qemu/hw/kvm/pci-assign.c
<<
>>
Prefs
   1/*
   2 * Copyright (c) 2007, Neocleus Corporation.
   3 *
   4 * This work is licensed under the terms of the GNU GPL, version 2.  See
   5 * the COPYING file in the top-level directory.
   6 *
   7 *
   8 *  Assign a PCI device from the host to a guest VM.
   9 *
  10 *  This implementation uses the classic device assignment interface of KVM
  11 *  and is only available on x86 hosts. It is expected to be obsoleted by VFIO
  12 *  based device assignment.
  13 *
  14 *  Adapted for KVM (qemu-kvm) by Qumranet. QEMU version was based on qemu-kvm
  15 *  revision 4144fe9d48. See its repository for the history.
  16 *
  17 *  Copyright (c) 2007, Neocleus, Alex Novik (alex@neocleus.com)
  18 *  Copyright (c) 2007, Neocleus, Guy Zana (guy@neocleus.com)
  19 *  Copyright (C) 2008, Qumranet, Amit Shah (amit.shah@qumranet.com)
  20 *  Copyright (C) 2008, Red Hat, Amit Shah (amit.shah@redhat.com)
  21 *  Copyright (C) 2008, IBM, Muli Ben-Yehuda (muli@il.ibm.com)
  22 */
  23#include <stdio.h>
  24#include <unistd.h>
  25#include <sys/io.h>
  26#include <sys/mman.h>
  27#include <sys/types.h>
  28#include <sys/stat.h>
  29#include "hw/hw.h"
  30#include "hw/pc.h"
  31#include "qemu/error-report.h"
  32#include "ui/console.h"
  33#include "hw/loader.h"
  34#include "monitor/monitor.h"
  35#include "qemu/range.h"
  36#include "sysemu/sysemu.h"
  37#include "hw/pci/pci.h"
  38#include "hw/pci/msi.h"
  39#include "kvm_i386.h"
  40
  41#define MSIX_PAGE_SIZE 0x1000
  42
  43/* From linux/ioport.h */
  44#define IORESOURCE_IO       0x00000100  /* Resource type */
  45#define IORESOURCE_MEM      0x00000200
  46#define IORESOURCE_IRQ      0x00000400
  47#define IORESOURCE_DMA      0x00000800
  48#define IORESOURCE_PREFETCH 0x00002000  /* No side effects */
  49#define IORESOURCE_MEM_64   0x00100000
  50
  51//#define DEVICE_ASSIGNMENT_DEBUG
  52
  53#ifdef DEVICE_ASSIGNMENT_DEBUG
  54#define DEBUG(fmt, ...)                                       \
  55    do {                                                      \
  56        fprintf(stderr, "%s: " fmt, __func__ , __VA_ARGS__);  \
  57    } while (0)
  58#else
  59#define DEBUG(fmt, ...)
  60#endif
  61
  62typedef struct PCIRegion {
  63    int type;           /* Memory or port I/O */
  64    int valid;
  65    uint64_t base_addr;
  66    uint64_t size;    /* size of the region */
  67    int resource_fd;
  68} PCIRegion;
  69
  70typedef struct PCIDevRegions {
  71    uint8_t bus, dev, func; /* Bus inside domain, device and function */
  72    int irq;                /* IRQ number */
  73    uint16_t region_number; /* number of active regions */
  74
  75    /* Port I/O or MMIO Regions */
  76    PCIRegion regions[PCI_NUM_REGIONS - 1];
  77    int config_fd;
  78} PCIDevRegions;
  79
  80typedef struct AssignedDevRegion {
  81    MemoryRegion container;
  82    MemoryRegion real_iomem;
  83    union {
  84        uint8_t *r_virtbase; /* mmapped access address for memory regions */
  85        uint32_t r_baseport; /* the base guest port for I/O regions */
  86    } u;
  87    pcibus_t e_size;    /* emulated size of region in bytes */
  88    pcibus_t r_size;    /* real size of region in bytes */
  89    PCIRegion *region;
  90} AssignedDevRegion;
  91
  92#define ASSIGNED_DEVICE_PREFER_MSI_BIT  0
  93#define ASSIGNED_DEVICE_SHARE_INTX_BIT  1
  94
  95#define ASSIGNED_DEVICE_PREFER_MSI_MASK (1 << ASSIGNED_DEVICE_PREFER_MSI_BIT)
  96#define ASSIGNED_DEVICE_SHARE_INTX_MASK (1 << ASSIGNED_DEVICE_SHARE_INTX_BIT)
  97
  98typedef struct MSIXTableEntry {
  99    uint32_t addr_lo;
 100    uint32_t addr_hi;
 101    uint32_t data;
 102    uint32_t ctrl;
 103} MSIXTableEntry;
 104
 105typedef enum AssignedIRQType {
 106    ASSIGNED_IRQ_NONE = 0,
 107    ASSIGNED_IRQ_INTX_HOST_INTX,
 108    ASSIGNED_IRQ_INTX_HOST_MSI,
 109    ASSIGNED_IRQ_MSI,
 110    ASSIGNED_IRQ_MSIX
 111} AssignedIRQType;
 112
 113typedef struct AssignedDevice {
 114    PCIDevice dev;
 115    PCIHostDeviceAddress host;
 116    uint32_t dev_id;
 117    uint32_t features;
 118    int intpin;
 119    AssignedDevRegion v_addrs[PCI_NUM_REGIONS - 1];
 120    PCIDevRegions real_device;
 121    PCIINTxRoute intx_route;
 122    AssignedIRQType assigned_irq_type;
 123    struct {
 124#define ASSIGNED_DEVICE_CAP_MSI (1 << 0)
 125#define ASSIGNED_DEVICE_CAP_MSIX (1 << 1)
 126        uint32_t available;
 127#define ASSIGNED_DEVICE_MSI_ENABLED (1 << 0)
 128#define ASSIGNED_DEVICE_MSIX_ENABLED (1 << 1)
 129#define ASSIGNED_DEVICE_MSIX_MASKED (1 << 2)
 130        uint32_t state;
 131    } cap;
 132    uint8_t emulate_config_read[PCI_CONFIG_SPACE_SIZE];
 133    uint8_t emulate_config_write[PCI_CONFIG_SPACE_SIZE];
 134    int msi_virq_nr;
 135    int *msi_virq;
 136    MSIXTableEntry *msix_table;
 137    hwaddr msix_table_addr;
 138    uint16_t msix_max;
 139    MemoryRegion mmio;
 140    char *configfd_name;
 141    int32_t bootindex;
 142} AssignedDevice;
 143
 144static void assigned_dev_update_irq_routing(PCIDevice *dev);
 145
 146static void assigned_dev_load_option_rom(AssignedDevice *dev);
 147
 148static void assigned_dev_unregister_msix_mmio(AssignedDevice *dev);
 149
 150static uint64_t assigned_dev_ioport_rw(AssignedDevRegion *dev_region,
 151                                       hwaddr addr, int size,
 152                                       uint64_t *data)
 153{
 154    uint64_t val = 0;
 155    int fd = dev_region->region->resource_fd;
 156
 157    if (fd >= 0) {
 158        if (data) {
 159            DEBUG("pwrite data=%" PRIx64 ", size=%d, e_phys=" TARGET_FMT_plx
 160                  ", addr="TARGET_FMT_plx"\n", *data, size, addr, addr);
 161            if (pwrite(fd, data, size, addr) != size) {
 162                error_report("%s - pwrite failed %s",
 163                             __func__, strerror(errno));
 164            }
 165        } else {
 166            if (pread(fd, &val, size, addr) != size) {
 167                error_report("%s - pread failed %s",
 168                             __func__, strerror(errno));
 169                val = (1UL << (size * 8)) - 1;
 170            }
 171            DEBUG("pread val=%" PRIx64 ", size=%d, e_phys=" TARGET_FMT_plx
 172                  ", addr=" TARGET_FMT_plx "\n", val, size, addr, addr);
 173        }
 174    } else {
 175        uint32_t port = addr + dev_region->u.r_baseport;
 176
 177        if (data) {
 178            DEBUG("out data=%" PRIx64 ", size=%d, e_phys=" TARGET_FMT_plx
 179                  ", host=%x\n", *data, size, addr, port);
 180            switch (size) {
 181            case 1:
 182                outb(*data, port);
 183                break;
 184            case 2:
 185                outw(*data, port);
 186                break;
 187            case 4:
 188                outl(*data, port);
 189                break;
 190            }
 191        } else {
 192            switch (size) {
 193            case 1:
 194                val = inb(port);
 195                break;
 196            case 2:
 197                val = inw(port);
 198                break;
 199            case 4:
 200                val = inl(port);
 201                break;
 202            }
 203            DEBUG("in data=%" PRIx64 ", size=%d, e_phys=" TARGET_FMT_plx
 204                  ", host=%x\n", val, size, addr, port);
 205        }
 206    }
 207    return val;
 208}
 209
 210static void assigned_dev_ioport_write(void *opaque, hwaddr addr,
 211                                      uint64_t data, unsigned size)
 212{
 213    assigned_dev_ioport_rw(opaque, addr, size, &data);
 214}
 215
 216static uint64_t assigned_dev_ioport_read(void *opaque,
 217                                         hwaddr addr, unsigned size)
 218{
 219    return assigned_dev_ioport_rw(opaque, addr, size, NULL);
 220}
 221
 222static uint32_t slow_bar_readb(void *opaque, hwaddr addr)
 223{
 224    AssignedDevRegion *d = opaque;
 225    uint8_t *in = d->u.r_virtbase + addr;
 226    uint32_t r;
 227
 228    r = *in;
 229    DEBUG("slow_bar_readl addr=0x" TARGET_FMT_plx " val=0x%08x\n", addr, r);
 230
 231    return r;
 232}
 233
 234static uint32_t slow_bar_readw(void *opaque, hwaddr addr)
 235{
 236    AssignedDevRegion *d = opaque;
 237    uint16_t *in = (uint16_t *)(d->u.r_virtbase + addr);
 238    uint32_t r;
 239
 240    r = *in;
 241    DEBUG("slow_bar_readl addr=0x" TARGET_FMT_plx " val=0x%08x\n", addr, r);
 242
 243    return r;
 244}
 245
 246static uint32_t slow_bar_readl(void *opaque, hwaddr addr)
 247{
 248    AssignedDevRegion *d = opaque;
 249    uint32_t *in = (uint32_t *)(d->u.r_virtbase + addr);
 250    uint32_t r;
 251
 252    r = *in;
 253    DEBUG("slow_bar_readl addr=0x" TARGET_FMT_plx " val=0x%08x\n", addr, r);
 254
 255    return r;
 256}
 257
 258static void slow_bar_writeb(void *opaque, hwaddr addr, uint32_t val)
 259{
 260    AssignedDevRegion *d = opaque;
 261    uint8_t *out = d->u.r_virtbase + addr;
 262
 263    DEBUG("slow_bar_writeb addr=0x" TARGET_FMT_plx " val=0x%02x\n", addr, val);
 264    *out = val;
 265}
 266
 267static void slow_bar_writew(void *opaque, hwaddr addr, uint32_t val)
 268{
 269    AssignedDevRegion *d = opaque;
 270    uint16_t *out = (uint16_t *)(d->u.r_virtbase + addr);
 271
 272    DEBUG("slow_bar_writew addr=0x" TARGET_FMT_plx " val=0x%04x\n", addr, val);
 273    *out = val;
 274}
