@samitouri / QOSamiQemu
Code Commits Issues Pulls Sessions CI/CD
master
master
c 2,720 lines 75.1 KB
Raw
1 /*
2 * QEMU Hyper-V VMBus
3 *
4 * Copyright (c) 2017-2018 Virtuozzo International GmbH.
5 *
6 * This work is licensed under the terms of the GNU GPL, version 2 or later.
7 * See the COPYING file in the top-level directory.
8 */
9
10 #include "qemu/osdep.h"
11 #include "qemu/error-report.h"
12 #include "qemu/main-loop.h"
13 #include "exec/target_page.h"
14 #include "qapi/error.h"
15 #include "migration/vmstate.h"
16 #include "hw/core/qdev-properties.h"
17 #include "hw/core/qdev-properties-system.h"
18 #include "hw/hyperv/hyperv.h"
19 #include "hw/hyperv/vmbus.h"
20 #include "hw/hyperv/vmbus-bridge.h"
21 #include "hw/core/sysbus.h"
22 #include "exec/cpu-common.h"
23 #include "system/kvm.h"
24 #include "system/physmem.h"
25 #include "trace.h"
26
27 enum {
28 VMGPADL_INIT,
29 VMGPADL_ALIVE,
30 VMGPADL_TEARINGDOWN,
31 VMGPADL_TORNDOWN,
32 };
33
34 struct VMBusGpadl {
35 /* GPADL id */
36 uint32_t id;
37 /* associated channel id (rudimentary?) */
38 uint32_t child_relid;
39
40 /* number of pages in the GPADL as declared in GPADL_HEADER message */
41 uint32_t num_gfns;
42 /*
43 * Due to limited message size, GPADL may not fit fully in a single
44 * GPADL_HEADER message, and is further popluated using GPADL_BODY
45 * messages. @seen_gfns is the number of pages seen so far; once it
46 * reaches @num_gfns, the GPADL is ready to use.
47 */
48 uint32_t seen_gfns;
49 /* array of GFNs (of size @num_gfns once allocated) */
50 uint64_t *gfns;
51
52 uint8_t state;
53
54 QTAILQ_ENTRY(VMBusGpadl) link;
55 VMBus *vmbus;
56 unsigned refcount;
57 };
58
59 /*
60 * Wrap sequential read from / write to GPADL.
61 */
62 typedef struct GpadlIter {
63 VMBusGpadl *gpadl;
64 AddressSpace *as;
65 DMADirection dir;
66 /* offset into GPADL where the next i/o will be performed */
67 uint32_t off;
68 /*
69 * Cached mapping of the currently accessed page, up to page boundary.
70 * Updated lazily on i/o.
71 * Note: MemoryRegionCache can not be used here because pages in the GPADL
72 * are non-contiguous and may belong to different memory regions.
73 */
74 void *map;
75 /* offset after last i/o (i.e. not affected by seek) */
76 uint32_t last_off;
77 /*
78 * Indicator that the iterator is active and may have a cached mapping.
79 * Allows to enforce bracketing of all i/o (which may create cached
80 * mappings) and thus exclude mapping leaks.
81 */
82 bool active;
83 } GpadlIter;
84
85 /*
86 * Ring buffer. There are two of them, sitting in the same GPADL, for each
87 * channel.
88 * Each ring buffer consists of a set of pages, with the first page containing
89 * the ring buffer header, and the remaining pages being for data packets.
90 */
91 typedef struct VMBusRingBufCommon {
92 AddressSpace *as;
93 /* GPA of the ring buffer header */
94 dma_addr_t rb_addr;
95 /* start and length of the ring buffer data area within GPADL */
96 uint32_t base;
97 uint32_t len;
98
99 GpadlIter iter;
100 } VMBusRingBufCommon;
101
102 typedef struct VMBusSendRingBuf {
103 VMBusRingBufCommon common;
104 /* current write index, to be committed at the end of send */
105 uint32_t wr_idx;
106 /* write index at the start of send */
107 uint32_t last_wr_idx;
108 /* space to be requested from the guest */
109 uint32_t wanted;
110 /* space reserved for planned sends */
111 uint32_t reserved;
112 /* last seen read index */
113 uint32_t last_seen_rd_idx;
114 } VMBusSendRingBuf;
115
116 typedef struct VMBusRecvRingBuf {
117 VMBusRingBufCommon common;
118 /* current read index, to be committed at the end of receive */
119 uint32_t rd_idx;
120 /* read index at the start of receive */
121 uint32_t last_rd_idx;
122 /* last seen write index */
123 uint32_t last_seen_wr_idx;
124 } VMBusRecvRingBuf;
125
126
127 enum {
128 VMOFFER_INIT,
129 VMOFFER_SENDING,
130 VMOFFER_SENT,
131 };
132
133 enum {
134 VMCHAN_INIT,
135 VMCHAN_OPENING,
136 VMCHAN_OPEN,
137 };
138
139 struct VMBusChannel {
140 VMBusDevice *dev;
141
142 /* channel id */
143 uint32_t id;
144 /*
145 * subchannel index within the device; subchannel #0 is "primary" and
146 * always exists
147 */
148 uint16_t subchan_idx;
149 uint32_t open_id;
150 /* VP_INDEX of the vCPU to notify with (synthetic) interrupts */
151 uint32_t target_vp;
152 /* GPADL id to use for the ring buffers */
153 uint32_t ringbuf_gpadl;
154 /* start (in pages) of the send ring buffer within @ringbuf_gpadl */
155 uint32_t ringbuf_send_offset;
156
157 uint8_t offer_state;
158 uint8_t state;
159 bool is_open;
160
161 /* main device worker; copied from the device class */
162 VMBusChannelNotifyCb notify_cb;
163 /*
164 * guest->host notifications, either sent directly or dispatched via
165 * interrupt page (older VMBus)
166 */
167 EventNotifier notifier;
168
169 VMBus *vmbus;
170 /*
171 * SINT route to signal with host->guest notifications; may be shared with
172 * the main VMBus SINT route
173 */
174 HvSintRoute *notify_route;
175 VMBusGpadl *gpadl;
176
177 VMBusSendRingBuf send_ringbuf;
178 VMBusRecvRingBuf recv_ringbuf;
179
180 QTAILQ_ENTRY(VMBusChannel) link;
181 };
182
183 /*
184 * Hyper-V spec mandates that every message port has 16 buffers, which means
185 * that the guest can post up to this many messages without blocking.
186 * Therefore a queue for incoming messages has to be provided.
187 * For outgoing (i.e. host->guest) messages there's no queue; the VMBus just
188 * doesn't transition to a new state until the message is known to have been
189 * successfully delivered to the respective SynIC message slot.
190 */
191 #define HV_MSG_QUEUE_LEN 16
192
193 /* Hyper-V devices never use channel #0. Must be something special. */
194 #define VMBUS_FIRST_CHANID 1
195 /* Each channel occupies one bit within a single event page sint slot. */
196 #define VMBUS_CHANID_COUNT (HV_EVENT_FLAGS_COUNT - VMBUS_FIRST_CHANID)
197 /* Leave a few connection numbers for other purposes. */
198 #define VMBUS_CHAN_CONNECTION_OFFSET 16
199
200 /*
201 * Since the success or failure of sending a message is reported
202 * asynchronously, the VMBus state machine has effectively two entry points:
203 * vmbus_run and vmbus_msg_cb (the latter is called when the host->guest
204 * message delivery status becomes known). Both are run as oneshot BHs on the
205 * main aio context, ensuring serialization.
206 */
207 enum {
208 VMBUS_LISTEN,
209 VMBUS_HANDSHAKE,
210 VMBUS_OFFER,
211 VMBUS_CREATE_GPADL,
212 VMBUS_TEARDOWN_GPADL,
213 VMBUS_OPEN_CHANNEL,
214 VMBUS_UNLOAD,
215 VMBUS_STATE_MAX
216 };
217
218 struct VMBus {
219 BusState parent;
220
221 uint8_t state;
222 /* protection against recursive aio_poll (see vmbus_run) */
223 bool in_progress;
224 /* whether there's a message being delivered to the guest */
225 bool msg_in_progress;
226 uint32_t version;
227 /* VP_INDEX of the vCPU to send messages and interrupts to */
228 uint32_t target_vp;
229 HvSintRoute *sint_route;
230 /*
231 * interrupt page for older protocol versions; newer ones use SynIC event
232 * flags directly
233 */
234 hwaddr int_page_gpa;
235
236 DECLARE_BITMAP(chanid_bitmap, VMBUS_CHANID_COUNT);
237
238 /* incoming message queue */
239 struct hyperv_post_message_input rx_queue[HV_MSG_QUEUE_LEN];
240 uint8_t rx_queue_head;
241 uint8_t rx_queue_size;
242 QemuMutex rx_queue_lock;
243
244 QTAILQ_HEAD(, VMBusGpadl) gpadl_list;
245 QTAILQ_HEAD(, VMBusChannel) channel_list;
246
247 /*
248 * guest->host notifications for older VMBus, to be dispatched via
249 * interrupt page
250 */
251 EventNotifier notifier;
252
253 /*
254 * Notifier to inform when vmfd is changed as a part of confidential guest
255 * reset mechanism.
256 */
257 NotifierWithReturn vmbus_vmfd_change_notifier;
258 };
259
260 static bool gpadl_full(VMBusGpadl *gpadl)
261 {
262 return gpadl->seen_gfns == gpadl->num_gfns;
263 }
264
265 static VMBusGpadl *create_gpadl(VMBus *vmbus, uint32_t id,
266 uint32_t child_relid, uint32_t num_gfns)
267 {
268 VMBusGpadl *gpadl = g_new0(VMBusGpadl, 1);
269
270 gpadl->id = id;
271 gpadl->child_relid = child_relid;
272 gpadl->num_gfns = num_gfns;
273 gpadl->gfns = g_new(uint64_t, num_gfns);
274 QTAILQ_INSERT_HEAD(&vmbus->gpadl_list, gpadl, link);
275 gpadl->vmbus = vmbus;
276 gpadl->refcount = 1;
277 return gpadl;
278 }
279
280 static void free_gpadl(VMBusGpadl *gpadl)
281 {
282 QTAILQ_REMOVE(&gpadl->vmbus->gpadl_list, gpadl, link);
283 g_free(gpadl->gfns);
284 g_free(gpadl);
285 }
286
287 static VMBusGpadl *find_gpadl(VMBus *vmbus, uint32_t gpadl_id)
288 {
289 VMBusGpadl *gpadl;
290 QTAILQ_FOREACH(gpadl, &vmbus->gpadl_list, link) {
291 if (gpadl->id == gpadl_id) {
292 return gpadl;
293 }
294 }
295 return NULL;
296 }
297
298 VMBusGpadl *vmbus_get_gpadl(VMBusChannel *chan, uint32_t gpadl_id)
299 {
300 VMBusGpadl *gpadl = find_gpadl(chan->vmbus, gpadl_id);
301 if (!gpadl || !gpadl_full(gpadl)) {
302 return NULL;
303 }
304 gpadl->refcount++;
305 return gpadl;
306 }
307
308 void vmbus_put_gpadl(VMBusGpadl *gpadl)
309 {
310 if (!gpadl) {
311 return;
312 }
313 if (--gpadl->refcount) {
314 return;
315 }
316 free_gpadl(gpadl);
317 }
318
319 uint32_t vmbus_gpadl_len(VMBusGpadl *gpadl)
320 {
321 return gpadl->num_gfns * TARGET_PAGE_SIZE;
322 }
323
324 static void gpadl_iter_init(GpadlIter *iter, VMBusGpadl *gpadl,
325 AddressSpace *as, DMADirection dir)
326 {
327 iter->gpadl = gpadl;
328 iter->as = as;
329 iter->dir = dir;
330 iter->active = false;
331 }
332
333 static inline void gpadl_iter_cache_unmap(GpadlIter *iter)
334 {
335 uint32_t map_start_in_page = (uintptr_t)iter->map & ~TARGET_PAGE_MASK;
336 uint32_t io_end_in_page = ((iter->last_off - 1) & ~TARGET_PAGE_MASK) + 1;
337
338 /* mapping is only done to do non-zero amount of i/o */
339 assert(iter->last_off > 0);
340 assert(map_start_in_page < io_end_in_page);
341
342 dma_memory_unmap(iter->as, iter->map, TARGET_PAGE_SIZE - map_start_in_page,
343 iter->dir, io_end_in_page - map_start_in_page);
344 }
345
346 /*
347 * Copy exactly @len bytes between the GPADL pointed to by @iter and @buf.
348 * The direction of the copy is determined by @iter->dir.
349 * The caller must ensure the operation overflows neither @buf nor the GPADL
350 * (there's an assert for the latter).
351 * Reuse the currently mapped page in the GPADL if possible.
