1 /* 2 * Copyright (c) 2007, Neocleus Corporation. 3 * Copyright (c) 2007, Intel Corporation. 4 * 5 * This work is licensed under the terms of the GNU GPL, version 2. See 6 * the COPYING file in the top-level directory. 7 * 8 * Alex Novik <alex@neocleus.com> 9 * Allen Kay <allen.m.kay@intel.com> 10 * Guy Zana <guy@neocleus.com> 11 * 12 * This file implements direct PCI assignment to a HVM guest 13 */ 14 15 /* 16 * Interrupt Disable policy: 17 * 18 * INTx interrupt: 19 * Initialize(register_real_device) 20 * Map INTx(xc_physdev_map_pirq): 21 * <fail> 22 * - Set real Interrupt Disable bit to '1'. 23 * - Set machine_irq and assigned_device->machine_irq to '0'. 24 * * Don't bind INTx. 25 * 26 * Bind INTx(xc_domain_bind_pt_pci_irq): 27 * <fail> 28 * - Set real Interrupt Disable bit to '1'. 29 * - Unmap INTx. 30 * - Decrement xen_pt_mapped_machine_irq[machine_irq] 31 * - Set assigned_device->machine_irq to '0'. 32 * 33 * Write to Interrupt Disable bit by guest software(xen_pt_cmd_reg_write) 34 * Write '0' 35 * - Set real bit to '0' if assigned_device->machine_irq isn't '0'. 36 * 37 * Write '1' 38 * - Set real bit to '1'. 39 * 40 * MSI interrupt: 41 * Initialize MSI register(xen_pt_msi_setup, xen_pt_msi_update) 42 * Bind MSI(xc_domain_update_msi_irq) 43 * <fail> 44 * - Unmap MSI. 45 * - Set dev->msi->pirq to '-1'. 46 * 47 * MSI-X interrupt: 48 * Initialize MSI-X register(xen_pt_msix_update_one) 49 * Bind MSI-X(xc_domain_update_msi_irq) 50 * <fail> 51 * - Unmap MSI-X. 52 * - Set entry->pirq to '-1'. 53 */ 54 55 #include "qemu/osdep.h" 56 #include "qapi/error.h" 57 #include <sys/ioctl.h> 58 59 #include "hw/pci/pci.h" 60 #include "hw/xen/xen.h" 61 #include "hw/i386/pc.h" 62 #include "hw/xen/xen-legacy-backend.h" 63 #include "xen_pt.h" 64 #include "qemu/range.h" 65 #include "exec/address-spaces.h" 66 67 #define XEN_PT_NR_IRQS (256) 68 static uint8_t xen_pt_mapped_machine_irq[XEN_PT_NR_IRQS] = {0}; 69 70 void xen_pt_log(const PCIDevice *d, const char *f, ...) 71 { 72 va_list ap; 73 74 va_start(ap, f); 75 if (d) { 76 fprintf(stderr, "[%02x:%02x.%d] ", pci_dev_bus_num(d), 77 PCI_SLOT(d->devfn), PCI_FUNC(d->devfn)); 78 } 79 vfprintf(stderr, f, ap); 80 va_end(ap); 81 } 82 83 /* Config Space */ 84 85 static int xen_pt_pci_config_access_check(PCIDevice *d, uint32_t addr, int len) 86 { 87 /* check offset range */ 88 if (addr > 0xFF) { 89 XEN_PT_ERR(d, "Failed to access register with offset exceeding 0xFF. " 90 "(addr: 0x%02x, len: %d)\n", addr, len); 91 return -1; 92 } 93 94 /* check read size */ 95 if ((len != 1) && (len != 2) && (len != 4)) { 96 XEN_PT_ERR(d, "Failed to access register with invalid access length. " 97 "(addr: 0x%02x, len: %d)\n", addr, len); 98 return -1; 99 } 100 101 /* check offset alignment */ 102 if (addr & (len - 1)) { 103 XEN_PT_ERR(d, "Failed to access register with invalid access size " 104 "alignment. (addr: 0x%02x, len: %d)\n", addr, len); 105 return -1; 106 } 107 108 return 0; 109 } 110 111 int xen_pt_bar_offset_to_index(uint32_t offset) 112 { 113 int index = 0; 114 115 /* check Exp ROM BAR */ 116 if (offset == PCI_ROM_ADDRESS) { 117 return PCI_ROM_SLOT; 118 } 119 120 /* calculate BAR index */ 121 index = (offset - PCI_BASE_ADDRESS_0) >> 2; 122 if (index >= PCI_NUM_REGIONS) { 123 return -1; 124 } 125 126 return index; 127 } 128 129 static uint32_t xen_pt_pci_read_config(PCIDevice *d, uint32_t addr, int len) 130 { 131 XenPCIPassthroughState *s = XEN_PT_DEVICE(d); 132 uint32_t val = 0; 133 XenPTRegGroup *reg_grp_entry = NULL; 134 XenPTReg *reg_entry = NULL; 135 int rc = 0; 136 int emul_len = 0; 137 uint32_t find_addr = addr; 138 139 if (xen_pt_pci_config_access_check(d, addr, len)) { 140 goto exit; 141 } 142 143 /* find register group entry */ 144 reg_grp_entry = xen_pt_find_reg_grp(s, addr); 145 if (reg_grp_entry) { 146 /* check 0-Hardwired register group */ 147 if (reg_grp_entry->reg_grp->grp_type == XEN_PT_GRP_TYPE_HARDWIRED) { 148 /* no need to emulate, just return 0 */ 149 val = 0; 150 goto exit; 151 } 152 } 153 154 /* read I/O device register value */ 155 rc = xen_host_pci_get_block(&s->real_device, addr, (uint8_t *)&val, len); 156 if (rc < 0) { 157 XEN_PT_ERR(d, "pci_read_block failed. return value: %d.\n", rc); 158 memset(&val, 0xff, len); 159 } 160 161 /* just return the I/O device register value for 162 * passthrough type register group */ 163 if (reg_grp_entry == NULL) { 164 goto exit; 165 } 166 167 /* adjust the read value to appropriate CFC-CFF window */ 168 val <<= (addr & 3) << 3; 169 emul_len = len; 170 171 /* loop around the guest requested size */ 172 while (emul_len > 0) { 173 /* find register entry to be emulated */ 174 reg_entry = xen_pt_find_reg(reg_grp_entry, find_addr); 175 if (reg_entry) { 176 XenPTRegInfo *reg = reg_entry->reg; 177 uint32_t real_offset = reg_grp_entry->base_offset + reg->offset; 178 uint32_t valid_mask = 0xFFFFFFFF >> ((4 - emul_len) << 3); 179 uint8_t *ptr_val = NULL; 180 181 valid_mask <<= (find_addr - real_offset) << 3; 182 ptr_val = (uint8_t *)&val + (real_offset & 3); 183 184 /* do emulation based on register size */ 185 switch (reg->size) { 186 case 1: 187 if (reg->u.b.read) { 188 rc = reg->u.b.read(s, reg_entry, ptr_val, valid_mask); 189 } 190 break; 191 case 2: 192 if (reg->u.w.read) { 193 rc = reg->u.w.read(s, reg_entry, 194 (uint16_t *)ptr_val, valid_mask); 195 } 196 break; 197 case 4: 198 if (reg->u.dw.read) { 199 rc = reg->u.dw.read(s, reg_entry, 200 (uint32_t *)ptr_val, valid_mask); 201 } 202 break; 203 } 204 205 if (rc < 0) { 206 xen_shutdown_fatal_error("Internal error: Invalid read " 207 "emulation. (%s, rc: %d)\n", 208 __func__, rc); 209 return 0; 210 } 211 212 /* calculate next address to find */ 213 emul_len -= reg->size; 214 if (emul_len > 0) { 215 find_addr = real_offset + reg->size; 216 } 217 } else { 218 /* nothing to do with passthrough type register, 219 * continue to find next byte */ 220 emul_len--; 221 find_addr++; 222 } 223 } 224 225 /* need to shift back before returning them to pci bus emulator */ 226 val >>= ((addr & 3) << 3); 227 228 exit: 229 XEN_PT_LOG_CONFIG(d, addr, val, len); 230 return val; 231 } 232 233 static void xen_pt_pci_write_config(PCIDevice *d, uint32_t addr, 234 uint32_t val, int len) 235 { 236 XenPCIPassthroughState *s = XEN_PT_DEVICE(d); 237 int index = 0; 238 XenPTRegGroup *reg_grp_entry = NULL; 239 int rc = 0; 240 uint32_t read_val = 0, wb_mask; 241 int emul_len = 0; 242 XenPTReg *reg_entry = NULL; 243 uint32_t find_addr = addr; 244 XenPTRegInfo *reg = NULL; 245 bool wp_flag = false; 246 247 if (xen_pt_pci_config_access_check(d, addr, len)) { 248 return; 249 } 250 251 XEN_PT_LOG_CONFIG(d, addr, val, len); 252 253 /* check unused BAR register */ 254 index = xen_pt_bar_offset_to_index(addr); 255 if ((index >= 0) && (val != 0)) { 256 uint32_t chk = val; 257 258 if (index == PCI_ROM_SLOT) 259 chk |= (uint32_t)~PCI_ROM_ADDRESS_MASK; 260 261 if ((chk != XEN_PT_BAR_ALLF) && 262 (s->bases[index].bar_flag == XEN_PT_BAR_FLAG_UNUSED)) { 263 XEN_PT_WARN(d, "Guest attempt to set address to unused " 264 "Base Address