virtio.c revision 270159
1222900Snp/*- 2222900Snp * Copyright (c) 2013 Chris Torek <torek @ torek net> 3222900Snp * All rights reserved. 4222900Snp * 5222900Snp * Redistribution and use in source and binary forms, with or without 6222900Snp * modification, are permitted provided that the following conditions 7222900Snp * are met: 8222900Snp * 1. Redistributions of source code must retain the above copyright 9222900Snp * notice, this list of conditions and the following disclaimer. 10222900Snp * 2. Redistributions in binary form must reproduce the above copyright 11222900Snp * notice, this list of conditions and the following disclaimer in the 12222900Snp * documentation and/or other materials provided with the distribution. 13222900Snp * 14222900Snp * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 15222900Snp * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 16222900Snp * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 17222900Snp * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 18222900Snp * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 19222900Snp * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 20222900Snp * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 21222900Snp * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 22296471Snp * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 23296471Snp * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 24296471Snp * SUCH DAMAGE. 25296471Snp */ 26296471Snp 27296471Snp#include <sys/cdefs.h> 28296471Snp__FBSDID("$FreeBSD: stable/10/usr.sbin/bhyve/virtio.c 270159 2014-08-19 01:20:24Z grehan $"); 29296471Snp 30296471Snp#include <sys/param.h> 31296471Snp#include <sys/uio.h> 32296471Snp 33296471Snp#include <stdio.h> 34296471Snp#include <stdint.h> 35296471Snp#include <pthread.h> 36296471Snp 37222900Snp#include "bhyverun.h" 38222900Snp#include "pci_emul.h" 39222900Snp#include "virtio.h" 40222900Snp 41222900Snp/* 42222900Snp * Functions for dealing with generalized "virtual devices" as 43222900Snp * defined by <https://www.google.com/#output=search&q=virtio+spec> 44222900Snp */ 45222900Snp 46222900Snp/* 47222900Snp * In case we decide to relax the "virtio softc comes at the 48222900Snp * front of virtio-based device softc" constraint, let's use 49222900Snp * this to convert. 50222900Snp */ 51222900Snp#define DEV_SOFTC(vs) ((void *)(vs)) 52222900Snp 53222900Snp/* 54222900Snp * Link a virtio_softc to its constants, the device softc, and 55222900Snp * the PCI emulation. 56222900Snp */ 57222900Snpvoid 58222900Snpvi_softc_linkup(struct virtio_softc *vs, struct virtio_consts *vc, 59222900Snp void *dev_softc, struct pci_devinst *pi, 60222900Snp struct vqueue_info *queues) 61222900Snp{ 62222900Snp int i; 63222900Snp 64222900Snp /* vs and dev_softc addresses must match */ 65222900Snp assert((void *)vs == dev_softc); 66222900Snp vs->vs_vc = vc; 67222900Snp vs->vs_pi = pi; 68222900Snp pi->pi_arg = vs; 69222900Snp 70222900Snp vs->vs_queues = queues; 71222900Snp for (i = 0; i < vc->vc_nvq; i++) { 72222900Snp queues[i].vq_vs = vs; 73222900Snp queues[i].vq_num = i; 74222900Snp } 75222900Snp} 76222900Snp 77222900Snp/* 78222900Snp * Reset device (device-wide). This erases all queues, i.e., 79222900Snp * all the queues become invalid (though we don't wipe out the 80222900Snp * internal pointers, we just clear the VQ_ALLOC flag). 81222900Snp * 82222900Snp * It resets negotiated features to "none". 