1 /*- 2 * SPDX-License-Identifier: BSD-2-Clause-FreeBSD 3 * 4 * Copyright (c) 2013 Chris Torek <torek @ torek net> 5 * All rights reserved. 6 * Copyright (c) 2019 Joyent, Inc. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 1. Redistributions of source code must retain the above copyright 12 * notice, this list of conditions and the following disclaimer. 13 * 2. Redistributions in binary form must reproduce the above copyright 14 * notice, this list of conditions and the following disclaimer in the 15 * documentation and/or other materials provided with the distribution. 16 * 17 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 18 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 19 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 20 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 21 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 22 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 23 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 24 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 25 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 26 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 27 * SUCH DAMAGE. 28 */ 29 30 #include <sys/cdefs.h> 31 __FBSDID("$FreeBSD$"); 32 33 #include <sys/param.h> 34 #include <sys/uio.h> 35 36 #include <machine/atomic.h> 37 38 #ifdef __FreeBSD__ 39 #include <dev/virtio/pci/virtio_pci_legacy_var.h> 40 #endif 41 42 #include <stdio.h> 43 #include <stdint.h> 44 #include <string.h> 45 #include <pthread.h> 46 #include <pthread_np.h> 47 48 #include "bhyverun.h" 49 #include "debug.h" 50 #include "pci_emul.h" 51 #include "virtio.h" 52 53 /* 54 * Functions for dealing with generalized "virtual devices" as 55 * defined by <https://www.google.com/#output=search&q=virtio+spec> 56 */ 57 58 /* 59 * In case we decide to relax the "virtio softc comes at the 60 * front of virtio-based device softc" constraint, let's use 61 * this to convert. 62 */ 63 #define DEV_SOFTC(vs) ((void *)(vs)) 64 65 /* 66 * Link a virtio_softc to its constants, the device softc, and 67 * the PCI emulation. 68 */ 69 void 70 vi_softc_linkup(struct virtio_softc *vs, struct virtio_consts *vc, 71 void *dev_softc, struct pci_devinst *pi, 72 struct vqueue_info *queues) 73 { 74 int i; 75 76 /* vs and dev_softc addresses must match */ 77 assert((void *)vs == dev_softc); 78 vs->vs_vc = vc; 79 vs->vs_pi = pi; 80 pi->pi_arg = vs; 81 82 vs->vs_queues = queues; 83 for (i = 0; i < vc->vc_nvq; i++) { 84 queues[i].vq_vs = vs; 85 queues[i].vq_num = i; 86 } 87 } 88 89 /* 90 * Reset device (device-wide). This erases all queues, i.e., 91 * all the queues become invalid (though we don't wipe out the 92 * internal pointers, we just clear the VQ_ALLOC flag). 93 * 94 * It resets negotiated features to "none". 95 * 96 * If MSI-X is enabled, this also resets all the vectors to NO_VECTOR. 97 */ 98 void 99 vi_reset_dev(struct virtio_softc *vs) 100 { 101 struct vqueue_info *vq; 102 int i, nvq; 103 104 if (vs->vs_mtx) 105 assert(pthread_mutex_isowned_np(vs->vs_mtx)); 106 107 nvq = vs->vs_vc->vc_nvq; 108 for (vq = vs->vs_queues, i = 0; i < nvq; vq++, i++) { 109 vq->vq_flags = 0; 110 vq->vq_last_avail = 0; 111 vq->vq_next_used = 0; 112 vq->vq_save_used = 0; 113 vq->vq_pfn = 0; 114 vq->vq_msix_idx = VIRTIO_MSI_NO_VECTOR; 115 } 116 vs->vs_negotiated_caps = 0; 117 vs->vs_curq = 0; 118 /* vs->vs_status = 0; -- redundant */ 119 if (vs->vs_isr) 120 pci_lintr_deassert(vs->vs_pi); 121 vs->vs_isr = 0; 122 vs->vs_msix_cfg_idx = VIRTIO_MSI_NO_VECTOR; 123 } 124 125 /* 126 * Set I/O BAR (usually 0) to map PCI config registers. 