xref: /qemu/hw/pci/pci.c (revision abff1abf)
1 /*
2  * QEMU PCI bus manager
3  *
4  * Copyright (c) 2004 Fabrice Bellard
5  *
6  * Permission is hereby granted, free of charge, to any person obtaining a copy
7  * of this software and associated documentation files (the "Software"), to deal
8  * in the Software without restriction, including without limitation the rights
9  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
10  * copies of the Software, and to permit persons to whom the Software is
11  * furnished to do so, subject to the following conditions:
12  *
13  * The above copyright notice and this permission notice shall be included in
14  * all copies or substantial portions of the Software.
15  *
16  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
17  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
18  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
19  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
20  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
21  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
22  * THE SOFTWARE.
23  */
24 
25 #include "qemu/osdep.h"
26 #include "qemu-common.h"
27 #include "hw/irq.h"
28 #include "hw/pci/pci.h"
29 #include "hw/pci/pci_bridge.h"
30 #include "hw/pci/pci_bus.h"
31 #include "hw/pci/pci_host.h"
32 #include "hw/qdev-properties.h"
33 #include "migration/qemu-file-types.h"
34 #include "migration/vmstate.h"
35 #include "monitor/monitor.h"
36 #include "net/net.h"
37 #include "sysemu/numa.h"
38 #include "sysemu/sysemu.h"
39 #include "hw/loader.h"
40 #include "qemu/error-report.h"
41 #include "qemu/range.h"
42 #include "trace.h"
43 #include "hw/pci/msi.h"
44 #include "hw/pci/msix.h"
45 #include "exec/address-spaces.h"
46 #include "hw/hotplug.h"
47 #include "hw/boards.h"
48 #include "qapi/error.h"
49 #include "qapi/qapi-commands-misc.h"
50 #include "qemu/cutils.h"
51 
52 //#define DEBUG_PCI
53 #ifdef DEBUG_PCI
54 # define PCI_DPRINTF(format, ...)       printf(format, ## __VA_ARGS__)
55 #else
56 # define PCI_DPRINTF(format, ...)       do { } while (0)
57 #endif
58 
59 bool pci_available = true;
60 
61 static void pcibus_dev_print(Monitor *mon, DeviceState *dev, int indent);
62 static char *pcibus_get_dev_path(DeviceState *dev);
63 static char *pcibus_get_fw_dev_path(DeviceState *dev);
64 static void pcibus_reset(BusState *qbus);
65 
66 static Property pci_props[] = {
67     DEFINE_PROP_PCI_DEVFN("addr", PCIDevice, devfn, -1),
68     DEFINE_PROP_STRING("romfile", PCIDevice, romfile),
69     DEFINE_PROP_UINT32("rombar",  PCIDevice, rom_bar, 1),
70     DEFINE_PROP_BIT("multifunction", PCIDevice, cap_present,
71                     QEMU_PCI_CAP_MULTIFUNCTION_BITNR, false),
72     DEFINE_PROP_BIT("x-pcie-lnksta-dllla", PCIDevice, cap_present,
73                     QEMU_PCIE_LNKSTA_DLLLA_BITNR, true),
74     DEFINE_PROP_BIT("x-pcie-extcap-init", PCIDevice, cap_present,
75                     QEMU_PCIE_EXTCAP_INIT_BITNR, true),
76     DEFINE_PROP_STRING("failover_pair_id", PCIDevice,
77                        failover_pair_id),
78     DEFINE_PROP_END_OF_LIST()
79 };
80 
81 static const VMStateDescription vmstate_pcibus = {
82     .name = "PCIBUS",
83     .version_id = 1,
84     .minimum_version_id = 1,
85     .fields = (VMStateField[]) {
86         VMSTATE_INT32_EQUAL(nirq, PCIBus, NULL),
87         VMSTATE_VARRAY_INT32(irq_count, PCIBus,
88                              nirq, 0, vmstate_info_int32,
89                              int32_t),
90         VMSTATE_END_OF_LIST()
91     }
92 };
93 
94 static void pci_init_bus_master(PCIDevice *pci_dev)
95 {
96     AddressSpace *dma_as = pci_device_iommu_address_space(pci_dev);
97 
98     memory_region_init_alias(&pci_dev->bus_master_enable_region,
99                              OBJECT(pci_dev), "bus master",
100                              dma_as->root, 0, memory_region_size(dma_as->root));
101     memory_region_set_enabled(&pci_dev->bus_master_enable_region, false);
102     memory_region_add_subregion(&pci_dev->bus_master_container_region, 0,
103                                 &pci_dev->bus_master_enable_region);
104 }
105 
106 static void pcibus_machine_done(Notifier *notifier, void *data)
107 {
108     PCIBus *bus = container_of(notifier, PCIBus, machine_done);
109     int i;
110 
111     for (i = 0; i < ARRAY_SIZE(bus->devices); ++i) {
112         if (bus->devices[i]) {
113             pci_init_bus_master(bus->devices[i]);
114         }
115     }
116 }
117 
118 static void pci_bus_realize(BusState *qbus, Error **errp)
119 {
120     PCIBus *bus = PCI_BUS(qbus);
121 
122     bus->machine_done.notify = pcibus_machine_done;
123     qemu_add_machine_init_done_notifier(&bus->machine_done);
124 
125     vmstate_register(NULL, VMSTATE_INSTANCE_ID_ANY, &vmstate_pcibus, bus);
126 }
127 
128 static void pcie_bus_realize(BusState *qbus, Error **errp)
129 {
130     PCIBus *bus = PCI_BUS(qbus);
131 
132     pci_bus_realize(qbus, errp);
133 
134     /*
135      * A PCI-E bus can support extended config space if it's the root
136      * bus, or if the bus/bridge above it does as well
137      */
138     if (pci_bus_is_root(bus)) {
139         bus->flags |= PCI_BUS_EXTENDED_CONFIG_SPACE;
140     } else {
141         PCIBus *parent_bus = pci_get_bus(bus->parent_dev);
142 
143         if (pci_bus_allows_extended_config_space(parent_bus)) {
144             bus->flags |= PCI_BUS_EXTENDED_CONFIG_SPACE;
145         }
146     }
147 }
148 
149 static void pci_bus_unrealize(BusState *qbus)
150 {
151     PCIBus *bus = PCI_BUS(qbus);
152 
153     qemu_remove_machine_init_done_notifier(&bus->machine_done);
154 
155     vmstate_unregister(NULL, &vmstate_pcibus, bus);
156 }
157 
158 static int pcibus_num(PCIBus *bus)
159 {
160     if (pci_bus_is_root(bus)) {
161         return 0; /* pci host bridge */
162     }
163     return bus->parent_dev->config[PCI_SECONDARY_BUS];
164 }
165 
166 static uint16_t pcibus_numa_node(PCIBus *bus)
167 {
168     return NUMA_NODE_UNASSIGNED;
169 }
170 
171 static void pci_bus_class_init(ObjectClass *klass, void *data)
172 {
173     BusClass *k = BUS_CLASS(klass);
174     PCIBusClass *pbc = PCI_BUS_CLASS(klass);
175 
176     k->print_dev = pcibus_dev_print;
177     k->get_dev_path = pcibus_get_dev_path;
178     k->get_fw_dev_path = pcibus_get_fw_dev_path;
179     k->realize = pci_bus_realize;
180     k->unrealize = pci_bus_unrealize;
181     k->reset = pcibus_reset;
182 
183     pbc->bus_num = pcibus_num;
184     pbc->numa_node = pcibus_numa_node;
185 }
186 
187 static const TypeInfo pci_bus_info = {
188     .name = TYPE_PCI_BUS,
189     .parent = TYPE_BUS,
190     .instance_size = sizeof(PCIBus),
191     .class_size = sizeof(PCIBusClass),
192     .class_init = pci_bus_class_init,
193 };
194 
195 static const TypeInfo pcie_interface_info = {
196     .name          = INTERFACE_PCIE_DEVICE,
197     .parent        = TYPE_INTERFACE,
198 };
199 
200 static const TypeInfo conventional_pci_interface_info = {
201     .name          = INTERFACE_CONVENTIONAL_PCI_DEVICE,
202     .parent        = TYPE_INTERFACE,
203 };
204 
205 static void pcie_bus_class_init(ObjectClass *klass, void *data)
206 {
207     BusClass *k = BUS_CLASS(klass);
208 
209     k->realize = pcie_bus_realize;
210 }
211 
212 static const TypeInfo pcie_bus_info = {
213     .name = TYPE_PCIE_BUS,
214     .parent = TYPE_PCI_BUS,
215     .class_init = pcie_bus_class_init,
216 };
217 
218 static PCIBus *pci_find_bus_nr(PCIBus *bus, int bus_num);
219 static void pci_update_mappings(PCIDevice *d);
220 static void pci_irq_handler(void *opaque, int irq_num, int level);
221 static void pci_add_option_rom(PCIDevice *pdev, bool is_default_rom, Error **);
222 static void pci_del_option_rom(PCIDevice *pdev);
223 
224 static uint16_t pci_default_sub_vendor_id = PCI_SUBVENDOR_ID_REDHAT_QUMRANET;
225 static uint16_t pci_default_sub_device_id = PCI_SUBDEVICE_ID_QEMU;
226 
227 static QLIST_HEAD(, PCIHostState) pci_host_bridges;
228 
229 int pci_bar(PCIDevice *d, int reg)
230 {
231     uint8_t type;
232 
233     if (reg != PCI_ROM_SLOT)
234         return PCI_BASE_ADDRESS_0 + reg * 4;
235 
236     type = d->config[PCI_HEADER_TYPE] & ~PCI_HEADER_TYPE_MULTI_FUNCTION;
237     return type == PCI_HEADER_TYPE_BRIDGE ? PCI_ROM_ADDRESS1 : PCI_ROM_ADDRESS;
238 }
239 
240 static inline int pci_irq_state(PCIDevice *d, int irq_num)
241 {
242         return (d->irq_state >> irq_num) & 0x1;
243 }
244 
245 static inline void pci_set_irq_state(PCIDevice *d, int irq_num, int level)
246 {
247         d->irq_state &= ~(0x1 << irq_num);
248         d->irq_state |= level << irq_num;
249 }
250 
251 static void pci_change_irq_level(PCIDevice *pci_dev, int irq_num, int change)
252 {
253     PCIBus *bus;
254     for (;;) {
255         bus = pci_get_bus(pci_dev);
256         irq_num = bus->map_irq(pci_dev, irq_num);
257         if (bus->set_irq)
258             break;
259         pci_dev = bus->parent_dev;
260     }
261     bus->irq_count[irq_num] += change;
262     bus->set_irq(bus->irq_opaque, irq_num, bus->irq_count[irq_num] != 0);
263 }
264 
265 int pci_bus_get_irq_level(PCIBus *bus, int irq_num)
266 {
267     assert(irq_num >= 0);
268     assert(irq_num < bus->nirq);
269     return !!bus->irq_count[irq_num];
270 }
271 
272 /* Update interrupt status bit in config space on interrupt
273  * state change. */
274 static void pci_update_irq_status(PCIDevice *dev)
275 {
276     if (dev->irq_state) {
277         dev->config[PCI_STATUS] |= PCI_STATUS_INTERRUPT;
278     } else {
279         dev->config[PCI_STATUS] &= ~PCI_STATUS_INTERRUPT;
280     }
281 }
282 
283 void pci_device_deassert_intx(PCIDevice *dev)
284 {
285     int i;
286     for (i = 0; i < PCI_NUM_PINS; ++i) {
287         pci_irq_handler(dev, i, 0);
288     }
289 }
290 
291 static void pci_do_device_reset(PCIDevice *dev)
292 {
293     int r;
294 
295     pci_device_deassert_intx(dev);
296     assert(dev->irq_state == 0);
297 
298     /* Clear all writable bits */
299     pci_word_test_and_clear_mask(dev->config + PCI_COMMAND,
300                                  pci_get_word(dev->wmask + PCI_COMMAND) |
301                                  pci_get_word(dev->w1cmask + PCI_COMMAND));
302     pci_word_test_and_clear_mask(dev->config + PCI_STATUS,
303                                  pci_get_word(dev->wmask + PCI_STATUS) |
304                                  pci_get_word(dev->w1cmask + PCI_STATUS));
305     /* Some devices make bits of PCI_INTERRUPT_LINE read only */
306     pci_byte_test_and_clear_mask(dev->config + PCI_INTERRUPT_LINE,
307                               pci_get_word(dev->wmask + PCI_INTERRUPT_LINE) |
308                               pci_get_word(dev->w1cmask + PCI_INTERRUPT_LINE));
309     dev->config[PCI_CACHE_LINE_SIZE] = 0x0;
310     for (r = 0; r < PCI_NUM_REGIONS; ++r) {
311         PCIIORegion *region = &dev->io_regions[r];
312         if (!region->size) {
313             continue;
314         }
315 
316         if (!(region->type & PCI_BASE_ADDRESS_SPACE_IO) &&
317             region->type & PCI_BASE_ADDRESS_MEM_TYPE_64) {
318             pci_set_quad(dev->config + pci_bar(dev, r), region->type);
319         } else {
320             pci_set_long(dev->config + pci_bar(dev, r), region->type);
321         }
322     }
323     pci_update_mappings(dev);
324 
325     msi_reset(dev);
326     msix_reset(dev);
327 }
328 
329 /*
330  * This function is called on #RST and FLR.
331  * FLR if PCI_EXP_DEVCTL_BCR_FLR is set
332  */
333 void pci_device_reset(PCIDevice *dev)
334 {
335     qdev_reset_all(&dev->qdev);
336     pci_do_device_reset(dev);
337 }
338 
339 /*
340  * Trigger pci bus reset under a given bus.
341  * Called via qbus_reset_all on RST# assert, after the devices
342  * have been reset qdev_reset_all-ed already.
