Introductory comment for rtl8168 VFIO MSI-X quirk states: At BAR2 offset 0x70 there is a dword data register, offset 0x74 is a dword address register. vfio: vfio_bar_read(0000:05:00.0:BAR2+0x70, 4) = 0xfee00398 // read data Thus, correct offset for data read is 0x70, but function vfio_rtl8168_quirk_data_read() wrongfully uses offset 0x74. Signed-off-by: Thorsten Kohfeldt <thorsten.kohfeldt@gmx.de> Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
1849 lines
64 KiB
C
1849 lines
64 KiB
C
/*
|
|
* device quirks for PCI devices
|
|
*
|
|
* Copyright Red Hat, Inc. 2012-2015
|
|
*
|
|
* Authors:
|
|
* Alex Williamson <alex.williamson@redhat.com>
|
|
*
|
|
* This work is licensed under the terms of the GNU GPL, version 2. See
|
|
* the COPYING file in the top-level directory.
|
|
*/
|
|
|
|
#include "qemu/osdep.h"
|
|
#include "qemu/error-report.h"
|
|
#include "qemu/range.h"
|
|
#include "qapi/error.h"
|
|
#include "hw/nvram/fw_cfg.h"
|
|
#include "pci.h"
|
|
#include "trace.h"
|
|
|
|
/* Use uin32_t for vendor & device so PCI_ANY_ID expands and cannot match hw */
|
|
static bool vfio_pci_is(VFIOPCIDevice *vdev, uint32_t vendor, uint32_t device)
|
|
{
|
|
return (vendor == PCI_ANY_ID || vendor == vdev->vendor_id) &&
|
|
(device == PCI_ANY_ID || device == vdev->device_id);
|
|
}
|
|
|
|
static bool vfio_is_vga(VFIOPCIDevice *vdev)
|
|
{
|
|
PCIDevice *pdev = &vdev->pdev;
|
|
uint16_t class = pci_get_word(pdev->config + PCI_CLASS_DEVICE);
|
|
|
|
return class == PCI_CLASS_DISPLAY_VGA;
|
|
}
|
|
|
|
/*
|
|
* List of device ids/vendor ids for which to disable
|
|
* option rom loading. This avoids the guest hangs during rom
|
|
* execution as noticed with the BCM 57810 card for lack of a
|
|
* more better way to handle such issues.
|
|
* The user can still override by specifying a romfile or
|
|
* rombar=1.
|
|
* Please see https://bugs.launchpad.net/qemu/+bug/1284874
|
|
* for an analysis of the 57810 card hang. When adding
|
|
* a new vendor id/device id combination below, please also add
|
|
* your card/environment details and information that could
|
|
* help in debugging to the bug tracking this issue
|
|
*/
|
|
static const struct {
|
|
uint32_t vendor;
|
|
uint32_t device;
|
|
} romblacklist[] = {
|
|
{ 0x14e4, 0x168e }, /* Broadcom BCM 57810 */
|
|
};
|
|
|
|
bool vfio_blacklist_opt_rom(VFIOPCIDevice *vdev)
|
|
{
|
|
int i;
|
|
|
|
for (i = 0 ; i < ARRAY_SIZE(romblacklist); i++) {
|
|
if (vfio_pci_is(vdev, romblacklist[i].vendor, romblacklist[i].device)) {
|
|
trace_vfio_quirk_rom_blacklisted(vdev->vbasedev.name,
|
|
romblacklist[i].vendor,
|
|
romblacklist[i].device);
|
|
return true;
|
|
}
|
|
}
|
|
return false;
|
|
}
|
|
|
|
/*
|
|
* Device specific region quirks (mostly backdoors to PCI config space)
|
|
*/
|
|
|
|
/*
|
|
* The generic window quirks operate on an address and data register,
|
|
* vfio_generic_window_address_quirk handles the address register and
|
|
* vfio_generic_window_data_quirk handles the data register. These ops
|
|
* pass reads and writes through to hardware until a value matching the
|
|
* stored address match/mask is written. When this occurs, the data
|
|
* register access emulated PCI config space for the device rather than
|
|
* passing through accesses. This enables devices where PCI config space
|
|
* is accessible behind a window register to maintain the virtualization
|
|
* provided through vfio.
