivers/"
783 "*** $ echo \"%04x %04x\" > /sys/bus/pci/drivers/pci-stub/remove_id\n"
785 ns, dev->host.domain, dev->host.bus, dev->host.slot,
786 dev->host.function, vendor_id, device_id,
787 dev->host.domain, dev->host.bus, dev->host.slot, dev->host.function,
788 ns, dev->host.domain, dev->host.bus, dev->host.slot,
789 dev->host.function, vendor_id, device_id);
792 return g_strdup("Couldn't find out why.");
795 static void assign_device(AssignedDevice *dev, Error **errp)
797 uint32_t flags = KVM_DEV_ASSIGN_ENABLE_IOMMU;
800 /* Only pass non-zero PCI segment to capable module */
801 if (!kvm_check_extension(kvm_state, KVM_CAP_PCI_SEGMENT) &&
803 error_setg(errp, "Can't assign device inside non-zero PCI segment "
804 "as this KVM module doesn't support it.");
808 if (!kvm_check_extension(kvm_state, KVM_CAP_IOMMU)) {
809 error_setg(errp, "No IOMMU found. Unable to assign device \"%s\"",
814 if (dev->features & ASSIGNED_DEVICE_SHARE_INTX_MASK &&
815 kvm_has_intx_set_mask()) {
816 flags |= KVM_DEV_ASSIGN_PCI_2_3;
819 r = kvm_device_pci_assign(kvm_state, &dev->host, flags, &dev->dev_id);
825 cause = assign_failed_examine(dev);
826 error_setg_errno(errp, -r, "Failed to assign device \"%s\"\n%s",
827 dev->dev.qdev.id, cause);
832 error_setg_errno(errp, -r, "Failed to assign device \"%s\"",
839 static void verify_irqchip_in_kernel(Error **errp)
841 if (kvm_irqchip_in_kernel()) {
844 error_setg(errp, "pci-assign requires KVM with in-kernel irqchip enabled");
847 static int assign_intx(AssignedDevice *dev, Error **errp)
849 AssignedIRQType new_type;
850 PCIINTxRoute intx_route;
853 Error *local_err = NULL;
855 /* Interrupt PIN 0 means don't use INTx */
856 if (assigned_dev_pci_read_byte(&dev->dev, PCI_INTERRUPT_PIN) == 0) {
857 pci_device_set_intx_routing_notifier(&dev->dev, NULL);
861 verify_irqchip_in_kernel(&local_err);
863 error_propagate(errp, local_err);
867 pci_device_set_intx_routing_notifier(&dev->dev,
868 assigned_dev_update_irq_routing);
870 intx_route = pci_device_route_intx_to_irq(&dev->dev, dev->intpin);
871 assert(intx_route.mode != PCI_INTX_INVERTED);
873 if (!pci_intx_route_changed(&dev->intx_route, &intx_route)) {
877 switch (dev->assigned_irq_type) {
878 case ASSIGNED_IRQ_INTX_HOST_INTX:
879 case ASSIGNED_IRQ_INTX_HOST_MSI:
880 intx_host_msi = dev->assigned_irq_type == ASSIGNED_IRQ_INTX_HOST_MSI;
881 r = kvm_device_intx_deassign(kvm_state, dev->dev_id, intx_host_msi);
883 case ASSIGNED_IRQ_MSI:
884 r = kvm_device_msi_deassign(kvm_state, dev->dev_id);
886 case ASSIGNED_IRQ_MSIX:
887 r = kvm_device_msix_deassign(kvm_state, dev->dev_id);
894 perror("assign_intx: deassignment of previous interrupt failed");
896 dev->assigned_irq_type = ASSIGNED_IRQ_NONE;
898 if (intx_route.mode == PCI_INTX_DISABLED) {
899 dev->intx_route = intx_route;
904 if (dev->features & ASSIGNED_DEVICE_PREFER_MSI_MASK &&
905 dev->cap.available & ASSIGNED_DEVICE_CAP_MSI) {
906 intx_host_msi = true;
907 new_type = ASSIGNED_IRQ_INTX_HOST_MSI;
909 intx_host_msi = false;
910 new_type = ASSIGNED_IRQ_INTX_HOST_INTX;
913 r = kvm_device_intx_assign(kvm_state, dev->dev_id, intx_host_msi,
916 if (r == -EIO && !(dev->features & ASSIGNED_DEVICE_PREFER_MSI_MASK) &&
917 dev->cap.available & ASSIGNED_DEVICE_CAP_MSI) {
918 /* Retry with host-side MSI. There might be an IRQ conflict and
919 * either the kernel or the device doesn't support sharing. */
920 error_report("Host-side INTx sharing not supported, "
921 "using MSI instead");
922 error_printf("Some devices do not work properly in this mode.\n");
923 dev->features |= ASSIGNED_DEVICE_PREFER_MSI_MASK;
926 error_setg_errno(errp, -r,
927 "Failed to assign irq for \"%s\"\n"
928 "Perhaps you are assigning a device "
929 "that shares an IRQ with another device?",
934 dev->intx_route = intx_route;
935 dev->assigned_irq_type = new_type;
939 static void deassign_device(AssignedDevice *dev)
943 r = kvm_device_pci_deassign(kvm_state, dev->dev_id);
947 /* The pci config space got updated. Check if irq numbers have changed
950 static void assigned_dev_update_irq_routing(PCIDevice *dev)
