xref: /openbmc/qemu/hw/i386/xen/xen-hvm.c (revision 650d103d3ea959212f826acb9d3fe80cf30e347b)
1 /*
2  * Copyright (C) 2010       Citrix Ltd.
3  *
4  * This work is licensed under the terms of the GNU GPL, version 2.  See
5  * the COPYING file in the top-level directory.
6  *
7  * Contributions after 2012-01-13 are licensed under the terms of the
8  * GNU GPL, version 2 or (at your option) any later version.
9  */
10 
11 #include "qemu/osdep.h"
12 
13 #include "cpu.h"
14 #include "hw/pci/pci.h"
15 #include "hw/pci/pci_host.h"
16 #include "hw/i386/pc.h"
17 #include "hw/irq.h"
18 #include "hw/hw.h"
19 #include "hw/i386/apic-msidef.h"
20 #include "hw/xen/xen_common.h"
21 #include "hw/xen/xen-legacy-backend.h"
22 #include "hw/xen/xen-bus.h"
23 #include "qapi/error.h"
24 #include "qapi/qapi-commands-misc.h"
25 #include "qemu/error-report.h"
26 #include "qemu/range.h"
27 #include "sysemu/xen-mapcache.h"
28 #include "trace.h"
29 #include "exec/address-spaces.h"
30 
31 #include <xen/hvm/ioreq.h>
32 #include <xen/hvm/e820.h>
33 
34 //#define DEBUG_XEN_HVM
35 
36 #ifdef DEBUG_XEN_HVM
37 #define DPRINTF(fmt, ...) \
38     do { fprintf(stderr, "xen: " fmt, ## __VA_ARGS__); } while (0)
39 #else
40 #define DPRINTF(fmt, ...) \
41     do { } while (0)
42 #endif
43 
44 static MemoryRegion ram_memory, ram_640k, ram_lo, ram_hi;
45 static MemoryRegion *framebuffer;
46 static bool xen_in_migration;
47 
48 /* Compatibility with older version */
49 
50 /* This allows QEMU to build on a system that has Xen 4.5 or earlier
51  * installed.  This here (not in hw/xen/xen_common.h) because xen/hvm/ioreq.h
52  * needs to be included before this block and hw/xen/xen_common.h needs to
53  * be included before xen/hvm/ioreq.h
54  */
55 #ifndef IOREQ_TYPE_VMWARE_PORT
56 #define IOREQ_TYPE_VMWARE_PORT  3
57 struct vmware_regs {
58     uint32_t esi;
59     uint32_t edi;
60     uint32_t ebx;
61     uint32_t ecx;
62     uint32_t edx;
63 };
64 typedef struct vmware_regs vmware_regs_t;
65 
66 struct shared_vmport_iopage {
67     struct vmware_regs vcpu_vmport_regs[1];
68 };
69 typedef struct shared_vmport_iopage shared_vmport_iopage_t;
70 #endif
71 
72 static inline uint32_t xen_vcpu_eport(shared_iopage_t *shared_page, int i)
73 {
74     return shared_page->vcpu_ioreq[i].vp_eport;
75 }
76 static inline ioreq_t *xen_vcpu_ioreq(shared_iopage_t *shared_page, int vcpu)
77 {
78     return &shared_page->vcpu_ioreq[vcpu];
79 }
80 
81 #define BUFFER_IO_MAX_DELAY  100
82 
83 typedef struct XenPhysmap {
84     hwaddr start_addr;
85     ram_addr_t size;
86     const char *name;
87     hwaddr phys_offset;
88 
89     QLIST_ENTRY(XenPhysmap) list;
90 } XenPhysmap;
91 
92 static QLIST_HEAD(, XenPhysmap) xen_physmap;
93 
94 typedef struct XenPciDevice {
95     PCIDevice *pci_dev;
96     uint32_t sbdf;
97     QLIST_ENTRY(XenPciDevice) entry;
98 } XenPciDevice;
99 
100 typedef struct XenIOState {
101     ioservid_t ioservid;
102     shared_iopage_t *shared_page;
103     shared_vmport_iopage_t *shared_vmport_page;
104     buffered_iopage_t *buffered_io_page;
105     QEMUTimer *buffered_io_timer;
106     CPUState **cpu_by_vcpu_id;
107     /* the evtchn port for polling the notification, */
108     evtchn_port_t *ioreq_local_port;
109     /* evtchn remote and local ports for buffered io */
110     evtchn_port_t bufioreq_remote_port;
111     evtchn_port_t bufioreq_local_port;
112     /* the evtchn fd for polling */
113     xenevtchn_handle *xce_handle;
114     /* which vcpu we are serving */
115     int send_vcpu;
116 
117     struct xs_handle *xenstore;
118     MemoryListener memory_listener;
119     MemoryListener io_listener;
120     QLIST_HEAD(, XenPciDevice) dev_list;
121     DeviceListener device_listener;
122     hwaddr free_phys_offset;
123     const XenPhysmap *log_for_dirtybit;
124     /* Buffer used by xen_sync_dirty_bitmap */
125     unsigned long *dirty_bitmap;
126 
127     Notifier exit;
128     Notifier suspend;
129     Notifier wakeup;
130 } XenIOState;
131 
132 /* Xen specific function for piix pci */
133 
134 int xen_pci_slot_get_pirq(PCIDevice *pci_dev, int irq_num)
135 {
136     return irq_num + ((pci_dev->devfn >> 3) << 2);
137 }
138 
139 void xen_piix3_set_irq(void *opaque, int irq_num, int level)
140 {
141     xen_set_pci_intx_level(xen_domid, 0, 0, irq_num >> 2,
142                            irq_num & 3, level);
143 }
144 
145 void xen_piix_pci_write_config_client(uint32_t address, uint32_t val, int len)
146 {
147     int i;
148 
149     /* Scan for updates to PCI link routes (0x60-0x63). */
150     for (i = 0; i < len; i++) {
151         uint8_t v = (val >> (8 * i)) & 0xff;
152         if (v & 0x80) {
153             v = 0;
154         }
155         v &= 0xf;
156         if (((address + i) >= 0x60) && ((address + i) <= 0x63)) {
157             xen_set_pci_link_route(xen_domid, address + i - 0x60, v);
158         }
159     }
160 }
161 
162 int xen_is_pirq_msi(uint32_t msi_data)
163 {
164     /* If vector is 0, the msi is remapped into a pirq, passed as
165      * dest_id.
166      */
167     return ((msi_data & MSI_DATA_VECTOR_MASK) >> MSI_DATA_VECTOR_SHIFT) == 0;
168 }
169 
170 void xen_hvm_inject_msi(uint64_t addr, uint32_t data)
171 {
172     xen_inject_msi(xen_domid, addr, data);
173 }
174 
175 static void xen_suspend_notifier(Notifier *notifier, void *data)
176 {
177     xc_set_hvm_param(xen_xc, xen_domid, HVM_PARAM_ACPI_S_STATE, 3);
178 }
179 
180 /* Xen Interrupt Controller */
181 
182 static void xen_set_irq(void *opaque, int irq, int level)
183 {
184     xen_set_isa_irq_level(xen_domid, irq, level);
185 }
186 
187 qemu_irq *xen_interrupt_controller_init(void)
188 {
189     return qemu_allocate_irqs(xen_set_irq, NULL, 16);
190 }
191 
192 /* Memory Ops */
193 
194 static void xen_ram_init(PCMachineState *pcms,
195                          ram_addr_t ram_size, MemoryRegion **ram_memory_p)
196 {
197     MemoryRegion *sysmem = get_system_memory();
198     ram_addr_t block_len;
199     uint64_t user_lowmem = object_property_get_uint(qdev_get_machine(),
200                                                     PC_MACHINE_MAX_RAM_BELOW_4G,
201                                                     &error_abort);
202 
203     /* Handle the machine opt max-ram-below-4g.  It is basically doing
204      * min(xen limit, user limit).