127 */ 128 void 129 vi_set_io_bar(struct virtio_softc *vs, int barnum) 130 { 131 size_t size; 132 133 /* 134 * ??? should we use VIRTIO_PCI_CONFIG_OFF(0) if MSI-X is disabled? 135 * Existing code did not... 136 */ 137 size = VIRTIO_PCI_CONFIG_OFF(1) + vs->vs_vc->vc_cfgsize; 138 pci_emul_alloc_bar(vs->vs_pi, barnum, PCIBAR_IO, size); 139 } 140 141 /* 142 * Initialize MSI-X vector capabilities if we're to use MSI-X, 143 * or MSI capabilities if not. 144 * 145 * We assume we want one MSI-X vector per queue, here, plus one 146 * for the config vec. 147 */ 148 int 149 vi_intr_init(struct virtio_softc *vs, int barnum, int use_msix) 150 { 151 int nvec; 152 153 if (use_msix) { 154 vs->vs_flags |= VIRTIO_USE_MSIX; 155 VS_LOCK(vs); 156 vi_reset_dev(vs); /* set all vectors to NO_VECTOR */ 157 VS_UNLOCK(vs); 158 nvec = vs->vs_vc->vc_nvq + 1; 159 if (pci_emul_add_msixcap(vs->vs_pi, nvec, barnum)) 160 return (1); 161 } else 162 vs->vs_flags &= ~VIRTIO_USE_MSIX; 163 164 /* Only 1 MSI vector for bhyve */ 165 pci_emul_add_msicap(vs->vs_pi, 1); 166 167 /* Legacy interrupts are mandatory for virtio devices */ 168 pci_lintr_request(vs->vs_pi); 169 170 return (0); 171 } 172 173 /* 174 * Initialize the currently-selected virtio queue (vs->vs_curq). 175 * The guest just gave us a page frame number, from which we can 176 * calculate the addresses of the queue. 177 */ 178 void 179 vi_vq_init(struct virtio_softc *vs, uint32_t pfn) 180 { 181 struct vqueue_info *vq; 182 uint64_t phys; 183 size_t size; 184 char *base; 185 186 vq = &vs->vs_queues[vs->vs_curq]; 187 vq->vq_pfn = pfn; 188 phys = (uint64_t)pfn << VRING_PFN; 189 size = vring_size_aligned(vq->vq_qsize); 190 base = paddr_guest2host(vs->vs_pi->pi_vmctx, phys, size); 191 192 /* First page(s) are descriptors... */ 193 vq->vq_desc = (struct vring_desc *)base; 194 base += vq->vq_qsize * sizeof(struct vring_desc); 195 196 /* ... immediately followed by "avail" ring (entirely uint16_t's) */ 197 vq->vq_avail = (struct vring_avail *)base; 198 base += (2 + vq->vq_qsize + 1) * sizeof(uint16_t); 199 200 /* Then it's rounded up to the next page... */ 201 base = (char *)roundup2((uintptr_t)base, VRING_ALIGN); 202 203 /* ... and the last page(s) are the used ring. */ 204 vq->vq_used = (struct vring_used *)base; 205 206 /* Mark queue as allocated, and start at 0 when we use it. */ 207 vq->vq_flags = VQ_ALLOC; 208 vq->vq_last_avail = 0; 209 vq->vq_next_used = 0; 210 vq->vq_save_used = 0; 211 } 212 213 /* 214 * Helper inline for vq_getchain(): record the i'th "real" 215 * descriptor. 216 */ 217 static inline void 218 _vq_record(int i, volatile struct vring_desc *vd, 219 struct vmctx *ctx, struct iovec *iov, int n_iov, 220 struct vi_req *reqp) { 221 222 if (i >= n_iov) 223 return; 224 iov[i].iov_base = paddr_guest2host(ctx, vd->addr, vd->len); 225 iov[i].iov_len = vd->len; 226 if ((vd->flags & VRING_DESC_F_WRITE) == 0) 227 reqp->readable++; 228 else 229 reqp->writable++; 230 } 231 #define VQ_MAX_DESCRIPTORS 512 /* see below */ 232 233 /* 234 * Examine the chain of descriptors starting at the "next one" to 235 * make sure that they describe a sensible request. If so, return 236 * the number of "real" descriptors that would be needed/used in 237 * acting on