83222900Snp * 84222900Snp * If MSI-X is enabled, this also resets all the vectors to NO_VECTOR. 85222900Snp */ 86222900Snpvoid 87222900Snpvi_reset_dev(struct virtio_softc *vs) 88296471Snp{ 89296471Snp struct vqueue_info *vq; 90296471Snp int i, nvq; 91296471Snp 92296471Snp nvq = vs->vs_vc->vc_nvq; 93222900Snp for (vq = vs->vs_queues, i = 0; i < nvq; vq++, i++) { 94222900Snp vq->vq_flags = 0; 95222900Snp vq->vq_last_avail = 0; 96222900Snp vq->vq_pfn = 0; 97296471Snp vq->vq_msix_idx = VIRTIO_MSI_NO_VECTOR; 98296471Snp } 99296471Snp vs->vs_negotiated_caps = 0; 100296471Snp vs->vs_curq = 0; 101296471Snp /* vs->vs_status = 0; -- redundant */ 102296471Snp VS_LOCK(vs); 103296471Snp if (vs->vs_isr) 104296471Snp pci_lintr_deassert(vs->vs_pi); 105296471Snp vs->vs_isr = 0; 106296471Snp VS_UNLOCK(vs); 107296471Snp vs->vs_msix_cfg_idx = VIRTIO_MSI_NO_VECTOR; 108296471Snp} 109296471Snp 110296471Snp/* 111296471Snp * Set I/O BAR (usually 0) to map PCI config registers. 112296471Snp */ 113296471Snpvoid 114296471Snpvi_set_io_bar(struct virtio_softc *vs, int barnum) 115296471Snp{ 116296471Snp size_t size; 117296471Snp 118296471Snp /* 119296471Snp * ??? should we use CFG0 if MSI-X is disabled? 120296471Snp * Existing code did not... 121296471Snp */ 122296471Snp size = VTCFG_R_CFG1 + vs->vs_vc->vc_cfgsize; 123296471Snp pci_emul_alloc_bar(vs->vs_pi, barnum, PCIBAR_IO, size); 124296471Snp} 125296471Snp 126296471Snp/* 127222900Snp * Initialize MSI-X vector capabilities if we're to use MSI-X, 128222900Snp * or MSI capabilities if not. 129222900Snp * 130222900Snp * We assume we want one MSI-X vector per queue, here, plus one 131222900Snp * for the config vec. 132222900Snp */ 133222900Snpint 134222900Snpvi_intr_init(struct virtio_softc *vs, int barnum, int use_msix) 135296471Snp{ 136222900Snp int nvec; 137222900Snp 138222900Snp if (use_msix) { 139222900Snp vs->vs_flags |= VIRTIO_USE_MSIX; 140222900Snp vi_reset_dev(vs); /* set all vectors to NO_VECTOR */ 141222900Snp nvec = vs->vs_vc->vc_nvq + 1; 142222900Snp if (pci_emul_add_msixcap(vs->vs_pi, nvec, barnum)) 143222900Snp return (1); 144222900Snp } else 145222900Snp vs->vs_flags &= ~VIRTIO_USE_MSIX; 146222900Snp /* Only 1 MSI vector for bhyve */ 147222900Snp pci_emul_add_msicap(vs->vs_pi, 1); 148222900Snp return (0); 149222900Snp} 150222900Snp 151222900Snp/* 152222900Snp * Initialize the currently-selected virtio queue (vs->vs_curq). 153222900Snp * The guest just gave us a page frame number, from which we can 154222900Snp * calculate the addresses of the queue. 155222900Snp */ 156222900Snpvoid 157222900Snpvi_vq_init(struct virtio_softc *vs, uint32_t pfn) 158222900Snp{ 159222900Snp struct vqueue_info *vq; 160222900Snp uint64_t phys; 161222900Snp size_t size; 162222900Snp char *base; 163222900Snp 164222900Snp vq = &vs->vs_queues[vs->vs_curq]; 165222900Snp vq->vq_pfn = pfn; 166222900Snp phys = (uint64_t)pfn << VRING_PFN; 167222900Snp size = vring_size(vq->vq_qsize); 168222900Snp base = paddr_guest2host(vs->vs_pi->pi_vmctx, phys, size); 169222900Snp 170 /* First page(s) are descriptors... */ 171 vq->vq_desc = (struct virtio_desc *)base; 172 base += vq->vq_qsize * sizeof(struct virtio_desc); 173 174 /* ... immediately followed by "avail" ring (entirely uint16_t's) */ 175 vq->vq_avail = (struct vring_avail *)base; 176 base += (2 + vq->vq_qsize + 1) * sizeof(uint16_t); 177 178 /* Then it's rounded up to the next page... */ 179 base = (char *)roundup2((uintptr_t)base, VRING_ALIGN); 180 181 /* ... and the last page(s) are the used ring. */ 182 vq->vq_used = (struct vring_used *)base; 183 184 /* Mark queue as allocated, and start at 0 when we use it. */ 185 vq->vq_flags = VQ_ALLOC; 186 vq->vq_last_avail = 0; 187} 188 189/* 190 * Helper inline for vq_getchain(): record the i'th "real" 191 * descriptor. 