352 */
353 static ssize_t gpadl_iter_io(GpadlIter *iter, void *buf, uint32_t len)
354 {
355 ssize_t ret = len;
356
357 assert(iter->active);
358
359 while (len) {
360 uint32_t off_in_page = iter->off & ~TARGET_PAGE_MASK;
361 uint32_t pgleft = TARGET_PAGE_SIZE - off_in_page;
362 uint32_t cplen = MIN(pgleft, len);
363 void *p;
364
365 /* try to reuse the cached mapping */
366 if (iter->map) {
367 uint32_t map_start_in_page =
368 (uintptr_t)iter->map & ~TARGET_PAGE_MASK;
369 uint32_t off_base = iter->off & ~TARGET_PAGE_MASK;
370 uint32_t mapped_base = (iter->last_off - 1) & ~TARGET_PAGE_MASK;
371 if (off_base != mapped_base || off_in_page < map_start_in_page) {
372 gpadl_iter_cache_unmap(iter);
373 iter->map = NULL;
374 }
375 }
376
377 if (!iter->map) {
378 dma_addr_t maddr;
379 dma_addr_t mlen = pgleft;
380 uint32_t idx = iter->off >> TARGET_PAGE_BITS;
381 assert(idx < iter->gpadl->num_gfns);
382
383 maddr = (iter->gpadl->gfns[idx] << TARGET_PAGE_BITS) | off_in_page;
384
385 iter->map = dma_memory_map(iter->as, maddr, &mlen, iter->dir,
386 MEMTXATTRS_UNSPECIFIED);
387 if (mlen != pgleft) {
388 dma_memory_unmap(iter->as, iter->map, mlen, iter->dir, 0);
389 iter->map = NULL;
390 return -EFAULT;
391 }
392 }
393
394 p = (void *)(uintptr_t)(((uintptr_t)iter->map & TARGET_PAGE_MASK) |
395 off_in_page);
396 if (iter->dir == DMA_DIRECTION_FROM_DEVICE) {
397 memcpy(p, buf, cplen);
398 } else {
399 memcpy(buf, p, cplen);
400 }
401
402 buf += cplen;
403 len -= cplen;
404 iter->off += cplen;
405 iter->last_off = iter->off;
406 }
407
408 return ret;
409 }
410
411 /*
412 * Position the iterator @iter at new offset @new_off.
413 * If this results in the cached mapping being unusable with the new offset,
414 * unmap it.
415 */
416 static inline void gpadl_iter_seek(GpadlIter *iter, uint32_t new_off)
417 {
418 assert(iter->active);
419 iter->off = new_off;
420 }
421
422 /*
423 * Start a series of i/o on the GPADL.
424 * After this i/o and seek operations on @iter become legal.
425 */
426 static inline void gpadl_iter_start_io(GpadlIter *iter)
427 {
428 assert(!iter->active);
429 /* mapping is cached lazily on i/o */
430 iter->map = NULL;
431 iter->active = true;
432 }
433
434 /*
435 * End the eariler started series of i/o on the GPADL and release the cached
436 * mapping if any.
437 */
438 static inline void gpadl_iter_end_io(GpadlIter *iter)
439 {
440 assert(iter->active);
441
442 if (iter->map) {
443 gpadl_iter_cache_unmap(iter);
444 }
445
446 iter->active = false;
447 }
448
449 static void vmbus_resched(VMBus *vmbus);
450 static void vmbus_msg_cb(void *data, int status);
451
452 ssize_t vmbus_iov_to_gpadl(VMBusChannel *chan, VMBusGpadl *gpadl, uint32_t off,
453 const struct iovec *iov, size_t iov_cnt)
454 {
455 GpadlIter iter;
456 size_t i;
457 ssize_t ret = 0;
458
459 gpadl_iter_init(&iter, gpadl, chan->dev->dma_as,
460 DMA_DIRECTION_FROM_DEVICE);
461 gpadl_iter_start_io(&iter);
462 gpadl_iter_seek(&iter, off);
463 for (i = 0; i < iov_cnt; i++) {
464 ret = gpadl_iter_io(&iter, iov[i].iov_base, iov[i].iov_len);
465 if (ret < 0) {
466 goto out;
467 }
468 }
469 out:
470 gpadl_iter_end_io(&iter);
471 return ret;
472 }
473
474 int vmbus_map_sgl(VMBusChanReq *req, DMADirection dir, struct iovec *iov,
475 unsigned iov_cnt, size_t len, size_t off)
476 {
477 int ret_cnt = 0, ret;
478 unsigned i;
479 QEMUSGList *sgl = &req->sgl;
480 ScatterGatherEntry *sg = sgl->sg;
481
482 for (i = 0; i < sgl->nsg; i++) {
483 if (sg[i].len > off) {
484 break;
485 }
486 off -= sg[i].len;
487 }
488 for (; len && i < sgl->nsg; i++) {
489 dma_addr_t mlen = MIN(sg[i].len - off, len);
490 dma_addr_t addr = sg[i].base + off;
491 len -= mlen;
492 off = 0;
493
494 for (; mlen; ret_cnt++) {
495 dma_addr_t l = mlen;
496 dma_addr_t a = addr;
497
498 if (ret_cnt == iov_cnt) {
499 ret = -ENOBUFS;
500 goto err;
501 }
502
503 iov[ret_cnt].iov_base = dma_memory_map(sgl->as, a, &l, dir,
504 MEMTXATTRS_UNSPECIFIED);
505 if (!l) {
506 ret = -EFAULT;
507 goto err;
508 }
509 iov[ret_cnt].iov_len = l;
510 addr += l;
511 mlen -= l;
512 }
513 }
514
515 return ret_cnt;
516 err:
517 vmbus_unmap_sgl(req, dir, iov, ret_cnt, 0);
518 return ret;
519 }
520
521 void vmbus_unmap_sgl(VMBusChanReq *req, DMADirection dir, struct iovec *iov,
522 unsigned iov_cnt, size_t accessed)
523 {
524 QEMUSGList *sgl = &req->sgl;
525 unsigned i;
526
527 for (i = 0; i < iov_cnt; i++) {
528 size_t acsd = MIN(accessed, iov[i].iov_len);
529 dma_memory_unmap(sgl->as, iov[i].iov_base, iov[i].iov_len, dir, acsd);
530 accessed -= acsd;
531 }
532 }
533
534 static const VMStateDescription vmstate_gpadl = {
535 .name = "vmbus/gpadl",
536 .version_id = 0,
537 .minimum_version_id = 0,
538 .fields = (const VMStateField[]) {
539 VMSTATE_UINT32(id, VMBusGpadl),
540 VMSTATE_UINT32(child_relid, VMBusGpadl),
541 VMSTATE_UINT32(num_gfns, VMBusGpadl),
542 VMSTATE_UINT32(seen_gfns, VMBusGpadl),
543 VMSTATE_VARRAY_UINT32_ALLOC(gfns, VMBusGpadl, num_gfns, 0,
544 vmstate_info_uint64, uint64_t),
545 VMSTATE_UINT8(state, VMBusGpadl),
546 VMSTATE_END_OF_LIST()
547 }
548 };
549
550 /*
551 * Wrap the index into a ring buffer of @len bytes.
552 * @idx is assumed not to exceed twice the size of the ringbuffer, so only
553 * single wraparound is considered.
554 */
555 static inline uint32_t rb_idx_wrap(uint32_t idx, uint32_t len)
556 {
557 if (idx >= len) {
558 idx -= len;
559 }
560 return idx;
561 }
562
563 /*
564 * Circular difference between two indices into a ring buffer of @len bytes.
565 * @allow_catchup - whether @idx1 may catch up @idx2; e.g. read index may catch
566 * up write index but not vice versa.
567 */
568 static inline uint32_t rb_idx_delta(uint32_t idx1, uint32_t idx2, uint32_t len,
569 bool allow_catchup)
570 {
571 return rb_idx_wrap(idx2 + len - idx1 - !allow_catchup, len);
572 }
573
574 static vmbus_ring_buffer *ringbuf_map_hdr(VMBusRingBufCommon *ringbuf)
575 {
576 vmbus_ring_buffer *rb;
577 dma_addr_t mlen = sizeof(*rb);
578
579 rb = dma_memory_map(ringbuf->as, ringbuf->rb_addr, &mlen,
580 DMA_DIRECTION_FROM_DEVICE, MEMTXATTRS_UNSPECIFIED);
581 if (mlen != sizeof(*rb)) {
582 dma_memory_unmap(ringbuf->as, rb, mlen,
583 DMA_DIRECTION_FROM_DEVICE, 0);
584 return NULL;
585 }
586 return rb;
587 }
588
589 static void ringbuf_unmap_hdr(VMBusRingBufCommon *ringbuf,
590 vmbus_ring_buffer *rb, bool dirty)
591 {
592 assert(rb);
593
594 dma_memory_unmap(ringbuf->as, rb, sizeof(*rb), DMA_DIRECTION_FROM_DEVICE,
595 dirty ? sizeof(*rb) : 0);
596 }
597
598 static void ringbuf_init_common(VMBusRingBufCommon *ringbuf, VMBusGpadl *gpadl,
599 AddressSpace *as, DMADirection dir,
600 uint32_t begin, uint32_t end)
601 {
602 ringbuf->as = as;
603 ringbuf->rb_addr = gpadl->gfns[begin] << TARGET_PAGE_BITS;
604 ringbuf->base = (begin + 1) << TARGET_PAGE_BITS;
605 ringbuf->len = (end - begin - 1) << TARGET_PAGE_BITS;
606 gpadl_iter_init(&ringbuf->iter, gpadl, as, dir);
607 }
608
609 static int ringbufs_init(VMBusChannel *chan)
610 {
611 vmbus_ring_buffer *rb;
612 VMBusSendRingBuf *send_ringbuf = &chan->send_ringbuf;
613 VMBusRecvRingBuf *recv_ringbuf = &chan->recv_ringbuf;
614
615 if (chan->ringbuf_send_offset <= 1 ||
616 chan->gpadl->num_gfns <= chan->ringbuf_send_offset + 1) {
617 return -EINVAL;
618 }
619
620 ringbuf_init_common(&recv_ringbuf->common, chan->gpadl, chan->dev->dma_as,
621 DMA_DIRECTION_TO_DEVICE, 0, chan->ringbuf_send_offset);
622 ringbuf_init_common(&send_ringbuf->common, chan->gpadl, chan->dev->dma_as,
623 DMA_DIRECTION_FROM_DEVICE, chan->ringbuf_send_offset,
624 chan->gpadl->num_gfns);
625 send_ringbuf->wanted = 0;
626 send_ringbuf->reserved = 0;
627
628 rb = ringbuf_map_hdr(&recv_ringbuf->common);
629 if (!rb) {
630 return -EFAULT;
631 }
632 recv_ringbuf->rd_idx = recv_ringbuf->last_rd_idx = rb->read_index;
633 ringbuf_unmap_hdr(&recv_ringbuf->common, rb, false);
634
635 rb = ringbuf_map_hdr(&send_ringbuf->common);
636 if (!rb) {
637 return -EFAULT;
638 }
639 send_ringbuf->wr_idx = send_ringbuf->last_wr_idx = rb->write_index;
640 send_ringbuf->last_seen_rd_idx = rb->read_index;
641 rb->feature_bits |= VMBUS_RING_BUFFER_FEAT_PENDING_SZ;
642 ringbuf_unmap_hdr(&send_ringbuf->common, rb, true);
643
644 if (recv_ringbuf->rd_idx >= recv_ringbuf->common.len ||
645 send_ringbuf->wr_idx >= send_ringbuf->common.len) {
646 return -EOVERFLOW;
647 }
648
649 return 0;
650 }
651
652 /*
653 * Perform io between the GPADL-backed ringbuffer @ringbuf and @buf, wrapping
654 * around if needed.
655 * @len is assumed not to exceed the size of the ringbuffer, so only single
656 * wraparound is considered.
657 */
658 static ssize_t ringbuf_io(VMBusRingBufCommon *ringbuf, void *buf, uint32_t len)
659 {
660 ssize_t ret1 = 0, ret2 = 0;
661 uint32_t remain = ringbuf->len + ringbuf->base - ringbuf->iter.off;
662
663 if (len >= remain) {
664 ret1 = gpadl_iter_io(&ringbuf->iter, buf, remain);
665 if (ret1 < 0) {
666 return ret1;
667 }
668 gpadl_iter_seek(&ringbuf->iter, ringbuf->base);
669 buf += remain;
670 len -= remain;
671 }
672 ret2 = gpadl_iter_io(&ringbuf->iter, buf, len);
673 if (ret2 < 0) {
674 return ret2;
675 }
676 return ret1 + ret2;
677 }
678
679 /*
680 * Position the circular iterator within @ringbuf to offset @new_off, wrapping
681 * around if needed.
682 * @new_off is assumed not to exceed twice the size of the ringbuffer, so only
683 * single wraparound is considered.
