+ - mkdir build

+ - cd build

+ - C:\tools\msys64\usr\bin\bash.exe -lc "../configure --python=python3

+ --target-list-exclude=i386-softmmu,ppc64-softmmu,aarch64-softmmu,mips64-softmmu,mipsel-softmmu,sh4-softmmu"

+ - C:\tools\msys64\usr\bin\bash.exe -lc "make -j8"

+# We jump some hoops in common_test_job_template to avoid

+# rebuilding all the object files we skip in the artifacts

+.native_build_artifact_template:

+ artifacts:

+ expire_in: 2 days

+ paths:

+ - build

+ - .git-submodule-status

+ exclude:

+ - build/**/*.p

+ - build/**/*.a.p

+ - build/**/*.fa.p

+ - build/**/*.c.o

+ - build/**/*.c.o.d

+ - build/**/*.fa

+

+ extends:

+ - .native_build_job_template

+ - .native_build_artifact_template

+ extends:

+ - .native_build_job_template

+ - .native_build_artifact_template

+ job: amd64-ubuntu2204-container

+ IMAGE: ubuntu2204

+ IMAGE: ubuntu2204

+ IMAGE: ubuntu2204

+ extends:

+ - .native_build_job_template

+ - .native_build_artifact_template

+ extends:

+ - .native_build_job_template

+ - .native_build_artifact_template

+ extends:

+ - .native_build_job_template

+ - .native_build_artifact_template

+ extends:

+ - .native_build_job_template

+ - .native_build_artifact_template

+ extends:

+ - .native_build_job_template

+ - .native_build_artifact_template

+ extends:

+ - .native_build_job_template

+ - .native_build_artifact_template

+ extends:

+ - .native_build_job_template

+ - .native_build_artifact_template

+ job: amd64-ubuntu2204-container

+ IMAGE: ubuntu2204

+ CONFIGURE_ARGS: --enable-tsan --cc=clang --cxx=clang++

+ job: amd64-ubuntu2204-container

+ IMAGE: ubuntu2204

+ extends:

+ - .native_build_job_template

+ - .native_build_artifact_template

+ $MAKE -j$(sysctl -n hw.ncpu) $TARGET V=1 ;

+ always:

+ build_result_artifacts:

+ path: build/meson-logs/*log.txt

+ type: text/plain

+PKGS='alsa-lib bash bison bzip2 ca_root_nss capstone4 ccache cdrkit-genisoimage cmocka ctags curl cyrus-sasl dbus diffutils dtc flex fusefs-libs3 gettext git glib gmake gnutls gsed gtk3 json-c libepoxy libffi libgcrypt libjpeg-turbo libnfs libslirp libspice-server libssh libtasn1 llvm lzo2 meson ncurses nettle ninja opencv pixman pkgconf png py39-numpy py39-pillow py39-pip py39-sphinx py39-sphinx_rtd_theme py39-yaml python3 rpm2cpio sdl2 sdl2_image snappy sndio socat spice-protocol tesseract usbredir virglrenderer vte3 zstd'

+PKGS='alsa-lib bash bison bzip2 ca_root_nss capstone4 ccache cdrkit-genisoimage cmocka ctags curl cyrus-sasl dbus diffutils dtc flex fusefs-libs3 gettext git glib gmake gnutls gsed gtk3 json-c libepoxy libffi libgcrypt libjpeg-turbo libnfs libslirp libspice-server libssh libtasn1 llvm lzo2 meson ncurses nettle ninja opencv pixman pkgconf png py39-numpy py39-pillow py39-pip py39-sphinx py39-sphinx_rtd_theme py39-yaml python3 rpm2cpio sdl2 sdl2_image snappy sndio socat spice-protocol tesseract usbredir virglrenderer vte3 zstd'

+PKGS='bash bc bison bzip2 capstone ccache cmocka ctags curl dbus diffutils dtc flex gcovr gettext git glib gnu-sed gnutls gtk+3 jemalloc jpeg-turbo json-c libepoxy libffi libgcrypt libiscsi libnfs libpng libslirp libssh libtasn1 libusb llvm lzo make meson ncurses nettle ninja pixman pkg-config python3 rpm2cpio sdl2 sdl2_image snappy socat sparse spice-protocol tesseract usbredir vde vte3 zlib zstd'

+ - export COMMON_TAG="$CI_REGISTRY/qemu-project/qemu/qemu/$NAME:latest"

+ - docker build --tag "$TAG" --cache-from "$TAG" --cache-from "$COMMON_TAG"

+ --build-arg BUILDKIT_INLINE_CACHE=1

+ -f "tests/docker/dockerfiles/$NAME.docker" "."

+amd64-ubuntu2204-container:

+ NAME: ubuntu2204

+

+# We can still run some tests on some of our cross build jobs. They can add this

+# template to their extends to save the build logs and test results

+.cross_test_artifacts:

+ artifacts:

+ name: "$CI_JOB_NAME-$CI_COMMIT_REF_SLUG"

+ expire_in: 7 days

+ paths:

+ - build/meson-logs/testlog.txt

+ reports:

+ junit: build/meson-logs/testlog.junit.xml

+ extends:

+ - .cross_system_build_job

+ - .cross_test_artifacts

+ extends:

+ - .cross_user_build_job

+ - .cross_test_artifacts

+ extends:

+ - .cross_accel_build_job

+ - .cross_test_artifacts

+.custom_runner_template:

+ extends: .base_job_template

+ extends: .custom_runner_template

+ extends: .custom_runner_template

+ extends: .custom_runner_template

+ extends: .custom_runner_template

+ extends: .custom_runner_template

+ extends: .custom_runner_template

+ extends: .custom_runner_template

+ extends: .custom_runner_template

+ extends: .custom_runner_template

+ extends: .custom_runner_template

+ extends: .custom_runner_template

+F: tests/avocado/tuxrun_baselines.py

+ rm -f config-host.mak Makefile.prereqs

+ rm -Rf .sdk qemu-bundle

+ s->xen_version = 0;

+ s->xen_gnttab_max_frames = 64;

+ s->xen_evtchn_max_pirq = 256;

+int probe_access_flags(CPUArchState *env, target_ulong addr, int size,

+ if ((tb_cflags(tb) & CF_PCREL || tb->pc == desc->pc) &&

+ h = tb_hash_func(phys_pc, (cflags & CF_PCREL ? 0 : pc),

+

+ if (cflags & CF_PCREL) {

+ /* Use acquire to ensure current load of pc from jc. */

+ tb = qatomic_load_acquire(&jc->array[hash].tb);

+

+ if (likely(tb &&

+ jc->array[hash].pc == pc &&

+ tb->cs_base == cs_base &&

+ tb->flags == flags &&

+ tb->trace_vcpu_dstate == *cpu->trace_dstate &&

+ tb_cflags(tb) == cflags)) {

+ return tb;

+ }

+ tb = tb_htable_lookup(cpu, pc, cs_base, flags, cflags);

+ if (tb == NULL) {

+ return NULL;

+ }

+ jc->array[hash].pc = pc;

+ /* Use store_release on tb to ensure pc is written first. */

+ qatomic_store_release(&jc->array[hash].tb, tb);

+ } else {

+ /* Use rcu_read to ensure current load of pc from *tb. */

+ tb = qatomic_rcu_read(&jc->array[hash].tb);

+

+ if (likely(tb &&

+ tb->pc == pc &&

+ tb->cs_base == cs_base &&

+ tb->flags == flags &&

+ tb->trace_vcpu_dstate == *cpu->trace_dstate &&

+ tb_cflags(tb) == cflags)) {

+ return tb;

+ }

+ tb = tb_htable_lookup(cpu, pc, cs_base, flags, cflags);

+ if (tb == NULL) {

+ return NULL;

+ }

+ /* Use the pc value already stored in tb->pc. */

+ qatomic_set(&jc->array[hash].tb, tb);

+

+ tcg_debug_assert(!(tb_cflags(last_tb) & CF_PCREL));

+ cc->set_pc(cpu, last_tb->pc);

+ /* Use the pc value already stored in tb->pc. */

+ qatomic_set(&cpu->tb_jmp_cache->array[h].tb, tb);

+int probe_access_full(CPUArchState *env, target_ulong addr, int size,

+ int flags = probe_access_internal(env, addr, size, access_type, mmu_idx,

+int probe_access_flags(CPUArchState *env, target_ulong addr, int size,

+ int flags;

+

+ g_assert(-(addr | TARGET_PAGE_MASK) >= size);

+

+ flags = probe_access_internal(env, addr, size, access_type, mmu_idx,

+ nonfault, phost, &full, retaddr);

+ /* Handle clean RAM pages. */

+ if (unlikely(flags & TLB_NOTDIRTY)) {

+ notdirty_write(env_cpu(env), addr, 1, full, retaddr);

+ flags &= ~TLB_NOTDIRTY;

+ }

+

+ return flags;

+ if (tb_cflags(tb) & CF_PCREL) {

+ return cpu->cc->get_pc(cpu);

+ } else {

+ return tb->pc;

+ }

+ if (tb_cflags(tb) & CF_PCREL) {

+ TCGv_i32 cpu_index = tcg_temp_ebb_new_i32();

+ TCGv_i32 meminfo = tcg_temp_ebb_new_i32();

+ TCGv_i64 vaddr64 = tcg_temp_ebb_new_i64();

+ TCGv_ptr udata = tcg_temp_ebb_new_ptr();

+ tcg_gen_movi_i32(meminfo, info);

+ tcg_gen_movi_ptr(udata, 0);

+ TCGv_i32 cpu_index = tcg_temp_ebb_new_i32();

+ TCGv_ptr udata = tcg_temp_ebb_new_ptr();

+ tcg_gen_movi_ptr(udata, 0);

+ TCGv_i64 val = tcg_temp_ebb_new_i64();

+ TCGv_ptr ptr = tcg_temp_ebb_new_ptr();

+ tcg_gen_movi_ptr(ptr, 0);

+ TCGv_ptr ptr = tcg_temp_ebb_new_ptr();

+ tcg_gen_movi_ptr(ptr, 0);

+ tcg_gen_st_ptr(tcg_constant_ptr(NULL), cpu_env,

+ offsetof(CPUState, plugin_mem_cbs) - offsetof(ArchCPU, env));

+ * For CF_PCREL, accesses to 'pc' must be protected by a

+ * load_acquire/store_release to 'tb'.

+ return ((tb_cflags(a) & CF_PCREL || a->pc == b->pc) &&

+ if (tb_cflags(tb) & CF_PCREL) {

+ uint32_t h = tb_jmp_cache_hash_func(tb->pc);

+ h = tb_hash_func(phys_pc, (orig_cflags & CF_PCREL ? 0 : tb->pc),

+ h = tb_hash_func(phys_pc, (tb->cflags & CF_PCREL ? 0 : tb->pc),

+ prev = (!(tb_cflags(tb) & CF_PCREL) && j == 0 ? tb->pc : 0);

+ if (!(tb_cflags(tb) & CF_PCREL)) {

+ data[0] = tb->pc;

+ gen_intermediate_code(env_cpu(env), tb, max_insns, pc, host_pc);

+ if (!(cflags & CF_PCREL)) {

+ tb->pc = pc;

+ }

+ * For CF_PCREL, attribute all executions of the generated code

+ * to its first mapping.

+void translator_loop(CPUState *cpu, TranslationBlock *tb, int *max_insns,

+ db->max_insns = *max_insns;

+ *max_insns = ++db->num_insns;

+int probe_access_flags(CPUArchState *env, target_ulong addr, int size,

+ g_assert(-(addr | TARGET_PAGE_MASK) >= size);

+ flags = probe_access_internal(env, addr, size, access_type, nonfault, ra);

+

+ xen_mode = XEN_ATTACH;

+#include <sys/sysctl.h>

+

+/*

+ * Length for the fixed length types.

+ * 0 means variable length for strings and structures

+ * Compare with sys/kern_sysctl.c ctl_size

+ * Note: Not all types appear to be used in-tree.

+ */

+static const int guest_ctl_size[CTLTYPE + 1] = {

+ [CTLTYPE_INT] = sizeof(abi_int),

+ [CTLTYPE_UINT] = sizeof(abi_uint),

+ [CTLTYPE_LONG] = sizeof(abi_long),

+ [CTLTYPE_ULONG] = sizeof(abi_ulong),

+ [CTLTYPE_S8] = sizeof(int8_t),

+ [CTLTYPE_S16] = sizeof(int16_t),

+ [CTLTYPE_S32] = sizeof(int32_t),

+ [CTLTYPE_S64] = sizeof(int64_t),

+ [CTLTYPE_U8] = sizeof(uint8_t),

+ [CTLTYPE_U16] = sizeof(uint16_t),

+ [CTLTYPE_U32] = sizeof(uint32_t),

+ [CTLTYPE_U64] = sizeof(uint64_t),

+};

+

+static const int host_ctl_size[CTLTYPE + 1] = {

+ [CTLTYPE_INT] = sizeof(int),

+ [CTLTYPE_UINT] = sizeof(u_int),

+ [CTLTYPE_LONG] = sizeof(long),

+ [CTLTYPE_ULONG] = sizeof(u_long),

+ [CTLTYPE_S8] = sizeof(int8_t),

+ [CTLTYPE_S16] = sizeof(int16_t),

+ [CTLTYPE_S32] = sizeof(int32_t),

+ [CTLTYPE_S64] = sizeof(int64_t),

+ [CTLTYPE_U8] = sizeof(uint8_t),

+ [CTLTYPE_U16] = sizeof(uint16_t),

+ [CTLTYPE_U32] = sizeof(uint32_t),

+ [CTLTYPE_U64] = sizeof(uint64_t),

+};

+

+#ifdef TARGET_ABI32

+/*

+ * Limit the amount of available memory to be most of the 32-bit address

+ * space. 0x100c000 was arrived at through trial and error as a good

+ * definition of 'most'.