952 AssignedDevice *assigned_dev = PCI_ASSIGN(dev);
956 r = assign_intx(assigned_dev, &err);
958 error_report_err(err);
960 qdev_unplug(&dev->qdev, &err);
965 static void assigned_dev_update_msi(PCIDevice *pci_dev)
967 AssignedDevice *assigned_dev = PCI_ASSIGN(pci_dev);
968 uint8_t ctrl_byte = pci_get_byte(pci_dev->config + pci_dev->msi_cap +
972 /* Some guests gratuitously disable MSI even if they're not using it,
973 * try to catch this by only deassigning irqs if the guest is using
974 * MSI or intends to start. */
975 if (assigned_dev->assigned_irq_type == ASSIGNED_IRQ_MSI ||
976 (ctrl_byte & PCI_MSI_FLAGS_ENABLE)) {
977 r = kvm_device_msi_deassign(kvm_state, assigned_dev->dev_id);
978 /* -ENXIO means no assigned irq */
979 if (r && r != -ENXIO) {
980 perror("assigned_dev_update_msi: deassign irq");
983 free_msi_virqs(assigned_dev);
985 assigned_dev->assigned_irq_type = ASSIGNED_IRQ_NONE;
986 pci_device_set_intx_routing_notifier(pci_dev, NULL);
989 if (ctrl_byte & PCI_MSI_FLAGS_ENABLE) {
990 MSIMessage msg = msi_get_message(pci_dev, 0);
993 virq = kvm_irqchip_add_msi_route(kvm_state, msg);
995 perror("assigned_dev_update_msi: kvm_irqchip_add_msi_route");
999 assigned_dev->msi_virq = g_malloc(sizeof(*assigned_dev->msi_virq));
1000 assigned_dev->msi_virq_nr = 1;
1001 assigned_dev->msi_virq[0] = virq;
1002 if (kvm_device_msi_assign(kvm_state, assigned_dev->dev_id, virq) < 0) {
1003 perror("assigned_dev_update_msi: kvm_device_msi_assign");
1006 assigned_dev->intx_route.mode = PCI_INTX_DISABLED;
1007 assigned_dev->intx_route.irq = -1;
1008 assigned_dev->assigned_irq_type = ASSIGNED_IRQ_MSI;
1010 Error *local_err = NULL;
1012 assign_intx(assigned_dev, &local_err);
1014 error_report_err(local_err);
1019 static void assigned_dev_update_msi_msg(PCIDevice *pci_dev)
1021 AssignedDevice *assigned_dev = PCI_ASSIGN(pci_dev);
1022 uint8_t ctrl_byte = pci_get_byte(pci_dev->config + pci_dev->msi_cap +
1025 if (assigned_dev->assigned_irq_type != ASSIGNED_IRQ_MSI ||
1026 !(ctrl_byte & PCI_MSI_FLAGS_ENABLE)) {
1030 kvm_irqchip_update_msi_route(kvm_state, assigned_dev->msi_virq[0],
1031 msi_get_message(pci_dev, 0));
1034 static bool assigned_dev_msix_masked(MSIXTableEntry *entry)
1036 return (entry->ctrl & cpu_to_le32(0x1)) != 0;
1040 * When MSI-X is first enabled the vector table typically has all the
1041 * vectors masked, so we can't use that as the obvious test to figure out
1042 * how many vectors to initially enable. Instead we look at the data field
1043 * because this is what worked for pci-assign for a long time. This makes
1044 * sure the physical MSI-X state tracks the guest's view, which is important
1045 * for some VF/PF and PF/fw communication channels.
1047 static bool assigned_dev_msix_skipped(MSIXTableEntry *entry)
1049 return !entry->data;
1052 static int assigned_dev_update_msix_mmio(PCIDevice *pci_dev)
1054 AssignedDevice *adev = PCI_ASSIGN(pci_dev);
1055 uint16_t entries_nr = 0;
1057 MSIXTableEntry *entry = adev->msix_table;
1060 /* Get the usable entry number for allocating */
1061 for (i = 0; i < adev->msix_max; i++, entry++) {
1062 if (assigned_dev_msix_skipped(entry)) {
1068 DEBUG("MSI-X entries: %d\n", entries_nr);
1070 /* It's valid to enable MSI-X with all entries masked */
1075 r = kvm_device_msix_init_vectors(kvm_state, adev->dev_id, entries_nr);
1077 error_report("fail to set MSI-X entry number for MSIX! %s",
1082 free_msi_virqs(adev);
1084 adev->msi_virq_nr = adev->msix_max;
1085 adev->msi_virq = g_malloc(adev->msix_max * sizeof(*adev->msi_virq));
1087 entry = adev->msix_table;
1088 for (i = 0; i < adev->msix_max; i++, entry++) {
1089 adev->msi_virq[i] = -1;
1091 if (assigned_dev_msix_skipped(entry)) {
1095 msg.address = entry->addr_lo | ((uint64_t)entry->addr_hi << 32);
1096 msg.data = entry->data;
1097 r = kvm_irqchip_add_msi_route(kvm_state, msg);
1101 adev->msi_virq[i] = r;
1103 DEBUG("MSI-X vector %d, gsi %d, addr %08x_%08x, data %08x\n", i,
1104 r, entry->addr_hi, entry->addr_lo, entry->data);
1106 r = kvm_device_msix_set_vector(kvm_state, adev->dev_id, i,