|
|
*/
|
|
typedef struct VFIOConfigWindowMatch {
|
|
uint32_t match;
|
|
uint32_t mask;
|
|
} VFIOConfigWindowMatch;
|
|
|
|
typedef struct VFIOConfigWindowQuirk {
|
|
struct VFIOPCIDevice *vdev;
|
|
|
|
uint32_t address_val;
|
|
|
|
uint32_t address_offset;
|
|
uint32_t data_offset;
|
|
|
|
bool window_enabled;
|
|
uint8_t bar;
|
|
|
|
MemoryRegion *addr_mem;
|
|
MemoryRegion *data_mem;
|
|
|
|
uint32_t nr_matches;
|
|
VFIOConfigWindowMatch matches[];
|
|
} VFIOConfigWindowQuirk;
|
|
|
|
static uint64_t vfio_generic_window_quirk_address_read(void *opaque,
|
|
hwaddr addr,
|
|
unsigned size)
|
|
{
|
|
VFIOConfigWindowQuirk *window = opaque;
|
|
VFIOPCIDevice *vdev = window->vdev;
|
|
|
|
return vfio_region_read(&vdev->bars[window->bar].region,
|
|
addr + window->address_offset, size);
|
|
}
|
|
|
|
static void vfio_generic_window_quirk_address_write(void *opaque, hwaddr addr,
|
|
uint64_t data,
|
|
unsigned size)
|
|
{
|
|
VFIOConfigWindowQuirk *window = opaque;
|
|
VFIOPCIDevice *vdev = window->vdev;
|
|
int i;
|
|
|
|
window->window_enabled = false;
|
|
|
|
vfio_region_write(&vdev->bars[window->bar].region,
|
|
addr + window->address_offset, data, size);
|
|
|
|
for (i = 0; i < window->nr_matches; i++) {
|
|
if ((data & ~window->matches[i].mask) == window->matches[i].match) {
|
|
window->window_enabled = true;
|
|
window->address_val = data & window->matches[i].mask;
|
|
trace_vfio_quirk_generic_window_address_write(vdev->vbasedev.name,
|
|
memory_region_name(window->addr_mem), data);
|
|
break;
|
|
}
|
|
}
|
|
}
|
|
|
|
static const MemoryRegionOps vfio_generic_window_address_quirk = {
|
|
.read = vfio_generic_window_quirk_address_read,
|
|
.write = vfio_generic_window_quirk_address_write,
|
|
.endianness = DEVICE_LITTLE_ENDIAN,
|
|
};
|
|
|
|
static uint64_t vfio_generic_window_quirk_data_read(void *opaque,
|
|
hwaddr addr, unsigned size)
|
|
{
|
|
VFIOConfigWindowQuirk *window = opaque;
|
|
VFIOPCIDevice *vdev = window->vdev;
|
|
uint64_t data;
|
|
|
|
/* Always read data reg, discard if window enabled */
|
|
data = vfio_region_read(&vdev->bars[window->bar].region,
|
|
addr + window->data_offset, size);
|
|
|
|
if (window->window_enabled) {
|
|
data = vfio_pci_read_config(&vdev->pdev, window->address_val, size);
|
|
trace_vfio_quirk_generic_window_data_read(vdev->vbasedev.name,
|
|
memory_region_name(window->data_mem), data);
|
|
}
|
|
|
|
return data;
|
|
}
|
|
|
|
static void vfio_generic_window_quirk_data_write(void *opaque, hwaddr addr,
|
|
uint64_t data, unsigned size)
|
|
{
|
|
VFIOConfigWindowQuirk *window = opaque;
|
|
VFIOPCIDevice *vdev = window->vdev;
|
|
|
|
if (window->window_enabled) {
|
|
vfio_pci_write_config(&vdev->pdev, window->address_val, data, size);
|
|
trace_vfio_quirk_generic_window_data_write(vdev->vbasedev.name,
|
|
memory_region_name(window->data_mem), data);
|
|
return;
|
|
}
|
|
|
|
vfio_region_write(&vdev->bars[window->bar].region,
|
|
addr + window->data_offset, data, size);
|
|
}
|
|
|
|
static const MemoryRegionOps vfio_generic_window_data_quirk = {
|
|
.read = vfio_generic_window_quirk_data_read,
|
|
.write = vfio_generic_window_quirk_data_write,
|
|
.endianness = DEVICE_LITTLE_ENDIAN,
|
|
};
|
|
|
|
/*
|
|
* The generic mirror quirk handles devices which expose PCI config space
|
|
* through a region within a BAR. When enabled, reads and writes are
|
|
* redirected through to emulated PCI config space. XXX if PCI config space
|
|
* used memory regions, this could just be an alias.
