1 /*
2 * Copyright (c) 2007, Neocleus Corporation.
3 * Copyright (c) 2007, Intel Corporation.
4 *
5 * This work is licensed under the terms of the GNU GPL, version 2. See
6 * the COPYING file in the top-level directory.
7 *
8 * Alex Novik <alex@neocleus.com>
9 * Allen Kay <allen.m.kay@intel.com>
10 * Guy Zana <guy@neocleus.com>
11 *
12 * This file implements direct PCI assignment to a HVM guest
13 */
14
15 /*
16 * Interrupt Disable policy:
17 *
18 * INTx interrupt:
19 * Initialize(register_real_device)
20 * Map INTx(xc_physdev_map_pirq):
21 * <fail>
22 * - Set real Interrupt Disable bit to '1'.
23 * - Set machine_irq and assigned_device->machine_irq to '0'.
24 * * Don't bind INTx.
25 *
26 * Bind INTx(xc_domain_bind_pt_pci_irq):
27 * <fail>
28 * - Set real Interrupt Disable bit to '1'.
29 * - Unmap INTx.
30 * - Decrement xen_pt_mapped_machine_irq[machine_irq]
31 * - Set assigned_device->machine_irq to '0'.
32 *
33 * Write to Interrupt Disable bit by guest software(xen_pt_cmd_reg_write)
34 * Write '0'
35 * - Set real bit to '0' if assigned_device->machine_irq isn't '0'.
36 *
37 * Write '1'
38 * - Set real bit to '1'.
39 *
40 * MSI interrupt:
41 * Initialize MSI register(xen_pt_msi_setup, xen_pt_msi_update)
42 * Bind MSI(xc_domain_update_msi_irq)
43 * <fail>
44 * - Unmap MSI.
45 * - Set dev->msi->pirq to '-1'.
46 *
47 * MSI-X interrupt:
48 * Initialize MSI-X register(xen_pt_msix_update_one)
49 * Bind MSI-X(xc_domain_update_msi_irq)
50 * <fail>
51 * - Unmap MSI-X.
52 * - Set entry->pirq to '-1'.
53 */
54
55 #include "qemu/osdep.h"
56 #include "qapi/error.h"
57 #include "qemu/error-report.h"
58 #include <sys/ioctl.h>
59
60 #include "hw/pci/pci.h"
61 #include "hw/qdev-properties.h"
62 #include "hw/qdev-properties-system.h"
63 #include "hw/xen/xen_pt.h"
64 #include "hw/xen/xen_igd.h"
65 #include "hw/xen/xen.h"
66 #include "hw/xen/xen-legacy-backend.h"
67 #include "qemu/range.h"
68
69 static bool has_igd_gfx_passthru;
70
xen_igd_gfx_pt_enabled(void)71 bool xen_igd_gfx_pt_enabled(void)
72 {
73 return has_igd_gfx_passthru;
74 }
75
xen_igd_gfx_pt_set(bool value,Error ** errp)76 void xen_igd_gfx_pt_set(bool value, Error **errp)
77 {
78 has_igd_gfx_passthru = value;
79 }
80
81 #define XEN_PT_NR_IRQS (256)
82 static uint8_t xen_pt_mapped_machine_irq[XEN_PT_NR_IRQS] = {0};
83
xen_pt_log(const PCIDevice * d,const char * f,...)84 void xen_pt_log(const PCIDevice *d, const char *f, ...)
85 {
86 va_list ap;
87
88 va_start(ap, f);
89 if (d) {
90 fprintf(stderr, "[%02x:%02x.%d] ", pci_dev_bus_num(d),
91 PCI_SLOT(d->devfn), PCI_FUNC(d->devfn));
92 }
93 vfprintf(stderr, f, ap);
94 va_end(ap);
95 }
96
97 /* Config Space */
98
xen_pt_pci_config_access_check(PCIDevice * d,uint32_t addr,int len)99 static int xen_pt_pci_config_access_check(PCIDevice *d, uint32_t addr, int len)
100 {
101 /* check offset range */
102 if (addr > 0xFF) {
103 XEN_PT_ERR(d, "Failed to access register with offset exceeding 0xFF. "
104 "(addr: 0x%02x, len: %d)\n", addr, len);
105 return -1;
106 }
107
108 /* check read size */
109 if ((len != 1) && (len != 2) && (len != 4)) {
110 XEN_PT_ERR(d, "Failed to access register with invalid access length. "
111 "(addr: 0x%02x, len: %d)\n", addr, len);
112 return -1;
113 }
114
115 /* check offset alignment */
116 if (addr & (len - 1)) {
117 XEN_PT_ERR(d, "Failed to access register with invalid access size "
118 "alignment. (addr: 0x%02x, len: %d)\n", addr, len);
119 return -1;
120 }
121
122 return 0;
123 }
124
xen_pt_bar_offset_to_index(uint32_t offset)125 int xen_pt_bar_offset_to_index(uint32_t offset)
126 {
127 int index = 0;
128
129 /* check Exp ROM BAR */
130 if (offset == PCI_ROM_ADDRESS) {
131 return PCI_ROM_SLOT;
132 }
133
134 /* calculate BAR index */
135 index = (offset - PCI_BASE_ADDRESS_0) >> 2;
136 if (index >= PCI_NUM_REGIONS) {
137 return -1;
138 }
139
140 return index;
141 }
142