1109 error_report("fail to set MSI-X entry! %s", strerror(-r));
1117 static void assigned_dev_update_msix(PCIDevice *pci_dev)
1119 AssignedDevice *assigned_dev = PCI_ASSIGN(pci_dev);
1120 uint16_t ctrl_word = pci_get_word(pci_dev->config + pci_dev->msix_cap +
1124 /* Some guests gratuitously disable MSIX even if they're not using it,
1125 * try to catch this by only deassigning irqs if the guest is using
1126 * MSIX or intends to start. */
1127 if ((assigned_dev->assigned_irq_type == ASSIGNED_IRQ_MSIX) ||
1128 (ctrl_word & PCI_MSIX_FLAGS_ENABLE)) {
1129 r = kvm_device_msix_deassign(kvm_state, assigned_dev->dev_id);
1130 /* -ENXIO means no assigned irq */
1131 if (r && r != -ENXIO) {
1132 perror("assigned_dev_update_msix: deassign irq");
1135 free_msi_virqs(assigned_dev);
1137 assigned_dev->assigned_irq_type = ASSIGNED_IRQ_NONE;
1138 pci_device_set_intx_routing_notifier(pci_dev, NULL);
1141 if (ctrl_word & PCI_MSIX_FLAGS_ENABLE) {
1142 if (assigned_dev_update_msix_mmio(pci_dev) < 0) {
1143 perror("assigned_dev_update_msix_mmio");
1147 if (assigned_dev->msi_virq_nr > 0) {
1148 if (kvm_device_msix_assign(kvm_state, assigned_dev->dev_id) < 0) {
1149 perror("assigned_dev_enable_msix: assign irq");
1153 assigned_dev->intx_route.mode = PCI_INTX_DISABLED;
1154 assigned_dev->intx_route.irq = -1;
1155 assigned_dev->assigned_irq_type = ASSIGNED_IRQ_MSIX;
1157 Error *local_err = NULL;
1159 assign_intx(assigned_dev, &local_err);
1161 error_report_err(local_err);
1166 static uint32_t assigned_dev_pci_read_config(PCIDevice *pci_dev,
1167 uint32_t address, int len)
1169 AssignedDevice *assigned_dev = PCI_ASSIGN(pci_dev);
1170 uint32_t virt_val = pci_default_read_config(pci_dev, address, len);
1171 uint32_t real_val, emulate_mask, full_emulation_mask;
1174 memcpy(&emulate_mask, assigned_dev->emulate_config_read + address, len);
1175 emulate_mask = le32_to_cpu(emulate_mask);
1177 full_emulation_mask = 0xffffffff >> (32 - len * 8);
1179 if (emulate_mask != full_emulation_mask) {
1180 real_val = assigned_dev_pci_read(pci_dev, address, len);
1181 return (virt_val & emulate_mask) | (real_val & ~emulate_mask);
1187 static void assigned_dev_pci_write_config(PCIDevice *pci_dev, uint32_t address,
1188 uint32_t val, int len)
1190 AssignedDevice *assigned_dev = PCI_ASSIGN(pci_dev);
1191 uint16_t old_cmd = pci_get_word(pci_dev->config + PCI_COMMAND);
1192 uint32_t emulate_mask, full_emulation_mask;
1195 pci_default_write_config(pci_dev, address, val, len);
1197 if (kvm_has_intx_set_mask() &&
1198 range_covers_byte(address, len, PCI_COMMAND + 1)) {
1199 bool intx_masked = (pci_get_word(pci_dev->config + PCI_COMMAND) &
1200 PCI_COMMAND_INTX_DISABLE);
1202 if (intx_masked != !!(old_cmd & PCI_COMMAND_INTX_DISABLE)) {
1203 ret = kvm_device_intx_set_mask(kvm_state, assigned_dev->dev_id,
1206 perror("assigned_dev_pci_write_config: set intx mask");
1210 if (assigned_dev->cap.available & ASSIGNED_DEVICE_CAP_MSI) {
1211 if (range_covers_byte(address, len,
1212 pci_dev->msi_cap + PCI_MSI_FLAGS)) {
1213 assigned_dev_update_msi(pci_dev);
1214 } else if (ranges_overlap(address, len, /* 32bit MSI only */
1215 pci_dev->msi_cap + PCI_MSI_ADDRESS_LO, 6)) {
1216 assigned_dev_update_msi_msg(pci_dev);
1219 if (assigned_dev->cap.available & ASSIGNED_DEVICE_CAP_MSIX) {
1220 if (range_covers_byte(address, len,
1221 pci_dev->msix_cap + PCI_MSIX_FLAGS + 1)) {
1222 assigned_dev_update_msix(pci_dev);
1227 memcpy(&emulate_mask, assigned_dev->emulate_config_write + address, len);
1228 emulate_mask = le32_to_cpu(emulate_mask);
1230 full_emulation_mask = 0xffffffff >> (32 - len * 8);
1232 if (emulate_mask != full_emulation_mask) {
1234 val &= ~emulate_mask;
1235 val |= assigned_dev_pci_read(pci_dev, address, len) & emulate_mask;
1237 assigned_dev_pci_write(pci_dev, address, val, len);
1241 static void assigned_dev_setup_cap_read(AssignedDevice *dev, uint32_t offset,
1244 assigned_dev_direct_config_read(dev, offset, len);
1245 assigned_dev_emulate_config_read(dev, offset + PCI_CAP_LIST_NEXT, 1);
1248 static int assigned_device_pci_cap_init(PCIDevice *pci_dev, Error **errp)