+ */

+static const abi_ulong guest_max_mem = UINT32_MAX - 0x100c000 + 1;

+

+static abi_ulong cap_memory(uint64_t mem)

+{

+ return MIN(guest_max_mem, mem);

+}

+#endif

+

+static abi_ulong scale_to_guest_pages(uint64_t pages)

+{

+ /* Scale pages from host to guest */

+ pages = muldiv64(pages, qemu_real_host_page_size(), TARGET_PAGE_SIZE);

+#ifdef TARGET_ABI32

+ /* cap pages if need be */

+ pages = MIN(pages, guest_max_mem / (abi_ulong)TARGET_PAGE_SIZE);

+#endif

+ return pages;

+}

+

+#ifdef TARGET_ABI32

+/* Used only for TARGET_ABI32 */

+static abi_long h2g_long_sat(long l)

+{

+ if (l > INT32_MAX) {

+ l = INT32_MAX;

+ } else if (l < INT32_MIN) {

+ l = INT32_MIN;

+ }

+ return l;

+}

+

+static abi_ulong h2g_ulong_sat(u_long ul)

+{

+ return MIN(ul, UINT32_MAX);

+}

+#endif

+

+/*

+ * placeholder until bsd-user downstream upstreams this with its thread support

+ */

+#define bsd_get_ncpu() 1

+

+/*

+ * This uses the undocumented oidfmt interface to find the kind of a requested

+ * sysctl, see /sys/kern/kern_sysctl.c:sysctl_sysctl_oidfmt() (compare to

+ * src/sbin/sysctl/sysctl.c)

+ */

+static int oidfmt(int *oid, int len, char *fmt, uint32_t *kind)

+{

+ int qoid[CTL_MAXNAME + 2];

+ uint8_t buf[BUFSIZ];

+ int i;

+ size_t j;

+

+ qoid[0] = CTL_SYSCTL;

+ qoid[1] = CTL_SYSCTL_OIDFMT;

+ memcpy(qoid + 2, oid, len * sizeof(int));

+

+ j = sizeof(buf);

+ i = sysctl(qoid, len + 2, buf, &j, 0, 0);

+ if (i) {

+ return i;

+ }

+

+ if (kind) {

+ *kind = *(uint32_t *)buf;

+ }

+

+ if (fmt) {

+ strcpy(fmt, (char *)(buf + sizeof(uint32_t)));

+ }

+ return 0;

+}

+

+/*

+ * Convert the old value from host to guest.

+ *

+ * For LONG and ULONG on ABI32, we need to 'down convert' the 8 byte quantities

+ * to 4 bytes. The caller setup a buffer in host memory to get this data from

+ * the kernel and pass it to us. We do the down conversion and adjust the length

+ * so the caller knows what to write as the returned length into the target when

+ * it copies the down converted values into the target.

+ *

+ * For normal integral types, we just need to byte swap. No size changes.

+ *

+ * For strings and node data, there's no conversion needed.

+ *

+ * For opaque data, per sysctl OID converts take care of it.

+ */

+static void h2g_old_sysctl(void *holdp, size_t *holdlen, uint32_t kind)

+{

+ size_t len;

+ int hlen, glen;

+ uint8_t *hp, *gp;

+

+ /*

+ * Although rare, we can have arrays of sysctl. Both sysctl_old_ddb in

+ * kern_sysctl.c and show_var in sbin/sysctl/sysctl.c have code that loops

+ * this way. *holdlen has been set by the kernel to the host's length.

+ * Only LONG and ULONG on ABI32 have different sizes: see below.

+ */

+ gp = hp = (uint8_t *)holdp;

+ len = 0;

+ hlen = host_ctl_size[kind & CTLTYPE];

+ glen = guest_ctl_size[kind & CTLTYPE];

+

+ /*

+ * hlen == 0 for CTLTYPE_STRING and CTLTYPE_NODE, which need no conversion

+ * as well as CTLTYPE_OPAQUE, which needs special converters.

+ */

+ if (hlen == 0) {

+ return;

+ }

+

+ while (len < *holdlen) {

+ if (hlen == glen) {

+ switch (hlen) {

+ case 1:

+ /* Nothing needed: no byteswapping and assigning in place */

+ break;

+ case 2:

+ *(uint16_t *)gp = tswap16(*(uint16_t *)hp);

+ break;

+ case 4:

+ *(uint32_t *)gp = tswap32(*(uint32_t *)hp);

+ break;

+ case 8:

+ *(uint64_t *)gp = tswap64(*(uint64_t *)hp);

+ break;

+ default:

+ g_assert_not_reached();

+ }

+ } else {

+#ifdef TARGET_ABI32

+ /*

+ * Saturating assignment for the only two types that differ between

+ * 32-bit and 64-bit machines. All other integral types have the

+ * same, fixed size and will be converted w/o loss of precision

+ * in the above switch.

+ */

+ switch (kind & CTLTYPE) {

+ case CTLTYPE_LONG:

+ *(abi_long *)gp = tswap32(h2g_long_sat(*(long *)hp));

+ break;

+ case CTLTYPE_ULONG:

+ *(abi_ulong *)gp = tswap32(h2g_ulong_sat(*(u_long *)hp));

+ break;

+ default:

+ g_assert_not_reached();

+ }

+#else

+ g_assert_not_reached();

+#endif

+ }

+ gp += glen;

+ hp += hlen;

+ len += hlen;

+ }

+#ifdef TARGET_ABI32

+ if (hlen != glen) {

+ *holdlen = (*holdlen / hlen) * glen;

+ }

+#endif

+}

+

+/*

+ * Convert the undocmented name2oid sysctl data for the target.

+ */

+static inline void sysctl_name2oid(uint32_t *holdp, size_t holdlen)

+{

+ size_t i, num = holdlen / sizeof(uint32_t);

+

+ for (i = 0; i < num; i++) {

+ holdp[i] = tswap32(holdp[i]);

+ }

+}

+

+static inline void sysctl_oidfmt(uint32_t *holdp)

+{

+ /* byte swap the kind */

+ holdp[0] = tswap32(holdp[0]);

+}

+

+static abi_long do_freebsd_sysctl_oid(CPUArchState *env, int32_t *snamep,

+ int32_t namelen, void *holdp, size_t *holdlenp, void *hnewp,

+ size_t newlen)

+{

+ uint32_t kind = 0;

+ abi_long ret;

+ size_t holdlen, oldlen;

+#ifdef TARGET_ABI32

+ void *old_holdp;

+#endif

+

+ holdlen = oldlen = *holdlenp;

+ oidfmt(snamep, namelen, NULL, &kind);

+

+ /* Handle some arch/emulator dependent sysctl()'s here. */

+ switch (snamep[0]) {

+ case CTL_KERN:

+ switch (snamep[1]) {

+ case KERN_USRSTACK:

+ if (oldlen) {

+ (*(abi_ulong *)holdp) = tswapal(TARGET_USRSTACK);

+ }

+ holdlen = sizeof(abi_ulong);

+ ret = 0;

+ goto out;

+

+ case KERN_PS_STRINGS:

+ if (oldlen) {

+ (*(abi_ulong *)holdp) = tswapal(TARGET_PS_STRINGS);

+ }

+ holdlen = sizeof(abi_ulong);

+ ret = 0;

+ goto out;

+

+ default:

+ break;

+ }

+ break;

+

+ case CTL_HW:

+ switch (snamep[1]) {

+ case HW_MACHINE:

+ holdlen = sizeof(TARGET_HW_MACHINE);

+ if (holdp) {

+ strlcpy(holdp, TARGET_HW_MACHINE, oldlen);

+ }

+ ret = 0;

+ goto out;

+

+ case HW_MACHINE_ARCH:

+ {

+ holdlen = sizeof(TARGET_HW_MACHINE_ARCH);

+ if (holdp) {

+ strlcpy(holdp, TARGET_HW_MACHINE_ARCH, oldlen);

+ }

+ ret = 0;

+ goto out;

+ }

+ case HW_NCPU:

+ if (oldlen) {

+ (*(abi_int *)holdp) = tswap32(bsd_get_ncpu());

+ }

+ holdlen = sizeof(int32_t);

+ ret = 0;

+ goto out;

+#if defined(TARGET_ARM)

+ case HW_FLOATINGPT:

+ if (oldlen) {

+ ARMCPU *cpu = env_archcpu(env);

+ *(abi_int *)holdp = cpu_isar_feature(aa32_vfp, cpu);

+ }

+ holdlen = sizeof(abi_int);

+ ret = 0;

+ goto out;

+#endif

+

+

+#ifdef TARGET_ABI32

+ case HW_PHYSMEM:

+ case HW_USERMEM:

+ case HW_REALMEM:

+ holdlen = sizeof(abi_ulong);

+ ret = 0;

+

+ if (oldlen) {

+ int mib[2] = {snamep[0], snamep[1]};

+ unsigned long lvalue;

+ size_t len = sizeof(lvalue);

+

+ if (sysctl(mib, 2, &lvalue, &len, NULL, 0) == -1) {

+ ret = -1;

+ } else {

+ lvalue = cap_memory(lvalue);

+ (*(abi_ulong *)holdp) = tswapal((abi_ulong)lvalue);

+ }

+ }

+ goto out;

+#endif

+

+ default:

+ {

+ static int oid_hw_availpages;

+ static int oid_hw_pagesizes;

+

+ if (!oid_hw_availpages) {

+ int real_oid[CTL_MAXNAME + 2];

+ size_t len = sizeof(real_oid) / sizeof(int);

+

+ if (sysctlnametomib("hw.availpages", real_oid, &len) >= 0) {

+ oid_hw_availpages = real_oid[1];

+ }

+ }

+ if (!oid_hw_pagesizes) {

+ int real_oid[CTL_MAXNAME + 2];

+ size_t len = sizeof(real_oid) / sizeof(int);

+

+ if (sysctlnametomib("hw.pagesizes", real_oid, &len) >= 0) {

+ oid_hw_pagesizes = real_oid[1];

+ }

+ }

+

+ if (oid_hw_availpages && snamep[1] == oid_hw_availpages) {

+ long lvalue;

+ size_t len = sizeof(lvalue);

+

+ if (sysctlbyname("hw.availpages", &lvalue, &len, NULL, 0) == -1) {

+ ret = -1;

+ } else {

+ if (oldlen) {

+ lvalue = scale_to_guest_pages(lvalue);

+ (*(abi_ulong *)holdp) = tswapal((abi_ulong)lvalue);

+ }

+ holdlen = sizeof(abi_ulong);

+ ret = 0;

+ }

+ goto out;

+ }

+

+ if (oid_hw_pagesizes && snamep[1] == oid_hw_pagesizes) {

+ if (oldlen) {

+ (*(abi_ulong *)holdp) = tswapal((abi_ulong)TARGET_PAGE_SIZE);

+ ((abi_ulong *)holdp)[1] = 0;

+ }

+ holdlen = sizeof(abi_ulong) * 2;

+ ret = 0;

+ goto out;

+ }

+ break;

+ }

+ }

+ break;

+

+ default:

+ break;

+ }

+

+#ifdef TARGET_ABI32

+ /*

+ * For long and ulong with a 64-bit host and a 32-bit target we have to do

+ * special things. holdlen here is the length provided by the target to the

+ * system call. So we allocate a buffer twice as large because longs are

+ * twice as big on the host which will be writing them. In h2g_old_sysctl

+ * we'll adjust them and adjust the length.

+ */

+ if (kind == CTLTYPE_LONG || kind == CTLTYPE_ULONG) {

+ old_holdp = holdp;

+ holdlen = holdlen * 2;

+ holdp = g_malloc(holdlen);

+ }

+#endif

+

+ ret = get_errno(sysctl(snamep, namelen, holdp, &holdlen, hnewp, newlen));

+ if (!ret && (holdp != 0)) {

+

+ if (snamep[0] == CTL_SYSCTL) {

+ switch (snamep[1]) {

+ case CTL_SYSCTL_NEXT:

+ case CTL_SYSCTL_NAME2OID:

+ case CTL_SYSCTL_NEXTNOSKIP:

+ /*

+ * All of these return an OID array, so we need to convert to

+ * target.

+ */

+ sysctl_name2oid(holdp, holdlen);

+ break;

+

+ case CTL_SYSCTL_OIDFMT:

+ /* Handle oidfmt */

+ sysctl_oidfmt(holdp);

+ break;

+ case CTL_SYSCTL_OIDDESCR:

+ case CTL_SYSCTL_OIDLABEL:

+ default:

+ /* Handle it based on the type */

+ h2g_old_sysctl(holdp, &holdlen, kind);

+ /* NB: None of these are LONG or ULONG */

+ break;

+ }

+ } else {

+ /*

+ * Need to convert from host to target. All the weird special cases

+ * are handled above.

+ */

+ h2g_old_sysctl(holdp, &holdlen, kind);

+#ifdef TARGET_ABI32

+ /*

+ * For the 32-bit on 64-bit case, for longs we need to copy the

+ * now-converted buffer to the target and free the buffer.

+ */

+ if (kind == CTLTYPE_LONG || kind == CTLTYPE_ULONG) {

+ memcpy(old_holdp, holdp, holdlen);

+ g_free(holdp);

+ holdp = old_holdp;

+ }

+#endif

+ }

+ }

+

+out:

+ *holdlenp = holdlen;

+ return ret;

+}

+

+/*

+ * This syscall was created to make sysctlbyname(3) more efficient, but we can't

+ * really provide it in bsd-user. Notably, we must always translate the names

+ * independently since some sysctl values have to be faked for the target

+ * environment, so it still has to break down to two syscalls for the underlying

+ * implementation.

+ */

+abi_long do_freebsd_sysctlbyname(CPUArchState *env, abi_ulong namep,

+ int32_t namelen, abi_ulong oldp, abi_ulong oldlenp, abi_ulong newp,

+ abi_ulong newlen)

+{

+ abi_long ret = -TARGET_EFAULT;

+ void *holdp = NULL, *hnewp = NULL;

+ char *snamep = NULL;

+ int oid[CTL_MAXNAME + 2];

+ size_t holdlen, oidplen;

+ abi_ulong oldlen = 0;

+

+ /* oldlenp is read/write, pre-check here for write */

+ if (oldlenp) {

+ if (!access_ok(VERIFY_WRITE, oldlenp, sizeof(abi_ulong)) ||

+ get_user_ual(oldlen, oldlenp)) {

+ goto out;

+ }

+ }

+ snamep = lock_user_string(namep);

+ if (snamep == NULL) {

+ goto out;

+ }

+ if (newp) {

+ hnewp = lock_user(VERIFY_READ, newp, newlen, 1);

+ if (hnewp == NULL) {

+ goto out;

+ }

+ }

+ if (oldp) {

+ holdp = lock_user(VERIFY_WRITE, oldp, oldlen, 0);

+ if (holdp == NULL) {

+ goto out;

+ }

+ }

+ holdlen = oldlen;

+

+ oidplen = ARRAY_SIZE(oid);

+ if (sysctlnametomib(snamep, oid, &oidplen) != 0) {

+ ret = -TARGET_EINVAL;

+ goto out;

+ }

+

+ ret = do_freebsd_sysctl_oid(env, oid, oidplen, holdp, &holdlen, hnewp,

+ newlen);

+

+ /*

+ * writeability pre-checked above. __sysctl(2) returns ENOMEM and updates

+ * oldlenp for the proper size to use.

