xref: /illumos-gate/usr/src/cmd/bhyve/virtio.c (revision b0de25cb)
1 /*-
2  * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
3  *
4  * Copyright (c) 2013  Chris Torek <torek @ torek net>
5  * All rights reserved.
6  * Copyright (c) 2019 Joyent, Inc.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  * 1. Redistributions of source code must retain the above copyright
12  *    notice, this list of conditions and the following disclaimer.
13  * 2. Redistributions in binary form must reproduce the above copyright
14  *    notice, this list of conditions and the following disclaimer in the
15  *    documentation and/or other materials provided with the distribution.
16  *
17  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
18  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
19  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
20  * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
21  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
22  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
23  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
24  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
25  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
26  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
27  * SUCH DAMAGE.
28  */
29 
30 #include <sys/cdefs.h>
31 __FBSDID("$FreeBSD$");
32 
33 #include <sys/param.h>
34 #include <sys/uio.h>
35 
36 #include <machine/atomic.h>
37 
38 #ifdef __FreeBSD__
39 #include <dev/virtio/pci/virtio_pci_legacy_var.h>
40 #endif
41 
42 #include <stdio.h>
43 #include <stdint.h>
44 #include <string.h>
45 #include <pthread.h>
46 #include <pthread_np.h>
47 
48 #include "bhyverun.h"
49 #include "debug.h"
50 #include "pci_emul.h"
51 #include "virtio.h"
52 
53 /*
54  * Functions for dealing with generalized "virtual devices" as
55  * defined by <https://www.google.com/#output=search&q=virtio+spec>
56  */
57 
58 /*
59  * In case we decide to relax the "virtio softc comes at the
60  * front of virtio-based device softc" constraint, let's use
61  * this to convert.
62  */
63 #define	DEV_SOFTC(vs) ((void *)(vs))
64 
65 /*
66  * Link a virtio_softc to its constants, the device softc, and
67  * the PCI emulation.
68  */
69 void
70 vi_softc_linkup(struct virtio_softc *vs, struct virtio_consts *vc,
71 		void *dev_softc, struct pci_devinst *pi,
72 		struct vqueue_info *queues)
73 {
74 	int i;
75 
76 	/* vs and dev_softc addresses must match */
77 	assert((void *)vs == dev_softc);
78 	vs->vs_vc = vc;
79 	vs->vs_pi = pi;
80 	pi->pi_arg = vs;
81 
82 	vs->vs_queues = queues;
83 	for (i = 0; i < vc->vc_nvq; i++) {
84 		queues[i].vq_vs = vs;
85 		queues[i].vq_num = i;
86 	}
87 }
88 
89 /*
90  * Reset device (device-wide).  This erases all queues, i.e.,
91  * all the queues become invalid (though we don't wipe out the
92  * internal pointers, we just clear the VQ_ALLOC flag).
93  *
94  * It resets negotiated features to "none".
95  *
96  * If MSI-X is enabled, this also resets all the vectors to NO_VECTOR.
97  */
98 void
99 vi_reset_dev(struct virtio_softc *vs)
100 {
101 	struct vqueue_info *vq;
102 	int i, nvq;
103 
104 	if (vs->vs_mtx)
105 		assert(pthread_mutex_isowned_np(vs->vs_mtx));
106 
107 	nvq = vs->vs_vc->vc_nvq;
108 	for (vq = vs->vs_queues, i = 0; i < nvq; vq++, i++) {
109 		vq->vq_flags = 0;
110 		vq->vq_last_avail = 0;
111 		vq->vq_next_used = 0;
112 		vq->vq_save_used = 0;
113 		vq->vq_pfn = 0;
114 		vq->vq_msix_idx = VIRTIO_MSI_NO_VECTOR;
115 	}
116 	vs->vs_negotiated_caps = 0;
117 	vs->vs_curq = 0;
118 	/* vs->vs_status = 0; -- redundant */
119 	if (vs->vs_isr)
120 		pci_lintr_deassert(vs->vs_pi);
121 	vs->vs_isr = 0;
122 	vs->vs_msix_cfg_idx = VIRTIO_MSI_NO_VECTOR;
123 }
124 
125 /*
126  * Set I/O BAR (usually 0) to map PCI config registers.