this request. This may be smaller than the number of 238 * available descriptors, e.g., if there are two available but 239 * they are two separate requests, this just returns 1. Or, it 240 * may be larger: if there are indirect descriptors involved, 241 * there may only be one descriptor available but it may be an 242 * indirect pointing to eight more. We return 8 in this case, 243 * i.e., we do not count the indirect descriptors, only the "real" 244 * ones. 245 * 246 * Basically, this vets the "flags" and "next" field of each 247 * descriptor and tells you how many are involved. Since some may 248 * be indirect, this also needs the vmctx (in the pci_devinst 249 * at vs->vs_pi) so that it can find indirect descriptors. 250 * 251 * As we process each descriptor, we copy and adjust it (guest to 252 * host address wise, also using the vmtctx) into the given iov[] 253 * array (of the given size). If the array overflows, we stop 254 * placing values into the array but keep processing descriptors, 255 * up to VQ_MAX_DESCRIPTORS, before giving up and returning -1. 256 * So you, the caller, must not assume that iov[] is as big as the 257 * return value (you can process the same thing twice to allocate 258 * a larger iov array if needed, or supply a zero length to find 259 * out how much space is needed). 260 * 261 * If some descriptor(s) are invalid, this prints a diagnostic message 262 * and returns -1. If no descriptors are ready now it simply returns 0. 263 * 264 * You are assumed to have done a vq_ring_ready() if needed (note 265 * that vq_has_descs() does one). 266 */ 267 int 268 vq_getchain(struct vqueue_info *vq, struct iovec *iov, int niov, 269 struct vi_req *reqp) 270 { 271 int i; 272 u_int ndesc, n_indir; 273 u_int idx, next; 274 struct vi_req req; 275 volatile struct vring_desc *vdir, *vindir, *vp; 276 struct vmctx *ctx; 277 struct virtio_softc *vs; 278 const char *name; 279 280 vs = vq->vq_vs; 281 name = vs->vs_vc->vc_name; 282 memset(&req, 0, sizeof(req)); 283 284 /* 285 * Note: it's the responsibility of the guest not to 286 * update vq->vq_avail->idx until all of the descriptors 287 * the guest has written are valid (including all their 288 * "next" fields and "flags"). 289 * 290 * Compute (vq_avail->idx - last_avail) in integers mod 2**16. This is 291 * the number of descriptors the device has made available 292 * since the last time we updated vq->vq_last_avail. 293 * 294 * We just need to do the subtraction as an unsigned int, 295 * then trim off excess bits. 296 */ 297 idx = vq->vq_last_avail; 298 ndesc = (uint16_t)((u_int)vq->vq_avail->idx - idx); 299 if (ndesc == 0) 300 return (0); 301 if (ndesc > vq->vq_qsize) { 302 /* XXX need better way to diagnose issues */ 303 EPRINTLN( 304 "%s: ndesc (%u) out of range, driver confused?", 305 name, (u_int)ndesc); 306 return (-1); 307 } 308 309 /* 310 * Now count/parse "involved" descriptors starting from 311 * the head of the chain. 312 * 313 * To prevent loops, we could be more complicated and 314 * check whether we're re-visiting a previously visited 315 * index, but we just abort if the count gets excessive. 