Register. (addr: 0x%02x, len: %d)\n", 265 addr, len); 266 } 267 } 268 269 /* find register group entry */ 270 reg_grp_entry = xen_pt_find_reg_grp(s, addr); 271 if (reg_grp_entry) { 272 /* check 0-Hardwired register group */ 273 if (reg_grp_entry->reg_grp->grp_type == XEN_PT_GRP_TYPE_HARDWIRED) { 274 /* ignore silently */ 275 XEN_PT_WARN(d, "Access to 0-Hardwired register. " 276 "(addr: 0x%02x, len: %d)\n", addr, len); 277 return; 278 } 279 } 280 281 rc = xen_host_pci_get_block(&s->real_device, addr, 282 (uint8_t *)&read_val, len); 283 if (rc < 0) { 284 XEN_PT_ERR(d, "pci_read_block failed. return value: %d.\n", rc); 285 memset(&read_val, 0xff, len); 286 wb_mask = 0; 287 } else { 288 wb_mask = 0xFFFFFFFF >> ((4 - len) << 3); 289 } 290 291 /* pass directly to the real device for passthrough type register group */ 292 if (reg_grp_entry == NULL) { 293 if (!s->permissive) { 294 wb_mask = 0; 295 wp_flag = true; 296 } 297 goto out; 298 } 299 300 memory_region_transaction_begin(); 301 pci_default_write_config(d, addr, val, len); 302 303 /* adjust the read and write value to appropriate CFC-CFF window */ 304 read_val <<= (addr & 3) << 3; 305 val <<= (addr & 3) << 3; 306 emul_len = len; 307 308 /* loop around the guest requested size */ 309 while (emul_len > 0) { 310 /* find register entry to be emulated */ 311 reg_entry = xen_pt_find_reg(reg_grp_entry, find_addr); 312 if (reg_entry) { 313 reg = reg_entry->reg; 314 uint32_t real_offset = reg_grp_entry->base_offset + reg->offset; 315 uint32_t valid_mask = 0xFFFFFFFF >> ((4 - emul_len) << 3); 316 uint8_t *ptr_val = NULL; 317 uint32_t wp_mask = reg->emu_mask | reg->ro_mask; 318 319 valid_mask <<= (find_addr - real_offset) << 3; 320 ptr_val = (uint8_t *)&val + (real_offset & 3); 321 if (!s->permissive) { 322 wp_mask |= reg->res_mask; 323 } 324 if (wp_mask == (0xFFFFFFFF >> ((4 - reg->size) << 3))) { 325 wb_mask &= ~((wp_mask >> ((find_addr - real_offset) << 3)) 326 << ((len - emul_len) << 3)); 327 } 328 329 /* do emulation based on register size */ 330 switch (reg->size) { 331 case 1: 332 if (reg->u.b.write) { 333 rc = reg->u.b.write(s, reg_entry, ptr_val, 334 read_val >> ((real_offset & 3) << 3), 335 valid_mask); 336 } 337 break; 338 case 2: 339 if (reg->u.w.write) { 340 rc = reg->u.w.write(s, reg_entry, (uint16_t *)ptr_val, 341 (read_val >> ((real_offset & 3) << 3)), 342 valid_mask); 343 } 344 break; 345 case 4: 346 if (reg->u.dw.write) { 347 rc = reg->u.dw.write(s, reg_entry, (uint32_t *)ptr_val, 348 (read_val >> ((real_offset & 3) << 3)), 349 valid_mask); 350 } 351 break; 352 } 353 354 if (rc < 0) { 355 xen_shutdown_fatal_error("Internal error: Invalid write" 356 " emulation. (%s, rc: %d)\n", 357 __func__, rc); 358 return; 359 } 360 361 /* calculate next address to find */ 362 emul_len -= reg->size; 363 if (emul_len > 0) { 364 find_addr = real_offset + reg->size; 365 } 366 } else { 367 /* nothing to do with passthrough type register, 368 * continue to find next byte */ 369 if (!s->permissive) { 370 wb_mask &= ~(0xff << ((len - emul_len) << 3)); 371 /* Unused BARs will make it here, but we don't want to issue 372 * warnings for writes to them (bogus writes get dealt with 373 * above). 