205      */
206     if (!user_lowmem) {
207         user_lowmem = HVM_BELOW_4G_RAM_END; /* default */
208     }
209     if (HVM_BELOW_4G_RAM_END <= user_lowmem) {
210         user_lowmem = HVM_BELOW_4G_RAM_END;
211     }
212 
213     if (ram_size >= user_lowmem) {
214         pcms->above_4g_mem_size = ram_size - user_lowmem;
215         pcms->below_4g_mem_size = user_lowmem;
216     } else {
217         pcms->above_4g_mem_size = 0;
218         pcms->below_4g_mem_size = ram_size;
219     }
220     if (!pcms->above_4g_mem_size) {
221         block_len = ram_size;
222     } else {
223         /*
224          * Xen does not allocate the memory continuously, it keeps a
225          * hole of the size computed above or passed in.
226          */
227         block_len = (1ULL << 32) + pcms->above_4g_mem_size;
228     }
229     memory_region_init_ram(&ram_memory, NULL, "xen.ram", block_len,
230                            &error_fatal);
231     *ram_memory_p = &ram_memory;
232 
233     memory_region_init_alias(&ram_640k, NULL, "xen.ram.640k",
234                              &ram_memory, 0, 0xa0000);
235     memory_region_add_subregion(sysmem, 0, &ram_640k);
236     /* Skip of the VGA IO memory space, it will be registered later by the VGA
237      * emulated device.
238      *
239      * The area between 0xc0000 and 0x100000 will be used by SeaBIOS to load
240      * the Options ROM, so it is registered here as RAM.
241      */
242     memory_region_init_alias(&ram_lo, NULL, "xen.ram.lo",
243                              &ram_memory, 0xc0000,
244                              pcms->below_4g_mem_size - 0xc0000);
245     memory_region_add_subregion(sysmem, 0xc0000, &ram_lo);
246     if (pcms->above_4g_mem_size > 0) {
247         memory_region_init_alias(&ram_hi, NULL, "xen.ram.hi",
248                                  &ram_memory, 0x100000000ULL,
249                                  pcms->above_4g_mem_size);
250         memory_region_add_subregion(sysmem, 0x100000000ULL, &ram_hi);
251     }
252 }
253 
254 void xen_ram_alloc(ram_addr_t ram_addr, ram_addr_t size, MemoryRegion *mr,
255                    Error **errp)
256 {
257     unsigned long nr_pfn;
258     xen_pfn_t *pfn_list;
259     int i;
260 
261     if (runstate_check(RUN_STATE_INMIGRATE)) {
262         /* RAM already populated in Xen */
263         fprintf(stderr, "%s: do not alloc "RAM_ADDR_FMT
264                 " bytes of ram at "RAM_ADDR_FMT" when runstate is INMIGRATE\n",
265                 __func__, size, ram_addr);
266         return;
267     }
268 
269     if (mr == &ram_memory) {
270         return;
271     }
272 
273     trace_xen_ram_alloc(ram_addr, size);
274 
275     nr_pfn = size >> TARGET_PAGE_BITS;
276     pfn_list = g_malloc(sizeof (*pfn_list) * nr_pfn);
277 
278     for (i = 0; i < nr_pfn; i++) {
279         pfn_list[i] = (ram_addr >> TARGET_PAGE_BITS) + i;
280     }
281 
282     if (xc_domain_populate_physmap_exact(xen_xc, xen_domid, nr_pfn, 0, 0, pfn_list)) {
283         error_setg(errp, "xen: failed to populate ram at " RAM_ADDR_FMT,
284                    ram_addr);
285     }
286 
287     g_free(pfn_list);
288 }
289 
290 static XenPhysmap *get_physmapping(hwaddr start_addr, ram_addr_t size)
291 {
292     XenPhysmap *physmap = NULL;
293 
294     start_addr &= TARGET_PAGE_MASK;
295 
296     QLIST_FOREACH(physmap, &xen_physmap, list) {
297         if (range_covers_byte(physmap->start_addr, physmap->size, start_addr)) {
298             return physmap;
299         }
300     }
301     return NULL;
302 }
303 
304 static hwaddr xen_phys_offset_to_gaddr(hwaddr phys_offset, ram_addr_t size)
305 {
306     hwaddr addr = phys_offset & TARGET_PAGE_MASK;
307     XenPhysmap *physmap = NULL;
308 
309     QLIST_FOREACH(physmap, &xen_physmap, list) {
310         if (range_covers_byte(physmap->phys_offset, physmap->size, addr)) {
311             return physmap->start_addr + (phys_offset - physmap->phys_offset);
312         }
313     }
314 
315     return phys_offset;
316 }
317 
318 #ifdef XEN_COMPAT_PHYSMAP
319 static int xen_save_physmap(XenIOState *state, XenPhysmap *physmap)
320 {
321     char path[80], value[17];
322 
323     snprintf(path, sizeof(path),
324             "/local/domain/0/device-model/%d/physmap/%"PRIx64"/start_addr",
325             xen_domid, (uint64_t)physmap->phys_offset);
326     snprintf(value, sizeof(value), "%"PRIx64, (uint64_t)physmap->start_addr);
327     if (!xs_write(state->xenstore, 0, path, value, strlen(value))) {
328         return -1;
329     }
330     snprintf(path, sizeof(path),
331             "/local/domain/0/device-model/%d/physmap/%"PRIx64"/size",
332             xen_domid, (uint64_t)physmap->phys_offset);
333     snprintf(value, sizeof(value), "%"PRIx64, (uint64_t)physmap->size);
334     if (!xs_write(state->xenstore, 0, path, value, strlen(value))) {
335         return -1;
336     }
337     if (physmap->name) {
338         snprintf(path, sizeof(path),
339                 "/local/domain/0/device-model/%d/physmap/%"PRIx64"/name",
340                 xen_domid, (uint64_t)physmap->phys_offset);
341         if (!xs_write(state->xenstore, 0, path,
342                       physmap->name, strlen(physmap->name))) {
343             return -1;
344         }
345     }
346     return 0;
347 }
348 #else
349 static int xen_save_physmap(XenIOState *state, XenPhysmap *physmap)
350 {
351     return 0;
352 }
353 #endif
354 
355 static int xen_add_to_physmap(XenIOState *state,
356                               hwaddr start_addr,
357                               ram_addr_t size,
358                               MemoryRegion *mr,
359                               hwaddr offset_within_region)
360 {
361     unsigned long nr_pages;
362     int rc = 0;
363     XenPhysmap *physmap = NULL;
364     hwaddr pfn, start_gpfn;
365     hwaddr phys_offset = memory_region_get_ram_addr(mr);
366     const char *mr_name;
367 
368     if (get_physmapping(start_addr, size)) {
369         return 0;
370     }
371     if (size <= 0) {
372         return -1;
373     }
374 
375     /* Xen can only handle a single dirty log region for now and we want
376      * the linear framebuffer to be that region.