 275
 276static void slow_bar_writel(void *opaque, hwaddr addr, uint32_t val)
 277{
 278    AssignedDevRegion *d = opaque;
 279    uint32_t *out = (uint32_t *)(d->u.r_virtbase + addr);
 280
 281    DEBUG("slow_bar_writel addr=0x" TARGET_FMT_plx " val=0x%08x\n", addr, val);
 282    *out = val;
 283}
 284
 285static const MemoryRegionOps slow_bar_ops = {
 286    .old_mmio = {
 287        .read = { slow_bar_readb, slow_bar_readw, slow_bar_readl, },
 288        .write = { slow_bar_writeb, slow_bar_writew, slow_bar_writel, },
 289    },
 290    .endianness = DEVICE_NATIVE_ENDIAN,
 291};
 292
 293static void assigned_dev_iomem_setup(PCIDevice *pci_dev, int region_num,
 294                                     pcibus_t e_size)
 295{
 296    AssignedDevice *r_dev = DO_UPCAST(AssignedDevice, dev, pci_dev);
 297    AssignedDevRegion *region = &r_dev->v_addrs[region_num];
 298    PCIRegion *real_region = &r_dev->real_device.regions[region_num];
 299
 300    if (e_size > 0) {
 301        memory_region_init(&region->container, "assigned-dev-container",
 302                           e_size);
 303        memory_region_add_subregion(&region->container, 0, &region->real_iomem);
 304
 305        /* deal with MSI-X MMIO page */
 306        if (real_region->base_addr <= r_dev->msix_table_addr &&
 307                real_region->base_addr + real_region->size >
 308                r_dev->msix_table_addr) {
 309            uint64_t offset = r_dev->msix_table_addr - real_region->base_addr;
 310
 311            memory_region_add_subregion_overlap(&region->container,
 312                                                offset,
 313                                                &r_dev->mmio,
 314                                                1);
 315        }
 316    }
 317}
 318
 319static const MemoryRegionOps assigned_dev_ioport_ops = {
 320    .read = assigned_dev_ioport_read,
 321    .write = assigned_dev_ioport_write,
 322    .endianness = DEVICE_NATIVE_ENDIAN,
 323};
 324
 325static void assigned_dev_ioport_setup(PCIDevice *pci_dev, int region_num,
 326                                      pcibus_t size)
 327{
 328    AssignedDevice *r_dev = DO_UPCAST(AssignedDevice, dev, pci_dev);
 329    AssignedDevRegion *region = &r_dev->v_addrs[region_num];
 330
 331    region->e_size = size;
 332    memory_region_init(&region->container, "assigned-dev-container", size);
 333    memory_region_init_io(&region->real_iomem, &assigned_dev_ioport_ops,
 334                          r_dev->v_addrs + region_num,
 335                          "assigned-dev-iomem", size);
 336    memory_region_add_subregion(&region->container, 0, &region->real_iomem);
 337}
 338
 339static uint32_t assigned_dev_pci_read(PCIDevice *d, int pos, int len)
 340{
 341    AssignedDevice *pci_dev = DO_UPCAST(AssignedDevice, dev, d);
 342    uint32_t val;
 343    ssize_t ret;
 344    int fd = pci_dev->real_device.config_fd;
 345
 346again:
 347    ret = pread(fd, &val, len, pos);
 348    if (ret != len) {
 349        if ((ret < 0) && (errno == EINTR || errno == EAGAIN)) {
 350            goto again;
 351        }
 352
 353        hw_error("pci read failed, ret = %zd errno = %d\n", ret, errno);
 354    }
 355
 356    return val;
 357}
 358
 359static uint8_t assigned_dev_pci_read_byte(PCIDevice *d, int pos)
 360{
 361    return (uint8_t)assigned_dev_pci_read(d, pos, 1);
 362}
 363
 364static void assigned_dev_pci_write(PCIDevice *d, int pos, uint32_t val, int len)
 365{
 366    AssignedDevice *pci_dev = DO_UPCAST(AssignedDevice, dev, d);
 367    ssize_t ret;
 368    int fd = pci_dev->real_device.config_fd;
 369
 370again:
 371    ret = pwrite(fd, &val, len, pos);
 372    if (ret != len) {
 373        if ((ret < 0) && (errno == EINTR || errno == EAGAIN)) {
 374            goto again;
 375        }
 376
 377        hw_error("pci write failed, ret = %zd errno = %d\n", ret, errno);
 378    }
 379}
 380
 381static void assigned_dev_emulate_config_read(AssignedDevice *dev,
 382                                             uint32_t offset, uint32_t len)
 383{
 384    memset(dev->emulate_config_read + offset, 0xff, len);
 385}
 386
 387static void assigned_dev_direct_config_read(AssignedDevice *dev,
 388                                            uint32_t offset, uint32_t len)
 389{
 390    memset(dev->emulate_config_read + offset, 0, len);
 391}
 392
 393static void assigned_dev_direct_config_write(AssignedDevice *dev,
 394                                             uint32_t offset, uint32_t len)
 395{
 396    memset(dev->emulate_config_write + offset, 0, len);
 397}
 398
 399static uint8_t pci_find_cap_offset(PCIDevice *d, uint8_t cap, uint8_t start)
 400{
 401    int id;
 402    int max_cap = 48;
 403    int pos = start ? start : PCI_CAPABILITY_LIST;
 404    int status;
 405
 406    status = assigned_dev_pci_read_byte(d, PCI_STATUS);
 407    if ((status & PCI_STATUS_CAP_LIST) == 0) {
 408        return 0;
 409    }
 410
 411    while (max_cap--) {
 412        pos = assigned_dev_pci_read_byte(d, pos);
 413        if (pos < 0x40) {
 414            break;
 415        }
 416
 417        pos &= ~3;
 418        id = assigned_dev_pci_read_byte(d, pos + PCI_CAP_LIST_ID);
 419
 420        if (id == 0xff) {
 421            break;
 422        }
 423        if (id == cap) {
 424            return pos;
 425        }
 426
 427        pos += PCI_CAP_LIST_NEXT;
 428    }
 429    return 0;
 430}
 431
 432static int assigned_dev_register_regions(PCIRegion *io_regions,
 433                                         unsigned long regions_num,
 434                                         AssignedDevice *pci_dev)
 435{
 436    uint32_t i;
 437    PCIRegion *cur_region = io_regions;
 438
 439    for (i = 0; i < regions_num; i++, cur_region++) {
 440        if (!cur_region->valid) {
 441            continue;
 442        }
 443
 444        /* handle memory io regions */
 445        if (cur_region->type & IORESOURCE_MEM) {
 446            int t = PCI_BASE_ADDRESS_SPACE_MEMORY;
 447            if (cur_region->type & IORESOURCE_PREFETCH) {
 448                t |= PCI_BASE_ADDRESS_MEM_PREFETCH;
 449            }
 450            if (cur_region->type & IORESOURCE_MEM_64) {
 451                t |= PCI_BASE_ADDRESS_MEM_TYPE_64;
 452            }
 453
 454            /* map physical memory */
 455            pci_dev->v_addrs[i].u.r_virtbase = mmap(NULL, cur_region->size,
 456                                                    PROT_WRITE | PROT_READ,
 457                                                    MAP_SHARED,
 458                                                    cur_region->resource_fd,
 459                                                    (off_t)0);
 460
 461            if (pci_dev->v_addrs[i].u.r_virtbase == MAP_FAILED) {
 462                pci_dev->v_addrs[i].u.r_virtbase = NULL;
 463                error_report("%s: Error: Couldn't mmap 0x%" PRIx64 "!",
 464                             __func__, cur_region->base_addr);
 465                return -1;
 466            }
 467
 468            pci_dev->v_addrs[i].r_size = cur_region->size;
 469            pci_dev->v_addrs[i].e_size = 0;
 470
 471            /* add offset */
 472            pci_dev->v_addrs[i].u.r_virtbase +=
 473                (cur_region->base_addr & 0xFFF);
 474
 475            if (cur_region->size & 0xFFF) {
 476                error_report("PCI region %d at address 0x%" PRIx64 " has "
 477                             "size 0x%" PRIx64 ", which is not a multiple of "
 478                             "4K.  You might experience some performance hit "
 479                             "due to that.",
 480                             i, cur_region->base_addr, cur_region->size);
 481                memory_region_init_io(&pci_dev->v_addrs[i].real_iomem,
 482                                      &slow_bar_ops, &pci_dev->v_addrs[i],
 483                                      "assigned-dev-slow-bar",
 484                                      cur_region->size);
 485            } else {
 486                void *virtbase = pci_dev->v_addrs[i].u.r_virtbase;
 487                char name[32];
 488                snprintf(name, sizeof(name), "%s.bar%d",
 489                         object_get_typename(OBJECT(pci_dev)), i);
 490                memory_region_init_ram_ptr(&pci_dev->v_addrs[i].real_iomem,
 491                                           name, cur_region->size,
 492                                           virtbase);
 493                vmstate_register_ram(&pci_dev->v_addrs[i].real_iomem,
 494                                     &pci_dev->dev.qdev);
 495            }
 496
 497            assigned_dev_iomem_setup(&pci_dev->dev, i, cur_region->size);
 498            pci_register_bar((PCIDevice *) pci_dev, i, t,
 499                             &pci_dev->v_addrs[i].container);
 500            continue;
 501        } else {
 502            /* handle port io regions */
 503            uint32_t val;
 504            int ret;
 505
 506            /* Test kernel support for ioport resource read/write.  Old
 507             * kernels return EIO.  New kernels only allow 1/2/4 byte reads
 508             * so should return EINVAL for a 3 byte read */
 509            ret = pread(pci_dev->v_addrs[i].region->resource_fd, &val, 3, 0);
 510            if (ret >= 0) {
 511                error_report("Unexpected return from I/O port read: %d", ret);