|
|
*/
|
|
typedef struct VFIOConfigMirrorQuirk {
|
|
struct VFIOPCIDevice *vdev;
|
|
uint32_t offset;
|
|
uint8_t bar;
|
|
MemoryRegion *mem;
|
|
} VFIOConfigMirrorQuirk;
|
|
|
|
static uint64_t vfio_generic_quirk_mirror_read(void *opaque,
|
|
hwaddr addr, unsigned size)
|
|
{
|
|
VFIOConfigMirrorQuirk *mirror = opaque;
|
|
VFIOPCIDevice *vdev = mirror->vdev;
|
|
uint64_t data;
|
|
|
|
/* Read and discard in case the hardware cares */
|
|
(void)vfio_region_read(&vdev->bars[mirror->bar].region,
|
|
addr + mirror->offset, size);
|
|
|
|
data = vfio_pci_read_config(&vdev->pdev, addr, size);
|
|
trace_vfio_quirk_generic_mirror_read(vdev->vbasedev.name,
|
|
memory_region_name(mirror->mem),
|
|
addr, data);
|
|
return data;
|
|
}
|
|
|
|
static void vfio_generic_quirk_mirror_write(void *opaque, hwaddr addr,
|
|
uint64_t data, unsigned size)
|
|
{
|
|
VFIOConfigMirrorQuirk *mirror = opaque;
|
|
VFIOPCIDevice *vdev = mirror->vdev;
|
|
|
|
vfio_pci_write_config(&vdev->pdev, addr, data, size);
|
|
trace_vfio_quirk_generic_mirror_write(vdev->vbasedev.name,
|
|
memory_region_name(mirror->mem),
|
|
addr, data);
|
|
}
|
|
|
|
static const MemoryRegionOps vfio_generic_mirror_quirk = {
|
|
.read = vfio_generic_quirk_mirror_read,
|
|
.write = vfio_generic_quirk_mirror_write,
|
|
.endianness = DEVICE_LITTLE_ENDIAN,
|
|
};
|
|
|
|
/* Is range1 fully contained within range2? */
|
|
static bool vfio_range_contained(uint64_t first1, uint64_t len1,
|
|
uint64_t first2, uint64_t len2) {
|
|
return (first1 >= first2 && first1 + len1 <= first2 + len2);
|
|
}
|
|
|
|
#define PCI_VENDOR_ID_ATI 0x1002
|
|
|
|
/*
|
|
* Radeon HD cards (HD5450 & HD7850) report the upper byte of the I/O port BAR
|
|
* through VGA register 0x3c3. On newer cards, the I/O port BAR is always
|
|
* BAR4 (older cards like the X550 used BAR1, but we don't care to support
|
|
* those). Note that on bare metal, a read of 0x3c3 doesn't always return the
|
|
* I/O port BAR address. Originally this was coded to return the virtual BAR
|
|
* address only if the physical register read returns the actual BAR address,
|
|
* but users have reported greater success if we return the virtual address
|
|
* unconditionally.
|
|
*/
|
|
static uint64_t vfio_ati_3c3_quirk_read(void *opaque,
|
|
hwaddr addr, unsigned size)
|
|
{
|
|
VFIOPCIDevice *vdev = opaque;
|
|
uint64_t data = vfio_pci_read_config(&vdev->pdev,
|
|
PCI_BASE_ADDRESS_4 + 1, size);
|
|
|
|
trace_vfio_quirk_ati_3c3_read(vdev->vbasedev.name, data);
|
|
|
|
return data;
|
|
}
|
|
|
|
static const MemoryRegionOps vfio_ati_3c3_quirk = {
|
|
.read = vfio_ati_3c3_quirk_read,
|
|
.endianness = DEVICE_LITTLE_ENDIAN,
|
|
};
|
|
|
|
static void vfio_vga_probe_ati_3c3_quirk(VFIOPCIDevice *vdev)
|
|
{
|
|
VFIOQuirk *quirk;
|
|
|
|
/*
|
|
* As long as the BAR is >= 256 bytes it will be aligned such that the
|
|
* lower byte is always zero. Filter out anything else, if it exists.
|
|
*/
|
|
if (!vfio_pci_is(vdev, PCI_VENDOR_ID_ATI, PCI_ANY_ID) ||
|
|
!vdev->bars[4].ioport || vdev->bars[4].region.size < 256) {
|
|
return;
|
|
}
|
|
|
|
quirk = g_malloc0(sizeof(*quirk));
|
|
quirk->mem = g_new0(MemoryRegion, 1);
|
|
quirk->nr_mem = 1;
|
|
|
|
memory_region_init_io(quirk->mem, OBJECT(vdev), &vfio_ati_3c3_quirk, vdev,
|
|
"vfio-ati-3c3-quirk", 1);
|
|
memory_region_add_subregion(&vdev->vga->region[QEMU_PCI_VGA_IO_HI].mem,
|
|
3 /* offset 3 bytes from 0x3c0 */, quirk->mem);
|
|
|
|
QLIST_INSERT_HEAD(&vdev->vga->region[QEMU_PCI_VGA_IO_HI].quirks,
|
|
quirk, next);
|
|
|
|
trace_vfio_quirk_ati_3c3_probe(vdev->vbasedev.name);
|
|
}
|
|
|
|
/*
|
|
* Newer ATI/AMD devices, including HD5450 and HD7850, have a mirror to PCI
|
|
* config space through MMIO BAR2 at offset 0x4000. Nothing seems to access
|
|
* the MMIO space directly, but a window to this space is provided through
|
|
* I/O port BAR4. Offset 0x0 is the address register and offset 0x4 is the
|
|
* data register. When the address is programmed to a range of 0x4000-0x4fff
|
|
* PCI configuration space is available. Experimentation seems to indicate
|
|
* that read-only may be provided by hardware.