377      * Avoid tracking any regions that is not videoram and avoid tracking
378      * the legacy vga region. */
379     if (mr == framebuffer && start_addr > 0xbffff) {
380         goto go_physmap;
381     }
382     return -1;
383 
384 go_physmap:
385     DPRINTF("mapping vram to %"HWADDR_PRIx" - %"HWADDR_PRIx"\n",
386             start_addr, start_addr + size);
387 
388     mr_name = memory_region_name(mr);
389 
390     physmap = g_malloc(sizeof(XenPhysmap));
391 
392     physmap->start_addr = start_addr;
393     physmap->size = size;
394     physmap->name = mr_name;
395     physmap->phys_offset = phys_offset;
396 
397     QLIST_INSERT_HEAD(&xen_physmap, physmap, list);
398 
399     if (runstate_check(RUN_STATE_INMIGRATE)) {
400         /* Now when we have a physmap entry we can replace a dummy mapping with
401          * a real one of guest foreign memory. */
402         uint8_t *p = xen_replace_cache_entry(phys_offset, start_addr, size);
403         assert(p && p == memory_region_get_ram_ptr(mr));
404 
405         return 0;
406     }
407 
408     pfn = phys_offset >> TARGET_PAGE_BITS;
409     start_gpfn = start_addr >> TARGET_PAGE_BITS;
410     nr_pages = size >> TARGET_PAGE_BITS;
411     rc = xendevicemodel_relocate_memory(xen_dmod, xen_domid, nr_pages, pfn,
412                                         start_gpfn);
413     if (rc) {
414         int saved_errno = errno;
415 
416         error_report("relocate_memory %lu pages from GFN %"HWADDR_PRIx
417                      " to GFN %"HWADDR_PRIx" failed: %s",
418                      nr_pages, pfn, start_gpfn, strerror(saved_errno));
419         errno = saved_errno;
420         return -1;
421     }
422 
423     rc = xendevicemodel_pin_memory_cacheattr(xen_dmod, xen_domid,
424                                    start_addr >> TARGET_PAGE_BITS,
425                                    (start_addr + size - 1) >> TARGET_PAGE_BITS,
426                                    XEN_DOMCTL_MEM_CACHEATTR_WB);
427     if (rc) {
428         error_report("pin_memory_cacheattr failed: %s", strerror(errno));
429     }
430     return xen_save_physmap(state, physmap);
431 }
432 
433 static int xen_remove_from_physmap(XenIOState *state,
434                                    hwaddr start_addr,
435                                    ram_addr_t size)
436 {
437     int rc = 0;
438     XenPhysmap *physmap = NULL;
439     hwaddr phys_offset = 0;
440 
441     physmap = get_physmapping(start_addr, size);
442     if (physmap == NULL) {
443         return -1;
444     }
445 
446     phys_offset = physmap->phys_offset;
447     size = physmap->size;
448 
449     DPRINTF("unmapping vram to %"HWADDR_PRIx" - %"HWADDR_PRIx", at "
450             "%"HWADDR_PRIx"\n", start_addr, start_addr + size, phys_offset);
451 
452     size >>= TARGET_PAGE_BITS;
453     start_addr >>= TARGET_PAGE_BITS;
454     phys_offset >>= TARGET_PAGE_BITS;
455     rc = xendevicemodel_relocate_memory(xen_dmod, xen_domid, size, start_addr,
456                                         phys_offset);
457     if (rc) {
458         int saved_errno = errno;
459 
460         error_report("relocate_memory "RAM_ADDR_FMT" pages"
461                      " from GFN %"HWADDR_PRIx
462                      " to GFN %"HWADDR_PRIx" failed: %s",
463                      size, start_addr, phys_offset, strerror(saved_errno));
464         errno = saved_errno;
465         return -1;
466     }
467 
468     QLIST_REMOVE(physmap, list);
469     if (state->log_for_dirtybit == physmap) {
470         state->log_for_dirtybit = NULL;
471         g_free(state->dirty_bitmap);
472         state->dirty_bitmap = NULL;
473     }
474     g_free(physmap);
475 
476     return 0;
477 }
478 
479 static void xen_set_memory(struct MemoryListener *listener,
480                            MemoryRegionSection *section,
481                            bool add)
482 {
483     XenIOState *state = container_of(listener, XenIOState, memory_listener);
484     hwaddr start_addr = section->offset_within_address_space;
485     ram_addr_t size = int128_get64(section->size);
486     bool log_dirty = memory_region_is_logging(section->mr, DIRTY_MEMORY_VGA);
487     hvmmem_type_t mem_type;
488 
489     if (section->mr == &ram_memory) {
490         return;
491     } else {
492         if (add) {
493             xen_map_memory_section(xen_domid, state->ioservid,
494                                    section);
495         } else {
496             xen_unmap_memory_section(xen_domid, state->ioservid,
497                                      section);
498         }
499     }
500 
501     if (!memory_region_is_ram(section->mr)) {
502         return;
503     }
504 
505     if (log_dirty != add) {
506         return;
507     }
508 
509     trace_xen_client_set_memory(start_addr, size, log_dirty);
510 
511     start_addr &= TARGET_PAGE_MASK;
512     size = TARGET_PAGE_ALIGN(size);
513 
514     if (add) {
515         if (!memory_region_is_rom(section->mr)) {
516             xen_add_to_physmap(state, start_addr, size,
517                                section->mr, section->offset_within_region);
518         } else {
519             mem_type = HVMMEM_ram_ro;
520             if (xen_set_mem_type(xen_domid, mem_type,
521                                  start_addr >> TARGET_PAGE_BITS,
522                                  size >> TARGET_PAGE_BITS)) {
523                 DPRINTF("xen_set_mem_type error, addr: "TARGET_FMT_plx"\n",
524                         start_addr);
525             }
526         }
527     } else {
528         if (xen_remove_from_physmap(state, start_addr, size) < 0) {
529             DPRINTF("physmapping does not exist at "TARGET_FMT_plx"\n", start_addr);
530         }
531     }
532 }
533 
534 static void xen_region_add(MemoryListener *listener,
535                            MemoryRegionSection *section)
536 {
537     memory_region_ref(section->mr);
538     xen_set_memory(listener, section, true);
539 }
540 
541 static void xen_region_del(MemoryListener *listener,
542                            MemoryRegionSection *section)
543 {
544     xen_set_memory(listener, section, false);
545     memory_region_unref(section->mr);
546 }
547 
548 static void xen_io_add(MemoryListener *listener,
549                        MemoryRegionSection *section)
550 {
551     XenIOState *state = container_of(listener, XenIOState, io_listener);
552     MemoryRegion *mr = section->mr;
553 
554     if (mr->ops == &unassigned_io_ops) {
555         return;
556     }
557 
558     memory_region_ref(mr);
559 
560     xen_map_io_section(xen_domid, state->ioservid, section);
561 }
562 
563 static void xen_io_del(MemoryListener *listener,
564                        MemoryRegionSection *section)
565 {
566     XenIOState *state = container_of(listener, XenIOState, io_listener);
567     MemoryRegion *mr = section->mr;
568 
569     if (mr->ops == &unassigned_io_ops) {
570         return;
571     }
572 
573     xen_unmap_io_section(xen_domid, state->ioservid, section);
574 
575     memory_region_unref(mr);
576 }
577 
578 static void xen_device_realize(DeviceListener *listener,
579                                DeviceState *dev)
580 {
581     XenIOState *state = container_of(listener, XenIOState, device_listener);
582 
583     if (object_dynamic_cast(OBJECT(dev), TYPE_PCI_DEVICE)) {
584         PCIDevice *pci_dev = PCI_DEVICE(dev);
585         XenPciDevice *xendev = g_new(XenPciDevice, 1);
586 
587         xendev->pci_dev = pci_dev;
588         xendev->sbdf = PCI_BUILD_BDF(pci_dev_bus_num(pci_dev),
589                                      pci_dev->devfn);
590         QLIST_INSERT_HEAD(&state->dev_list, xendev, entry);
591 
592         xen_map_pcidev(xen_domid, state->ioservid, pci_dev);
593     }
594 }
595 