xen_pt_pci_read_config(PCIDevice * d,uint32_t addr,int len)143 static uint32_t xen_pt_pci_read_config(PCIDevice *d, uint32_t addr, int len)
144 {
145 XenPCIPassthroughState *s = XEN_PT_DEVICE(d);
146 uint32_t val = 0;
147 XenPTRegGroup *reg_grp_entry = NULL;
148 XenPTReg *reg_entry = NULL;
149 int rc = 0;
150 int emul_len = 0;
151 uint32_t find_addr = addr;
152
153 if (xen_pt_pci_config_access_check(d, addr, len)) {
154 goto exit;
155 }
156
157 /* find register group entry */
158 reg_grp_entry = xen_pt_find_reg_grp(s, addr);
159 if (reg_grp_entry) {
160 /* check 0-Hardwired register group */
161 if (reg_grp_entry->reg_grp->grp_type == XEN_PT_GRP_TYPE_HARDWIRED) {
162 /* no need to emulate, just return 0 */
163 val = 0;
164 goto exit;
165 }
166 }
167
168 /* read I/O device register value */
169 rc = xen_host_pci_get_block(&s->real_device, addr, (uint8_t *)&val, len);
170 if (rc < 0) {
171 XEN_PT_ERR(d, "pci_read_block failed. return value: %d.\n", rc);
172 memset(&val, 0xff, len);
173 }
174
175 /* just return the I/O device register value for
176 * passthrough type register group */
177 if (reg_grp_entry == NULL) {
178 goto exit;
179 }
180
181 /* adjust the read value to appropriate CFC-CFF window */
182 val <<= (addr & 3) << 3;
183 emul_len = len;
184
185 /* loop around the guest requested size */
186 while (emul_len > 0) {
187 /* find register entry to be emulated */
188 reg_entry = xen_pt_find_reg(reg_grp_entry, find_addr);
189 if (reg_entry) {
190 XenPTRegInfo *reg = reg_entry->reg;
191 uint32_t real_offset = reg_grp_entry->base_offset + reg->offset;
192 uint32_t valid_mask = 0xFFFFFFFF >> ((4 - emul_len) << 3);
193 uint8_t *ptr_val = NULL;
194
195 valid_mask <<= (find_addr - real_offset) << 3;
196 ptr_val = (uint8_t *)&val + (real_offset & 3);
197
198 /* do emulation based on register size */
199 switch (reg->size) {
200 case 1:
201 if (reg->u.b.read) {
202 rc = reg->u.b.read(s, reg_entry, ptr_val, valid_mask);
203 }
204 break;
205 case 2:
206 if (reg->u.w.read) {
207 rc = reg->u.w.read(s, reg_entry,
208 (uint16_t *)ptr_val, valid_mask);
209 }
210 break;
211 case 4:
212 if (reg->u.dw.read) {
213 rc = reg->u.dw.read(s, reg_entry,
214 (uint32_t *)ptr_val, valid_mask);
215 }
216 break;
217 }
218
219 if (rc < 0) {
220 xen_shutdown_fatal_error("Internal error: Invalid read "
221 "emulation. (%s, rc: %d)\n",
222 __func__, rc);
223 return 0;
224 }
225
226 /* calculate next address to find */
227 emul_len -= reg->size;
228 if (emul_len > 0) {
229 find_addr = real_offset + reg->size;
230 }
231 } else {
232 /* nothing to do with passthrough type register,
233 * continue to find next byte */
234 emul_len--;
235 find_addr++;
236 }
237 }
238
239 /* need to shift back before returning them to pci bus emulator */
240 val >>= ((addr & 3) << 3);
241
242 exit:
243 XEN_PT_LOG_CONFIG(d, addr, val, len);
244 return val;
245 }
246
xen_pt_pci_write_config(PCIDevice * d,uint32_t addr,uint32_t val,int len)247 static void xen_pt_pci_write_config(PCIDevice *d, uint32_t addr,
248 uint32_t val, int len)
249 {
250 XenPCIPassthroughState *s = XEN_PT_DEVICE(d);
251 int index = 0;
252 XenPTRegGroup *reg_grp_entry = NULL;
253 int rc = 0;
254 uint32_t read_val = 0, wb_mask;
255 int emul_len = 0;
256 XenPTReg *reg_entry = NULL;
257 uint32_t find_addr = addr;
258 XenPTRegInfo *reg = NULL;
259 bool wp_flag = false;
260
261 if (xen_pt_pci_config_access_check(d, addr, len)) {
262 return;
263 }
264
265 XEN_PT_LOG_CONFIG(d, addr, val, len);
266
267 /* check unused BAR register */
268 index = xen_pt_bar_offset_to_index(addr);
269 if ((index >= 0) && (val != 0)) {
270 uint32_t chk = val;
271
272 if (index == PCI_ROM_SLOT)
273 chk |= (uint32_t)~PCI_ROM_ADDRESS_MASK;
274
275 if ((chk != XEN_PT_BAR_ALLF) &&
276 (s->bases[index].bar_flag == XEN_PT_BAR_FLAG_UNUSED)) {
277 XEN_PT_WARN(d, "Guest attempt to set address to unused "
278 "Base Address Register. (addr: 0x%02x, len: %d)\n",
279 addr, len);
280 }
281 }
282
283 /* find register group entry */