1250 AssignedDevice *dev = PCI_ASSIGN(pci_dev);
1251 PCIRegion *pci_region = dev->real_device.regions;
1253 Error *local_err = NULL;
1255 /* Clear initial capabilities pointer and status copied from hw */
1256 pci_set_byte(pci_dev->config + PCI_CAPABILITY_LIST, 0);
1257 pci_set_word(pci_dev->config + PCI_STATUS,
1258 pci_get_word(pci_dev->config + PCI_STATUS) &
1259 ~PCI_STATUS_CAP_LIST);
1261 /* Expose MSI capability
1262 * MSI capability is the 1st capability in capability config */
1263 pos = pci_find_cap_offset(pci_dev, PCI_CAP_ID_MSI, 0);
1264 if (pos != 0 && kvm_check_extension(kvm_state, KVM_CAP_ASSIGN_DEV_IRQ)) {
1265 verify_irqchip_in_kernel(&local_err);
1267 error_propagate(errp, local_err);
1270 dev->cap.available |= ASSIGNED_DEVICE_CAP_MSI;
1271 /* Only 32-bit/no-mask currently supported */
1272 ret = pci_add_capability2(pci_dev, PCI_CAP_ID_MSI, pos, 10,
1275 error_propagate(errp, local_err);
1278 pci_dev->msi_cap = pos;
1280 pci_set_word(pci_dev->config + pos + PCI_MSI_FLAGS,
1281 pci_get_word(pci_dev->config + pos + PCI_MSI_FLAGS) &
1282 PCI_MSI_FLAGS_QMASK);
1283 pci_set_long(pci_dev->config + pos + PCI_MSI_ADDRESS_LO, 0);
1284 pci_set_word(pci_dev->config + pos + PCI_MSI_DATA_32, 0);
1286 /* Set writable fields */
1287 pci_set_word(pci_dev->wmask + pos + PCI_MSI_FLAGS,
1288 PCI_MSI_FLAGS_QSIZE | PCI_MSI_FLAGS_ENABLE);
1289 pci_set_long(pci_dev->wmask + pos + PCI_MSI_ADDRESS_LO, 0xfffffffc);
1290 pci_set_word(pci_dev->wmask + pos + PCI_MSI_DATA_32, 0xffff);
1292 /* Expose MSI-X capability */
1293 pos = pci_find_cap_offset(pci_dev, PCI_CAP_ID_MSIX, 0);
1294 if (pos != 0 && kvm_device_msix_supported(kvm_state)) {
1296 uint32_t msix_table_entry;
1299 verify_irqchip_in_kernel(&local_err);
1301 error_propagate(errp, local_err);
1304 dev->cap.available |= ASSIGNED_DEVICE_CAP_MSIX;
1305 ret = pci_add_capability2(pci_dev, PCI_CAP_ID_MSIX, pos, 12,
1308 error_propagate(errp, local_err);
1311 pci_dev->msix_cap = pos;
1313 msix_max = (pci_get_word(pci_dev->config + pos + PCI_MSIX_FLAGS) &
1314 PCI_MSIX_FLAGS_QSIZE) + 1;
1315 msix_max = MIN(msix_max, KVM_MAX_MSIX_PER_DEV);
1316 pci_set_word(pci_dev->config + pos + PCI_MSIX_FLAGS, msix_max - 1);
1318 /* Only enable and function mask bits are writable */
1319 pci_set_word(pci_dev->wmask + pos + PCI_MSIX_FLAGS,
1320 PCI_MSIX_FLAGS_ENABLE | PCI_MSIX_FLAGS_MASKALL);
1322 msix_table_entry = pci_get_long(pci_dev->config + pos + PCI_MSIX_TABLE);
1323 bar_nr = msix_table_entry & PCI_MSIX_FLAGS_BIRMASK;
1324 msix_table_entry &= ~PCI_MSIX_FLAGS_BIRMASK;
1325 dev->msix_table_addr = pci_region[bar_nr].base_addr + msix_table_entry;
1326 dev->msix_max = msix_max;
1329 /* Minimal PM support, nothing writable, device appears to NAK changes */
1330 pos = pci_find_cap_offset(pci_dev, PCI_CAP_ID_PM, 0);
1334 ret = pci_add_capability2(pci_dev, PCI_CAP_ID_PM, pos, PCI_PM_SIZEOF,
1337 error_propagate(errp, local_err);
1341 assigned_dev_setup_cap_read(dev, pos, PCI_PM_SIZEOF);
1343 pmc = pci_get_word(pci_dev->config + pos + PCI_CAP_FLAGS);
1344 pmc &= (PCI_PM_CAP_VER_MASK | PCI_PM_CAP_DSI);
1345 pci_set_word(pci_dev->config + pos + PCI_CAP_FLAGS, pmc);
1347 /* assign_device will bring the device up to D0, so we don't need
1348 * to worry about doing that ourselves here. */
1349 pci_set_word(pci_dev->config + pos + PCI_PM_CTRL,
1350 PCI_PM_CTRL_NO_SOFT_RESET);
1352 pci_set_byte(pci_dev->config + pos + PCI_PM_PPB_EXTENSIONS, 0);
1353 pci_set_byte(pci_dev->config + pos + PCI_PM_DATA_REGISTER, 0);
1356 pos = pci_find_cap_offset(pci_dev, PCI_CAP_ID_EXP, 0);
1358 uint8_t version, size = 0;
1359 uint16_t type, devctl, lnksta;
1360 uint32_t devcap, lnkcap;
1362 version = pci_get_byte(pci_dev->config + pos + PCI_EXP_FLAGS);
1363 version &= PCI_EXP_FLAGS_VERS;
1366 } else if (version == 2) {
1368 * Check for non-std size, accept reduced size to 0x34,
1369 * which is what bcm5761 implemented, violating the
1370 * PCIe v3.0 spec that regs should exist and be read as 0,
1371 * not optionally provided and shorten the struct size.