316 */ 317 ctx = vs->vs_pi->pi_vmctx; 318 req.idx = next = vq->vq_avail->ring[idx & (vq->vq_qsize - 1)]; 319 vq->vq_last_avail++; 320 for (i = 0; i < VQ_MAX_DESCRIPTORS; next = vdir->next) { 321 if (next >= vq->vq_qsize) { 322 EPRINTLN( 323 "%s: descriptor index %u out of range, " 324 "driver confused?", 325 name, next); 326 return (-1); 327 } 328 vdir = &vq->vq_desc[next]; 329 if ((vdir->flags & VRING_DESC_F_INDIRECT) == 0) { 330 _vq_record(i, vdir, ctx, iov, niov, &req); 331 i++; 332 } else if ((vs->vs_vc->vc_hv_caps & 333 VIRTIO_RING_F_INDIRECT_DESC) == 0) { 334 EPRINTLN( 335 "%s: descriptor has forbidden INDIRECT flag, " 336 "driver confused?", 337 name); 338 return (-1); 339 } else { 340 n_indir = vdir->len / 16; 341 if ((vdir->len & 0xf) || n_indir == 0) { 342 EPRINTLN( 343 "%s: invalid indir len 0x%x, " 344 "driver confused?", 345 name, (u_int)vdir->len); 346 return (-1); 347 } 348 vindir = paddr_guest2host(ctx, 349 vdir->addr, vdir->len); 350 /* 351 * Indirects start at the 0th, then follow 352 * their own embedded "next"s until those run 353 * out. Each one's indirect flag must be off 354 * (we don't really have to check, could just 355 * ignore errors...). 356 */ 357 next = 0; 358 for (;;) { 359 vp = &vindir[next]; 360 if (vp->flags & VRING_DESC_F_INDIRECT) { 361 EPRINTLN( 362 "%s: indirect desc has INDIR flag," 363 " driver confused?", 364 name); 365 return (-1); 366 } 367 _vq_record(i, vp, ctx, iov, niov, &req); 368 if (++i > VQ_MAX_DESCRIPTORS) 369 goto loopy; 370 if ((vp->flags & VRING_DESC_F_NEXT) == 0) 371 break; 372 next = vp->next; 373 if (next >= n_indir) { 374 EPRINTLN( 375 "%s: invalid next %u > %u, " 376 "driver confused?", 377 name, (u_int)next, n_indir); 378 return (-1); 379 } 380 } 381 } 382 if ((vdir->flags & VRING_DESC_F_NEXT) == 0) 383 goto done; 384 } 385 386 loopy: 387 EPRINTLN( 388 "%s: descriptor loop? count > %d - driver confused?", 389 name, i); 390 return (-1); 391 392 done: 393 *reqp = req; 394 return (i); 395 } 396 397 /* 398 * Return the first n_chain request chains back to the available queue. 399 * 400 * (These chains are the ones you handled when you called vq_getchain() 401 * and used its positive return value.) 402 */ 403 void 404 vq_retchains(struct vqueue_info *vq, uint16_t n_chains) 405 { 406 407 vq->vq_last_avail -= n_chains; 408 } 409 410 void 411 vq_relchain_prepare(struct vqueue_info *vq, uint16_t idx, uint32_t iolen) 412 { 413 volatile struct vring_used *vuh; 414 volatile struct vring_used_elem *vue; 415 uint16_t mask; 416 417 /* 418 * Notes: 419 * - mask is N-1 where N is a power of 2 so computes x % N 420 * - vuh points to the "used" data shared with guest 421 * - vue points to the "used" ring entry we want to update 422 */ 423 mask = vq->vq_qsize - 1; 424 vuh = vq->vq_used; 425 426 vue = &vuh->ring[vq->vq_next_used++ & mask]; 427 vue->id = idx; 428 vue->len = iolen; 429 } 430 431 void 432 vq_relchain_publish(struct vqueue_info *vq) 433 { 434 /* 435 * Ensure the used descriptor is visible before updating the index. 436 * This is necessary on ISAs with memory ordering less strict than x86 437 * (and even on x86 to act as a compiler barrier). 438 */ 439 atomic_thread_fence_rel(); 440 vq->vq_used->idx = vq->vq_next_used; 441 } 442 443 /* 444 * Return specified request chain to the guest, setting its I/O length 445 * to the provided value. 446 * 447 * (This chain is the one you handled when you called vq_getchain() 448 * and used its positive return value.) 