+ */

+ if (oldlenp && (ret == 0 || ret == -TARGET_ENOMEM)) {

+ put_user_ual(holdlen, oldlenp);

+ }

+out:

+ unlock_user(snamep, namep, 0);

+ unlock_user(holdp, oldp, ret == 0 ? holdlen : 0);

+ unlock_user(hnewp, newp, 0);

+

+ return ret;

+}

+

+abi_long do_freebsd_sysctl(CPUArchState *env, abi_ulong namep, int32_t namelen,

+ abi_ulong oldp, abi_ulong oldlenp, abi_ulong newp, abi_ulong newlen)

+{

+ abi_long ret = -TARGET_EFAULT;

+ void *hnamep, *holdp = NULL, *hnewp = NULL;

+ size_t holdlen;

+ abi_ulong oldlen = 0;

+ int32_t *snamep = g_malloc(sizeof(int32_t) * namelen), *p, *q, i;

+

+ /* oldlenp is read/write, pre-check here for write */

+ if (oldlenp) {

+ if (!access_ok(VERIFY_WRITE, oldlenp, sizeof(abi_ulong)) ||

+ get_user_ual(oldlen, oldlenp)) {

+ goto out;

+ }

+ }

+ hnamep = lock_user(VERIFY_READ, namep, namelen, 1);

+ if (hnamep == NULL) {

+ goto out;

+ }

+ if (newp) {

+ hnewp = lock_user(VERIFY_READ, newp, newlen, 1);

+ if (hnewp == NULL) {

+ goto out;

+ }

+ }

+ if (oldp) {

+ holdp = lock_user(VERIFY_WRITE, oldp, oldlen, 0);

+ if (holdp == NULL) {

+ goto out;

+ }

+ }

+ holdlen = oldlen;

+ for (p = hnamep, q = snamep, i = 0; i < namelen; p++, i++, q++) {

+ *q = tswap32(*p);

+ }

+

+ ret = do_freebsd_sysctl_oid(env, snamep, namelen, holdp, &holdlen, hnewp,

+ newlen);

+

+ /*

+ * writeability pre-checked above. __sysctl(2) returns ENOMEM and updates

+ * oldlenp for the proper size to use.

+ */

+ if (oldlenp && (ret == 0 || ret == -TARGET_ENOMEM)) {

+ put_user_ual(holdlen, oldlenp);

+ }

+ unlock_user(hnamep, namep, 0);

+ unlock_user(holdp, oldp, ret == 0 ? holdlen : 0);

+out:

+ g_free(snamep);

+ return ret;

+}

+

+ /*

+ * sys{ctl, arch, call}

+ */

+ case TARGET_FREEBSD_NR___sysctl: /* sysctl(3) */

+ ret = do_freebsd_sysctl(cpu_env, arg1, arg2, arg3, arg4, arg5, arg6);

+ break;

+

+ case TARGET_FREEBSD_NR___sysctlbyname: /* sysctlbyname(2) */

+ ret = do_freebsd_sysctlbyname(cpu_env, arg1, arg2, arg3, arg4, arg5, arg6);

+ break;

+

+ case TARGET_FREEBSD_NR_sysarch: /* sysarch(2) */

+ ret = do_freebsd_sysarch(cpu_env, arg1, arg2);

+ break;

+

+ abi_long ret;

+abi_long do_freebsd_sysctl(CPUArchState *env, abi_ulong namep, int32_t namelen,

+ abi_ulong oldp, abi_ulong oldlenp, abi_ulong newp, abi_ulong newlen);

+abi_long do_freebsd_sysctlbyname(CPUArchState *env, abi_ulong namep,

+ int32_t namelen, abi_ulong oldp, abi_ulong oldlenp, abi_ulong newp,

+ abi_ulong newlen);

+ QEMU_CFLAGS="-fno-pie $QEMU_CFLAGS"

+runc=""

+ runc=$($python "$source_path"/tests/docker/docker.py probe)

+ echo "RUNC=$runc" >> $config_host_mak

+TCG (Tiny Code Generator) began as a generic backend for a C compiler.

+It was simplified to be used in QEMU. It also has its roots in the

+QOP code generator written by Paul Brook.

+The TCG *target* is the architecture for which we generate the code.

+It is of course not the same as the "target" of QEMU which is the

+emulated architecture. As TCG started as a generic C backend used

+for cross compiling, the assumption was that TCG target might be

+different from the host, although this is never the case for QEMU.

+Basic Blocks

+============

+A TCG *basic block* is a single entry, multiple exit region which

+corresponds to a list of instructions terminated by a label, or

+any branch instruction.

+A TCG *extended basic block* is a single entry, multiple exit region

+which corresponds to a list of instructions terminated by a label or

+an unconditional branch. Specifically, an extended basic block is

+a sequence of basic blocks connected by the fall-through paths of

+zero or more conditional branch instructions.

+Operations

+==========

+TCG instructions or *ops* operate on TCG *variables*, both of which

+are strongly typed. Each instruction has a fixed number of output

+variable operands, input variable operands and constant operands.

+Vector instructions have a field specifying the element size within

+the vector. The notable exception is the call instruction which has

+a variable number of outputs and inputs.

+Variables

+=========

+* ``TEMP_FIXED``

+ There is one TCG *fixed global* variable, ``cpu_env``, which is

+ live in all translation blocks, and holds a pointer to ``CPUArchState``.

+ This variable is held in a host cpu register at all times in all

+ translation blocks.

+* ``TEMP_GLOBAL``

+ A TCG *global* is a variable which is live in all translation blocks,

+ and corresponds to memory location that is within ``CPUArchState``.

+ These may be specified as an offset from ``cpu_env``, in which case

+ they are called *direct globals*, or may be specified as an offset

+ from a direct global, in which case they are called *indirect globals*.

+ Even indirect globals should still reference memory within

+ ``CPUArchState``. All TCG globals are defined during

+ ``TCGCPUOps.initialize``, before any translation blocks are generated.

+* ``TEMP_CONST``

+ A TCG *constant* is a variable which is live throughout the entire

+ translation block, and contains a constant value. These variables

+ are allocated on demand during translation and are hashed so that

+ there is exactly one variable holding a given value.

+* ``TEMP_TB``

+ A TCG *translation block temporary* is a variable which is live

+ throughout the entire translation block, but dies on any exit.

+ These temporaries are allocated explicitly during translation.

+* ``TEMP_EBB``

+ A TCG *extended basic block temporary* is a variable which is live

+ throughout an extended basic block, but dies on any exit.

+ These temporaries are allocated explicitly during translation.

+

+Types

+=====

+

+* ``TCG_TYPE_I32``

+

+ A 32-bit integer.

+

+* ``TCG_TYPE_I64``

+

+ A 64-bit integer. For 32-bit hosts, such variables are split into a pair

+ of variables with ``type=TCG_TYPE_I32`` and ``base_type=TCG_TYPE_I64``.

+ The ``temp_subindex`` for each indicates where it falls within the

+ host-endian representation.

+* ``TCG_TYPE_PTR``

+ An alias for ``TCG_TYPE_I32`` or ``TCG_TYPE_I64``, depending on the size

+ of a pointer for the host.

+* ``TCG_TYPE_REG``

+ An alias for ``TCG_TYPE_I32`` or ``TCG_TYPE_I64``, depending on the size

+ of the integer registers for the host. This may be larger

+ than ``TCG_TYPE_PTR`` depending on the host ABI.

+* ``TCG_TYPE_I128``

+ A 128-bit integer. For all hosts, such variables are split into a number

+ of variables with ``type=TCG_TYPE_REG`` and ``base_type=TCG_TYPE_I128``.

+ The ``temp_subindex`` for each indicates where it falls within the

+ host-endian representation.

+* ``TCG_TYPE_V64``

+ A 64-bit vector. This type is valid only if the TCG target

+ sets ``TCG_TARGET_HAS_v64``.

+* ``TCG_TYPE_V128``

+

+ A 128-bit vector. This type is valid only if the TCG target

+ sets ``TCG_TARGET_HAS_v128``.

+

+* ``TCG_TYPE_V256``

+

+ A 256-bit vector. This type is valid only if the TCG target

+ sets ``TCG_TARGET_HAS_v256``.

+

+Helpers

+=======

+

+Helpers are registered in a guest-specific ``helper.h``,

+which is processed to generate ``tcg_gen_helper_*`` functions.

+With these functions it is possible to call a function taking

+i32, i64, i128 or pointer types.

+

+By default, before calling a helper, all globals are stored at their

+canonical location. By default, the helper is allowed to modify the

+CPU state (including the state represented by tcg globals)

+or may raise an exception. This default can be overridden using the

+following function modifiers:

+

+* ``TCG_CALL_NO_WRITE_GLOBALS``

+

+ The helper does not modify any globals, but may read them.

+ Globals will be saved to their canonical location before calling helpers,

+ but need not be reloaded afterwards.

+

+* ``TCG_CALL_NO_READ_GLOBALS``

+

+ The helper does not read globals, either directly or via an exception.

+ They will not be saved to their canonical locations before calling

+ the helper. This implies ``TCG_CALL_NO_WRITE_GLOBALS``.

+

+* ``TCG_CALL_NO_SIDE_EFFECTS``

+

+ The call to the helper function may be removed if the return value is

+ not used. This means that it may not modify any CPU state nor may it

+ raise an exception.

+==================

+- Free temporaries when they are no longer used (``tcg_temp_free``).

+ Since ``tcg_const_x`` also creates a temporary, you should free it

+ after it is used.

+TSan is currently supported in the ubuntu2204 docker.

+ make docker-test-tsan@ubuntu2204

+Xen HVM guest support

+=====================

+

+

+Description

+-----------

+

+KVM has support for hosting Xen guests, intercepting Xen hypercalls and event

+channel (Xen PV interrupt) delivery. This allows guests which expect to be

+run under Xen to be hosted in QEMU under Linux/KVM instead.

+

+Setup

+-----

+

+Xen mode is enabled by setting the ``xen-version`` property of the KVM

+accelerator, for example for Xen 4.10:

+

+.. parsed-literal::

+

+ |qemu_system| --accel kvm,xen-version=0x4000a

+

+Additionally, virtual APIC support can be advertised to the guest through the

+``xen-vapic`` CPU flag:

+

+.. parsed-literal::

+

+ |qemu_system| --accel kvm,xen-version=0x4000a --cpu host,+xen_vapic

+

+When Xen support is enabled, QEMU changes hypervisor identification (CPUID

+0x40000000..0x4000000A) to Xen. The KVM identification and features are not

+advertised to a Xen guest. If Hyper-V is also enabled, the Xen identification

+moves to leaves 0x40000100..0x4000010A.

+

+The Xen platform device is enabled automatically for a Xen guest. This allows

+a guest to unplug all emulated devices, in order to use Xen PV block and network

+drivers instead. Note that until the Xen PV device back ends are enabled to work

+with Xen mode in QEMU, that is unlikely to cause significant joy. Linux guests

+can be dissuaded from this by adding 'xen_emul_unplug=never' on their command

+line, and it can also be noted that AHCI disk controllers are exempt from being

+unplugged, as are passthrough VFIO PCI devices.

+

+Properties

+----------

+

+The following properties exist on the KVM accelerator object:

+

+``xen-version``

+ This property contains the Xen version in ``XENVER_version`` form, with the

+ major version in the top 16 bits and the minor version in the low 16 bits.

+ Setting this property enables the Xen guest support.

+

+``xen-evtchn-max-pirq``

+ Xen PIRQs represent an emulated physical interrupt, either GSI or MSI, which

+ can be routed to an event channel instead of to the emulated I/O or local

+ APIC. By default, QEMU permits only 256 PIRQs because this allows maximum

+ compatibility with 32-bit MSI where the higher bits of the PIRQ# would need

+ to be in the upper 64 bits of the MSI message. For guests with large numbers

+ of PCI devices (and none which are limited to 32-bit addressing) it may be

+ desirable to increase this value.

+

+``xen-gnttab-max-frames``

+ Xen grant tables are the means by which a Xen guest grants access to its

+ memory for PV back ends (disk, network, etc.). Since QEMU only supports v1

+ grant tables which are 8 bytes in size, each page (each frame) of the grant

+ table can reference 512 pages of guest memory. The default number of frames

+ is 64, allowing for 32768 pages of guest memory to be accessed by PV backends

+ through simultaneous grants. For guests with large numbers of PV devices and

+ high throughput, it may be desirable to increase this value.

+

+OS requirements

+---------------

+

+The minimal Xen support in the KVM accelerator requires the host to be running

+Linux v5.12 or newer. Later versions add optimisations: Linux v5.17 added

+acceleration of interrupt delivery via the Xen PIRQ mechanism, and Linux v5.19

+accelerated Xen PV timers and inter-processor interrupts (IPIs).

+ i386/xen

+

+#if defined(CONFIG_XEN_EMU)

+ {

+ .name = "xen-event-inject",

+ .args_type = "port:i",

+ .params = "port",

+ .help = "inject event channel",

+ .cmd = hmp_xen_event_inject,

+ },

+

+SRST

+``xen-event-inject`` *port*

+ Notify guest via event channel on port *port*.

+ERST

+

+

+ {

+ .name = "xen-event-list",

+ .args_type = "",

+ .params = "",

+ .help = "list event channel state",

+ .cmd = hmp_xen_event_list,

+ },

+

+SRST

+``xen-event-list``

+ List event channels in the guest

+ERST

+#endif

+source xen/Kconfig

+ info->acpi = !!object_class_property_find(OBJECT_CLASS(mc), "acpi");

+

+config XEN_EMU

+ bool

+ default y

+ depends on KVM && (I386 || X86_64)

+i386_kvm_ss.add(when: 'CONFIG_XEN_EMU', if_true: files(

+ 'xen_overlay.c',

+ 'xen_evtchn.c',

+ 'xen_gnttab.c',

+ 'xen_xenstore.c',

+ ))

+

+xen_stubs_ss = ss.source_set()

+xen_stubs_ss.add(when: 'CONFIG_XEN_EMU', if_false: files(

+ 'xen-stubs.c',

+))

+

+specific_ss.add_all(when: 'CONFIG_SOFTMMU', if_true: xen_stubs_ss)

+kvm_xen_map_pirq(int pirq, int gsi) "pirq %d gsi %d"

+kvm_xen_unmap_pirq(int pirq, int gsi) "pirq %d gsi %d"

+kvm_xen_get_free_pirq(int pirq, int type) "pirq %d type %d"

+kvm_xen_bind_pirq(int pirq, int port) "pirq %d port %d"

+kvm_xen_unmask_pirq(int pirq, char *dev, int vector) "pirq %d dev %s vector %d"

+#include "trace/trace-hw_i386_kvm.h"

+/*

+ * QEMU Xen emulation: QMP stubs

+ *

+ * Copyright © 2023 Amazon.com, Inc. or its affiliates. All Rights Reserved.

+ *

+ * Authors: David Woodhouse <dwmw2@infradead.org>

+ *

+ * This work is licensed under the terms of the GNU GPL, version 2 or later.