343  */
344 static void pcibus_reset(BusState *qbus)
345 {
346     PCIBus *bus = DO_UPCAST(PCIBus, qbus, qbus);
347     int i;
348 
349     for (i = 0; i < ARRAY_SIZE(bus->devices); ++i) {
350         if (bus->devices[i]) {
351             pci_do_device_reset(bus->devices[i]);
352         }
353     }
354 
355     for (i = 0; i < bus->nirq; i++) {
356         assert(bus->irq_count[i] == 0);
357     }
358 }
359 
360 static void pci_host_bus_register(DeviceState *host)
361 {
362     PCIHostState *host_bridge = PCI_HOST_BRIDGE(host);
363 
364     QLIST_INSERT_HEAD(&pci_host_bridges, host_bridge, next);
365 }
366 
367 static void pci_host_bus_unregister(DeviceState *host)
368 {
369     PCIHostState *host_bridge = PCI_HOST_BRIDGE(host);
370 
371     QLIST_REMOVE(host_bridge, next);
372 }
373 
374 PCIBus *pci_device_root_bus(const PCIDevice *d)
375 {
376     PCIBus *bus = pci_get_bus(d);
377 
378     while (!pci_bus_is_root(bus)) {
379         d = bus->parent_dev;
380         assert(d != NULL);
381 
382         bus = pci_get_bus(d);
383     }
384 
385     return bus;
386 }
387 
388 const char *pci_root_bus_path(PCIDevice *dev)
389 {
390     PCIBus *rootbus = pci_device_root_bus(dev);
391     PCIHostState *host_bridge = PCI_HOST_BRIDGE(rootbus->qbus.parent);
392     PCIHostBridgeClass *hc = PCI_HOST_BRIDGE_GET_CLASS(host_bridge);
393 
394     assert(host_bridge->bus == rootbus);
395 
396     if (hc->root_bus_path) {
397         return (*hc->root_bus_path)(host_bridge, rootbus);
398     }
399 
400     return rootbus->qbus.name;
401 }
402 
403 static void pci_root_bus_init(PCIBus *bus, DeviceState *parent,
404                               MemoryRegion *address_space_mem,
405                               MemoryRegion *address_space_io,
406                               uint8_t devfn_min)
407 {
408     assert(PCI_FUNC(devfn_min) == 0);
409     bus->devfn_min = devfn_min;
410     bus->slot_reserved_mask = 0x0;
411     bus->address_space_mem = address_space_mem;
412     bus->address_space_io = address_space_io;
413     bus->flags |= PCI_BUS_IS_ROOT;
414 
415     /* host bridge */
416     QLIST_INIT(&bus->child);
417 
418     pci_host_bus_register(parent);
419 }
420 
421 static void pci_bus_uninit(PCIBus *bus)
422 {
423     pci_host_bus_unregister(BUS(bus)->parent);
424 }
425 
426 bool pci_bus_is_express(PCIBus *bus)
427 {
428     return object_dynamic_cast(OBJECT(bus), TYPE_PCIE_BUS);
429 }
430 
431 void pci_root_bus_new_inplace(PCIBus *bus, size_t bus_size, DeviceState *parent,
432                               const char *name,
433                               MemoryRegion *address_space_mem,
434                               MemoryRegion *address_space_io,
435                               uint8_t devfn_min, const char *typename)
436 {
437     qbus_create_inplace(bus, bus_size, typename, parent, name);
438     pci_root_bus_init(bus, parent, address_space_mem, address_space_io,
439                       devfn_min);
440 }
441 
442 PCIBus *pci_root_bus_new(DeviceState *parent, const char *name,
443                          MemoryRegion *address_space_mem,
444                          MemoryRegion *address_space_io,
445                          uint8_t devfn_min, const char *typename)
446 {
447     PCIBus *bus;
448 
449     bus = PCI_BUS(qbus_create(typename, parent, name));
450     pci_root_bus_init(bus, parent, address_space_mem, address_space_io,
451                       devfn_min);
452     return bus;
453 }
454 
455 void pci_root_bus_cleanup(PCIBus *bus)
456 {
457     pci_bus_uninit(bus);
458     /* the caller of the unplug hotplug handler will delete this device */
459     qbus_unrealize(BUS(bus));
460 }
461 
462 void pci_bus_irqs(PCIBus *bus, pci_set_irq_fn set_irq, pci_map_irq_fn map_irq,
463                   void *irq_opaque, int nirq)
464 {
465     bus->set_irq = set_irq;
466     bus->map_irq = map_irq;
467     bus->irq_opaque = irq_opaque;
468     bus->nirq = nirq;
469     bus->irq_count = g_malloc0(nirq * sizeof(bus->irq_count[0]));
470 }
471 
472 void pci_bus_irqs_cleanup(PCIBus *bus)
473 {
474     bus->set_irq = NULL;
475     bus->map_irq = NULL;
476     bus->irq_opaque = NULL;
477     bus->nirq = 0;
478     g_free(bus->irq_count);
479 }
480 
481 PCIBus *pci_register_root_bus(DeviceState *parent, const char *name,
482                               pci_set_irq_fn set_irq, pci_map_irq_fn map_irq,
483                               void *irq_opaque,
484                               MemoryRegion *address_space_mem,
485                               MemoryRegion *address_space_io,
486                               uint8_t devfn_min, int nirq,
487                               const char *typename)
488 {
489     PCIBus *bus;
490 
491     bus = pci_root_bus_new(parent, name, address_space_mem,
492                            address_space_io, devfn_min, typename);
493     pci_bus_irqs(bus, set_irq, map_irq, irq_opaque, nirq);
494     return bus;
495 }
496 
497 void pci_unregister_root_bus(PCIBus *bus)
498 {
499     pci_bus_irqs_cleanup(bus);
500     pci_root_bus_cleanup(bus);
501 }
502 
503 int pci_bus_num(PCIBus *s)
504 {
505     return PCI_BUS_GET_CLASS(s)->bus_num(s);
506 }
507 
508 int pci_bus_numa_node(PCIBus *bus)
509 {
510     return PCI_BUS_GET_CLASS(bus)->numa_node(bus);
511 }
512 
513 static int get_pci_config_device(QEMUFile *f, void *pv, size_t size,
514                                  const VMStateField *field)
515 {
516     PCIDevice *s = container_of(pv, PCIDevice, config);
517     PCIDeviceClass *pc = PCI_DEVICE_GET_CLASS(s);
518     uint8_t *config;
519     int i;
520 
521     assert(size == pci_config_size(s));
522     config = g_malloc(size);
523 
524     qemu_get_buffer(f, config, size);
525     for (i = 0; i < size; ++i) {
526         if ((config[i] ^ s->config[i]) &
527             s->cmask[i] & ~s->wmask[i] & ~s->w1cmask[i]) {
528             error_report("%s: Bad config data: i=0x%x read: %x device: %x "
529                          "cmask: %x wmask: %x w1cmask:%x", __func__,
530                          i, config[i], s->config[i],
531                          s->cmask[i], s->wmask[i], s->w1cmask[i]);
532             g_free(config);
533             return -EINVAL;
534         }
535     }
536     memcpy(s->config, config, size);
537 
538     pci_update_mappings(s);
539     if (pc->is_bridge) {
540         PCIBridge *b = PCI_BRIDGE(s);
541         pci_bridge_update_mappings(b);
542     }
543 
544     memory_region_set_enabled(&s->bus_master_enable_region,
545                               pci_get_word(s->config + PCI_COMMAND)
546                               & PCI_COMMAND_MASTER);
547 
548     g_free(config);
549     return 0;
550 }
551 
552 /* just put buffer */
553 static int put_pci_config_device(QEMUFile *f, void *pv, size_t size,
554                                  const VMStateField *field, QJSON *vmdesc)
555 {
556     const uint8_t **v = pv;
557     assert(size == pci_config_size(container_of(pv, PCIDevice, config)));
558     qemu_put_buffer(f, *v, size);
559 
560     return 0;
561 }
562 
563 static VMStateInfo vmstate_info_pci_config = {
564     .name = "pci config",
565     .get  = get_pci_config_device,
566     .put  = put_pci_config_device,
567 };
568 
569 static int get_pci_irq_state(QEMUFile *f, void *pv, size_t size,
570                              const VMStateField *field)
571 {
572     PCIDevice *s = container_of(pv, PCIDevice, irq_state);
573     uint32_t irq_state[PCI_NUM_PINS];
574     int i;
575     for (i = 0; i < PCI_NUM_PINS; ++i) {
576         irq_state[i] = qemu_get_be32(f);
577         if (irq_state[i] != 0x1 && irq_state[i] != 0) {
578             fprintf(stderr, "irq state %d: must be 0 or 1.\n",
579                     irq_state[i]);
580             return -EINVAL;
581         }
582     }
583 
584     for (i = 0; i < PCI_NUM_PINS; ++i) {
585         pci_set_irq_state(s, i, irq_state[i]);
586     }
587 
588     return 0;
589 }
590 
591 static int put_pci_irq_state(QEMUFile *f, void *pv, size_t size,
592                              const VMStateField *field, QJSON *vmdesc)
593 {
594     int i;
595     PCIDevice *s = container_of(pv, PCIDevice, irq_state);
596 
597     for (i = 0; i < PCI_NUM_PINS; ++i) {
598         qemu_put_be32(f, pci_irq_state(s, i));
599     }
600 
601     return 0;
602 }
603 
604 static VMStateInfo vmstate_info_pci_irq_state = {
605     .name = "pci irq state",
606     .get  = get_pci_irq_state,
607     .put  = put_pci_irq_state,
608 };
609 
610 static bool migrate_is_pcie(void *opaque, int version_id)
611 {
612     return pci_is_express((PCIDevice *)opaque);
613 }
614 
615 static bool migrate_is_not_pcie(void *opaque, int version_id)
616 {
617     return !pci_is_express((PCIDevice *)opaque);
618 }
619 
620 const VMStateDescription vmstate_pci_device = {
621     .name = "PCIDevice",
622     .version_id = 2,
623     .minimum_version_id = 1,
624     .fields = (VMStateField[]) {
625         VMSTATE_INT32_POSITIVE_LE(version_id, PCIDevice),
626         VMSTATE_BUFFER_UNSAFE_INFO_TEST(config, PCIDevice,
627                                    migrate_is_not_pcie,
628                                    0, vmstate_info_pci_config,
629                                    PCI_CONFIG_SPACE_SIZE),
630         VMSTATE_BUFFER_UNSAFE_INFO_TEST(config, PCIDevice,
631                                    migrate_is_pcie,
632                                    0, vmstate_info_pci_config,
633                                    PCIE_CONFIG_SPACE_SIZE),
634         VMSTATE_BUFFER_UNSAFE_INFO(irq_state, PCIDevice, 2,
635                                    vmstate_info_pci_irq_state,
636                                    PCI_NUM_PINS * sizeof(int32_t)),
637         VMSTATE_END_OF_LIST()
638     }
639 };
640 
641 
642 void pci_device_save(PCIDevice *s, QEMUFile *f)
643 {
644     /* Clear interrupt status bit: it is implicit
645      * in irq_state which we are saving.
646      * This makes us compatible with old devices
647      * which never set or clear this bit. */
648     s->config[PCI_STATUS] &= ~PCI_STATUS_INTERRUPT;
649     vmstate_save_state(f, &vmstate_pci_device, s, NULL);
650     /* Restore the interrupt status bit. */
651     pci_update_irq_status(s);
652 }
653 
654 int pci_device_load(PCIDevice *s, QEMUFile *f)
655 {
656     int ret;
657     ret = vmstate_load_state(f, &vmstate_pci_device, s, s->version_id);
658     /* Restore the interrupt status bit. */
659     pci_update_irq_status(s);
660     return ret;
661 }
662 
663 static void pci_set_default_subsystem_id(PCIDevice *pci_dev)
664 {
665     pci_set_word(pci_dev->config + PCI_SUBSYSTEM_VENDOR_ID,
666                  pci_default_sub_vendor_id);
667     pci_set_word(pci_dev->config + PCI_SUBSYSTEM_ID,
668                  pci_default_sub_device_id);
669 }
670 
671 /*
672  * Parse [[<domain>:]<bus>:]<slot>, return -1 on error if funcp == NULL
673  *       [[<domain>:]<bus>:]<slot>.<func>, return -1 on error
674  */
675 static int pci_parse_devaddr(const char *addr, int *domp, int *busp,
676                              unsigned int *slotp, unsigned int *funcp)
677 {
678     const char *p;
679     char *e;
680     unsigned long val;
681     unsigned long dom = 0, bus = 0;
682     unsigned int slot = 0;
683     unsigned int func = 0;
684 
685     p = addr;
686     val = strtoul(p, &e, 16);
687     if (e == p)
688         return -1;
689     if (*e == ':') {
690         bus = val;
691         p = e + 1;
692         val = strtoul(p, &e, 16);
693         if (e == p)
694             return -1;
695         if (*e == ':') {
696             dom = bus;
697             bus = val;
698             p = e + 1;
699             val = strtoul(p, &e, 16);
700             if (e == p)
701                 return -1;
702         }
703     }
704 
705     slot = val;
706 
707     if (funcp != NULL) {
708         if (*e != '.')
709             return -1;
710 
711         p = e + 1;
712         val = strtoul(p, &e, 16);
713         if (e == p)
714             return -1;
715 
716         func = val;
717     }
718 
719     /* if funcp == NULL func is 0 */
720     if (dom > 0xffff || bus > 0xff || slot > 0x1f || func > 7)
721         return -1;
722 
723     if (*e)
724         return -1;
725 
726     *domp = dom;
727     *busp = bus;
728     *slotp = slot;
729     if (funcp != NULL)
730         *funcp = func;
731     return 0;
732 }
733 
734 static void pci_init_cmask(PCIDevice *dev)
735 {
736     pci_set_word(dev->cmask + PCI_VENDOR_ID, 0xffff);
737     pci_set_word(dev->cmask + PCI_DEVICE_ID, 0xffff);
738     dev->cmask[PCI_STATUS] = PCI_STATUS_CAP_LIST;
739     dev->cmask[PCI_REVISION_ID] = 0xff;
740     dev->cmask[PCI_CLASS_PROG] = 0xff;
741     pci_set_word(dev->cmask + PCI_CLASS_DEVICE, 0xffff);
742     dev->cmask[PCI_HEADER_TYPE] = 0xff;
743     dev->cmask[PCI_CAPABILITY_LIST] = 0xff;
744 }
745 
746 static void pci_init_wmask(PCIDevice *dev)
747 {
748     int config_size = pci_config_size(dev);
749 
750     dev->wmask[PCI_CACHE_LINE_SIZE] = 0xff;
751     dev->wmask[PCI_INTERRUPT_LINE] = 0xff;
752     pci_set_word(dev->wmask + PCI_COMMAND,
753                  PCI_COMMAND_IO | PCI_COMMAND_MEMORY | PCI_COMMAND_MASTER |
754                  PCI_COMMAND_INTX_DISABLE);
755     pci_word_test_and_set_mask(dev->wmask + PCI_COMMAND, PCI_COMMAND_SERR);
756 
757     memset(dev->wmask + PCI_CONFIG_HEADER_SIZE, 0xff,
758            config_size - PCI_CONFIG_HEADER_SIZE);
759 }
760 
761 static void pci_init_w1cmask(PCIDevice *dev)
762 {
763     /*
764      * Note: It's okay to set w1cmask even for readonly bits as
765      * long as their value is hardwired to 0.