 512                abort();
 513            } else if (errno != EINVAL) {
 514                error_report("Kernel doesn't support ioport resource "
 515                             "access, hiding this region.");
 516                close(pci_dev->v_addrs[i].region->resource_fd);
 517                cur_region->valid = 0;
 518                continue;
 519            }
 520
 521            pci_dev->v_addrs[i].u.r_baseport = cur_region->base_addr;
 522            pci_dev->v_addrs[i].r_size = cur_region->size;
 523            pci_dev->v_addrs[i].e_size = 0;
 524
 525            assigned_dev_ioport_setup(&pci_dev->dev, i, cur_region->size);
 526            pci_register_bar((PCIDevice *) pci_dev, i,
 527                             PCI_BASE_ADDRESS_SPACE_IO,
 528                             &pci_dev->v_addrs[i].container);
 529        }
 530    }
 531
 532    /* success */
 533    return 0;
 534}
 535
 536static int get_real_id(const char *devpath, const char *idname, uint16_t *val)
 537{
 538    FILE *f;
 539    char name[128];
 540    long id;
 541
 542    snprintf(name, sizeof(name), "%s%s", devpath, idname);
 543    f = fopen(name, "r");
 544    if (f == NULL) {
 545        error_report("%s: %s: %m", __func__, name);
 546        return -1;
 547    }
 548    if (fscanf(f, "%li\n", &id) == 1) {
 549        *val = id;
 550    } else {
 551        return -1;
 552    }
 553    fclose(f);
 554
 555    return 0;
 556}
 557
 558static int get_real_vendor_id(const char *devpath, uint16_t *val)
 559{
 560    return get_real_id(devpath, "vendor", val);
 561}
 562
 563static int get_real_device_id(const char *devpath, uint16_t *val)
 564{
 565    return get_real_id(devpath, "device", val);
 566}
 567
 568static int get_real_device(AssignedDevice *pci_dev, uint16_t r_seg,
 569                           uint8_t r_bus, uint8_t r_dev, uint8_t r_func)
 570{
 571    char dir[128], name[128];
 572    int fd, r = 0, v;
 573    FILE *f;
 574    uint64_t start, end, size, flags;
 575    uint16_t id;
 576    PCIRegion *rp;
 577    PCIDevRegions *dev = &pci_dev->real_device;
 578
 579    dev->region_number = 0;
 580
 581    snprintf(dir, sizeof(dir), "/sys/bus/pci/devices/%04x:%02x:%02x.%x/",
 582             r_seg, r_bus, r_dev, r_func);
 583
 584    snprintf(name, sizeof(name), "%sconfig", dir);
 585
 586    if (pci_dev->configfd_name && *pci_dev->configfd_name) {
 587        dev->config_fd = monitor_handle_fd_param(cur_mon, pci_dev->configfd_name);
 588        if (dev->config_fd < 0) {
 589            return 1;
 590        }
 591    } else {
 592        dev->config_fd = open(name, O_RDWR);
 593
 594        if (dev->config_fd == -1) {
 595            error_report("%s: %s: %m", __func__, name);
 596            return 1;
 597        }
 598    }
 599again:
 600    r = read(dev->config_fd, pci_dev->dev.config,
 601             pci_config_size(&pci_dev->dev));
 602    if (r < 0) {
 603        if (errno == EINTR || errno == EAGAIN) {
 604            goto again;
 605        }
 606        error_report("%s: read failed, errno = %d", __func__, errno);
 607    }
 608
 609    /* Restore or clear multifunction, this is always controlled by qemu */
 610    if (pci_dev->dev.cap_present & QEMU_PCI_CAP_MULTIFUNCTION) {
 611        pci_dev->dev.config[PCI_HEADER_TYPE] |= PCI_HEADER_TYPE_MULTI_FUNCTION;
 612    } else {
 613        pci_dev->dev.config[PCI_HEADER_TYPE] &= ~PCI_HEADER_TYPE_MULTI_FUNCTION;
 614    }
 615
 616    /* Clear host resource mapping info.  If we choose not to register a
 617     * BAR, such as might be the case with the option ROM, we can get
 618     * confusing, unwritable, residual addresses from the host here. */
 619    memset(&pci_dev->dev.config[PCI_BASE_ADDRESS_0], 0, 24);
 620    memset(&pci_dev->dev.config[PCI_ROM_ADDRESS], 0, 4);
 621
 622    snprintf(name, sizeof(name), "%sresource", dir);
 623
 624    f = fopen(name, "r");
 625    if (f == NULL) {
 626        error_report("%s: %s: %m", __func__, name);
 627        return 1;
 628    }
 629
 630    for (r = 0; r < PCI_ROM_SLOT; r++) {
 631        if (fscanf(f, "%" SCNi64 " %" SCNi64 " %" SCNi64 "\n",
 632                   &start, &end, &flags) != 3) {
 633            break;
 634        }
 635
 636        rp = dev->regions + r;
 637        rp->valid = 0;
 638        rp->resource_fd = -1;
 639        size = end - start + 1;
 640        flags &= IORESOURCE_IO | IORESOURCE_MEM | IORESOURCE_PREFETCH
 641                 | IORESOURCE_MEM_64;
 642        if (size == 0 || (flags & ~IORESOURCE_PREFETCH) == 0) {
 643            continue;
 644        }
 645        if (flags & IORESOURCE_MEM) {
 646            flags &= ~IORESOURCE_IO;
 647        } else {
 648            flags &= ~IORESOURCE_PREFETCH;
 649        }
 650        snprintf(name, sizeof(name), "%sresource%d", dir, r);
 651        fd = open(name, O_RDWR);
 652        if (fd == -1) {
 653            continue;
 654        }
 655        rp->resource_fd = fd;
 656
 657        rp->type = flags;
 658        rp->valid = 1;
 659        rp->base_addr = start;
 660        rp->size = size;
 661        pci_dev->v_addrs[r].region = rp;
 662        DEBUG("region %d size %" PRIu64 " start 0x%" PRIx64
 663              " type %d resource_fd %d\n",
 664              r, rp->size, start, rp->type, rp->resource_fd);
 665    }
 666
 667    fclose(f);
 668
 669    /* read and fill vendor ID */
 670    v = get_real_vendor_id(dir, &id);
 671    if (v) {
 672        return 1;
 673    }
 674    pci_dev->dev.config[0] = id & 0xff;
 675    pci_dev->dev.config[1] = (id & 0xff00) >> 8;
 676
 677    /* read and fill device ID */
 678    v = get_real_device_id(dir, &id);
 679    if (v) {
 680        return 1;
 681    }
 682    pci_dev->dev.config[2] = id & 0xff;
 683    pci_dev->dev.config[3] = (id & 0xff00) >> 8;
 684
 685    pci_word_test_and_clear_mask(pci_dev->emulate_config_write + PCI_COMMAND,
 686                                 PCI_COMMAND_MASTER | PCI_COMMAND_INTX_DISABLE);
 687
 688    dev->region_number = r;
 689    return 0;
 690}
 691
 692static void free_msi_virqs(AssignedDevice *dev)
 693{
 694    int i;
 695
 696    for (i = 0; i < dev->msi_virq_nr; i++) {
 697        if (dev->msi_virq[i] >= 0) {
 698            kvm_irqchip_release_virq(kvm_state, dev->msi_virq[i]);
 699            dev->msi_virq[i] = -1;
 700        }
 701    }
 702    g_free(dev->msi_virq);
 703    dev->msi_virq = NULL;
 704    dev->msi_virq_nr = 0;
 705}
 706
 707static void free_assigned_device(AssignedDevice *dev)
 708{
 709    int i;
 710
 711    if (dev->cap.available & ASSIGNED_DEVICE_CAP_MSIX) {
 712        assigned_dev_unregister_msix_mmio(dev);
 713    }
 714    for (i = 0; i < dev->real_device.region_number; i++) {
 715        PCIRegion *pci_region = &dev->real_device.regions[i];
 716        AssignedDevRegion *region = &dev->v_addrs[i];
 717
 718        if (!pci_region->valid) {
 719            continue;
 720        }
 721        if (pci_region->type & IORESOURCE_IO) {
 722            if (region->u.r_baseport) {
 723                memory_region_del_subregion(&region->container,
 724                                            &region->real_iomem);
 725                memory_region_destroy(&region->real_iomem);
 726                memory_region_destroy(&region->container);
 727            }
 728        } else if (pci_region->type & IORESOURCE_MEM) {
 729            if (region->u.r_virtbase) {
 730                memory_region_del_subregion(&region->container,
 731                                            &region->real_iomem);
 732
 733                /* Remove MSI-X table subregion */
 734                if (pci_region->base_addr <= dev->msix_table_addr &&
 735                    pci_region->base_addr + pci_region->size >
 736                    dev->msix_table_addr) {
 737                    memory_region_del_subregion(&region->container,
 738                                                &dev->mmio);
 739                }
 740
 741                memory_region_destroy(&region->real_iomem);
 742                memory_region_destroy(&region->container);
 743                if (munmap(region->u.r_virtbase,
 744                           (pci_region->size + 0xFFF) & 0xFFFFF000)) {
 745                    error_report("Failed to unmap assigned device region: %s",
 746                                 strerror(errno));
 747                }
 748            }
 749        }
 750        if (pci_region->resource_fd >= 0) {
 751            close(pci_region->resource_fd);
 752        }
 753    }
 754
 755    if (dev->real_device.config_fd >= 0) {
 756        close(dev->real_device.config_fd);
 757    }
 758
 759    free_msi_virqs(dev);
 760}
 761
 762static void assign_failed_examine(AssignedDevice *dev)
 763{
 764    char name[PATH_MAX], dir[PATH_MAX], driver[PATH_MAX] = {}, *ns;
 765    uint16_t vendor_id, device_id;
 766    int r;
 767
 768    snprintf(dir, sizeof(dir), "/sys/bus/pci/devices/%04x:%02x:%02x.%01x/",
 769            dev->host.domain, dev->host.bus, dev->host.slot,
 770            dev->host.function);
 771
 772    snprintf(name, sizeof(name), "%sdriver", dir);
 773
 774    r = readlink(name, driver, sizeof(driver));
 775    if ((r <= 0) || r >= sizeof(driver)) {
 776        goto fail;
 777    }
 778
 779    ns = strrchr(driver, '/');
 780    if (!ns) {
 781        goto fail;
 782    }
 783
 784    ns++;
 785
 786    if (get_real_vendor_id(dir, &vendor_id) ||