284 reg_grp_entry = xen_pt_find_reg_grp(s, addr);
285 if (reg_grp_entry) {
286 /* check 0-Hardwired register group */
287 if (reg_grp_entry->reg_grp->grp_type == XEN_PT_GRP_TYPE_HARDWIRED) {
288 /* ignore silently */
289 XEN_PT_WARN(d, "Access to 0-Hardwired register. "
290 "(addr: 0x%02x, len: %d)\n", addr, len);
291 return;
292 }
293 }
294
295 rc = xen_host_pci_get_block(&s->real_device, addr,
296 (uint8_t *)&read_val, len);
297 if (rc < 0) {
298 XEN_PT_ERR(d, "pci_read_block failed. return value: %d.\n", rc);
299 memset(&read_val, 0xff, len);
300 wb_mask = 0;
301 } else {
302 wb_mask = 0xFFFFFFFF >> ((4 - len) << 3);
303 }
304
305 /* pass directly to the real device for passthrough type register group */
306 if (reg_grp_entry == NULL) {
307 if (!s->permissive) {
308 wb_mask = 0;
309 wp_flag = true;
310 }
311 goto out;
312 }
313
314 memory_region_transaction_begin();
315 pci_default_write_config(d, addr, val, len);
316
317 /* adjust the read and write value to appropriate CFC-CFF window */
318 read_val <<= (addr & 3) << 3;
319 val <<= (addr & 3) << 3;
320 emul_len = len;
321
322 /* loop around the guest requested size */
323 while (emul_len > 0) {
324 /* find register entry to be emulated */
325 reg_entry = xen_pt_find_reg(reg_grp_entry, find_addr);
326 if (reg_entry) {
327 reg = reg_entry->reg;
328 uint32_t real_offset = reg_grp_entry->base_offset + reg->offset;
329 uint32_t valid_mask = 0xFFFFFFFF >> ((4 - emul_len) << 3);
330 uint8_t *ptr_val = NULL;
331 uint32_t wp_mask = reg->emu_mask | reg->ro_mask;
332
333 valid_mask <<= (find_addr - real_offset) << 3;
334 ptr_val = (uint8_t *)&val + (real_offset & 3);
335 if (!s->permissive) {
336 wp_mask |= reg->res_mask;
337 }
338 if (wp_mask == (0xFFFFFFFF >> ((4 - reg->size) << 3))) {
339 wb_mask &= ~((wp_mask >> ((find_addr - real_offset) << 3))
340 << ((len - emul_len) << 3));
341 }
342
343 /* do emulation based on register size */
344 switch (reg->size) {
345 case 1:
346 if (reg->u.b.write) {
347 rc = reg->u.b.write(s, reg_entry, ptr_val,
348 read_val >> ((real_offset & 3) << 3),
349 valid_mask);
350 }
351 break;
352 case 2:
353 if (reg->u.w.write) {
354 rc = reg->u.w.write(s, reg_entry, (uint16_t *)ptr_val,
355 (read_val >> ((real_offset & 3) << 3)),
356 valid_mask);
357 }
358 break;
359 case 4:
360 if (reg->u.dw.write) {
361 rc = reg->u.dw.write(s, reg_entry, (uint32_t *)ptr_val,
362 (read_val >> ((real_offset & 3) << 3)),
363 valid_mask);
364 }
365 break;
366 }
367
368 if (rc < 0) {
369 xen_shutdown_fatal_error("Internal error: Invalid write"
370 " emulation. (%s, rc: %d)\n",
371 __func__, rc);
372 return;
373 }
374
375 /* calculate next address to find */
376 emul_len -= reg->size;
377 if (emul_len > 0) {
378 find_addr = real_offset + reg->size;
379 }
380 } else {
381 /* nothing to do with passthrough type register,
382 * continue to find next byte */
383 if (!s->permissive) {
384 wb_mask &= ~(0xff << ((len - emul_len) << 3));
385 /* Unused BARs will make it here, but we don't want to issue
386 * warnings for writes to them (bogus writes get dealt with
387 * above).
388 */
389 if (index < 0) {
390 wp_flag = true;
391 }
392 }
393 emul_len--;
394 find_addr++;
395 }
396 }
397
398 /* need to shift back before passing them to xen_host_pci_set_block. */
399 val >>= (addr & 3) << 3;
400
401 memory_region_transaction_commit();
402
403 out:
404 if (wp_flag && !s->permissive_warned) {
405 s->permissive_warned = true;
406 xen_pt_log(d, "Write-back to unknown field 0x%02x (partially) inhibited (0x%0*x)\n",
407 addr, len * 2, wb_mask);
408 xen_pt_log(d, "If the device doesn't work, try enabling permissive mode\n");
409 xen_pt_log(d, "(unsafe) and if it helps report the problem to xen-devel\n");
410 }
411 for (index = 0; wb_mask; index += len) {
412 /* unknown regs are passed through */
413 while (!(wb_mask & 0xff)) {
414 index++;
415 wb_mask >>= 8;
416 }
417 len = 0;
418 do {
419 len++;