596 static void xen_device_unrealize(DeviceListener *listener,
597                                  DeviceState *dev)
598 {
599     XenIOState *state = container_of(listener, XenIOState, device_listener);
600 
601     if (object_dynamic_cast(OBJECT(dev), TYPE_PCI_DEVICE)) {
602         PCIDevice *pci_dev = PCI_DEVICE(dev);
603         XenPciDevice *xendev, *next;
604 
605         xen_unmap_pcidev(xen_domid, state->ioservid, pci_dev);
606 
607         QLIST_FOREACH_SAFE(xendev, &state->dev_list, entry, next) {
608             if (xendev->pci_dev == pci_dev) {
609                 QLIST_REMOVE(xendev, entry);
610                 g_free(xendev);
611                 break;
612             }
613         }
614     }
615 }
616 
617 static void xen_sync_dirty_bitmap(XenIOState *state,
618                                   hwaddr start_addr,
619                                   ram_addr_t size)
620 {
621     hwaddr npages = size >> TARGET_PAGE_BITS;
622     const int width = sizeof(unsigned long) * 8;
623     size_t bitmap_size = DIV_ROUND_UP(npages, width);
624     int rc, i, j;
625     const XenPhysmap *physmap = NULL;
626 
627     physmap = get_physmapping(start_addr, size);
628     if (physmap == NULL) {
629         /* not handled */
630         return;
631     }
632 
633     if (state->log_for_dirtybit == NULL) {
634         state->log_for_dirtybit = physmap;
635         state->dirty_bitmap = g_new(unsigned long, bitmap_size);
636     } else if (state->log_for_dirtybit != physmap) {
637         /* Only one range for dirty bitmap can be tracked. */
638         return;
639     }
640 
641     rc = xen_track_dirty_vram(xen_domid, start_addr >> TARGET_PAGE_BITS,
642                               npages, state->dirty_bitmap);
643     if (rc < 0) {
644 #ifndef ENODATA
645 #define ENODATA  ENOENT
646 #endif
647         if (errno == ENODATA) {
648             memory_region_set_dirty(framebuffer, 0, size);
649             DPRINTF("xen: track_dirty_vram failed (0x" TARGET_FMT_plx
650                     ", 0x" TARGET_FMT_plx "): %s\n",
651                     start_addr, start_addr + size, strerror(errno));
652         }
653         return;
654     }
655 
656     for (i = 0; i < bitmap_size; i++) {
657         unsigned long map = state->dirty_bitmap[i];
658         while (map != 0) {
659             j = ctzl(map);
660             map &= ~(1ul << j);
661             memory_region_set_dirty(framebuffer,
662                                     (i * width + j) * TARGET_PAGE_SIZE,
663                                     TARGET_PAGE_SIZE);
664         };
665     }
666 }
667 
668 static void xen_log_start(MemoryListener *listener,
669                           MemoryRegionSection *section,
670                           int old, int new)
671 {
672     XenIOState *state = container_of(listener, XenIOState, memory_listener);
673 
674     if (new & ~old & (1 << DIRTY_MEMORY_VGA)) {
675         xen_sync_dirty_bitmap(state, section->offset_within_address_space,
676                               int128_get64(section->size));
677     }
678 }
679 
680 static void xen_log_stop(MemoryListener *listener, MemoryRegionSection *section,
681                          int old, int new)
682 {
683     XenIOState *state = container_of(listener, XenIOState, memory_listener);
684 
685     if (old & ~new & (1 << DIRTY_MEMORY_VGA)) {
686         state->log_for_dirtybit = NULL;
687         g_free(state->dirty_bitmap);
688         state->dirty_bitmap = NULL;
689         /* Disable dirty bit tracking */
690         xen_track_dirty_vram(xen_domid, 0, 0, NULL);
691     }
692 }
693 
694 static void xen_log_sync(MemoryListener *listener, MemoryRegionSection *section)
695 {
696     XenIOState *state = container_of(listener, XenIOState, memory_listener);
697 
698     xen_sync_dirty_bitmap(state, section->offset_within_address_space,
699                           int128_get64(section->size));
700 }
701 
702 static void xen_log_global_start(MemoryListener *listener)
703 {
704     if (xen_enabled()) {
705         xen_in_migration = true;
706     }
707 }
708 
709 static void xen_log_global_stop(MemoryListener *listener)
710 {
711     xen_in_migration = false;
712 }
713 
714 static MemoryListener xen_memory_listener = {
715     .region_add = xen_region_add,
716     .region_del = xen_region_del,
717     .log_start = xen_log_start,
718     .log_stop = xen_log_stop,
719     .log_sync = xen_log_sync,
720     .log_global_start = xen_log_global_start,
721     .log_global_stop = xen_log_global_stop,
722     .priority = 10,
723 };
724 
725 static MemoryListener xen_io_listener = {
726     .region_add = xen_io_add,
727     .region_del = xen_io_del,
728     .priority = 10,
729 };
730 
731 static DeviceListener xen_device_listener = {
732     .realize = xen_device_realize,
733     .unrealize = xen_device_unrealize,
734 };
735 
736 /* get the ioreq packets from share mem */
737 static ioreq_t *cpu_get_ioreq_from_shared_memory(XenIOState *state, int vcpu)
738 {
739     ioreq_t *req = xen_vcpu_ioreq(state->shared_page, vcpu);
740 
741     if (req->state != STATE_IOREQ_READY) {
742         DPRINTF("I/O request not ready: "
743                 "%x, ptr: %x, port: %"PRIx64", "
744                 "data: %"PRIx64", count: %u, size: %u\n",
745                 req->state, req->data_is_ptr, req->addr,
746                 req->data, req->count, req->size);
747         return NULL;
748     }
749 
750     xen_rmb(); /* see IOREQ_READY /then/ read contents of ioreq */
751 
752     req->state = STATE_IOREQ_INPROCESS;
753     return req;
754 }
755 
756 /* use poll to get the port notification */
757 /* ioreq_vec--out,the */
758 /* retval--the number of ioreq packet */
759 static ioreq_t *cpu_get_ioreq(XenIOState *state)
760 {
761     MachineState *ms = MACHINE(qdev_get_machine());
762     unsigned int max_cpus = ms->smp.max_cpus;
763     int i;
764     evtchn_port_t port;
765 
766     port = xenevtchn_pending(state->xce_handle);
767     if (port == state->bufioreq_local_port) {
768         timer_mod(state->buffered_io_timer,
769                 BUFFER_IO_MAX_DELAY + qemu_clock_get_ms(QEMU_CLOCK_REALTIME));
770         return NULL;
771     }
772 
773     if (port != -1) {
774         for (i = 0; i < max_cpus; i++) {
775             if (state->ioreq_local_port[i] == port) {
776                 break;
777             }
778         }
779 
780         if (i == max_cpus) {
781             hw_error("Fatal error while trying to get io event!\n");
782         }
783 
784         /* unmask the wanted port again */
785         xenevtchn_unmask(state->xce_handle, port);
786 
787         /* get the io packet from shared memory */
788         state->send_vcpu = i;
789         return cpu_get_ioreq_from_shared_memory(state, i);
790     }
791 
792     /* read error or read nothing */
793     return NULL;
794 }
795 
796 static uint32_t do_inp(uint32_t addr, unsigned long size)
797 {
798     switch (size) {
799         case 1:
800             return cpu_inb(addr);
801         case 2:
802             return cpu_inw(addr);
803         case 4:
804             return cpu_inl(addr);
805         default:
806             hw_error("inp: bad size: %04x %lx", addr, size);
807     }
808 }
809 
810 static void do_outp(uint32_t addr,
811         unsigned long size, uint32_t val)
812 {
813     switch (size) {
814         case 1:
815             return cpu_outb(addr, val);
816         case 2:
817             return cpu_outw(addr, val);
818         case 4:
819             return cpu_outl(addr, val);
820         default:
821             hw_error("outp: bad size: %04x %lx", addr, size);
822     }
823 }
824 
825 /*
826  * Helper functions which read/write an object from/to physical guest
827  * memory, as part of the implementation of an ioreq.