766      */
767     pci_set_word(dev->w1cmask + PCI_STATUS,
768                  PCI_STATUS_PARITY | PCI_STATUS_SIG_TARGET_ABORT |
769                  PCI_STATUS_REC_TARGET_ABORT | PCI_STATUS_REC_MASTER_ABORT |
770                  PCI_STATUS_SIG_SYSTEM_ERROR | PCI_STATUS_DETECTED_PARITY);
771 }
772 
773 static void pci_init_mask_bridge(PCIDevice *d)
774 {
775     /* PCI_PRIMARY_BUS, PCI_SECONDARY_BUS, PCI_SUBORDINATE_BUS and
776        PCI_SEC_LETENCY_TIMER */
777     memset(d->wmask + PCI_PRIMARY_BUS, 0xff, 4);
778 
779     /* base and limit */
780     d->wmask[PCI_IO_BASE] = PCI_IO_RANGE_MASK & 0xff;
781     d->wmask[PCI_IO_LIMIT] = PCI_IO_RANGE_MASK & 0xff;
782     pci_set_word(d->wmask + PCI_MEMORY_BASE,
783                  PCI_MEMORY_RANGE_MASK & 0xffff);
784     pci_set_word(d->wmask + PCI_MEMORY_LIMIT,
785                  PCI_MEMORY_RANGE_MASK & 0xffff);
786     pci_set_word(d->wmask + PCI_PREF_MEMORY_BASE,
787                  PCI_PREF_RANGE_MASK & 0xffff);
788     pci_set_word(d->wmask + PCI_PREF_MEMORY_LIMIT,
789                  PCI_PREF_RANGE_MASK & 0xffff);
790 
791     /* PCI_PREF_BASE_UPPER32 and PCI_PREF_LIMIT_UPPER32 */
792     memset(d->wmask + PCI_PREF_BASE_UPPER32, 0xff, 8);
793 
794     /* Supported memory and i/o types */
795     d->config[PCI_IO_BASE] |= PCI_IO_RANGE_TYPE_16;
796     d->config[PCI_IO_LIMIT] |= PCI_IO_RANGE_TYPE_16;
797     pci_word_test_and_set_mask(d->config + PCI_PREF_MEMORY_BASE,
798                                PCI_PREF_RANGE_TYPE_64);
799     pci_word_test_and_set_mask(d->config + PCI_PREF_MEMORY_LIMIT,
800                                PCI_PREF_RANGE_TYPE_64);
801 
802     /*
803      * TODO: Bridges default to 10-bit VGA decoding but we currently only
804      * implement 16-bit decoding (no alias support).
805      */
806     pci_set_word(d->wmask + PCI_BRIDGE_CONTROL,
807                  PCI_BRIDGE_CTL_PARITY |
808                  PCI_BRIDGE_CTL_SERR |
809                  PCI_BRIDGE_CTL_ISA |
810                  PCI_BRIDGE_CTL_VGA |
811                  PCI_BRIDGE_CTL_VGA_16BIT |
812                  PCI_BRIDGE_CTL_MASTER_ABORT |
813                  PCI_BRIDGE_CTL_BUS_RESET |
814                  PCI_BRIDGE_CTL_FAST_BACK |
815                  PCI_BRIDGE_CTL_DISCARD |
816                  PCI_BRIDGE_CTL_SEC_DISCARD |
817                  PCI_BRIDGE_CTL_DISCARD_SERR);
818     /* Below does not do anything as we never set this bit, put here for
819      * completeness. */
820     pci_set_word(d->w1cmask + PCI_BRIDGE_CONTROL,
821                  PCI_BRIDGE_CTL_DISCARD_STATUS);
822     d->cmask[PCI_IO_BASE] |= PCI_IO_RANGE_TYPE_MASK;
823     d->cmask[PCI_IO_LIMIT] |= PCI_IO_RANGE_TYPE_MASK;
824     pci_word_test_and_set_mask(d->cmask + PCI_PREF_MEMORY_BASE,
825                                PCI_PREF_RANGE_TYPE_MASK);
826     pci_word_test_and_set_mask(d->cmask + PCI_PREF_MEMORY_LIMIT,
827                                PCI_PREF_RANGE_TYPE_MASK);
828 }
829 
830 static void pci_init_multifunction(PCIBus *bus, PCIDevice *dev, Error **errp)
831 {
832     uint8_t slot = PCI_SLOT(dev->devfn);
833     uint8_t func;
834 
835     if (dev->cap_present & QEMU_PCI_CAP_MULTIFUNCTION) {
836         dev->config[PCI_HEADER_TYPE] |= PCI_HEADER_TYPE_MULTI_FUNCTION;
837     }
838 
839     /*
840      * multifunction bit is interpreted in two ways as follows.
841      *   - all functions must set the bit to 1.
842      *     Example: Intel X53
843      *   - function 0 must set the bit, but the rest function (> 0)
844      *     is allowed to leave the bit to 0.
845      *     Example: PIIX3(also in qemu), PIIX4(also in qemu), ICH10,
846      *
847      * So OS (at least Linux) checks the bit of only function 0,
848      * and doesn't see the bit of function > 0.
849      *
850      * The below check allows both interpretation.
851      */
852     if (PCI_FUNC(dev->devfn)) {
853         PCIDevice *f0 = bus->devices[PCI_DEVFN(slot, 0)];
854         if (f0 && !(f0->cap_present & QEMU_PCI_CAP_MULTIFUNCTION)) {
855             /* function 0 should set multifunction bit */
856             error_setg(errp, "PCI: single function device can't be populated "
857                        "in function %x.%x", slot, PCI_FUNC(dev->devfn));
858             return;
859         }
860         return;
861     }
862 
863     if (dev->cap_present & QEMU_PCI_CAP_MULTIFUNCTION) {
864         return;
865     }
866     /* function 0 indicates single function, so function > 0 must be NULL */
867     for (func = 1; func < PCI_FUNC_MAX; ++func) {
868         if (bus->devices[PCI_DEVFN(slot, func)]) {
869             error_setg(errp, "PCI: %x.0 indicates single function, "
870                        "but %x.%x is already populated.",
871                        slot, slot, func);
872             return;
873         }
874     }
875 }
876 
877 static void pci_config_alloc(PCIDevice *pci_dev)
878 {
879     int config_size = pci_config_size(pci_dev);
880 
881     pci_dev->config = g_malloc0(config_size);
882     pci_dev->cmask = g_malloc0(config_size);
883     pci_dev->wmask = g_malloc0(config_size);
884     pci_dev->w1cmask = g_malloc0(config_size);
885     pci_dev->used = g_malloc0(config_size);
886 }
887 
888 static void pci_config_free(PCIDevice *pci_dev)
889 {
890     g_free(pci_dev->config);
891     g_free(pci_dev->cmask);
892     g_free(pci_dev->wmask);
893     g_free(pci_dev->w1cmask);
894     g_free(pci_dev->used);
895 }
896 
897 static void do_pci_unregister_device(PCIDevice *pci_dev)
898 {
899     pci_get_bus(pci_dev)->devices[pci_dev->devfn] = NULL;
900     pci_config_free(pci_dev);
901 
902     if (memory_region_is_mapped(&pci_dev->bus_master_enable_region)) {
903         memory_region_del_subregion(&pci_dev->bus_master_container_region,
904                                     &pci_dev->bus_master_enable_region);
905     }
906     address_space_destroy(&pci_dev->bus_master_as);
907 }
908 
909 /* Extract PCIReqIDCache into BDF format */
910 static uint16_t pci_req_id_cache_extract(PCIReqIDCache *cache)
911 {
912     uint8_t bus_n;
913     uint16_t result;
914 
915     switch (cache->type) {
916     case PCI_REQ_ID_BDF:
917         result = pci_get_bdf(cache->dev);
918         break;
919     case PCI_REQ_ID_SECONDARY_BUS:
920         bus_n = pci_dev_bus_num(cache->dev);
921         result = PCI_BUILD_BDF(bus_n, 0);
922         break;
923     default:
924         error_report("Invalid PCI requester ID cache type: %d",
925                      cache->type);
926         exit(1);
927         break;
928     }
929 
930     return result;
931 }
932 
933 /* Parse bridges up to the root complex and return requester ID
934  * cache for specific device.  For full PCIe topology, the cache
935  * result would be exactly the same as getting BDF of the device.
936  * However, several tricks are required when system mixed up with
937  * legacy PCI devices and PCIe-to-PCI bridges.
938  *
939  * Here we cache the proxy device (and type) not requester ID since
940  * bus number might change from time to time.
941  */
942 static PCIReqIDCache pci_req_id_cache_get(PCIDevice *dev)
943 {
944     PCIDevice *parent;
945     PCIReqIDCache cache = {
946         .dev = dev,
947         .type = PCI_REQ_ID_BDF,
948     };
949 
950     while (!pci_bus_is_root(pci_get_bus(dev))) {
951         /* We are under PCI/PCIe bridges */
952         parent = pci_get_bus(dev)->parent_dev;
953         if (pci_is_express(parent)) {
954             if (pcie_cap_get_type(parent) == PCI_EXP_TYPE_PCI_BRIDGE) {
955                 /* When we pass through PCIe-to-PCI/PCIX bridges, we
956                  * override the requester ID using secondary bus
957                  * number of parent bridge with zeroed devfn
958                  * (pcie-to-pci bridge spec chap 2.3). */
959                 cache.type = PCI_REQ_ID_SECONDARY_BUS;
960                 cache.dev = dev;
961             }
962         } else {
963             /* Legacy PCI, override requester ID with the bridge's
964              * BDF upstream.  When the root complex connects to
965              * legacy PCI devices (including buses), it can only
966              * obtain requester ID info from directly attached
967              * devices.  If devices are attached under bridges, only
968              * the requester ID of the bridge that is directly
969              * attached to the root complex can be recognized. */
970             cache.type = PCI_REQ_ID_BDF;
971             cache.dev = parent;
972         }
973         dev = parent;
974     }
975 
976     return cache;
977 }
978 
979 uint16_t pci_requester_id(PCIDevice *dev)
980 {
981     return pci_req_id_cache_extract(&dev->requester_id_cache);
982 }
983 
984 static bool pci_bus_devfn_available(PCIBus *bus, int devfn)
985 {
986     return !(bus->devices[devfn]);
987 }
988 
989 static bool pci_bus_devfn_reserved(PCIBus *bus, int devfn)
990 {
991     return bus->slot_reserved_mask & (1UL << PCI_SLOT(devfn));
992 }
993 
994 /* -1 for devfn means auto assign */
995 static PCIDevice *do_pci_register_device(PCIDevice *pci_dev,
996                                          const char *name, int devfn,
997                                          Error **errp)
998 {
999     PCIDeviceClass *pc = PCI_DEVICE_GET_CLASS(pci_dev);
1000     PCIConfigReadFunc *config_read = pc->config_read;
1001     PCIConfigWriteFunc *config_write = pc->config_write;
1002     Error *local_err = NULL;
1003     DeviceState *dev = DEVICE(pci_dev);
1004     PCIBus *bus = pci_get_bus(pci_dev);
1005 
1006     /* Only pci bridges can be attached to extra PCI root buses */
1007     if (pci_bus_is_root(bus) && bus->parent_dev && !pc->is_bridge) {
1008         error_setg(errp,
1009                    "PCI: Only PCI/PCIe bridges can be plugged into %s",
1010                     bus->parent_dev->name);
1011         return NULL;
1012     }
1013 
1014     if (devfn < 0) {
1015         for(devfn = bus->devfn_min ; devfn < ARRAY_SIZE(bus->devices);
1016             devfn += PCI_FUNC_MAX) {
1017             if (pci_bus_devfn_available(bus, devfn) &&
1018                    !pci_bus_devfn_reserved(bus, devfn)) {
1019                 goto found;
1020             }
1021         }
1022         error_setg(errp, "PCI: no slot/function available for %s, all in use "
1023                    "or reserved", name);
1024         return NULL;
1025     found: ;
1026     } else if (pci_bus_devfn_reserved(bus, devfn)) {
1027         error_setg(errp, "PCI: slot %d function %d not available for %s,"
1028                    " reserved",
1029                    PCI_SLOT(devfn), PCI_FUNC(devfn), name);
1030         return NULL;
1031     } else if (!pci_bus_devfn_available(bus, devfn)) {
1032         error_setg(errp, "PCI: slot %d function %d not available for %s,"
1033                    " in use by %s",
1034                    PCI_SLOT(devfn), PCI_FUNC(devfn), name,
1035                    bus->devices[devfn]->name);
1036         return NULL;
1037     } else if (dev->hotplugged &&
1038                pci_get_function_0(pci_dev)) {
1039         error_setg(errp, "PCI: slot %d function 0 already ocuppied by %s,"
1040                    " new func %s cannot be exposed to guest.",
1041                    PCI_SLOT(pci_get_function_0(pci_dev)->devfn),
1042                    pci_get_function_0(pci_dev)->name,
1043                    name);
1044 
1045        return NULL;
1046     }
1047 
1048     pci_dev->devfn = devfn;
1049     pci_dev->requester_id_cache = pci_req_id_cache_get(pci_dev);
1050     pstrcpy(pci_dev->name, sizeof(pci_dev->name), name);
1051 
1052     memory_region_init(&pci_dev->bus_master_container_region, OBJECT(pci_dev),
1053                        "bus master container", UINT64_MAX);