420 wb_mask >>= 8;
421 } while (wb_mask & 0xff);
422 rc = xen_host_pci_set_block(&s->real_device, addr + index,
423 (uint8_t *)&val + index, len);
424
425 if (rc < 0) {
426 XEN_PT_ERR(d, "xen_host_pci_set_block failed. return value: %d.\n", rc);
427 }
428 }
429 }
430
431 /* register regions */
432
xen_pt_bar_read(void * o,hwaddr addr,unsigned size)433 static uint64_t xen_pt_bar_read(void *o, hwaddr addr,
434 unsigned size)
435 {
436 PCIDevice *d = o;
437 /* if this function is called, that probably means that there is a
438 * misconfiguration of the IOMMU. */
439 XEN_PT_ERR(d, "Should not read BAR through QEMU. @0x"HWADDR_FMT_plx"\n",
440 addr);
441 return 0;
442 }
xen_pt_bar_write(void * o,hwaddr addr,uint64_t val,unsigned size)443 static void xen_pt_bar_write(void *o, hwaddr addr, uint64_t val,
444 unsigned size)
445 {
446 PCIDevice *d = o;
447 /* Same comment as xen_pt_bar_read function */
448 XEN_PT_ERR(d, "Should not write BAR through QEMU. @0x"HWADDR_FMT_plx"\n",
449 addr);
450 }
451
452 static const MemoryRegionOps ops = {
453 .endianness = DEVICE_NATIVE_ENDIAN,
454 .read = xen_pt_bar_read,
455 .write = xen_pt_bar_write,
456 };
457
xen_pt_register_regions(XenPCIPassthroughState * s,uint16_t * cmd)458 static int xen_pt_register_regions(XenPCIPassthroughState *s, uint16_t *cmd)
459 {
460 int i = 0;
461 XenHostPCIDevice *d = &s->real_device;
462
463 /* Register PIO/MMIO BARs */
464 for (i = 0; i < PCI_ROM_SLOT; i++) {
465 XenHostPCIIORegion *r = &d->io_regions[i];
466 uint8_t type;
467
468 if (r->base_addr == 0 || r->size == 0) {
469 continue;
470 }
471
472 s->bases[i].access.u = r->base_addr;
473
474 if (r->type & XEN_HOST_PCI_REGION_TYPE_IO) {
475 type = PCI_BASE_ADDRESS_SPACE_IO;
476 *cmd |= PCI_COMMAND_IO;
477 } else {
478 type = PCI_BASE_ADDRESS_SPACE_MEMORY;
479 if (r->type & XEN_HOST_PCI_REGION_TYPE_PREFETCH) {
480 type |= PCI_BASE_ADDRESS_MEM_PREFETCH;
481 }
482 if (r->type & XEN_HOST_PCI_REGION_TYPE_MEM_64) {
483 type |= PCI_BASE_ADDRESS_MEM_TYPE_64;
484 }
485 *cmd |= PCI_COMMAND_MEMORY;
486 }
487
488 memory_region_init_io(&s->bar[i], OBJECT(s), &ops, &s->dev,
489 "xen-pci-pt-bar", r->size);
490 pci_register_bar(&s->dev, i, type, &s->bar[i]);
491
492 XEN_PT_LOG(&s->dev, "IO region %i registered (size=0x%08"PRIx64
493 " base_addr=0x%08"PRIx64" type: 0x%x)\n",
494 i, r->size, r->base_addr, type);
495 }
496
497 /* Register expansion ROM address */
498 if (d->rom.base_addr && d->rom.size) {
499 uint32_t bar_data = 0;
500
501 /* Re-set BAR reported by OS, otherwise ROM can't be read. */
502 if (xen_host_pci_get_long(d, PCI_ROM_ADDRESS, &bar_data)) {
503 return 0;
504 }
505 if ((bar_data & PCI_ROM_ADDRESS_MASK) == 0) {
506 bar_data |= d->rom.base_addr & PCI_ROM_ADDRESS_MASK;
507 xen_host_pci_set_long(d, PCI_ROM_ADDRESS, bar_data);
508 }
509
510 s->bases[PCI_ROM_SLOT].access.maddr = d->rom.base_addr;
511
512 memory_region_init_io(&s->rom, OBJECT(s), &ops, &s->dev,
513 "xen-pci-pt-rom", d->rom.size);
514 pci_register_bar(&s->dev, PCI_ROM_SLOT, PCI_BASE_ADDRESS_MEM_PREFETCH,
515 &s->rom);
516
517 XEN_PT_LOG(&s->dev, "Expansion ROM registered (size=0x%08"PRIx64
518 " base_addr=0x%08"PRIx64")\n",
519 d->rom.size, d->rom.base_addr);
520 }
521
522 xen_pt_register_vga_regions(d);
523 return 0;
524 }
525
526 /* region mapping */
527
xen_pt_bar_from_region(XenPCIPassthroughState * s,MemoryRegion * mr)528 static int xen_pt_bar_from_region(XenPCIPassthroughState *s, MemoryRegion *mr)
529 {
530 int i = 0;
531
532 for (i = 0; i < PCI_NUM_REGIONS - 1; i++) {
533 if (mr == &s->bar[i]) {
534 return i;
535 }
536 }
537 if (mr == &s->rom) {
538 return PCI_ROM_SLOT;
539 }
540 return -1;
541 }
542
543 /*
544 * This function checks if an io_region overlaps an io_region from another
545 * device. The io_region to check is provided with (addr, size and type)
546 * A callback can be provided and will be called for every region that is
547 * overlapped.