828  *
829  * Equivalent to
830  *   cpu_physical_memory_rw(addr + (req->df ? -1 : +1) * req->size * i,
831  *                          val, req->size, 0/1)
832  * except without the integer overflow problems.
833  */
834 static void rw_phys_req_item(hwaddr addr,
835                              ioreq_t *req, uint32_t i, void *val, int rw)
836 {
837     /* Do everything unsigned so overflow just results in a truncated result
838      * and accesses to undesired parts of guest memory, which is up
839      * to the guest */
840     hwaddr offset = (hwaddr)req->size * i;
841     if (req->df) {
842         addr -= offset;
843     } else {
844         addr += offset;
845     }
846     cpu_physical_memory_rw(addr, val, req->size, rw);
847 }
848 
849 static inline void read_phys_req_item(hwaddr addr,
850                                       ioreq_t *req, uint32_t i, void *val)
851 {
852     rw_phys_req_item(addr, req, i, val, 0);
853 }
854 static inline void write_phys_req_item(hwaddr addr,
855                                        ioreq_t *req, uint32_t i, void *val)
856 {
857     rw_phys_req_item(addr, req, i, val, 1);
858 }
859 
860 
861 static void cpu_ioreq_pio(ioreq_t *req)
862 {
863     uint32_t i;
864 
865     trace_cpu_ioreq_pio(req, req->dir, req->df, req->data_is_ptr, req->addr,
866                          req->data, req->count, req->size);
867 
868     if (req->size > sizeof(uint32_t)) {
869         hw_error("PIO: bad size (%u)", req->size);
870     }
871 
872     if (req->dir == IOREQ_READ) {
873         if (!req->data_is_ptr) {
874             req->data = do_inp(req->addr, req->size);
875             trace_cpu_ioreq_pio_read_reg(req, req->data, req->addr,
876                                          req->size);
877         } else {
878             uint32_t tmp;
879 
880             for (i = 0; i < req->count; i++) {
881                 tmp = do_inp(req->addr, req->size);
882                 write_phys_req_item(req->data, req, i, &tmp);
883             }
884         }
885     } else if (req->dir == IOREQ_WRITE) {
886         if (!req->data_is_ptr) {
887             trace_cpu_ioreq_pio_write_reg(req, req->data, req->addr,
888                                           req->size);
889             do_outp(req->addr, req->size, req->data);
890         } else {
891             for (i = 0; i < req->count; i++) {
892                 uint32_t tmp = 0;
893 
894                 read_phys_req_item(req->data, req, i, &tmp);
895                 do_outp(req->addr, req->size, tmp);
896             }
897         }
898     }
899 }
900 
901 static void cpu_ioreq_move(ioreq_t *req)
902 {
903     uint32_t i;
904 
905     trace_cpu_ioreq_move(req, req->dir, req->df, req->data_is_ptr, req->addr,
906                          req->data, req->count, req->size);
907 
908     if (req->size > sizeof(req->data)) {
909         hw_error("MMIO: bad size (%u)", req->size);
910     }
911 
912     if (!req->data_is_ptr) {
913         if (req->dir == IOREQ_READ) {
914             for (i = 0; i < req->count; i++) {
915                 read_phys_req_item(req->addr, req, i, &req->data);
916             }
917         } else if (req->dir == IOREQ_WRITE) {
918             for (i = 0; i < req->count; i++) {
919                 write_phys_req_item(req->addr, req, i, &req->data);
920             }
921         }
922     } else {
923         uint64_t tmp;
924 
925         if (req->dir == IOREQ_READ) {
926             for (i = 0; i < req->count; i++) {
927                 read_phys_req_item(req->addr, req, i, &tmp);
928                 write_phys_req_item(req->data, req, i, &tmp);
929             }
930         } else if (req->dir == IOREQ_WRITE) {
931             for (i = 0; i < req->count; i++) {
932                 read_phys_req_item(req->data, req, i, &tmp);
933                 write_phys_req_item(req->addr, req, i, &tmp);
934             }
935         }
936     }
937 }
938 
939 static void cpu_ioreq_config(XenIOState *state, ioreq_t *req)
940 {
941     uint32_t sbdf = req->addr >> 32;
942     uint32_t reg = req->addr;
943     XenPciDevice *xendev;
944 
945     if (req->size != sizeof(uint8_t) && req->size != sizeof(uint16_t) &&
946         req->size != sizeof(uint32_t)) {
947         hw_error("PCI config access: bad size (%u)", req->size);
948     }
949 
950     if (req->count != 1) {
951         hw_error("PCI config access: bad count (%u)", req->count);
952     }
953 
954     QLIST_FOREACH(xendev, &state->dev_list, entry) {
955         if (xendev->sbdf != sbdf) {
956             continue;
957         }
958 
959         if (!req->data_is_ptr) {
960             if (req->dir == IOREQ_READ) {
961                 req->data = pci_host_config_read_common(
962                     xendev->pci_dev, reg, PCI_CONFIG_SPACE_SIZE,
963                     req->size);
964                 trace_cpu_ioreq_config_read(req, xendev->sbdf, reg,
965                                             req->size, req->data);
966             } else if (req->dir == IOREQ_WRITE) {
967                 trace_cpu_ioreq_config_write(req, xendev->sbdf, reg,
968                                              req->size, req->data);
969                 pci_host_config_write_common(
970                     xendev->pci_dev, reg, PCI_CONFIG_SPACE_SIZE,
971                     req->data, req->size);
972             }
973         } else {
974             uint32_t tmp;
975 
976             if (req->dir == IOREQ_READ) {
977                 tmp = pci_host_config_read_common(
978                     xendev->pci_dev, reg, PCI_CONFIG_SPACE_SIZE,
979                     req->size);
980                 trace_cpu_ioreq_config_read(req, xendev->sbdf, reg,
981                                             req->size, tmp);
982                 write_phys_req_item(req->data, req, 0, &tmp);
983             } else if (req->dir == IOREQ_WRITE) {
984                 read_phys_req_item(req->data, req, 0, &tmp);
985                 trace_cpu_ioreq_config_write(req, xendev->sbdf, reg,
986                                              req->size, tmp);
987                 pci_host_config_write_common(
988                     xendev->pci_dev, reg, PCI_CONFIG_SPACE_SIZE,
989                     tmp, req->size);
990             }
991         }
992     }
993 }
994 
995 static void regs_to_cpu(vmware_regs_t *vmport_regs, ioreq_t *req)
996 {
997     X86CPU *cpu;
998     CPUX86State *env;
999 
1000     cpu = X86_CPU(current_cpu);
1001     env = &cpu->env;
1002     env->regs[R_EAX] = req->data;