127  */
128 void
129 vi_set_io_bar(struct virtio_softc *vs, int barnum)
130 {
131 	size_t size;
132 
133 	/*
134 	 * ??? should we use VIRTIO_PCI_CONFIG_OFF(0) if MSI-X is disabled?
135 	 * Existing code did not...
136 	 */
137 	size = VIRTIO_PCI_CONFIG_OFF(1) + vs->vs_vc->vc_cfgsize;
138 	pci_emul_alloc_bar(vs->vs_pi, barnum, PCIBAR_IO, size);
139 }
140 
141 /*
142  * Initialize MSI-X vector capabilities if we're to use MSI-X,
143  * or MSI capabilities if not.
144  *
145  * We assume we want one MSI-X vector per queue, here, plus one
146  * for the config vec.
147  */
148 int
149 vi_intr_init(struct virtio_softc *vs, int barnum, int use_msix)
150 {
151 	int nvec;
152 
153 	if (use_msix) {
154 		vs->vs_flags |= VIRTIO_USE_MSIX;
155 		VS_LOCK(vs);
156 		vi_reset_dev(vs); /* set all vectors to NO_VECTOR */
157 		VS_UNLOCK(vs);
158 		nvec = vs->vs_vc->vc_nvq + 1;
159 		if (pci_emul_add_msixcap(vs->vs_pi, nvec, barnum))
160 			return (1);
161 	} else
162 		vs->vs_flags &= ~VIRTIO_USE_MSIX;
163 
164 	/* Only 1 MSI vector for bhyve */
165 	pci_emul_add_msicap(vs->vs_pi, 1);
166 
167 	/* Legacy interrupts are mandatory for virtio devices */
168 	pci_lintr_request(vs->vs_pi);
169 
170 	return (0);
171 }
172 
173 /*
174  * Initialize the currently-selected virtio queue (vs->vs_curq).
175  * The guest just gave us a page frame number, from which we can
176  * calculate the addresses of the queue.
177  */
178 void
179 vi_vq_init(struct virtio_softc *vs, uint32_t pfn)
180 {
181 	struct vqueue_info *vq;
182 	uint64_t phys;
183 	size_t size;
184 	char *base;
185 
186 	vq = &vs->vs_queues[vs->vs_curq];
187 	vq->vq_pfn = pfn;
188 	phys = (uint64_t)pfn << VRING_PFN;
189 	size = vring_size_aligned(vq->vq_qsize);
190 	base = paddr_guest2host(vs->vs_pi->pi_vmctx, phys, size);
191 
192 	/* First page(s) are descriptors... */
193 	vq->vq_desc = (struct vring_desc *)base;
194 	base += vq->vq_qsize * sizeof(struct vring_desc);
195 
196 	/* ... immediately followed by "avail" ring (entirely uint16_t's) */
197 	vq->vq_avail = (struct vring_avail *)base;
198 	base += (2 + vq->vq_qsize + 1) * sizeof(uint16_t);
199 
200 	/* Then it's rounded up to the next page... */
201 	base = (char *)roundup2((uintptr_t)base, VRING_ALIGN);
202 
203 	/* ... and the last page(s) are the used ring. */
204 	vq->vq_used = (struct vring_used *)base;
205 
206 	/* Mark queue as allocated, and start at 0 when we use it. */
207 	vq->vq_flags = VQ_ALLOC;
208 	vq->vq_last_avail = 0;
209 	vq->vq_next_used = 0;
210 	vq->vq_save_used = 0;
211 }
212 
213 /*
214  * Helper inline for vq_getchain(): record the i'th "real"
215  * descriptor.