|
|
*/
|
|
static void vfio_probe_ati_bar4_quirk(VFIOPCIDevice *vdev, int nr)
|
|
{
|
|
VFIOQuirk *quirk;
|
|
VFIOConfigWindowQuirk *window;
|
|
|
|
/* This windows doesn't seem to be used except by legacy VGA code */
|
|
if (!vfio_pci_is(vdev, PCI_VENDOR_ID_ATI, PCI_ANY_ID) ||
|
|
!vdev->vga || nr != 4) {
|
|
return;
|
|
}
|
|
|
|
quirk = g_malloc0(sizeof(*quirk));
|
|
quirk->mem = g_new0(MemoryRegion, 2);
|
|
quirk->nr_mem = 2;
|
|
window = quirk->data = g_malloc0(sizeof(*window) +
|
|
sizeof(VFIOConfigWindowMatch));
|
|
window->vdev = vdev;
|
|
window->address_offset = 0;
|
|
window->data_offset = 4;
|
|
window->nr_matches = 1;
|
|
window->matches[0].match = 0x4000;
|
|
window->matches[0].mask = vdev->config_size - 1;
|
|
window->bar = nr;
|
|
window->addr_mem = &quirk->mem[0];
|
|
window->data_mem = &quirk->mem[1];
|
|
|
|
memory_region_init_io(window->addr_mem, OBJECT(vdev),
|
|
&vfio_generic_window_address_quirk, window,
|
|
"vfio-ati-bar4-window-address-quirk", 4);
|
|
memory_region_add_subregion_overlap(vdev->bars[nr].region.mem,
|
|
window->address_offset,
|
|
window->addr_mem, 1);
|
|
|
|
memory_region_init_io(window->data_mem, OBJECT(vdev),
|
|
&vfio_generic_window_data_quirk, window,
|
|
"vfio-ati-bar4-window-data-quirk", 4);
|
|
memory_region_add_subregion_overlap(vdev->bars[nr].region.mem,
|
|
window->data_offset,
|
|
window->data_mem, 1);
|
|
|
|
QLIST_INSERT_HEAD(&vdev->bars[nr].quirks, quirk, next);
|
|
|
|
trace_vfio_quirk_ati_bar4_probe(vdev->vbasedev.name);
|
|
}
|
|
|
|
/*
|
|
* Trap the BAR2 MMIO mirror to config space as well.
|
|
*/
|
|
static void vfio_probe_ati_bar2_quirk(VFIOPCIDevice *vdev, int nr)
|
|
{
|
|
VFIOQuirk *quirk;
|
|
VFIOConfigMirrorQuirk *mirror;
|
|
|
|
/* Only enable on newer devices where BAR2 is 64bit */
|
|
if (!vfio_pci_is(vdev, PCI_VENDOR_ID_ATI, PCI_ANY_ID) ||
|
|
!vdev->vga || nr != 2 || !vdev->bars[2].mem64) {
|
|
return;
|
|
}
|
|
|
|
quirk = g_malloc0(sizeof(*quirk));
|
|
mirror = quirk->data = g_malloc0(sizeof(*mirror));
|
|
mirror->mem = quirk->mem = g_new0(MemoryRegion, 1);
|
|
quirk->nr_mem = 1;
|
|
mirror->vdev = vdev;
|
|
mirror->offset = 0x4000;
|
|
mirror->bar = nr;
|
|
|
|
memory_region_init_io(mirror->mem, OBJECT(vdev),
|
|
&vfio_generic_mirror_quirk, mirror,
|
|
"vfio-ati-bar2-4000-quirk", PCI_CONFIG_SPACE_SIZE);
|
|
memory_region_add_subregion_overlap(vdev->bars[nr].region.mem,
|
|
mirror->offset, mirror->mem, 1);
|
|
|
|
QLIST_INSERT_HEAD(&vdev->bars[nr].quirks, quirk, next);
|
|
|
|
trace_vfio_quirk_ati_bar2_probe(vdev->vbasedev.name);
|
|
}
|
|
|
|
/*
|
|
* Older ATI/AMD cards like the X550 have a similar window to that above.
|
|
* I/O port BAR1 provides a window to a mirror of PCI config space located
|
|
* in BAR2 at offset 0xf00. We don't care to support such older cards, but
|
|
* note it for future reference.
|
|
*/
|
|
|
|
#define PCI_VENDOR_ID_NVIDIA 0x10de
|
|
|
|
/*
|
|
* Nvidia has several different methods to get to config space, the
|
|
* nouveu project has several of these documented here:
|
|
* https://github.com/pathscale/envytools/tree/master/hwdocs
|
|
*
|
|
* The first quirk is actually not documented in envytools and is found
|
|
* on 10de:01d1 (NVIDIA Corporation G72 [GeForce 7300 LE]). This is an
|
|
* NV46 chipset. The backdoor uses the legacy VGA I/O ports to access
|
|
* the mirror of PCI config space found at BAR0 offset 0x1800. The access
|
|
* sequence first writes 0x338 to I/O port 0x3d4. The target offset is
|
|
* then written to 0x3d0. Finally 0x538 is written for a read and 0x738
|
|
* is written for a write to 0x3d4. The BAR0 offset is then accessible
|
|
* through 0x3d0. This quirk doesn't seem to be necessary on newer cards
|
|
* that use the I/O port BAR5 window but it doesn't hurt to leave it.