1003     env->regs[R_EBX] = vmport_regs->ebx;
1004     env->regs[R_ECX] = vmport_regs->ecx;
1005     env->regs[R_EDX] = vmport_regs->edx;
1006     env->regs[R_ESI] = vmport_regs->esi;
1007     env->regs[R_EDI] = vmport_regs->edi;
1008 }
1009 
1010 static void regs_from_cpu(vmware_regs_t *vmport_regs)
1011 {
1012     X86CPU *cpu = X86_CPU(current_cpu);
1013     CPUX86State *env = &cpu->env;
1014 
1015     vmport_regs->ebx = env->regs[R_EBX];
1016     vmport_regs->ecx = env->regs[R_ECX];
1017     vmport_regs->edx = env->regs[R_EDX];
1018     vmport_regs->esi = env->regs[R_ESI];
1019     vmport_regs->edi = env->regs[R_EDI];
1020 }
1021 
1022 static void handle_vmport_ioreq(XenIOState *state, ioreq_t *req)
1023 {
1024     vmware_regs_t *vmport_regs;
1025 
1026     assert(state->shared_vmport_page);
1027     vmport_regs =
1028         &state->shared_vmport_page->vcpu_vmport_regs[state->send_vcpu];
1029     QEMU_BUILD_BUG_ON(sizeof(*req) < sizeof(*vmport_regs));
1030 
1031     current_cpu = state->cpu_by_vcpu_id[state->send_vcpu];
1032     regs_to_cpu(vmport_regs, req);
1033     cpu_ioreq_pio(req);
1034     regs_from_cpu(vmport_regs);
1035     current_cpu = NULL;
1036 }
1037 
1038 static void handle_ioreq(XenIOState *state, ioreq_t *req)
1039 {
1040     trace_handle_ioreq(req, req->type, req->dir, req->df, req->data_is_ptr,
1041                        req->addr, req->data, req->count, req->size);
1042 
1043     if (!req->data_is_ptr && (req->dir == IOREQ_WRITE) &&
1044             (req->size < sizeof (target_ulong))) {
1045         req->data &= ((target_ulong) 1 << (8 * req->size)) - 1;
1046     }
1047 
1048     if (req->dir == IOREQ_WRITE)
1049         trace_handle_ioreq_write(req, req->type, req->df, req->data_is_ptr,
1050                                  req->addr, req->data, req->count, req->size);
1051 
1052     switch (req->type) {
1053         case IOREQ_TYPE_PIO:
1054             cpu_ioreq_pio(req);
1055             break;
1056         case IOREQ_TYPE_COPY:
1057             cpu_ioreq_move(req);
1058             break;
1059         case IOREQ_TYPE_VMWARE_PORT:
1060             handle_vmport_ioreq(state, req);
1061             break;
1062         case IOREQ_TYPE_TIMEOFFSET:
1063             break;
1064         case IOREQ_TYPE_INVALIDATE:
1065             xen_invalidate_map_cache();
1066             break;
1067         case IOREQ_TYPE_PCI_CONFIG:
1068             cpu_ioreq_config(state, req);
1069             break;
1070         default:
1071             hw_error("Invalid ioreq type 0x%x\n", req->type);
1072     }
1073     if (req->dir == IOREQ_READ) {
1074         trace_handle_ioreq_read(req, req->type, req->df, req->data_is_ptr,
1075                                 req->addr, req->data, req->count, req->size);
1076     }
1077 }
1078 
1079 static int handle_buffered_iopage(XenIOState *state)
1080 {
1081     buffered_iopage_t *buf_page = state->buffered_io_page;
1082     buf_ioreq_t *buf_req = NULL;
1083     ioreq_t req;
1084     int qw;
1085 
1086     if (!buf_page) {
1087         return 0;
1088     }
1089 
1090     memset(&req, 0x00, sizeof(req));
1091     req.state = STATE_IOREQ_READY;
1092     req.count = 1;
1093     req.dir = IOREQ_WRITE;
1094 
1095     for (;;) {
1096         uint32_t rdptr = buf_page->read_pointer, wrptr;
1097 
1098         xen_rmb();
1099         wrptr = buf_page->write_pointer;
1100         xen_rmb();
1101         if (rdptr != buf_page->read_pointer) {
1102             continue;
1103         }
1104         if (rdptr == wrptr) {
1105             break;
1106         }
1107         buf_req = &buf_page->buf_ioreq[rdptr % IOREQ_BUFFER_SLOT_NUM];
1108         req.size = 1U << buf_req->size;
1109         req.addr = buf_req->addr;
1110         req.data = buf_req->data;
1111         req.type = buf_req->type;
1112         xen_rmb();
1113         qw = (req.size == 8);
1114         if (qw) {
1115             if (rdptr + 1 == wrptr) {
1116                 hw_error("Incomplete quad word buffered ioreq");
1117             }
1118             buf_req = &buf_page->buf_ioreq[(rdptr + 1) %
1119                                            IOREQ_BUFFER_SLOT_NUM];
1120             req.data |= ((uint64_t)buf_req->data) << 32;
1121             xen_rmb();
1122         }
1123 
1124         handle_ioreq(state, &req);
1125 
1126         /* Only req.data may get updated by handle_ioreq(), albeit even that
1127          * should not happen as such data would never make it to the guest (we
1128          * can only usefully see writes here after all).
1129          */
1130         assert(req.state == STATE_IOREQ_READY);
1131         assert(req.count == 1);
1132         assert(req.dir == IOREQ_WRITE);
1133         assert(!req.data_is_ptr);
1134 
1135         atomic_add(&buf_page->read_pointer, qw + 1);
1136     }
1137 
1138     return req.count;
1139 }
1140 
1141 static void handle_buffered_io(void *opaque)
1142 {
1143     XenIOState *state = opaque;
1144 
1145     if (handle_buffered_iopage(state)) {
1146         timer_mod(state->buffered_io_timer,
1147                 BUFFER_IO_MAX_DELAY + qemu_clock_get_ms(QEMU_CLOCK_REALTIME));
1148     } else {
1149         timer_del(state->buffered_io_timer);
1150         xenevtchn_unmask(state->xce_handle, state->bufioreq_local_port);
1151     }
1152 }
1153 
1154 static void cpu_handle_ioreq(void *opaque)
1155 {
1156     XenIOState *state = opaque;
1157     ioreq_t *req = cpu_get_ioreq(state);
1158 
1159     handle_buffered_iopage(state);
1160     if (req) {
1161         ioreq_t copy = *req;
1162 
1163         xen_rmb();
1164         handle_ioreq(state, &copy);
1165         req->data = copy.data;
1166 
1167         if (req->state != STATE_IOREQ_INPROCESS) {
1168             fprintf(stderr, "Badness in I/O request ... not in service?!: "
1169                     "%x, ptr: %x, port: %"PRIx64", "
1170                     "data: %"PRIx64", count: %u, size: %u, type: %u\n",
1171                     req->state, req->data_is_ptr, req->addr,
1172                     req->data, req->count, req->size, req->type);
1173             destroy_hvm_domain(false);
1174             return;
1175         }
1176 
1177         xen_wmb(); /* Update ioreq contents /then/ update state. */
1178 
1179         /*
1180          * We do this before we send the response so that the tools
1181          * have the opportunity to pick up on the reset before the
1182          * guest resumes and does a hlt with interrupts disabled which
1183          * causes Xen to powerdown the domain.