216  */
217 static inline void
218 _vq_record(int i, volatile struct vring_desc *vd,
219 	   struct vmctx *ctx, struct iovec *iov, int n_iov,
220 	   struct vi_req *reqp) {
221 
222 	if (i >= n_iov)
223 		return;
224 	iov[i].iov_base = paddr_guest2host(ctx, vd->addr, vd->len);
225 	iov[i].iov_len = vd->len;
226 	if ((vd->flags & VRING_DESC_F_WRITE) == 0)
227 		reqp->readable++;
228 	else
229 		reqp->writable++;
230 }
231 #define	VQ_MAX_DESCRIPTORS	512	/* see below */
232 
233 /*
234  * Examine the chain of descriptors starting at the "next one" to
235  * make sure that they describe a sensible request.  If so, return
236  * the number of "real" descriptors that would be needed/used in
237  * acting on this request.  This may be smaller than the number of
238  * available descriptors, e.g., if there are two available but
239  * they are two separate requests, this just returns 1.  Or, it
240  * may be larger: if there are indirect descriptors involved,
241  * there may only be one descriptor available but it may be an
242  * indirect pointing to eight more.  We return 8 in this case,
243  * i.e., we do not count the indirect descriptors, only the "real"
244  * ones.
245  *
246  * Basically, this vets the "flags" and "next" field of each
247  * descriptor and tells you how many are involved.  Since some may
248  * be indirect, this also needs the vmctx (in the pci_devinst
249  * at vs->vs_pi) so that it can find indirect descriptors.
250  *
251  * As we process each descriptor, we copy and adjust it (guest to
252  * host address wise, also using the vmtctx) into the given iov[]
253  * array (of the given size).  If the array overflows, we stop
254  * placing values into the array but keep processing descriptors,
255  * up to VQ_MAX_DESCRIPTORS, before giving up and returning -1.
256  * So you, the caller, must not assume that iov[] is as big as the
257  * return value (you can process the same thing twice to allocate
258  * a larger iov array if needed, or supply a zero length to find
259  * out how much space is needed).
260  *
261  * If some descriptor(s) are invalid, this prints a diagnostic message
262  * and returns -1.  If no descriptors are ready now it simply returns 0.
263  *
264  * You are assumed to have done a vq_ring_ready() if needed (note
265  * that vq_has_descs() does one).
266  */
267 int
268 vq_getchain(struct vqueue_info *vq, struct iovec *iov, int niov,
269 	    struct vi_req *reqp)
270 {
271 	int i;
272 	u_int ndesc, n_indir;
273 	u_int idx, next;
274 	struct vi_req req;
275 	volatile struct vring_desc *vdir, *vindir, *vp;
276 	struct vmctx *ctx;
277 	struct virtio_softc *vs;
278 	const char *name;
279 
280 	vs = vq->vq_vs;
281 	name = vs->vs_vc->vc_name;
282 	memset(&req, 0, sizeof(req));
283 
284 	/*
285 	 * Note: it's the responsibility of the guest not to
286 	 * update vq->vq_avail->idx until all of the descriptors
287          * the guest has written are valid (including all their
288          * "next" fields and "flags").
289 	 *
290 	 * Compute (vq_avail->idx - last_avail) in integers mod 2**16.  This is
291 	 * the number of descriptors the device has made available
292 	 * since the last time we updated vq->vq_last_avail.
293 	 *
294 	 * We just need to do the subtraction as an unsigned int,
295 	 * then trim off excess bits.
296 	 */
297 	idx = vq->vq_last_avail;
298 	ndesc = (uint16_t)((u_int)vq->vq_avail->idx - idx);
299 	if (ndesc == 0)
300 		return (0);
301 	if (ndesc > vq->vq_qsize) {
302 		/* XXX need better way to diagnose issues */
303 		EPRINTLN(
304 		    "%s: ndesc (%u) out of range, driver confused?",
305 		    name, (u_int)ndesc);
306 		return (-1);
307 	}
308 
309 	/*
310 	 * Now count/parse "involved" descriptors starting from
311 	 * the head of the chain.
312 	 *
313 	 * To prevent loops, we could be more complicated and
314 	 * check whether we're re-visiting a previously visited
315 	 * index, but we just abort if the count gets excessive.