1054     address_space_init(&pci_dev->bus_master_as,
1055                        &pci_dev->bus_master_container_region, pci_dev->name);
1056 
1057     if (qdev_hotplug) {
1058         pci_init_bus_master(pci_dev);
1059     }
1060     pci_dev->irq_state = 0;
1061     pci_config_alloc(pci_dev);
1062 
1063     pci_config_set_vendor_id(pci_dev->config, pc->vendor_id);
1064     pci_config_set_device_id(pci_dev->config, pc->device_id);
1065     pci_config_set_revision(pci_dev->config, pc->revision);
1066     pci_config_set_class(pci_dev->config, pc->class_id);
1067 
1068     if (!pc->is_bridge) {
1069         if (pc->subsystem_vendor_id || pc->subsystem_id) {
1070             pci_set_word(pci_dev->config + PCI_SUBSYSTEM_VENDOR_ID,
1071                          pc->subsystem_vendor_id);
1072             pci_set_word(pci_dev->config + PCI_SUBSYSTEM_ID,
1073                          pc->subsystem_id);
1074         } else {
1075             pci_set_default_subsystem_id(pci_dev);
1076         }
1077     } else {
1078         /* subsystem_vendor_id/subsystem_id are only for header type 0 */
1079         assert(!pc->subsystem_vendor_id);
1080         assert(!pc->subsystem_id);
1081     }
1082     pci_init_cmask(pci_dev);
1083     pci_init_wmask(pci_dev);
1084     pci_init_w1cmask(pci_dev);
1085     if (pc->is_bridge) {
1086         pci_init_mask_bridge(pci_dev);
1087     }
1088     pci_init_multifunction(bus, pci_dev, &local_err);
1089     if (local_err) {
1090         error_propagate(errp, local_err);
1091         do_pci_unregister_device(pci_dev);
1092         return NULL;
1093     }
1094 
1095     if (!config_read)
1096         config_read = pci_default_read_config;
1097     if (!config_write)
1098         config_write = pci_default_write_config;
1099     pci_dev->config_read = config_read;
1100     pci_dev->config_write = config_write;
1101     bus->devices[devfn] = pci_dev;
1102     pci_dev->version_id = 2; /* Current pci device vmstate version */
1103     return pci_dev;
1104 }
1105 
1106 static void pci_unregister_io_regions(PCIDevice *pci_dev)
1107 {
1108     PCIIORegion *r;
1109     int i;
1110 
1111     for(i = 0; i < PCI_NUM_REGIONS; i++) {
1112         r = &pci_dev->io_regions[i];
1113         if (!r->size || r->addr == PCI_BAR_UNMAPPED)
1114             continue;
1115         memory_region_del_subregion(r->address_space, r->memory);
1116     }
1117 
1118     pci_unregister_vga(pci_dev);
1119 }
1120 
1121 static void pci_qdev_unrealize(DeviceState *dev)
1122 {
1123     PCIDevice *pci_dev = PCI_DEVICE(dev);
1124     PCIDeviceClass *pc = PCI_DEVICE_GET_CLASS(pci_dev);
1125 
1126     pci_unregister_io_regions(pci_dev);
1127     pci_del_option_rom(pci_dev);
1128 
1129     if (pc->exit) {
1130         pc->exit(pci_dev);
1131     }
1132 
1133     pci_device_deassert_intx(pci_dev);
1134     do_pci_unregister_device(pci_dev);
1135 }
1136 
1137 void pci_register_bar(PCIDevice *pci_dev, int region_num,
1138                       uint8_t type, MemoryRegion *memory)
1139 {
1140     PCIIORegion *r;
1141     uint32_t addr; /* offset in pci config space */
1142     uint64_t wmask;
1143     pcibus_t size = memory_region_size(memory);
1144 
1145     assert(region_num >= 0);
1146     assert(region_num < PCI_NUM_REGIONS);
1147     if (size & (size-1)) {
1148         error_report("ERROR: PCI region size must be pow2 "
1149                     "type=0x%x, size=0x%"FMT_PCIBUS"", type, size);
1150         exit(1);
1151     }
1152 
1153     r = &pci_dev->io_regions[region_num];
1154     r->addr = PCI_BAR_UNMAPPED;
1155     r->size = size;
1156     r->type = type;
1157     r->memory = memory;
1158     r->address_space = type & PCI_BASE_ADDRESS_SPACE_IO
1159                         ? pci_get_bus(pci_dev)->address_space_io
1160                         : pci_get_bus(pci_dev)->address_space_mem;
1161 
1162     wmask = ~(size - 1);
1163     if (region_num == PCI_ROM_SLOT) {
1164         /* ROM enable bit is writable */
1165         wmask |= PCI_ROM_ADDRESS_ENABLE;
1166     }
1167 
1168     addr = pci_bar(pci_dev, region_num);
1169     pci_set_long(pci_dev->config + addr, type);
1170 
1171     if (!(r->type & PCI_BASE_ADDRESS_SPACE_IO) &&
1172         r->type & PCI_BASE_ADDRESS_MEM_TYPE_64) {
1173         pci_set_quad(pci_dev->wmask + addr, wmask);
1174         pci_set_quad(pci_dev->cmask + addr, ~0ULL);
1175     } else {
1176         pci_set_long(pci_dev->wmask + addr, wmask & 0xffffffff);
1177         pci_set_long(pci_dev->cmask + addr, 0xffffffff);
1178     }
1179 }
1180 
1181 static void pci_update_vga(PCIDevice *pci_dev)
1182 {
1183     uint16_t cmd;
1184 
1185     if (!pci_dev->has_vga) {
1186         return;
1187     }
1188 
1189     cmd = pci_get_word(pci_dev->config + PCI_COMMAND);
1190 
1191     memory_region_set_enabled(pci_dev->vga_regions[QEMU_PCI_VGA_MEM],
1192                               cmd & PCI_COMMAND_MEMORY);
1193     memory_region_set_enabled(pci_dev->vga_regions[QEMU_PCI_VGA_IO_LO],
1194                               cmd & PCI_COMMAND_IO);
1195     memory_region_set_enabled(pci_dev->vga_regions[QEMU_PCI_VGA_IO_HI],
1196                               cmd & PCI_COMMAND_IO);
1197 }
1198 
1199 void pci_register_vga(PCIDevice *pci_dev, MemoryRegion *mem,
1200                       MemoryRegion *io_lo, MemoryRegion *io_hi)
1201 {
1202     PCIBus *bus = pci_get_bus(pci_dev);
1203 
1204     assert(!pci_dev->has_vga);
1205 
1206     assert(memory_region_size(mem) == QEMU_PCI_VGA_MEM_SIZE);
1207     pci_dev->vga_regions[QEMU_PCI_VGA_MEM] = mem;
1208     memory_region_add_subregion_overlap(bus->address_space_mem,
1209                                         QEMU_PCI_VGA_MEM_BASE, mem, 1);
1210 
1211     assert(memory_region_size(io_lo) == QEMU_PCI_VGA_IO_LO_SIZE);
1212     pci_dev->vga_regions[QEMU_PCI_VGA_IO_LO] = io_lo;
1213     memory_region_add_subregion_overlap(bus->address_space_io,
1214                                         QEMU_PCI_VGA_IO_LO_BASE, io_lo, 1);
1215 
1216     assert(memory_region_size(io_hi) == QEMU_PCI_VGA_IO_HI_SIZE);
1217     pci_dev->vga_regions[QEMU_PCI_VGA_IO_HI] = io_hi;
1218     memory_region_add_subregion_overlap(bus->address_space_io,
1219                                         QEMU_PCI_VGA_IO_HI_BASE, io_hi, 1);
1220     pci_dev->has_vga = true;
1221 
1222     pci_update_vga(pci_dev);
1223 }
1224 
1225 void pci_unregister_vga(PCIDevice *pci_dev)
1226 {
1227     PCIBus *bus = pci_get_bus(pci_dev);
1228 
1229     if (!pci_dev->has_vga) {
1230         return;
1231     }
1232 
1233     memory_region_del_subregion(bus->address_space_mem,
1234                                 pci_dev->vga_regions[QEMU_PCI_VGA_MEM]);
1235     memory_region_del_subregion(bus->address_space_io,
1236                                 pci_dev->vga_regions[QEMU_PCI_VGA_IO_LO]);
1237     memory_region_del_subregion(bus->address_space_io,
1238                                 pci_dev->vga_regions[QEMU_PCI_VGA_IO_HI]);
1239     pci_dev->has_vga = false;
1240 }
1241 
1242 pcibus_t pci_get_bar_addr(PCIDevice *pci_dev, int region_num)
1243 {
1244     return pci_dev->io_regions[region_num].addr;
1245 }
1246 
1247 static pcibus_t pci_bar_address(PCIDevice *d,
1248                                 int reg, uint8_t type, pcibus_t size)
1249 {
1250     pcibus_t new_addr, last_addr;
1251     int bar = pci_bar(d, reg);
1252     uint16_t cmd = pci_get_word(d->config + PCI_COMMAND);
1253     Object *machine = qdev_get_machine();
1254     ObjectClass *oc = object_get_class(machine);
1255     MachineClass *mc = MACHINE_CLASS(oc);
1256     bool allow_0_address = mc->pci_allow_0_address;
1257 
1258     if (type & PCI_BASE_ADDRESS_SPACE_IO) {
1259         if (!(cmd & PCI_COMMAND_IO)) {
1260             return PCI_BAR_UNMAPPED;
1261         }
1262         new_addr = pci_get_long(d->config + bar) & ~(size - 1);
1263         last_addr = new_addr + size - 1;
1264         /* Check if 32 bit BAR wraps around explicitly.
1265          * TODO: make priorities correct and remove this work around.
1266          */
1267         if (last_addr <= new_addr || last_addr >= UINT32_MAX ||
1268             (!allow_0_address && new_addr == 0)) {
1269             return PCI_BAR_UNMAPPED;
1270         }
1271         return new_addr;
1272     }
1273 
1274     if (!(cmd & PCI_COMMAND_MEMORY)) {
1275         return PCI_BAR_UNMAPPED;
1276     }
1277     if (type & PCI_BASE_ADDRESS_MEM_TYPE_64) {
1278         new_addr = pci_get_quad(d->config + bar);
1279     } else {
1280         new_addr = pci_get_long(d->config + bar);
1281     }
1282     /* the ROM slot has a specific enable bit */
1283     if (reg == PCI_ROM_SLOT && !(new_addr & PCI_ROM_ADDRESS_ENABLE)) {
1284         return PCI_BAR_UNMAPPED;
1285     }
1286     new_addr &= ~(size - 1);
1287     last_addr = new_addr + size - 1;
1288     /* NOTE: we do not support wrapping */
1289     /* XXX: as we cannot support really dynamic
1290        mappings, we handle specific values as invalid
1291        mappings. */
1292     if (last_addr <= new_addr || last_addr == PCI_BAR_UNMAPPED ||
1293         (!allow_0_address && new_addr == 0)) {
1294         return PCI_BAR_UNMAPPED;
1295     }
1296 
1297     /* Now pcibus_t is 64bit.
1298      * Check if 32 bit BAR wraps around explicitly.
1299      * Without this, PC ide doesn't work well.
1300      * TODO: remove this work around.
1301      */
1302     if  (!(type & PCI_BASE_ADDRESS_MEM_TYPE_64) && last_addr >= UINT32_MAX) {
1303         return PCI_BAR_UNMAPPED;
1304     }
1305 
1306     /*
1307      * OS is allowed to set BAR beyond its addressable
1308      * bits. For example, 32 bit OS can set 64bit bar
1309      * to >4G. Check it. TODO: we might need to support
1310      * it in the future for e.g. PAE.
1311      */
1312     if (last_addr >= HWADDR_MAX) {
1313         return PCI_BAR_UNMAPPED;
1314     }
1315 
1316     return new_addr;
1317 }
1318 
1319 static void pci_update_mappings(PCIDevice *d)
1320 {
1321     PCIIORegion *r;
1322     int i;
1323     pcibus_t new_addr;
1324 
1325     for(i = 0; i < PCI_NUM_REGIONS; i++) {
1326         r = &d->io_regions[i];
1327 
1328         /* this region isn't registered */
1329         if (!r->size)
1330             continue;
1331 
1332         new_addr = pci_bar_address(d, i, r->type, r->size);
1333 
1334         /* This bar isn't changed */
1335         if (new_addr == r->addr)
1336             continue;
1337 
1338         /* now do the real mapping */
1339         if (r->addr != PCI_BAR_UNMAPPED) {
1340             trace_pci_update_mappings_del(d, pci_dev_bus_num(d),
1341                                           PCI_SLOT(d->devfn),
1342                                           PCI_FUNC(d->devfn),
1343                                           i, r->addr, r->size);
1344             memory_region_del_subregion(r->address_space, r->memory);
1345         }
1346         r->addr = new_addr;
1347         if (r->addr != PCI_BAR_UNMAPPED) {
1348             trace_pci_update_mappings_add(d, pci_dev_bus_num(d),
1349                                           PCI_SLOT(d->devfn),
1350                                           PCI_FUNC(d->devfn),
1351                                           i, r->addr, r->size);
1352             memory_region_add_subregion_overlap(r->address_space,
1353                                                 r->addr, r->memory, 1);
1354         }
1355     }
1356 
1357     pci_update_vga(d);
1358 }
1359 
1360 static inline int pci_irq_disabled(PCIDevice *d)
1361 {
1362     return pci_get_word(d->config + PCI_COMMAND) & PCI_COMMAND_INTX_DISABLE;
1363 }
1364 
1365 /* Called after interrupt disabled field update in config space,
1366  * assert/deassert interrupts if necessary.