1184          */
1185         if (runstate_is_running()) {
1186             ShutdownCause request;
1187 
1188             if (qemu_shutdown_requested_get()) {
1189                 destroy_hvm_domain(false);
1190             }
1191             request = qemu_reset_requested_get();
1192             if (request) {
1193                 qemu_system_reset(request);
1194                 destroy_hvm_domain(true);
1195             }
1196         }
1197 
1198         req->state = STATE_IORESP_READY;
1199         xenevtchn_notify(state->xce_handle,
1200                          state->ioreq_local_port[state->send_vcpu]);
1201     }
1202 }
1203 
1204 static void xen_main_loop_prepare(XenIOState *state)
1205 {
1206     int evtchn_fd = -1;
1207 
1208     if (state->xce_handle != NULL) {
1209         evtchn_fd = xenevtchn_fd(state->xce_handle);
1210     }
1211 
1212     state->buffered_io_timer = timer_new_ms(QEMU_CLOCK_REALTIME, handle_buffered_io,
1213                                                  state);
1214 
1215     if (evtchn_fd != -1) {
1216         CPUState *cpu_state;
1217 
1218         DPRINTF("%s: Init cpu_by_vcpu_id\n", __func__);
1219         CPU_FOREACH(cpu_state) {
1220             DPRINTF("%s: cpu_by_vcpu_id[%d]=%p\n",
1221                     __func__, cpu_state->cpu_index, cpu_state);
1222             state->cpu_by_vcpu_id[cpu_state->cpu_index] = cpu_state;
1223         }
1224         qemu_set_fd_handler(evtchn_fd, cpu_handle_ioreq, NULL, state);
1225     }
1226 }
1227 
1228 
1229 static void xen_hvm_change_state_handler(void *opaque, int running,
1230                                          RunState rstate)
1231 {
1232     XenIOState *state = opaque;
1233 
1234     if (running) {
1235         xen_main_loop_prepare(state);
1236     }
1237 
1238     xen_set_ioreq_server_state(xen_domid,
1239                                state->ioservid,
1240                                (rstate == RUN_STATE_RUNNING));
1241 }
1242 
1243 static void xen_exit_notifier(Notifier *n, void *data)
1244 {
1245     XenIOState *state = container_of(n, XenIOState, exit);
1246 
1247     xenevtchn_close(state->xce_handle);
1248     xs_daemon_close(state->xenstore);
1249 }
1250 
1251 #ifdef XEN_COMPAT_PHYSMAP
1252 static void xen_read_physmap(XenIOState *state)
1253 {
1254     XenPhysmap *physmap = NULL;
1255     unsigned int len, num, i;
1256     char path[80], *value = NULL;
1257     char **entries = NULL;
1258 
1259     snprintf(path, sizeof(path),
1260             "/local/domain/0/device-model/%d/physmap", xen_domid);
1261     entries = xs_directory(state->xenstore, 0, path, &num);
1262     if (entries == NULL)
1263         return;
1264 
1265     for (i = 0; i < num; i++) {
1266         physmap = g_malloc(sizeof (XenPhysmap));
1267         physmap->phys_offset = strtoull(entries[i], NULL, 16);
1268         snprintf(path, sizeof(path),
1269                 "/local/domain/0/device-model/%d/physmap/%s/start_addr",
1270                 xen_domid, entries[i]);
1271         value = xs_read(state->xenstore, 0, path, &len);
1272         if (value == NULL) {
1273             g_free(physmap);
1274             continue;
1275         }
1276         physmap->start_addr = strtoull(value, NULL, 16);
1277         free(value);
1278 
1279         snprintf(path, sizeof(path),
1280                 "/local/domain/0/device-model/%d/physmap/%s/size",
1281                 xen_domid, entries[i]);
1282         value = xs_read(state->xenstore, 0, path, &len);
1283         if (value == NULL) {
1284             g_free(physmap);
1285             continue;
1286         }
1287         physmap->size = strtoull(value, NULL, 16);
1288         free(value);
1289 
1290         snprintf(path, sizeof(path),
1291                 "/local/domain/0/device-model/%d/physmap/%s/name",
1292                 xen_domid, entries[i]);
1293         physmap->name = xs_read(state->xenstore, 0, path, &len);
1294 
1295         QLIST_INSERT_HEAD(&xen_physmap, physmap, list);
1296     }
1297     free(entries);
1298 }
1299 #else
1300 static void xen_read_physmap(XenIOState *state)
1301 {
1302 }
1303 #endif
1304 
1305 static void xen_wakeup_notifier(Notifier *notifier, void *data)
1306 {
1307     xc_set_hvm_param(xen_xc, xen_domid, HVM_PARAM_ACPI_S_STATE, 0);
1308 }
1309 
1310 static int xen_map_ioreq_server(XenIOState *state)
1311 {
1312     void *addr = NULL;
1313     xenforeignmemory_resource_handle *fres;
1314     xen_pfn_t ioreq_pfn;
1315     xen_pfn_t bufioreq_pfn;
1316     evtchn_port_t bufioreq_evtchn;
1317     int rc;
1318 
1319     /*
1320      * Attempt to map using the resource API and fall back to normal
1321      * foreign mapping if this is not supported.
1322      */
1323     QEMU_BUILD_BUG_ON(XENMEM_resource_ioreq_server_frame_bufioreq != 0);
1324     QEMU_BUILD_BUG_ON(XENMEM_resource_ioreq_server_frame_ioreq(0) != 1);
1325     fres = xenforeignmemory_map_resource(xen_fmem, xen_domid,
1326                                          XENMEM_resource_ioreq_server,
1327                                          state->ioservid, 0, 2,
1328                                          &addr,
1329                                          PROT_READ | PROT_WRITE, 0);
1330     if (fres != NULL) {
1331         trace_xen_map_resource_ioreq(state->ioservid, addr);
1332         state->buffered_io_page = addr;
1333         state->shared_page = addr + TARGET_PAGE_SIZE;
1334     } else if (errno != EOPNOTSUPP) {
1335         error_report("failed to map ioreq server resources: error %d handle=%p",
1336                      errno, xen_xc);
1337         return -1;
1338     }
1339 
1340     rc = xen_get_ioreq_server_info(xen_domid, state->ioservid,
1341                                    (state->shared_page == NULL) ?
1342                                    &ioreq_pfn : NULL,
1343                                    (state->buffered_io_page == NULL) ?
1344                                    &bufioreq_pfn : NULL,
1345                                    &bufioreq_evtchn);
1346     if (rc < 0) {
1347         error_report("failed to get ioreq server info: error %d handle=%p",
1348                      errno, xen_xc);
1349         return rc;
1350     }
1351 
1352     if (state->shared_page == NULL) {
1353         DPRINTF("shared page at pfn %lx\n", ioreq_pfn);
1354 
1355         state->shared_page = xenforeignmemory_map(xen_fmem, xen_domid,
1356                                                   PROT_READ | PROT_WRITE,
1357                                                   1, &ioreq_pfn, NULL);
1358         if (state->shared_page == NULL) {
1359             error_report("map shared IO page returned error %d handle=%p",
1360                          errno, xen_xc);
1361         }
1362     }
1363 
1364     if (state->buffered_io_page == NULL) {
1365         DPRINTF("buffered io page at pfn %lx\n", bufioreq_pfn);
1366 
1367         state->buffered_io_page = xenforeignmemory_map(xen_fmem, xen_domid,
1368                                                        PROT_READ | PROT_WRITE,
1369                                                        1, &bufioreq_pfn,
1370                                                        NULL);
1371         if (state->buffered_io_page == NULL) {
1372             error_report("map buffered IO page returned error %d", errno);
1373             return -1;
1374         }
1375     }
1376 
1377     if (state->shared_page == NULL || state->buffered_io_page == NULL) {
1378         return -1;
1379     }
1380 
1381     DPRINTF("buffered io evtchn is %x\n", bufioreq_evtchn);
1382 