684 */
685 static inline void ringbuf_seek(VMBusRingBufCommon *ringbuf, uint32_t new_off)
686 {
687 gpadl_iter_seek(&ringbuf->iter,
688 ringbuf->base + rb_idx_wrap(new_off, ringbuf->len));
689 }
690
691 static inline uint32_t ringbuf_tell(VMBusRingBufCommon *ringbuf)
692 {
693 return ringbuf->iter.off - ringbuf->base;
694 }
695
696 static inline void ringbuf_start_io(VMBusRingBufCommon *ringbuf)
697 {
698 gpadl_iter_start_io(&ringbuf->iter);
699 }
700
701 static inline void ringbuf_end_io(VMBusRingBufCommon *ringbuf)
702 {
703 gpadl_iter_end_io(&ringbuf->iter);
704 }
705
706 VMBusDevice *vmbus_channel_device(VMBusChannel *chan)
707 {
708 return chan->dev;
709 }
710
711 VMBusChannel *vmbus_device_channel(VMBusDevice *dev, uint32_t chan_idx)
712 {
713 if (chan_idx >= dev->num_channels) {
714 return NULL;
715 }
716 return &dev->channels[chan_idx];
717 }
718
719 uint32_t vmbus_channel_idx(VMBusChannel *chan)
720 {
721 return chan - chan->dev->channels;
722 }
723
724 void vmbus_channel_notify_host(VMBusChannel *chan)
725 {
726 event_notifier_set(&chan->notifier);
727 }
728
729 bool vmbus_channel_is_open(VMBusChannel *chan)
730 {
731 return chan->is_open;
732 }
733
734 /*
735 * Notify the guest side about the data to work on in the channel ring buffer.
736 * The notification is done by signaling a dedicated per-channel SynIC event
737 * flag (more recent guests) or setting a bit in the interrupt page and firing
738 * the VMBus SINT (older guests).
739 */
740 static int vmbus_channel_notify_guest(VMBusChannel *chan)
741 {
742 int res = 0;
743 unsigned long *int_map, mask;
744 unsigned idx;
745 hwaddr addr = chan->vmbus->int_page_gpa;
746 hwaddr len = TARGET_PAGE_SIZE / 2, dirty = 0;
747
748 trace_vmbus_channel_notify_guest(chan->id);
749
750 if (!addr) {
751 return hyperv_set_event_flag(chan->notify_route, chan->id);
752 }
753
754 int_map = physical_memory_map(addr, &len, 1);
755 if (len != TARGET_PAGE_SIZE / 2) {
756 res = -ENXIO;
757 goto unmap;
758 }
759
760 idx = BIT_WORD(chan->id);
761 mask = BIT_MASK(chan->id);
762 if ((qatomic_fetch_or(&int_map[idx], mask) & mask) != mask) {
763 res = hyperv_sint_route_set_sint(chan->notify_route);
764 dirty = len;
765 }
766
767 unmap:
768 physical_memory_unmap(int_map, len, 1, dirty);
769 return res;
770 }
771
772 #define VMBUS_PKT_TRAILER sizeof(uint64_t)
773
774 static uint32_t vmbus_pkt_hdr_set_offsets(vmbus_packet_hdr *hdr,
775 uint32_t desclen, uint32_t msglen)
776 {
777 hdr->offset_qwords = sizeof(*hdr) / sizeof(uint64_t) +
778 DIV_ROUND_UP(desclen, sizeof(uint64_t));
779 hdr->len_qwords = hdr->offset_qwords +
780 DIV_ROUND_UP(msglen, sizeof(uint64_t));
781 return hdr->len_qwords * sizeof(uint64_t) + VMBUS_PKT_TRAILER;
782 }
783
784 /*
785 * Simplified ring buffer operation with paired barriers annotations in the
786 * producer and consumer loops:
787 *
788 * producer * consumer
789 * ~~~~~~~~ * ~~~~~~~~
790 * write pending_send_sz * read write_index
791 * smp_mb [A] * smp_mb [C]
792 * read read_index * read packet
793 * smp_mb [B] * read/write out-of-band data
794 * read/write out-of-band data * smp_mb [B]
795 * write packet * write read_index
796 * smp_mb [C] * smp_mb [A]
797 * write write_index * read pending_send_sz
798 * smp_wmb [D] * smp_rmb [D]
799 * write pending_send_sz * read write_index
800 * ... * ...
801 */
802
803 static inline uint32_t ringbuf_send_avail(VMBusSendRingBuf *ringbuf)
804 {
805 /* don't trust guest data */
806 if (ringbuf->last_seen_rd_idx >= ringbuf->common.len) {
807 return 0;
808 }
809 return rb_idx_delta(ringbuf->wr_idx, ringbuf->last_seen_rd_idx,
810 ringbuf->common.len, false);
811 }
812
813 static ssize_t ringbuf_send_update_idx(VMBusChannel *chan)
814 {
815 VMBusSendRingBuf *ringbuf = &chan->send_ringbuf;
816 vmbus_ring_buffer *rb;
817 uint32_t written;
818
819 written = rb_idx_delta(ringbuf->last_wr_idx, ringbuf->wr_idx,
820 ringbuf->common.len, true);
821 if (!written) {
822 return 0;
823 }
824
825 rb = ringbuf_map_hdr(&ringbuf->common);
826 if (!rb) {
827 return -EFAULT;
828 }
829
830 ringbuf->reserved -= written;
831
832 /* prevent reorder with the data operation and packet write */
833 smp_mb(); /* barrier pair [C] */
834 rb->write_index = ringbuf->wr_idx;
835
836 /*
837 * If the producer earlier indicated that it wants to be notified when the
838 * consumer frees certain amount of space in the ring buffer, that amount
839 * is reduced by the size of the completed write.
840 */
841 if (ringbuf->wanted) {
842 /* otherwise reservation would fail */
843 assert(ringbuf->wanted < written);
844 ringbuf->wanted -= written;
845 /* prevent reorder with write_index write */
846 smp_wmb(); /* barrier pair [D] */
847 rb->pending_send_sz = ringbuf->wanted;
848 }
849
850 /* prevent reorder with write_index or pending_send_sz write */
851 smp_mb(); /* barrier pair [A] */
852 ringbuf->last_seen_rd_idx = rb->read_index;
853
854 /*
855 * The consumer may have missed the reduction of pending_send_sz and skip
856 * notification, so re-check the blocking condition, and, if it's no longer
857 * true, ensure processing another iteration by simulating consumer's
858 * notification.
859 */
860 if (ringbuf_send_avail(ringbuf) >= ringbuf->wanted) {
861 vmbus_channel_notify_host(chan);
862 }
863
864 /* skip notification by consumer's request */
865 if (rb->interrupt_mask) {
866 goto out;
867 }
868
869 /*
870 * The consumer hasn't caught up with the producer's previous state so it's
871 * not blocked.
872 * (last_seen_rd_idx comes from the guest but it's safe to use w/o
873 * validation here as it only affects notification.)
874 */
875 if (rb_idx_delta(ringbuf->last_seen_rd_idx, ringbuf->wr_idx,
876 ringbuf->common.len, true) > written) {
877 goto out;
878 }
879
880 vmbus_channel_notify_guest(chan);
881 out:
882 ringbuf_unmap_hdr(&ringbuf->common, rb, true);
883 ringbuf->last_wr_idx = ringbuf->wr_idx;
884 return written;
885 }
886
887 int vmbus_channel_reserve(VMBusChannel *chan,
888 uint32_t desclen, uint32_t msglen)
889 {
890 VMBusSendRingBuf *ringbuf = &chan->send_ringbuf;
891 vmbus_ring_buffer *rb = NULL;
892 vmbus_packet_hdr hdr;
893 uint32_t needed = ringbuf->reserved +
894 vmbus_pkt_hdr_set_offsets(&hdr, desclen, msglen);
895
896 /* avoid touching the guest memory if possible */
897 if (likely(needed <= ringbuf_send_avail(ringbuf))) {
898 goto success;
899 }
900
901 rb = ringbuf_map_hdr(&ringbuf->common);
902 if (!rb) {
903 return -EFAULT;
904 }
905
906 /* fetch read index from guest memory and try again */
907 ringbuf->last_seen_rd_idx = rb->read_index;
908
909 if (likely(needed <= ringbuf_send_avail(ringbuf))) {
910 goto success;
911 }
912
913 rb->pending_send_sz = needed;
914
915 /*
916 * The consumer may have made progress and freed up some space before
917 * seeing updated pending_send_sz, so re-read read_index (preventing
918 * reorder with the pending_send_sz write) and try again.
919 */
920 smp_mb(); /* barrier pair [A] */
921 ringbuf->last_seen_rd_idx = rb->read_index;
922
923 if (needed > ringbuf_send_avail(ringbuf)) {
924 goto out;
925 }
926
927 success:
928 ringbuf->reserved = needed;
929 needed = 0;
930
931 /* clear pending_send_sz if it was set */
932 if (ringbuf->wanted) {
933 if (!rb) {
934 rb = ringbuf_map_hdr(&ringbuf->common);
935 if (!rb) {
936 /* failure to clear pending_send_sz is non-fatal */
937 goto out;
938 }
939 }
940
941 rb->pending_send_sz = 0;
942 }
943
944 /* prevent reorder of the following data operation with read_index read */
945 smp_mb(); /* barrier pair [B] */
946
947 out:
948 if (rb) {
949 ringbuf_unmap_hdr(&ringbuf->common, rb, ringbuf->wanted == needed);
950 }
951 ringbuf->wanted = needed;
952 return needed ? -ENOSPC : 0;
953 }
954
955 ssize_t vmbus_channel_send(VMBusChannel *chan, uint16_t pkt_type,
956 void *desc, uint32_t desclen,
957 void *msg, uint32_t msglen,
958 bool need_comp, uint64_t transaction_id)
959 {
960 ssize_t ret = 0;
961 vmbus_packet_hdr hdr;
962 uint32_t totlen;
963 VMBusSendRingBuf *ringbuf = &chan->send_ringbuf;
964
965 if (!vmbus_channel_is_open(chan)) {
966 return -EINVAL;
967 }
968
969 totlen = vmbus_pkt_hdr_set_offsets(&hdr, desclen, msglen);
970 hdr.type = pkt_type;
971 hdr.flags = need_comp ? VMBUS_PACKET_FLAG_REQUEST_COMPLETION : 0;
972 hdr.transaction_id = transaction_id;
973
974 assert(totlen <= ringbuf->reserved);
975
976 ringbuf_start_io(&ringbuf->common);
977 ringbuf_seek(&ringbuf->common, ringbuf->wr_idx);
978 ret = ringbuf_io(&ringbuf->common, &hdr, sizeof(hdr));
979 if (ret < 0) {
980 goto out;
981 }
982 if (desclen) {
983 assert(desc);
984 ret = ringbuf_io(&ringbuf->common, desc, desclen);
985 if (ret < 0) {
986 goto out;
987 }
988 ringbuf_seek(&ringbuf->common,
989 ringbuf->wr_idx + hdr.offset_qwords * sizeof(uint64_t));
990 }
991 ret = ringbuf_io(&ringbuf->common, msg, msglen);
992 if (ret < 0) {
993 goto out;
994 }
995 ringbuf_seek(&ringbuf->common, ringbuf->wr_idx + totlen);
996 ringbuf->wr_idx = ringbuf_tell(&ringbuf->common);
997 ret = 0;
998 out:
999 ringbuf_end_io(&ringbuf->common);
1000 if (ret) {
1001 return ret;
1002 }
1003 return ringbuf_send_update_idx(chan);
1004 }
1005
1006 ssize_t vmbus_channel_send_completion(VMBusChanReq *req,
1007 void *msg, uint32_t msglen)
1008 {
1009 assert(req->need_comp);