1367  * Gets original interrupt disable bit value (before update). */
1368 static void pci_update_irq_disabled(PCIDevice *d, int was_irq_disabled)
1369 {
1370     int i, disabled = pci_irq_disabled(d);
1371     if (disabled == was_irq_disabled)
1372         return;
1373     for (i = 0; i < PCI_NUM_PINS; ++i) {
1374         int state = pci_irq_state(d, i);
1375         pci_change_irq_level(d, i, disabled ? -state : state);
1376     }
1377 }
1378 
1379 uint32_t pci_default_read_config(PCIDevice *d,
1380                                  uint32_t address, int len)
1381 {
1382     uint32_t val = 0;
1383 
1384     assert(address + len <= pci_config_size(d));
1385 
1386     if (pci_is_express_downstream_port(d) &&
1387         ranges_overlap(address, len, d->exp.exp_cap + PCI_EXP_LNKSTA, 2)) {
1388         pcie_sync_bridge_lnk(d);
1389     }
1390     memcpy(&val, d->config + address, len);
1391     return le32_to_cpu(val);
1392 }
1393 
1394 void pci_default_write_config(PCIDevice *d, uint32_t addr, uint32_t val_in, int l)
1395 {
1396     int i, was_irq_disabled = pci_irq_disabled(d);
1397     uint32_t val = val_in;
1398 
1399     assert(addr + l <= pci_config_size(d));
1400 
1401     for (i = 0; i < l; val >>= 8, ++i) {
1402         uint8_t wmask = d->wmask[addr + i];
1403         uint8_t w1cmask = d->w1cmask[addr + i];
1404         assert(!(wmask & w1cmask));
1405         d->config[addr + i] = (d->config[addr + i] & ~wmask) | (val & wmask);
1406         d->config[addr + i] &= ~(val & w1cmask); /* W1C: Write 1 to Clear */
1407     }
1408     if (ranges_overlap(addr, l, PCI_BASE_ADDRESS_0, 24) ||
1409         ranges_overlap(addr, l, PCI_ROM_ADDRESS, 4) ||
1410         ranges_overlap(addr, l, PCI_ROM_ADDRESS1, 4) ||
1411         range_covers_byte(addr, l, PCI_COMMAND))
1412         pci_update_mappings(d);
1413 
1414     if (range_covers_byte(addr, l, PCI_COMMAND)) {
1415         pci_update_irq_disabled(d, was_irq_disabled);
1416         memory_region_set_enabled(&d->bus_master_enable_region,
1417                                   pci_get_word(d->config + PCI_COMMAND)
1418                                     & PCI_COMMAND_MASTER);
1419     }
1420 
1421     msi_write_config(d, addr, val_in, l);
1422     msix_write_config(d, addr, val_in, l);
1423 }
1424 
1425 /***********************************************************/
1426 /* generic PCI irq support */
1427 
1428 /* 0 <= irq_num <= 3. level must be 0 or 1 */
1429 static void pci_irq_handler(void *opaque, int irq_num, int level)
1430 {
1431     PCIDevice *pci_dev = opaque;
1432     int change;
1433 
1434     change = level - pci_irq_state(pci_dev, irq_num);
1435     if (!change)
1436         return;
1437 
1438     pci_set_irq_state(pci_dev, irq_num, level);
1439     pci_update_irq_status(pci_dev);
1440     if (pci_irq_disabled(pci_dev))
1441         return;
1442     pci_change_irq_level(pci_dev, irq_num, change);
1443 }
1444 
1445 static inline int pci_intx(PCIDevice *pci_dev)
1446 {
1447     return pci_get_byte(pci_dev->config + PCI_INTERRUPT_PIN) - 1;
1448 }
1449 
1450 qemu_irq pci_allocate_irq(PCIDevice *pci_dev)
1451 {
1452     int intx = pci_intx(pci_dev);
1453 
1454     return qemu_allocate_irq(pci_irq_handler, pci_dev, intx);
1455 }
1456 
1457 void pci_set_irq(PCIDevice *pci_dev, int level)
1458 {
1459     int intx = pci_intx(pci_dev);
1460     pci_irq_handler(pci_dev, intx, level);
1461 }
1462 
1463 /* Special hooks used by device assignment */
1464 void pci_bus_set_route_irq_fn(PCIBus *bus, pci_route_irq_fn route_intx_to_irq)
1465 {
1466     assert(pci_bus_is_root(bus));
1467     bus->route_intx_to_irq = route_intx_to_irq;
1468 }
1469 
1470 PCIINTxRoute pci_device_route_intx_to_irq(PCIDevice *dev, int pin)
1471 {
1472     PCIBus *bus;
1473 
1474     do {
1475         bus = pci_get_bus(dev);
1476         pin = bus->map_irq(dev, pin);
1477         dev = bus->parent_dev;
1478     } while (dev);
1479 
1480     if (!bus->route_intx_to_irq) {
1481         error_report("PCI: Bug - unimplemented PCI INTx routing (%s)",
1482                      object_get_typename(OBJECT(bus->qbus.parent)));
1483         return (PCIINTxRoute) { PCI_INTX_DISABLED, -1 };
1484     }
1485 
1486     return bus->route_intx_to_irq(bus->irq_opaque, pin);
1487 }
1488 
1489 bool pci_intx_route_changed(PCIINTxRoute *old, PCIINTxRoute *new)
1490 {
1491     return old->mode != new->mode || old->irq != new->irq;
1492 }
1493 
1494 void pci_bus_fire_intx_routing_notifier(PCIBus *bus)
1495 {
1496     PCIDevice *dev;
1497     PCIBus *sec;
1498     int i;
1499 
1500     for (i = 0; i < ARRAY_SIZE(bus->devices); ++i) {
1501         dev = bus->devices[i];
1502         if (dev && dev->intx_routing_notifier) {
1503             dev->intx_routing_notifier(dev);
1504         }
1505     }
1506 
1507     QLIST_FOREACH(sec, &bus->child, sibling) {
1508         pci_bus_fire_intx_routing_notifier(sec);
1509     }
1510 }
1511 
1512 void pci_device_set_intx_routing_notifier(PCIDevice *dev,
1513                                           PCIINTxRoutingNotifier notifier)
1514 {
1515     dev->intx_routing_notifier = notifier;
1516 }
1517 
1518 /*
1519  * PCI-to-PCI bridge specification
1520  * 9.1: Interrupt routing. Table 9-1
1521  *
1522  * the PCI Express Base Specification, Revision 2.1
1523  * 2.2.8.1: INTx interrutp signaling - Rules
1524  *          the Implementation Note
1525  *          Table 2-20
1526  */
1527 /*
1528  * 0 <= pin <= 3 0 = INTA, 1 = INTB, 2 = INTC, 3 = INTD
1529  * 0-origin unlike PCI interrupt pin register.
1530  */
1531 int pci_swizzle_map_irq_fn(PCIDevice *pci_dev, int pin)
1532 {
1533     return pci_swizzle(PCI_SLOT(pci_dev->devfn), pin);
1534 }
1535 
1536 /***********************************************************/
1537 /* monitor info on PCI */
1538 
1539 typedef struct {
1540     uint16_t class;
1541     const char *desc;
1542     const char *fw_name;
1543     uint16_t fw_ign_bits;
1544 } pci_class_desc;
1545 
1546 static const pci_class_desc pci_class_descriptions[] =
1547 {
1548     { 0x0001, "VGA controller", "display"},
1549     { 0x0100, "SCSI controller", "scsi"},
1550     { 0x0101, "IDE controller", "ide"},
1551     { 0x0102, "Floppy controller", "fdc"},
1552     { 0x0103, "IPI controller", "ipi"},
1553     { 0x0104, "RAID controller", "raid"},
1554     { 0x0106, "SATA controller"},
1555     { 0x0107, "SAS controller"},
1556     { 0x0180, "Storage controller"},
1557     { 0x0200, "Ethernet controller", "ethernet"},
1558     { 0x0201, "Token Ring controller", "token-ring"},
1559     { 0x0202, "FDDI controller", "fddi"},
1560     { 0x0203, "ATM controller", "atm"},
1561     { 0x0280, "Network controller"},
1562     { 0x0300, "VGA controller", "display", 0x00ff},
1563     { 0x0301, "XGA controller"},
1564     { 0x0302, "3D controller"},
1565     { 0x0380, "Display controller"},
1566     { 0x0400, "Video controller", "video"},
1567     { 0x0401, "Audio controller", "sound"},
1568     { 0x0402, "Phone"},
1569     { 0x0403, "Audio controller", "sound"},
1570     { 0x0480, "Multimedia controller"},
1571     { 0x0500, "RAM controller", "memory"},
1572     { 0x0501, "Flash controller", "flash"},
1573     { 0x0580, "Memory controller"},
1574     { 0x0600, "Host bridge", "host"},
1575     { 0x0601, "ISA bridge", "isa"},
1576     { 0x0602, "EISA bridge", "eisa"},
1577     { 0x0603, "MC bridge", "mca"},
1578     { 0x0604, "PCI bridge", "pci-bridge"},
1579     { 0x0605, "PCMCIA bridge", "pcmcia"},
1580     { 0x0606, "NUBUS bridge", "nubus"},
1581     { 0x0607, "CARDBUS bridge", "cardbus"},
1582     { 0x0608, "RACEWAY bridge"},
1583     { 0x0680, "Bridge"},
1584     { 0x0700, "Serial port", "serial"},
1585     { 0x0701, "Parallel port", "parallel"},
1586     { 0x0800, "Interrupt controller", "interrupt-controller"},
1587     { 0x0801, "DMA controller", "dma-controller"},
1588     { 0x0802, "Timer", "timer"},
1589     { 0x0803, "RTC", "rtc"},
1590     { 0x0900, "Keyboard", "keyboard"},
1591     { 0x0901, "Pen", "pen"},
1592     { 0x0902, "Mouse", "mouse"},
1593     { 0x0A00, "Dock station", "dock", 0x00ff},
1594     { 0x0B00, "i386 cpu", "cpu", 0x00ff},
1595     { 0x0c00, "Fireware contorller", "fireware"},
1596     { 0x0c01, "Access bus controller", "access-bus"},
1597     { 0x0c02, "SSA controller", "ssa"},
1598     { 0x0c03, "USB controller", "usb"},
1599     { 0x0c04, "Fibre channel controller", "fibre-channel"},
1600     { 0x0c05, "SMBus"},
1601     { 0, NULL}
1602 };
1603 
1604 static void pci_for_each_device_under_bus_reverse(PCIBus *bus,
1605                                                   void (*fn)(PCIBus *b,
1606                                                              PCIDevice *d,
1607                                                              void *opaque),
1608                                                   void *opaque)
1609 {
1610     PCIDevice *d;
1611     int devfn;
1612 
1613     for (devfn = 0; devfn < ARRAY_SIZE(bus->devices); devfn++) {
1614         d = bus->devices[ARRAY_SIZE(bus->devices) - 1 - devfn];
1615         if (d) {
1616             fn(bus, d, opaque);
1617         }
1618     }
1619 }
1620 
1621 void pci_for_each_device_reverse(PCIBus *bus, int bus_num,
1622                          void (*fn)(PCIBus *b, PCIDevice *d, void *opaque),
1623                          void *opaque)
1624 {
1625     bus = pci_find_bus_nr(bus, bus_num);
1626 
1627     if (bus) {
1628         pci_for_each_device_under_bus_reverse(bus, fn, opaque);
1629     }
1630 }
1631 
1632 static void pci_for_each_device_under_bus(PCIBus *bus,
1633                                           void (*fn)(PCIBus *b, PCIDevice *d,
1634                                                      void *opaque),
1635                                           void *opaque)
1636 {
1637     PCIDevice *d;
1638     int devfn;
1639 
1640     for(devfn = 0; devfn < ARRAY_SIZE(bus->devices); devfn++) {
1641         d = bus->devices[devfn];
1642         if (d) {
1643             fn(bus, d, opaque);
1644         }
1645     }
1646 }
1647 
1648 void pci_for_each_device(PCIBus *bus, int bus_num,
1649                          void (*fn)(PCIBus *b, PCIDevice *d, void *opaque),
1650                          void *opaque)
1651 {
1652     bus = pci_find_bus_nr(bus, bus_num);
1653 
1654     if (bus) {
1655         pci_for_each_device_under_bus(bus, fn, opaque);
1656     }
1657 }
1658 
1659 static const pci_class_desc *get_class_desc(int class)
1660 {
1661     const pci_class_desc *desc;
1662 
1663     desc = pci_class_descriptions;
1664     while (desc->desc && class != desc->class) {
1665         desc++;
1666     }
1667 
1668     return desc;
1669 }
1670 
1671 static PciDeviceInfoList *qmp_query_pci_devices(PCIBus *bus, int bus_num);
1672 
1673 static PciMemoryRegionList *qmp_query_pci_regions(const PCIDevice *dev)
1674 {
1675     PciMemoryRegionList *head = NULL, *cur_item = NULL;
1676     int i;
1677 
1678     for (i = 0; i < PCI_NUM_REGIONS; i++) {
1679         const PCIIORegion *r = &dev->io_regions[i];
1680         PciMemoryRegionList *region;
1681 
1682         if (!r->size) {
1683             continue;
1684         }
1685 
1686         region = g_malloc0(sizeof(*region));
1687         region->value = g_malloc0(sizeof(*region->value));
1688 
1689         if (r->type & PCI_BASE_ADDRESS_SPACE_IO) {
1690             region->value->type = g_strdup("io");
1691         } else {
1692             region->value->type = g_strdup("memory");
1693             region->value->has_prefetch = true;
1694             region->value->prefetch = !!(r->type & PCI_BASE_ADDRESS_MEM_PREFETCH);
1695             region->value->has_mem_type_64 = true;
1696             region->value->mem_type_64 = !!(r->type & PCI_BASE_ADDRESS_MEM_TYPE_64);
1697         }
1698 
1699         region->value->bar = i;
1700         region->value->address = r->addr;
1701         region->value->size = r->size;
1702 
1703         /* XXX: waiting for the qapi to support GSList */
1704         if (!cur_item) {
1705             head = cur_item = region;
1706         } else {
1707             cur_item->next = region;
1708             cur_item = region;
1709         }
1710     }
1711 
1712     return head;
1713 }
1714 
1715 static PciBridgeInfo *qmp_query_pci_bridge(PCIDevice *dev, PCIBus *bus,
1716                                            int bus_num)
1717 {
1718     PciBridgeInfo *info;
1719     PciMemoryRange *range;
1720 
1721     info = g_new0(PciBridgeInfo, 1);
1722 
1723     info->bus = g_new0(PciBusInfo, 1);
1724     info->bus->number = dev->config[PCI_PRIMARY_BUS];
1725     info->bus->secondary = dev->config[PCI_SECONDARY_BUS];
1726     info->bus->subordinate = dev->config[PCI_SUBORDINATE_BUS];
1727 
1728     range = info->bus->io_range = g_new0(PciMemoryRange, 1);
1729     range->base = pci_bridge_get_base(dev, PCI_BASE_ADDRESS_SPACE_IO);
1730     range->limit = pci_bridge_get_limit(dev, PCI_BASE_ADDRESS_SPACE_IO);
1731 
1732     range = info->bus->memory_range = g_new0(PciMemoryRange, 1);
1733     range->base = pci_bridge_get_base(dev, PCI_BASE_ADDRESS_SPACE_MEMORY);
1734     range->limit = pci_bridge_get_limit(dev, PCI_BASE_ADDRESS_SPACE_MEMORY);
1735 
1736     range = info->bus->prefetchable_range = g_new0(PciMemoryRange, 1);
1737     range->base = pci_bridge_get_base(dev, PCI_BASE_ADDRESS_MEM_PREFETCH);
1738     range->limit = pci_bridge_get_limit(dev, PCI_BASE_ADDRESS_MEM_PREFETCH);
1739 
1740     if (dev->config[PCI_SECONDARY_BUS] != 0) {
1741         PCIBus *child_bus = pci_find_bus_nr(bus, dev->config[PCI_SECONDARY_BUS]);
1742         if (child_bus) {
1743             info->has_devices = true;
1744             info->devices = qmp_query_pci_devices(child_bus, dev->config[PCI_SECONDARY_BUS]);
1745         }
1746     }
1747 
1748     return info;
1749 }
1750 
1751 static PciDeviceInfo *qmp_query_pci_device(PCIDevice *dev, PCIBus *bus,
1752                                            int bus_num)
1753 {
1754     const pci_class_desc *desc;
1755     PciDeviceInfo *info;
1756     uint8_t type;
1757     int class;
1758 
1759     info = g_new0(PciDeviceInfo, 1);
1760     info->bus = bus_num;
1761     info->slot = PCI_SLOT(dev->devfn);
1762     info->function = PCI_FUNC(dev->devfn);
1763 
1764     info->class_info = g_new0(PciDeviceClass, 1);
1765     class = pci_get_word(dev->config + PCI_CLASS_DEVICE);
1766     info->class_info->q_class = class;
1767     desc = get_class_desc(class);
1768     if (desc->desc) {
1769         info->class_info->has_desc = true;
1770         info->class_info->desc = g_strdup(desc->desc);
1771     }
1772 
1773     info->id = g_new0(PciDeviceId, 1);
1774     info->id->vendor = pci_get_word(dev->config + PCI_VENDOR_ID);
1775     info->id->device = pci_get_word(dev->config + PCI_DEVICE_ID);
1776     info->regions = qmp_query_pci_regions(dev);
1777     info->qdev_id = g_strdup(dev->qdev.id ? dev->qdev.id : "");
1778 
1779     info->irq_pin = dev->config[PCI_INTERRUPT_PIN];
1780     if (dev->config[PCI_INTERRUPT_PIN] != 0) {
1781         info->has_irq = true;
1782         info->irq = dev->config[PCI_INTERRUPT_LINE];
1783     }
1784 
1785     type = dev->config[PCI_HEADER_TYPE] & ~PCI_HEADER_TYPE_MULTI_FUNCTION;
1786     if (type == PCI_HEADER_TYPE_BRIDGE) {
1787         info->has_pci_bridge = true;
1788         info->pci_bridge = qmp_query_pci_bridge(dev, bus, bus_num);
1789     } else if (type == PCI_HEADER_TYPE_NORMAL) {
1790         info->id->has_subsystem = info->id->has_subsystem_vendor = true;
1791         info->id->subsystem = pci_get_word(dev->config + PCI_SUBSYSTEM_ID);