316 	 */
317 	ctx = vs->vs_pi->pi_vmctx;
318 	req.idx = next = vq->vq_avail->ring[idx & (vq->vq_qsize - 1)];
319 	vq->vq_last_avail++;
320 	for (i = 0; i < VQ_MAX_DESCRIPTORS; next = vdir->next) {
321 		if (next >= vq->vq_qsize) {
322 			EPRINTLN(
323 			    "%s: descriptor index %u out of range, "
324 			    "driver confused?",
325 			    name, next);
326 			return (-1);
327 		}
328 		vdir = &vq->vq_desc[next];
329 		if ((vdir->flags & VRING_DESC_F_INDIRECT) == 0) {
330 			_vq_record(i, vdir, ctx, iov, niov, &req);
331 			i++;
332 		} else if ((vs->vs_vc->vc_hv_caps &
333 		    VIRTIO_RING_F_INDIRECT_DESC) == 0) {
334 			EPRINTLN(
335 			    "%s: descriptor has forbidden INDIRECT flag, "
336 			    "driver confused?",
337 			    name);
338 			return (-1);
339 		} else {
340 			n_indir = vdir->len / 16;
341 			if ((vdir->len & 0xf) || n_indir == 0) {
342 				EPRINTLN(
343 				    "%s: invalid indir len 0x%x, "
344 				    "driver confused?",
345 				    name, (u_int)vdir->len);
346 				return (-1);
347 			}
348 			vindir = paddr_guest2host(ctx,
349 			    vdir->addr, vdir->len);
350 			/*
351 			 * Indirects start at the 0th, then follow
352 			 * their own embedded "next"s until those run
353 			 * out.  Each one's indirect flag must be off
354 			 * (we don't really have to check, could just
355 			 * ignore errors...).
356 			 */
357 			next = 0;
358 			for (;;) {
359 				vp = &vindir[next];
360 				if (vp->flags & VRING_DESC_F_INDIRECT) {
361 					EPRINTLN(
362 					    "%s: indirect desc has INDIR flag,"
363 					    " driver confused?",
364 					    name);
365 					return (-1);
366 				}
367 				_vq_record(i, vp, ctx, iov, niov, &req);
368 				if (++i > VQ_MAX_DESCRIPTORS)
369 					goto loopy;
370 				if ((vp->flags & VRING_DESC_F_NEXT) == 0)
371 					break;
372 				next = vp->next;
373 				if (next >= n_indir) {
374 					EPRINTLN(
375 					    "%s: invalid next %u > %u, "
376 					    "driver confused?",
377 					    name, (u_int)next, n_indir);
378 					return (-1);
379 				}
380 			}
381 		}
382 		if ((vdir->flags & VRING_DESC_F_NEXT) == 0)
383 			goto done;
384 	}
385 
386 loopy:
387 	EPRINTLN(
388 	    "%s: descriptor loop? count > %d - driver confused?",
389 	    name, i);
390 	return (-1);
391 
392 done:
393 	*reqp = req;
394 	return (i);
395 }
396 
397 /*
398  * Return the first n_chain request chains back to the available queue.
399  *
400  * (These chains are the ones you handled when you called vq_getchain()
401  * and used its positive return value.)
402  */
403 void
404 vq_retchains(struct vqueue_info *vq, uint16_t n_chains)
405 {
406 
407 	vq->vq_last_avail -= n_chains;
408 }
409 
410 void
411 vq_relchain_prepare(struct vqueue_info *vq, uint16_t idx, uint32_t iolen)
412 {
413 	volatile struct vring_used *vuh;
414 	volatile struct vring_used_elem *vue;
415 	uint16_t mask;
416 
417 	/*
418 	 * Notes:
419 	 *  - mask is N-1 where N is a power of 2 so computes x % N
420 	 *  - vuh points to the "used" data shared with guest
421 	 *  - vue points to the "used" ring entry we want to update
422 	 */
423 	mask = vq->vq_qsize - 1;
424 	vuh = vq->vq_used;
425 
426 	vue = &vuh->ring[vq->vq_next_used++ & mask];
427 	vue->id = idx;
428 	vue->len = iolen;
429 }
430 
431 void
432 vq_relchain_publish(struct vqueue_info *vq)
433 {
434 	/*
435 	 * Ensure the used descriptor is visible before updating the index.