548 * The return value indicates if the region is overlappsed */
549 struct CheckBarArgs {
550 XenPCIPassthroughState *s;
551 pcibus_t addr;
552 pcibus_t size;
553 uint8_t type;
554 bool rc;
555 };
xen_pt_check_bar_overlap(PCIBus * bus,PCIDevice * d,void * opaque)556 static void xen_pt_check_bar_overlap(PCIBus *bus, PCIDevice *d, void *opaque)
557 {
558 struct CheckBarArgs *arg = opaque;
559 XenPCIPassthroughState *s = arg->s;
560 uint8_t type = arg->type;
561 int i;
562
563 if (d->devfn == s->dev.devfn) {
564 return;
565 }
566
567 /* xxx: This ignores bridges. */
568 for (i = 0; i < PCI_NUM_REGIONS; i++) {
569 const PCIIORegion *r = &d->io_regions[i];
570
571 if (!r->size) {
572 continue;
573 }
574 if ((type & PCI_BASE_ADDRESS_SPACE_IO)
575 != (r->type & PCI_BASE_ADDRESS_SPACE_IO)) {
576 continue;
577 }
578
579 if (ranges_overlap(arg->addr, arg->size, r->addr, r->size)) {
580 XEN_PT_WARN(&s->dev,
581 "Overlapped to device [%02x:%02x.%d] Region: %i"
582 " (addr: 0x%"FMT_PCIBUS", len: 0x%"FMT_PCIBUS")\n",
583 pci_bus_num(bus), PCI_SLOT(d->devfn),
584 PCI_FUNC(d->devfn), i, r->addr, r->size);
585 arg->rc = true;
586 }
587 }
588 }
589
xen_pt_region_update(XenPCIPassthroughState * s,MemoryRegionSection * sec,bool adding)590 static void xen_pt_region_update(XenPCIPassthroughState *s,
591 MemoryRegionSection *sec, bool adding)
592 {
593 PCIDevice *d = &s->dev;
594 MemoryRegion *mr = sec->mr;
595 int bar = -1;
596 int rc;
597 int op = adding ? DPCI_ADD_MAPPING : DPCI_REMOVE_MAPPING;
598 struct CheckBarArgs args = {
599 .s = s,
600 .addr = sec->offset_within_address_space,
601 .size = int128_get64(sec->size),
602 .rc = false,
603 };
604
605 bar = xen_pt_bar_from_region(s, mr);
606 if (bar == -1 && (!s->msix || &s->msix->mmio != mr)) {
607 return;
608 }
609
610 if (s->msix && &s->msix->mmio == mr) {
611 if (adding) {
612 s->msix->mmio_base_addr = sec->offset_within_address_space;
613 rc = xen_pt_msix_update_remap(s, s->msix->bar_index);
614 }
615 return;
616 }
617
618 args.type = d->io_regions[bar].type;
619 pci_for_each_device_under_bus(pci_get_bus(d),
620 xen_pt_check_bar_overlap, &args);
621 if (args.rc) {
622 XEN_PT_WARN(d, "Region: %d (addr: 0x%"FMT_PCIBUS
623 ", len: 0x%"FMT_PCIBUS") is overlapped.\n",
624 bar, sec->offset_within_address_space,
625 int128_get64(sec->size));
626 }
627
628 if (d->io_regions[bar].type & PCI_BASE_ADDRESS_SPACE_IO) {
629 uint32_t guest_port = sec->offset_within_address_space;
630 uint32_t machine_port = s->bases[bar].access.pio_base;
631 uint32_t size = int128_get64(sec->size);
632 rc = xc_domain_ioport_mapping(xen_xc, xen_domid,
633 guest_port, machine_port, size,
634 op);
635 if (rc) {
636 XEN_PT_ERR(d, "%s ioport mapping failed! (err: %i)\n",
637 adding ? "create new" : "remove old", errno);
638 }
639 } else {
640 pcibus_t guest_addr = sec->offset_within_address_space;
641 pcibus_t machine_addr = s->bases[bar].access.maddr
642 + sec->offset_within_region;
643 pcibus_t size = int128_get64(sec->size);
644 rc = xc_domain_memory_mapping(xen_xc, xen_domid,
645 XEN_PFN(guest_addr + XC_PAGE_SIZE - 1),
646 XEN_PFN(machine_addr + XC_PAGE_SIZE - 1),
647 XEN_PFN(size + XC_PAGE_SIZE - 1),
648 op);
649 if (rc) {
650 XEN_PT_ERR(d, "%s mem mapping failed! (err: %i)\n",
651 adding ? "create new" : "remove old", errno);
652 }
653 }
654 }
655
xen_pt_region_add(MemoryListener * l,MemoryRegionSection * sec)656 static void xen_pt_region_add(MemoryListener *l, MemoryRegionSection *sec)
657 {
658 XenPCIPassthroughState *s = container_of(l, XenPCIPassthroughState,
659 memory_listener);
660
661 memory_region_ref(sec->mr);
662 xen_pt_region_update(s, sec, true);
663 }
664
xen_pt_region_del(MemoryListener * l,MemoryRegionSection * sec)665 static void xen_pt_region_del(MemoryListener *l, MemoryRegionSection *sec)
666 {
667 XenPCIPassthroughState *s = container_of(l, XenPCIPassthroughState,
668 memory_listener);
669
670 xen_pt_region_update(s, sec, false);
671 memory_region_unref(sec->mr);
672 }
673
xen_pt_io_region_add(MemoryListener * l,MemoryRegionSection * sec)674 static void xen_pt_io_region_add(MemoryListener *l, MemoryRegionSection *sec)
675 {
676 XenPCIPassthroughState *s = container_of(l, XenPCIPassthroughState,
677 io_listener);
678
679 memory_region_ref(sec->mr);
680 xen_pt_region_update(s, sec, true);
681 }
682
xen_pt_io_region_del(MemoryListener * l,MemoryRegionSection * sec)683 static void xen_pt_io_region_del(MemoryListener *l, MemoryRegionSection *sec)
684 {
685 XenPCIPassthroughState *s = container_of(l, XenPCIPassthroughState,
686 io_listener);
687
688 xen_pt_region_update(s, sec, false);
689 memory_region_unref(sec->mr);
690 }
691
692 static const MemoryListener xen_pt_memory_listener = {
693 .name = "xen-pt-mem",
694 .region_add = xen_pt_region_add,
695 .region_del = xen_pt_region_del,
696 .priority = MEMORY_LISTENER_PRIORITY_ACCEL,
697 };
698
699 static const MemoryListener xen_pt_io_listener = {
700 .name = "xen-pt-io",
701 .region_add = xen_pt_io_region_add,
702 .region_del = xen_pt_io_region_del,
703 .priority = MEMORY_LISTENER_PRIORITY_ACCEL,
704 };
705
706 /* destroy. */
xen_pt_destroy(PCIDevice * d)707 static void xen_pt_destroy(PCIDevice *d) {
708
709 XenPCIPassthroughState *s = XEN_PT_DEVICE(d);
710 XenHostPCIDevice *host_dev = &s->real_device;
711 uint8_t machine_irq = s->machine_irq;
712 uint8_t intx;
713 int rc;
714
715 if (machine_irq && !xen_host_pci_device_closed(host_dev)) {
716 intx = xen_pt_pci_intx(s);
717 rc = xc_domain_unbind_pt_irq(xen_xc, xen_domid, machine_irq,
718 PT_IRQ_TYPE_PCI,
719 pci_dev_bus_num(d),
720 PCI_SLOT(s->dev.devfn),
721 intx,
722 0 /* isa_irq */);