449 */ 450 void 451 vq_relchain(struct vqueue_info *vq, uint16_t idx, uint32_t iolen) 452 { 453 vq_relchain_prepare(vq, idx, iolen); 454 vq_relchain_publish(vq); 455 } 456 457 /* 458 * Driver has finished processing "available" chains and calling 459 * vq_relchain on each one. If driver used all the available 460 * chains, used_all should be set. 461 * 462 * If the "used" index moved we may need to inform the guest, i.e., 463 * deliver an interrupt. Even if the used index did NOT move we 464 * may need to deliver an interrupt, if the avail ring is empty and 465 * we are supposed to interrupt on empty. 466 * 467 * Note that used_all_avail is provided by the caller because it's 468 * a snapshot of the ring state when he decided to finish interrupt 469 * processing -- it's possible that descriptors became available after 470 * that point. (It's also typically a constant 1/True as well.) 471 */ 472 void 473 vq_endchains(struct vqueue_info *vq, int used_all_avail) 474 { 475 struct virtio_softc *vs; 476 uint16_t event_idx, new_idx, old_idx; 477 int intr; 478 479 /* 480 * Interrupt generation: if we're using EVENT_IDX, 481 * interrupt if we've crossed the event threshold. 482 * Otherwise interrupt is generated if we added "used" entries, 483 * but suppressed by VRING_AVAIL_F_NO_INTERRUPT. 484 * 485 * In any case, though, if NOTIFY_ON_EMPTY is set and the 486 * entire avail was processed, we need to interrupt always. 487 */ 488 vs = vq->vq_vs; 489 old_idx = vq->vq_save_used; 490 vq->vq_save_used = new_idx = vq->vq_used->idx; 491 492 /* 493 * Use full memory barrier between "idx" store from preceding 494 * vq_relchain() call and the loads from VQ_USED_EVENT_IDX() or 495 * "flags" field below. 496 */ 497 atomic_thread_fence_seq_cst(); 498 if (used_all_avail && 499 (vs->vs_negotiated_caps & VIRTIO_F_NOTIFY_ON_EMPTY)) 500 intr = 1; 501 else if (vs->vs_negotiated_caps & VIRTIO_RING_F_EVENT_IDX) { 502 event_idx = VQ_USED_EVENT_IDX(vq); 503 /* 504 * This calculation is per docs and the kernel 505 * (see src/sys/dev/virtio/virtio_ring.h). 506 */ 507 intr = (uint16_t)(new_idx - event_idx - 1) < 508 (uint16_t)(new_idx - old_idx); 509 } else { 510 intr = new_idx != old_idx && 511 !(vq->vq_avail->flags & VRING_AVAIL_F_NO_INTERRUPT); 512 } 513 if (intr) 514 vq_interrupt(vs, vq); 515 } 516 517 /* Note: these are in sorted order to make for a fast search */ 518 static struct config_reg { 519 uint16_t cr_offset; /* register offset */ 520 uint8_t cr_size; /* size (bytes) */ 521 uint8_t cr_ro; /* true => reg is read only */ 522 const char *cr_name; /* name of reg */ 523 } config_regs[] = { 524 { VIRTIO_PCI_HOST_FEATURES, 4, 1, "HOST_FEATURES" }, 525 { VIRTIO_PCI_GUEST_FEATURES, 4, 0, "GUEST_FEATURES" }, 526 { VIRTIO_PCI_QUEUE_PFN, 4, 0, "QUEUE_PFN" }, 527 { VIRTIO_PCI_QUEUE_NUM, 2, 1, "QUEUE_NUM" }, 528 { VIRTIO_PCI_QUEUE_SEL, 2, 0, "QUEUE_SEL" }, 529 { VIRTIO_PCI_QUEUE_NOTIFY, 2, 0, "QUEUE_NOTIFY" }, 530 { VIRTIO_PCI_STATUS, 1, 0, "STATUS" }, 531 { VIRTIO_PCI_ISR, 1, 0, "ISR" }, 532 { VIRTIO_MSI_CONFIG_VECTOR, 2, 0, "CONFIG_VECTOR" }, 533 { VIRTIO_MSI_QUEUE_VECTOR, 2, 0, "QUEUE_VECTOR" }, 534 }; 535 536 static inline struct config_reg * 537 vi_find_cr(int offset) { 538 u_int hi, lo, mid; 539 struct config_reg *cr; 540 541 lo = 0; 542 hi = sizeof(config_regs) / sizeof(*config_regs) - 1; 543 while (hi >= lo) { 544 mid = (hi + lo) >> 1; 545 cr = &config_regs[mid]; 546 if (cr->cr_offset == offset) 547 return (cr); 548 if (cr->cr_offset < offset) 549 lo = mid + 1; 550 else 551 hi = mid - 1; 552 } 553 return (NULL); 554 } 555 556 /* 557 * Handle pci config space reads. 