436 	 * This is necessary on ISAs with memory ordering less strict than x86
437 	 * (and even on x86 to act as a compiler barrier).
438 	 */
439 	atomic_thread_fence_rel();
440 	vq->vq_used->idx = vq->vq_next_used;
441 }
442 
443 /*
444  * Return specified request chain to the guest, setting its I/O length
445  * to the provided value.
446  *
447  * (This chain is the one you handled when you called vq_getchain()
448  * and used its positive return value.)
449  */
450 void
451 vq_relchain(struct vqueue_info *vq, uint16_t idx, uint32_t iolen)
452 {
453 	vq_relchain_prepare(vq, idx, iolen);
454 	vq_relchain_publish(vq);
455 }
456 
457 /*
458  * Driver has finished processing "available" chains and calling
459  * vq_relchain on each one.  If driver used all the available
460  * chains, used_all should be set.
461  *
462  * If the "used" index moved we may need to inform the guest, i.e.,
463  * deliver an interrupt.  Even if the used index did NOT move we
464  * may need to deliver an interrupt, if the avail ring is empty and
465  * we are supposed to interrupt on empty.
466  *
467  * Note that used_all_avail is provided by the caller because it's
468  * a snapshot of the ring state when he decided to finish interrupt
469  * processing -- it's possible that descriptors became available after
470  * that point.  (It's also typically a constant 1/True as well.)
471  */
472 void
473 vq_endchains(struct vqueue_info *vq, int used_all_avail)
474 {
475 	struct virtio_softc *vs;
476 	uint16_t event_idx, new_idx, old_idx;
477 	int intr;
478 
479 	/*
480 	 * Interrupt generation: if we're using EVENT_IDX,
481 	 * interrupt if we've crossed the event threshold.
482 	 * Otherwise interrupt is generated if we added "used" entries,
483 	 * but suppressed by VRING_AVAIL_F_NO_INTERRUPT.
484 	 *
485 	 * In any case, though, if NOTIFY_ON_EMPTY is set and the
486 	 * entire avail was processed, we need to interrupt always.
487 	 */
488 	vs = vq->vq_vs;
489 	old_idx = vq->vq_save_used;
490 	vq->vq_save_used = new_idx = vq->vq_used->idx;
491 
492 	/*
493 	 * Use full memory barrier between "idx" store from preceding
494 	 * vq_relchain() call and the loads from VQ_USED_EVENT_IDX() or
495 	 * "flags" field below.
496 	 */
497 	atomic_thread_fence_seq_cst();
498 	if (used_all_avail &&
499 	    (vs->vs_negotiated_caps & VIRTIO_F_NOTIFY_ON_EMPTY))
500 		intr = 1;
501 	else if (vs->vs_negotiated_caps & VIRTIO_RING_F_EVENT_IDX) {
502 		event_idx = VQ_USED_EVENT_IDX(vq);
503 		/*
504 		 * This calculation is per docs and the kernel
505 		 * (see src/sys/dev/virtio/virtio_ring.h).