+ * See the COPYING file in the top-level directory.

+ */

+

+#include "qemu/osdep.h"

+

+#include "qapi/error.h"

+#include "qapi/qapi-commands-misc-target.h"

+

+#include "xen_evtchn.h"

+

+void xen_evtchn_snoop_msi(PCIDevice *dev, bool is_msix, unsigned int vector,

+ uint64_t addr, uint32_t data, bool is_masked)

+{

+}

+

+void xen_evtchn_remove_pci_device(PCIDevice *dev)

+{

+}

+

+bool xen_evtchn_deliver_pirq_msi(uint64_t address, uint32_t data)

+{

+ return false;

+}

+

+#ifdef TARGET_I386

+EvtchnInfoList *qmp_xen_event_list(Error **errp)

+{

+ error_setg(errp, "Xen event channel emulation not enabled");

+ return NULL;

+}

+

+void qmp_xen_event_inject(uint32_t port, Error **errp)

+{

+ error_setg(errp, "Xen event channel emulation not enabled");

+}

+#endif

+/*

+ * QEMU Xen emulation: Event channel support

+ *

+ * Copyright © 2022 Amazon.com, Inc. or its affiliates. All Rights Reserved.

+ *

+ * Authors: David Woodhouse <dwmw2@infradead.org>

+ *

+ * This work is licensed under the terms of the GNU GPL, version 2 or later.

+ * See the COPYING file in the top-level directory.

+ */

+

+#include "qemu/osdep.h"

+#include "qemu/host-utils.h"

+#include "qemu/module.h"

+#include "qemu/lockable.h"

+#include "qemu/main-loop.h"

+#include "qemu/log.h"

+#include "monitor/monitor.h"

+#include "monitor/hmp.h"

+#include "qapi/error.h"

+#include "qapi/qapi-commands-misc-target.h"

+#include "qapi/qmp/qdict.h"

+#include "qom/object.h"

+#include "exec/target_page.h"

+#include "exec/address-spaces.h"

+#include "migration/vmstate.h"

+#include "trace.h"

+

+#include "hw/sysbus.h"

+#include "hw/xen/xen.h"

+#include "hw/i386/x86.h"

+#include "hw/i386/pc.h"

+#include "hw/pci/pci.h"

+#include "hw/pci/msi.h"

+#include "hw/pci/msix.h"

+#include "hw/irq.h"

+

+#include "xen_evtchn.h"

+#include "xen_overlay.h"

+#include "xen_xenstore.h"

+

+#include "sysemu/kvm.h"

+#include "sysemu/kvm_xen.h"

+#include <linux/kvm.h>

+#include <sys/eventfd.h>

+

+#include "hw/xen/interface/memory.h"

+#include "hw/xen/interface/hvm/params.h"

+

+/* XX: For kvm_update_msi_routes_all() */

+#include "target/i386/kvm/kvm_i386.h"

+

+#define TYPE_XEN_EVTCHN "xen-evtchn"

+OBJECT_DECLARE_SIMPLE_TYPE(XenEvtchnState, XEN_EVTCHN)

+

+typedef struct XenEvtchnPort {

+ uint32_t vcpu; /* Xen/ACPI vcpu_id */

+ uint16_t type; /* EVTCHNSTAT_xxxx */

+ uint16_t type_val; /* pirq# / virq# / remote port according to type */

+} XenEvtchnPort;

+

+/* 32-bit compatibility definitions, also used natively in 32-bit build */

+struct compat_arch_vcpu_info {

+ unsigned int cr2;

+ unsigned int pad[5];

+};

+

+struct compat_vcpu_info {

+ uint8_t evtchn_upcall_pending;

+ uint8_t evtchn_upcall_mask;

+ uint16_t pad;

+ uint32_t evtchn_pending_sel;

+ struct compat_arch_vcpu_info arch;

+ struct vcpu_time_info time;

+}; /* 64 bytes (x86) */

+

+struct compat_arch_shared_info {

+ unsigned int max_pfn;

+ unsigned int pfn_to_mfn_frame_list_list;

+ unsigned int nmi_reason;

+ unsigned int p2m_cr3;

+ unsigned int p2m_vaddr;

+ unsigned int p2m_generation;

+ uint32_t wc_sec_hi;

+};

+

+struct compat_shared_info {

+ struct compat_vcpu_info vcpu_info[XEN_LEGACY_MAX_VCPUS];

+ uint32_t evtchn_pending[32];

+ uint32_t evtchn_mask[32];

+ uint32_t wc_version; /* Version counter: see vcpu_time_info_t. */

+ uint32_t wc_sec;

+ uint32_t wc_nsec;

+ struct compat_arch_shared_info arch;

+};

+

+#define COMPAT_EVTCHN_2L_NR_CHANNELS 1024

+

+/* Local private implementation of struct xenevtchn_handle */

+struct xenevtchn_handle {

+ evtchn_port_t be_port;

+ evtchn_port_t guest_port; /* Or zero for unbound */

+ int fd;

+};

+

+/*

+ * For unbound/interdomain ports there are only two possible remote

+ * domains; self and QEMU. Use a single high bit in type_val for that,

+ * and the low bits for the remote port number (or 0 for unbound).

+ */

+#define PORT_INFO_TYPEVAL_REMOTE_QEMU 0x8000

+#define PORT_INFO_TYPEVAL_REMOTE_PORT_MASK 0x7FFF

+

+/*

+ * These 'emuirq' values are used by Xen in the LM stream... and yes, I am

+ * insane enough to think about guest-transparent live migration from actual

+ * Xen to QEMU, and ensuring that we can convert/consume the stream.

+ */

+#define IRQ_UNBOUND -1

+#define IRQ_PT -2

+#define IRQ_MSI_EMU -3

+

+

+struct pirq_info {

+ int gsi;

+ uint16_t port;

+ PCIDevice *dev;

+ int vector;

+ bool is_msix;

+ bool is_masked;

+ bool is_translated;

+};

+

+struct XenEvtchnState {

+ /*< private >*/

+ SysBusDevice busdev;

+ /*< public >*/

+

+ uint64_t callback_param;

+ bool evtchn_in_kernel;

+ uint32_t callback_gsi;

+

+ QEMUBH *gsi_bh;

+

+ QemuMutex port_lock;

+ uint32_t nr_ports;

+ XenEvtchnPort port_table[EVTCHN_2L_NR_CHANNELS];

+ qemu_irq gsis[IOAPIC_NUM_PINS];

+

+ struct xenevtchn_handle *be_handles[EVTCHN_2L_NR_CHANNELS];

+

+ uint32_t nr_pirqs;

+

+ /* Bitmap of allocated PIRQs (serialized) */

+ uint16_t nr_pirq_inuse_words;

+ uint64_t *pirq_inuse_bitmap;

+

+ /* GSI → PIRQ mapping (serialized) */

+ uint16_t gsi_pirq[IOAPIC_NUM_PINS];

+

+ /* Per-GSI assertion state (serialized) */

+ uint32_t pirq_gsi_set;

+

+ /* Per-PIRQ information (rebuilt on migration, protected by BQL) */

+ struct pirq_info *pirq;

+};

+

+#define pirq_inuse_word(s, pirq) (s->pirq_inuse_bitmap[((pirq) / 64)])

+#define pirq_inuse_bit(pirq) (1ULL << ((pirq) & 63))

+

+#define pirq_inuse(s, pirq) (pirq_inuse_word(s, pirq) & pirq_inuse_bit(pirq))

+

+struct XenEvtchnState *xen_evtchn_singleton;

+

+/* Top bits of callback_param are the type (HVM_PARAM_CALLBACK_TYPE_xxx) */

+#define CALLBACK_VIA_TYPE_SHIFT 56

+

+static void unbind_backend_ports(XenEvtchnState *s);

+

+static int xen_evtchn_pre_load(void *opaque)

+{

+ XenEvtchnState *s = opaque;

+

+ /* Unbind all the backend-side ports; they need to rebind */

+ unbind_backend_ports(s);

+

+ /* It'll be leaked otherwise. */

+ g_free(s->pirq_inuse_bitmap);

+ s->pirq_inuse_bitmap = NULL;

+

+ return 0;

+}

+

+static int xen_evtchn_post_load(void *opaque, int version_id)

+{

+ XenEvtchnState *s = opaque;

+ uint32_t i;

+

+ if (s->callback_param) {

+ xen_evtchn_set_callback_param(s->callback_param);

+ }

+

+ /* Rebuild s->pirq[].port mapping */

+ for (i = 0; i < s->nr_ports; i++) {

+ XenEvtchnPort *p = &s->port_table[i];

+

+ if (p->type == EVTCHNSTAT_pirq) {

+ assert(p->type_val);

+ assert(p->type_val < s->nr_pirqs);

+

+ /*

+ * Set the gsi to IRQ_UNBOUND; it may be changed to an actual

+ * GSI# below, or to IRQ_MSI_EMU when the MSI table snooping

+ * catches up with it.

+ */

+ s->pirq[p->type_val].gsi = IRQ_UNBOUND;

+ s->pirq[p->type_val].port = i;

+ }

+ }

+ /* Rebuild s->pirq[].gsi mapping */

+ for (i = 0; i < IOAPIC_NUM_PINS; i++) {

+ if (s->gsi_pirq[i]) {

+ s->pirq[s->gsi_pirq[i]].gsi = i;

+ }

+ }

+ return 0;

+}

+

+static bool xen_evtchn_is_needed(void *opaque)

+{

+ return xen_mode == XEN_EMULATE;

+}

+

+static const VMStateDescription xen_evtchn_port_vmstate = {

+ .name = "xen_evtchn_port",

+ .version_id = 1,

+ .minimum_version_id = 1,

+ .fields = (VMStateField[]) {

+ VMSTATE_UINT32(vcpu, XenEvtchnPort),

+ VMSTATE_UINT16(type, XenEvtchnPort),

+ VMSTATE_UINT16(type_val, XenEvtchnPort),

+ VMSTATE_END_OF_LIST()

+ }

+};

+

+static const VMStateDescription xen_evtchn_vmstate = {

+ .name = "xen_evtchn",

+ .version_id = 1,

+ .minimum_version_id = 1,

+ .needed = xen_evtchn_is_needed,

+ .pre_load = xen_evtchn_pre_load,

+ .post_load = xen_evtchn_post_load,

+ .fields = (VMStateField[]) {

+ VMSTATE_UINT64(callback_param, XenEvtchnState),

+ VMSTATE_UINT32(nr_ports, XenEvtchnState),

+ VMSTATE_STRUCT_VARRAY_UINT32(port_table, XenEvtchnState, nr_ports, 1,

+ xen_evtchn_port_vmstate, XenEvtchnPort),

+ VMSTATE_UINT16_ARRAY(gsi_pirq, XenEvtchnState, IOAPIC_NUM_PINS),

+ VMSTATE_VARRAY_UINT16_ALLOC(pirq_inuse_bitmap, XenEvtchnState,

+ nr_pirq_inuse_words, 0,

+ vmstate_info_uint64, uint64_t),

+ VMSTATE_UINT32(pirq_gsi_set, XenEvtchnState),

+ VMSTATE_END_OF_LIST()

+ }

+};

+

+static void xen_evtchn_class_init(ObjectClass *klass, void *data)

+{

+ DeviceClass *dc = DEVICE_CLASS(klass);

+

+ dc->vmsd = &xen_evtchn_vmstate;

+}

+

+static const TypeInfo xen_evtchn_info = {

+ .name = TYPE_XEN_EVTCHN,

+ .parent = TYPE_SYS_BUS_DEVICE,

+ .instance_size = sizeof(XenEvtchnState),

+ .class_init = xen_evtchn_class_init,

+};

+

+static void gsi_assert_bh(void *opaque)

+{

+ struct vcpu_info *vi = kvm_xen_get_vcpu_info_hva(0);

+ if (vi) {

+ xen_evtchn_set_callback_level(!!vi->evtchn_upcall_pending);

+ }

+}

+

+void xen_evtchn_create(void)

+{

+ XenEvtchnState *s = XEN_EVTCHN(sysbus_create_simple(TYPE_XEN_EVTCHN,

+ -1, NULL));

+ int i;

+

+ xen_evtchn_singleton = s;

+

+ qemu_mutex_init(&s->port_lock);

+ s->gsi_bh = aio_bh_new(qemu_get_aio_context(), gsi_assert_bh, s);

+

+ for (i = 0; i < IOAPIC_NUM_PINS; i++) {

+ sysbus_init_irq(SYS_BUS_DEVICE(s), &s->gsis[i]);

+ }

+

+ /*

+ * The Xen scheme for encoding PIRQ# into an MSI message is not

+ * compatible with 32-bit MSI, as it puts the high bits of the

+ * PIRQ# into the high bits of the MSI message address, instead of

+ * using the Extended Destination ID in address bits 4-11 which

+ * perhaps would have been a better choice.

+ *

+ * To keep life simple, kvm_accel_instance_init() initialises the

+ * default to 256. which conveniently doesn't need to set anything

+ * outside the low 32 bits of the address. It can be increased by

+ * setting the xen-evtchn-max-pirq property.

+ */

+ s->nr_pirqs = kvm_xen_get_evtchn_max_pirq();

+

+ s->nr_pirq_inuse_words = DIV_ROUND_UP(s->nr_pirqs, 64);

+ s->pirq_inuse_bitmap = g_new0(uint64_t, s->nr_pirq_inuse_words);

+ s->pirq = g_new0(struct pirq_info, s->nr_pirqs);

+}

+

+void xen_evtchn_connect_gsis(qemu_irq *system_gsis)

+{

+ XenEvtchnState *s = xen_evtchn_singleton;

+ int i;

+

+ if (!s) {

+ return;

+ }

+

+ for (i = 0; i < IOAPIC_NUM_PINS; i++) {

+ sysbus_connect_irq(SYS_BUS_DEVICE(s), i, system_gsis[i]);

+ }

+}

+

+static void xen_evtchn_register_types(void)

+{

+ type_register_static(&xen_evtchn_info);

+}

+

+type_init(xen_evtchn_register_types)

+

+static int set_callback_pci_intx(XenEvtchnState *s, uint64_t param)

+{

+ PCMachineState *pcms = PC_MACHINE(qdev_get_machine());

+ uint8_t pin = param & 3;

+ uint8_t devfn = (param >> 8) & 0xff;

+ uint16_t bus = (param >> 16) & 0xffff;

+ uint16_t domain = (param >> 32) & 0xffff;

+ PCIDevice *pdev;

+ PCIINTxRoute r;

+

+ if (domain || !pcms) {

+ return 0;

+ }

+

+ pdev = pci_find_device(pcms->bus, bus, devfn);

+ if (!pdev) {

+ return 0;

+ }

+

+ r = pci_device_route_intx_to_irq(pdev, pin);

+ if (r.mode != PCI_INTX_ENABLED) {

+ return 0;

+ }

+

+ /*

+ * Hm, can we be notified of INTX routing changes? Not without

+ * *owning* the device and being allowed to overwrite its own

+ * ->intx_routing_notifier, AFAICT. So let's not.