1373 size = MIN(0x3c, PCI_CONFIG_SPACE_SIZE - pos);
1375 error_setg(errp, "Invalid size PCIe cap-id 0x%x",
1378 } else if (size != 0x3c) {
1379 error_report("WARNING, %s: PCIe cap-id 0x%x has "
1380 "non-standard size 0x%x; std size should be 0x3c",
1381 __func__, PCI_CAP_ID_EXP, size);
1383 } else if (version == 0) {
1385 vid = pci_get_word(pci_dev->config + PCI_VENDOR_ID);
1386 did = pci_get_word(pci_dev->config + PCI_DEVICE_ID);
1387 if (vid == PCI_VENDOR_ID_INTEL && did == 0x10ed) {
1389 * quirk for Intel 82599 VF with invalid PCIe capability
1390 * version, should really be version 2 (same as PF)
1397 error_setg(errp, "Unsupported PCI express capability version %d",
1402 ret = pci_add_capability2(pci_dev, PCI_CAP_ID_EXP, pos, size,
1405 error_propagate(errp, local_err);
1409 assigned_dev_setup_cap_read(dev, pos, size);
1411 type = pci_get_word(pci_dev->config + pos + PCI_EXP_FLAGS);
1412 type = (type & PCI_EXP_FLAGS_TYPE) >> 4;
1413 if (type != PCI_EXP_TYPE_ENDPOINT &&
1414 type != PCI_EXP_TYPE_LEG_END && type != PCI_EXP_TYPE_RC_END) {
1415 error_setg(errp, "Device assignment only supports endpoint "
1416 "assignment, device type %d", type);
1420 /* capabilities, pass existing read-only copy
1421 * PCI_EXP_FLAGS_IRQ: updated by hardware, should be direct read */
1423 /* device capabilities: hide FLR */
1424 devcap = pci_get_long(pci_dev->config + pos + PCI_EXP_DEVCAP);
1425 devcap &= ~PCI_EXP_DEVCAP_FLR;
1426 pci_set_long(pci_dev->config + pos + PCI_EXP_DEVCAP, devcap);
1428 /* device control: clear all error reporting enable bits, leaving
1429 * only a few host values. Note, these are
1430 * all writable, but not passed to hw.
1432 devctl = pci_get_word(pci_dev->config + pos + PCI_EXP_DEVCTL);
1433 devctl = (devctl & (PCI_EXP_DEVCTL_READRQ | PCI_EXP_DEVCTL_PAYLOAD)) |
1434 PCI_EXP_DEVCTL_RELAX_EN | PCI_EXP_DEVCTL_NOSNOOP_EN;
1435 pci_set_word(pci_dev->config + pos + PCI_EXP_DEVCTL, devctl);
1436 devctl = PCI_EXP_DEVCTL_BCR_FLR | PCI_EXP_DEVCTL_AUX_PME;
1437 pci_set_word(pci_dev->wmask + pos + PCI_EXP_DEVCTL, ~devctl);
1439 /* Clear device status */
1440 pci_set_word(pci_dev->config + pos + PCI_EXP_DEVSTA, 0);
1442 /* Link capabilities, expose links and latencues, clear reporting */
1443 lnkcap = pci_get_long(pci_dev->config + pos + PCI_EXP_LNKCAP);
1444 lnkcap &= (PCI_EXP_LNKCAP_SLS | PCI_EXP_LNKCAP_MLW |
1445 PCI_EXP_LNKCAP_ASPMS | PCI_EXP_LNKCAP_L0SEL |
1446 PCI_EXP_LNKCAP_L1EL);
1447 pci_set_long(pci_dev->config + pos + PCI_EXP_LNKCAP, lnkcap);
1449 /* Link control, pass existing read-only copy. Should be writable? */
1451 /* Link status, only expose current speed and width */
1452 lnksta = pci_get_word(pci_dev->config + pos + PCI_EXP_LNKSTA);
1453 lnksta &= (PCI_EXP_LNKSTA_CLS | PCI_EXP_LNKSTA_NLW);
1454 pci_set_word(pci_dev->config + pos + PCI_EXP_LNKSTA, lnksta);
1457 /* Slot capabilities, control, status - not needed for endpoints */
1458 pci_set_long(pci_dev->config + pos + PCI_EXP_SLTCAP, 0);
1459 pci_set_word(pci_dev->config + pos + PCI_EXP_SLTCTL, 0);
1460 pci_set_word(pci_dev->config + pos + PCI_EXP_SLTSTA, 0);
1462 /* Root control, capabilities, status - not needed for endpoints */
1463 pci_set_word(pci_dev->config + pos + PCI_EXP_RTCTL, 0);
1464 pci_set_word(pci_dev->config + pos + PCI_EXP_RTCAP, 0);
1465 pci_set_long(pci_dev->config + pos + PCI_EXP_RTSTA, 0);
1467 /* Device capabilities/control 2, pass existing read-only copy */
1468 /* Link control 2, pass existing read-only copy */