1010 return vmbus_channel_send(req->chan, VMBUS_PACKET_COMP, NULL, 0,
1011 msg, msglen, false, req->transaction_id);
1012 }
1013
1014 static int sgl_from_gpa_ranges(QEMUSGList *sgl, VMBusDevice *dev,
1015 VMBusRingBufCommon *ringbuf, uint32_t len)
1016 {
1017 int ret;
1018 vmbus_pkt_gpa_direct hdr;
1019 hwaddr curaddr = 0;
1020 hwaddr curlen = 0;
1021 int num;
1022
1023 if (len < sizeof(hdr)) {
1024 return -EIO;
1025 }
1026 ret = ringbuf_io(ringbuf, &hdr, sizeof(hdr));
1027 if (ret < 0) {
1028 return ret;
1029 }
1030 len -= sizeof(hdr);
1031
1032 num = (len - hdr.rangecount * sizeof(vmbus_gpa_range)) / sizeof(uint64_t);
1033 if (num < 0) {
1034 return -EIO;
1035 }
1036 qemu_sglist_init(sgl, DEVICE(dev), num, ringbuf->as);
1037
1038 for (; hdr.rangecount; hdr.rangecount--) {
1039 vmbus_gpa_range range;
1040
1041 if (len < sizeof(range)) {
1042 goto eio;
1043 }
1044 ret = ringbuf_io(ringbuf, &range, sizeof(range));
1045 if (ret < 0) {
1046 goto err;
1047 }
1048 len -= sizeof(range);
1049
1050 if (range.byte_offset & TARGET_PAGE_MASK) {
1051 goto eio;
1052 }
1053
1054 for (; range.byte_count; range.byte_offset = 0) {
1055 uint64_t paddr;
1056 uint32_t plen = MIN(range.byte_count,
1057 TARGET_PAGE_SIZE - range.byte_offset);
1058
1059 if (len < sizeof(uint64_t)) {
1060 goto eio;
1061 }
1062 ret = ringbuf_io(ringbuf, &paddr, sizeof(paddr));
1063 if (ret < 0) {
1064 goto err;
1065 }
1066 len -= sizeof(uint64_t);
1067 paddr <<= TARGET_PAGE_BITS;
1068 paddr |= range.byte_offset;
1069 range.byte_count -= plen;
1070
1071 if (curaddr + curlen == paddr) {
1072 /* consecutive fragments - join */
1073 curlen += plen;
1074 } else {
1075 if (curlen) {
1076 qemu_sglist_add(sgl, curaddr, curlen);
1077 }
1078
1079 curaddr = paddr;
1080 curlen = plen;
1081 }
1082 }
1083 }
1084
1085 if (curlen) {
1086 qemu_sglist_add(sgl, curaddr, curlen);
1087 }
1088
1089 return 0;
1090 eio:
1091 ret = -EIO;
1092 err:
1093 qemu_sglist_destroy(sgl);
1094 return ret;
1095 }
1096
1097 static VMBusChanReq *vmbus_alloc_req(VMBusChannel *chan,
1098 uint32_t size, uint16_t pkt_type,
1099 uint32_t msglen, uint64_t transaction_id,
1100 bool need_comp)
1101 {
1102 VMBusChanReq *req;
1103 uint32_t msgoff = QEMU_ALIGN_UP(size, __alignof__(*req->msg));
1104 uint32_t totlen = msgoff + msglen;
1105
1106 req = g_malloc0(totlen);
1107 req->chan = chan;
1108 req->pkt_type = pkt_type;
1109 req->msg = (void *)req + msgoff;
1110 req->msglen = msglen;
1111 req->transaction_id = transaction_id;
1112 req->need_comp = need_comp;
1113 return req;
1114 }
1115
1116 int vmbus_channel_recv_start(VMBusChannel *chan)
1117 {
1118 VMBusRecvRingBuf *ringbuf = &chan->recv_ringbuf;
1119 vmbus_ring_buffer *rb;
1120
1121 rb = ringbuf_map_hdr(&ringbuf->common);
1122 if (!rb) {
1123 return -EFAULT;
1124 }
1125 ringbuf->last_seen_wr_idx = rb->write_index;
1126 ringbuf_unmap_hdr(&ringbuf->common, rb, false);
1127
1128 if (ringbuf->last_seen_wr_idx >= ringbuf->common.len) {
1129 return -EOVERFLOW;
1130 }
1131
1132 /* prevent reorder of the following data operation with write_index read */
1133 smp_mb(); /* barrier pair [C] */
1134 return 0;
1135 }
1136
1137 void *vmbus_channel_recv_peek(VMBusChannel *chan, uint32_t size)
1138 {
1139 VMBusRecvRingBuf *ringbuf = &chan->recv_ringbuf;
1140 vmbus_packet_hdr hdr = {};
1141 VMBusChanReq *req;
1142 uint32_t avail;
1143 uint32_t totlen, pktlen, msglen, msgoff, desclen;
1144
1145 assert(size >= sizeof(*req));
1146
1147 /* safe as last_seen_wr_idx is validated in vmbus_channel_recv_start */
1148 avail = rb_idx_delta(ringbuf->rd_idx, ringbuf->last_seen_wr_idx,
1149 ringbuf->common.len, true);
1150 if (avail < sizeof(hdr)) {
1151 return NULL;
1152 }
1153
1154 ringbuf_seek(&ringbuf->common, ringbuf->rd_idx);
1155 if (ringbuf_io(&ringbuf->common, &hdr, sizeof(hdr)) < 0) {
1156 return NULL;
1157 }
1158
1159 pktlen = hdr.len_qwords * sizeof(uint64_t);
1160 totlen = pktlen + VMBUS_PKT_TRAILER;
1161 if (totlen > avail) {
1162 return NULL;
1163 }
1164
1165 msgoff = hdr.offset_qwords * sizeof(uint64_t);
1166 if (msgoff > pktlen || msgoff < sizeof(hdr)) {
1167 error_report("%s: malformed packet: %u %u", __func__, msgoff, pktlen);
1168 return NULL;
1169 }
1170
1171 msglen = pktlen - msgoff;
1172
1173 req = vmbus_alloc_req(chan, size, hdr.type, msglen, hdr.transaction_id,
1174 hdr.flags & VMBUS_PACKET_FLAG_REQUEST_COMPLETION);
1175
1176 switch (hdr.type) {
1177 case VMBUS_PACKET_DATA_USING_GPA_DIRECT:
1178 desclen = msgoff - sizeof(hdr);
1179 if (sgl_from_gpa_ranges(&req->sgl, chan->dev, &ringbuf->common,
1180 desclen) < 0) {
1181 error_report("%s: failed to convert GPA ranges to SGL", __func__);
1182 goto free_req;
1183 }
1184 break;
1185 case VMBUS_PACKET_DATA_INBAND:
1186 case VMBUS_PACKET_COMP:
1187 break;
1188 default:
1189 error_report("%s: unexpected msg type: %x", __func__, hdr.type);
1190 goto free_req;
1191 }
1192
1193 ringbuf_seek(&ringbuf->common, ringbuf->rd_idx + msgoff);
1194 if (ringbuf_io(&ringbuf->common, req->msg, msglen) < 0) {
1195 goto free_req;
1196 }
1197 ringbuf_seek(&ringbuf->common, ringbuf->rd_idx + totlen);
1198
1199 return req;
1200 free_req:
1201 vmbus_free_req(req);
1202 return NULL;
1203 }
1204
1205 void vmbus_channel_recv_pop(VMBusChannel *chan)
1206 {
1207 VMBusRecvRingBuf *ringbuf = &chan->recv_ringbuf;
1208 ringbuf->rd_idx = ringbuf_tell(&ringbuf->common);
1209 }
1210
1211 ssize_t vmbus_channel_recv_done(VMBusChannel *chan)
1212 {
1213 VMBusRecvRingBuf *ringbuf = &chan->recv_ringbuf;
1214 vmbus_ring_buffer *rb;
1215 uint32_t read;
1216
1217 read = rb_idx_delta(ringbuf->last_rd_idx, ringbuf->rd_idx,
1218 ringbuf->common.len, true);
1219 if (!read) {
1220 return 0;
1221 }
1222
1223 rb = ringbuf_map_hdr(&ringbuf->common);
1224 if (!rb) {
1225 return -EFAULT;
1226 }
1227
1228 /* prevent reorder with the data operation and packet read */
1229 smp_mb(); /* barrier pair [B] */
1230 rb->read_index = ringbuf->rd_idx;
1231
1232 /* prevent reorder of the following pending_send_sz read */
1233 smp_mb(); /* barrier pair [A] */
1234
1235 if (rb->interrupt_mask) {
1236 goto out;
1237 }
1238
1239 if (rb->feature_bits & VMBUS_RING_BUFFER_FEAT_PENDING_SZ) {
1240 uint32_t wr_idx, wr_avail;
1241 uint32_t wanted = rb->pending_send_sz;
1242
1243 if (!wanted) {
1244 goto out;
1245 }
1246
1247 /* prevent reorder with pending_send_sz read */
1248 smp_rmb(); /* barrier pair [D] */
1249 wr_idx = rb->write_index;
1250
1251 wr_avail = rb_idx_delta(wr_idx, ringbuf->rd_idx, ringbuf->common.len,
1252 true);
1253
1254 /* the producer wasn't blocked on the consumer state */
1255 if (wr_avail >= read + wanted) {
1256 goto out;
1257 }
1258 /* there's not enough space for the producer to make progress */
1259 if (wr_avail < wanted) {
1260 goto out;
1261 }
1262 }
1263
1264 vmbus_channel_notify_guest(chan);
1265 out:
1266 ringbuf_unmap_hdr(&ringbuf->common, rb, true);
1267 ringbuf->last_rd_idx = ringbuf->rd_idx;
1268 return read;
1269 }
1270
1271 void vmbus_free_req(void *req)
1272 {
1273 VMBusChanReq *r = req;
1274
1275 if (!req) {
1276 return;
1277 }
1278
1279 if (r->sgl.dev) {
1280 qemu_sglist_destroy(&r->sgl);
1281 }
1282 g_free(req);
1283 }
1284
1285 static void channel_event_cb(EventNotifier *e)
1286 {
1287 VMBusChannel *chan = container_of(e, VMBusChannel, notifier);
1288 if (event_notifier_test_and_clear(e)) {
1289 /*
1290 * All receives are supposed to happen within the device worker, so
1291 * bracket it with ringbuf_start/end_io on the receive ringbuffer, and
1292 * potentially reuse the cached mapping throughout the worker.
1293 * Can't do this for sends as they may happen outside the device
1294 * worker.
1295 */
1296 VMBusRecvRingBuf *ringbuf = &chan->recv_ringbuf;
1297 ringbuf_start_io(&ringbuf->common);
1298 chan->notify_cb(chan);
1299 ringbuf_end_io(&ringbuf->common);
1300
1301 }
1302 }
1303
1304 static int alloc_chan_id(VMBus *vmbus)
1305 {
1306 int ret;
1307
1308 ret = find_next_zero_bit(vmbus->chanid_bitmap, VMBUS_CHANID_COUNT, 0);
1309 if (ret == VMBUS_CHANID_COUNT) {
1310 return -ENOMEM;
1311 }
1312 return ret + VMBUS_FIRST_CHANID;
1313 }
1314
1315 static int register_chan_id(VMBusChannel *chan)
1316 {
1317 return test_and_set_bit(chan->id - VMBUS_FIRST_CHANID,
1318 chan->vmbus->chanid_bitmap) ? -EEXIST : 0;
1319 }
1320
1321 static void unregister_chan_id(VMBusChannel *chan)
1322 {
1323 clear_bit(chan->id - VMBUS_FIRST_CHANID, chan->vmbus->chanid_bitmap);
1324 }
1325
1326 static uint32_t chan_connection_id(VMBusChannel *chan)
1327 {
1328 return VMBUS_CHAN_CONNECTION_OFFSET + chan->id;
1329 }
1330
1331 static void init_channel(VMBus *vmbus, VMBusDevice *dev, VMBusDeviceClass *vdc,
1332 VMBusChannel *chan, uint16_t idx, Error **errp)
1333 {
1334 int res;
1335
1336 chan->dev = dev;
1337 chan->notify_cb = vdc->chan_notify_cb;
1338 chan->subchan_idx = idx;
1339 chan->vmbus = vmbus;
1340
1341 res = alloc_chan_id(vmbus);
1342 if (res < 0) {
1343 error_setg(errp, "no spare channel id");
1344 return;
1345 }
1346 chan->id = res;
1347 register_chan_id(chan);
1348
1349 /*
1350 * The guest drivers depend on the device subchannels (idx #1+) to be
1351 * offered after the primary channel (idx #0) of that device. To ensure
1352 * that, record the channels on the channel list in the order they appear
1353 * within the device.