192 */ 193static inline void 194_vq_record(int i, volatile struct virtio_desc *vd, struct vmctx *ctx, 195 struct iovec *iov, int n_iov, uint16_t *flags) { 196 197 if (i >= n_iov) 198 return; 199 iov[i].iov_base = paddr_guest2host(ctx, vd->vd_addr, vd->vd_len); 200 iov[i].iov_len = vd->vd_len; 201 if (flags != NULL) 202 flags[i] = vd->vd_flags; 203} 204#define VQ_MAX_DESCRIPTORS 512 /* see below */ 205 206/* 207 * Examine the chain of descriptors starting at the "next one" to 208 * make sure that they describe a sensible request. If so, return 209 * the number of "real" descriptors that would be needed/used in 210 * acting on this request. This may be smaller than the number of 211 * available descriptors, e.g., if there are two available but 212 * they are two separate requests, this just returns 1. Or, it 213 * may be larger: if there are indirect descriptors involved, 214 * there may only be one descriptor available but it may be an 215 * indirect pointing to eight more. We return 8 in this case, 216 * i.e., we do not count the indirect descriptors, only the "real" 217 * ones. 218 * 219 * Basically, this vets the vd_flags and vd_next field of each 220 * descriptor and tells you how many are involved. Since some may 221 * be indirect, this also needs the vmctx (in the pci_devinst 222 * at vs->vs_pi) so that it can find indirect descriptors. 223 * 224 * As we process each descriptor, we copy and adjust it (guest to 225 * host address wise, also using the vmtctx) into the given iov[] 226 * array (of the given size). If the array overflows, we stop 227 * placing values into the array but keep processing descriptors, 228 * up to VQ_MAX_DESCRIPTORS, before giving up and returning -1. 229 * So you, the caller, must not assume that iov[] is as big as the 230 * return value (you can process the same thing twice to allocate 231 * a larger iov array if needed, or supply a zero length to find 232 * out how much space is needed). 233 * 234 * If you want to verify the WRITE flag on each descriptor, pass a 235 * non-NULL "flags" pointer to an array of "uint16_t" of the same size 236 * as n_iov and we'll copy each vd_flags field after unwinding any 237 * indirects. 238 * 239 * If some descriptor(s) are invalid, this prints a diagnostic message 240 * and returns -1. If no descriptors are ready now it simply returns 0. 241 * 242 * You are assumed to have done a vq_ring_ready() if needed (note 243 * that vq_has_descs() does one). 244 */ 245int 246vq_getchain(struct vqueue_info *vq, 247 struct iovec *iov, int n_iov, uint16_t *flags) 248{ 249 int i; 250 u_int ndesc, n_indir; 251 u_int idx, head, next; 252 volatile struct virtio_desc *vdir, *vindir, *vp; 253 struct vmctx *ctx; 254 struct virtio_softc *vs; 255 const char *name; 256 257 vs = vq->vq_vs; 258 name = vs->vs_vc->vc_name; 259 260 /* 261 * Note: it's the responsibility of the guest not to 262 * update vq->vq_avail->va_idx until all of the descriptors 263 * the guest has written are valid (including all their 264 * vd_next fields and vd_flags). 