 787        get_real_device_id(dir, &device_id)) {
 788        goto fail;
 789    }
 790
 791    error_report("*** The driver '%s' is occupying your device "
 792                 "%04x:%02x:%02x.%x.",
 793                 ns, dev->host.domain, dev->host.bus, dev->host.slot,
 794                 dev->host.function);
 795    error_report("***");
 796    error_report("*** You can try the following commands to free it:");
 797    error_report("***");
 798    error_report("*** $ echo \"%04x %04x\" > /sys/bus/pci/drivers/pci-stub/"
 799                 "new_id", vendor_id, device_id);
 800    error_report("*** $ echo \"%04x:%02x:%02x.%x\" > /sys/bus/pci/drivers/"
 801                 "%s/unbind",
 802                 dev->host.domain, dev->host.bus, dev->host.slot,
 803                 dev->host.function, ns);
 804    error_report("*** $ echo \"%04x:%02x:%02x.%x\" > /sys/bus/pci/drivers/"
 805                 "pci-stub/bind",
 806                 dev->host.domain, dev->host.bus, dev->host.slot,
 807                 dev->host.function);
 808    error_report("*** $ echo \"%04x %04x\" > /sys/bus/pci/drivers/pci-stub"
 809                 "/remove_id", vendor_id, device_id);
 810    error_report("***");
 811
 812    return;
 813
 814fail:
 815    error_report("Couldn't find out why.");
 816}
 817
 818static int assign_device(AssignedDevice *dev)
 819{
 820    uint32_t flags = KVM_DEV_ASSIGN_ENABLE_IOMMU;
 821    int r;
 822
 823    /* Only pass non-zero PCI segment to capable module */
 824    if (!kvm_check_extension(kvm_state, KVM_CAP_PCI_SEGMENT) &&
 825        dev->host.domain) {
 826        error_report("Can't assign device inside non-zero PCI segment "
 827                     "as this KVM module doesn't support it.");
 828        return -ENODEV;
 829    }
 830
 831    if (!kvm_check_extension(kvm_state, KVM_CAP_IOMMU)) {
 832        error_report("No IOMMU found.  Unable to assign device \"%s\"",
 833                     dev->dev.qdev.id);
 834        return -ENODEV;
 835    }
 836
 837    if (dev->features & ASSIGNED_DEVICE_SHARE_INTX_MASK &&
 838        kvm_has_intx_set_mask()) {
 839        flags |= KVM_DEV_ASSIGN_PCI_2_3;
 840    }
 841
 842    r = kvm_device_pci_assign(kvm_state, &dev->host, flags, &dev->dev_id);
 843    if (r < 0) {
 844        error_report("Failed to assign device \"%s\" : %s",
 845                     dev->dev.qdev.id, strerror(-r));
 846
 847        switch (r) {
 848        case -EBUSY:
 849            assign_failed_examine(dev);
 850            break;
 851        default:
 852            break;
 853        }
 854    }
 855    return r;
 856}
 857
 858static bool check_irqchip_in_kernel(void)
 859{
 860    if (kvm_irqchip_in_kernel()) {
 861        return true;
 862    }
 863    error_report("pci-assign: error: requires KVM with in-kernel irqchip "
 864                 "enabled");
 865    return false;
 866}
 867
 868static int assign_intx(AssignedDevice *dev)
 869{
 870    AssignedIRQType new_type;
 871    PCIINTxRoute intx_route;
 872    bool intx_host_msi;
 873    int r;
 874
 875    /* Interrupt PIN 0 means don't use INTx */
 876    if (assigned_dev_pci_read_byte(&dev->dev, PCI_INTERRUPT_PIN) == 0) {
 877        pci_device_set_intx_routing_notifier(&dev->dev, NULL);
 878        return 0;
 879    }
 880
 881    if (!check_irqchip_in_kernel()) {
 882        return -ENOTSUP;
 883    }
 884
 885    pci_device_set_intx_routing_notifier(&dev->dev,
 886                                         assigned_dev_update_irq_routing);
 887
 888    intx_route = pci_device_route_intx_to_irq(&dev->dev, dev->intpin);
 889    assert(intx_route.mode != PCI_INTX_INVERTED);
 890
 891    if (!pci_intx_route_changed(&dev->intx_route, &intx_route)) {
 892        return 0;
 893    }
 894
 895    switch (dev->assigned_irq_type) {
 896    case ASSIGNED_IRQ_INTX_HOST_INTX:
 897    case ASSIGNED_IRQ_INTX_HOST_MSI:
 898        intx_host_msi = dev->assigned_irq_type == ASSIGNED_IRQ_INTX_HOST_MSI;
 899        r = kvm_device_intx_deassign(kvm_state, dev->dev_id, intx_host_msi);
 900        break;
 901    case ASSIGNED_IRQ_MSI:
 902        r = kvm_device_msi_deassign(kvm_state, dev->dev_id);
 903        break;
 904    case ASSIGNED_IRQ_MSIX:
 905        r = kvm_device_msix_deassign(kvm_state, dev->dev_id);
 906        break;
 907    default:
 908        r = 0;
 909        break;
 910    }
 911    if (r) {
 912        perror("assign_intx: deassignment of previous interrupt failed");
 913    }
 914    dev->assigned_irq_type = ASSIGNED_IRQ_NONE;
 915
 916    if (intx_route.mode == PCI_INTX_DISABLED) {
 917        dev->intx_route = intx_route;
 918        return 0;
 919    }
 920
 921retry:
 922    if (dev->features & ASSIGNED_DEVICE_PREFER_MSI_MASK &&
 923        dev->cap.available & ASSIGNED_DEVICE_CAP_MSI) {
 924        intx_host_msi = true;
 925        new_type = ASSIGNED_IRQ_INTX_HOST_MSI;
 926    } else {
 927        intx_host_msi = false;
 928        new_type = ASSIGNED_IRQ_INTX_HOST_INTX;
 929    }
 930
 931    r = kvm_device_intx_assign(kvm_state, dev->dev_id, intx_host_msi,
 932                               intx_route.irq);
 933    if (r < 0) {
 934        if (r == -EIO && !(dev->features & ASSIGNED_DEVICE_PREFER_MSI_MASK) &&
 935            dev->cap.available & ASSIGNED_DEVICE_CAP_MSI) {
 936            /* Retry with host-side MSI. There might be an IRQ conflict and
 937             * either the kernel or the device doesn't support sharing. */
 938            error_report("Host-side INTx sharing not supported, "
 939                         "using MSI instead");
 940            error_printf("Some devices do not work properly in this mode.\n");
 941            dev->features |= ASSIGNED_DEVICE_PREFER_MSI_MASK;
 942            goto retry;
 943        }
 944        error_report("Failed to assign irq for \"%s\": %s",
 945                     dev->dev.qdev.id, strerror(-r));
 946        error_report("Perhaps you are assigning a device "
 947                     "that shares an IRQ with another device?");
 948        return r;
 949    }
 950
 951    dev->intx_route = intx_route;
 952    dev->assigned_irq_type = new_type;
 953    return r;
 954}
 955
 956static void deassign_device(AssignedDevice *dev)
 957{
 958    int r;
 959
 960    r = kvm_device_pci_deassign(kvm_state, dev->dev_id);
 961    assert(r == 0);
 962}
 963
 964/* The pci config space got updated. Check if irq numbers have changed
 965 * for our devices
 966 */
 967static void assigned_dev_update_irq_routing(PCIDevice *dev)
 968{
 969    AssignedDevice *assigned_dev = DO_UPCAST(AssignedDevice, dev, dev);
 970    Error *err = NULL;
 971    int r;
 972
 973    r = assign_intx(assigned_dev);
 974    if (r < 0) {
 975        qdev_unplug(&dev->qdev, &err);
 976        assert(!err);
 977    }
 978}
 979
 980static void assigned_dev_update_msi(PCIDevice *pci_dev)
 981{
 982    AssignedDevice *assigned_dev = DO_UPCAST(AssignedDevice, dev, pci_dev);
 983    uint8_t ctrl_byte = pci_get_byte(pci_dev->config + pci_dev->msi_cap +
 984                                     PCI_MSI_FLAGS);
 985    int r;
 986
 987    /* Some guests gratuitously disable MSI even if they're not using it,
 988     * try to catch this by only deassigning irqs if the guest is using
 989     * MSI or intends to start. */
 990    if (assigned_dev->assigned_irq_type == ASSIGNED_IRQ_MSI ||
 991        (ctrl_byte & PCI_MSI_FLAGS_ENABLE)) {
 992        r = kvm_device_msi_deassign(kvm_state, assigned_dev->dev_id);
 993        /* -ENXIO means no assigned irq */
 994        if (r && r != -ENXIO) {
 995            perror("assigned_dev_update_msi: deassign irq");
 996        }
 997
 998        free_msi_virqs(assigned_dev);
 999
1000        assigned_dev->assigned_irq_type = ASSIGNED_IRQ_NONE;
1001        pci_device_set_intx_routing_notifier(pci_dev, NULL);
1002    }
1003
1004    if (ctrl_byte & PCI_MSI_FLAGS_ENABLE) {
1005        MSIMessage msg = msi_get_message(pci_dev, 0);
1006        int virq;
1007
1008        virq = kvm_irqchip_add_msi_route(kvm_state, msg);
1009        if (virq < 0) {
1010            perror("assigned_dev_update_msi: kvm_irqchip_add_msi_route");
1011            return;
1012        }
1013
1014        assigned_dev->msi_virq = g_malloc(sizeof(*assigned_dev->msi_virq));
1015        assigned_dev->msi_virq_nr = 1;
1016        assigned_dev->msi_virq[0] = virq;
1017        if (kvm_device_msi_assign(kvm_state, assigned_dev->dev_id, virq) < 0) {
1018            perror("assigned_dev_update_msi: kvm_device_msi_assign");
1019        }
1020
1021        assigned_dev->intx_route.mode = PCI_INTX_DISABLED;
1022        assigned_dev->intx_route.irq = -1;
1023        assigned_dev->assigned_irq_type = ASSIGNED_IRQ_MSI;
1024    } else {
1025        assign_intx(assigned_dev);
1026    }
1027}
1028
1029static bool assigned_dev_msix_masked(MSIXTableEntry *entry)
1030{
1031    return (entry->ctrl & cpu_to_le32(0x1)) != 0;
1032}
1033
1034/*
1035 * When MSI-X is first enabled the vector table typically has all the
1036 * vectors masked, so we can't use that as the obvious test to figure out
1037 * how many vectors to initially enable.  Instead we look at the data field
1038 * because this is what worked for pci-assign for a long time.  This makes
1039 * sure the physical MSI-X state tracks the guest's view, which is important
1040 * for some VF/PF and PF/fw communication channels.