+ */

+ return r.irq;

+}

+

+void xen_evtchn_set_callback_level(int level)

+{

+ XenEvtchnState *s = xen_evtchn_singleton;

+ if (!s) {

+ return;

+ }

+

+ /*

+ * We get to this function in a number of ways:

+ *

+ * • From I/O context, via PV backend drivers sending a notification to

+ * the guest.

+ *

+ * • From guest vCPU context, via loopback interdomain event channels

+ * (or theoretically even IPIs but guests don't use those with GSI

+ * delivery because that's pointless. We don't want a malicious guest

+ * to be able to trigger a deadlock though, so we can't rule it out.)

+ *

+ * • From guest vCPU context when the HVM_PARAM_CALLBACK_IRQ is being

+ * configured.

+ *

+ * • From guest vCPU context in the KVM exit handler, if the upcall

+ * pending flag has been cleared and the GSI needs to be deasserted.

+ *

+ * • Maybe in future, in an interrupt ack/eoi notifier when the GSI has

+ * been acked in the irqchip.

+ *

+ * Whichever context we come from if we aren't already holding the BQL

+ * then e can't take it now, as we may already hold s->port_lock. So

+ * trigger the BH to set the IRQ for us instead of doing it immediately.

+ *

+ * In the HVM_PARAM_CALLBACK_IRQ and KVM exit handler cases, the caller

+ * will deliberately take the BQL because they want the change to take

+ * effect immediately. That just leaves interdomain loopback as the case

+ * which uses the BH.

+ */

+ if (!qemu_mutex_iothread_locked()) {

+ qemu_bh_schedule(s->gsi_bh);

+ return;

+ }

+

+ if (s->callback_gsi && s->callback_gsi < IOAPIC_NUM_PINS) {

+ qemu_set_irq(s->gsis[s->callback_gsi], level);

+ if (level) {

+ /* Ensure the vCPU polls for deassertion */

+ kvm_xen_set_callback_asserted();

+ }

+ }

+}

+

+int xen_evtchn_set_callback_param(uint64_t param)

+{

+ XenEvtchnState *s = xen_evtchn_singleton;

+ struct kvm_xen_hvm_attr xa = {

+ .type = KVM_XEN_ATTR_TYPE_UPCALL_VECTOR,

+ .u.vector = 0,

+ };

+ bool in_kernel = false;

+ uint32_t gsi = 0;

+ int type = param >> CALLBACK_VIA_TYPE_SHIFT;

+ int ret;

+

+ if (!s) {

+ return -ENOTSUP;

+ }

+

+ /*

+ * We need the BQL because set_callback_pci_intx() may call into PCI code,

+ * and because we may need to manipulate the old and new GSI levels.

+ */

+ assert(qemu_mutex_iothread_locked());

+ qemu_mutex_lock(&s->port_lock);

+

+ switch (type) {

+ case HVM_PARAM_CALLBACK_TYPE_VECTOR: {

+ xa.u.vector = (uint8_t)param,

+

+ ret = kvm_vm_ioctl(kvm_state, KVM_XEN_HVM_SET_ATTR, &xa);

+ if (!ret && kvm_xen_has_cap(EVTCHN_SEND)) {

+ in_kernel = true;

+ }

+ gsi = 0;

+ break;

+ }

+

+ case HVM_PARAM_CALLBACK_TYPE_PCI_INTX:

+ gsi = set_callback_pci_intx(s, param);

+ ret = gsi ? 0 : -EINVAL;

+ break;

+

+ case HVM_PARAM_CALLBACK_TYPE_GSI:

+ gsi = (uint32_t)param;

+ ret = 0;

+ break;

+

+ default:

+ /* Xen doesn't return error even if you set something bogus */

+ ret = 0;

+ break;

+ }

+

+ if (!ret) {

+ /* If vector delivery was turned *off* then tell the kernel */

+ if ((s->callback_param >> CALLBACK_VIA_TYPE_SHIFT) ==

+ HVM_PARAM_CALLBACK_TYPE_VECTOR && !xa.u.vector) {

+ kvm_vm_ioctl(kvm_state, KVM_XEN_HVM_SET_ATTR, &xa);

+ }

+ s->callback_param = param;

+ s->evtchn_in_kernel = in_kernel;

+

+ if (gsi != s->callback_gsi) {

+ struct vcpu_info *vi = kvm_xen_get_vcpu_info_hva(0);

+

+ xen_evtchn_set_callback_level(0);

+ s->callback_gsi = gsi;

+

+ if (gsi && vi && vi->evtchn_upcall_pending) {

+ kvm_xen_inject_vcpu_callback_vector(0, type);

+ }

+ }

+ }

+

+ qemu_mutex_unlock(&s->port_lock);

+

+ return ret;

+}

+

+static void inject_callback(XenEvtchnState *s, uint32_t vcpu)

+{

+ int type = s->callback_param >> CALLBACK_VIA_TYPE_SHIFT;

+

+ kvm_xen_inject_vcpu_callback_vector(vcpu, type);

+}

+

+static void deassign_kernel_port(evtchn_port_t port)

+{

+ struct kvm_xen_hvm_attr ha;

+ int ret;

+

+ ha.type = KVM_XEN_ATTR_TYPE_EVTCHN;

+ ha.u.evtchn.send_port = port;

+ ha.u.evtchn.flags = KVM_XEN_EVTCHN_DEASSIGN;

+

+ ret = kvm_vm_ioctl(kvm_state, KVM_XEN_HVM_SET_ATTR, &ha);

+ if (ret) {

+ qemu_log_mask(LOG_GUEST_ERROR, "Failed to unbind kernel port %d: %s\n",

+ port, strerror(ret));

+ }

+}

+

+static int assign_kernel_port(uint16_t type, evtchn_port_t port,

+ uint32_t vcpu_id)

+{

+ CPUState *cpu = qemu_get_cpu(vcpu_id);

+ struct kvm_xen_hvm_attr ha;

+

+ if (!cpu) {

+ return -ENOENT;

+ }

+

+ ha.type = KVM_XEN_ATTR_TYPE_EVTCHN;

+ ha.u.evtchn.send_port = port;

+ ha.u.evtchn.type = type;

+ ha.u.evtchn.flags = 0;

+ ha.u.evtchn.deliver.port.port = port;

+ ha.u.evtchn.deliver.port.vcpu = kvm_arch_vcpu_id(cpu);

+ ha.u.evtchn.deliver.port.priority = KVM_IRQ_ROUTING_XEN_EVTCHN_PRIO_2LEVEL;

+

+ return kvm_vm_ioctl(kvm_state, KVM_XEN_HVM_SET_ATTR, &ha);

+}

+

+static int assign_kernel_eventfd(uint16_t type, evtchn_port_t port, int fd)

+{

+ struct kvm_xen_hvm_attr ha;

+

+ ha.type = KVM_XEN_ATTR_TYPE_EVTCHN;

+ ha.u.evtchn.send_port = port;

+ ha.u.evtchn.type = type;

+ ha.u.evtchn.flags = 0;

+ ha.u.evtchn.deliver.eventfd.port = 0;

+ ha.u.evtchn.deliver.eventfd.fd = fd;

+

+ return kvm_vm_ioctl(kvm_state, KVM_XEN_HVM_SET_ATTR, &ha);

+}

+

+static bool valid_port(evtchn_port_t port)

+{

+ if (!port) {

+ return false;

+ }

+

+ if (xen_is_long_mode()) {

+ return port < EVTCHN_2L_NR_CHANNELS;

+ } else {

+ return port < COMPAT_EVTCHN_2L_NR_CHANNELS;

+ }

+}

+

+static bool valid_vcpu(uint32_t vcpu)

+{

+ return !!qemu_get_cpu(vcpu);

+}

+

+static void unbind_backend_ports(XenEvtchnState *s)

+{

+ XenEvtchnPort *p;

+ int i;

+

+ for (i = 1; i < s->nr_ports; i++) {

+ p = &s->port_table[i];

+ if (p->type == EVTCHNSTAT_interdomain &&

+ (p->type_val & PORT_INFO_TYPEVAL_REMOTE_QEMU)) {

+ evtchn_port_t be_port = p->type_val & PORT_INFO_TYPEVAL_REMOTE_PORT_MASK;

+

+ if (s->be_handles[be_port]) {

+ /* This part will be overwritten on the load anyway. */

+ p->type = EVTCHNSTAT_unbound;

+ p->type_val = PORT_INFO_TYPEVAL_REMOTE_QEMU;

+

+ /* Leave the backend port open and unbound too. */

+ if (kvm_xen_has_cap(EVTCHN_SEND)) {

+ deassign_kernel_port(i);

+ }

+ s->be_handles[be_port]->guest_port = 0;

+ }

+ }

+ }

+}

+

+int xen_evtchn_status_op(struct evtchn_status *status)

+{

+ XenEvtchnState *s = xen_evtchn_singleton;

+ XenEvtchnPort *p;

+

+ if (!s) {

+ return -ENOTSUP;

+ }

+

+ if (status->dom != DOMID_SELF && status->dom != xen_domid) {

+ return -ESRCH;

+ }

+

+ if (!valid_port(status->port)) {

+ return -EINVAL;

+ }

+

+ qemu_mutex_lock(&s->port_lock);

+

+ p = &s->port_table[status->port];

+

+ status->status = p->type;

+ status->vcpu = p->vcpu;

+

+ switch (p->type) {

+ case EVTCHNSTAT_unbound:

+ if (p->type_val & PORT_INFO_TYPEVAL_REMOTE_QEMU) {

+ status->u.unbound.dom = DOMID_QEMU;

+ } else {

+ status->u.unbound.dom = xen_domid;

+ }

+ break;

+

+ case EVTCHNSTAT_interdomain:

+ if (p->type_val & PORT_INFO_TYPEVAL_REMOTE_QEMU) {

+ status->u.interdomain.dom = DOMID_QEMU;

+ } else {

+ status->u.interdomain.dom = xen_domid;

+ }

+

+ status->u.interdomain.port = p->type_val &

+ PORT_INFO_TYPEVAL_REMOTE_PORT_MASK;

+ break;

+

+ case EVTCHNSTAT_pirq:

+ status->u.pirq = p->type_val;

+ break;

+

+ case EVTCHNSTAT_virq:

+ status->u.virq = p->type_val;

+ break;

+ }

+

+ qemu_mutex_unlock(&s->port_lock);

+ return 0;

+}

+

+/*

+ * Never thought I'd hear myself say this, but C++ templates would be

+ * kind of nice here.

+ *

+ * template<class T> static int do_unmask_port(T *shinfo, ...);

+ */

+static int do_unmask_port_lm(XenEvtchnState *s, evtchn_port_t port,

+ bool do_unmask, struct shared_info *shinfo,

+ struct vcpu_info *vcpu_info)

+{

+ const int bits_per_word = BITS_PER_BYTE * sizeof(shinfo->evtchn_pending[0]);

+ typeof(shinfo->evtchn_pending[0]) mask;

+ int idx = port / bits_per_word;

+ int offset = port % bits_per_word;

+

+ mask = 1UL << offset;

+

+ if (idx >= bits_per_word) {

+ return -EINVAL;

+ }

+

+ if (do_unmask) {

+ /*

+ * If this is a true unmask operation, clear the mask bit. If

+ * it was already unmasked, we have nothing further to do.

+ */

+ if (!((qatomic_fetch_and(&shinfo->evtchn_mask[idx], ~mask) & mask))) {

+ return 0;

+ }

+ } else {

+ /*

+ * This is a pseudo-unmask for affinity changes. We don't

+ * change the mask bit, and if it's *masked* we have nothing

+ * else to do.

+ */

+ if (qatomic_fetch_or(&shinfo->evtchn_mask[idx], 0) & mask) {

+ return 0;

+ }

+ }

+

+ /* If the event was not pending, we're done. */

+ if (!(qatomic_fetch_or(&shinfo->evtchn_pending[idx], 0) & mask)) {

+ return 0;

+ }

+

+ /* Now on to the vcpu_info evtchn_pending_sel index... */

+ mask = 1UL << idx;

+

+ /* If a port in this word was already pending for this vCPU, all done. */

+ if (qatomic_fetch_or(&vcpu_info->evtchn_pending_sel, mask) & mask) {

+ return 0;

+ }

+

+ /* Set evtchn_upcall_pending for this vCPU */

+ if (qatomic_fetch_or(&vcpu_info->evtchn_upcall_pending, 1)) {

+ return 0;

+ }

+

+ inject_callback(s, s->port_table[port].vcpu);

+

+ return 0;

+}

+

+static int do_unmask_port_compat(XenEvtchnState *s, evtchn_port_t port,

+ bool do_unmask,

+ struct compat_shared_info *shinfo,

+ struct compat_vcpu_info *vcpu_info)

+{

+ const int bits_per_word = BITS_PER_BYTE * sizeof(shinfo->evtchn_pending[0]);

+ typeof(shinfo->evtchn_pending[0]) mask;

+ int idx = port / bits_per_word;

+ int offset = port % bits_per_word;

+

+ mask = 1UL << offset;

+

+ if (idx >= bits_per_word) {

+ return -EINVAL;

+ }

+

+ if (do_unmask) {

+ /*

+ * If this is a true unmask operation, clear the mask bit. If

+ * it was already unmasked, we have nothing further to do.

+ */

+ if (!((qatomic_fetch_and(&shinfo->evtchn_mask[idx], ~mask) & mask))) {

+ return 0;

+ }

+ } else {

+ /*

+ * This is a pseudo-unmask for affinity changes. We don't

+ * change the mask bit, and if it's *masked* we have nothing

+ * else to do.