1472 pos = pci_find_cap_offset(pci_dev, PCI_CAP_ID_PCIX, 0);
1477 /* Only expose the minimum, 8 byte capability */
1478 ret = pci_add_capability2(pci_dev, PCI_CAP_ID_PCIX, pos, 8,
1481 error_propagate(errp, local_err);
1485 assigned_dev_setup_cap_read(dev, pos, 8);
1487 /* Command register, clear upper bits, including extended modes */
1488 cmd = pci_get_word(pci_dev->config + pos + PCI_X_CMD);
1489 cmd &= (PCI_X_CMD_DPERR_E | PCI_X_CMD_ERO | PCI_X_CMD_MAX_READ |
1490 PCI_X_CMD_MAX_SPLIT);
1491 pci_set_word(pci_dev->config + pos + PCI_X_CMD, cmd);
1493 /* Status register, update with emulated PCI bus location, clear
1494 * error bits, leave the rest. */
1495 status = pci_get_long(pci_dev->config + pos + PCI_X_STATUS);
1496 status &= ~(PCI_X_STATUS_BUS | PCI_X_STATUS_DEVFN);
1497 status |= (pci_bus_num(pci_dev->bus) << 8) | pci_dev->devfn;
1498 status &= ~(PCI_X_STATUS_SPL_DISC | PCI_X_STATUS_UNX_SPL |
1499 PCI_X_STATUS_SPL_ERR);
1500 pci_set_long(pci_dev->config + pos + PCI_X_STATUS, status);
1503 pos = pci_find_cap_offset(pci_dev, PCI_CAP_ID_VPD, 0);
1505 /* Direct R/W passthrough */
1506 ret = pci_add_capability2(pci_dev, PCI_CAP_ID_VPD, pos, 8,
1509 error_propagate(errp, local_err);
1513 assigned_dev_setup_cap_read(dev, pos, 8);
1515 /* direct write for cap content */
1516 assigned_dev_direct_config_write(dev, pos + 2, 6);
1519 /* Devices can have multiple vendor capabilities, get them all */
1520 for (pos = 0; (pos = pci_find_cap_offset(pci_dev, PCI_CAP_ID_VNDR, pos));
1521 pos += PCI_CAP_LIST_NEXT) {
1522 uint8_t len = pci_get_byte(pci_dev->config + pos + PCI_CAP_FLAGS);
1523 /* Direct R/W passthrough */
1524 ret = pci_add_capability2(pci_dev, PCI_CAP_ID_VNDR, pos, len,
1527 error_propagate(errp, local_err);
1531 assigned_dev_setup_cap_read(dev, pos, len);
1533 /* direct write for cap content */
1534 assigned_dev_direct_config_write(dev, pos + 2, len - 2);
1537 /* If real and virtual capability list status bits differ, virtualize the
1539 if ((pci_get_word(pci_dev->config + PCI_STATUS) & PCI_STATUS_CAP_LIST) !=
1540 (assigned_dev_pci_read_byte(pci_dev, PCI_STATUS) &
1541 PCI_STATUS_CAP_LIST)) {
1542 dev->emulate_config_read[PCI_STATUS] |= PCI_STATUS_CAP_LIST;
1549 assigned_dev_msix_mmio_read(void *opaque, hwaddr addr,
1552 AssignedDevice *adev = opaque;
1555 memcpy(&val, (void *)((uint8_t *)adev->msix_table + addr), size);
1560 static void assigned_dev_msix_mmio_write(void *opaque, hwaddr addr,
1561 uint64_t val, unsigned size)
1563 AssignedDevice *adev = opaque;
1564 PCIDevice *pdev = &adev->dev;
1566 MSIXTableEntry orig;
1569 if (i >= adev->msix_max) {
1570 return; /* Drop write */
1573 ctrl = pci_get_word(pdev->config + pdev->msix_cap + PCI_MSIX_FLAGS);
1575 DEBUG("write to MSI-X table offset 0x%lx, val 0x%lx\n", addr, val);
1577 if (ctrl & PCI_MSIX_FLAGS_ENABLE) {
1578 orig = adev->msix_table[i];
1581 memcpy((uint8_t *)adev->msix_table + addr, &val, size);
1583 if (ctrl & PCI_MSIX_FLAGS_ENABLE) {
1584 MSIXTableEntry *entry = &adev->msix_table[i];
1586 if (!assigned_dev_msix_masked(&orig) &&
1587 assigned_dev_msix_masked(entry)) {
1589 * Vector masked, disable it
1591 * XXX It's not clear if we can or should actually attempt
1592 * to mask or disable the interrupt. KVM doesn't have
1593 * support for pending bits and kvm_assign_set_msix_entry
1594 * doesn't modify the device hardware mask. Interrupts
1595 * while masked are simply not injected to the guest, so
1596 * are lost. Can we get away with always injecting an
1597 * interrupt on unmask?