374 */ 375 if (index < 0) { 376 wp_flag = true; 377 } 378 } 379 emul_len--; 380 find_addr++; 381 } 382 } 383 384 /* need to shift back before passing them to xen_host_pci_set_block. */ 385 val >>= (addr & 3) << 3; 386 387 memory_region_transaction_commit(); 388 389 out: 390 if (wp_flag && !s->permissive_warned) { 391 s->permissive_warned = true; 392 xen_pt_log(d, "Write-back to unknown field 0x%02x (partially) inhibited (0x%0*x)\n", 393 addr, len * 2, wb_mask); 394 xen_pt_log(d, "If the device doesn't work, try enabling permissive mode\n"); 395 xen_pt_log(d, "(unsafe) and if it helps report the problem to xen-devel\n"); 396 } 397 for (index = 0; wb_mask; index += len) { 398 /* unknown regs are passed through */ 399 while (!(wb_mask & 0xff)) { 400 index++; 401 wb_mask >>= 8; 402 } 403 len = 0; 404 do { 405 len++; 406 wb_mask >>= 8; 407 } while (wb_mask & 0xff); 408 rc = xen_host_pci_set_block(&s->real_device, addr + index, 409 (uint8_t *)&val + index, len); 410 411 if (rc < 0) { 412 XEN_PT_ERR(d, "xen_host_pci_set_block failed. return value: %d.\n", rc); 413 } 414 } 415 } 416 417 /* register regions */ 418 419 static uint64_t xen_pt_bar_read(void *o, hwaddr addr, 420 unsigned size) 421 { 422 PCIDevice *d = o; 423 /* if this function is called, that probably means that there is a 424 * misconfiguration of the IOMMU. */ 425 XEN_PT_ERR(d, "Should not read BAR through QEMU. @0x"TARGET_FMT_plx"\n", 426 addr); 427 return 0; 428 } 429 static void xen_pt_bar_write(void *o, hwaddr addr, uint64_t val, 430 unsigned size) 431 { 432 PCIDevice *d = o; 433 /* Same comment as xen_pt_bar_read function */ 434 XEN_PT_ERR(d, "Should not write BAR through QEMU. @0x"TARGET_FMT_plx"\n", 435 addr); 436 } 437 438 static const MemoryRegionOps ops = { 439 .endianness = DEVICE_NATIVE_ENDIAN, 440 .read = xen_pt_bar_read, 441 .write = xen_pt_bar_write, 442 }; 443 444 static int xen_pt_register_regions(XenPCIPassthroughState *s, uint16_t *cmd) 445 { 446 int i = 0; 447 XenHostPCIDevice *d = &s->real_device; 448 449 /* Register PIO/MMIO BARs */ 450 for (i = 0; i < PCI_ROM_SLOT; i++) { 451 XenHostPCIIORegion *r = &d->io_regions[i]; 452 uint8_t type; 453 454 if (r->base_addr == 0 || r->size == 0) { 455 continue; 456 } 457 458 s->bases[i].access.u = r->base_addr; 459 460 if (r->type & XEN_HOST_PCI_REGION_TYPE_IO) { 461 type = PCI_BASE_ADDRESS_SPACE_IO; 462 *cmd |= PCI_COMMAND_IO; 463 } else { 464 type = PCI_BASE_ADDRESS_SPACE_MEMORY; 465 if (r->type & XEN_HOST_PCI_REGION_TYPE_PREFETCH) { 466 type |= PCI_BASE_ADDRESS_MEM_PREFETCH; 467 } 468 if (r->type & XEN_HOST_PCI_REGION_TYPE_MEM_64) { 469 type |= PCI_BASE_ADDRESS_MEM_TYPE_64; 470 } 471 *cmd |= PCI_COMMAND_MEMORY; 472 } 473 474 memory_region_init_io(&s->bar[i], OBJECT(s), &ops, &s->dev, 475 "xen-pci-pt-bar", r->size); 476 pci_register_bar(&s->dev, i, type, &s->bar[i]); 477 478 XEN_PT_LOG(&s->dev, "IO region %i registered (size=0x%08"PRIx64 479 " base_addr=0x%08"PRIx64" type: %#x)\n", 480 i, r->size, r->base_addr, type); 481 } 482 483 /* Register expansion ROM address */ 484 if (d->rom.base_addr && d->rom.size) { 485 uint32_t bar_data = 0; 486 487 /* Re-set BAR reported by OS, otherwise ROM can't be read. */ 488 if (xen_host_pci_get_long(d, PCI_ROM_ADDRESS, &bar_data)) { 489 return 0; 490 } 491 if ((bar_data & PCI_ROM_ADDRESS_MASK) == 0) { 492 bar_data |= d->rom.base_addr & PCI_ROM_ADDRESS_MASK; 493 xen_host_pci_set_long(d, PCI_ROM_ADDRESS, bar_data); 494 } 495 496 s->bases[PCI_ROM_SLOT].access.maddr = d->rom.base_addr; 497 498 memory_region_init_io(&s->rom, OBJECT(s), &ops, &s->dev, 499 "xen-pci-pt-rom", d->rom.size); 500 pci_register_bar(&s->dev, PCI_ROM_SLOT, PCI_BASE_ADDRESS_MEM_PREFETCH, 501 &s->rom); 502 503 XEN_PT_LOG(&s->dev, "Expansion ROM registered (size=0x%08"PRIx64 504 " base_addr=0x%08"PRIx64")\n", 505 d->rom.size, d->rom.base_addr); 506 } 507 508 xen_pt_register_vga_regions(d); 