1041 */
1042static bool assigned_dev_msix_skipped(MSIXTableEntry *entry)
1043{
1044    return !entry->data;
1045}
1046
1047static int assigned_dev_update_msix_mmio(PCIDevice *pci_dev)
1048{
1049    AssignedDevice *adev = DO_UPCAST(AssignedDevice, dev, pci_dev);
1050    uint16_t entries_nr = 0;
1051    int i, r = 0;
1052    MSIXTableEntry *entry = adev->msix_table;
1053    MSIMessage msg;
1054
1055    /* Get the usable entry number for allocating */
1056    for (i = 0; i < adev->msix_max; i++, entry++) {
1057        if (assigned_dev_msix_skipped(entry)) {
1058            continue;
1059        }
1060        entries_nr++;
1061    }
1062
1063    DEBUG("MSI-X entries: %d\n", entries_nr);
1064
1065    /* It's valid to enable MSI-X with all entries masked */
1066    if (!entries_nr) {
1067        return 0;
1068    }
1069
1070    r = kvm_device_msix_init_vectors(kvm_state, adev->dev_id, entries_nr);
1071    if (r != 0) {
1072        error_report("fail to set MSI-X entry number for MSIX! %s",
1073                     strerror(-r));
1074        return r;
1075    }
1076
1077    free_msi_virqs(adev);
1078
1079    adev->msi_virq_nr = adev->msix_max;
1080    adev->msi_virq = g_malloc(adev->msix_max * sizeof(*adev->msi_virq));
1081
1082    entry = adev->msix_table;
1083    for (i = 0; i < adev->msix_max; i++, entry++) {
1084        adev->msi_virq[i] = -1;
1085
1086        if (assigned_dev_msix_skipped(entry)) {
1087            continue;
1088        }
1089
1090        msg.address = entry->addr_lo | ((uint64_t)entry->addr_hi << 32);
1091        msg.data = entry->data;
1092        r = kvm_irqchip_add_msi_route(kvm_state, msg);
1093        if (r < 0) {
1094            return r;
1095        }
1096        adev->msi_virq[i] = r;
1097
1098        DEBUG("MSI-X vector %d, gsi %d, addr %08x_%08x, data %08x\n", i,
1099              r, entry->addr_hi, entry->addr_lo, entry->data);
1100
1101        r = kvm_device_msix_set_vector(kvm_state, adev->dev_id, i,
1102                                       adev->msi_virq[i]);
1103        if (r) {
1104            error_report("fail to set MSI-X entry! %s", strerror(-r));
1105            break;
1106        }
1107    }
1108
1109    return r;
1110}
1111
1112static void assigned_dev_update_msix(PCIDevice *pci_dev)
1113{
1114    AssignedDevice *assigned_dev = DO_UPCAST(AssignedDevice, dev, pci_dev);
1115    uint16_t ctrl_word = pci_get_word(pci_dev->config + pci_dev->msix_cap +
1116                                      PCI_MSIX_FLAGS);
1117    int r;
1118
1119    /* Some guests gratuitously disable MSIX even if they're not using it,
1120     * try to catch this by only deassigning irqs if the guest is using
1121     * MSIX or intends to start. */
1122    if ((assigned_dev->assigned_irq_type == ASSIGNED_IRQ_MSIX) ||
1123        (ctrl_word & PCI_MSIX_FLAGS_ENABLE)) {
1124        r = kvm_device_msix_deassign(kvm_state, assigned_dev->dev_id);
1125        /* -ENXIO means no assigned irq */
1126        if (r && r != -ENXIO) {
1127            perror("assigned_dev_update_msix: deassign irq");
1128        }
1129
1130        free_msi_virqs(assigned_dev);
1131
1132        assigned_dev->assigned_irq_type = ASSIGNED_IRQ_NONE;
1133        pci_device_set_intx_routing_notifier(pci_dev, NULL);
1134    }
1135
1136    if (ctrl_word & PCI_MSIX_FLAGS_ENABLE) {
1137        if (assigned_dev_update_msix_mmio(pci_dev) < 0) {
1138            perror("assigned_dev_update_msix_mmio");
1139            return;
1140        }
1141
1142        if (assigned_dev->msi_virq_nr > 0) {
1143            if (kvm_device_msix_assign(kvm_state, assigned_dev->dev_id) < 0) {
1144                perror("assigned_dev_enable_msix: assign irq");
1145                return;
1146            }
1147        }
1148        assigned_dev->intx_route.mode = PCI_INTX_DISABLED;
1149        assigned_dev->intx_route.irq = -1;
1150        assigned_dev->assigned_irq_type = ASSIGNED_IRQ_MSIX;
1151    } else {
1152        assign_intx(assigned_dev);
1153    }
1154}
1155
1156static uint32_t assigned_dev_pci_read_config(PCIDevice *pci_dev,
1157                                             uint32_t address, int len)
1158{
1159    AssignedDevice *assigned_dev = DO_UPCAST(AssignedDevice, dev, pci_dev);
1160    uint32_t virt_val = pci_default_read_config(pci_dev, address, len);
1161    uint32_t real_val, emulate_mask, full_emulation_mask;
1162
1163    emulate_mask = 0;
1164    memcpy(&emulate_mask, assigned_dev->emulate_config_read + address, len);
1165    emulate_mask = le32_to_cpu(emulate_mask);
1166
1167    full_emulation_mask = 0xffffffff >> (32 - len * 8);
1168
1169    if (emulate_mask != full_emulation_mask) {
1170        real_val = assigned_dev_pci_read(pci_dev, address, len);
1171        return (virt_val & emulate_mask) | (real_val & ~emulate_mask);
1172    } else {
1173        return virt_val;
1174    }
1175}
1176
1177static void assigned_dev_pci_write_config(PCIDevice *pci_dev, uint32_t address,
1178                                          uint32_t val, int len)
1179{
1180    AssignedDevice *assigned_dev = DO_UPCAST(AssignedDevice, dev, pci_dev);
1181    uint16_t old_cmd = pci_get_word(pci_dev->config + PCI_COMMAND);
1182    uint32_t emulate_mask, full_emulation_mask;
1183    int ret;
1184
1185    pci_default_write_config(pci_dev, address, val, len);
1186
1187    if (kvm_has_intx_set_mask() &&
1188        range_covers_byte(address, len, PCI_COMMAND + 1)) {
1189        bool intx_masked = (pci_get_word(pci_dev->config + PCI_COMMAND) &
1190                            PCI_COMMAND_INTX_DISABLE);
1191
1192        if (intx_masked != !!(old_cmd & PCI_COMMAND_INTX_DISABLE)) {
1193            ret = kvm_device_intx_set_mask(kvm_state, assigned_dev->dev_id,
1194                                           intx_masked);
1195            if (ret) {
1196                perror("assigned_dev_pci_write_config: set intx mask");
1197            }
1198        }
1199    }
1200    if (assigned_dev->cap.available & ASSIGNED_DEVICE_CAP_MSI) {
1201        if (range_covers_byte(address, len,
1202                              pci_dev->msi_cap + PCI_MSI_FLAGS)) {
1203            assigned_dev_update_msi(pci_dev);
1204        }
1205    }
1206    if (assigned_dev->cap.available & ASSIGNED_DEVICE_CAP_MSIX) {
1207        if (range_covers_byte(address, len,
1208                              pci_dev->msix_cap + PCI_MSIX_FLAGS + 1)) {
1209            assigned_dev_update_msix(pci_dev);
1210        }
1211    }
1212
1213    emulate_mask = 0;
1214    memcpy(&emulate_mask, assigned_dev->emulate_config_write + address, len);
1215    emulate_mask = le32_to_cpu(emulate_mask);
1216
1217    full_emulation_mask = 0xffffffff >> (32 - len * 8);
1218
1219    if (emulate_mask != full_emulation_mask) {
1220        if (emulate_mask) {
1221            val &= ~emulate_mask;
1222            val |= assigned_dev_pci_read(pci_dev, address, len) & emulate_mask;
1223        }
1224        assigned_dev_pci_write(pci_dev, address, val, len);
1225    }
1226}
1227
1228static void assigned_dev_setup_cap_read(AssignedDevice *dev, uint32_t offset,
1229                                        uint32_t len)
1230{
1231    assigned_dev_direct_config_read(dev, offset, len);
1232    assigned_dev_emulate_config_read(dev, offset + PCI_CAP_LIST_NEXT, 1);
1233}
1234
1235static int assigned_device_pci_cap_init(PCIDevice *pci_dev)
1236{
1237    AssignedDevice *dev = DO_UPCAST(AssignedDevice, dev, pci_dev);
1238    PCIRegion *pci_region = dev->real_device.regions;