1792         info->id->subsystem_vendor =
1793             pci_get_word(dev->config + PCI_SUBSYSTEM_VENDOR_ID);
1794     } else if (type == PCI_HEADER_TYPE_CARDBUS) {
1795         info->id->has_subsystem = info->id->has_subsystem_vendor = true;
1796         info->id->subsystem = pci_get_word(dev->config + PCI_CB_SUBSYSTEM_ID);
1797         info->id->subsystem_vendor =
1798             pci_get_word(dev->config + PCI_CB_SUBSYSTEM_VENDOR_ID);
1799     }
1800 
1801     return info;
1802 }
1803 
1804 static PciDeviceInfoList *qmp_query_pci_devices(PCIBus *bus, int bus_num)
1805 {
1806     PciDeviceInfoList *info, *head = NULL, *cur_item = NULL;
1807     PCIDevice *dev;
1808     int devfn;
1809 
1810     for (devfn = 0; devfn < ARRAY_SIZE(bus->devices); devfn++) {
1811         dev = bus->devices[devfn];
1812         if (dev) {
1813             info = g_malloc0(sizeof(*info));
1814             info->value = qmp_query_pci_device(dev, bus, bus_num);
1815 
1816             /* XXX: waiting for the qapi to support GSList */
1817             if (!cur_item) {
1818                 head = cur_item = info;
1819             } else {
1820                 cur_item->next = info;
1821                 cur_item = info;
1822             }
1823         }
1824     }
1825 
1826     return head;
1827 }
1828 
1829 static PciInfo *qmp_query_pci_bus(PCIBus *bus, int bus_num)
1830 {
1831     PciInfo *info = NULL;
1832 
1833     bus = pci_find_bus_nr(bus, bus_num);
1834     if (bus) {
1835         info = g_malloc0(sizeof(*info));
1836         info->bus = bus_num;
1837         info->devices = qmp_query_pci_devices(bus, bus_num);
1838     }
1839 
1840     return info;
1841 }
1842 
1843 PciInfoList *qmp_query_pci(Error **errp)
1844 {
1845     PciInfoList *info, *head = NULL, *cur_item = NULL;
1846     PCIHostState *host_bridge;
1847 
1848     QLIST_FOREACH(host_bridge, &pci_host_bridges, next) {
1849         info = g_malloc0(sizeof(*info));
1850         info->value = qmp_query_pci_bus(host_bridge->bus,
1851                                         pci_bus_num(host_bridge->bus));
1852 
1853         /* XXX: waiting for the qapi to support GSList */
1854         if (!cur_item) {
1855             head = cur_item = info;
1856         } else {
1857             cur_item->next = info;
1858             cur_item = info;
1859         }
1860     }
1861 
1862     return head;
1863 }
1864 
1865 /* Initialize a PCI NIC.  */
1866 PCIDevice *pci_nic_init_nofail(NICInfo *nd, PCIBus *rootbus,
1867                                const char *default_model,
1868                                const char *default_devaddr)
1869 {
1870     const char *devaddr = nd->devaddr ? nd->devaddr : default_devaddr;
1871     GSList *list;
1872     GPtrArray *pci_nic_models;
1873     PCIBus *bus;
1874     PCIDevice *pci_dev;
1875     DeviceState *dev;
1876     int devfn;
1877     int i;
1878     int dom, busnr;
1879     unsigned slot;
1880 
1881     if (nd->model && !strcmp(nd->model, "virtio")) {
1882         g_free(nd->model);
1883         nd->model = g_strdup("virtio-net-pci");
1884     }
1885 
1886     list = object_class_get_list_sorted(TYPE_PCI_DEVICE, false);
1887     pci_nic_models = g_ptr_array_new();
1888     while (list) {
1889         DeviceClass *dc = OBJECT_CLASS_CHECK(DeviceClass, list->data,
1890                                              TYPE_DEVICE);
1891         GSList *next;
1892         if (test_bit(DEVICE_CATEGORY_NETWORK, dc->categories) &&
1893             dc->user_creatable) {
1894             const char *name = object_class_get_name(list->data);
1895             /*
1896              * A network device might also be something else than a NIC, see
1897              * e.g. the "rocker" device. Thus we have to look for the "netdev"
1898              * property, too. Unfortunately, some devices like virtio-net only
1899              * create this property during instance_init, so we have to create
1900              * a temporary instance here to be able to check it.
1901              */
1902             Object *obj = object_new_with_class(OBJECT_CLASS(dc));
1903             if (object_property_find(obj, "netdev", NULL)) {
1904                 g_ptr_array_add(pci_nic_models, (gpointer)name);
1905             }
1906             object_unref(obj);
1907         }
1908         next = list->next;
1909         g_slist_free_1(list);
1910         list = next;
1911     }
1912     g_ptr_array_add(pci_nic_models, NULL);
1913 
1914     if (qemu_show_nic_models(nd->model, (const char **)pci_nic_models->pdata)) {
1915         exit(0);
1916     }
1917 
1918     i = qemu_find_nic_model(nd, (const char **)pci_nic_models->pdata,
1919                             default_model);
1920     if (i < 0) {
1921         exit(1);
1922     }
1923 
1924     if (!rootbus) {
1925         error_report("No primary PCI bus");
1926         exit(1);
1927     }
1928 
1929     assert(!rootbus->parent_dev);
1930 
1931     if (!devaddr) {
1932         devfn = -1;
1933         busnr = 0;
1934     } else {
1935         if (pci_parse_devaddr(devaddr, &dom, &busnr, &slot, NULL) < 0) {
1936             error_report("Invalid PCI device address %s for device %s",
1937                          devaddr, nd->model);
1938             exit(1);
1939         }
1940 
1941         if (dom != 0) {
1942             error_report("No support for non-zero PCI domains");
1943             exit(1);
1944         }
1945 
1946         devfn = PCI_DEVFN(slot, 0);
1947     }
1948 
1949     bus = pci_find_bus_nr(rootbus, busnr);
1950     if (!bus) {
1951         error_report("Invalid PCI device address %s for device %s",
1952                      devaddr, nd->model);
1953         exit(1);
1954     }
1955 
1956     pci_dev = pci_new(devfn, nd->model);
1957     dev = &pci_dev->qdev;
1958     qdev_set_nic_properties(dev, nd);
1959     pci_realize_and_unref(pci_dev, bus, &error_fatal);
1960     g_ptr_array_free(pci_nic_models, true);
1961     return pci_dev;
1962 }
1963 
1964 PCIDevice *pci_vga_init(PCIBus *bus)
1965 {
1966     switch (vga_interface_type) {
1967     case VGA_CIRRUS:
1968         return pci_create_simple(bus, -1, "cirrus-vga");
1969     case VGA_QXL:
1970         return pci_create_simple(bus, -1, "qxl-vga");
1971     case VGA_STD:
1972         return pci_create_simple(bus, -1, "VGA");
1973     case VGA_VMWARE:
1974         return pci_create_simple(bus, -1, "vmware-svga");
1975     case VGA_VIRTIO:
1976         return pci_create_simple(bus, -1, "virtio-vga");
1977     case VGA_NONE:
1978     default: /* Other non-PCI types. Checking for unsupported types is already
1979                 done in vl.c. */
1980         return NULL;
1981     }
1982 }
1983 
1984 /* Whether a given bus number is in range of the secondary
1985  * bus of the given bridge device. */
1986 static bool pci_secondary_bus_in_range(PCIDevice *dev, int bus_num)
1987 {
1988     return !(pci_get_word(dev->config + PCI_BRIDGE_CONTROL) &
1989              PCI_BRIDGE_CTL_BUS_RESET) /* Don't walk the bus if it's reset. */ &&
1990         dev->config[PCI_SECONDARY_BUS] <= bus_num &&
1991         bus_num <= dev->config[PCI_SUBORDINATE_BUS];
1992 }
1993 
1994 /* Whether a given bus number is in a range of a root bus */
1995 static bool pci_root_bus_in_range(PCIBus *bus, int bus_num)
1996 {
1997     int i;
1998 
1999     for (i = 0; i < ARRAY_SIZE(bus->devices); ++i) {
2000         PCIDevice *dev = bus->devices[i];
2001 
2002         if (dev && PCI_DEVICE_GET_CLASS(dev)->is_bridge) {
2003             if (pci_secondary_bus_in_range(dev, bus_num)) {
2004                 return true;
2005             }
2006         }
2007     }
2008 
2009     return false;
2010 }
2011 
2012 static PCIBus *pci_find_bus_nr(PCIBus *bus, int bus_num)
2013 {
2014     PCIBus *sec;
2015 
2016     if (!bus) {
2017         return NULL;
2018     }
2019 
2020     if (pci_bus_num(bus) == bus_num) {
2021         return bus;
2022     }
2023 
2024     /* Consider all bus numbers in range for the host pci bridge. */
2025     if (!pci_bus_is_root(bus) &&
2026         !pci_secondary_bus_in_range(bus->parent_dev, bus_num)) {
2027         return NULL;
2028     }
2029 
2030     /* try child bus */
2031     for (; bus; bus = sec) {
2032         QLIST_FOREACH(sec, &bus->child, sibling) {
2033             if (pci_bus_num(sec) == bus_num) {
2034                 return sec;
2035             }
2036             /* PXB buses assumed to be children of bus 0 */
2037             if (pci_bus_is_root(sec)) {
2038                 if (pci_root_bus_in_range(sec, bus_num)) {
2039                     break;
2040                 }
2041             } else {
2042                 if (pci_secondary_bus_in_range(sec->parent_dev, bus_num)) {
2043                     break;
2044                 }
2045             }
2046         }
2047     }
2048 
2049     return NULL;
2050 }
2051 
2052 void pci_for_each_bus_depth_first(PCIBus *bus,
2053                                   void *(*begin)(PCIBus *bus, void *parent_state),
2054                                   void (*end)(PCIBus *bus, void *state),
2055                                   void *parent_state)
2056 {
2057     PCIBus *sec;
2058     void *state;
2059 
2060     if (!bus) {
2061         return;
2062     }
2063 
2064     if (begin) {
2065         state = begin(bus, parent_state);
2066     } else {
2067         state = parent_state;
2068     }
2069 
2070     QLIST_FOREACH(sec, &bus->child, sibling) {
2071         pci_for_each_bus_depth_first(sec, begin, end, state);
2072     }
2073 
2074     if (end) {
2075         end(bus, state);
2076     }
2077 }
2078 
2079 
2080 PCIDevice *pci_find_device(PCIBus *bus, int bus_num, uint8_t devfn)
2081 {
2082     bus = pci_find_bus_nr(bus, bus_num);
2083 
2084     if (!bus)
2085         return NULL;
2086 
2087     return bus->devices[devfn];
2088 }
2089 
2090 static void pci_qdev_realize(DeviceState *qdev, Error **errp)
2091 {
2092     PCIDevice *pci_dev = (PCIDevice *)qdev;
2093     PCIDeviceClass *pc = PCI_DEVICE_GET_CLASS(pci_dev);
2094     ObjectClass *klass = OBJECT_CLASS(pc);
2095     Error *local_err = NULL;
2096     bool is_default_rom;
2097     uint16_t class_id;
2098 
2099     /* initialize cap_present for pci_is_express() and pci_config_size(),
2100      * Note that hybrid PCIs are not set automatically and need to manage
2101      * QEMU_PCI_CAP_EXPRESS manually */
2102     if (object_class_dynamic_cast(klass, INTERFACE_PCIE_DEVICE) &&
2103        !object_class_dynamic_cast(klass, INTERFACE_CONVENTIONAL_PCI_DEVICE)) {
2104         pci_dev->cap_present |= QEMU_PCI_CAP_EXPRESS;
2105     }
2106 
2107     pci_dev = do_pci_register_device(pci_dev,
2108                                      object_get_typename(OBJECT(qdev)),
2109                                      pci_dev->devfn, errp);
2110     if (pci_dev == NULL)
2111         return;
2112 
2113     if (pc->realize) {
2114         pc->realize(pci_dev, &local_err);
2115         if (local_err) {
2116             error_propagate(errp, local_err);
2117             do_pci_unregister_device(pci_dev);
2118             return;
2119         }
2120     }
2121 
2122     if (pci_dev->failover_pair_id) {
2123         if (!pci_bus_is_express(pci_get_bus(pci_dev))) {
2124             error_setg(errp, "failover primary device must be on "
2125                              "PCIExpress bus");
2126             pci_qdev_unrealize(DEVICE(pci_dev));
2127             return;
2128         }
2129         class_id = pci_get_word(pci_dev->config + PCI_CLASS_DEVICE);
2130         if (class_id != PCI_CLASS_NETWORK_ETHERNET) {
2131             error_setg(errp, "failover primary device is not an "
2132                              "Ethernet device");
2133             pci_qdev_unrealize(DEVICE(pci_dev));
2134             return;
2135         }
2136         if (!(pci_dev->cap_present & QEMU_PCI_CAP_MULTIFUNCTION)
2137             && (PCI_FUNC(pci_dev->devfn) == 0)) {
2138             qdev->allow_unplug_during_migration = true;
2139         } else {
2140             error_setg(errp, "failover: primary device must be in its own "
2141                               "PCI slot");
2142             pci_qdev_unrealize(DEVICE(pci_dev));
2143             return;
2144         }
2145         qdev->allow_unplug_during_migration = true;
2146     }
2147 
2148     /* rom loading */
2149     is_default_rom = false;
2150     if (pci_dev->romfile == NULL && pc->romfile != NULL) {
2151         pci_dev->romfile = g_strdup(pc->romfile);
2152         is_default_rom = true;
2153     }
2154 
2155     pci_add_option_rom(pci_dev, is_default_rom, &local_err);
2156     if (local_err) {
2157         error_propagate(errp, local_err);
2158         pci_qdev_unrealize(DEVICE(pci_dev));
2159         return;
2160     }
2161 }
2162 
2163 PCIDevice *pci_new_multifunction(int devfn, bool multifunction,
2164                                  const char *name)
2165 {
2166     DeviceState *dev;
2167 
2168     dev = qdev_new(name);
2169     qdev_prop_set_int32(dev, "addr", devfn);
2170     qdev_prop_set_bit(dev, "multifunction", multifunction);
2171     return PCI_DEVICE(dev);
2172 }
2173 
2174 PCIDevice *pci_new(int devfn, const char *name)
2175 {
2176     return pci_new_multifunction(devfn, false, name);
2177 }
2178 
2179 bool pci_realize_and_unref(PCIDevice *dev, PCIBus *bus, Error **errp)
2180 {
2181     return qdev_realize_and_unref(&dev->qdev, &bus->qbus, errp);
2182 }
2183 
2184 PCIDevice *pci_create_simple_multifunction(PCIBus *bus, int devfn,
2185                                            bool multifunction,
2186                                            const char *name)
2187 {
2188     PCIDevice *dev = pci_new_multifunction(devfn, multifunction, name);
2189     pci_realize_and_unref(dev, bus, &error_fatal);
2190     return dev;
2191 }
2192 
2193 PCIDevice *pci_create_simple(PCIBus *bus, int devfn, const char *name)
2194 {
2195     return pci_create_simple_multifunction(bus, devfn, false, name);
2196 }
2197 
2198 static uint8_t pci_find_space(PCIDevice *pdev, uint8_t size)
2199 {
2200     int offset = PCI_CONFIG_HEADER_SIZE;
2201     int i;
2202     for (i = PCI_CONFIG_HEADER_SIZE; i < PCI_CONFIG_SPACE_SIZE; ++i) {
2203         if (pdev->used[i])
2204             offset = i + 1;
2205         else if (i - offset + 1 == size)
2206             return offset;
2207     }
2208     return 0;
2209 }
2210 
2211 static uint8_t pci_find_capability_list(PCIDevice *pdev, uint8_t cap_id,
2212                                         uint8_t *prev_p)
2213 {
2214     uint8_t next, prev;
2215 
2216     if (!(pdev->config[PCI_STATUS] & PCI_STATUS_CAP_LIST))
2217         return 0;
2218 
2219     for (prev = PCI_CAPABILITY_LIST; (next = pdev->config[prev]);
2220          prev = next + PCI_CAP_LIST_NEXT)
2221         if (pdev->config[next + PCI_CAP_LIST_ID] == cap_id)
2222             break;
2223 
2224     if (prev_p)
2225         *prev_p = prev;
2226     return next;
2227 }
2228 
2229 static uint8_t pci_find_capability_at_offset(PCIDevice *pdev, uint8_t offset)
2230 {
2231     uint8_t next, prev, found = 0;
2232 
2233     if (!(pdev->used[offset])) {
2234         return 0;
2235     }
2236 
2237     assert(pdev->config[PCI_STATUS] & PCI_STATUS_CAP_LIST);
2238 
2239     for (prev = PCI_CAPABILITY_LIST; (next = pdev->config[prev]);
2240          prev = next + PCI_CAP_LIST_NEXT) {
2241         if (next <= offset && next > found) {
2242             found = next;
2243         }
2244     }
2245     return found;
2246 }
2247 
2248 /* Patch the PCI vendor and device ids in a PCI rom image if necessary.