265 * 266 * Compute (last_avail - va_idx) in integers mod 2**16. This is 267 * the number of descriptors the device has made available 268 * since the last time we updated vq->vq_last_avail. 269 * 270 * We just need to do the subtraction as an unsigned int, 271 * then trim off excess bits. 272 */ 273 idx = vq->vq_last_avail; 274 ndesc = (uint16_t)((u_int)vq->vq_avail->va_idx - idx); 275 if (ndesc == 0) 276 return (0); 277 if (ndesc > vq->vq_qsize) { 278 /* XXX need better way to diagnose issues */ 279 fprintf(stderr, 280 "%s: ndesc (%u) out of range, driver confused?\r\n", 281 name, (u_int)ndesc); 282 return (-1); 283 } 284 285 /* 286 * Now count/parse "involved" descriptors starting from 287 * the head of the chain. 288 * 289 * To prevent loops, we could be more complicated and 290 * check whether we're re-visiting a previously visited 291 * index, but we just abort if the count gets excessive. 292 */ 293 ctx = vs->vs_pi->pi_vmctx; 294 head = vq->vq_avail->va_ring[idx & (vq->vq_qsize - 1)]; 295 next = head; 296 for (i = 0; i < VQ_MAX_DESCRIPTORS; next = vdir->vd_next) { 297 if (next >= vq->vq_qsize) { 298 fprintf(stderr, 299 "%s: descriptor index %u out of range, " 300 "driver confused?\r\n", 301 name, next); 302 return (-1); 303 } 304 vdir = &vq->vq_desc[next]; 305 if ((vdir->vd_flags & VRING_DESC_F_INDIRECT) == 0) { 306 _vq_record(i, vdir, ctx, iov, n_iov, flags); 307 i++; 308 } else if ((vs->vs_negotiated_caps & 309 VIRTIO_RING_F_INDIRECT_DESC) == 0) { 310 fprintf(stderr, 311 "%s: descriptor has forbidden INDIRECT flag, " 312 "driver confused?\r\n", 313 name); 314 return (-1); 315 } else { 316 n_indir = vdir->vd_len / 16; 317 if ((vdir->vd_len & 0xf) || n_indir == 0) { 318 fprintf(stderr, 319 "%s: invalid indir len 0x%x, " 320 "driver confused?\r\n", 321 name, (u_int)vdir->vd_len); 322 return (-1); 323 } 324 vindir = paddr_guest2host(ctx, 325 vdir->vd_addr, vdir->vd_len); 326 /* 327 * Indirects start at the 0th, then follow 328 * their own embedded "next"s until those run 329 * out. Each one's indirect flag must be off 330 * (we don't really have to check, could just 331 * ignore errors...). 332 */ 333 next = 0; 334 for (;;) { 335 vp = &vindir[next]; 336 if (vp->vd_flags & VRING_DESC_F_INDIRECT) { 337 fprintf(stderr, 338 "%s: indirect desc has INDIR flag," 339 " driver confused?\r\n", 340 name); 341 return (-1); 342 } 343 _vq_record(i, vp, ctx, iov, n_iov, flags); 344 if (++i > VQ_MAX_DESCRIPTORS) 345 goto loopy; 346 if ((vp->vd_flags & VRING_DESC_F_NEXT) == 0) 347 break; 348 next = vp->vd_next; 349 if (next >= n_indir) { 350 fprintf(stderr, 351 "%s: invalid next %u > %u, " 352 "driver confused?\r\n", 353 name, (u_int)next, n_indir); 354 return (-1); 355 } 356 } 357 } 358 if ((vdir->vd_flags & VRING_DESC_F_NEXT) == 0) 359 return (i); 360 } 361loopy: 362 fprintf(stderr, 363 "%s: descriptor loop? count > %d - driver confused?\r\n", 364 name, i); 365 return (-1); 366} 367 368/* 369 * Return the currently-first request chain to the guest, setting 370 * its I/O length to the provided value. 371 * 372 * (This chain is the one you handled when you called vq_getchain() 373 * and used its positive return value.) 374 */ 375void 376vq_relchain(struct vqueue_info *vq, uint32_t iolen) 377{ 378 uint16_t head, uidx, mask; 379 volatile struct vring_used *vuh; 380 volatile struct virtio_used *vue; 381 382 /* 383 * Notes: 384 * - mask is N-1 where N is a power of 2 so computes x % N 385 * - vuh points to the "used" data shared with guest 386 * - vue points to the "used" ring entry we want to update 387 * - head is the same value we compute in vq_iovecs(). 