723 if (rc < 0) {
724 XEN_PT_ERR(d, "unbinding of interrupt INT%c failed."
725 " (machine irq: %i, err: %d)"
726 " But bravely continuing on..\n",
727 'a' + intx, machine_irq, errno);
728 }
729 }
730
731 /* N.B. xen_pt_config_delete takes care of freeing them. */
732 if (s->msi) {
733 xen_pt_msi_disable(s);
734 }
735 if (s->msix) {
736 xen_pt_msix_disable(s);
737 }
738
739 if (machine_irq) {
740 xen_pt_mapped_machine_irq[machine_irq]--;
741
742 if (xen_pt_mapped_machine_irq[machine_irq] == 0) {
743 rc = xc_physdev_unmap_pirq(xen_xc, xen_domid, machine_irq);
744
745 if (rc < 0) {
746 XEN_PT_ERR(d, "unmapping of interrupt %i failed. (err: %d)"
747 " But bravely continuing on..\n",
748 machine_irq, errno);
749 }
750 }
751 s->machine_irq = 0;
752 }
753
754 /* delete all emulated config registers */
755 xen_pt_config_delete(s);
756
757 xen_pt_unregister_vga_regions(host_dev);
758
759 if (s->listener_set) {
760 memory_listener_unregister(&s->memory_listener);
761 memory_listener_unregister(&s->io_listener);
762 s->listener_set = false;
763 }
764 if (!xen_host_pci_device_closed(host_dev)) {
765 xen_host_pci_device_put(host_dev);
766 }
767 }
768 /* init */
769
770 #if CONFIG_XEN_CTRL_INTERFACE_VERSION >= 42000
xen_pt_need_gsi(void)771 static bool xen_pt_need_gsi(void)
772 {
773 FILE *fp;
774 int len;
775 /*
776 * The max length of guest_type is "PVH"+'\n'+'\0', it is 5,
777 * so here set the length of type to be twice.
778 */
779 char type[10];
780 const char *guest_type = "/sys/hypervisor/guest_type";
781
782 fp = fopen(guest_type, "r");
783 if (!fp) {
784 error_report("Cannot open %s: %s", guest_type, strerror(errno));
785 return false;
786 }
787
788 if (fgets(type, sizeof(type), fp)) {
789 len = strlen(type);
790 if (len) {
791 type[len - 1] = '\0';
792 if (!strcmp(type, "PVH")) {
793 fclose(fp);
794 return true;
795 }
796 }
797 }
798
799 fclose(fp);
800 return false;
801 }
802
xen_pt_map_pirq_for_gsi(PCIDevice * d,int * pirq)803 static int xen_pt_map_pirq_for_gsi(PCIDevice *d, int *pirq)
804 {
805 int gsi;
806 XenPCIPassthroughState *s = XEN_PT_DEVICE(d);
807
808 gsi = xc_pcidev_get_gsi(xen_xc,
809 PCI_SBDF(s->real_device.domain,
810 s->real_device.bus,
811 s->real_device.dev,
812 s->real_device.func));
813 if (gsi >= 0) {
814 return xc_physdev_map_pirq_gsi(xen_xc, xen_domid, gsi, pirq);
815 }
816
817 return gsi;
818 }
819 #endif
820
xen_pt_realize(PCIDevice * d,Error ** errp)821 static void xen_pt_realize(PCIDevice *d, Error **errp)
822 {
823 ERRP_GUARD();
824 XenPCIPassthroughState *s = XEN_PT_DEVICE(d);
825 int i, rc = 0;
826 uint8_t machine_irq = 0, scratch;
827 uint16_t cmd = 0;
828 int pirq = XEN_PT_UNASSIGNED_PIRQ;
829
830 /* register real device */
831 XEN_PT_LOG(d, "Assigning real physical device %02x:%02x.%d"
832 " to devfn 0x%x\n",
833 s->hostaddr.bus, s->hostaddr.slot, s->hostaddr.function,
834 s->dev.devfn);
835
836 s->is_virtfn = s->real_device.is_virtfn;
837 if (s->is_virtfn) {
838 XEN_PT_LOG(d, "%04x:%02x:%02x.%d is a SR-IOV Virtual Function\n",
839 s->real_device.domain, s->real_device.bus,