|
|
*/
|
|
typedef enum {NONE = 0, SELECT, WINDOW, READ, WRITE} VFIONvidia3d0State;
|
|
static const char *nv3d0_states[] = { "NONE", "SELECT",
|
|
"WINDOW", "READ", "WRITE" };
|
|
|
|
typedef struct VFIONvidia3d0Quirk {
|
|
VFIOPCIDevice *vdev;
|
|
VFIONvidia3d0State state;
|
|
uint32_t offset;
|
|
} VFIONvidia3d0Quirk;
|
|
|
|
static uint64_t vfio_nvidia_3d4_quirk_read(void *opaque,
|
|
hwaddr addr, unsigned size)
|
|
{
|
|
VFIONvidia3d0Quirk *quirk = opaque;
|
|
VFIOPCIDevice *vdev = quirk->vdev;
|
|
|
|
quirk->state = NONE;
|
|
|
|
return vfio_vga_read(&vdev->vga->region[QEMU_PCI_VGA_IO_HI],
|
|
addr + 0x14, size);
|
|
}
|
|
|
|
static void vfio_nvidia_3d4_quirk_write(void *opaque, hwaddr addr,
|
|
uint64_t data, unsigned size)
|
|
{
|
|
VFIONvidia3d0Quirk *quirk = opaque;
|
|
VFIOPCIDevice *vdev = quirk->vdev;
|
|
VFIONvidia3d0State old_state = quirk->state;
|
|
|
|
quirk->state = NONE;
|
|
|
|
switch (data) {
|
|
case 0x338:
|
|
if (old_state == NONE) {
|
|
quirk->state = SELECT;
|
|
trace_vfio_quirk_nvidia_3d0_state(vdev->vbasedev.name,
|
|
nv3d0_states[quirk->state]);
|
|
}
|
|
break;
|
|
case 0x538:
|
|
if (old_state == WINDOW) {
|
|
quirk->state = READ;
|
|
trace_vfio_quirk_nvidia_3d0_state(vdev->vbasedev.name,
|
|
nv3d0_states[quirk->state]);
|
|
}
|
|
break;
|
|
case 0x738:
|
|
if (old_state == WINDOW) {
|
|
quirk->state = WRITE;
|
|
trace_vfio_quirk_nvidia_3d0_state(vdev->vbasedev.name,
|
|
nv3d0_states[quirk->state]);
|
|
}
|
|
break;
|
|
}
|
|
|
|
vfio_vga_write(&vdev->vga->region[QEMU_PCI_VGA_IO_HI],
|
|
addr + 0x14, data, size);
|
|
}
|
|
|
|
static const MemoryRegionOps vfio_nvidia_3d4_quirk = {
|
|
.read = vfio_nvidia_3d4_quirk_read,
|
|
.write = vfio_nvidia_3d4_quirk_write,
|
|
.endianness = DEVICE_LITTLE_ENDIAN,
|
|
};
|
|
|
|
static uint64_t vfio_nvidia_3d0_quirk_read(void *opaque,
|
|
hwaddr addr, unsigned size)
|
|
{
|
|
VFIONvidia3d0Quirk *quirk = opaque;
|
|
VFIOPCIDevice *vdev = quirk->vdev;
|
|
VFIONvidia3d0State old_state = quirk->state;
|
|
uint64_t data = vfio_vga_read(&vdev->vga->region[QEMU_PCI_VGA_IO_HI],
|
|
addr + 0x10, size);
|
|
|
|
quirk->state = NONE;
|
|
|
|
if (old_state == READ &&
|
|
(quirk->offset & ~(PCI_CONFIG_SPACE_SIZE - 1)) == 0x1800) {
|
|
uint8_t offset = quirk->offset & (PCI_CONFIG_SPACE_SIZE - 1);
|
|
|
|
data = vfio_pci_read_config(&vdev->pdev, offset, size);
|
|
trace_vfio_quirk_nvidia_3d0_read(vdev->vbasedev.name,
|
|
offset, size, data);
|
|
}
|
|
|
|
return data;
|
|
}
|
|
|
|
static void vfio_nvidia_3d0_quirk_write(void *opaque, hwaddr addr,
|
|
uint64_t data, unsigned size)
|
|
{
|
|
VFIONvidia3d0Quirk *quirk = opaque;
|
|
VFIOPCIDevice *vdev = quirk->vdev;
|
|
VFIONvidia3d0State old_state = quirk->state;
|
|
|
|
quirk->state = NONE;
|
|
|
|
if (old_state == SELECT) {
|
|
quirk->offset = (uint32_t)data;
|
|
quirk->state = WINDOW;
|
|
trace_vfio_quirk_nvidia_3d0_state(vdev->vbasedev.name,
|
|
nv3d0_states[quirk->state]);
|
|
} else if (old_state == WRITE) {
|
|
if ((quirk->offset & ~(PCI_CONFIG_SPACE_SIZE - 1)) == 0x1800) {
|
|
uint8_t offset = quirk->offset & (PCI_CONFIG_SPACE_SIZE - 1);
|
|
|
|
vfio_pci_write_config(&vdev->pdev, offset, data, size);
|
|
trace_vfio_quirk_nvidia_3d0_write(vdev->vbasedev.name,
|
|
offset, data, size);
|
|
return;
|
|
}
|
|
}