388 * 389 * (I apologize for the two fields named vu_idx; the 390 * virtio spec calls the one that vue points to, "id"...) 391 */ 392 mask = vq->vq_qsize - 1; 393 vuh = vq->vq_used; 394 head = vq->vq_avail->va_ring[vq->vq_last_avail++ & mask]; 395 396 uidx = vuh->vu_idx; 397 vue = &vuh->vu_ring[uidx++ & mask]; 398 vue->vu_idx = head; /* ie, vue->id = head */ 399 vue->vu_tlen = iolen; 400 vuh->vu_idx = uidx; 401} 402 403/* 404 * Driver has finished processing "available" chains and calling 405 * vq_relchain on each one. If driver used all the available 406 * chains, used_all should be set. 407 * 408 * If the "used" index moved we may need to inform the guest, i.e., 409 * deliver an interrupt. Even if the used index did NOT move we 410 * may need to deliver an interrupt, if the avail ring is empty and 411 * we are supposed to interrupt on empty. 412 * 413 * Note that used_all_avail is provided by the caller because it's 414 * a snapshot of the ring state when he decided to finish interrupt 415 * processing -- it's possible that descriptors became available after 416 * that point. (It's also typically a constant 1/True as well.) 417 */ 418void 419vq_endchains(struct vqueue_info *vq, int used_all_avail) 420{ 421 struct virtio_softc *vs; 422 uint16_t event_idx, new_idx, old_idx; 423 int intr; 424 425 /* 426 * Interrupt generation: if we're using EVENT_IDX, 427 * interrupt if we've crossed the event threshold. 428 * Otherwise interrupt is generated if we added "used" entries, 429 * but suppressed by VRING_AVAIL_F_NO_INTERRUPT. 430 * 431 * In any case, though, if NOTIFY_ON_EMPTY is set and the 432 * entire avail was processed, we need to interrupt always. 433 */ 434 vs = vq->vq_vs; 435 new_idx = vq->vq_used->vu_idx; 436 old_idx = vq->vq_save_used; 437 if (used_all_avail && 438 (vs->vs_negotiated_caps & VIRTIO_F_NOTIFY_ON_EMPTY)) 439 intr = 1; 440 else if (vs->vs_negotiated_caps & VIRTIO_RING_F_EVENT_IDX) { 441 event_idx = VQ_USED_EVENT_IDX(vq); 442 /* 443 * This calculation is per docs and the kernel 444 * (see src/sys/dev/virtio/virtio_ring.h). 445 */ 446 intr = (uint16_t)(new_idx - event_idx - 1) < 447 (uint16_t)(new_idx - old_idx); 448 } else { 449 intr = new_idx != old_idx && 450 !(vq->vq_avail->va_flags & VRING_AVAIL_F_NO_INTERRUPT); 451 } 452 if (intr) 453 vq_interrupt(vs, vq); 454} 455 456/* Note: these are in sorted order to make for a fast search */ 457static struct config_reg { 458 uint16_t cr_offset; /* register offset */ 459 uint8_t cr_size; /* size (bytes) */ 460 uint8_t cr_ro; /* true => reg is read only */ 461 const char *cr_name; /* name of reg */ 462} config_regs[] = { 463 { VTCFG_R_HOSTCAP, 4, 1, "HOSTCAP" }, 464 { VTCFG_R_GUESTCAP, 4, 0, "GUESTCAP" }, 465 { VTCFG_R_PFN, 4, 0, "PFN" }, 466 { VTCFG_R_QNUM, 2, 1, "QNUM" }, 467 { VTCFG_R_QSEL, 2, 0, "QSEL" }, 468 { VTCFG_R_QNOTIFY, 2, 0, "QNOTIFY" }, 469 { VTCFG_R_STATUS, 1, 0, "STATUS" }, 470 { VTCFG_R_ISR, 1, 0, "ISR" }, 471 { VTCFG_R_CFGVEC, 2, 0, "CFGVEC" }, 472 { VTCFG_R_QVEC, 2, 0, "QVEC" }, 473}; 474 475static inline struct config_reg * 476vi_find_cr(int offset) { 477 u_int hi, lo, mid; 478 struct config_reg *cr; 479 480 lo = 0; 481 hi = sizeof(config_regs) / sizeof(*config_regs) - 1; 482 while (hi >= lo) { 483 mid = (hi + lo) >> 1; 484 cr = &config_regs[mid]; 485 if (cr->cr_offset == offset) 486 return (cr); 487 if (cr->cr_offset < offset) 488 lo = mid + 1; 489 else 490 hi = mid - 1; 491 } 492 return (NULL); 493} 494 495/* 496 * Handle pci config space reads. 