+ */

+ if (qatomic_fetch_or(&shinfo->evtchn_mask[idx], 0) & mask) {

+ return 0;

+ }

+ }

+

+ /* If the event was not pending, we're done. */

+ if (!(qatomic_fetch_or(&shinfo->evtchn_pending[idx], 0) & mask)) {

+ return 0;

+ }

+

+ /* Now on to the vcpu_info evtchn_pending_sel index... */

+ mask = 1UL << idx;

+

+ /* If a port in this word was already pending for this vCPU, all done. */

+ if (qatomic_fetch_or(&vcpu_info->evtchn_pending_sel, mask) & mask) {

+ return 0;

+ }

+

+ /* Set evtchn_upcall_pending for this vCPU */

+ if (qatomic_fetch_or(&vcpu_info->evtchn_upcall_pending, 1)) {

+ return 0;

+ }

+

+ inject_callback(s, s->port_table[port].vcpu);

+

+ return 0;

+}

+

+static int unmask_port(XenEvtchnState *s, evtchn_port_t port, bool do_unmask)

+{

+ void *vcpu_info, *shinfo;

+

+ if (s->port_table[port].type == EVTCHNSTAT_closed) {

+ return -EINVAL;

+ }

+

+ shinfo = xen_overlay_get_shinfo_ptr();

+ if (!shinfo) {

+ return -ENOTSUP;

+ }

+

+ vcpu_info = kvm_xen_get_vcpu_info_hva(s->port_table[port].vcpu);

+ if (!vcpu_info) {

+ return -EINVAL;

+ }

+

+ if (xen_is_long_mode()) {

+ return do_unmask_port_lm(s, port, do_unmask, shinfo, vcpu_info);

+ } else {

+ return do_unmask_port_compat(s, port, do_unmask, shinfo, vcpu_info);

+ }

+}

+

+static int do_set_port_lm(XenEvtchnState *s, evtchn_port_t port,

+ struct shared_info *shinfo,

+ struct vcpu_info *vcpu_info)

+{

+ const int bits_per_word = BITS_PER_BYTE * sizeof(shinfo->evtchn_pending[0]);

+ typeof(shinfo->evtchn_pending[0]) mask;

+ int idx = port / bits_per_word;

+ int offset = port % bits_per_word;

+

+ mask = 1UL << offset;

+

+ if (idx >= bits_per_word) {

+ return -EINVAL;

+ }

+

+ /* Update the pending bit itself. If it was already set, we're done. */

+ if (qatomic_fetch_or(&shinfo->evtchn_pending[idx], mask) & mask) {

+ return 0;

+ }

+

+ /* Check if it's masked. */

+ if (qatomic_fetch_or(&shinfo->evtchn_mask[idx], 0) & mask) {

+ return 0;

+ }

+

+ /* Now on to the vcpu_info evtchn_pending_sel index... */

+ mask = 1UL << idx;

+

+ /* If a port in this word was already pending for this vCPU, all done. */

+ if (qatomic_fetch_or(&vcpu_info->evtchn_pending_sel, mask) & mask) {

+ return 0;

+ }

+

+ /* Set evtchn_upcall_pending for this vCPU */

+ if (qatomic_fetch_or(&vcpu_info->evtchn_upcall_pending, 1)) {

+ return 0;

+ }

+

+ inject_callback(s, s->port_table[port].vcpu);

+

+ return 0;

+}

+

+static int do_set_port_compat(XenEvtchnState *s, evtchn_port_t port,

+ struct compat_shared_info *shinfo,

+ struct compat_vcpu_info *vcpu_info)

+{

+ const int bits_per_word = BITS_PER_BYTE * sizeof(shinfo->evtchn_pending[0]);

+ typeof(shinfo->evtchn_pending[0]) mask;

+ int idx = port / bits_per_word;

+ int offset = port % bits_per_word;

+

+ mask = 1UL << offset;

+

+ if (idx >= bits_per_word) {

+ return -EINVAL;

+ }

+

+ /* Update the pending bit itself. If it was already set, we're done. */

+ if (qatomic_fetch_or(&shinfo->evtchn_pending[idx], mask) & mask) {

+ return 0;

+ }

+

+ /* Check if it's masked. */

+ if (qatomic_fetch_or(&shinfo->evtchn_mask[idx], 0) & mask) {

+ return 0;

+ }

+

+ /* Now on to the vcpu_info evtchn_pending_sel index... */

+ mask = 1UL << idx;

+

+ /* If a port in this word was already pending for this vCPU, all done. */

+ if (qatomic_fetch_or(&vcpu_info->evtchn_pending_sel, mask) & mask) {

+ return 0;

+ }

+

+ /* Set evtchn_upcall_pending for this vCPU */

+ if (qatomic_fetch_or(&vcpu_info->evtchn_upcall_pending, 1)) {

+ return 0;

+ }

+

+ inject_callback(s, s->port_table[port].vcpu);

+

+ return 0;

+}

+

+static int set_port_pending(XenEvtchnState *s, evtchn_port_t port)

+{

+ void *vcpu_info, *shinfo;

+

+ if (s->port_table[port].type == EVTCHNSTAT_closed) {

+ return -EINVAL;

+ }

+

+ if (s->evtchn_in_kernel) {

+ XenEvtchnPort *p = &s->port_table[port];

+ CPUState *cpu = qemu_get_cpu(p->vcpu);

+ struct kvm_irq_routing_xen_evtchn evt;

+

+ if (!cpu) {

+ return 0;

+ }

+

+ evt.port = port;

+ evt.vcpu = kvm_arch_vcpu_id(cpu);

+ evt.priority = KVM_IRQ_ROUTING_XEN_EVTCHN_PRIO_2LEVEL;

+

+ return kvm_vm_ioctl(kvm_state, KVM_XEN_HVM_EVTCHN_SEND, &evt);

+ }

+

+ shinfo = xen_overlay_get_shinfo_ptr();

+ if (!shinfo) {

+ return -ENOTSUP;

+ }

+

+ vcpu_info = kvm_xen_get_vcpu_info_hva(s->port_table[port].vcpu);

+ if (!vcpu_info) {

+ return -EINVAL;

+ }

+

+ if (xen_is_long_mode()) {

+ return do_set_port_lm(s, port, shinfo, vcpu_info);

+ } else {

+ return do_set_port_compat(s, port, shinfo, vcpu_info);

+ }

+}

+

+static int clear_port_pending(XenEvtchnState *s, evtchn_port_t port)

+{

+ void *p = xen_overlay_get_shinfo_ptr();

+

+ if (!p) {

+ return -ENOTSUP;

+ }

+

+ if (xen_is_long_mode()) {

+ struct shared_info *shinfo = p;

+ const int bits_per_word = BITS_PER_BYTE * sizeof(shinfo->evtchn_pending[0]);

+ typeof(shinfo->evtchn_pending[0]) mask;

+ int idx = port / bits_per_word;

+ int offset = port % bits_per_word;

+

+ mask = 1UL << offset;

+

+ qatomic_fetch_and(&shinfo->evtchn_pending[idx], ~mask);

+ } else {

+ struct compat_shared_info *shinfo = p;

+ const int bits_per_word = BITS_PER_BYTE * sizeof(shinfo->evtchn_pending[0]);

+ typeof(shinfo->evtchn_pending[0]) mask;

+ int idx = port / bits_per_word;

+ int offset = port % bits_per_word;

+

+ mask = 1UL << offset;

+

+ qatomic_fetch_and(&shinfo->evtchn_pending[idx], ~mask);

+ }

+ return 0;

+}

+

+static void free_port(XenEvtchnState *s, evtchn_port_t port)

+{

+ s->port_table[port].type = EVTCHNSTAT_closed;

+ s->port_table[port].type_val = 0;

+ s->port_table[port].vcpu = 0;

+

+ if (s->nr_ports == port + 1) {

+ do {

+ s->nr_ports--;

+ } while (s->nr_ports &&

+ s->port_table[s->nr_ports - 1].type == EVTCHNSTAT_closed);

+ }

+

+ /* Clear pending event to avoid unexpected behavior on re-bind. */

+ clear_port_pending(s, port);

+}

+

+static int allocate_port(XenEvtchnState *s, uint32_t vcpu, uint16_t type,

+ uint16_t val, evtchn_port_t *port)

+{

+ evtchn_port_t p = 1;

+

+ for (p = 1; valid_port(p); p++) {

+ if (s->port_table[p].type == EVTCHNSTAT_closed) {

+ s->port_table[p].vcpu = vcpu;

+ s->port_table[p].type = type;

+ s->port_table[p].type_val = val;

+

+ *port = p;

+

+ if (s->nr_ports < p + 1) {

+ s->nr_ports = p + 1;

+ }

+

+ return 0;

+ }

+ }

+ return -ENOSPC;

+}

+

+static bool virq_is_global(uint32_t virq)

+{

+ switch (virq) {

+ case VIRQ_TIMER:

+ case VIRQ_DEBUG:

+ case VIRQ_XENOPROF:

+ case VIRQ_XENPMU:

+ return false;

+

+ default:

+ return true;

+ }

+}

+

+static int close_port(XenEvtchnState *s, evtchn_port_t port,

+ bool *flush_kvm_routes)

+{

+ XenEvtchnPort *p = &s->port_table[port];

+

+ /* Because it *might* be a PIRQ port */

+ assert(qemu_mutex_iothread_locked());

+

+ switch (p->type) {

+ case EVTCHNSTAT_closed:

+ return -ENOENT;

+

+ case EVTCHNSTAT_pirq:

+ s->pirq[p->type_val].port = 0;

+ if (s->pirq[p->type_val].is_translated) {

+ *flush_kvm_routes = true;

+ }

+ break;

+

+ case EVTCHNSTAT_virq:

+ kvm_xen_set_vcpu_virq(virq_is_global(p->type_val) ? 0 : p->vcpu,

+ p->type_val, 0);

+ break;

+

+ case EVTCHNSTAT_ipi:

+ if (s->evtchn_in_kernel) {

+ deassign_kernel_port(port);

+ }

+ break;

+

+ case EVTCHNSTAT_interdomain:

+ if (p->type_val & PORT_INFO_TYPEVAL_REMOTE_QEMU) {

+ uint16_t be_port = p->type_val & ~PORT_INFO_TYPEVAL_REMOTE_QEMU;

+ struct xenevtchn_handle *xc = s->be_handles[be_port];

+ if (xc) {

+ if (kvm_xen_has_cap(EVTCHN_SEND)) {

+ deassign_kernel_port(port);

+ }

+ xc->guest_port = 0;

+ }

+ } else {

+ /* Loopback interdomain */

+ XenEvtchnPort *rp = &s->port_table[p->type_val];

+ if (!valid_port(p->type_val) || rp->type_val != port ||

+ rp->type != EVTCHNSTAT_interdomain) {

+ error_report("Inconsistent state for interdomain unbind");

+ } else {

+ /* Set the other end back to unbound */

+ rp->type = EVTCHNSTAT_unbound;

+ rp->type_val = 0;

+ }

+ }

+ break;

+

+ default:

+ break;

+ }

+

+ free_port(s, port);

+ return 0;

+}

+

+int xen_evtchn_soft_reset(void)

+{

+ XenEvtchnState *s = xen_evtchn_singleton;

+ bool flush_kvm_routes;

+ int i;

+

+ if (!s) {

+ return -ENOTSUP;

+ }

+

+ assert(qemu_mutex_iothread_locked());

+

+ qemu_mutex_lock(&s->port_lock);

+

+ for (i = 0; i < s->nr_ports; i++) {

+ close_port(s, i, &flush_kvm_routes);

+ }

+

+ qemu_mutex_unlock(&s->port_lock);

+

+ if (flush_kvm_routes) {

+ kvm_update_msi_routes_all(NULL, true, 0, 0);

+ }

+

+ return 0;

+}

+

+int xen_evtchn_reset_op(struct evtchn_reset *reset)

+{

+ if (reset->dom != DOMID_SELF && reset->dom != xen_domid) {

+ return -ESRCH;

+ }

+

+ return xen_evtchn_soft_reset();

+}

+

+int xen_evtchn_close_op(struct evtchn_close *close)

+{

+ XenEvtchnState *s = xen_evtchn_singleton;

+ bool flush_kvm_routes = false;

+ int ret;

+

+ if (!s) {

+ return -ENOTSUP;

+ }

+

+ if (!valid_port(close->port)) {

+ return -EINVAL;

+ }

+

+ QEMU_IOTHREAD_LOCK_GUARD();

+ qemu_mutex_lock(&s->port_lock);

+

+ ret = close_port(s, close->port, &flush_kvm_routes);

+

+ qemu_mutex_unlock(&s->port_lock);

+

+ if (flush_kvm_routes) {

+ kvm_update_msi_routes_all(NULL, true, 0, 0);

+ }

+

+ return ret;

+}

+

+int xen_evtchn_unmask_op(struct evtchn_unmask *unmask)

+{

+ XenEvtchnState *s = xen_evtchn_singleton;

+ int ret;

+

+ if (!s) {

+ return -ENOTSUP;

+ }

+

+ if (!valid_port(unmask->port)) {

+ return -EINVAL;

+ }

+

+ qemu_mutex_lock(&s->port_lock);

+

+ ret = unmask_port(s, unmask->port, true);

+

+ qemu_mutex_unlock(&s->port_lock);

+

+ return ret;

+}

+

+int xen_evtchn_bind_vcpu_op(struct evtchn_bind_vcpu *vcpu)

+{

+ XenEvtchnState *s = xen_evtchn_singleton;

+ XenEvtchnPort *p;

+ int ret = -EINVAL;

+

+ if (!s) {

+ return -ENOTSUP;

+ }

+

+ if (!valid_port(vcpu->port)) {

+ return -EINVAL;

+ }

+

+ if (!valid_vcpu(vcpu->vcpu)) {

+ return -ENOENT;

+ }

+

+ qemu_mutex_lock(&s->port_lock);

+

+ p = &s->port_table[vcpu->port];

+

+ if (p->type == EVTCHNSTAT_interdomain ||

+ p->type == EVTCHNSTAT_unbound ||

+ p->type == EVTCHNSTAT_pirq ||

+ (p->type == EVTCHNSTAT_virq && virq_is_global(p->type_val))) {

+ /*

+ * unmask_port() with do_unmask==false will just raise the event

+ * on the new vCPU if the port was already pending.