1599 } else if (assigned_dev_msix_masked(&orig) &&
1600 !assigned_dev_msix_masked(entry)) {
1601 /* Vector unmasked */
1602 if (i >= adev->msi_virq_nr || adev->msi_virq[i] < 0) {
1603 /* Previously unassigned vector, start from scratch */
1604 assigned_dev_update_msix(pdev);
1607 /* Update an existing, previously masked vector */
1611 msg.address = entry->addr_lo |
1612 ((uint64_t)entry->addr_hi << 32);
1613 msg.data = entry->data;
1615 ret = kvm_irqchip_update_msi_route(kvm_state,
1616 adev->msi_virq[i], msg);
1618 error_report("Error updating irq routing entry (%d)", ret);
1625 static const MemoryRegionOps assigned_dev_msix_mmio_ops = {
1626 .read = assigned_dev_msix_mmio_read,
1627 .write = assigned_dev_msix_mmio_write,
1628 .endianness = DEVICE_NATIVE_ENDIAN,
1630 .min_access_size = 4,
1631 .max_access_size = 8,
1634 .min_access_size = 4,
1635 .max_access_size = 8,
1639 static void assigned_dev_msix_reset(AssignedDevice *dev)
1641 MSIXTableEntry *entry;
1644 if (!dev->msix_table) {
1648 memset(dev->msix_table, 0, MSIX_PAGE_SIZE);
1650 for (i = 0, entry = dev->msix_table; i < dev->msix_max; i++, entry++) {
1651 entry->ctrl = cpu_to_le32(0x1); /* Masked */
1655 static void assigned_dev_register_msix_mmio(AssignedDevice *dev, Error **errp)
1657 dev->msix_table = mmap(NULL, MSIX_PAGE_SIZE, PROT_READ|PROT_WRITE,
1658 MAP_ANONYMOUS|MAP_PRIVATE, 0, 0);
1659 if (dev->msix_table == MAP_FAILED) {
1660 error_setg_errno(errp, errno, "failed to allocate msix_table");
1661 dev->msix_table = NULL;
1665 assigned_dev_msix_reset(dev);
1667 memory_region_init_io(&dev->mmio, OBJECT(dev), &assigned_dev_msix_mmio_ops,
1668 dev, "assigned-dev-msix", MSIX_PAGE_SIZE);
1671 static void assigned_dev_unregister_msix_mmio(AssignedDevice *dev)
1673 if (!dev->msix_table) {
1677 if (munmap(dev->msix_table, MSIX_PAGE_SIZE) == -1) {
1678 error_report("error unmapping msix_table! %s", strerror(errno));
1680 dev->msix_table = NULL;
1683 static const VMStateDescription vmstate_assigned_device = {
1684 .name = "pci-assign",
1688 static void reset_assigned_device(DeviceState *dev)
1690 PCIDevice *pci_dev = PCI_DEVICE(dev);
1691 AssignedDevice *adev = PCI_ASSIGN(pci_dev);
1692 char reset_file[64];
1693 const char reset[] = "1";
1697 * If a guest is reset without being shutdown, MSI/MSI-X can still
1698 * be running. We want to return the device to a known state on
1699 * reset, so disable those here. We especially do not want MSI-X
1700 * enabled since it lives in MMIO space, which is about to get
1703 if (adev->assigned_irq_type == ASSIGNED_IRQ_MSIX) {
1704 uint16_t ctrl = pci_get_word(pci_dev->config +
1705 pci_dev->msix_cap + PCI_MSIX_FLAGS);
1707 pci_set_word(pci_dev->config + pci_dev->msix_cap + PCI_MSIX_FLAGS,
1708 ctrl & ~PCI_MSIX_FLAGS_ENABLE);
1709 assigned_dev_update_msix(pci_dev);
1710 } else if (adev->assigned_irq_type == ASSIGNED_IRQ_MSI) {
1711 uint8_t ctrl = pci_get_byte(pci_dev->config +
1712 pci_dev->msi_cap + PCI_MSI_FLAGS);
1714 pci_set_byte(pci_dev->config + pci_dev->msi_cap + PCI_MSI_FLAGS,
1715 ctrl & ~PCI_MSI_FLAGS_ENABLE);
1716 assigned_dev_update_msi(pci_dev);
1719 snprintf(reset_file, sizeof(reset_file),
1720 "/sys/bus/pci/devices/%04x:%02x:%02x.%01x/reset",
1721 adev->host.domain, adev->host.bus, adev->host.slot,
1722 adev->host.function);
1725 * Issue a device reset via pci-sysfs. Note that we use write(2) here
1726 * and ignore the return value because some kernels have a bug that
1727 * returns 0 rather than bytes written on success, sending us into an
1728 * infinite retry loop using other write mechanisms.
1730 fd = open(reset_file, O_WRONLY);
1732 ret = write(fd, reset, strlen(reset));
1738 * When a 0 is written to the bus master register, the device is logically
1739 * disconnected from the PCI bus. This avoids further DMA transfers.
1741 assigned_dev_pci_write_config(pci_dev, PCI_COMMAND, 0, 1);
1744 static void assigned_realize(struct PCIDevice *pci_dev, Error **errp)
1746 AssignedDevice *dev = PCI_ASSIGN(pci_dev);
1749 Error *local_err = NULL;
1751 if (!kvm_enabled()) {
1752 error_setg(&local_err, "pci-assign requires KVM support");
1753 goto exit_with_error;
1756 if (!dev->host.domain && !dev->host.bus && !dev->host.slot &&
1757 !dev->host.function) {
1758 error_setg(&local_err, "no host device specified");
1759 goto exit_with_error;
1763 * Set up basic config space access control. Will be further refined during
1764 * device initialization.