1239    int ret, pos;
1240
1241    /* Clear initial capabilities pointer and status copied from hw */
1242    pci_set_byte(pci_dev->config + PCI_CAPABILITY_LIST, 0);
1243    pci_set_word(pci_dev->config + PCI_STATUS,
1244                 pci_get_word(pci_dev->config + PCI_STATUS) &
1245                 ~PCI_STATUS_CAP_LIST);
1246
1247    /* Expose MSI capability
1248     * MSI capability is the 1st capability in capability config */
1249    pos = pci_find_cap_offset(pci_dev, PCI_CAP_ID_MSI, 0);
1250    if (pos != 0 && kvm_check_extension(kvm_state, KVM_CAP_ASSIGN_DEV_IRQ)) {
1251        if (!check_irqchip_in_kernel()) {
1252            return -ENOTSUP;
1253        }
1254        dev->cap.available |= ASSIGNED_DEVICE_CAP_MSI;
1255        /* Only 32-bit/no-mask currently supported */
1256        ret = pci_add_capability(pci_dev, PCI_CAP_ID_MSI, pos, 10);
1257        if (ret < 0) {
1258            return ret;
1259        }
1260        pci_dev->msi_cap = pos;
1261
1262        pci_set_word(pci_dev->config + pos + PCI_MSI_FLAGS,
1263                     pci_get_word(pci_dev->config + pos + PCI_MSI_FLAGS) &
1264                     PCI_MSI_FLAGS_QMASK);
1265        pci_set_long(pci_dev->config + pos + PCI_MSI_ADDRESS_LO, 0);
1266        pci_set_word(pci_dev->config + pos + PCI_MSI_DATA_32, 0);
1267
1268        /* Set writable fields */
1269        pci_set_word(pci_dev->wmask + pos + PCI_MSI_FLAGS,
1270                     PCI_MSI_FLAGS_QSIZE | PCI_MSI_FLAGS_ENABLE);
1271        pci_set_long(pci_dev->wmask + pos + PCI_MSI_ADDRESS_LO, 0xfffffffc);
1272        pci_set_word(pci_dev->wmask + pos + PCI_MSI_DATA_32, 0xffff);
1273    }
1274    /* Expose MSI-X capability */
1275    pos = pci_find_cap_offset(pci_dev, PCI_CAP_ID_MSIX, 0);
1276    if (pos != 0 && kvm_device_msix_supported(kvm_state)) {
1277        int bar_nr;
1278        uint32_t msix_table_entry;
1279
1280        if (!check_irqchip_in_kernel()) {
1281            return -ENOTSUP;
1282        }
1283        dev->cap.available |= ASSIGNED_DEVICE_CAP_MSIX;
1284        ret = pci_add_capability(pci_dev, PCI_CAP_ID_MSIX, pos, 12);
1285        if (ret < 0) {
1286            return ret;
1287        }
1288        pci_dev->msix_cap = pos;
1289
1290        pci_set_word(pci_dev->config + pos + PCI_MSIX_FLAGS,
1291                     pci_get_word(pci_dev->config + pos + PCI_MSIX_FLAGS) &
1292                     PCI_MSIX_FLAGS_QSIZE);
1293
1294        /* Only enable and function mask bits are writable */
1295        pci_set_word(pci_dev->wmask + pos + PCI_MSIX_FLAGS,
1296                     PCI_MSIX_FLAGS_ENABLE | PCI_MSIX_FLAGS_MASKALL);
1297
1298        msix_table_entry = pci_get_long(pci_dev->config + pos + PCI_MSIX_TABLE);
1299        bar_nr = msix_table_entry & PCI_MSIX_FLAGS_BIRMASK;
1300        msix_table_entry &= ~PCI_MSIX_FLAGS_BIRMASK;
1301        dev->msix_table_addr = pci_region[bar_nr].base_addr + msix_table_entry;
1302        dev->msix_max = pci_get_word(pci_dev->config + pos + PCI_MSIX_FLAGS);
1303        dev->msix_max &= PCI_MSIX_FLAGS_QSIZE;
1304        dev->msix_max += 1;
1305    }
1306
1307    /* Minimal PM support, nothing writable, device appears to NAK changes */
1308    pos = pci_find_cap_offset(pci_dev, PCI_CAP_ID_PM, 0);
1309    if (pos) {
1310        uint16_t pmc;
1311
1312        ret = pci_add_capability(pci_dev, PCI_CAP_ID_PM, pos, PCI_PM_SIZEOF);
1313        if (ret < 0) {
1314            return ret;
1315        }
1316
1317        assigned_dev_setup_cap_read(dev, pos, PCI_PM_SIZEOF);
1318
1319        pmc = pci_get_word(pci_dev->config + pos + PCI_CAP_FLAGS);
1320        pmc &= (PCI_PM_CAP_VER_MASK | PCI_PM_CAP_DSI);
1321        pci_set_word(pci_dev->config + pos + PCI_CAP_FLAGS, pmc);
1322
1323        /* assign_device will bring the device up to D0, so we don't need
1324         * to worry about doing that ourselves here. */
1325        pci_set_word(pci_dev->config + pos + PCI_PM_CTRL,
1326                     PCI_PM_CTRL_NO_SOFT_RESET);
1327
1328        pci_set_byte(pci_dev->config + pos + PCI_PM_PPB_EXTENSIONS, 0);
1329        pci_set_byte(pci_dev->config + pos + PCI_PM_DATA_REGISTER, 0);
1330    }
1331
1332    pos = pci_find_cap_offset(pci_dev, PCI_CAP_ID_EXP, 0);
1333    if (pos) {
1334        uint8_t version, size = 0;
1335        uint16_t type, devctl, lnksta;
1336        uint32_t devcap, lnkcap;
1337
1338        version = pci_get_byte(pci_dev->config + pos + PCI_EXP_FLAGS);
1339        version &= PCI_EXP_FLAGS_VERS;
1340        if (version == 1) {
1341            size = 0x14;
1342        } else if (version == 2) {
1343            /*
1344             * Check for non-std size, accept reduced size to 0x34,
1345             * which is what bcm5761 implemented, violating the
1346             * PCIe v3.0 spec that regs should exist and be read as 0,
1347             * not optionally provided and shorten the struct size.
1348             */
1349            size = MIN(0x3c, PCI_CONFIG_SPACE_SIZE - pos);
1350            if (size < 0x34) {
1351                error_report("%s: Invalid size PCIe cap-id 0x%x",
1352                             __func__, PCI_CAP_ID_EXP);
1353                return -EINVAL;
1354            } else if (size != 0x3c) {
1355                error_report("WARNING, %s: PCIe cap-id 0x%x has "
1356                             "non-standard size 0x%x; std size should be 0x3c",
1357                             __func__, PCI_CAP_ID_EXP, size);
1358            }
1359        } else if (version == 0) {
1360            uint16_t vid, did;
1361            vid = pci_get_word(pci_dev->config + PCI_VENDOR_ID);
1362            did = pci_get_word(pci_dev->config + PCI_DEVICE_ID);
1363            if (vid == PCI_VENDOR_ID_INTEL && did == 0x10ed) {
1364                /*
1365                 * quirk for Intel 82599 VF with invalid PCIe capability
1366                 * version, should really be version 2 (same as PF)
1367                 */
1368                size = 0x3c;
1369            }
1370        }
1371
1372        if (size == 0) {
1373            error_report("%s: Unsupported PCI express capability version %d",
1374                         __func__, version);
1375            return -EINVAL;
1376        }
1377
1378        ret = pci_add_capability(pci_dev, PCI_CAP_ID_EXP, pos, size);
1379        if (ret < 0) {
1380            return ret;
1381        }
1382
1383        assigned_dev_setup_cap_read(dev, pos, size);
1384
1385        type = pci_get_word(pci_dev->config + pos + PCI_EXP_FLAGS);
1386        type = (type & PCI_EXP_FLAGS_TYPE) >> 4;
1387        if (type != PCI_EXP_TYPE_ENDPOINT &&
1388            type != PCI_EXP_TYPE_LEG_END && type != PCI_EXP_TYPE_RC_END) {
1389            error_report("Device assignment only supports endpoint assignment,"
1390                         " device type %d", type);
1391            return -EINVAL;
1392        }
1393
1394        /* capabilities, pass existing read-only copy
1395         * PCI_EXP_FLAGS_IRQ: updated by hardware, should be direct read */
1396
1397        /* device capabilities: hide FLR */
1398        devcap = pci_get_long(pci_dev->config + pos + PCI_EXP_DEVCAP);
1399        devcap &= ~PCI_EXP_DEVCAP_FLR;
1400        pci_set_long(pci_dev->config + pos + PCI_EXP_DEVCAP, devcap);
1401
1402        /* device control: clear all error reporting enable bits, leaving
1403         *                 only a few host values.  Note, these are
1404         *                 all writable, but not passed to hw.