|
|
|
|
vfio_vga_write(&vdev->vga->region[QEMU_PCI_VGA_IO_HI],
|
|
addr + 0x10, data, size);
|
|
}
|
|
|
|
static const MemoryRegionOps vfio_nvidia_3d0_quirk = {
|
|
.read = vfio_nvidia_3d0_quirk_read,
|
|
.write = vfio_nvidia_3d0_quirk_write,
|
|
.endianness = DEVICE_LITTLE_ENDIAN,
|
|
};
|
|
|
|
static void vfio_vga_probe_nvidia_3d0_quirk(VFIOPCIDevice *vdev)
|
|
{
|
|
VFIOQuirk *quirk;
|
|
VFIONvidia3d0Quirk *data;
|
|
|
|
if (!vfio_pci_is(vdev, PCI_VENDOR_ID_NVIDIA, PCI_ANY_ID) ||
|
|
!vdev->bars[1].region.size) {
|
|
return;
|
|
}
|
|
|
|
quirk = g_malloc0(sizeof(*quirk));
|
|
quirk->data = data = g_malloc0(sizeof(*data));
|
|
quirk->mem = g_new0(MemoryRegion, 2);
|
|
quirk->nr_mem = 2;
|
|
data->vdev = vdev;
|
|
|
|
memory_region_init_io(&quirk->mem[0], OBJECT(vdev), &vfio_nvidia_3d4_quirk,
|
|
data, "vfio-nvidia-3d4-quirk", 2);
|
|
memory_region_add_subregion(&vdev->vga->region[QEMU_PCI_VGA_IO_HI].mem,
|
|
0x14 /* 0x3c0 + 0x14 */, &quirk->mem[0]);
|
|
|
|
memory_region_init_io(&quirk->mem[1], OBJECT(vdev), &vfio_nvidia_3d0_quirk,
|
|
data, "vfio-nvidia-3d0-quirk", 2);
|
|
memory_region_add_subregion(&vdev->vga->region[QEMU_PCI_VGA_IO_HI].mem,
|
|
0x10 /* 0x3c0 + 0x10 */, &quirk->mem[1]);
|
|
|
|
QLIST_INSERT_HEAD(&vdev->vga->region[QEMU_PCI_VGA_IO_HI].quirks,
|
|
quirk, next);
|
|
|
|
trace_vfio_quirk_nvidia_3d0_probe(vdev->vbasedev.name);
|
|
}
|
|
|
|
/*
|
|
* The second quirk is documented in envytools. The I/O port BAR5 is just
|
|
* a set of address/data ports to the MMIO BARs. The BAR we care about is
|
|
* again BAR0. This backdoor is apparently a bit newer than the one above
|
|
* so we need to not only trap 256 bytes @0x1800, but all of PCI config
|
|
* space, including extended space is available at the 4k @0x88000.
|
|
*/
|
|
typedef struct VFIONvidiaBAR5Quirk {
|
|
uint32_t master;
|
|
uint32_t enable;
|
|
MemoryRegion *addr_mem;
|
|
MemoryRegion *data_mem;
|
|
bool enabled;
|
|
VFIOConfigWindowQuirk window; /* last for match data */
|
|
} VFIONvidiaBAR5Quirk;
|
|
|
|
static void vfio_nvidia_bar5_enable(VFIONvidiaBAR5Quirk *bar5)
|
|
{
|
|
VFIOPCIDevice *vdev = bar5->window.vdev;
|
|
|
|
if (((bar5->master & bar5->enable) & 0x1) == bar5->enabled) {
|
|
return;
|
|
}
|
|
|
|
bar5->enabled = !bar5->enabled;
|
|
trace_vfio_quirk_nvidia_bar5_state(vdev->vbasedev.name,
|
|
bar5->enabled ? "Enable" : "Disable");
|
|
memory_region_set_enabled(bar5->addr_mem, bar5->enabled);
|
|
memory_region_set_enabled(bar5->data_mem, bar5->enabled);
|
|
}
|
|
|
|
static uint64_t vfio_nvidia_bar5_quirk_master_read(void *opaque,
|
|
hwaddr addr, unsigned size)
|
|
{
|
|
VFIONvidiaBAR5Quirk *bar5 = opaque;
|
|
VFIOPCIDevice *vdev = bar5->window.vdev;
|
|
|
|
return vfio_region_read(&vdev->bars[5].region, addr, size);
|
|
}
|
|
|
|
static void vfio_nvidia_bar5_quirk_master_write(void *opaque, hwaddr addr,
|
|
uint64_t data, unsigned size)
|
|
{
|
|
VFIONvidiaBAR5Quirk *bar5 = opaque;
|
|
VFIOPCIDevice *vdev = bar5->window.vdev;
|
|
|
|
vfio_region_write(&vdev->bars[5].region, addr, data, size);
|
|
|
|
bar5->master = data;
|
|
vfio_nvidia_bar5_enable(bar5);
|
|
}
|
|
|
|
static const MemoryRegionOps vfio_nvidia_bar5_quirk_master = {
|
|
.read = vfio_nvidia_bar5_quirk_master_read,
|
|
.write = vfio_nvidia_bar5_quirk_master_write,