+ */

+ p->vcpu = vcpu->vcpu;

+ unmask_port(s, vcpu->port, false);

+ ret = 0;

+ }

+

+ qemu_mutex_unlock(&s->port_lock);

+

+ return ret;

+}

+

+int xen_evtchn_bind_virq_op(struct evtchn_bind_virq *virq)

+{

+ XenEvtchnState *s = xen_evtchn_singleton;

+ int ret;

+

+ if (!s) {

+ return -ENOTSUP;

+ }

+

+ if (virq->virq >= NR_VIRQS) {

+ return -EINVAL;

+ }

+

+ /* Global VIRQ must be allocated on vCPU0 first */

+ if (virq_is_global(virq->virq) && virq->vcpu != 0) {

+ return -EINVAL;

+ }

+

+ if (!valid_vcpu(virq->vcpu)) {

+ return -ENOENT;

+ }

+

+ qemu_mutex_lock(&s->port_lock);

+

+ ret = allocate_port(s, virq->vcpu, EVTCHNSTAT_virq, virq->virq,

+ &virq->port);

+ if (!ret) {

+ ret = kvm_xen_set_vcpu_virq(virq->vcpu, virq->virq, virq->port);

+ if (ret) {

+ free_port(s, virq->port);

+ }

+ }

+

+ qemu_mutex_unlock(&s->port_lock);

+

+ return ret;

+}

+

+int xen_evtchn_bind_pirq_op(struct evtchn_bind_pirq *pirq)

+{

+ XenEvtchnState *s = xen_evtchn_singleton;

+ int ret;

+

+ if (!s) {

+ return -ENOTSUP;

+ }

+

+ if (pirq->pirq >= s->nr_pirqs) {

+ return -EINVAL;

+ }

+

+ QEMU_IOTHREAD_LOCK_GUARD();

+

+ if (s->pirq[pirq->pirq].port) {

+ return -EBUSY;

+ }

+

+ qemu_mutex_lock(&s->port_lock);

+

+ ret = allocate_port(s, 0, EVTCHNSTAT_pirq, pirq->pirq,

+ &pirq->port);

+ if (ret) {

+ qemu_mutex_unlock(&s->port_lock);

+ return ret;

+ }

+

+ s->pirq[pirq->pirq].port = pirq->port;

+ trace_kvm_xen_bind_pirq(pirq->pirq, pirq->port);

+

+ qemu_mutex_unlock(&s->port_lock);

+

+ /*

+ * Need to do the unmask outside port_lock because it may call

+ * back into the MSI translate function.

+ */

+ if (s->pirq[pirq->pirq].gsi == IRQ_MSI_EMU) {

+ if (s->pirq[pirq->pirq].is_masked) {

+ PCIDevice *dev = s->pirq[pirq->pirq].dev;

+ int vector = s->pirq[pirq->pirq].vector;

+ char *dev_path = qdev_get_dev_path(DEVICE(dev));

+

+ trace_kvm_xen_unmask_pirq(pirq->pirq, dev_path, vector);

+ g_free(dev_path);

+

+ if (s->pirq[pirq->pirq].is_msix) {

+ msix_set_mask(dev, vector, false);

+ } else {

+ msi_set_mask(dev, vector, false, NULL);

+ }

+ } else if (s->pirq[pirq->pirq].is_translated) {

+ /*

+ * If KVM had attempted to translate this one before, make it try

+ * again. If we unmasked, then the notifier on the MSI(-X) vector

+ * will already have had the same effect.

+ */

+ kvm_update_msi_routes_all(NULL, true, 0, 0);

+ }

+ }

+

+ return ret;

+}

+

+int xen_evtchn_bind_ipi_op(struct evtchn_bind_ipi *ipi)

+{

+ XenEvtchnState *s = xen_evtchn_singleton;

+ int ret;

+

+ if (!s) {

+ return -ENOTSUP;

+ }

+

+ if (!valid_vcpu(ipi->vcpu)) {

+ return -ENOENT;

+ }

+

+ qemu_mutex_lock(&s->port_lock);

+

+ ret = allocate_port(s, ipi->vcpu, EVTCHNSTAT_ipi, 0, &ipi->port);

+ if (!ret && s->evtchn_in_kernel) {

+ assign_kernel_port(EVTCHNSTAT_ipi, ipi->port, ipi->vcpu);

+ }

+

+ qemu_mutex_unlock(&s->port_lock);

+

+ return ret;

+}

+

+int xen_evtchn_bind_interdomain_op(struct evtchn_bind_interdomain *interdomain)

+{

+ XenEvtchnState *s = xen_evtchn_singleton;

+ uint16_t type_val;

+ int ret;

+

+ if (!s) {

+ return -ENOTSUP;

+ }

+

+ if (interdomain->remote_dom == DOMID_QEMU) {

+ type_val = PORT_INFO_TYPEVAL_REMOTE_QEMU;

+ } else if (interdomain->remote_dom == DOMID_SELF ||

+ interdomain->remote_dom == xen_domid) {

+ type_val = 0;

+ } else {

+ return -ESRCH;

+ }

+

+ if (!valid_port(interdomain->remote_port)) {

+ return -EINVAL;

+ }

+

+ qemu_mutex_lock(&s->port_lock);

+

+ /* The newly allocated port starts out as unbound */

+ ret = allocate_port(s, 0, EVTCHNSTAT_unbound, type_val,

+ &interdomain->local_port);

+ if (ret) {

+ goto out;

+ }

+

+ if (interdomain->remote_dom == DOMID_QEMU) {

+ struct xenevtchn_handle *xc = s->be_handles[interdomain->remote_port];

+ XenEvtchnPort *lp = &s->port_table[interdomain->local_port];

+

+ if (!xc) {

+ ret = -ENOENT;

+ goto out_free_port;

+ }

+

+ if (xc->guest_port) {

+ ret = -EBUSY;

+ goto out_free_port;

+ }

+

+ assert(xc->be_port == interdomain->remote_port);

+ xc->guest_port = interdomain->local_port;

+ if (kvm_xen_has_cap(EVTCHN_SEND)) {

+ assign_kernel_eventfd(lp->type, xc->guest_port, xc->fd);

+ }

+ lp->type = EVTCHNSTAT_interdomain;

+ lp->type_val = PORT_INFO_TYPEVAL_REMOTE_QEMU | interdomain->remote_port;

+ ret = 0;

+ } else {

+ /* Loopback */

+ XenEvtchnPort *rp = &s->port_table[interdomain->remote_port];

+ XenEvtchnPort *lp = &s->port_table[interdomain->local_port];

+

+ if (rp->type == EVTCHNSTAT_unbound && rp->type_val == 0) {

+ /* It's a match! */

+ rp->type = EVTCHNSTAT_interdomain;

+ rp->type_val = interdomain->local_port;

+

+ lp->type = EVTCHNSTAT_interdomain;

+ lp->type_val = interdomain->remote_port;

+ } else {

+ ret = -EINVAL;

+ }

+ }

+

+ out_free_port:

+ if (ret) {

+ free_port(s, interdomain->local_port);

+ }

+ out:

+ qemu_mutex_unlock(&s->port_lock);

+

+ return ret;

+

+}

+int xen_evtchn_alloc_unbound_op(struct evtchn_alloc_unbound *alloc)

+{

+ XenEvtchnState *s = xen_evtchn_singleton;

+ uint16_t type_val;

+ int ret;

+

+ if (!s) {

+ return -ENOTSUP;

+ }

+

+ if (alloc->dom != DOMID_SELF && alloc->dom != xen_domid) {

+ return -ESRCH;

+ }

+

+ if (alloc->remote_dom == DOMID_QEMU) {

+ type_val = PORT_INFO_TYPEVAL_REMOTE_QEMU;

+ } else if (alloc->remote_dom == DOMID_SELF ||

+ alloc->remote_dom == xen_domid) {

+ type_val = 0;

+ } else {

+ return -EPERM;

+ }

+

+ qemu_mutex_lock(&s->port_lock);

+

+ ret = allocate_port(s, 0, EVTCHNSTAT_unbound, type_val, &alloc->port);

+

+ qemu_mutex_unlock(&s->port_lock);

+

+ return ret;

+}

+

+int xen_evtchn_send_op(struct evtchn_send *send)

+{

+ XenEvtchnState *s = xen_evtchn_singleton;

+ XenEvtchnPort *p;

+ int ret = 0;

+

+ if (!s) {

+ return -ENOTSUP;

+ }

+

+ if (!valid_port(send->port)) {

+ return -EINVAL;

+ }

+

+ qemu_mutex_lock(&s->port_lock);

+

+ p = &s->port_table[send->port];

+

+ switch (p->type) {

+ case EVTCHNSTAT_interdomain:

+ if (p->type_val & PORT_INFO_TYPEVAL_REMOTE_QEMU) {

+ /*

+ * This is an event from the guest to qemu itself, which is

+ * serving as the driver domain.

+ */

+ uint16_t be_port = p->type_val & ~PORT_INFO_TYPEVAL_REMOTE_QEMU;

+ struct xenevtchn_handle *xc = s->be_handles[be_port];

+ if (xc) {

+ eventfd_write(xc->fd, 1);

+ ret = 0;

+ } else {

+ ret = -ENOENT;

+ }

+ } else {

+ /* Loopback interdomain ports; just a complex IPI */

+ set_port_pending(s, p->type_val);

+ }

+ break;

+

+ case EVTCHNSTAT_ipi:

+ set_port_pending(s, send->port);

+ break;

+

+ case EVTCHNSTAT_unbound:

+ /* Xen will silently drop these */

+ break;

+

+ default:

+ ret = -EINVAL;

+ break;

+ }

+

+ qemu_mutex_unlock(&s->port_lock);

+

+ return ret;

+}

+

+int xen_evtchn_set_port(uint16_t port)

+{

+ XenEvtchnState *s = xen_evtchn_singleton;

+ XenEvtchnPort *p;

+ int ret = -EINVAL;

+

+ if (!s) {

+ return -ENOTSUP;

+ }

+

+ if (!valid_port(port)) {

+ return -EINVAL;

+ }

+

+ qemu_mutex_lock(&s->port_lock);

+

+ p = &s->port_table[port];

+

+ /* QEMU has no business sending to anything but these */

+ if (p->type == EVTCHNSTAT_virq ||

+ (p->type == EVTCHNSTAT_interdomain &&

+ (p->type_val & PORT_INFO_TYPEVAL_REMOTE_QEMU))) {

+ set_port_pending(s, port);

+ ret = 0;

+ }

+

+ qemu_mutex_unlock(&s->port_lock);

+

+ return ret;

+}

+

+static int allocate_pirq(XenEvtchnState *s, int type, int gsi)

+{

+ uint16_t pirq;

+

+ /*

+ * Preserve the allocation strategy that Xen has. It looks like

+ * we *never* give out PIRQ 0-15, we give out 16-nr_irqs_gsi only

+ * to GSIs (counting up from 16), and then we count backwards from

+ * the top for MSIs or when the GSI space is exhausted.

+ */

+ if (type == MAP_PIRQ_TYPE_GSI) {

+ for (pirq = 16 ; pirq < IOAPIC_NUM_PINS; pirq++) {

+ if (pirq_inuse(s, pirq)) {

+ continue;

+ }

+

+ /* Found it */

+ goto found;

+ }

+ }

+ for (pirq = s->nr_pirqs - 1; pirq >= IOAPIC_NUM_PINS; pirq--) {

+ /* Skip whole words at a time when they're full */

+ if (pirq_inuse_word(s, pirq) == UINT64_MAX) {

+ pirq &= ~63ULL;

+ continue;

+ }

+ if (pirq_inuse(s, pirq)) {

+ continue;

+ }

+

+ goto found;

+ }

+ return -ENOSPC;

+

+ found:

+ pirq_inuse_word(s, pirq) |= pirq_inuse_bit(pirq);

+ if (gsi >= 0) {

+ assert(gsi <= IOAPIC_NUM_PINS);

+ s->gsi_pirq[gsi] = pirq;

+ }

+ s->pirq[pirq].gsi = gsi;

+ return pirq;

+}

+

+bool xen_evtchn_set_gsi(int gsi, int level)

+{

+ XenEvtchnState *s = xen_evtchn_singleton;

+ int pirq;

+

+ assert(qemu_mutex_iothread_locked());

+

+ if (!s || gsi < 0 || gsi > IOAPIC_NUM_PINS) {

+ return false;

+ }

+

+ /*

+ * Check that that it *isn't* the event channel GSI, and thus

+ * that we are not recursing and it's safe to take s->port_lock.

+ *

+ * Locking aside, it's perfectly sane to bail out early for that

+ * special case, as it would make no sense for the event channel

+ * GSI to be routed back to event channels, when the delivery

+ * method is to raise the GSI... that recursion wouldn't *just*

+ * be a locking issue.

+ */

+ if (gsi && gsi == s->callback_gsi) {

+ return false;

+ }

+

+ QEMU_LOCK_GUARD(&s->port_lock);

+

+ pirq = s->gsi_pirq[gsi];

+ if (!pirq) {

+ return false;

+ }

+

+ if (level) {

+ int port = s->pirq[pirq].port;

+

+ s->pirq_gsi_set |= (1U << gsi);

+ if (port) {

+ set_port_pending(s, port);

+ }

+ } else {

+ s->pirq_gsi_set &= ~(1U << gsi);

+ }

+ return true;

+}

+

+static uint32_t msi_pirq_target(uint64_t addr, uint32_t data)

+{

+ /* The vector (in low 8 bits of data) must be zero */

+ if (data & 0xff) {

+ return 0;

+ }

+

+ uint32_t pirq = (addr & 0xff000) >> 12;

+ pirq |= (addr >> 32) & 0xffffff00;

+

+ return pirq;

+}

+

+static void do_remove_pci_vector(XenEvtchnState *s, PCIDevice *dev, int vector,

+ int except_pirq)

+{

+ uint32_t pirq;

+

+ for (pirq = 0; pirq < s->nr_pirqs; pirq++) {

+ /*

+ * We could be cleverer here, but it isn't really a fast path, and

+ * this trivial optimisation is enough to let us skip the big gap

+ * in the middle a bit quicker (in terms of both loop iterations,

+ * and cache lines).

+ */

+ if (!(pirq & 63) && !(pirq_inuse_word(s, pirq))) {

+ pirq += 64;

+ continue;

+ }

+ if (except_pirq && pirq == except_pirq) {

+ continue;

+ }

+ if (s->pirq[pirq].dev != dev) {

+ continue;

+ }

+ if (vector != -1 && s->pirq[pirq].vector != vector) {

+ continue;

+ }

+

+ /* It could theoretically be bound to a port already, but that is OK. */

+ s->pirq[pirq].dev = dev;

+ s->pirq[pirq].gsi = IRQ_UNBOUND;

+ s->pirq[pirq].is_msix = false;

+ s->pirq[pirq].vector = 0;

+ s->pirq[pirq].is_masked = false;

+ s->pirq[pirq].is_translated = false;

+ }

+}

+

+void xen_evtchn_remove_pci_device(PCIDevice *dev)

+{

+ XenEvtchnState *s = xen_evtchn_singleton;

+

+ if (!s) {

+ return;

+ }

+

+ QEMU_LOCK_GUARD(&s->port_lock);

+ do_remove_pci_vector(s, dev, -1, 0);

+}

+

+void xen_evtchn_snoop_msi(PCIDevice *dev, bool is_msix, unsigned int vector,

+ uint64_t addr, uint32_t data, bool is_masked)

+{

+ XenEvtchnState *s = xen_evtchn_singleton;

+ uint32_t pirq;

+

+ if (!s) {

+ return;

+ }

+

+ assert(qemu_mutex_iothread_locked());

+

+ pirq = msi_pirq_target(addr, data);

+

+ /*

+ * The PIRQ# must be sane, and there must be an allocated PIRQ in

+ * IRQ_UNBOUND or IRQ_MSI_EMU state to match it.