1383     state->bufioreq_remote_port = bufioreq_evtchn;
1384 
1385     return 0;
1386 }
1387 
1388 void xen_hvm_init(PCMachineState *pcms, MemoryRegion **ram_memory)
1389 {
1390     MachineState *ms = MACHINE(pcms);
1391     unsigned int max_cpus = ms->smp.max_cpus;
1392     int i, rc;
1393     xen_pfn_t ioreq_pfn;
1394     XenIOState *state;
1395 
1396     state = g_malloc0(sizeof (XenIOState));
1397 
1398     state->xce_handle = xenevtchn_open(NULL, 0);
1399     if (state->xce_handle == NULL) {
1400         perror("xen: event channel open");
1401         goto err;
1402     }
1403 
1404     state->xenstore = xs_daemon_open();
1405     if (state->xenstore == NULL) {
1406         perror("xen: xenstore open");
1407         goto err;
1408     }
1409 
1410     xen_create_ioreq_server(xen_domid, &state->ioservid);
1411 
1412     state->exit.notify = xen_exit_notifier;
1413     qemu_add_exit_notifier(&state->exit);
1414 
1415     state->suspend.notify = xen_suspend_notifier;
1416     qemu_register_suspend_notifier(&state->suspend);
1417 
1418     state->wakeup.notify = xen_wakeup_notifier;
1419     qemu_register_wakeup_notifier(&state->wakeup);
1420 
1421     /*
1422      * Register wake-up support in QMP query-current-machine API
1423      */
1424     qemu_register_wakeup_support();
1425 
1426     rc = xen_map_ioreq_server(state);
1427     if (rc < 0) {
1428         goto err;
1429     }
1430 
1431     rc = xen_get_vmport_regs_pfn(xen_xc, xen_domid, &ioreq_pfn);
1432     if (!rc) {
1433         DPRINTF("shared vmport page at pfn %lx\n", ioreq_pfn);
1434         state->shared_vmport_page =
1435             xenforeignmemory_map(xen_fmem, xen_domid, PROT_READ|PROT_WRITE,
1436                                  1, &ioreq_pfn, NULL);
1437         if (state->shared_vmport_page == NULL) {
1438             error_report("map shared vmport IO page returned error %d handle=%p",
1439                          errno, xen_xc);
1440             goto err;
1441         }
1442     } else if (rc != -ENOSYS) {
1443         error_report("get vmport regs pfn returned error %d, rc=%d",
1444                      errno, rc);
1445         goto err;
1446     }
1447 
1448     /* Note: cpus is empty at this point in init */
1449     state->cpu_by_vcpu_id = g_malloc0(max_cpus * sizeof(CPUState *));
1450 
1451     rc = xen_set_ioreq_server_state(xen_domid, state->ioservid, true);
1452     if (rc < 0) {
1453         error_report("failed to enable ioreq server info: error %d handle=%p",
1454                      errno, xen_xc);
1455         goto err;
1456     }
1457 
1458     state->ioreq_local_port = g_malloc0(max_cpus * sizeof (evtchn_port_t));
1459 
1460     /* FIXME: how about if we overflow the page here? */
1461     for (i = 0; i < max_cpus; i++) {
1462         rc = xenevtchn_bind_interdomain(state->xce_handle, xen_domid,
1463                                         xen_vcpu_eport(state->shared_page, i));
1464         if (rc == -1) {
1465             error_report("shared evtchn %d bind error %d", i, errno);
1466             goto err;
1467         }
1468         state->ioreq_local_port[i] = rc;
1469     }
1470 
1471     rc = xenevtchn_bind_interdomain(state->xce_handle, xen_domid,
1472                                     state->bufioreq_remote_port);
1473     if (rc == -1) {
1474         error_report("buffered evtchn bind error %d", errno);
1475         goto err;
1476     }
1477     state->bufioreq_local_port = rc;
1478 
1479     /* Init RAM management */
1480 #ifdef XEN_COMPAT_PHYSMAP
1481     xen_map_cache_init(xen_phys_offset_to_gaddr, state);
1482 #else
1483     xen_map_cache_init(NULL, state);
1484 #endif
1485     xen_ram_init(pcms, ram_size, ram_memory);
1486 
1487     qemu_add_vm_change_state_handler(xen_hvm_change_state_handler, state);
1488 
1489     state->memory_listener = xen_memory_listener;
1490     memory_listener_register(&state->memory_listener, &address_space_memory);
1491     state->log_for_dirtybit = NULL;
1492 
1493     state->io_listener = xen_io_listener;
1494     memory_listener_register(&state->io_listener, &address_space_io);
1495 
1496     state->device_listener = xen_device_listener;
1497     QLIST_INIT(&state->dev_list);
1498     device_listener_register(&state->device_listener);
1499 
1500     xen_bus_init();
1501 
1502     /* Initialize backend core & drivers */
1503     if (xen_be_init() != 0) {
1504         error_report("xen backend core setup failed");
1505         goto err;
1506     }
1507     xen_be_register_common();
1508 
1509     QLIST_INIT(&xen_physmap);
1510     xen_read_physmap(state);
1511 
1512     /* Disable ACPI build because Xen handles it */
1513     pcms->acpi_build_enabled = false;
1514 
1515     return;
1516 
1517 err:
1518     error_report("xen hardware virtual machine initialisation failed");
1519     exit(1);
1520 }
1521 
1522 void destroy_hvm_domain(bool reboot)
1523 {
1524     xc_interface *xc_handle;
1525     int sts;
1526     int rc;
1527 
1528     unsigned int reason = reboot ? SHUTDOWN_reboot : SHUTDOWN_poweroff;
1529 
1530     if (xen_dmod) {
1531         rc = xendevicemodel_shutdown(xen_dmod, xen_domid, reason);
1532         if (!rc) {
1533             return;
1534         }
1535         if (errno != ENOTTY /* old Xen */) {
1536             perror("xendevicemodel_shutdown failed");
1537         }
1538         /* well, try the old thing then */
1539     }
1540 
1541     xc_handle = xc_interface_open(0, 0, 0);
1542     if (xc_handle == NULL) {
1543         fprintf(stderr, "Cannot acquire xenctrl handle\n");
1544     } else {
1545         sts = xc_domain_shutdown(xc_handle, xen_domid, reason);
1546         if (sts != 0) {
1547             fprintf(stderr, "xc_domain_shutdown failed to issue %s, "
1548                     "sts %d, %s\n", reboot ? "reboot" : "poweroff",
1549                     sts, strerror(errno));
1550         } else {
1551             fprintf(stderr, "Issued domain %d %s\n", xen_domid,
1552                     reboot ? "reboot" : "poweroff");
1553         }
1554         xc_interface_close(xc_handle);
1555     }
1556 }
1557 
1558 void xen_register_framebuffer(MemoryRegion *mr)
1559 {
1560     framebuffer = mr;
1561 }
1562 
1563 void xen_shutdown_fatal_error(const char *fmt, ...)
1564 {
1565     va_list ap;
1566 
1567     va_start(ap, fmt);
1568     vfprintf(stderr, fmt, ap);
1569     va_end(ap);
1570     fprintf(stderr, "Will destroy the domain.\n");
1571     /* destroy the domain */
1572     qemu_system_shutdown_request(SHUTDOWN_CAUSE_HOST_ERROR);
1573 }
1574 
1575 void xen_hvm_modified_memory(ram_addr_t start, ram_addr_t length)
1576 {
1577     if (unlikely(xen_in_migration)) {
1578         int rc;
1579         ram_addr_t start_pfn, nb_pages;
1580 
1581         start = xen_phys_offset_to_gaddr(start, length);
1582 
1583         if (length == 0) {
1584             length = TARGET_PAGE_SIZE;
1585         }
1586         start_pfn = start >> TARGET_PAGE_BITS;
1587         nb_pages = ((start + length + TARGET_PAGE_SIZE - 1) >> TARGET_PAGE_BITS)
1588             - start_pfn;
1589         rc = xen_modified_memory(xen_domid, start_pfn, nb_pages);
1590         if (rc) {
1591             fprintf(stderr,
1592                     "%s failed for "RAM_ADDR_FMT" ("RAM_ADDR_FMT"): %i, %s\n",
1593                     __func__, start, nb_pages, errno, strerror(errno));
1594         }
1595     }
1596 }
1597 
1598 void qmp_xen_set_global_dirty_log(bool enable, Error **errp)
1599 {
1600     if (enable) {
1601         memory_global_dirty_log_start();
1602     } else {
1603         memory_global_dirty_log_stop();
1604     }
1605 }
1606