509 return 0; 510 } 511 512 /* region mapping */ 513 514 static int xen_pt_bar_from_region(XenPCIPassthroughState *s, MemoryRegion *mr) 515 { 516 int i = 0; 517 518 for (i = 0; i < PCI_NUM_REGIONS - 1; i++) { 519 if (mr == &s->bar[i]) { 520 return i; 521 } 522 } 523 if (mr == &s->rom) { 524 return PCI_ROM_SLOT; 525 } 526 return -1; 527 } 528 529 /* 530 * This function checks if an io_region overlaps an io_region from another 531 * device. The io_region to check is provided with (addr, size and type) 532 * A callback can be provided and will be called for every region that is 533 * overlapped. 534 * The return value indicates if the region is overlappsed */ 535 struct CheckBarArgs { 536 XenPCIPassthroughState *s; 537 pcibus_t addr; 538 pcibus_t size; 539 uint8_t type; 540 bool rc; 541 }; 542 static void xen_pt_check_bar_overlap(PCIBus *bus, PCIDevice *d, void *opaque) 543 { 544 struct CheckBarArgs *arg = opaque; 545 XenPCIPassthroughState *s = arg->s; 546 uint8_t type = arg->type; 547 int i; 548 549 if (d->devfn == s->dev.devfn) { 550 return; 551 } 552 553 /* xxx: This ignores bridges. */ 554 for (i = 0; i < PCI_NUM_REGIONS; i++) { 555 const PCIIORegion *r = &d->io_regions[i]; 556 557 if (!r->size) { 558 continue; 559 } 560 if ((type & PCI_BASE_ADDRESS_SPACE_IO) 561 != (r->type & PCI_BASE_ADDRESS_SPACE_IO)) { 562 continue; 563 } 564 565 if (ranges_overlap(arg->addr, arg->size, r->addr, r->size)) { 566 XEN_PT_WARN(&s->dev, 567 "Overlapped to device [%02x:%02x.%d] Region: %i" 568 " (addr: %#"FMT_PCIBUS", len: %#"FMT_PCIBUS")\n", 569 pci_bus_num(bus), PCI_SLOT(d->devfn), 570 PCI_FUNC(d->devfn), i, r->addr, r->size); 571 arg->rc = true; 572 } 573 } 574 } 575 576 static void xen_pt_region_update(XenPCIPassthroughState *s, 577 MemoryRegionSection *sec, bool adding) 578 { 579 PCIDevice *d = &s->dev; 580 MemoryRegion *mr = sec->mr; 581 int bar = -1; 582 int rc; 583 int op = adding ? DPCI_ADD_MAPPING : DPCI_REMOVE_MAPPING; 584 struct CheckBarArgs args = { 585 .s = s, 586 .addr = sec->offset_within_address_space, 587 .size = int128_get64(sec->size), 588 .rc = false, 589 }; 590 591 bar = xen_pt_bar_from_region(s, mr); 592 if (bar == -1 && (!s->msix || &s->msix->mmio != mr)) { 593 return; 594 } 595 596 if (s->msix && &s->msix->mmio == mr) { 597 if (adding) { 598 s->msix->mmio_base_addr = sec->offset_within_address_space; 599 rc = xen_pt_msix_update_remap(s, s->msix->bar_index); 600 } 601 return; 602 } 603 604 args.type = d->io_regions[bar].type; 605 pci_for_each_device(pci_get_bus(d), pci_dev_bus_num(d), 606 xen_pt_check_bar_overlap, &args); 607 if (args.rc) { 608 XEN_PT_WARN(d, "Region: %d (addr: %#"FMT_PCIBUS 609 ", len: %#"FMT_PCIBUS") is overlapped.\n", 610 bar, sec->offset_within_address_space, 611 int128_get64(sec->size)); 612 } 613 614 if (d->io_regions[bar].type & PCI_BASE_ADDRESS_SPACE_IO) { 615 uint32_t guest_port = sec->offset_within_address_space; 616 uint32_t machine_port = s->bases[bar].access.pio_base; 617 uint32_t size = int128_get64(sec->size); 618 rc = xc_domain_ioport_mapping(xen_xc, xen_domid, 619 guest_port, machine_port, size, 620 op); 621 if (rc) { 622 XEN_PT_ERR(d, "%s ioport mapping failed! (err: %i)\n", 623 adding ? "create new" : "remove old", errno); 624 } 625 } else { 626 pcibus_t guest_addr = sec->offset_within_address_space; 627 pcibus_t machine_addr = s->bases[bar].access.maddr 628 + sec->offset_within_region; 629 pcibus_t size = int128_get64(sec->size); 630 rc = xc_domain_memory_mapping(xen_xc, xen_domid, 631 XEN_PFN(guest_addr + XC_PAGE_SIZE - 1), 632 XEN_PFN(machine_addr + XC_PAGE_SIZE - 1), 633 XEN_PFN(size + XC_PAGE_SIZE - 1), 634 op); 635 if (rc) { 636 XEN_PT_ERR(d, "%s mem mapping failed! (err: %i)\n", 637 adding ? "create new" : "remove old", errno); 638 } 639 } 640 } 641 642 static void xen_pt_region_add(MemoryListener *l, MemoryRegionSection *sec) 643 { 644 XenPCIPassthroughState *s = container_of(l, XenPCIPassthroughState, 645 memory_listener); 646 647 memory_region_ref(sec->mr); 648 xen_pt_region_update(s, sec, true); 649 } 650 651 static void xen_pt_region_del(MemoryListener *l, MemoryRegionSection *sec) 652 { 653 XenPCIPassthroughState *s = container_of(l, XenPCIPassthroughState, 654 memory_listener); 655 656 xen_pt_region_update(s, sec, false); 657 memory_region_unref(sec->mr); 658 } 659 660 static void xen_pt_io_region_add(MemoryListener *l, MemoryRegionSection *sec) 661 { 662 XenPCIPassthroughState *s = container_of(l, XenPCIPassthroughState, 663 io_listener); 664 665 memory_region_ref(sec->mr); 666 xen_pt_region_update(s, sec, true); 667 } 668 669 static void xen_pt_io_region_del(MemoryListener *l, MemoryRegionSection *sec) 670 { 671 XenPCIPassthroughState *s = container_of(l, XenPCIPassthroughState, 672 io_listener); 673 674 xen_pt_region_update(s, sec, false); 675 memory_region_unref(sec->mr); 676 } 677 678 static const MemoryListener xen_pt_memory_listener = { 679 .region_add = xen_pt_region_add, 680 .region_del = xen_pt_region_del, 681 .priority = 10, 682 }; 683 684 static const MemoryListener xen_pt_io_listener = { 685 .region_add = xen_pt_io_region_add, 686 .region_del = xen_pt_io_region_del, 687 .priority = 10, 688 }; 689 690 static void 691 xen_igd_passthrough_isa_bridge_create(XenPCIPassthroughState *s, 692 XenHostPCIDevice *dev) 693 { 694 uint16_t gpu_dev_id; 695 PCIDevice *d = &s->dev; 696 697 gpu_dev_id = dev->device_id; 698 igd_passthrough_isa_bridge_create(pci_get_bus(d), gpu_dev_id); 699 } 700 701 /* destroy. */ 702 static void xen_pt_destroy(PCIDevice *d) { 703 704 XenPCIPassthroughState *s = XEN_PT_DEVICE(d); 705 XenHostPCIDevice *host_dev = &s->real_device; 706 uint8_t machine_irq = s->machine_irq; 707 uint8_t intx; 708 int rc; 709 710 if (machine_irq && !xen_host_pci_device_closed(&s->real_device)) { 711 intx = xen_pt_pci_intx(s); 712 rc = xc_domain_unbind_pt_irq(xen_xc, xen_domid, machine_irq, 713 PT_IRQ_TYPE_PCI, 714 pci_dev_bus_num(d), 715 PCI_SLOT(s->dev.devfn), 716 intx, 717 0 /* isa_irq */); 718 if (rc < 0) { 719 XEN_PT_ERR(d, "unbinding of interrupt INT%c failed." 720 " (machine irq: %i, err: %d)" 721 " But bravely continuing on..\n", 722 'a' + intx, machine_irq, errno); 723 } 724 } 725 726 /* N.B. xen_pt_config_delete takes care of freeing them. */ 727 if (s->msi) { 728 xen_pt_msi_disable(s); 729 } 730 if (s->msix) { 731 xen_pt_msix_disable(s); 732 } 733 734 if (machine_irq) { 735 xen_pt_mapped_machine_irq[machine_irq]--; 736 737 if (xen_pt_mapped_machine_irq[machine_irq] == 0) { 738 rc = xc_physdev_unmap_pirq(xen_xc, xen_domid, machine_irq); 739 740 if (rc < 0) { 741 XEN_PT_ERR(d, "unmapping of interrupt %i failed. (err: %d)" 742 " But bravely continuing on..