506 		 */
507 		intr = (uint16_t)(new_idx - event_idx - 1) <
508 			(uint16_t)(new_idx - old_idx);
509 	} else {
510 		intr = new_idx != old_idx &&
511 		    !(vq->vq_avail->flags & VRING_AVAIL_F_NO_INTERRUPT);
512 	}
513 	if (intr)
514 		vq_interrupt(vs, vq);
515 }
516 
517 /* Note: these are in sorted order to make for a fast search */
518 static struct config_reg {
519 	uint16_t	cr_offset;	/* register offset */
520 	uint8_t		cr_size;	/* size (bytes) */
521 	uint8_t		cr_ro;		/* true => reg is read only */
522 	const char	*cr_name;	/* name of reg */
523 } config_regs[] = {
524 	{ VIRTIO_PCI_HOST_FEATURES,	4, 1, "HOST_FEATURES" },
525 	{ VIRTIO_PCI_GUEST_FEATURES,	4, 0, "GUEST_FEATURES" },
526 	{ VIRTIO_PCI_QUEUE_PFN,		4, 0, "QUEUE_PFN" },
527 	{ VIRTIO_PCI_QUEUE_NUM,		2, 1, "QUEUE_NUM" },
528 	{ VIRTIO_PCI_QUEUE_SEL,		2, 0, "QUEUE_SEL" },
529 	{ VIRTIO_PCI_QUEUE_NOTIFY,	2, 0, "QUEUE_NOTIFY" },
530 	{ VIRTIO_PCI_STATUS,		1, 0, "STATUS" },
531 	{ VIRTIO_PCI_ISR,		1, 0, "ISR" },
532 	{ VIRTIO_MSI_CONFIG_VECTOR,	2, 0, "CONFIG_VECTOR" },
533 	{ VIRTIO_MSI_QUEUE_VECTOR,	2, 0, "QUEUE_VECTOR" },
534 };
535 
536 static inline struct config_reg *
537 vi_find_cr(int offset) {
538 	u_int hi, lo, mid;
539 	struct config_reg *cr;
540 
541 	lo = 0;
542 	hi = sizeof(config_regs) / sizeof(*config_regs) - 1;
543 	while (hi >= lo) {
544 		mid = (hi + lo) >> 1;
545 		cr = &config_regs[mid];
546 		if (cr->cr_offset == offset)
547 			return (cr);
548 		if (cr->cr_offset < offset)
549 			lo = mid + 1;
550 		else
551 			hi = mid - 1;
552 	}
553 	return (NULL);
554 }
555 
556 /*
557  * Handle pci config space reads.
558  * If it's to the MSI-X info, do that.
559  * If it's part of the virtio standard stuff, do that.
560  * Otherwise dispatch to the actual driver.
561  */
562 uint64_t
563 vi_pci_read(struct vmctx *ctx, int vcpu, struct pci_devinst *pi,
564 	    int baridx, uint64_t offset, int size)
565 {
566 	struct virtio_softc *vs = pi->pi_arg;
567 	struct virtio_consts *vc;
568 	struct config_reg *cr;
569 	uint64_t virtio_config_size, max;
570 	const char *name;
571 	uint32_t newoff;
572 	uint32_t value;
573 	int error;
574 
575 	if (vs->vs_flags & VIRTIO_USE_MSIX) {
576 		if (baridx == pci_msix_table_bar(pi) ||
577 		    baridx == pci_msix_pba_bar(pi)) {
578 			return (pci_emul_msix_tread(pi, offset, size));
579 		}
580 	}
581 
582 	/* XXX probably should do something better than just assert() */
583 	assert(baridx == 0);
584 
585 	if (vs->vs_mtx)
586 		pthread_mutex_lock(vs->vs_mtx);
587 
588 	vc = vs->vs_vc;
589 	name = vc->vc_name;
590 	value = size == 1 ? 0xff : size == 2 ? 0xffff : 0xffffffff;
591 
592 	if (size != 1 && size != 2 && size != 4)
593 		goto bad;
594 
595 	virtio_config_size = VIRTIO_PCI_CONFIG_OFF(pci_msix_enabled(pi));
596 
597 	if (offset >= virtio_config_size) {
598 		/*
599 		 * Subtract off the standard size (including MSI-X
600 		 * registers if enabled) and dispatch to underlying driver.
601 		 * If that fails, fall into general code.