1354 */
1355 QTAILQ_INSERT_TAIL(&vmbus->channel_list, chan, link);
1356 }
1357
1358 static void deinit_channel(VMBusChannel *chan)
1359 {
1360 assert(chan->state == VMCHAN_INIT);
1361 QTAILQ_REMOVE(&chan->vmbus->channel_list, chan, link);
1362 unregister_chan_id(chan);
1363 }
1364
1365 static void create_channels(VMBus *vmbus, VMBusDevice *dev, Error **errp)
1366 {
1367 uint16_t i;
1368 VMBusDeviceClass *vdc = VMBUS_DEVICE_GET_CLASS(dev);
1369 Error *err = NULL;
1370
1371 dev->num_channels = vdc->num_channels ? vdc->num_channels(dev) : 1;
1372 if (dev->num_channels < 1) {
1373 error_setg(errp, "invalid #channels: %u", dev->num_channels);
1374 return;
1375 }
1376
1377 dev->channels = g_new0(VMBusChannel, dev->num_channels);
1378 for (i = 0; i < dev->num_channels; i++) {
1379 init_channel(vmbus, dev, vdc, &dev->channels[i], i, &err);
1380 if (err) {
1381 goto err_init;
1382 }
1383 }
1384
1385 return;
1386
1387 err_init:
1388 while (i--) {
1389 deinit_channel(&dev->channels[i]);
1390 }
1391 error_propagate(errp, err);
1392 }
1393
1394 static void free_channels(VMBusDevice *dev)
1395 {
1396 uint16_t i;
1397 for (i = 0; i < dev->num_channels; i++) {
1398 deinit_channel(&dev->channels[i]);
1399 }
1400 g_free(dev->channels);
1401 }
1402
1403 static HvSintRoute *make_sint_route(VMBus *vmbus, uint32_t vp_index)
1404 {
1405 VMBusChannel *chan;
1406
1407 if (vp_index == vmbus->target_vp) {
1408 hyperv_sint_route_ref(vmbus->sint_route);
1409 return vmbus->sint_route;
1410 }
1411
1412 QTAILQ_FOREACH(chan, &vmbus->channel_list, link) {
1413 if (chan->target_vp == vp_index && vmbus_channel_is_open(chan)) {
1414 hyperv_sint_route_ref(chan->notify_route);
1415 return chan->notify_route;
1416 }
1417 }
1418
1419 return hyperv_sint_route_new(vp_index, VMBUS_SINT, NULL, NULL);
1420 }
1421
1422 static void open_channel(VMBusChannel *chan)
1423 {
1424 VMBusDeviceClass *vdc = VMBUS_DEVICE_GET_CLASS(chan->dev);
1425
1426 chan->gpadl = vmbus_get_gpadl(chan, chan->ringbuf_gpadl);
1427 if (!chan->gpadl) {
1428 return;
1429 }
1430
1431 if (ringbufs_init(chan)) {
1432 goto put_gpadl;
1433 }
1434
1435 if (event_notifier_init(&chan->notifier, 0) < 0) {
1436 goto put_gpadl;
1437 }
1438
1439 event_notifier_set_handler(&chan->notifier, channel_event_cb);
1440
1441 if (hyperv_set_event_flag_handler(chan_connection_id(chan),
1442 &chan->notifier)) {
1443 goto cleanup_notifier;
1444 }
1445
1446 chan->notify_route = make_sint_route(chan->vmbus, chan->target_vp);
1447 if (!chan->notify_route) {
1448 goto clear_event_flag_handler;
1449 }
1450
1451 if (vdc->open_channel && vdc->open_channel(chan)) {
1452 goto unref_sint_route;
1453 }
1454
1455 chan->is_open = true;
1456 return;
1457
1458 unref_sint_route:
1459 hyperv_sint_route_unref(chan->notify_route);
1460 clear_event_flag_handler:
1461 hyperv_set_event_flag_handler(chan_connection_id(chan), NULL);
1462 cleanup_notifier:
1463 event_notifier_set_handler(&chan->notifier, NULL);
1464 event_notifier_cleanup(&chan->notifier);
1465 put_gpadl:
1466 vmbus_put_gpadl(chan->gpadl);
1467 }
1468
1469 static void close_channel(VMBusChannel *chan)
1470 {
1471 VMBusDeviceClass *vdc = VMBUS_DEVICE_GET_CLASS(chan->dev);
1472
1473 if (!chan->is_open) {
1474 return;
1475 }
1476
1477 if (vdc->close_channel) {
1478 vdc->close_channel(chan);
1479 }
1480
1481 hyperv_sint_route_unref(chan->notify_route);
1482 hyperv_set_event_flag_handler(chan_connection_id(chan), NULL);
1483 event_notifier_set_handler(&chan->notifier, NULL);
1484 event_notifier_cleanup(&chan->notifier);
1485 vmbus_put_gpadl(chan->gpadl);
1486 chan->is_open = false;
1487 }
1488
1489 static int channel_post_load(void *opaque, int version_id)
1490 {
1491 VMBusChannel *chan = opaque;
1492
1493 return register_chan_id(chan);
1494 }
1495
1496 static const VMStateDescription vmstate_channel = {
1497 .name = "vmbus/channel",
1498 .version_id = 0,
1499 .minimum_version_id = 0,
1500 .post_load = channel_post_load,
1501 .fields = (const VMStateField[]) {
1502 VMSTATE_UINT32(id, VMBusChannel),
1503 VMSTATE_UINT16(subchan_idx, VMBusChannel),
1504 VMSTATE_UINT32(open_id, VMBusChannel),
1505 VMSTATE_UINT32(target_vp, VMBusChannel),
1506 VMSTATE_UINT32(ringbuf_gpadl, VMBusChannel),
1507 VMSTATE_UINT32(ringbuf_send_offset, VMBusChannel),
1508 VMSTATE_UINT8(offer_state, VMBusChannel),
1509 VMSTATE_UINT8(state, VMBusChannel),
1510 VMSTATE_END_OF_LIST()
1511 }
1512 };
1513
1514 static VMBusChannel *find_channel(VMBus *vmbus, uint32_t id)
1515 {
1516 VMBusChannel *chan;
1517 QTAILQ_FOREACH(chan, &vmbus->channel_list, link) {
1518 if (chan->id == id) {
1519 return chan;
1520 }
1521 }
1522 return NULL;
1523 }
1524
1525 static int enqueue_incoming_message(VMBus *vmbus,
1526 const struct hyperv_post_message_input *msg)
1527 {
1528 uint8_t idx, prev_size;
1529
1530 QEMU_LOCK_GUARD(&vmbus->rx_queue_lock);
1531
1532 if (vmbus->rx_queue_size == HV_MSG_QUEUE_LEN) {
1533 return -ENOBUFS;
1534 }
1535
1536 prev_size = vmbus->rx_queue_size;
1537 idx = (vmbus->rx_queue_head + vmbus->rx_queue_size) % HV_MSG_QUEUE_LEN;
1538 memcpy(&vmbus->rx_queue[idx], msg, sizeof(*msg));
1539 vmbus->rx_queue_size++;
1540
1541 /* only need to resched if the queue was empty before */
1542 if (!prev_size) {
1543 vmbus_resched(vmbus);
1544 }
1545 return 0;
1546 }
1547
1548 static uint16_t vmbus_recv_message(const struct hyperv_post_message_input *msg,
1549 void *data)
1550 {
1551 VMBus *vmbus = data;
1552 struct vmbus_message_header *vmbus_msg;
1553
1554 if (msg->message_type != HV_MESSAGE_VMBUS) {
1555 return HV_STATUS_INVALID_HYPERCALL_INPUT;
1556 }
1557
1558 if (msg->payload_size < sizeof(struct vmbus_message_header)) {
1559 return HV_STATUS_INVALID_HYPERCALL_INPUT;
1560 }
1561
1562 vmbus_msg = (struct vmbus_message_header *)msg->payload;
1563
1564 trace_vmbus_recv_message(vmbus_msg->message_type, msg->payload_size);
1565
1566 if (vmbus_msg->message_type == VMBUS_MSG_INVALID ||
1567 vmbus_msg->message_type >= VMBUS_MSG_COUNT) {
1568 error_report("vmbus: unknown message type %#x",
1569 vmbus_msg->message_type);
1570 return HV_STATUS_INVALID_HYPERCALL_INPUT;
1571 }
1572
1573 if (enqueue_incoming_message(vmbus, msg)) {
1574 return HV_STATUS_INSUFFICIENT_BUFFERS;
1575 }
1576 return HV_STATUS_SUCCESS;
1577 }
1578
1579 static bool vmbus_initialized(VMBus *vmbus)
1580 {
1581 return vmbus->version > 0 && vmbus->version <= VMBUS_VERSION_CURRENT;
1582 }
1583
1584 static void vmbus_reset_all(VMBus *vmbus)
1585 {
1586 bus_cold_reset(BUS(vmbus));
1587 }
1588
1589 static void post_msg(VMBus *vmbus, void *msgdata, uint32_t msglen)
1590 {
1591 int ret;
1592 struct hyperv_message msg = {
1593 .header.message_type = HV_MESSAGE_VMBUS,
1594 };
1595
1596 assert(!vmbus->msg_in_progress);
1597 assert(msglen <= sizeof(msg.payload));
1598 assert(msglen >= sizeof(struct vmbus_message_header));
1599
1600 vmbus->msg_in_progress = true;
1601
1602 trace_vmbus_post_msg(((struct vmbus_message_header *)msgdata)->message_type,
1603 msglen);
1604
1605 memcpy(msg.payload, msgdata, msglen);
1606 msg.header.payload_size = ROUND_UP(msglen, VMBUS_MESSAGE_SIZE_ALIGN);
1607
1608 ret = hyperv_post_msg(vmbus->sint_route, &msg);
1609 if (ret == 0 || ret == -EAGAIN) {
1610 return;
1611 }
1612
1613 error_report("message delivery fatal failure: %d; aborting vmbus", ret);
1614 vmbus_reset_all(vmbus);
1615 }
1616
1617 static int vmbus_init(VMBus *vmbus)
1618 {
1619 if (vmbus->target_vp != (uint32_t)-1) {
1620 vmbus->sint_route = hyperv_sint_route_new(vmbus->target_vp, VMBUS_SINT,
1621 vmbus_msg_cb, vmbus);
1622 if (!vmbus->sint_route) {
1623 error_report("failed to set up SINT route");
1624 return -ENOMEM;
1625 }
1626 }
1627 return 0;
1628 }
1629
1630 static void vmbus_deinit(VMBus *vmbus)
1631 {
1632 VMBusGpadl *gpadl, *tmp_gpadl;
1633 VMBusChannel *chan;
1634
1635 QTAILQ_FOREACH_SAFE(gpadl, &vmbus->gpadl_list, link, tmp_gpadl) {
1636 if (gpadl->state == VMGPADL_TORNDOWN) {
1637 continue;
1638 }
1639 vmbus_put_gpadl(gpadl);
1640 }
1641
1642 QTAILQ_FOREACH(chan, &vmbus->channel_list, link) {
1643 chan->offer_state = VMOFFER_INIT;
1644 }
1645
1646 hyperv_sint_route_unref(vmbus->sint_route);
1647 vmbus->sint_route = NULL;
1648 vmbus->int_page_gpa = 0;
1649 vmbus->target_vp = (uint32_t)-1;
1650 vmbus->version = 0;
1651 vmbus->state = VMBUS_LISTEN;
1652 vmbus->msg_in_progress = false;
1653 }
1654
1655 static void handle_initiate_contact(VMBus *vmbus,
1656 vmbus_message_initiate_contact *msg,
1657 uint32_t msglen)
1658 {
1659 if (msglen < sizeof(*msg)) {
1660 return;
1661 }
1662
1663 trace_vmbus_initiate_contact(msg->version_requested >> 16,
1664 msg->version_requested & 0xffff,
1665 msg->target_vcpu, msg->monitor_page1,
1666 msg->monitor_page2, msg->interrupt_page);
1667
1668 /*
1669 * Reset vmbus on INITIATE_CONTACT regardless of its previous state.
1670 * Useful, in particular, with vmbus-aware BIOS which can't shut vmbus down
1671 * before handing over to OS loader.