\n", 743 machine_irq, errno); 744 } 745 } 746 s->machine_irq = 0; 747 } 748 749 /* delete all emulated config registers */ 750 xen_pt_config_delete(s); 751 752 xen_pt_unregister_vga_regions(host_dev); 753 754 if (s->listener_set) { 755 memory_listener_unregister(&s->memory_listener); 756 memory_listener_unregister(&s->io_listener); 757 s->listener_set = false; 758 } 759 if (!xen_host_pci_device_closed(&s->real_device)) { 760 xen_host_pci_device_put(&s->real_device); 761 } 762 } 763 /* init */ 764 765 static void xen_pt_realize(PCIDevice *d, Error **errp) 766 { 767 XenPCIPassthroughState *s = XEN_PT_DEVICE(d); 768 int i, rc = 0; 769 uint8_t machine_irq = 0, scratch; 770 uint16_t cmd = 0; 771 int pirq = XEN_PT_UNASSIGNED_PIRQ; 772 Error *err = NULL; 773 774 /* register real device */ 775 XEN_PT_LOG(d, "Assigning real physical device %02x:%02x.%d" 776 " to devfn %#x\n", 777 s->hostaddr.bus, s->hostaddr.slot, s->hostaddr.function, 778 s->dev.devfn); 779 780 xen_host_pci_device_get(&s->real_device, 781 s->hostaddr.domain, s->hostaddr.bus, 782 s->hostaddr.slot, s->hostaddr.function, 783 &err); 784 if (err) { 785 error_append_hint(&err, "Failed to \"open\" the real pci device"); 786 error_propagate(errp, err); 787 return; 788 } 789 790 s->is_virtfn = s->real_device.is_virtfn; 791 if (s->is_virtfn) { 792 XEN_PT_LOG(d, "%04x:%02x:%02x.%d is a SR-IOV Virtual Function\n", 793 s->real_device.domain, s->real_device.bus, 794 s->real_device.dev, s->real_device.func); 795 } 796 797 /* Initialize virtualized PCI configuration (Extended 256 Bytes) */ 798 memset(d->config, 0, PCI_CONFIG_SPACE_SIZE); 799 800 s->memory_listener = xen_pt_memory_listener; 801 s->io_listener = xen_pt_io_listener; 802 803 /* Setup VGA bios for passthrough GFX */ 804 if ((s->real_device.domain == 0) && (s->real_device.bus == 0) && 805 (s->real_device.dev == 2) && (s->real_device.func == 0)) { 806 if (!is_igd_vga_passthrough(&s->real_device)) { 807 error_setg(errp, "Need to enable igd-passthru if you're trying" 808 " to passthrough IGD GFX"); 809 xen_host_pci_device_put(&s->real_device); 810 return; 811 } 812 813 xen_pt_setup_vga(s, &s->real_device, &err); 814 if (err) { 815 error_append_hint(&err, "Setup VGA BIOS of passthrough" 816 " GFX failed"); 817 error_propagate(errp, err); 818 xen_host_pci_device_put(&s->real_device); 819 return; 820 } 821 822 /* Register ISA bridge for passthrough GFX. */ 823 xen_igd_passthrough_isa_bridge_create(s, &s->real_device); 824 } 825 826 /* Handle real device's MMIO/PIO BARs */ 827 xen_pt_register_regions(s, &cmd); 828 829 /* reinitialize each config register to be emulated */ 830 xen_pt_config_init(s, &err); 831 if (err) { 832 error_append_hint(&err, "PCI Config space initialisation failed"); 833 error_propagate(errp, err); 834 rc = -1; 835 goto err_out; 836 } 837 838 /* Bind interrupt */ 839 rc = xen_host_pci_get_byte(&s->real_device, PCI_INTERRUPT_PIN, &scratch); 840 if (rc) { 841 error_setg_errno(errp, errno, "Failed to read PCI_INTERRUPT_PIN"); 842 goto err_out; 843 } 844 if (!scratch) { 845 XEN_PT_LOG(d, "no pin interrupt\n"); 846 goto out; 847 } 848 849 machine_irq = s->real_device.irq; 850 if (machine_irq == 0) { 851 XEN_PT_LOG(d, "machine irq is 0\n"); 852 cmd |= PCI_COMMAND_INTX_DISABLE; 853 goto out; 854 } 855 856 rc = xc_physdev_map_pirq(xen_xc, xen_domid, machine_irq, &pirq); 857 if (rc < 0) { 858 error_setg_errno(errp, errno, "Mapping machine irq %u to" 859 " pirq %i failed", machine_irq, pirq); 860 861 /* Disable PCI intx assertion (turn on bit10 of devctl) */ 862 cmd |= PCI_COMMAND_INTX_DISABLE; 863 machine_irq = 0; 864 s->machine_irq = 0; 865 } else { 866 machine_irq = pirq; 867 s->machine_irq = pirq; 868 xen_pt_mapped_machine_irq[machine_irq]++; 869 } 870 871 /* bind machine_irq to device */ 872 if (machine_irq != 0) { 873 uint8_t e_intx = xen_pt_pci_intx(s); 874 875 rc = xc_domain_bind_pt_pci_irq(xen_xc, xen_domid, machine_irq, 