1405         */
1406        devctl = pci_get_word(pci_dev->config + pos + PCI_EXP_DEVCTL);
1407        devctl = (devctl & (PCI_EXP_DEVCTL_READRQ | PCI_EXP_DEVCTL_PAYLOAD)) |
1408                  PCI_EXP_DEVCTL_RELAX_EN | PCI_EXP_DEVCTL_NOSNOOP_EN;
1409        pci_set_word(pci_dev->config + pos + PCI_EXP_DEVCTL, devctl);
1410        devctl = PCI_EXP_DEVCTL_BCR_FLR | PCI_EXP_DEVCTL_AUX_PME;
1411        pci_set_word(pci_dev->wmask + pos + PCI_EXP_DEVCTL, ~devctl);
1412
1413        /* Clear device status */
1414        pci_set_word(pci_dev->config + pos + PCI_EXP_DEVSTA, 0);
1415
1416        /* Link capabilities, expose links and latencues, clear reporting */
1417        lnkcap = pci_get_long(pci_dev->config + pos + PCI_EXP_LNKCAP);
1418        lnkcap &= (PCI_EXP_LNKCAP_SLS | PCI_EXP_LNKCAP_MLW |
1419                   PCI_EXP_LNKCAP_ASPMS | PCI_EXP_LNKCAP_L0SEL |
1420                   PCI_EXP_LNKCAP_L1EL);
1421        pci_set_long(pci_dev->config + pos + PCI_EXP_LNKCAP, lnkcap);
1422
1423        /* Link control, pass existing read-only copy.  Should be writable? */
1424
1425        /* Link status, only expose current speed and width */
1426        lnksta = pci_get_word(pci_dev->config + pos + PCI_EXP_LNKSTA);
1427        lnksta &= (PCI_EXP_LNKSTA_CLS | PCI_EXP_LNKSTA_NLW);
1428        pci_set_word(pci_dev->config + pos + PCI_EXP_LNKSTA, lnksta);
1429
1430        if (version >= 2) {
1431            /* Slot capabilities, control, status - not needed for endpoints */
1432            pci_set_long(pci_dev->config + pos + PCI_EXP_SLTCAP, 0);
1433            pci_set_word(pci_dev->config + pos + PCI_EXP_SLTCTL, 0);
1434            pci_set_word(pci_dev->config + pos + PCI_EXP_SLTSTA, 0);
1435
1436            /* Root control, capabilities, status - not needed for endpoints */
1437            pci_set_word(pci_dev->config + pos + PCI_EXP_RTCTL, 0);
1438            pci_set_word(pci_dev->config + pos + PCI_EXP_RTCAP, 0);
1439            pci_set_long(pci_dev->config + pos + PCI_EXP_RTSTA, 0);
1440
1441            /* Device capabilities/control 2, pass existing read-only copy */
1442            /* Link control 2, pass existing read-only copy */
1443        }
1444    }
1445
1446    pos = pci_find_cap_offset(pci_dev, PCI_CAP_ID_PCIX, 0);
1447    if (pos) {
1448        uint16_t cmd;
1449        uint32_t status;
1450
1451        /* Only expose the minimum, 8 byte capability */
1452        ret = pci_add_capability(pci_dev, PCI_CAP_ID_PCIX, pos, 8);
1453        if (ret < 0) {
1454            return ret;
1455        }
1456
1457        assigned_dev_setup_cap_read(dev, pos, 8);
1458
1459        /* Command register, clear upper bits, including extended modes */
1460        cmd = pci_get_word(pci_dev->config + pos + PCI_X_CMD);
1461        cmd &= (PCI_X_CMD_DPERR_E | PCI_X_CMD_ERO | PCI_X_CMD_MAX_READ |
1462                PCI_X_CMD_MAX_SPLIT);
1463        pci_set_word(pci_dev->config + pos + PCI_X_CMD, cmd);
1464
1465        /* Status register, update with emulated PCI bus location, clear
1466         * error bits, leave the rest. */
1467        status = pci_get_long(pci_dev->config + pos + PCI_X_STATUS);
1468        status &= ~(PCI_X_STATUS_BUS | PCI_X_STATUS_DEVFN);
1469        status |= (pci_bus_num(pci_dev->bus) << 8) | pci_dev->devfn;
1470        status &= ~(PCI_X_STATUS_SPL_DISC | PCI_X_STATUS_UNX_SPL |
1471                    PCI_X_STATUS_SPL_ERR);
1472        pci_set_long(pci_dev->config + pos + PCI_X_STATUS, status);
1473    }
1474
1475    pos = pci_find_cap_offset(pci_dev, PCI_CAP_ID_VPD, 0);
1476    if (pos) {
1477        /* Direct R/W passthrough */
1478        ret = pci_add_capability(pci_dev, PCI_CAP_ID_VPD, pos, 8);
1479        if (ret < 0) {
1480            return ret;
1481        }
1482
1483        assigned_dev_setup_cap_read(dev, pos, 8);
1484
1485        /* direct write for cap content */
1486        assigned_dev_direct_config_write(dev, pos + 2, 6);
1487    }
1488
1489    /* Devices can have multiple vendor capabilities, get them all */
1490    for (pos = 0; (pos = pci_find_cap_offset(pci_dev, PCI_CAP_ID_VNDR, pos));
1491        pos += PCI_CAP_LIST_NEXT) {
1492        uint8_t len = pci_get_byte(pci_dev->config + pos + PCI_CAP_FLAGS);
1493        /* Direct R/W passthrough */
1494        ret = pci_add_capability(pci_dev, PCI_CAP_ID_VNDR, pos, len);
1495        if (ret < 0) {
1496            return ret;
1497        }
1498
1499        assigned_dev_setup_cap_read(dev, pos, len);
1500
1501        /* direct write for cap content */
1502        assigned_dev_direct_config_write(dev, pos + 2, len - 2);
1503    }
1504
1505    /* If real and virtual capability list status bits differ, virtualize the
1506     * access. */
1507    if ((pci_get_word(pci_dev->config + PCI_STATUS) & PCI_STATUS_CAP_LIST) !=
1508        (assigned_dev_pci_read_byte(pci_dev, PCI_STATUS) &
1509         PCI_STATUS_CAP_LIST)) {
1510        dev->emulate_config_read[PCI_STATUS] |= PCI_STATUS_CAP_LIST;
1511    }
1512
1513    return 0;
1514}
1515
1516static uint64_t
1517assigned_dev_msix_mmio_read(void *opaque, hwaddr addr,
1518                            unsigned size)
1519{
1520    AssignedDevice *adev = opaque;
1521    uint64_t val;
1522
1523    memcpy(&val, (void *)((uint8_t *)adev->msix_table + addr), size);
1524
1525    return val;
1526}
1527
1528static void assigned_dev_msix_mmio_write(void *opaque, hwaddr addr,
1529                                         uint64_t val, unsigned size)
1530{
1531    AssignedDevice *adev = opaque;
1532    PCIDevice *pdev = &adev->dev;
1533    uint16_t ctrl;
1534    MSIXTableEntry orig;
1535    int i = addr >> 4;
1536
1537    if (i >= adev->msix_max) {
1538        return; /* Drop write */
1539    }
1540
1541    ctrl = pci_get_word(pdev->config + pdev->msix_cap + PCI_MSIX_FLAGS);
1542
1543    DEBUG("write to MSI-X table offset 0x%lx, val 0x%lx\n", addr, val);
1544
1545    if (ctrl & PCI_MSIX_FLAGS_ENABLE) {
1546        orig = adev->msix_table[i];
1547    }
1548
1549    memcpy((uint8_t *)adev->msix_table + addr, &val, size);
1550
1551    if (ctrl & PCI_MSIX_FLAGS_ENABLE) {
1552        MSIXTableEntry *entry = &adev->msix_table[i];
1553
1554        if (!assigned_dev_msix_masked(&orig) &&
1555            assigned_dev_msix_masked(entry)) {
1556            /*
1557             * Vector masked, disable it
1558             *
1559             * XXX It's not clear if we can or should actually attempt
1560             * to mask or disable the interrupt.  KVM doesn't have
1561             * support for pending bits and kvm_assign_set_msix_entry
1562             * doesn't modify the device hardware mask.  Interrupts
1563             * while masked are simply not injected to the guest, so
1564             * are lost.  Can we get away with always injecting an
1565             * interrupt on unmask?
1566             */
1567        } else if (assigned_dev_msix_masked(&orig) &&
1568                   !assigned_dev_msix_masked(entry)) {
1569            /* Vector unmasked */
1570            if (i >= adev->msi_virq_nr || adev->msi_virq[i] < 0) {
1571                /* Previously unassigned vector, start from scratch */
1572                assigned_dev_update_msix(pdev);
1573                return;
1574            } else {
1575                /* Update an existing, previously masked vector */
1576                MSIMessage msg;
1577                int ret;
1578
1579                msg.address = entry->addr_lo |
1580                    ((uint64_t)entry->addr_hi << 32);
1581                msg.data = entry->data;
1582
1583                ret = kvm_irqchip_update_msi_route(kvm_state,
1584                                                   adev->msi_virq[i], msg);
1585                if (ret) {
1586                    error_report("Error updating irq routing entry (%d)", ret);
1587                }
1588            }
1589        }
1590    }
1591}
1592
1593static const MemoryRegionOps assigned_dev_msix_mmio_ops = {
1594    .read = assigned_dev_msix_mmio_read,
1595    .write = assigned_dev_msix_mmio_write,
1596    .endianness = DEVICE_NATIVE_ENDIAN,
1597    .valid = {
1598        .min_access_size = 4,
1599        .max_access_size = 8,
1600    },
1601    .impl = {
1602        .min_access_size = 4,
1603        .max_access_size = 8,
1604    },
1605};
1606
1607static void assigned_dev_msix_reset(AssignedDevice *dev)
1608{
1609    MSIXTableEntry *entry;
1610    int i;
1611
1612    if (!dev->msix_table) {
1613        return;
1614    }
1615
1616    memset(dev->msix_table, 0, MSIX_PAGE_SIZE);
1617
1618    for (i = 0, entry = dev->msix_table; i < dev->msix_max; i++, entry++) {
1619        entry->ctrl = cpu_to_le32(0x1); /* Masked */
1620    }
1621}
1622
1623static int assigned_dev_register_msix_mmio(AssignedDevice *dev)
1624{
1625    dev->msix_table = mmap(NULL, MSIX_PAGE_SIZE, PROT_READ|PROT_WRITE,
1626                           MAP_ANONYMOUS|MAP_PRIVATE, 0, 0);
1627    if (dev->msix_table == MAP_FAILED) {
1628        error_report("fail allocate msix_table! %s", strerror(errno));
1629        return -EFAULT;
1630    }
1631
1632    assigned_dev_msix_reset(dev);
1633
1634    memory_region_init_io(&dev->mmio, &assigned_dev_msix_mmio_ops, dev,
1635                          "assigned-dev-msix", MSIX_PAGE_SIZE);
1636    return 0;
1637}
1638
1639static void assigned_dev_unregister_msix_mmio(AssignedDevice *dev)
1640{
1641    if (!dev->msix_table) {
1642        return;
1643    }
1644
1645    memory_region_destroy(&dev->mmio);
1646
1647    if (munmap(dev->msix_table, MSIX_PAGE_SIZE) == -1) {
1648        error_report("error unmapping msix_table! %s", strerror(errno));
1649    }
1650    dev->msix_table = NULL;
1651}
1652
1653static const VMStateDescription vmstate_assigned_device = {
1654    .name = "pci-assign",
1655    .unmigratable = 1,
1656};
1657
1658static void reset_assigned_device(DeviceState *dev)
1659{
1660    PCIDevice *pci_dev = DO_UPCAST(PCIDevice, qdev, dev);
1661    AssignedDevice *adev = DO_UPCAST(AssignedDevice, dev, pci_dev);
1662    char reset_file[64];
1663    const char reset[] = "1";
1664    int fd, ret;
1665
1666    /*
1667     * If a guest is reset without being shutdown, MSI/MSI-X can still
1668     * be running.  We want to return the device to a known state on
1669     * reset, so disable those here.  We especially do not want MSI-X
1670     * enabled since it lives in MMIO space, which is about to get
1671     * disabled.