840 s->real_device.dev, s->real_device.func);
841 }
842
843 /* Initialize virtualized PCI configuration (Extended 256 Bytes) */
844 memset(d->config, 0, PCI_CONFIG_SPACE_SIZE);
845
846 s->memory_listener = xen_pt_memory_listener;
847 s->io_listener = xen_pt_io_listener;
848
849 /* Setup VGA bios for passthrough GFX */
850 if ((s->real_device.domain == XEN_PCI_IGD_DOMAIN) &&
851 (s->real_device.bus == XEN_PCI_IGD_BUS) &&
852 (s->real_device.dev == XEN_PCI_IGD_DEV) &&
853 (s->real_device.func == XEN_PCI_IGD_FN)) {
854 if (!is_igd_vga_passthrough(&s->real_device)) {
855 error_setg(errp, "Need to enable igd-passthru if you're trying"
856 " to passthrough IGD GFX");
857 xen_host_pci_device_put(&s->real_device);
858 return;
859 }
860
861 xen_pt_setup_vga(s, &s->real_device, errp);
862 if (*errp) {
863 error_append_hint(errp, "Setup VGA BIOS of passthrough"
864 " GFX failed");
865 xen_host_pci_device_put(&s->real_device);
866 return;
867 }
868
869 /* Register ISA bridge for passthrough GFX. */
870 xen_igd_passthrough_isa_bridge_create(s, &s->real_device);
871 }
872
873 /* Handle real device's MMIO/PIO BARs */
874 xen_pt_register_regions(s, &cmd);
875
876 /* reinitialize each config register to be emulated */
877 xen_pt_config_init(s, errp);
878 if (*errp) {
879 error_append_hint(errp, "PCI Config space initialisation failed");
880 rc = -1;
881 goto err_out;
882 }
883
884 /* Bind interrupt */
885 rc = xen_host_pci_get_byte(&s->real_device, PCI_INTERRUPT_PIN, &scratch);
886 if (rc) {
887 error_setg_errno(errp, errno, "Failed to read PCI_INTERRUPT_PIN");
888 goto err_out;
889 }
890 if (!scratch) {
891 XEN_PT_LOG(d, "no pin interrupt\n");
892 goto out;
893 }
894
895 machine_irq = s->real_device.irq;
896 if (machine_irq == 0) {
897 XEN_PT_LOG(d, "machine irq is 0\n");
898 cmd |= PCI_COMMAND_INTX_DISABLE;
899 goto out;
900 }
901
902 #if CONFIG_XEN_CTRL_INTERFACE_VERSION >= 42000
903 if (xen_pt_need_gsi()) {
904 rc = xen_pt_map_pirq_for_gsi(d, &pirq);
905 } else {
906 rc = xc_physdev_map_pirq(xen_xc, xen_domid, machine_irq, &pirq);
907 }
908 #else
909 rc = xc_physdev_map_pirq(xen_xc, xen_domid, machine_irq, &pirq);
910 #endif
911
912 if (rc < 0) {
913 XEN_PT_ERR(d, "Mapping machine irq %u to pirq %i failed, (err: %d)\n",
914 machine_irq, pirq, errno);
915
916 /* Disable PCI intx assertion (turn on bit10 of devctl) */
917 cmd |= PCI_COMMAND_INTX_DISABLE;
918 machine_irq = 0;
919 s->machine_irq = 0;
920 } else {
921 machine_irq = pirq;
922 s->machine_irq = pirq;
923 xen_pt_mapped_machine_irq[machine_irq]++;
924 }
925
926 /* bind machine_irq to device */
927 if (machine_irq != 0) {
928 uint8_t e_intx = xen_pt_pci_intx(s);
929
930 rc = xc_domain_bind_pt_pci_irq(xen_xc, xen_domid, machine_irq,
931 pci_dev_bus_num(d),
932 PCI_SLOT(d->devfn),
933 e_intx);
934 if (rc < 0) {
935 XEN_PT_ERR(d, "Binding of interrupt %i failed! (err: %d)\n",
936 e_intx, errno);
937
938 /* Disable PCI intx assertion (turn on bit10 of devctl) */
939 cmd |= PCI_COMMAND_INTX_DISABLE;
940 xen_pt_mapped_machine_irq[machine_irq]--;