876 pci_dev_bus_num(d), 877 PCI_SLOT(d->devfn), 878 e_intx); 879 if (rc < 0) { 880 error_setg_errno(errp, errno, "Binding of interrupt %u failed", 881 e_intx); 882 883 /* Disable PCI intx assertion (turn on bit10 of devctl) */ 884 cmd |= PCI_COMMAND_INTX_DISABLE; 885 xen_pt_mapped_machine_irq[machine_irq]--; 886 887 if (xen_pt_mapped_machine_irq[machine_irq] == 0) { 888 if (xc_physdev_unmap_pirq(xen_xc, xen_domid, machine_irq)) { 889 error_setg_errno(errp, errno, "Unmapping of machine" 890 " interrupt %u failed", machine_irq); 891 } 892 } 893 s->machine_irq = 0; 894 } 895 } 896 897 out: 898 if (cmd) { 899 uint16_t val; 900 901 rc = xen_host_pci_get_word(&s->real_device, PCI_COMMAND, &val); 902 if (rc) { 903 error_setg_errno(errp, errno, "Failed to read PCI_COMMAND"); 904 goto err_out; 905 } else { 906 val |= cmd; 907 rc = xen_host_pci_set_word(&s->real_device, PCI_COMMAND, val); 908 if (rc) { 909 error_setg_errno(errp, errno, "Failed to write PCI_COMMAND" 910 " val = 0x%x", val); 911 goto err_out; 912 } 913 } 914 } 915 916 memory_listener_register(&s->memory_listener, &address_space_memory); 917 memory_listener_register(&s->io_listener, &address_space_io); 918 s->listener_set = true; 919 XEN_PT_LOG(d, 920 "Real physical device %02x:%02x.%d registered successfully\n", 921 s->hostaddr.bus, s->hostaddr.slot, s->hostaddr.function); 922 923 return; 924 925 err_out: 926 for (i = 0; i < PCI_ROM_SLOT; i++) { 927 object_unparent(OBJECT(&s->bar[i])); 928 } 929 object_unparent(OBJECT(&s->rom)); 930 931 xen_pt_destroy(d); 932 assert(rc); 933 } 934 935 static void xen_pt_unregister_device(PCIDevice *d) 936 { 937 xen_pt_destroy(d); 938 } 939 940 static Property xen_pci_passthrough_properties[] = { 941 DEFINE_PROP_PCI_HOST_DEVADDR("hostaddr", XenPCIPassthroughState, hostaddr), 942 DEFINE_PROP_BOOL("permissive", XenPCIPassthroughState, permissive, false), 943 DEFINE_PROP_END_OF_LIST(), 944 }; 945 946 static void xen_pci_passthrough_instance_init(Object *obj) 947 { 948 /* QEMU_PCI_CAP_EXPRESS initialization does not depend on QEMU command 949 * line, therefore, no need to wait to realize like other devices */ 950 PCI_DEVICE(obj)->cap_present |= QEMU_PCI_CAP_EXPRESS; 951 } 952 953 static void xen_pci_passthrough_class_init(ObjectClass *klass, void *data) 954 { 955 DeviceClass *dc = DEVICE_CLASS(klass); 956 PCIDeviceClass *k = PCI_DEVICE_CLASS(klass); 957 958 k->realize = xen_pt_realize; 959 k->exit = xen_pt_unregister_device; 960 k->config_read = xen_pt_pci_read_config; 961 k->config_write = xen_pt_pci_write_config; 962 set_bit(DEVICE_CATEGORY_MISC, dc->categories); 963 dc->desc = "Assign an host PCI device with Xen"; 964 dc->props = xen_pci_passthrough_properties; 965 }; 966 967 static void xen_pci_passthrough_finalize(Object *obj) 968 { 969 XenPCIPassthroughState *s = XEN_PT_DEVICE(obj); 970 971 xen_pt_msix_delete(s); 972 } 973 974 static const TypeInfo xen_pci_passthrough_info = { 975 .name = TYPE_XEN_PT_DEVICE, 976 .parent = TYPE_PCI_DEVICE, 977 .instance_size = sizeof(XenPCIPassthroughState), 978 .instance_finalize = xen_pci_passthrough_finalize, 979 .class_init = xen_pci_passthrough_class_init, 980 .instance_init = xen_pci_passthrough_instance_init, 981 .interfaces = (InterfaceInfo[]) { 982 { INTERFACE_CONVENTIONAL_PCI_DEVICE }, 983 { INTERFACE_PCIE_DEVICE }, 984 { }, 985 }, 986 }; 987 988 static void xen_pci_passthrough_register_types(void) 989 { 990 type_register_static(&xen_pci_passthrough_info); 991 } 992 993 type_init(xen_pci_passthrough_register_types) 994