|
|
.endianness = DEVICE_LITTLE_ENDIAN,
|
|
};
|
|
|
|
static uint64_t vfio_nvidia_bar5_quirk_enable_read(void *opaque,
|
|
hwaddr addr, unsigned size)
|
|
{
|
|
VFIONvidiaBAR5Quirk *bar5 = opaque;
|
|
VFIOPCIDevice *vdev = bar5->window.vdev;
|
|
|
|
return vfio_region_read(&vdev->bars[5].region, addr + 4, size);
|
|
}
|
|
|
|
static void vfio_nvidia_bar5_quirk_enable_write(void *opaque, hwaddr addr,
|
|
uint64_t data, unsigned size)
|
|
{
|
|
VFIONvidiaBAR5Quirk *bar5 = opaque;
|
|
VFIOPCIDevice *vdev = bar5->window.vdev;
|
|
|
|
vfio_region_write(&vdev->bars[5].region, addr + 4, data, size);
|
|
|
|
bar5->enable = data;
|
|
vfio_nvidia_bar5_enable(bar5);
|
|
}
|
|
|
|
static const MemoryRegionOps vfio_nvidia_bar5_quirk_enable = {
|
|
.read = vfio_nvidia_bar5_quirk_enable_read,
|
|
.write = vfio_nvidia_bar5_quirk_enable_write,
|
|
.endianness = DEVICE_LITTLE_ENDIAN,
|
|
};
|
|
|
|
static void vfio_probe_nvidia_bar5_quirk(VFIOPCIDevice *vdev, int nr)
|
|
{
|
|
VFIOQuirk *quirk;
|
|
VFIONvidiaBAR5Quirk *bar5;
|
|
VFIOConfigWindowQuirk *window;
|
|
|
|
if (!vfio_pci_is(vdev, PCI_VENDOR_ID_NVIDIA, PCI_ANY_ID) ||
|
|
!vdev->vga || nr != 5) {
|
|
return;
|
|
}
|
|
|
|
quirk = g_malloc0(sizeof(*quirk));
|
|
quirk->mem = g_new0(MemoryRegion, 4);
|
|
quirk->nr_mem = 4;
|
|
bar5 = quirk->data = g_malloc0(sizeof(*bar5) +
|
|
(sizeof(VFIOConfigWindowMatch) * 2));
|
|
window = &bar5->window;
|
|
|
|
window->vdev = vdev;
|
|
window->address_offset = 0x8;
|
|
window->data_offset = 0xc;
|
|
window->nr_matches = 2;
|
|
window->matches[0].match = 0x1800;
|
|
window->matches[0].mask = PCI_CONFIG_SPACE_SIZE - 1;
|
|
window->matches[1].match = 0x88000;
|
|
window->matches[1].mask = vdev->config_size - 1;
|
|
window->bar = nr;
|
|
window->addr_mem = bar5->addr_mem = &quirk->mem[0];
|
|
window->data_mem = bar5->data_mem = &quirk->mem[1];
|
|
|
|
memory_region_init_io(window->addr_mem, OBJECT(vdev),
|
|
&vfio_generic_window_address_quirk, window,
|
|
"vfio-nvidia-bar5-window-address-quirk", 4);
|
|
memory_region_add_subregion_overlap(vdev->bars[nr].region.mem,
|
|
window->address_offset,
|
|
window->addr_mem, 1);
|
|
memory_region_set_enabled(window->addr_mem, false);
|
|
|
|
memory_region_init_io(window->data_mem, OBJECT(vdev),
|
|
&vfio_generic_window_data_quirk, window,
|
|
"vfio-nvidia-bar5-window-data-quirk", 4);
|
|
memory_region_add_subregion_overlap(vdev->bars[nr].region.mem,
|
|
window->data_offset,
|
|
window->data_mem, 1);
|
|
memory_region_set_enabled(window->data_mem, false);
|
|
|
|
memory_region_init_io(&quirk->mem[2], OBJECT(vdev),
|
|
&vfio_nvidia_bar5_quirk_master, bar5,
|
|
"vfio-nvidia-bar5-master-quirk", 4);
|
|
memory_region_add_subregion_overlap(vdev->bars[nr].region.mem,
|
|
0, &quirk->mem[2], 1);
|
|
|
|
memory_region_init_io(&quirk->mem[3], OBJECT(vdev),
|
|
&vfio_nvidia_bar5_quirk_enable, bar5,
|
|
"vfio-nvidia-bar5-enable-quirk", 4);
|
|
memory_region_add_subregion_overlap(vdev->bars[nr].region.mem,
|
|
4, &quirk->mem[3], 1);
|
|
|
|
QLIST_INSERT_HEAD(&vdev->bars[nr].quirks, quirk, next);
|
|
|
|
trace_vfio_quirk_nvidia_bar5_probe(vdev->vbasedev.name);
|
|
}
|
|
|
|
/*
|
|
* Finally, BAR0 itself. We want to redirect any accesses to either
|
|
* 0x1800 or 0x88000 through the PCI config space access functions.