2249    This is needed for an option rom which is used for more than one device. */
2250 static void pci_patch_ids(PCIDevice *pdev, uint8_t *ptr, int size)
2251 {
2252     uint16_t vendor_id;
2253     uint16_t device_id;
2254     uint16_t rom_vendor_id;
2255     uint16_t rom_device_id;
2256     uint16_t rom_magic;
2257     uint16_t pcir_offset;
2258     uint8_t checksum;
2259 
2260     /* Words in rom data are little endian (like in PCI configuration),
2261        so they can be read / written with pci_get_word / pci_set_word. */
2262 
2263     /* Only a valid rom will be patched. */
2264     rom_magic = pci_get_word(ptr);
2265     if (rom_magic != 0xaa55) {
2266         PCI_DPRINTF("Bad ROM magic %04x\n", rom_magic);
2267         return;
2268     }
2269     pcir_offset = pci_get_word(ptr + 0x18);
2270     if (pcir_offset + 8 >= size || memcmp(ptr + pcir_offset, "PCIR", 4)) {
2271         PCI_DPRINTF("Bad PCIR offset 0x%x or signature\n", pcir_offset);
2272         return;
2273     }
2274 
2275     vendor_id = pci_get_word(pdev->config + PCI_VENDOR_ID);
2276     device_id = pci_get_word(pdev->config + PCI_DEVICE_ID);
2277     rom_vendor_id = pci_get_word(ptr + pcir_offset + 4);
2278     rom_device_id = pci_get_word(ptr + pcir_offset + 6);
2279 
2280     PCI_DPRINTF("%s: ROM id %04x%04x / PCI id %04x%04x\n", pdev->romfile,
2281                 vendor_id, device_id, rom_vendor_id, rom_device_id);
2282 
2283     checksum = ptr[6];
2284 
2285     if (vendor_id != rom_vendor_id) {
2286         /* Patch vendor id and checksum (at offset 6 for etherboot roms). */
2287         checksum += (uint8_t)rom_vendor_id + (uint8_t)(rom_vendor_id >> 8);
2288         checksum -= (uint8_t)vendor_id + (uint8_t)(vendor_id >> 8);
2289         PCI_DPRINTF("ROM checksum %02x / %02x\n", ptr[6], checksum);
2290         ptr[6] = checksum;
2291         pci_set_word(ptr + pcir_offset + 4, vendor_id);
2292     }
2293 
2294     if (device_id != rom_device_id) {
2295         /* Patch device id and checksum (at offset 6 for etherboot roms). */
2296         checksum += (uint8_t)rom_device_id + (uint8_t)(rom_device_id >> 8);
2297         checksum -= (uint8_t)device_id + (uint8_t)(device_id >> 8);
2298         PCI_DPRINTF("ROM checksum %02x / %02x\n", ptr[6], checksum);
2299         ptr[6] = checksum;
2300         pci_set_word(ptr + pcir_offset + 6, device_id);
2301     }
2302 }
2303 
2304 /* Add an option rom for the device */
2305 static void pci_add_option_rom(PCIDevice *pdev, bool is_default_rom,
2306                                Error **errp)
2307 {
2308     int size;
2309     char *path;
2310     void *ptr;
2311     char name[32];
2312     const VMStateDescription *vmsd;
2313 
2314     if (!pdev->romfile)
2315         return;
2316     if (strlen(pdev->romfile) == 0)
2317         return;
2318 
2319     if (!pdev->rom_bar) {
2320         /*
2321          * Load rom via fw_cfg instead of creating a rom bar,
2322          * for 0.11 compatibility.
2323          */
2324         int class = pci_get_word(pdev->config + PCI_CLASS_DEVICE);
2325 
2326         /*
2327          * Hot-plugged devices can't use the option ROM
2328          * if the rom bar is disabled.
2329          */
2330         if (DEVICE(pdev)->hotplugged) {
2331             error_setg(errp, "Hot-plugged device without ROM bar"
2332                        " can't have an option ROM");
2333             return;
2334         }
2335 
2336         if (class == 0x0300) {
2337             rom_add_vga(pdev->romfile);
2338         } else {
2339             rom_add_option(pdev->romfile, -1);
2340         }
2341         return;
2342     }
2343 
2344     path = qemu_find_file(QEMU_FILE_TYPE_BIOS, pdev->romfile);
2345     if (path == NULL) {
2346         path = g_strdup(pdev->romfile);
2347     }
2348 
2349     size = get_image_size(path);
2350     if (size < 0) {
2351         error_setg(errp, "failed to find romfile \"%s\"", pdev->romfile);
2352         g_free(path);
2353         return;
2354     } else if (size == 0) {
2355         error_setg(errp, "romfile \"%s\" is empty", pdev->romfile);
2356         g_free(path);
2357         return;
2358     }
2359     size = pow2ceil(size);
2360 
2361     vmsd = qdev_get_vmsd(DEVICE(pdev));
2362 
2363     if (vmsd) {
2364         snprintf(name, sizeof(name), "%s.rom", vmsd->name);
2365     } else {
2366         snprintf(name, sizeof(name), "%s.rom", object_get_typename(OBJECT(pdev)));
2367     }
2368     pdev->has_rom = true;
2369     memory_region_init_rom(&pdev->rom, OBJECT(pdev), name, size, &error_fatal);
2370     ptr = memory_region_get_ram_ptr(&pdev->rom);
2371     if (load_image_size(path, ptr, size) < 0) {
2372         error_setg(errp, "failed to load romfile \"%s\"", pdev->romfile);
2373         g_free(path);
2374         return;
2375     }
2376     g_free(path);
2377 
2378     if (is_default_rom) {
2379         /* Only the default rom images will be patched (if needed). */
2380         pci_patch_ids(pdev, ptr, size);
2381     }
2382 
2383     pci_register_bar(pdev, PCI_ROM_SLOT, 0, &pdev->rom);
2384 }
2385 
2386 static void pci_del_option_rom(PCIDevice *pdev)
2387 {
2388     if (!pdev->has_rom)
2389         return;
2390 
2391     vmstate_unregister_ram(&pdev->rom, &pdev->qdev);
2392     pdev->has_rom = false;
2393 }
2394 
2395 /*
2396  * On success, pci_add_capability() returns a positive value
2397  * that the offset of the pci capability.
2398  * On failure, it sets an error and returns a negative error
2399  * code.
2400  */
2401 int pci_add_capability(PCIDevice *pdev, uint8_t cap_id,
2402                        uint8_t offset, uint8_t size,
2403                        Error **errp)
2404 {
2405     uint8_t *config;
2406     int i, overlapping_cap;
2407 
2408     if (!offset) {
2409         offset = pci_find_space(pdev, size);
2410         /* out of PCI config space is programming error */
2411         assert(offset);
2412     } else {
2413         /* Verify that capabilities don't overlap.  Note: device assignment
2414          * depends on this check to verify that the device is not broken.
2415          * Should never trigger for emulated devices, but it's helpful
2416          * for debugging these. */
2417         for (i = offset; i < offset + size; i++) {
2418             overlapping_cap = pci_find_capability_at_offset(pdev, i);
2419             if (overlapping_cap) {
2420                 error_setg(errp, "%s:%02x:%02x.%x "
2421                            "Attempt to add PCI capability %x at offset "
2422                            "%x overlaps existing capability %x at offset %x",
2423                            pci_root_bus_path(pdev), pci_dev_bus_num(pdev),
2424                            PCI_SLOT(pdev->devfn), PCI_FUNC(pdev->devfn),
2425                            cap_id, offset, overlapping_cap, i);
2426                 return -EINVAL;
2427             }
2428         }
2429     }
2430 
2431     config = pdev->config + offset;
2432     config[PCI_CAP_LIST_ID] = cap_id;
2433     config[PCI_CAP_LIST_NEXT] = pdev->config[PCI_CAPABILITY_LIST];
2434     pdev->config[PCI_CAPABILITY_LIST] = offset;
2435     pdev->config[PCI_STATUS] |= PCI_STATUS_CAP_LIST;
2436     memset(pdev->used + offset, 0xFF, QEMU_ALIGN_UP(size, 4));
2437     /* Make capability read-only by default */
2438     memset(pdev->wmask + offset, 0, size);
2439     /* Check capability by default */
2440     memset(pdev->cmask + offset, 0xFF, size);
2441     return offset;
2442 }
2443 
2444 /* Unlink capability from the pci config space. */
2445 void pci_del_capability(PCIDevice *pdev, uint8_t cap_id, uint8_t size)
2446 {
2447     uint8_t prev, offset = pci_find_capability_list(pdev, cap_id, &prev);
2448     if (!offset)
2449         return;
2450     pdev->config[prev] = pdev->config[offset + PCI_CAP_LIST_NEXT];
2451     /* Make capability writable again */
2452     memset(pdev->wmask + offset, 0xff, size);
2453     memset(pdev->w1cmask + offset, 0, size);
2454     /* Clear cmask as device-specific registers can't be checked */
2455     memset(pdev->cmask + offset, 0, size);
2456     memset(pdev->used + offset, 0, QEMU_ALIGN_UP(size, 4));
2457 
2458     if (!pdev->config[PCI_CAPABILITY_LIST])
2459         pdev->config[PCI_STATUS] &= ~PCI_STATUS_CAP_LIST;
2460 }
2461 
2462 uint8_t pci_find_capability(PCIDevice *pdev, uint8_t cap_id)
2463 {
2464     return pci_find_capability_list(pdev, cap_id, NULL);
2465 }
2466 
2467 static void pcibus_dev_print(Monitor *mon, DeviceState *dev, int indent)
2468 {
2469     PCIDevice *d = (PCIDevice *)dev;
2470     const pci_class_desc *desc;
2471     char ctxt[64];
2472     PCIIORegion *r;
2473     int i, class;
2474 
2475     class = pci_get_word(d->config + PCI_CLASS_DEVICE);
2476     desc = pci_class_descriptions;
2477     while (desc->desc && class != desc->class)
2478         desc++;
2479     if (desc->desc) {
2480         snprintf(ctxt, sizeof(ctxt), "%s", desc->desc);
2481     } else {
2482         snprintf(ctxt, sizeof(ctxt), "Class %04x", class);
2483     }
2484 
2485     monitor_printf(mon, "%*sclass %s, addr %02x:%02x.%x, "
2486                    "pci id %04x:%04x (sub %04x:%04x)\n",
2487                    indent, "", ctxt, pci_dev_bus_num(d),
2488                    PCI_SLOT(d->devfn), PCI_FUNC(d->devfn),
2489                    pci_get_word(d->config + PCI_VENDOR_ID),
2490                    pci_get_word(d->config + PCI_DEVICE_ID),
2491                    pci_get_word(d->config + PCI_SUBSYSTEM_VENDOR_ID),
2492                    pci_get_word(d->config + PCI_SUBSYSTEM_ID));
2493     for (i = 0; i < PCI_NUM_REGIONS; i++) {
2494         r = &d->io_regions[i];
2495         if (!r->size)
2496             continue;
2497         monitor_printf(mon, "%*sbar %d: %s at 0x%"FMT_PCIBUS
2498                        " [0x%"FMT_PCIBUS"]\n",
2499                        indent, "",
2500                        i, r->type & PCI_BASE_ADDRESS_SPACE_IO ? "i/o" : "mem",
2501                        r->addr, r->addr + r->size - 1);
2502     }
2503 }
2504 
2505 static char *pci_dev_fw_name(DeviceState *dev, char *buf, int len)
2506 {
2507     PCIDevice *d = (PCIDevice *)dev;
2508     const char *name = NULL;
2509     const pci_class_desc *desc =  pci_class_descriptions;
2510     int class = pci_get_word(d->config + PCI_CLASS_DEVICE);
2511 
2512     while (desc->desc &&
2513           (class & ~desc->fw_ign_bits) !=
2514           (desc->class & ~desc->fw_ign_bits)) {
2515         desc++;
2516     }
2517 
2518     if (desc->desc) {
2519         name = desc->fw_name;
2520     }
2521 
2522     if (name) {
2523         pstrcpy(buf, len, name);
2524     } else {
2525         snprintf(buf, len, "pci%04x,%04x",
2526                  pci_get_word(d->config + PCI_VENDOR_ID),
2527                  pci_get_word(d->config + PCI_DEVICE_ID));
2528     }
2529 
2530     return buf;
2531 }
2532 
2533 static char *pcibus_get_fw_dev_path(DeviceState *dev)
2534 {
2535     PCIDevice *d = (PCIDevice *)dev;
2536     char path[50], name[33];
2537     int off;
2538 
2539     off = snprintf(path, sizeof(path), "%s@%x",
2540                    pci_dev_fw_name(dev, name, sizeof name),
2541                    PCI_SLOT(d->devfn));
2542     if (PCI_FUNC(d->devfn))
2543         snprintf(path + off, sizeof(path) + off, ",%x", PCI_FUNC(d->devfn));
2544     return g_strdup(path);
2545 }
2546 
2547 static char *pcibus_get_dev_path(DeviceState *dev)
2548 {
2549     PCIDevice *d = container_of(dev, PCIDevice, qdev);
2550     PCIDevice *t;
2551     int slot_depth;
2552     /* Path format: Domain:00:Slot.Function:Slot.Function....:Slot.Function.