1766 assigned_dev_emulate_config_read(dev, 0, PCI_CONFIG_SPACE_SIZE);
1767 assigned_dev_direct_config_read(dev, PCI_STATUS, 2);
1768 assigned_dev_direct_config_read(dev, PCI_REVISION_ID, 1);
1769 assigned_dev_direct_config_read(dev, PCI_CLASS_PROG, 3);
1770 assigned_dev_direct_config_read(dev, PCI_CACHE_LINE_SIZE, 1);
1771 assigned_dev_direct_config_read(dev, PCI_LATENCY_TIMER, 1);
1772 assigned_dev_direct_config_read(dev, PCI_BIST, 1);
1773 assigned_dev_direct_config_read(dev, PCI_CARDBUS_CIS, 4);
1774 assigned_dev_direct_config_read(dev, PCI_SUBSYSTEM_VENDOR_ID, 2);
1775 assigned_dev_direct_config_read(dev, PCI_SUBSYSTEM_ID, 2);
1776 assigned_dev_direct_config_read(dev, PCI_CAPABILITY_LIST + 1, 7);
1777 assigned_dev_direct_config_read(dev, PCI_MIN_GNT, 1);
1778 assigned_dev_direct_config_read(dev, PCI_MAX_LAT, 1);
1779 memcpy(dev->emulate_config_write, dev->emulate_config_read,
1780 sizeof(dev->emulate_config_read));
1782 get_real_device(dev, &local_err);
1787 if (assigned_device_pci_cap_init(pci_dev, &local_err) < 0) {
1791 /* intercept MSI-X entry page in the MMIO */
1792 if (dev->cap.available & ASSIGNED_DEVICE_CAP_MSIX) {
1793 assigned_dev_register_msix_mmio(dev, &local_err);
1799 /* handle real device's MMIO/PIO BARs */
1800 assigned_dev_register_regions(dev->real_device.regions,
1801 dev->real_device.region_number, dev,
1807 /* handle interrupt routing */
1808 e_intx = dev->dev.config[PCI_INTERRUPT_PIN] - 1;
1809 dev->intpin = e_intx;
1810 dev->intx_route.mode = PCI_INTX_DISABLED;
1811 dev->intx_route.irq = -1;
1813 /* assign device to guest */
1814 assign_device(dev, &local_err);
1819 /* assign legacy INTx to the device */
1820 r = assign_intx(dev, &local_err);
1825 assigned_dev_load_option_rom(dev);
1830 deassign_device(dev);
1833 free_assigned_device(dev);
1837 error_propagate(errp, local_err);
1840 static void assigned_exitfn(struct PCIDevice *pci_dev)
1842 AssignedDevice *dev = PCI_ASSIGN(pci_dev);
1844 deassign_device(dev);
1845 free_assigned_device(dev);
1848 static void assigned_dev_instance_init(Object *obj)
1850 PCIDevice *pci_dev = PCI_DEVICE(obj);
1851 AssignedDevice *d = PCI_ASSIGN(pci_dev);
1853 device_add_bootindex_property(obj, &d->bootindex,
1855 &pci_dev->qdev, NULL);
1858 static Property assigned_dev_properties[] = {
1859 DEFINE_PROP_PCI_HOST_DEVADDR("host", AssignedDevice, host),
1860 DEFINE_PROP_BIT("prefer_msi", AssignedDevice, features,
1861 ASSIGNED_DEVICE_PREFER_MSI_BIT, false),
1862 DEFINE_PROP_BIT("share_intx", AssignedDevice, features,
1863 ASSIGNED_DEVICE_SHARE_INTX_BIT, true),
1864 DEFINE_PROP_STRING("configfd", AssignedDevice, configfd_name),
1865 DEFINE_PROP_END_OF_LIST(),
1868 static void assign_class_init(ObjectClass *klass, void *data)
1870 PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
1871 DeviceClass *dc = DEVICE_CLASS(klass);
1873 k->realize = assigned_realize;
1874 k->exit = assigned_exitfn;
1875 k->config_read = assigned_dev_pci_read_config;
1876 k->config_write = assigned_dev_pci_write_config;
1877 dc->props = assigned_dev_properties;
1878 dc->vmsd = &vmstate_assigned_device;
1879 dc->reset = reset_assigned_device;
1880 set_bit(DEVICE_CATEGORY_MISC, dc->categories);
1881 dc->desc = "KVM-based PCI passthrough";
1884 static const TypeInfo assign_info = {
1885 .name = TYPE_PCI_ASSIGN,
1886 .parent = TYPE_PCI_DEVICE,
1887 .instance_size = sizeof(AssignedDevice),
1888 .class_init = assign_class_init,
1889 .instance_init = assigned_dev_instance_init,
1892 static void assign_register_types(void)
1894 type_register_static(&assign_info);
1897 type_init(assign_register_types)
1900 * Scan the assigned devices for the devices that have an option ROM, and then
1901 * load the corresponding ROM data to RAM. If an error occurs while loading an
1902 * option ROM, we just ignore that option ROM and continue with the next one.
1904 static void assigned_dev_load_option_rom(AssignedDevice *dev)
1906 char name[32], rom_file[64];
1912 /* If loading ROM from file, pci handles it */
1913 if (dev->dev.romfile || !dev->dev.rom_bar) {
1917 snprintf(rom_file, sizeof(rom_file),
1918 "/sys/bus/pci/devices/%04x:%02x:%02x.%01x/rom",
1919 dev->host.domain, dev->host.bus, dev->host.slot,
1920 dev->host.function);
1922 if (stat(rom_file, &st)) {
1926 if (access(rom_file, F_OK)) {
1927 error_report("pci-assign: Insufficient privileges for %s", rom_file);
1931 /* Write "1" to the ROM file to enable it */
1932 fp = fopen(rom_file, "r+");
1937 if (fwrite(&val, 1, 1, fp) != 1) {
1940 fseek(fp, 0, SEEK_SET);
1942 snprintf(name, sizeof(name), "%s.rom",
1943 object_get_typename(OBJECT(dev)));
1944 memory_region_init_ram(&dev->dev.rom, OBJECT(dev), name, st.st_size,
1946 vmstate_register_ram(&dev->dev.rom, &dev->dev.qdev);
1947 ptr = memory_region_get_ram_ptr(&dev->dev.rom);
1948 memset(ptr, 0xff, st.st_size);
1950 if (!fread(ptr, 1, st.st_size, fp)) {
1951 error_report("pci-assign: Cannot read from host %s", rom_file);
1952 error_printf("Device option ROM contents are probably invalid "
1953 "(check dmesg).\nSkip option ROM probe with rombar=0, "
1954 "or load from file with romfile=\n");
1958 pci_register_bar(&dev->dev, PCI_ROM_SLOT, 0, &dev->dev.rom);
1959 dev->dev.has_rom = true;
1961 /* Write "0" to disable ROM */
1962 fseek(fp, 0, SEEK_SET);
1964 if (!fwrite(&val, 1, 1, fp)) {
1965 DEBUG("%s\n", "Failed to disable pci-sysfs rom file");