1672 */
1673 vmbus_reset_all(vmbus);
1674
1675 vmbus->target_vp = msg->target_vcpu;
1676 vmbus->version = msg->version_requested;
1677 if (vmbus->version < VMBUS_VERSION_WIN8) {
1678 /* linux passes interrupt page even when it doesn't need it */
1679 vmbus->int_page_gpa = msg->interrupt_page;
1680 }
1681 vmbus->state = VMBUS_HANDSHAKE;
1682
1683 if (vmbus_init(vmbus)) {
1684 error_report("failed to init vmbus; aborting");
1685 vmbus_deinit(vmbus);
1686 return;
1687 }
1688 }
1689
1690 static void send_handshake(VMBus *vmbus)
1691 {
1692 struct vmbus_message_version_response msg = {
1693 .header.message_type = VMBUS_MSG_VERSION_RESPONSE,
1694 .version_supported = vmbus_initialized(vmbus),
1695 };
1696
1697 post_msg(vmbus, &msg, sizeof(msg));
1698 }
1699
1700 static void handle_request_offers(VMBus *vmbus, void *msgdata, uint32_t msglen)
1701 {
1702 VMBusChannel *chan;
1703
1704 if (!vmbus_initialized(vmbus)) {
1705 return;
1706 }
1707
1708 QTAILQ_FOREACH(chan, &vmbus->channel_list, link) {
1709 if (chan->offer_state == VMOFFER_INIT) {
1710 chan->offer_state = VMOFFER_SENDING;
1711 break;
1712 }
1713 }
1714
1715 vmbus->state = VMBUS_OFFER;
1716 }
1717
1718 static void send_offer(VMBus *vmbus)
1719 {
1720 VMBusChannel *chan;
1721 struct vmbus_message_header alloffers_msg = {
1722 .message_type = VMBUS_MSG_ALLOFFERS_DELIVERED,
1723 };
1724
1725 QTAILQ_FOREACH(chan, &vmbus->channel_list, link) {
1726 if (chan->offer_state == VMOFFER_SENDING) {
1727 VMBusDeviceClass *vdc = VMBUS_DEVICE_GET_CLASS(chan->dev);
1728 /* Hyper-V wants LE GUIDs */
1729 QemuUUID classid = qemu_uuid_bswap(vdc->classid);
1730 QemuUUID instanceid = qemu_uuid_bswap(chan->dev->instanceid);
1731 struct vmbus_message_offer_channel msg = {
1732 .header.message_type = VMBUS_MSG_OFFERCHANNEL,
1733 .child_relid = chan->id,
1734 .connection_id = chan_connection_id(chan),
1735 .channel_flags = vdc->channel_flags,
1736 .mmio_size_mb = vdc->mmio_size_mb,
1737 .sub_channel_index = vmbus_channel_idx(chan),
1738 .interrupt_flags = VMBUS_OFFER_INTERRUPT_DEDICATED,
1739 };
1740
1741 memcpy(msg.type_uuid, &classid, sizeof(classid));
1742 memcpy(msg.instance_uuid, &instanceid, sizeof(instanceid));
1743
1744 trace_vmbus_send_offer(chan->id, chan->dev);
1745
1746 post_msg(vmbus, &msg, sizeof(msg));
1747 return;
1748 }
1749 }
1750
1751 /* no more offers, send terminator message */
1752 trace_vmbus_terminate_offers();
1753 post_msg(vmbus, &alloffers_msg, sizeof(alloffers_msg));
1754 }
1755
1756 static bool complete_offer(VMBus *vmbus)
1757 {
1758 VMBusChannel *chan;
1759
1760 QTAILQ_FOREACH(chan, &vmbus->channel_list, link) {
1761 if (chan->offer_state == VMOFFER_SENDING) {
1762 chan->offer_state = VMOFFER_SENT;
1763 goto next_offer;
1764 }
1765 }
1766 /*
1767 * no transitioning channels found so this is completing the terminator
1768 * message, and vmbus can move to the next state
1769 */
1770 return true;
1771
1772 next_offer:
1773 /* try to mark another channel for offering */
1774 QTAILQ_FOREACH(chan, &vmbus->channel_list, link) {
1775 if (chan->offer_state == VMOFFER_INIT) {
1776 chan->offer_state = VMOFFER_SENDING;
1777 break;
1778 }
1779 }
1780 /*
1781 * if an offer has been sent there are more offers or the terminator yet to
1782 * send, so no state transition for vmbus
1783 */
1784 return false;
1785 }
1786
1787
1788 static void handle_gpadl_header(VMBus *vmbus, vmbus_message_gpadl_header *msg,
1789 uint32_t msglen)
1790 {
1791 VMBusGpadl *gpadl;
1792 uint32_t num_gfns, i;
1793
1794 /* must include at least one gpa range */
1795 if (msglen < sizeof(*msg) + sizeof(msg->range[0]) ||
1796 !vmbus_initialized(vmbus)) {
1797 return;
1798 }
1799
1800 num_gfns = (msg->range_buflen - msg->rangecount * sizeof(msg->range[0])) /
1801 sizeof(msg->range[0].pfn_array[0]);
1802
1803 trace_vmbus_gpadl_header(msg->gpadl_id, num_gfns);
1804
1805 /*
1806 * In theory the GPADL_HEADER message can define a GPADL with multiple GPA
1807 * ranges each with arbitrary size and alignment. However in practice only
1808 * single-range page-aligned GPADLs have been observed so just ignore
1809 * anything else and simplify things greatly.
1810 */
1811 if (msg->rangecount != 1 || msg->range[0].byte_offset ||
1812 (msg->range[0].byte_count != (num_gfns << TARGET_PAGE_BITS))) {
1813 return;
1814 }
1815
1816 /* ignore requests to create already existing GPADLs */
1817 if (find_gpadl(vmbus, msg->gpadl_id)) {
1818 return;
1819 }
1820
1821 gpadl = create_gpadl(vmbus, msg->gpadl_id, msg->child_relid, num_gfns);
1822
1823 for (i = 0; i < num_gfns &&
1824 (void *)&msg->range[0].pfn_array[i + 1] <= (void *)msg + msglen;
1825 i++) {
1826 gpadl->gfns[gpadl->seen_gfns++] = msg->range[0].pfn_array[i];
1827 }
1828
1829 if (gpadl_full(gpadl)) {
1830 vmbus->state = VMBUS_CREATE_GPADL;
1831 }
1832 }
1833
1834 static void handle_gpadl_body(VMBus *vmbus, vmbus_message_gpadl_body *msg,
1835 uint32_t msglen)
1836 {
1837 VMBusGpadl *gpadl;
1838 uint32_t num_gfns_left, i;
1839
1840 if (msglen < sizeof(*msg) || !vmbus_initialized(vmbus)) {
1841 return;
1842 }
1843
1844 trace_vmbus_gpadl_body(msg->gpadl_id);
1845
1846 gpadl = find_gpadl(vmbus, msg->gpadl_id);
1847 if (!gpadl) {
1848 return;
1849 }
1850
1851 num_gfns_left = gpadl->num_gfns - gpadl->seen_gfns;
1852 assert(num_gfns_left);
1853
1854 for (i = 0; i < num_gfns_left &&
1855 (void *)&msg->pfn_array[i + 1] <= (void *)msg + msglen; i++) {
1856 gpadl->gfns[gpadl->seen_gfns++] = msg->pfn_array[i];
1857 }
1858
1859 if (gpadl_full(gpadl)) {
1860 vmbus->state = VMBUS_CREATE_GPADL;
1861 }
1862 }
1863
1864 static void send_create_gpadl(VMBus *vmbus)
1865 {
1866 VMBusGpadl *gpadl;
1867
1868 QTAILQ_FOREACH(gpadl, &vmbus->gpadl_list, link) {
1869 if (gpadl_full(gpadl) && gpadl->state == VMGPADL_INIT) {
1870 struct vmbus_message_gpadl_created msg = {
1871 .header.message_type = VMBUS_MSG_GPADL_CREATED,
1872 .gpadl_id = gpadl->id,
1873 .child_relid = gpadl->child_relid,
1874 };
1875
1876 trace_vmbus_gpadl_created(gpadl->id);
1877 post_msg(vmbus, &msg, sizeof(msg));
1878 return;
1879 }
1880 }
1881
1882 g_assert_not_reached();
1883 }
1884
1885 static bool complete_create_gpadl(VMBus *vmbus)
1886 {
1887 VMBusGpadl *gpadl;
1888
1889 QTAILQ_FOREACH(gpadl, &vmbus->gpadl_list, link) {
1890 if (gpadl_full(gpadl) && gpadl->state == VMGPADL_INIT) {
1891 gpadl->state = VMGPADL_ALIVE;
1892
1893 return true;
1894 }
1895 }
1896
1897 g_assert_not_reached();
1898 }
1899
1900 static void handle_gpadl_teardown(VMBus *vmbus,
1901 vmbus_message_gpadl_teardown *msg,
1902 uint32_t msglen)
1903 {
1904 VMBusGpadl *gpadl;
1905
1906 if (msglen < sizeof(*msg) || !vmbus_initialized(vmbus)) {
1907 return;
1908 }
1909
1910 trace_vmbus_gpadl_teardown(msg->gpadl_id);
1911
1912 gpadl = find_gpadl(vmbus, msg->gpadl_id);
1913 if (!gpadl || gpadl->state == VMGPADL_TORNDOWN) {
1914 return;
1915 }
1916
1917 gpadl->state = VMGPADL_TEARINGDOWN;
1918 vmbus->state = VMBUS_TEARDOWN_GPADL;
1919 }
1920
1921 static void send_teardown_gpadl(VMBus *vmbus)
1922 {
1923 VMBusGpadl *gpadl;
1924
1925 QTAILQ_FOREACH(gpadl, &vmbus->gpadl_list, link) {
1926 if (gpadl->state == VMGPADL_TEARINGDOWN) {
1927 struct vmbus_message_gpadl_torndown msg = {
1928 .header.message_type = VMBUS_MSG_GPADL_TORNDOWN,
1929 .gpadl_id = gpadl->id,
1930 };
1931
1932 trace_vmbus_gpadl_torndown(gpadl->id);
1933 post_msg(vmbus, &msg, sizeof(msg));
1934 return;
1935 }
1936 }
1937
1938 g_assert_not_reached();
1939 }
1940
1941 static bool complete_teardown_gpadl(VMBus *vmbus)
1942 {
1943 VMBusGpadl *gpadl;
1944
1945 QTAILQ_FOREACH(gpadl, &vmbus->gpadl_list, link) {
1946 if (gpadl->state == VMGPADL_TEARINGDOWN) {
1947 gpadl->state = VMGPADL_TORNDOWN;
1948 vmbus_put_gpadl(gpadl);
1949 return true;
1950 }
1951 }
1952
1953 g_assert_not_reached();
1954 }
1955
1956 static void handle_open_channel(VMBus *vmbus, vmbus_message_open_channel *msg,
1957 uint32_t msglen)
1958 {
1959 VMBusChannel *chan;
1960
1961 if (msglen < sizeof(*msg) || !vmbus_initialized(vmbus)) {
1962 return;
1963 }
1964
1965 trace_vmbus_open_channel(msg->child_relid, msg->ring_buffer_gpadl_id,
1966 msg->target_vp);
1967 chan = find_channel(vmbus, msg->child_relid);
1968 if (!chan || chan->state != VMCHAN_INIT) {
1969 return;
1970 }
1971
1972 chan->ringbuf_gpadl = msg->ring_buffer_gpadl_id;
1973 chan->ringbuf_send_offset = msg->ring_buffer_offset;
1974 chan->target_vp = msg->target_vp;
1975 chan->open_id = msg->open_id;
1976
1977 open_channel(chan);
1978
1979 chan->state = VMCHAN_OPENING;
1980 vmbus->state = VMBUS_OPEN_CHANNEL;
1981 }
1982
1983 static void send_open_channel(VMBus *vmbus)
1984 {
1985 VMBusChannel *chan;
1986
1987 QTAILQ_FOREACH(chan, &vmbus->channel_list, link) {
1988 if (chan->state == VMCHAN_OPENING) {
1989 struct vmbus_message_open_result msg = {
1990 .header.message_type = VMBUS_MSG_OPENCHANNEL_RESULT,
1991 .child_relid = chan->id,
1992 .open_id = chan->open_id,
1993 .status = !vmbus_channel_is_open(chan),
1994 };
1995
1996 trace_vmbus_channel_open(chan->id, msg.status);
1997 post_msg(vmbus, &msg, sizeof(msg));
1998 return;
1999 }
2000 }
2001
2002 g_assert_not_reached();
2003 }
2004