1672     */
1673    if (adev->assigned_irq_type == ASSIGNED_IRQ_MSIX) {
1674        uint16_t ctrl = pci_get_word(pci_dev->config +
1675                                     pci_dev->msix_cap + PCI_MSIX_FLAGS);
1676
1677        pci_set_word(pci_dev->config + pci_dev->msix_cap + PCI_MSIX_FLAGS,
1678                     ctrl & ~PCI_MSIX_FLAGS_ENABLE);
1679        assigned_dev_update_msix(pci_dev);
1680    } else if (adev->assigned_irq_type == ASSIGNED_IRQ_MSI) {
1681        uint8_t ctrl = pci_get_byte(pci_dev->config +
1682                                    pci_dev->msi_cap + PCI_MSI_FLAGS);
1683
1684        pci_set_byte(pci_dev->config + pci_dev->msi_cap + PCI_MSI_FLAGS,
1685                     ctrl & ~PCI_MSI_FLAGS_ENABLE);
1686        assigned_dev_update_msi(pci_dev);
1687    }
1688
1689    snprintf(reset_file, sizeof(reset_file),
1690             "/sys/bus/pci/devices/%04x:%02x:%02x.%01x/reset",
1691             adev->host.domain, adev->host.bus, adev->host.slot,
1692             adev->host.function);
1693
1694    /*
1695     * Issue a device reset via pci-sysfs.  Note that we use write(2) here
1696     * and ignore the return value because some kernels have a bug that
1697     * returns 0 rather than bytes written on success, sending us into an
1698     * infinite retry loop using other write mechanisms.
1699     */
1700    fd = open(reset_file, O_WRONLY);
1701    if (fd != -1) {
1702        ret = write(fd, reset, strlen(reset));
1703        (void)ret;
1704        close(fd);
1705    }
1706
1707    /*
1708     * When a 0 is written to the bus master register, the device is logically
1709     * disconnected from the PCI bus. This avoids further DMA transfers.
1710     */
1711    assigned_dev_pci_write_config(pci_dev, PCI_COMMAND, 0, 1);
1712}
1713
1714static int assigned_initfn(struct PCIDevice *pci_dev)
1715{
1716    AssignedDevice *dev = DO_UPCAST(AssignedDevice, dev, pci_dev);
1717    uint8_t e_intx;
1718    int r;
1719
1720    if (!kvm_enabled()) {
1721        error_report("pci-assign: error: requires KVM support");
1722        return -1;
1723    }
1724
1725    if (!dev->host.domain && !dev->host.bus && !dev->host.slot &&
1726        !dev->host.function) {
1727        error_report("pci-assign: error: no host device specified");
1728        return -1;
1729    }
1730
1731    /*
1732     * Set up basic config space access control. Will be further refined during
1733     * device initialization.
1734     */
1735    assigned_dev_emulate_config_read(dev, 0, PCI_CONFIG_SPACE_SIZE);
1736    assigned_dev_direct_config_read(dev, PCI_STATUS, 2);
1737    assigned_dev_direct_config_read(dev, PCI_REVISION_ID, 1);
1738    assigned_dev_direct_config_read(dev, PCI_CLASS_PROG, 3);
1739    assigned_dev_direct_config_read(dev, PCI_CACHE_LINE_SIZE, 1);
1740    assigned_dev_direct_config_read(dev, PCI_LATENCY_TIMER, 1);
1741    assigned_dev_direct_config_read(dev, PCI_BIST, 1);
1742    assigned_dev_direct_config_read(dev, PCI_CARDBUS_CIS, 4);
1743    assigned_dev_direct_config_read(dev, PCI_SUBSYSTEM_VENDOR_ID, 2);
1744    assigned_dev_direct_config_read(dev, PCI_SUBSYSTEM_ID, 2);
1745    assigned_dev_direct_config_read(dev, PCI_CAPABILITY_LIST + 1, 7);
1746    assigned_dev_direct_config_read(dev, PCI_MIN_GNT, 1);
1747    assigned_dev_direct_config_read(dev, PCI_MAX_LAT, 1);
1748    memcpy(dev->emulate_config_write, dev->emulate_config_read,
1749           sizeof(dev->emulate_config_read));
1750
1751    if (get_real_device(dev, dev->host.domain, dev->host.bus,
1752                        dev->host.slot, dev->host.function)) {
1753        error_report("pci-assign: Error: Couldn't get real device (%s)!",
1754                     dev->dev.qdev.id);
1755        goto out;
1756    }
1757
1758    if (assigned_device_pci_cap_init(pci_dev) < 0) {
1759        goto out;
1760    }
1761
1762    /* intercept MSI-X entry page in the MMIO */
1763    if (dev->cap.available & ASSIGNED_DEVICE_CAP_MSIX) {
1764        if (assigned_dev_register_msix_mmio(dev)) {
1765            goto out;
1766        }
1767    }
1768
1769    /* handle real device's MMIO/PIO BARs */
1770    if (assigned_dev_register_regions(dev->real_device.regions,
1771                                      dev->real_device.region_number,
1772                                      dev)) {
1773        goto out;
1774    }
1775
1776    /* handle interrupt routing */
1777    e_intx = dev->dev.config[PCI_INTERRUPT_PIN] - 1;
1778    dev->intpin = e_intx;
1779    dev->intx_route.mode = PCI_INTX_DISABLED;
1780    dev->intx_route.irq = -1;
1781
1782    /* assign device to guest */
1783    r = assign_device(dev);
1784    if (r < 0) {
1785        goto out;
1786    }
1787
1788    /* assign legacy INTx to the device */
1789    r = assign_intx(dev);
1790    if (r < 0) {
1791        goto assigned_out;
1792    }
1793
1794    assigned_dev_load_option_rom(dev);
1795
1796    add_boot_device_path(dev->bootindex, &pci_dev->qdev, NULL);
1797
1798    return 0;
1799
1800assigned_out:
1801    deassign_device(dev);
1802out:
1803    free_assigned_device(dev);
1804    return -1;
1805}
1806
1807static void assigned_exitfn(struct PCIDevice *pci_dev)
1808{
1809    AssignedDevice *dev = DO_UPCAST(AssignedDevice, dev, pci_dev);
1810
1811    deassign_device(dev);
1812    free_assigned_device(dev);
1813}
1814
1815static Property assigned_dev_properties[] = {
1816    DEFINE_PROP_PCI_HOST_DEVADDR("host", AssignedDevice, host),
1817    DEFINE_PROP_BIT("prefer_msi", AssignedDevice, features,
1818                    ASSIGNED_DEVICE_PREFER_MSI_BIT, false),
1819    DEFINE_PROP_BIT("share_intx", AssignedDevice, features,
1820                    ASSIGNED_DEVICE_SHARE_INTX_BIT, true),
1821    DEFINE_PROP_INT32("bootindex", AssignedDevice, bootindex, -1),
1822    DEFINE_PROP_STRING("configfd", AssignedDevice, configfd_name),
1823    DEFINE_PROP_END_OF_LIST(),
1824};
1825
1826static void assign_class_init(ObjectClass *klass, void *data)
1827{
1828    PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
1829    DeviceClass *dc = DEVICE_CLASS(klass);
1830
1831    k->init         = assigned_initfn;
1832    k->exit         = assigned_exitfn;
1833    k->config_read  = assigned_dev_pci_read_config;
1834    k->config_write = assigned_dev_pci_write_config;
1835    dc->props       = assigned_dev_properties;
1836    dc->vmsd        = &vmstate_assigned_device;
1837    dc->reset       = reset_assigned_device;
1838    dc->desc        = "KVM-based PCI passthrough";
1839}
1840
1841static const TypeInfo assign_info = {
1842    .name               = "kvm-pci-assign",
1843    .parent             = TYPE_PCI_DEVICE,
1844    .instance_size      = sizeof(AssignedDevice),
1845    .class_init         = assign_class_init,
1846};
1847
1848static void assign_register_types(void)
1849{
1850    type_register_static(&assign_info);
1851}
1852
1853type_init(assign_register_types)
1854
1855/*
1856 * Scan the assigned devices for the devices that have an option ROM, and then
1857 * load the corresponding ROM data to RAM. If an error occurs while loading an
1858 * option ROM, we just ignore that option ROM and continue with the next one.
1859 */
1860static void assigned_dev_load_option_rom(AssignedDevice *dev)
1861{
1862    char name[32], rom_file[64];
1863    FILE *fp;
1864    uint8_t val;
1865    struct stat st;
1866    void *ptr;
1867
1868    /* If loading ROM from file, pci handles it */
1869    if (dev->dev.romfile || !dev->dev.rom_bar) {
1870        return;
1871    }
1872
1873    snprintf(rom_file, sizeof(rom_file),
1874             "/sys/bus/pci/devices/%04x:%02x:%02x.%01x/rom",
1875             dev->host.domain, dev->host.bus, dev->host.slot,
1876             dev->host.function);
1877
1878    if (stat(rom_file, &st)) {
1879        return;
1880    }
1881
1882    if (access(rom_file, F_OK)) {
1883        error_report("pci-assign: Insufficient privileges for %s", rom_file);
1884        return;
1885    }
1886
1887    /* Write "1" to the ROM file to enable it */
1888    fp = fopen(rom_file, "r+");
1889    if (fp == NULL) {
1890        return;
1891    }
1892    val = 1;
1893    if (fwrite(&val, 1, 1, fp) != 1) {
1894        goto close_rom;
1895    }
1896    fseek(fp, 0, SEEK_SET);
1897
1898    snprintf(name, sizeof(name), "%s.rom",
1899            object_get_typename(OBJECT(dev)));
1900    memory_region_init_ram(&dev->dev.rom, name, st.st_size);
1901    vmstate_register_ram(&dev->dev.rom, &dev->dev.qdev);
1902    ptr = memory_region_get_ram_ptr(&dev->dev.rom);
1903    memset(ptr, 0xff, st.st_size);
1904
1905    if (!fread(ptr, 1, st.st_size, fp)) {
1906        error_report("pci-assign: Cannot read from host %s", rom_file);
1907        error_printf("Device option ROM contents are probably invalid "
1908                     "(check dmesg).\nSkip option ROM probe with rombar=0, "
1909                     "or load from file with romfile=\n");
1910        memory_region_destroy(&dev->dev.rom);
1911        goto close_rom;
1912    }
1913
1914    pci_register_bar(&dev->dev, PCI_ROM_SLOT, 0, &dev->dev.rom);
1915    dev->dev.has_rom = true;
1916close_rom:
1917    /* Write "0" to disable ROM */
1918    fseek(fp, 0, SEEK_SET);
1919    val = 0;
1920    if (!fwrite(&val, 1, 1, fp)) {
1921        DEBUG("%s\n", "Failed to disable pci-sysfs rom file");
1922    }
1923    fclose(fp);
1924}
1925