602 		 */
603 		newoff = offset - virtio_config_size;
604 		max = vc->vc_cfgsize ? vc->vc_cfgsize : 0x100000000;
605 		if (newoff + size > max)
606 			goto bad;
607 		if (vc->vc_cfgread != NULL)
608 			error = (*vc->vc_cfgread)(DEV_SOFTC(vs), newoff, size, &value);
609 		else
610 			error = 0;
611 		if (!error)
612 			goto done;
613 	}
614 
615 bad:
616 	cr = vi_find_cr(offset);
617 	if (cr == NULL || cr->cr_size != size) {
618 		if (cr != NULL) {
619 			/* offset must be OK, so size must be bad */
620 			EPRINTLN(
621 			    "%s: read from %s: bad size %d",
622 			    name, cr->cr_name, size);
623 		} else {
624 			EPRINTLN(
625 			    "%s: read from bad offset/size %jd/%d",
626 			    name, (uintmax_t)offset, size);
627 		}
628 		goto done;
629 	}
630 
631 	switch (offset) {
632 	case VIRTIO_PCI_HOST_FEATURES:
633 		value = vc->vc_hv_caps;
634 		break;
635 	case VIRTIO_PCI_GUEST_FEATURES:
636 		value = vs->vs_negotiated_caps;
637 		break;
638 	case VIRTIO_PCI_QUEUE_PFN:
639 		if (vs->vs_curq < vc->vc_nvq)
640 			value = vs->vs_queues[vs->vs_curq].vq_pfn;
641 		break;
642 	case VIRTIO_PCI_QUEUE_NUM:
643 		value = vs->vs_curq < vc->vc_nvq ?
644 		    vs->vs_queues[vs->vs_curq].vq_qsize : 0;
645 		break;
646 	case VIRTIO_PCI_QUEUE_SEL:
647 		value = vs->vs_curq;
648 		break;
649 	case VIRTIO_PCI_QUEUE_NOTIFY:
650 		value = 0;	/* XXX */
651 		break;
652 	case VIRTIO_PCI_STATUS:
653 		value = vs->vs_status;
654 		break;
655 	case VIRTIO_PCI_ISR:
656 		value = vs->vs_isr;
657 		vs->vs_isr = 0;		/* a read clears this flag */
658 		if (value)
659 			pci_lintr_deassert(pi);
660 		break;
661 	case VIRTIO_MSI_CONFIG_VECTOR:
662 		value = vs->vs_msix_cfg_idx;
663 		break;
664 	case VIRTIO_MSI_QUEUE_VECTOR:
665 		value = vs->vs_curq < vc->vc_nvq ?
666 		    vs->vs_queues[vs->vs_curq].vq_msix_idx :
667 		    VIRTIO_MSI_NO_VECTOR;
668 		break;
669 	}
670 done:
671 	if (vs->vs_mtx)
672 		pthread_mutex_unlock(vs->vs_mtx);
673 	return (value);
674 }
675 
676 /*
677  * Handle pci config space writes.
678  * If it's to the MSI-X info, do that.
679  * If it's part of the virtio standard stuff, do that.
680  * Otherwise dispatch to the actual driver.
681  */
682 void
683 vi_pci_write(struct vmctx *ctx, int vcpu, struct pci_devinst *pi,
684 	     int baridx, uint64_t offset, int size, uint64_t value)
685 {
686 	struct virtio_softc *vs = pi->pi_arg;
687 	struct vqueue_info *vq;
688 	struct virtio_consts *vc;
689 	struct config_reg *cr;
690 	uint64_t virtio_config_size, max;
691 	const char *name;
692 	uint32_t newoff;
693 	int error;
694 
695 	if (vs->vs_flags & VIRTIO_USE_MSIX) {
696 		if (baridx == pci_msix_table_bar(pi) ||
697 		    baridx == pci_msix_pba_bar(pi)) {
698 			pci_emul_msix_twrite(pi, offset, size, value);
699 			return;
700 		}
701 	}
702 
703 	/* XXX probably should do something better than just assert() */
704 	assert(baridx == 0);
705 
706 	if (vs->vs_mtx)
707 		pthread_mutex_lock(vs->vs_mtx);
708 
709 	vc = vs->vs_vc;
710 	name = vc->vc_name;
711 
712 	if (size != 1 && size != 2 && size != 4)
713 		goto bad;
714 
715 	virtio_config_size = VIRTIO_PCI_CONFIG_OFF(pci_msix_enabled(pi));
716 
717 	if (offset >= virtio_config_size) {
718 		/*
719 		 * Subtract off the standard size (including MSI-X
720 		 * registers if enabled) and dispatch to underlying driver.