941
942 if (xen_pt_mapped_machine_irq[machine_irq] == 0) {
943 if (xc_physdev_unmap_pirq(xen_xc, xen_domid, machine_irq)) {
944 XEN_PT_ERR(d, "Unmapping of machine interrupt %i failed!"
945 " (err: %d)\n", machine_irq, errno);
946 }
947 }
948 s->machine_irq = 0;
949 }
950 }
951
952 out:
953 if (cmd) {
954 uint16_t val;
955
956 rc = xen_host_pci_get_word(&s->real_device, PCI_COMMAND, &val);
957 if (rc) {
958 error_setg_errno(errp, errno, "Failed to read PCI_COMMAND");
959 goto err_out;
960 } else {
961 val |= cmd;
962 rc = xen_host_pci_set_word(&s->real_device, PCI_COMMAND, val);
963 if (rc) {
964 error_setg_errno(errp, errno, "Failed to write PCI_COMMAND"
965 " val = 0x%x", val);
966 goto err_out;
967 }
968 }
969 }
970
971 memory_listener_register(&s->memory_listener, &address_space_memory);
972 memory_listener_register(&s->io_listener, &address_space_io);
973 s->listener_set = true;
974 XEN_PT_LOG(d,
975 "Real physical device %02x:%02x.%d registered successfully\n",
976 s->hostaddr.bus, s->hostaddr.slot, s->hostaddr.function);
977
978 return;
979
980 err_out:
981 for (i = 0; i < PCI_ROM_SLOT; i++) {
982 object_unparent(OBJECT(&s->bar[i]));
983 }
984 object_unparent(OBJECT(&s->rom));
985
986 xen_pt_destroy(d);
987 assert(rc);
988 }
989
xen_pt_unregister_device(PCIDevice * d)990 static void xen_pt_unregister_device(PCIDevice *d)
991 {
992 xen_pt_destroy(d);
993 }
994
995 static const Property xen_pci_passthrough_properties[] = {
996 DEFINE_PROP_PCI_HOST_DEVADDR("hostaddr", XenPCIPassthroughState, hostaddr),
997 DEFINE_PROP_BOOL("permissive", XenPCIPassthroughState, permissive, false),
998 };
999
xen_pci_passthrough_instance_init(Object * obj)1000 static void xen_pci_passthrough_instance_init(Object *obj)
1001 {
1002 /* QEMU_PCI_CAP_EXPRESS initialization does not depend on QEMU command
1003 * line, therefore, no need to wait to realize like other devices */
1004 PCI_DEVICE(obj)->cap_present |= QEMU_PCI_CAP_EXPRESS;
1005 }
1006
xen_igd_reserve_slot(PCIBus * pci_bus)1007 void xen_igd_reserve_slot(PCIBus *pci_bus)
1008 {
1009 if (!xen_igd_gfx_pt_enabled()) {
1010 return;
1011 }
1012
1013 XEN_PT_LOG(0, "Reserving PCI slot 2 for IGD\n");
1014 pci_bus_set_slot_reserved_mask(pci_bus, XEN_PCI_IGD_SLOT_MASK);
1015 }
1016
xen_igd_clear_slot(DeviceState * qdev,Error ** errp)1017 static void xen_igd_clear_slot(DeviceState *qdev, Error **errp)
1018 {
1019 ERRP_GUARD();
1020 PCIDevice *pci_dev = (PCIDevice *)qdev;
1021 XenPCIPassthroughState *s = XEN_PT_DEVICE(pci_dev);
1022 XenPTDeviceClass *xpdc = XEN_PT_DEVICE_GET_CLASS(s);
1023 PCIBus *pci_bus = pci_get_bus(pci_dev);
1024
1025 xen_host_pci_device_get(&s->real_device,
1026 s->hostaddr.domain, s->hostaddr.bus,
1027 s->hostaddr.slot, s->hostaddr.function,
1028 errp);
1029 if (*errp) {
1030 error_append_hint(errp, "Failed to \"open\" the real pci device");
1031 return;
1032 }
1033
1034 if (!(pci_bus_get_slot_reserved_mask(pci_bus) & XEN_PCI_IGD_SLOT_MASK)) {
1035 xpdc->pci_qdev_realize(qdev, errp);
1036 return;
1037 }
1038
1039 if (is_igd_vga_passthrough(&s->real_device) &&
1040 s->real_device.domain == XEN_PCI_IGD_DOMAIN &&
1041 s->real_device.bus == XEN_PCI_IGD_BUS &&
1042 s->real_device.dev == XEN_PCI_IGD_DEV &&
1043 s->real_device.func == XEN_PCI_IGD_FN &&
1044 s->real_device.vendor_id == PCI_VENDOR_ID_INTEL) {
1045 pci_bus_clear_slot_reserved_mask(pci_bus, XEN_PCI_IGD_SLOT_MASK);
1046 XEN_PT_LOG(pci_dev, "Intel IGD found, using slot 2\n");
1047 }
1048 xpdc->pci_qdev_realize(qdev, errp);
1049 }
1050
xen_pci_passthrough_class_init(ObjectClass * klass,const void * data)1051 static void xen_pci_passthrough_class_init(ObjectClass *klass, const void *data)
1052 {
1053 DeviceClass *dc = DEVICE_CLASS(klass);
1054 PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
1055
1056 XenPTDeviceClass *xpdc = XEN_PT_DEVICE_CLASS(klass);
1057 xpdc->pci_qdev_realize = dc->realize;
1058 dc->realize = xen_igd_clear_slot;
1059 k->realize = xen_pt_realize;
1060 k->exit = xen_pt_unregister_device;
1061 k->config_read = xen_pt_pci_read_config;
1062 k->config_write = xen_pt_pci_write_config;
1063 set_bit(DEVICE_CATEGORY_MISC, dc->categories);
1064 dc->desc = "Assign an host PCI device with Xen";
1065 device_class_set_props(dc, xen_pci_passthrough_properties);
1066 };
1067
xen_pci_passthrough_finalize(Object * obj)1068 static void xen_pci_passthrough_finalize(Object *obj)
1069 {
1070 XenPCIPassthroughState *s = XEN_PT_DEVICE(obj);
1071
1072 xen_pt_msix_delete(s);
1073 }
1074
1075 static const TypeInfo xen_pci_passthrough_info = {
1076 .name = TYPE_XEN_PT_DEVICE,
1077 .parent = TYPE_PCI_DEVICE,
1078 .instance_size = sizeof(XenPCIPassthroughState),
1079 .instance_finalize = xen_pci_passthrough_finalize,
1080 .class_init = xen_pci_passthrough_class_init,
1081 .class_size = sizeof(XenPTDeviceClass),
1082 .instance_init = xen_pci_passthrough_instance_init,
1083 .interfaces = (const InterfaceInfo[]) {
1084 { INTERFACE_CONVENTIONAL_PCI_DEVICE },
1085 { INTERFACE_PCIE_DEVICE },
1086 { },
1087 },
1088 };
1089
xen_pci_passthrough_register_types(void)1090 static void xen_pci_passthrough_register_types(void)
1091 {
1092 type_register_static(&xen_pci_passthrough_info);
1093 }
1094
1095 type_init(xen_pci_passthrough_register_types)
1096