2553      * 00 is added here to make this format compatible with
2554      * domain:Bus:Slot.Func for systems without nested PCI bridges.
2555      * Slot.Function list specifies the slot and function numbers for all
2556      * devices on the path from root to the specific device. */
2557     const char *root_bus_path;
2558     int root_bus_len;
2559     char slot[] = ":SS.F";
2560     int slot_len = sizeof slot - 1 /* For '\0' */;
2561     int path_len;
2562     char *path, *p;
2563     int s;
2564 
2565     root_bus_path = pci_root_bus_path(d);
2566     root_bus_len = strlen(root_bus_path);
2567 
2568     /* Calculate # of slots on path between device and root. */;
2569     slot_depth = 0;
2570     for (t = d; t; t = pci_get_bus(t)->parent_dev) {
2571         ++slot_depth;
2572     }
2573 
2574     path_len = root_bus_len + slot_len * slot_depth;
2575 
2576     /* Allocate memory, fill in the terminating null byte. */
2577     path = g_malloc(path_len + 1 /* For '\0' */);
2578     path[path_len] = '\0';
2579 
2580     memcpy(path, root_bus_path, root_bus_len);
2581 
2582     /* Fill in slot numbers. We walk up from device to root, so need to print
2583      * them in the reverse order, last to first. */
2584     p = path + path_len;
2585     for (t = d; t; t = pci_get_bus(t)->parent_dev) {
2586         p -= slot_len;
2587         s = snprintf(slot, sizeof slot, ":%02x.%x",
2588                      PCI_SLOT(t->devfn), PCI_FUNC(t->devfn));
2589         assert(s == slot_len);
2590         memcpy(p, slot, slot_len);
2591     }
2592 
2593     return path;
2594 }
2595 
2596 static int pci_qdev_find_recursive(PCIBus *bus,
2597                                    const char *id, PCIDevice **pdev)
2598 {
2599     DeviceState *qdev = qdev_find_recursive(&bus->qbus, id);
2600     if (!qdev) {
2601         return -ENODEV;
2602     }
2603 
2604     /* roughly check if given qdev is pci device */
2605     if (object_dynamic_cast(OBJECT(qdev), TYPE_PCI_DEVICE)) {
2606         *pdev = PCI_DEVICE(qdev);
2607         return 0;
2608     }
2609     return -EINVAL;
2610 }
2611 
2612 int pci_qdev_find_device(const char *id, PCIDevice **pdev)
2613 {
2614     PCIHostState *host_bridge;
2615     int rc = -ENODEV;
2616 
2617     QLIST_FOREACH(host_bridge, &pci_host_bridges, next) {
2618         int tmp = pci_qdev_find_recursive(host_bridge->bus, id, pdev);
2619         if (!tmp) {
2620             rc = 0;
2621             break;
2622         }
2623         if (tmp != -ENODEV) {
2624             rc = tmp;
2625         }
2626     }
2627 
2628     return rc;
2629 }
2630 
2631 MemoryRegion *pci_address_space(PCIDevice *dev)
2632 {
2633     return pci_get_bus(dev)->address_space_mem;
2634 }
2635 
2636 MemoryRegion *pci_address_space_io(PCIDevice *dev)
2637 {
2638     return pci_get_bus(dev)->address_space_io;
2639 }
2640 
2641 static void pci_device_class_init(ObjectClass *klass, void *data)
2642 {
2643     DeviceClass *k = DEVICE_CLASS(klass);
2644 
2645     k->realize = pci_qdev_realize;
2646     k->unrealize = pci_qdev_unrealize;
2647     k->bus_type = TYPE_PCI_BUS;
2648     device_class_set_props(k, pci_props);
2649 }
2650 
2651 static void pci_device_class_base_init(ObjectClass *klass, void *data)
2652 {
2653     if (!object_class_is_abstract(klass)) {
2654         ObjectClass *conventional =
2655             object_class_dynamic_cast(klass, INTERFACE_CONVENTIONAL_PCI_DEVICE);
2656         ObjectClass *pcie =
2657             object_class_dynamic_cast(klass, INTERFACE_PCIE_DEVICE);
2658         assert(conventional || pcie);
2659     }
2660 }
2661 
2662 AddressSpace *pci_device_iommu_address_space(PCIDevice *dev)
2663 {
2664     PCIBus *bus = pci_get_bus(dev);
2665     PCIBus *iommu_bus = bus;
2666     uint8_t devfn = dev->devfn;
2667 
2668     while (iommu_bus && !iommu_bus->iommu_fn && iommu_bus->parent_dev) {
2669         PCIBus *parent_bus = pci_get_bus(iommu_bus->parent_dev);
2670 
2671         /*
2672          * The requester ID of the provided device may be aliased, as seen from
2673          * the IOMMU, due to topology limitations.  The IOMMU relies on a
2674          * requester ID to provide a unique AddressSpace for devices, but
2675          * conventional PCI buses pre-date such concepts.  Instead, the PCIe-
2676          * to-PCI bridge creates and accepts transactions on behalf of down-
2677          * stream devices.  When doing so, all downstream devices are masked
2678          * (aliased) behind a single requester ID.  The requester ID used
2679          * depends on the format of the bridge devices.  Proper PCIe-to-PCI
2680          * bridges, with a PCIe capability indicating such, follow the
2681          * guidelines of chapter 2.3 of the PCIe-to-PCI/X bridge specification,
2682          * where the bridge uses the seconary bus as the bridge portion of the
2683          * requester ID and devfn of 00.0.  For other bridges, typically those
2684          * found on the root complex such as the dmi-to-pci-bridge, we follow
2685          * the convention of typical bare-metal hardware, which uses the
2686          * requester ID of the bridge itself.  There are device specific
2687          * exceptions to these rules, but these are the defaults that the
2688          * Linux kernel uses when determining DMA aliases itself and believed
2689          * to be true for the bare metal equivalents of the devices emulated
2690          * in QEMU.
2691          */
2692         if (!pci_bus_is_express(iommu_bus)) {
2693             PCIDevice *parent = iommu_bus->parent_dev;
2694 
2695             if (pci_is_express(parent) &&
2696                 pcie_cap_get_type(parent) == PCI_EXP_TYPE_PCI_BRIDGE) {
2697                 devfn = PCI_DEVFN(0, 0);
2698                 bus = iommu_bus;
2699             } else {
2700                 devfn = parent->devfn;
2701                 bus = parent_bus;
2702             }
2703         }
2704 
2705         iommu_bus = parent_bus;
2706     }
2707     if (iommu_bus && iommu_bus->iommu_fn) {
2708         return iommu_bus->iommu_fn(bus, iommu_bus->iommu_opaque, devfn);
2709     }
2710     return &address_space_memory;
2711 }
2712 
2713 void pci_setup_iommu(PCIBus *bus, PCIIOMMUFunc fn, void *opaque)
2714 {
2715     bus->iommu_fn = fn;
2716     bus->iommu_opaque = opaque;
2717 }
2718 
2719 static void pci_dev_get_w64(PCIBus *b, PCIDevice *dev, void *opaque)
2720 {
2721     Range *range = opaque;
2722     PCIDeviceClass *pc = PCI_DEVICE_GET_CLASS(dev);
2723     uint16_t cmd = pci_get_word(dev->config + PCI_COMMAND);
2724     int i;
2725 
2726     if (!(cmd & PCI_COMMAND_MEMORY)) {
2727         return;
2728     }
2729 
2730     if (pc->is_bridge) {
2731         pcibus_t base = pci_bridge_get_base(dev, PCI_BASE_ADDRESS_MEM_PREFETCH);
2732         pcibus_t limit = pci_bridge_get_limit(dev, PCI_BASE_ADDRESS_MEM_PREFETCH);
2733 
2734         base = MAX(base, 0x1ULL << 32);
2735 
2736         if (limit >= base) {
2737             Range pref_range;
2738             range_set_bounds(&pref_range, base, limit);
2739             range_extend(range, &pref_range);
2740         }
2741     }
2742     for (i = 0; i < PCI_NUM_REGIONS; ++i) {
2743         PCIIORegion *r = &dev->io_regions[i];
2744         pcibus_t lob, upb;
2745         Range region_range;
2746 
2747         if (!r->size ||
2748             (r->type & PCI_BASE_ADDRESS_SPACE_IO) ||
2749             !(r->type & PCI_BASE_ADDRESS_MEM_TYPE_64)) {
2750             continue;
2751         }
2752 
2753         lob = pci_bar_address(dev, i, r->type, r->size);
2754         upb = lob + r->size - 1;
2755         if (lob == PCI_BAR_UNMAPPED) {
2756             continue;
2757         }
2758 
2759         lob = MAX(lob, 0x1ULL << 32);
2760 
2761         if (upb >= lob) {
2762             range_set_bounds(&region_range, lob, upb);
2763             range_extend(range, &region_range);
2764         }
2765     }
2766 }
2767 
2768 void pci_bus_get_w64_range(PCIBus *bus, Range *range)
2769 {
2770     range_make_empty(range);
2771     pci_for_each_device_under_bus(bus, pci_dev_get_w64, range);
2772 }
2773 
2774 static bool pcie_has_upstream_port(PCIDevice *dev)
2775 {
2776     PCIDevice *parent_dev = pci_bridge_get_device(pci_get_bus(dev));
2777 
2778     /* Device associated with an upstream port.
2779      * As there are several types of these, it's easier to check the
2780      * parent device: upstream ports are always connected to
2781      * root or downstream ports.
2782      */
2783     return parent_dev &&
2784         pci_is_express(parent_dev) &&
2785         parent_dev->exp.exp_cap &&
2786         (pcie_cap_get_type(parent_dev) == PCI_EXP_TYPE_ROOT_PORT ||
2787          pcie_cap_get_type(parent_dev) == PCI_EXP_TYPE_DOWNSTREAM);
2788 }
2789 
2790 PCIDevice *pci_get_function_0(PCIDevice *pci_dev)
2791 {
2792     PCIBus *bus = pci_get_bus(pci_dev);
2793 
2794     if(pcie_has_upstream_port(pci_dev)) {
2795         /* With an upstream PCIe port, we only support 1 device at slot 0 */
2796         return bus->devices[0];
2797     } else {
2798         /* Other bus types might support multiple devices at slots 0-31 */
2799         return bus->devices[PCI_DEVFN(PCI_SLOT(pci_dev->devfn), 0)];
2800     }
2801 }
2802 
2803 MSIMessage pci_get_msi_message(PCIDevice *dev, int vector)
2804 {
2805     MSIMessage msg;
2806     if (msix_enabled(dev)) {
2807         msg = msix_get_message(dev, vector);
2808     } else if (msi_enabled(dev)) {
2809         msg = msi_get_message(dev, vector);
2810     } else {
2811         /* Should never happen */
2812         error_report("%s: unknown interrupt type", __func__);
2813         abort();
2814     }
2815     return msg;
2816 }
2817 
2818 static const TypeInfo pci_device_type_info = {
2819     .name = TYPE_PCI_DEVICE,
2820     .parent = TYPE_DEVICE,
2821     .instance_size = sizeof(PCIDevice),
2822     .abstract = true,
2823     .class_size = sizeof(PCIDeviceClass),
2824     .class_init = pci_device_class_init,
2825     .class_base_init = pci_device_class_base_init,
2826 };
2827 
2828 static void pci_register_types(void)
2829 {
2830     type_register_static(&pci_bus_info);
2831     type_register_static(&pcie_bus_info);
2832     type_register_static(&conventional_pci_interface_info);
2833     type_register_static(&pcie_interface_info);
2834     type_register_static(&pci_device_type_info);
2835 }
2836 
2837 type_init(pci_register_types)
2838