721 		 */
722 		newoff = offset - virtio_config_size;
723 		max = vc->vc_cfgsize ? vc->vc_cfgsize : 0x100000000;
724 		if (newoff + size > max)
725 			goto bad;
726 		if (vc->vc_cfgwrite != NULL)
727 			error = (*vc->vc_cfgwrite)(DEV_SOFTC(vs), newoff, size, value);
728 		else
729 			error = 0;
730 		if (!error)
731 			goto done;
732 	}
733 
734 bad:
735 	cr = vi_find_cr(offset);
736 	if (cr == NULL || cr->cr_size != size || cr->cr_ro) {
737 		if (cr != NULL) {
738 			/* offset must be OK, wrong size and/or reg is R/O */
739 			if (cr->cr_size != size)
740 				EPRINTLN(
741 				    "%s: write to %s: bad size %d",
742 				    name, cr->cr_name, size);
743 			if (cr->cr_ro)
744 				EPRINTLN(
745 				    "%s: write to read-only reg %s",
746 				    name, cr->cr_name);
747 		} else {
748 			EPRINTLN(
749 			    "%s: write to bad offset/size %jd/%d",
750 			    name, (uintmax_t)offset, size);
751 		}
752 		goto done;
753 	}
754 
755 	switch (offset) {
756 	case VIRTIO_PCI_GUEST_FEATURES:
757 		vs->vs_negotiated_caps = value & vc->vc_hv_caps;
758 		if (vc->vc_apply_features)
759 			(*vc->vc_apply_features)(DEV_SOFTC(vs),
760 			    vs->vs_negotiated_caps);
761 		break;
762 	case VIRTIO_PCI_QUEUE_PFN:
763 		if (vs->vs_curq >= vc->vc_nvq)
764 			goto bad_qindex;
765 		vi_vq_init(vs, value);
766 		break;
767 	case VIRTIO_PCI_QUEUE_SEL:
768 		/*
769 		 * Note that the guest is allowed to select an
770 		 * invalid queue; we just need to return a QNUM
771 		 * of 0 while the bad queue is selected.
772 		 */
773 		vs->vs_curq = value;
774 		break;
775 	case VIRTIO_PCI_QUEUE_NOTIFY:
776 		if (value >= vc->vc_nvq) {
777 			EPRINTLN("%s: queue %d notify out of range",
778 				name, (int)value);
779 			goto done;
780 		}
781 		vq = &vs->vs_queues[value];
782 		if (vq->vq_notify)
783 			(*vq->vq_notify)(DEV_SOFTC(vs), vq);
784 		else if (vc->vc_qnotify)
785 			(*vc->vc_qnotify)(DEV_SOFTC(vs), vq);
786 		else
787 			EPRINTLN(
788 			    "%s: qnotify queue %d: missing vq/vc notify",
789 				name, (int)value);
790 		break;
791 	case VIRTIO_PCI_STATUS:
792 		vs->vs_status = value;
793 		if (value == 0)
794 			(*vc->vc_reset)(DEV_SOFTC(vs));
795 		break;
796 	case VIRTIO_MSI_CONFIG_VECTOR:
797 		vs->vs_msix_cfg_idx = value;
798 		break;
799 	case VIRTIO_MSI_QUEUE_VECTOR:
800 		if (vs->vs_curq >= vc->vc_nvq)
801 			goto bad_qindex;
802 		vq = &vs->vs_queues[vs->vs_curq];
803 		vq->vq_msix_idx = value;
804 		break;
805 	}
806 	goto done;
807 
808 bad_qindex:
809 	EPRINTLN(
810 	    "%s: write config reg %s: curq %d >= max %d",
811 	    name, cr->cr_name, vs->vs_curq, vc->vc_nvq);
812 done:
813 	if (vs->vs_mtx)
814 		pthread_mutex_unlock(vs->vs_mtx);
815 }
816