497 * If it's to the MSI-X info, do that. 498 * If it's part of the virtio standard stuff, do that. 499 * Otherwise dispatch to the actual driver. 500 */ 501uint64_t 502vi_pci_read(struct vmctx *ctx, int vcpu, struct pci_devinst *pi, 503 int baridx, uint64_t offset, int size) 504{ 505 struct virtio_softc *vs = pi->pi_arg; 506 struct virtio_consts *vc; 507 struct config_reg *cr; 508 uint64_t virtio_config_size, max; 509 const char *name; 510 uint32_t newoff; 511 uint32_t value; 512 int error; 513 514 if (vs->vs_flags & VIRTIO_USE_MSIX) { 515 if (baridx == pci_msix_table_bar(pi) || 516 baridx == pci_msix_pba_bar(pi)) { 517 return (pci_emul_msix_tread(pi, offset, size)); 518 } 519 } 520 521 /* XXX probably should do something better than just assert() */ 522 assert(baridx == 0); 523 524 if (vs->vs_mtx) 525 pthread_mutex_lock(vs->vs_mtx); 526 527 vc = vs->vs_vc; 528 name = vc->vc_name; 529 value = size == 1 ? 0xff : size == 2 ? 0xffff : 0xffffffff; 530 531 if (size != 1 && size != 2 && size != 4) 532 goto bad; 533 534 if (pci_msix_enabled(pi)) 535 virtio_config_size = VTCFG_R_CFG1; 536 else 537 virtio_config_size = VTCFG_R_CFG0; 538 539 if (offset >= virtio_config_size) { 540 /* 541 * Subtract off the standard size (including MSI-X 542 * registers if enabled) and dispatch to underlying driver. 543 * If that fails, fall into general code. 544 */ 545 newoff = offset - virtio_config_size; 546 max = vc->vc_cfgsize ? vc->vc_cfgsize : 0x100000000; 547 if (newoff + size > max) 548 goto bad; 549 error = (*vc->vc_cfgread)(DEV_SOFTC(vs), newoff, size, &value); 550 if (!error) 551 goto done; 552 } 553 554bad: 555 cr = vi_find_cr(offset); 556 if (cr == NULL || cr->cr_size != size) { 557 if (cr != NULL) { 558 /* offset must be OK, so size must be bad */ 559 fprintf(stderr, 560 "%s: read from %s: bad size %d\r\n", 561 name, cr->cr_name, size); 562 } else { 563 fprintf(stderr, 564 "%s: read from bad offset/size %jd/%d\r\n", 565 name, (uintmax_t)offset, size); 566 } 567 goto done; 568 } 569 570 switch (offset) { 571 case VTCFG_R_HOSTCAP: 572 value = vc->vc_hv_caps; 573 break; 574 case VTCFG_R_GUESTCAP: 575 value = vs->vs_negotiated_caps; 576 break; 577 case VTCFG_R_PFN: 578 if (vs->vs_curq < vc->vc_nvq) 579 value = vs->vs_queues[vs->vs_curq].vq_pfn; 580 break; 581 case VTCFG_R_QNUM: 582 value = vs->vs_curq < vc->vc_nvq ? 583 vs->vs_queues[vs->vs_curq].vq_qsize : 0; 584 break; 585 case VTCFG_R_QSEL: 586 value = vs->vs_curq; 587 break; 588 case VTCFG_R_QNOTIFY: 589 value = 0; /* XXX */ 590 break; 591 case VTCFG_R_STATUS: 592 value = vs->vs_status; 593 break; 594 case VTCFG_R_ISR: 595 value = vs->vs_isr; 596 vs->vs_isr = 0; /* a read clears this flag */ 597 if (value) 598 pci_lintr_deassert(pi); 599 break; 600 case VTCFG_R_CFGVEC: 601 value = vs->vs_msix_cfg_idx; 602 break; 603 case VTCFG_R_QVEC: 604 value = vs->vs_curq < vc->vc_nvq ? 605 vs->vs_queues[vs->vs_curq].vq_msix_idx : 606 VIRTIO_MSI_NO_VECTOR; 607 break; 608 } 609done: 610 if (vs->vs_mtx) 611 pthread_mutex_unlock(vs->vs_mtx); 612 return (value); 613} 614 615/* 616 * Handle pci config space writes. 617 * If it's to the MSI-X info, do that. 618 * If it's part of the virtio standard stuff, do that. 619 * Otherwise dispatch to the actual driver. 