2005 static bool complete_open_channel(VMBus *vmbus)
2006 {
2007 VMBusChannel *chan;
2008
2009 QTAILQ_FOREACH(chan, &vmbus->channel_list, link) {
2010 if (chan->state == VMCHAN_OPENING) {
2011 if (vmbus_channel_is_open(chan)) {
2012 chan->state = VMCHAN_OPEN;
2013 /*
2014 * simulate guest notification of ringbuffer space made
2015 * available, for the channel protocols where the host
2016 * initiates the communication
2017 */
2018 vmbus_channel_notify_host(chan);
2019 } else {
2020 chan->state = VMCHAN_INIT;
2021 }
2022 return true;
2023 }
2024 }
2025
2026 g_assert_not_reached();
2027 }
2028
2029 static void vdev_reset_on_close(VMBusDevice *vdev)
2030 {
2031 uint16_t i;
2032
2033 for (i = 0; i < vdev->num_channels; i++) {
2034 if (vmbus_channel_is_open(&vdev->channels[i])) {
2035 return;
2036 }
2037 }
2038
2039 /* all channels closed -- reset device */
2040 device_cold_reset(DEVICE(vdev));
2041 }
2042
2043 static void handle_close_channel(VMBus *vmbus, vmbus_message_close_channel *msg,
2044 uint32_t msglen)
2045 {
2046 VMBusChannel *chan;
2047
2048 if (msglen < sizeof(*msg) || !vmbus_initialized(vmbus)) {
2049 return;
2050 }
2051
2052 trace_vmbus_close_channel(msg->child_relid);
2053
2054 chan = find_channel(vmbus, msg->child_relid);
2055 if (!chan) {
2056 return;
2057 }
2058
2059 close_channel(chan);
2060 chan->state = VMCHAN_INIT;
2061
2062 vdev_reset_on_close(chan->dev);
2063 }
2064
2065 static void handle_unload(VMBus *vmbus, void *msg, uint32_t msglen)
2066 {
2067 vmbus->state = VMBUS_UNLOAD;
2068 }
2069
2070 static void send_unload(VMBus *vmbus)
2071 {
2072 vmbus_message_header msg = {
2073 .message_type = VMBUS_MSG_UNLOAD_RESPONSE,
2074 };
2075
2076 qemu_mutex_lock(&vmbus->rx_queue_lock);
2077 vmbus->rx_queue_size = 0;
2078 qemu_mutex_unlock(&vmbus->rx_queue_lock);
2079
2080 post_msg(vmbus, &msg, sizeof(msg));
2081 }
2082
2083 static bool complete_unload(VMBus *vmbus)
2084 {
2085 vmbus_reset_all(vmbus);
2086 return true;
2087 }
2088
2089 static void process_message(VMBus *vmbus)
2090 {
2091 struct hyperv_post_message_input *hv_msg;
2092 struct vmbus_message_header *msg;
2093 void *msgdata;
2094 uint32_t msglen;
2095
2096 QEMU_LOCK_GUARD(&vmbus->rx_queue_lock);
2097
2098 if (!vmbus->rx_queue_size) {
2099 return;
2100 }
2101
2102 hv_msg = &vmbus->rx_queue[vmbus->rx_queue_head];
2103 msglen = hv_msg->payload_size;
2104 if (msglen < sizeof(*msg)) {
2105 goto out;
2106 }
2107 msgdata = hv_msg->payload;
2108 msg = msgdata;
2109
2110 trace_vmbus_process_incoming_message(msg->message_type);
2111
2112 switch (msg->message_type) {
2113 case VMBUS_MSG_INITIATE_CONTACT:
2114 handle_initiate_contact(vmbus, msgdata, msglen);
2115 break;
2116 case VMBUS_MSG_REQUESTOFFERS:
2117 handle_request_offers(vmbus, msgdata, msglen);
2118 break;
2119 case VMBUS_MSG_GPADL_HEADER:
2120 handle_gpadl_header(vmbus, msgdata, msglen);
2121 break;
2122 case VMBUS_MSG_GPADL_BODY:
2123 handle_gpadl_body(vmbus, msgdata, msglen);
2124 break;
2125 case VMBUS_MSG_GPADL_TEARDOWN:
2126 handle_gpadl_teardown(vmbus, msgdata, msglen);
2127 break;
2128 case VMBUS_MSG_OPENCHANNEL:
2129 handle_open_channel(vmbus, msgdata, msglen);
2130 break;
2131 case VMBUS_MSG_CLOSECHANNEL:
2132 handle_close_channel(vmbus, msgdata, msglen);
2133 break;
2134 case VMBUS_MSG_UNLOAD:
2135 handle_unload(vmbus, msgdata, msglen);
2136 break;
2137 default:
2138 error_report("unknown message type %#x", msg->message_type);
2139 break;
2140 }
2141
2142 out:
2143 vmbus->rx_queue_size--;
2144 vmbus->rx_queue_head++;
2145 vmbus->rx_queue_head %= HV_MSG_QUEUE_LEN;
2146
2147 vmbus_resched(vmbus);
2148 }
2149
2150 static const struct {
2151 void (*run)(VMBus *vmbus);
2152 bool (*complete)(VMBus *vmbus);
2153 } state_runner[] = {
2154 [VMBUS_LISTEN] = {process_message, NULL},
2155 [VMBUS_HANDSHAKE] = {send_handshake, NULL},
2156 [VMBUS_OFFER] = {send_offer, complete_offer},
2157 [VMBUS_CREATE_GPADL] = {send_create_gpadl, complete_create_gpadl},
2158 [VMBUS_TEARDOWN_GPADL] = {send_teardown_gpadl, complete_teardown_gpadl},
2159 [VMBUS_OPEN_CHANNEL] = {send_open_channel, complete_open_channel},
2160 [VMBUS_UNLOAD] = {send_unload, complete_unload},
2161 };
2162
2163 static void vmbus_do_run(VMBus *vmbus)
2164 {
2165 if (vmbus->msg_in_progress) {
2166 return;
2167 }
2168
2169 assert(vmbus->state < VMBUS_STATE_MAX);
2170 assert(state_runner[vmbus->state].run);
2171 state_runner[vmbus->state].run(vmbus);
2172 }
2173
2174 static void vmbus_run(void *opaque)
2175 {
2176 VMBus *vmbus = opaque;
2177
2178 /* make sure no recursion happens (e.g. due to recursive aio_poll()) */
2179 if (vmbus->in_progress) {
2180 return;
2181 }
2182
2183 vmbus->in_progress = true;
2184 /*
2185 * FIXME: if vmbus_resched() is called from within vmbus_do_run(), it
2186 * should go *after* the code that can result in aio_poll; otherwise
2187 * reschedules can be missed. No idea how to enforce that.
2188 */
2189 vmbus_do_run(vmbus);
2190 vmbus->in_progress = false;
2191 }
2192
2193 static void vmbus_msg_cb(void *data, int status)
2194 {
2195 VMBus *vmbus = data;
2196 bool (*complete)(VMBus *vmbus);
2197
2198 assert(vmbus->msg_in_progress);
2199
2200 trace_vmbus_msg_cb(status);
2201
2202 if (status == -EAGAIN) {
2203 goto out;
2204 }
2205 if (status) {
2206 error_report("message delivery fatal failure: %d; aborting vmbus",
2207 status);
2208 vmbus_reset_all(vmbus);
2209 return;
2210 }
2211
2212 assert(vmbus->state < VMBUS_STATE_MAX);
2213 complete = state_runner[vmbus->state].complete;
2214 if (!complete || complete(vmbus)) {
2215 vmbus->state = VMBUS_LISTEN;
2216 }
2217 out:
2218 vmbus->msg_in_progress = false;
2219 vmbus_resched(vmbus);
2220 }
2221
2222 static void vmbus_resched(VMBus *vmbus)
2223 {
2224 aio_bh_schedule_oneshot(qemu_get_aio_context(), vmbus_run, vmbus);
2225 }
2226
2227 static void vmbus_signal_event(EventNotifier *e)
2228 {
2229 VMBusChannel *chan;
2230 VMBus *vmbus = container_of(e, VMBus, notifier);
2231 unsigned long *int_map;
2232 hwaddr addr, len;
2233 bool is_dirty = false;
2234
2235 if (!event_notifier_test_and_clear(e)) {
2236 return;
2237 }
2238
2239 trace_vmbus_signal_event();
2240
2241 if (!vmbus->int_page_gpa) {
2242 return;
2243 }
2244
2245 addr = vmbus->int_page_gpa + TARGET_PAGE_SIZE / 2;
2246 len = TARGET_PAGE_SIZE / 2;
2247 int_map = physical_memory_map(addr, &len, 1);
2248 if (len != TARGET_PAGE_SIZE / 2) {
2249 goto unmap;
2250 }
2251
2252 QTAILQ_FOREACH(chan, &vmbus->channel_list, link) {
2253 if (bitmap_test_and_clear_atomic(int_map, chan->id, 1)) {
2254 if (!vmbus_channel_is_open(chan)) {
2255 continue;
2256 }
2257 vmbus_channel_notify_host(chan);
2258 is_dirty = true;
2259 }
2260 }
2261
2262 unmap:
2263 physical_memory_unmap(int_map, len, 1, is_dirty);
2264 }
2265
2266 static void vmbus_dev_realize(DeviceState *dev, Error **errp)
2267 {
2268 VMBusDevice *vdev = VMBUS_DEVICE(dev);
2269 VMBusDeviceClass *vdc = VMBUS_DEVICE_GET_CLASS(vdev);
2270 VMBus *vmbus = VMBUS(qdev_get_parent_bus(dev));
2271 BusChild *child;
2272 Error *err = NULL;
2273 char idstr[UUID_STR_LEN];
2274
2275 assert(!qemu_uuid_is_null(&vdev->instanceid));
2276
2277 if (!qemu_uuid_is_null(&vdc->instanceid)) {
2278 /* Class wants to only have a single instance with a fixed UUID */
2279 if (!qemu_uuid_is_equal(&vdev->instanceid, &vdc->instanceid)) {
2280 error_setg(&err, "instance id can't be changed");
2281 goto error_out;
2282 }
2283 }
2284
2285 /* Check for instance id collision for this class id */
2286 QTAILQ_FOREACH(child, &BUS(vmbus)->children, sibling) {
2287 VMBusDevice *child_dev = VMBUS_DEVICE(child->child);
2288
2289 if (child_dev == vdev) {
2290 continue;
2291 }
2292
2293 if (qemu_uuid_is_equal(&child_dev->instanceid, &vdev->instanceid)) {
2294 qemu_uuid_unparse(&vdev->instanceid, idstr);
2295 error_setg(&err, "duplicate vmbus device instance id %s", idstr);
2296 goto error_out;
2297 }
2298 }
2299
2300 vdev->dma_as = &address_space_memory;
2301
2302 create_channels(vmbus, vdev, &err);
2303 if (err) {
2304 goto error_out;
2305 }
2306
2307 if (vdc->vmdev_realize) {
2308 vdc->vmdev_realize(vdev, &err);
2309 if (err) {
2310 goto err_vdc_realize;
2311 }
2312 }
2313 return;
2314
2315 err_vdc_realize:
2316 free_channels(vdev);
2317 error_out:
2318 error_propagate(errp, err);
2319 }
2320
2321 static void vmbus_dev_reset(DeviceState *dev)
2322 {
2323 uint16_t i;
2324 VMBusDevice *vdev = VMBUS_DEVICE(dev);
2325 VMBusDeviceClass *vdc = VMBUS_DEVICE_GET_CLASS(vdev);
2326
2327 if (vdev->channels) {
2328 for (i = 0; i < vdev->num_channels; i++) {
2329 VMBusChannel *chan = &vdev->channels[i];
2330 close_channel(chan);
2331 chan->state = VMCHAN_INIT;
2332 }
2333 }
2334
2335 if (vdc->vmdev_reset) {
2336 vdc->vmdev_reset(vdev);
2337 }
2338 }
2339
2340 static void vmbus_dev_unrealize(DeviceState *dev)
2341 {
2342 VMBusDevice *vdev = VMBUS_DEVICE(dev);
2343 VMBusDeviceClass *vdc = VMBUS_DEVICE_GET_CLASS(vdev);
2344
2345 if (vdc->vmdev_unrealize) {
2346 vdc->vmdev_unrealize(vdev);
2347 }
2348 free_channels(vdev);
2349 }
2350
2351 /*
2352 * If the KVM fd changes because of VM reset in confidential guests,
2353 * reassociate event fd with the new KVM fd.