558 * If it's to the MSI-X info, do that. 559 * If it's part of the virtio standard stuff, do that. 560 * Otherwise dispatch to the actual driver. 561 */ 562 uint64_t 563 vi_pci_read(struct vmctx *ctx, int vcpu, struct pci_devinst *pi, 564 int baridx, uint64_t offset, int size) 565 { 566 struct virtio_softc *vs = pi->pi_arg; 567 struct virtio_consts *vc; 568 struct config_reg *cr; 569 uint64_t virtio_config_size, max; 570 const char *name; 571 uint32_t newoff; 572 uint32_t value; 573 int error; 574 575 if (vs->vs_flags & VIRTIO_USE_MSIX) { 576 if (baridx == pci_msix_table_bar(pi) || 577 baridx == pci_msix_pba_bar(pi)) { 578 return (pci_emul_msix_tread(pi, offset, size)); 579 } 580 } 581 582 /* XXX probably should do something better than just assert() */ 583 assert(baridx == 0); 584 585 if (vs->vs_mtx) 586 pthread_mutex_lock(vs->vs_mtx); 587 588 vc = vs->vs_vc; 589 name = vc->vc_name; 590 value = size == 1 ? 0xff : size == 2 ? 0xffff : 0xffffffff; 591 592 if (size != 1 && size != 2 && size != 4) 593 goto bad; 594 595 virtio_config_size = VIRTIO_PCI_CONFIG_OFF(pci_msix_enabled(pi)); 596 597 if (offset >= virtio_config_size) { 598 /* 599 * Subtract off the standard size (including MSI-X 600 * registers if enabled) and dispatch to underlying driver. 601 * If that fails, fall into general code. 602 */ 603 newoff = offset - virtio_config_size; 604 max = vc->vc_cfgsize ? vc->vc_cfgsize : 0x100000000; 605 if (newoff + size > max) 606 goto bad; 607 if (vc->vc_cfgread != NULL) 608 error = (*vc->vc_cfgread)(DEV_SOFTC(vs), newoff, size, &value); 609 else 610 error = 0; 611 if (!error) 612 goto done; 613 } 614 615 bad: 616 cr = vi_find_cr(offset); 617 if (cr == NULL || cr->cr_size != size) { 618 if (cr != NULL) { 619 /* offset must be OK, so size must be bad */ 620 EPRINTLN( 621 "%s: read from %s: bad size %d", 622 name, cr->cr_name, size); 623 } else { 624 EPRINTLN( 625 "%s: read from bad offset/size %jd/%d", 626 name, (uintmax_t)offset, size); 627 } 628 goto done; 629 } 630 631 switch (offset) { 632 case VIRTIO_PCI_HOST_FEATURES: 633 value = vc->vc_hv_caps; 634 break; 635 case VIRTIO_PCI_GUEST_FEATURES: 636 value = vs->vs_negotiated_caps; 637 break; 638 case VIRTIO_PCI_QUEUE_PFN: 639 if (vs->vs_curq < vc->vc_nvq) 640 value = vs->vs_queues[vs->vs_curq].vq_pfn; 641 break; 642 case VIRTIO_PCI_QUEUE_NUM: 643 value = vs->vs_curq < vc->vc_nvq ? 644 vs->vs_queues[vs->vs_curq].vq_qsize : 0; 645 break; 646 case VIRTIO_PCI_QUEUE_SEL: 647 value = vs->vs_curq; 648 break; 649 case VIRTIO_PCI_QUEUE_NOTIFY: 650 value = 0; /* XXX */ 651 break; 652 case VIRTIO_PCI_STATUS: 653 value = vs->vs_status; 654 break; 655 case VIRTIO_PCI_ISR: 656 value = vs->vs_isr; 657 vs->vs_isr = 0; /* a read clears this flag */ 658 if (value) 659 pci_lintr_deassert(pi); 660 break; 661 case VIRTIO_MSI_CONFIG_VECTOR: 662 value = vs->vs_msix_cfg_idx; 663 break; 664 case VIRTIO_MSI_QUEUE_VECTOR: 665 value = vs->vs_curq < vc->vc_nvq ? 666 vs->vs_queues[vs->vs_curq].vq_msix_idx : 667 VIRTIO_MSI_NO_VECTOR; 668 break; 669 } 670 done: 671 if (vs->vs_mtx) 672 pthread_mutex_unlock(vs->vs_mtx); 673 return (value); 674 } 675 676 /* 677 * Handle pci config space writes. 678 * If it's to the MSI-X info, do that. 679 * If it's part of the virtio standard stuff, do that. 680 * Otherwise dispatch to the actual driver. 