+ */

+ if (!pirq || pirq >= s->nr_pirqs || !pirq_inuse(s, pirq) ||

+ (s->pirq[pirq].gsi != IRQ_UNBOUND &&

+ s->pirq[pirq].gsi != IRQ_MSI_EMU)) {

+ pirq = 0;

+ }

+

+ if (pirq) {

+ s->pirq[pirq].dev = dev;

+ s->pirq[pirq].gsi = IRQ_MSI_EMU;

+ s->pirq[pirq].is_msix = is_msix;

+ s->pirq[pirq].vector = vector;

+ s->pirq[pirq].is_masked = is_masked;

+ }

+

+ /* Remove any (other) entries for this {device, vector} */

+ do_remove_pci_vector(s, dev, vector, pirq);

+}

+

+int xen_evtchn_translate_pirq_msi(struct kvm_irq_routing_entry *route,

+ uint64_t address, uint32_t data)

+{

+ XenEvtchnState *s = xen_evtchn_singleton;

+ uint32_t pirq, port;

+ CPUState *cpu;

+

+ if (!s) {

+ return 1; /* Not a PIRQ */

+ }

+

+ assert(qemu_mutex_iothread_locked());

+

+ pirq = msi_pirq_target(address, data);

+ if (!pirq || pirq >= s->nr_pirqs) {

+ return 1; /* Not a PIRQ */

+ }

+

+ if (!kvm_xen_has_cap(EVTCHN_2LEVEL)) {

+ return -ENOTSUP;

+ }

+

+ if (s->pirq[pirq].gsi != IRQ_MSI_EMU) {

+ return -EINVAL;

+ }

+

+ /* Remember that KVM tried to translate this. It might need to try again. */

+ s->pirq[pirq].is_translated = true;

+

+ QEMU_LOCK_GUARD(&s->port_lock);

+

+ port = s->pirq[pirq].port;

+ if (!valid_port(port)) {

+ return -EINVAL;

+ }

+

+ cpu = qemu_get_cpu(s->port_table[port].vcpu);

+ if (!cpu) {

+ return -EINVAL;

+ }

+

+ route->type = KVM_IRQ_ROUTING_XEN_EVTCHN;

+ route->u.xen_evtchn.port = port;

+ route->u.xen_evtchn.vcpu = kvm_arch_vcpu_id(cpu);

+ route->u.xen_evtchn.priority = KVM_IRQ_ROUTING_XEN_EVTCHN_PRIO_2LEVEL;

+

+ return 0; /* Handled */

+}

+

+bool xen_evtchn_deliver_pirq_msi(uint64_t address, uint32_t data)

+{

+ XenEvtchnState *s = xen_evtchn_singleton;

+ uint32_t pirq, port;

+

+ if (!s) {

+ return false;

+ }

+

+ assert(qemu_mutex_iothread_locked());

+

+ pirq = msi_pirq_target(address, data);

+ if (!pirq || pirq >= s->nr_pirqs) {

+ return false;

+ }

+

+ QEMU_LOCK_GUARD(&s->port_lock);

+

+ port = s->pirq[pirq].port;

+ if (!valid_port(port)) {

+ return false;

+ }

+

+ set_port_pending(s, port);

+ return true;

+}

+

+int xen_physdev_map_pirq(struct physdev_map_pirq *map)

+{

+ XenEvtchnState *s = xen_evtchn_singleton;

+ int pirq = map->pirq;

+ int gsi = map->index;

+

+ if (!s) {

+ return -ENOTSUP;

+ }

+

+ QEMU_IOTHREAD_LOCK_GUARD();

+ QEMU_LOCK_GUARD(&s->port_lock);

+

+ if (map->domid != DOMID_SELF && map->domid != xen_domid) {

+ return -EPERM;

+ }

+ if (map->type != MAP_PIRQ_TYPE_GSI) {

+ return -EINVAL;

+ }

+ if (gsi < 0 || gsi >= IOAPIC_NUM_PINS) {

+ return -EINVAL;

+ }

+

+ if (pirq < 0) {

+ pirq = allocate_pirq(s, map->type, gsi);

+ if (pirq < 0) {

+ return pirq;

+ }

+ map->pirq = pirq;

+ } else if (pirq > s->nr_pirqs) {

+ return -EINVAL;

+ } else {

+ /*

+ * User specified a valid-looking PIRQ#. Allow it if it is

+ * allocated and not yet bound, or if it is unallocated

+ */

+ if (pirq_inuse(s, pirq)) {

+ if (s->pirq[pirq].gsi != IRQ_UNBOUND) {

+ return -EBUSY;

+ }

+ } else {

+ /* If it was unused, mark it used now. */

+ pirq_inuse_word(s, pirq) |= pirq_inuse_bit(pirq);

+ }

+ /* Set the mapping in both directions. */

+ s->pirq[pirq].gsi = gsi;

+ s->gsi_pirq[gsi] = pirq;

+ }

+

+ trace_kvm_xen_map_pirq(pirq, gsi);

+ return 0;

+}

+

+int xen_physdev_unmap_pirq(struct physdev_unmap_pirq *unmap)

+{

+ XenEvtchnState *s = xen_evtchn_singleton;

+ int pirq = unmap->pirq;

+ int gsi;

+

+ if (!s) {

+ return -ENOTSUP;

+ }

+

+ if (unmap->domid != DOMID_SELF && unmap->domid != xen_domid) {

+ return -EPERM;

+ }

+ if (pirq < 0 || pirq >= s->nr_pirqs) {

+ return -EINVAL;

+ }

+

+ QEMU_IOTHREAD_LOCK_GUARD();

+ qemu_mutex_lock(&s->port_lock);

+

+ if (!pirq_inuse(s, pirq)) {

+ qemu_mutex_unlock(&s->port_lock);

+ return -ENOENT;

+ }

+

+ gsi = s->pirq[pirq].gsi;

+

+ /* We can only unmap GSI PIRQs */

+ if (gsi < 0) {

+ qemu_mutex_unlock(&s->port_lock);

+ return -EINVAL;

+ }

+

+ s->gsi_pirq[gsi] = 0;

+ s->pirq[pirq].gsi = IRQ_UNBOUND; /* Doesn't actually matter because: */

+ pirq_inuse_word(s, pirq) &= ~pirq_inuse_bit(pirq);

+

+ trace_kvm_xen_unmap_pirq(pirq, gsi);

+ qemu_mutex_unlock(&s->port_lock);

+

+ if (gsi == IRQ_MSI_EMU) {

+ kvm_update_msi_routes_all(NULL, true, 0, 0);

+ }

+

+ return 0;

+}

+

+int xen_physdev_eoi_pirq(struct physdev_eoi *eoi)

+{

+ XenEvtchnState *s = xen_evtchn_singleton;

+ int pirq = eoi->irq;

+ int gsi;

+

+ if (!s) {

+ return -ENOTSUP;

+ }

+

+ QEMU_IOTHREAD_LOCK_GUARD();

+ QEMU_LOCK_GUARD(&s->port_lock);

+

+ if (!pirq_inuse(s, pirq)) {

+ return -ENOENT;

+ }

+

+ gsi = s->pirq[pirq].gsi;

+ if (gsi < 0) {

+ return -EINVAL;

+ }

+

+ /* Reassert a level IRQ if needed */

+ if (s->pirq_gsi_set & (1U << gsi)) {

+ int port = s->pirq[pirq].port;

+ if (port) {

+ set_port_pending(s, port);

+ }

+ }

+

+ return 0;

+}

+

+int xen_physdev_query_pirq(struct physdev_irq_status_query *query)

+{

+ XenEvtchnState *s = xen_evtchn_singleton;

+ int pirq = query->irq;

+

+ if (!s) {

+ return -ENOTSUP;

+ }

+

+ QEMU_IOTHREAD_LOCK_GUARD();

+ QEMU_LOCK_GUARD(&s->port_lock);

+

+ if (!pirq_inuse(s, pirq)) {

+ return -ENOENT;

+ }

+

+ if (s->pirq[pirq].gsi >= 0) {

+ query->flags = XENIRQSTAT_needs_eoi;

+ } else {

+ query->flags = 0;

+ }

+

+ return 0;

+}

+

+int xen_physdev_get_free_pirq(struct physdev_get_free_pirq *get)

+{

+ XenEvtchnState *s = xen_evtchn_singleton;

+ int pirq;

+

+ if (!s) {

+ return -ENOTSUP;

+ }

+

+ QEMU_LOCK_GUARD(&s->port_lock);

+

+ pirq = allocate_pirq(s, get->type, IRQ_UNBOUND);

+ if (pirq < 0) {

+ return pirq;

+ }

+

+ get->pirq = pirq;

+ trace_kvm_xen_get_free_pirq(pirq, get->type);

+ return 0;

+}

+

+struct xenevtchn_handle *xen_be_evtchn_open(void)

+{

+ struct xenevtchn_handle *xc = g_new0(struct xenevtchn_handle, 1);

+

+ xc->fd = eventfd(0, EFD_CLOEXEC);

+ if (xc->fd < 0) {

+ free(xc);

+ return NULL;

+ }

+

+ return xc;

+}

+

+static int find_be_port(XenEvtchnState *s, struct xenevtchn_handle *xc)

+{

+ int i;

+

+ for (i = 1; i < EVTCHN_2L_NR_CHANNELS; i++) {

+ if (!s->be_handles[i]) {

+ s->be_handles[i] = xc;

+ xc->be_port = i;

+ return i;

+ }

+ }

+ return 0;

+}

+

+int xen_be_evtchn_bind_interdomain(struct xenevtchn_handle *xc, uint32_t domid,

+ evtchn_port_t guest_port)

+{

+ XenEvtchnState *s = xen_evtchn_singleton;

+ XenEvtchnPort *gp;

+ uint16_t be_port = 0;

+ int ret;

+

+ if (!s) {

+ return -ENOTSUP;

+ }

+

+ if (!xc) {

+ return -EFAULT;

+ }

+

+ if (domid != xen_domid) {

+ return -ESRCH;

+ }

+

+ if (!valid_port(guest_port)) {

+ return -EINVAL;

+ }

+

+ qemu_mutex_lock(&s->port_lock);

+

+ /* The guest has to have an unbound port waiting for us to bind */

+ gp = &s->port_table[guest_port];

+

+ switch (gp->type) {

+ case EVTCHNSTAT_interdomain:

+ /* Allow rebinding after migration, preserve port # if possible */

+ be_port = gp->type_val & ~PORT_INFO_TYPEVAL_REMOTE_QEMU;

+ assert(be_port != 0);

+ if (!s->be_handles[be_port]) {

+ s->be_handles[be_port] = xc;

+ xc->guest_port = guest_port;

+ ret = xc->be_port = be_port;

+ if (kvm_xen_has_cap(EVTCHN_SEND)) {

+ assign_kernel_eventfd(gp->type, guest_port, xc->fd);

+ }

+ break;

+ }

+ /* fall through */

+

+ case EVTCHNSTAT_unbound:

+ be_port = find_be_port(s, xc);

+ if (!be_port) {

+ ret = -ENOSPC;

+ goto out;

+ }

+

+ gp->type = EVTCHNSTAT_interdomain;

+ gp->type_val = be_port | PORT_INFO_TYPEVAL_REMOTE_QEMU;

+ xc->guest_port = guest_port;

+ if (kvm_xen_has_cap(EVTCHN_SEND)) {

+ assign_kernel_eventfd(gp->type, guest_port, xc->fd);

+ }

+ ret = be_port;

+ break;

+

+ default:

+ ret = -EINVAL;

+ break;

+ }

+

+ out:

+ qemu_mutex_unlock(&s->port_lock);

+

+ return ret;

+}

+

+int xen_be_evtchn_unbind(struct xenevtchn_handle *xc, evtchn_port_t port)

+{

+ XenEvtchnState *s = xen_evtchn_singleton;

+ int ret;

+

+ if (!s) {

+ return -ENOTSUP;

+ }

+

+ if (!xc) {

+ return -EFAULT;

+ }

+

+ qemu_mutex_lock(&s->port_lock);

+

+ if (port && port != xc->be_port) {

+ ret = -EINVAL;

+ goto out;

+ }

+

+ if (xc->guest_port) {

+ XenEvtchnPort *gp = &s->port_table[xc->guest_port];

+

+ /* This should never *not* be true */

+ if (gp->type == EVTCHNSTAT_interdomain) {

+ gp->type = EVTCHNSTAT_unbound;

+ gp->type_val = PORT_INFO_TYPEVAL_REMOTE_QEMU;

+ }

+

+ if (kvm_xen_has_cap(EVTCHN_SEND)) {

+ deassign_kernel_port(xc->guest_port);

+ }

+ xc->guest_port = 0;

+ }

+

+ s->be_handles[xc->be_port] = NULL;

+ xc->be_port = 0;

+ ret = 0;

+ out:

+ qemu_mutex_unlock(&s->port_lock);

+ return ret;

+}

+

+int xen_be_evtchn_close(struct xenevtchn_handle *xc)

+{

+ if (!xc) {

+ return -EFAULT;

+ }

+

+ xen_be_evtchn_unbind(xc, 0);

+

+ close(xc->fd);

+ free(xc);

+ return 0;

+}

+

+int xen_be_evtchn_fd(struct xenevtchn_handle *xc)

+{

+ if (!xc) {

+ return -1;

+ }

+ return xc->fd;

+}

+

+int xen_be_evtchn_notify(struct xenevtchn_handle *xc, evtchn_port_t port)

+{

+ XenEvtchnState *s = xen_evtchn_singleton;

+ int ret;

+

+ if (!s) {

+ return -ENOTSUP;

+ }

+

+ if (!xc) {

+ return -EFAULT;

+ }

+

+ qemu_mutex_lock(&s->port_lock);

+

+ if (xc->guest_port) {

+ set_port_pending(s, xc->guest_port);

+ ret = 0;

+ } else {

+ ret = -ENOTCONN;

+ }

+

+ qemu_mutex_unlock(&s->port_lock);

+

+ return ret;

+}

+

+int xen_be_evtchn_pending(struct xenevtchn_handle *xc)

+{

+ uint64_t val;

+

+ if (!xc) {

+ return -EFAULT;

+ }

+

+ if (!xc->be_port) {

+ return 0;

+ }

+

+ if (eventfd_read(xc->fd, &val)) {

+ return -errno;

+ }

+

+ return val ? xc->be_port : 0;

+}

+

+int xen_be_evtchn_unmask(struct xenevtchn_handle *xc, evtchn_port_t port)

+{

+ if (!xc) {

+ return -EFAULT;

+ }

+

+ if (xc->be_port != port) {

+ return -EINVAL;

+ }

+

+ /*

+ * We don't actually do anything to unmask it; the event was already

+ * consumed in xen_be_evtchn_pending().

+ */