620 */ 621void 622vi_pci_write(struct vmctx *ctx, int vcpu, struct pci_devinst *pi, 623 int baridx, uint64_t offset, int size, uint64_t value) 624{ 625 struct virtio_softc *vs = pi->pi_arg; 626 struct vqueue_info *vq; 627 struct virtio_consts *vc; 628 struct config_reg *cr; 629 uint64_t virtio_config_size, max; 630 const char *name; 631 uint32_t newoff; 632 int error; 633 634 if (vs->vs_flags & VIRTIO_USE_MSIX) { 635 if (baridx == pci_msix_table_bar(pi) || 636 baridx == pci_msix_pba_bar(pi)) { 637 pci_emul_msix_twrite(pi, offset, size, value); 638 return; 639 } 640 } 641 642 /* XXX probably should do something better than just assert() */ 643 assert(baridx == 0); 644 645 if (vs->vs_mtx) 646 pthread_mutex_lock(vs->vs_mtx); 647 648 vc = vs->vs_vc; 649 name = vc->vc_name; 650 651 if (size != 1 && size != 2 && size != 4) 652 goto bad; 653 654 if (pci_msix_enabled(pi)) 655 virtio_config_size = VTCFG_R_CFG1; 656 else 657 virtio_config_size = VTCFG_R_CFG0; 658 659 if (offset >= virtio_config_size) { 660 /* 661 * Subtract off the standard size (including MSI-X 662 * registers if enabled) and dispatch to underlying driver. 663 */ 664 newoff = offset - virtio_config_size; 665 max = vc->vc_cfgsize ? vc->vc_cfgsize : 0x100000000; 666 if (newoff + size > max) 667 goto bad; 668 error = (*vc->vc_cfgwrite)(DEV_SOFTC(vs), newoff, size, value); 669 if (!error) 670 goto done; 671 } 672 673bad: 674 cr = vi_find_cr(offset); 675 if (cr == NULL || cr->cr_size != size || cr->cr_ro) { 676 if (cr != NULL) { 677 /* offset must be OK, wrong size and/or reg is R/O */ 678 if (cr->cr_size != size) 679 fprintf(stderr, 680 "%s: write to %s: bad size %d\r\n", 681 name, cr->cr_name, size); 682 if (cr->cr_ro) 683 fprintf(stderr, 684 "%s: write to read-only reg %s\r\n", 685 name, cr->cr_name); 686 } else { 687 fprintf(stderr, 688 "%s: write to bad offset/size %jd/%d\r\n", 689 name, (uintmax_t)offset, size); 690 } 691 goto done; 692 } 693 694 switch (offset) { 695 case VTCFG_R_GUESTCAP: 696 vs->vs_negotiated_caps = value & vc->vc_hv_caps; 697 break; 698 case VTCFG_R_PFN: 699 if (vs->vs_curq >= vc->vc_nvq) 700 goto bad_qindex; 701 vi_vq_init(vs, value); 702 break; 703 case VTCFG_R_QSEL: 704 /* 705 * Note that the guest is allowed to select an 706 * invalid queue; we just need to return a QNUM 707 * of 0 while the bad queue is selected. 708 */ 709 vs->vs_curq = value; 710 break; 711 case VTCFG_R_QNOTIFY: 712 if (value >= vc->vc_nvq) { 713 fprintf(stderr, "%s: queue %d notify out of range\r\n", 714 name, (int)value); 715 goto done; 716 } 717 vq = &vs->vs_queues[value]; 718 if (vq->vq_notify) 719 (*vq->vq_notify)(DEV_SOFTC(vs), vq); 720 else if (vc->vc_qnotify) 721 (*vc->vc_qnotify)(DEV_SOFTC(vs), vq); 722 else 723 fprintf(stderr, 724 "%s: qnotify queue %d: missing vq/vc notify\r\n", 725 name, (int)value); 726 break; 727 case VTCFG_R_STATUS: 728 vs->vs_status = value; 729 if (value == 0) 730 (*vc->vc_reset)(DEV_SOFTC(vs)); 731 break; 732 case VTCFG_R_CFGVEC: 733 vs->vs_msix_cfg_idx = value; 734 break; 735 case VTCFG_R_QVEC: 736 if (vs->vs_curq >= vc->vc_nvq) 737 goto bad_qindex; 738 vq = &vs->vs_queues[vs->vs_curq]; 739 vq->vq_msix_idx = value; 740 break; 741 } 742 goto done; 743 744bad_qindex: 745 fprintf(stderr, 746 "%s: write config reg %s: curq %d >= max %d\r\n", 747 name, cr->cr_name, vs->vs_curq, vc->vc_nvq); 748done: 749 if (vs->vs_mtx) 750 pthread_mutex_unlock(vs->vs_mtx); 751} 752