681 */ 682 void 683 vi_pci_write(struct vmctx *ctx, int vcpu, struct pci_devinst *pi, 684 int baridx, uint64_t offset, int size, uint64_t value) 685 { 686 struct virtio_softc *vs = pi->pi_arg; 687 struct vqueue_info *vq; 688 struct virtio_consts *vc; 689 struct config_reg *cr; 690 uint64_t virtio_config_size, max; 691 const char *name; 692 uint32_t newoff; 693 int error; 694 695 if (vs->vs_flags & VIRTIO_USE_MSIX) { 696 if (baridx == pci_msix_table_bar(pi) || 697 baridx == pci_msix_pba_bar(pi)) { 698 pci_emul_msix_twrite(pi, offset, size, value); 699 return; 700 } 701 } 702 703 /* XXX probably should do something better than just assert() */ 704 assert(baridx == 0); 705 706 if (vs->vs_mtx) 707 pthread_mutex_lock(vs->vs_mtx); 708 709 vc = vs->vs_vc; 710 name = vc->vc_name; 711 712 if (size != 1 && size != 2 && size != 4) 713 goto bad; 714 715 virtio_config_size = VIRTIO_PCI_CONFIG_OFF(pci_msix_enabled(pi)); 716 717 if (offset >= virtio_config_size) { 718 /* 719 * Subtract off the standard size (including MSI-X 720 * registers if enabled) and dispatch to underlying driver. 721 */ 722 newoff = offset - virtio_config_size; 723 max = vc->vc_cfgsize ? vc->vc_cfgsize : 0x100000000; 724 if (newoff + size > max) 725 goto bad; 726 if (vc->vc_cfgwrite != NULL) 727 error = (*vc->vc_cfgwrite)(DEV_SOFTC(vs), newoff, size, value); 728 else 729 error = 0; 730 if (!error) 731 goto done; 732 } 733 734 bad: 735 cr = vi_find_cr(offset); 736 if (cr == NULL || cr->cr_size != size || cr->cr_ro) { 737 if (cr != NULL) { 738 /* offset must be OK, wrong size and/or reg is R/O */ 739 if (cr->cr_size != size) 740 EPRINTLN( 741 "%s: write to %s: bad size %d", 742 name, cr->cr_name, size); 743 if (cr->cr_ro) 744 EPRINTLN( 745 "%s: write to read-only reg %s", 746 name, cr->cr_name); 747 } else { 748 EPRINTLN( 749 "%s: write to bad offset/size %jd/%d", 750 name, (uintmax_t)offset, size); 751 } 752 goto done; 753 } 754 755 switch (offset) { 756 case VIRTIO_PCI_GUEST_FEATURES: 757 vs->vs_negotiated_caps = value & vc->vc_hv_caps; 758 if (vc->vc_apply_features) 759 (*vc->vc_apply_features)(DEV_SOFTC(vs), 760 vs->vs_negotiated_caps); 761 break; 762 case VIRTIO_PCI_QUEUE_PFN: 763 if (vs->vs_curq >= vc->vc_nvq) 764 goto bad_qindex; 765 vi_vq_init(vs, value); 766 break; 767 case VIRTIO_PCI_QUEUE_SEL: 768 /* 769 * Note that the guest is allowed to select an 770 * invalid queue; we just need to return a QNUM 771 * of 0 while the bad queue is selected. 772 */ 773 vs->vs_curq = value; 774 break; 775 case VIRTIO_PCI_QUEUE_NOTIFY: 776 if (value >= vc->vc_nvq) { 777 EPRINTLN("%s: queue %d notify out of range", 778 name, (int)value); 779 goto done; 780 } 781 vq = &vs->vs_queues[value]; 782 if (vq->vq_notify) 783 (*vq->vq_notify)(DEV_SOFTC(vs), vq); 784 else if (vc->vc_qnotify) 785 (*vc->vc_qnotify)(DEV_SOFTC(vs), vq); 786 else 787 EPRINTLN( 788 "%s: qnotify queue %d: missing vq/vc notify", 789 name, (int)value); 790 break; 791 case VIRTIO_PCI_STATUS: 792 vs->vs_status = value; 793 if (value == 0) 794 (*vc->vc_reset)(DEV_SOFTC(vs)); 795 break; 796 case VIRTIO_MSI_CONFIG_VECTOR: 797 vs->vs_msix_cfg_idx = value; 798 break; 799 case VIRTIO_MSI_QUEUE_VECTOR: 800 if (vs->vs_curq >= vc->vc_nvq) 801 goto bad_qindex; 802 vq = &vs->vs_queues[vs->vs_curq]; 803 vq->vq_msix_idx = value; 804 break; 805 } 806 goto done; 807 808 bad_qindex: 809 EPRINTLN( 810 "%s: write config reg %s: curq %d >= max %d", 811 name, cr->cr_name, vs->vs_curq, vc->vc_nvq); 812 done: 813 if (vs->vs_mtx) 814 pthread_mutex_unlock(vs->vs_mtx); 815 } 816