2354 */
2355 static int vmbus_handle_vmfd_change(NotifierWithReturn *notifier,
2356 void *data, Error** errp)
2357 {
2358 VMBus *vmbus = container_of(notifier, VMBus,
2359 vmbus_vmfd_change_notifier);
2360 int ret = 0;
2361
2362 /* we are not interested in pre vmfd change notification */
2363 if (((VmfdChangeNotifier *)data)->pre) {
2364 return 0;
2365 }
2366
2367 ret = hyperv_set_event_flag_handler(VMBUS_EVENT_CONNECTION_ID,
2368 &vmbus->notifier);
2369 /* if we are only using userland event handler, it may already exist */
2370 if (ret != 0 && ret != -EEXIST) {
2371 error_setg(errp, "hyperv set event handler failed with %d", ret);
2372 }
2373
2374 trace_vmbus_handle_vmfd_change();
2375 return ret;
2376 }
2377
2378 static const Property vmbus_dev_props[] = {
2379 DEFINE_PROP_UUID("instanceid", VMBusDevice, instanceid),
2380 };
2381
2382
2383 static void vmbus_dev_class_init(ObjectClass *klass, const void *data)
2384 {
2385 DeviceClass *kdev = DEVICE_CLASS(klass);
2386 device_class_set_props(kdev, vmbus_dev_props);
2387 kdev->bus_type = TYPE_VMBUS;
2388 kdev->realize = vmbus_dev_realize;
2389 kdev->unrealize = vmbus_dev_unrealize;
2390 device_class_set_legacy_reset(kdev, vmbus_dev_reset);
2391 }
2392
2393 static void vmbus_dev_instance_init(Object *obj)
2394 {
2395 VMBusDevice *vdev = VMBUS_DEVICE(obj);
2396 VMBusDeviceClass *vdc = VMBUS_DEVICE_GET_CLASS(vdev);
2397
2398 if (!qemu_uuid_is_null(&vdc->instanceid)) {
2399 /* Class wants to only have a single instance with a fixed UUID */
2400 vdev->instanceid = vdc->instanceid;
2401 }
2402 }
2403
2404 const VMStateDescription vmstate_vmbus_dev = {
2405 .name = TYPE_VMBUS_DEVICE,
2406 .version_id = 0,
2407 .minimum_version_id = 0,
2408 .fields = (const VMStateField[]) {
2409 VMSTATE_UINT8_ARRAY(instanceid.data, VMBusDevice, 16),
2410 VMSTATE_UINT16(num_channels, VMBusDevice),
2411 VMSTATE_STRUCT_VARRAY_POINTER_UINT16(channels, VMBusDevice,
2412 num_channels, vmstate_channel,
2413 VMBusChannel),
2414 VMSTATE_END_OF_LIST()
2415 }
2416 };
2417
2418 /* vmbus generic device base */
2419 static const TypeInfo vmbus_dev_type_info = {
2420 .name = TYPE_VMBUS_DEVICE,
2421 .parent = TYPE_DEVICE,
2422 .abstract = true,
2423 .instance_size = sizeof(VMBusDevice),
2424 .class_size = sizeof(VMBusDeviceClass),
2425 .class_init = vmbus_dev_class_init,
2426 .instance_init = vmbus_dev_instance_init,
2427 };
2428
2429 static void vmbus_realize(BusState *bus, Error **errp)
2430 {
2431 int ret = 0;
2432 VMBus *vmbus = VMBUS(bus);
2433
2434 qemu_mutex_init(&vmbus->rx_queue_lock);
2435
2436 QTAILQ_INIT(&vmbus->gpadl_list);
2437 QTAILQ_INIT(&vmbus->channel_list);
2438
2439 ret = hyperv_set_msg_handler(VMBUS_MESSAGE_CONNECTION_ID,
2440 vmbus_recv_message, vmbus);
2441 if (ret != 0) {
2442 error_setg(errp, "hyperv set message handler failed: %d", ret);
2443 goto error_out;
2444 }
2445
2446 ret = event_notifier_init(&vmbus->notifier, 0);
2447 if (ret < 0) {
2448 error_setg(errp, "event notifier failed to init with %d", ret);
2449 goto remove_msg_handler;
2450 }
2451
2452 event_notifier_set_handler(&vmbus->notifier, vmbus_signal_event);
2453 ret = hyperv_set_event_flag_handler(VMBUS_EVENT_CONNECTION_ID,
2454 &vmbus->notifier);
2455 if (ret != 0) {
2456 error_setg(errp, "hyperv set event handler failed with %d", ret);
2457 goto clear_event_notifier;
2458 }
2459
2460 vmbus->vmbus_vmfd_change_notifier.notify = vmbus_handle_vmfd_change;
2461 kvm_vmfd_add_change_notifier(&vmbus->vmbus_vmfd_change_notifier);
2462
2463 return;
2464
2465 clear_event_notifier:
2466 event_notifier_cleanup(&vmbus->notifier);
2467 remove_msg_handler:
2468 hyperv_set_msg_handler(VMBUS_MESSAGE_CONNECTION_ID, NULL, NULL);
2469 error_out:
2470 qemu_mutex_destroy(&vmbus->rx_queue_lock);
2471 }
2472
2473 static void vmbus_unrealize(BusState *bus)
2474 {
2475 VMBus *vmbus = VMBUS(bus);
2476
2477 hyperv_set_msg_handler(VMBUS_MESSAGE_CONNECTION_ID, NULL, NULL);
2478 hyperv_set_event_flag_handler(VMBUS_EVENT_CONNECTION_ID, NULL);
2479 event_notifier_cleanup(&vmbus->notifier);
2480
2481 qemu_mutex_destroy(&vmbus->rx_queue_lock);
2482 }
2483
2484 static void vmbus_reset_hold(Object *obj, ResetType type)
2485 {
2486 vmbus_deinit(VMBUS(obj));
2487 }
2488
2489 static char *vmbus_get_dev_path(DeviceState *dev)
2490 {
2491 BusState *bus = qdev_get_parent_bus(dev);
2492 return qdev_get_dev_path(bus->parent);
2493 }
2494
2495 static char *vmbus_get_fw_dev_path(DeviceState *dev)
2496 {
2497 VMBusDevice *vdev = VMBUS_DEVICE(dev);
2498 char uuid[UUID_STR_LEN];
2499
2500 qemu_uuid_unparse(&vdev->instanceid, uuid);
2501 return g_strdup_printf("%s@%s", qdev_fw_name(dev), uuid);
2502 }
2503
2504 static void vmbus_class_init(ObjectClass *klass, const void *data)
2505 {
2506 BusClass *k = BUS_CLASS(klass);
2507 ResettableClass *rc = RESETTABLE_CLASS(klass);
2508
2509 k->get_dev_path = vmbus_get_dev_path;
2510 k->get_fw_dev_path = vmbus_get_fw_dev_path;
2511 k->realize = vmbus_realize;
2512 k->unrealize = vmbus_unrealize;
2513 rc->phases.hold = vmbus_reset_hold;
2514 }
2515
2516 static int vmbus_pre_load(void *opaque)
2517 {
2518 VMBusChannel *chan;
2519 VMBus *vmbus = VMBUS(opaque);
2520
2521 /*
2522 * channel IDs allocated by the source will come in the migration stream
2523 * for each channel, so clean up the ones allocated at realize
2524 */
2525 QTAILQ_FOREACH(chan, &vmbus->channel_list, link) {
2526 unregister_chan_id(chan);
2527 }
2528
2529 return 0;
2530 }
2531 static int vmbus_post_load(void *opaque, int version_id)
2532 {
2533 int ret;
2534 VMBus *vmbus = VMBUS(opaque);
2535 VMBusGpadl *gpadl;
2536 VMBusChannel *chan;
2537
2538 ret = vmbus_init(vmbus);
2539 if (ret) {
2540 return ret;
2541 }
2542
2543 QTAILQ_FOREACH(gpadl, &vmbus->gpadl_list, link) {
2544 gpadl->vmbus = vmbus;
2545 gpadl->refcount = 1;
2546 }
2547
2548 /*
2549 * reopening channels depends on initialized vmbus so it's done here
2550 * instead of channel_post_load()
2551 */
2552 QTAILQ_FOREACH(chan, &vmbus->channel_list, link) {
2553
2554 if (chan->state == VMCHAN_OPENING || chan->state == VMCHAN_OPEN) {
2555 open_channel(chan);
2556 }
2557
2558 if (chan->state != VMCHAN_OPEN) {
2559 continue;
2560 }
2561
2562 if (!vmbus_channel_is_open(chan)) {
2563 /* reopen failed, abort loading */
2564 return -1;
2565 }
2566
2567 /* resume processing on the guest side if it missed the notification */
2568 hyperv_sint_route_set_sint(chan->notify_route);
2569 /* ditto on the host side */
2570 vmbus_channel_notify_host(chan);
2571 }
2572
2573 vmbus_resched(vmbus);
2574 return 0;
2575 }
2576
2577 static const VMStateDescription vmstate_post_message_input = {
2578 .name = "vmbus/hyperv_post_message_input",
2579 .version_id = 0,
2580 .minimum_version_id = 0,
2581 .fields = (const VMStateField[]) {
2582 /*
2583 * skip connection_id and message_type as they are validated before
2584 * queueing and ignored on dequeueing
2585 */
2586 VMSTATE_UINT32(payload_size, struct hyperv_post_message_input),
2587 VMSTATE_UINT8_ARRAY(payload, struct hyperv_post_message_input,
2588 HV_MESSAGE_PAYLOAD_SIZE),
2589 VMSTATE_END_OF_LIST()
2590 }
2591 };
2592
2593 static bool vmbus_rx_queue_needed(void *opaque)
2594 {
2595 VMBus *vmbus = VMBUS(opaque);
2596 return vmbus->rx_queue_size;
2597 }
2598
2599 static const VMStateDescription vmstate_rx_queue = {
2600 .name = "vmbus/rx_queue",
2601 .version_id = 0,
2602 .minimum_version_id = 0,
2603 .needed = vmbus_rx_queue_needed,
2604 .fields = (const VMStateField[]) {
2605 VMSTATE_UINT8(rx_queue_head, VMBus),
2606 VMSTATE_UINT8(rx_queue_size, VMBus),
2607 VMSTATE_STRUCT_ARRAY(rx_queue, VMBus,
2608 HV_MSG_QUEUE_LEN, 0,
2609 vmstate_post_message_input,
2610 struct hyperv_post_message_input),
2611 VMSTATE_END_OF_LIST()
2612 }
2613 };
2614
2615 static const VMStateDescription vmstate_vmbus = {
2616 .name = TYPE_VMBUS,
2617 .version_id = 0,
2618 .minimum_version_id = 0,
2619 .pre_load = vmbus_pre_load,
2620 .post_load = vmbus_post_load,
2621 .fields = (const VMStateField[]) {
2622 VMSTATE_UINT8(state, VMBus),
2623 VMSTATE_UINT32(version, VMBus),
2624 VMSTATE_UINT32(target_vp, VMBus),
2625 VMSTATE_UINT64(int_page_gpa, VMBus),
2626 VMSTATE_QTAILQ_V(gpadl_list, VMBus, 0,
2627 vmstate_gpadl, VMBusGpadl, link),
2628 VMSTATE_END_OF_LIST()
2629 },
2630 .subsections = (const VMStateDescription * const []) {
2631 &vmstate_rx_queue,
2632 NULL
2633 }
2634 };
2635
2636 static const TypeInfo vmbus_type_info = {
2637 .name = TYPE_VMBUS,
2638 .parent = TYPE_BUS,
2639 .instance_size = sizeof(VMBus),
2640 .class_init = vmbus_class_init,
2641 };
2642
2643 static void vmbus_bridge_realize(DeviceState *dev, Error **errp)
2644 {
2645 VMBusBridge *bridge = VMBUS_BRIDGE(dev);
2646
2647 /*
2648 * here there's at least one vmbus bridge that is being realized, so
2649 * vmbus_bridge_find can only return NULL if it's not unique
2650 */
2651 if (!vmbus_bridge_find()) {
2652 error_setg(errp, "there can be at most one %s in the system",
2653 TYPE_VMBUS_BRIDGE);
2654 return;
2655 }
2656
2657 if (!hyperv_is_synic_enabled()) {
2658 error_report("VMBus requires usable Hyper-V SynIC and VP_INDEX");
2659 return;
2660 }
2661
2662 if (!hyperv_are_vmbus_recommended_features_enabled()) {
2663 warn_report("VMBus enabled without the recommended set of Hyper-V features: "
2664 "hv-stimer, hv-vapic and hv-runtime. "
2665 "Some Windows versions might not boot or enable the VMBus device");
2666 }
2667
2668 bridge->bus = VMBUS(qbus_new(TYPE_VMBUS, dev, "vmbus"));
2669 }
2670
2671 static char *vmbus_bridge_ofw_unit_address(const SysBusDevice *dev)
2672 {
2673 /* there can be only one VMBus */
2674 return g_strdup("0");
2675 }
2676
2677 static const VMStateDescription vmstate_vmbus_bridge = {
2678 .name = TYPE_VMBUS_BRIDGE,
2679 .version_id = 0,
2680 .minimum_version_id = 0,
2681 .fields = (const VMStateField[]) {
2682 VMSTATE_STRUCT_POINTER(bus, VMBusBridge, vmstate_vmbus, VMBus),
2683 VMSTATE_END_OF_LIST()
2684 },
2685 };
2686
2687 static const Property vmbus_bridge_props[] = {
2688 DEFINE_PROP_UINT8("irq", VMBusBridge, irq, 7),
2689 };
2690
2691 static void vmbus_bridge_class_init(ObjectClass *klass, const void *data)
2692 {
2693 DeviceClass *k = DEVICE_CLASS(klass);
2694 SysBusDeviceClass *sk = SYS_BUS_DEVICE_CLASS(klass);
2695
2696 k->realize = vmbus_bridge_realize;
2697 k->fw_name = "vmbus";
2698 sk->explicit_ofw_unit_address = vmbus_bridge_ofw_unit_address;
2699 set_bit(DEVICE_CATEGORY_BRIDGE, k->categories);
2700 k->vmsd = &vmstate_vmbus_bridge;
2701 device_class_set_props(k, vmbus_bridge_props);
2702 /* override SysBusDevice's default */
2703 k->user_creatable = true;
2704 }
2705
2706 static const TypeInfo vmbus_bridge_type_info = {
2707 .name = TYPE_VMBUS_BRIDGE,
2708 .parent = TYPE_SYS_BUS_DEVICE,
2709 .instance_size = sizeof(VMBusBridge),
2710 .class_init = vmbus_bridge_class_init,
2711 };
2712
2713 static void vmbus_register_types(void)
2714 {
2715 type_register_static(&vmbus_bridge_type_info);
2716 type_register_static(&vmbus_dev_type_info);
2717 type_register_static(&vmbus_type_info);
2718 }
2719
2720 type_init(vmbus_register_types)