|
|
*/
|
|
static void vfio_nvidia_quirk_mirror_write(void *opaque, hwaddr addr,
|
|
uint64_t data, unsigned size)
|
|
{
|
|
VFIOConfigMirrorQuirk *mirror = opaque;
|
|
VFIOPCIDevice *vdev = mirror->vdev;
|
|
PCIDevice *pdev = &vdev->pdev;
|
|
|
|
vfio_generic_quirk_mirror_write(opaque, addr, data, size);
|
|
|
|
/*
|
|
* Nvidia seems to acknowledge MSI interrupts by writing 0xff to the
|
|
* MSI capability ID register. Both the ID and next register are
|
|
* read-only, so we allow writes covering either of those to real hw.
|
|
*/
|
|
if ((pdev->cap_present & QEMU_PCI_CAP_MSI) &&
|
|
vfio_range_contained(addr, size, pdev->msi_cap, PCI_MSI_FLAGS)) {
|
|
vfio_region_write(&vdev->bars[mirror->bar].region,
|
|
addr + mirror->offset, data, size);
|
|
trace_vfio_quirk_nvidia_bar0_msi_ack(vdev->vbasedev.name);
|
|
}
|
|
}
|
|
|
|
static const MemoryRegionOps vfio_nvidia_mirror_quirk = {
|
|
.read = vfio_generic_quirk_mirror_read,
|
|
.write = vfio_nvidia_quirk_mirror_write,
|
|
.endianness = DEVICE_LITTLE_ENDIAN,
|
|
};
|
|
|
|
static void vfio_probe_nvidia_bar0_quirk(VFIOPCIDevice *vdev, int nr)
|
|
{
|
|
VFIOQuirk *quirk;
|
|
VFIOConfigMirrorQuirk *mirror;
|
|
|
|
if (!vfio_pci_is(vdev, PCI_VENDOR_ID_NVIDIA, PCI_ANY_ID) ||
|
|
!vfio_is_vga(vdev) || nr != 0) {
|
|
return;
|
|
}
|
|
|
|
quirk = g_malloc0(sizeof(*quirk));
|
|
mirror = quirk->data = g_malloc0(sizeof(*mirror));
|
|
mirror->mem = quirk->mem = g_new0(MemoryRegion, 1);
|
|
quirk->nr_mem = 1;
|
|
mirror->vdev = vdev;
|
|
mirror->offset = 0x88000;
|
|
mirror->bar = nr;
|
|
|
|
memory_region_init_io(mirror->mem, OBJECT(vdev),
|
|
&vfio_nvidia_mirror_quirk, mirror,
|
|
"vfio-nvidia-bar0-88000-mirror-quirk",
|
|
vdev->config_size);
|
|
memory_region_add_subregion_overlap(vdev->bars[nr].region.mem,
|
|
mirror->offset, mirror->mem, 1);
|
|
|
|
QLIST_INSERT_HEAD(&vdev->bars[nr].quirks, quirk, next);
|
|
|
|
/* The 0x1800 offset mirror only seems to get used by legacy VGA */
|
|
if (vdev->vga) {
|
|
quirk = g_malloc0(sizeof(*quirk));
|
|
mirror = quirk->data = g_malloc0(sizeof(*mirror));
|
|
mirror->mem = quirk->mem = g_new0(MemoryRegion, 1);
|
|
quirk->nr_mem = 1;
|
|
mirror->vdev = vdev;
|
|
mirror->offset = 0x1800;
|
|
mirror->bar = nr;
|
|
|
|
memory_region_init_io(mirror->mem, OBJECT(vdev),
|
|
&vfio_nvidia_mirror_quirk, mirror,
|
|
"vfio-nvidia-bar0-1800-mirror-quirk",
|
|
PCI_CONFIG_SPACE_SIZE);
|
|
memory_region_add_subregion_overlap(vdev->bars[nr].region.mem,
|
|
mirror->offset, mirror->mem, 1);
|
|
|
|
QLIST_INSERT_HEAD(&vdev->bars[nr].quirks, quirk, next);
|
|
}
|
|
|
|
trace_vfio_quirk_nvidia_bar0_probe(vdev->vbasedev.name);
|
|
}
|
|
|
|
/*
|
|
* TODO - Some Nvidia devices provide config access to their companion HDA
|
|
* device and even to their parent bridge via these config space mirrors.
|
|
* Add quirks for those regions.
|
|
*/
|
|
|
|
#define PCI_VENDOR_ID_REALTEK 0x10ec
|
|
|
|
/*
|
|
* RTL8168 devices have a backdoor that can access the MSI-X table. At BAR2
|
|
* offset 0x70 there is a dword data register, offset 0x74 is a dword address
|
|
* register. According to the Linux r8169 driver, the MSI-X table is addressed
|
|
* when the "type" portion of the address register is set to 0x1. This appears
|
|
* to be bits 16:30. Bit 31 is both a write indicator and some sort of
|
|
* "address latched" indicator. Bits 12:15 are a mask field, which we can
|
|
* ignore because the MSI-X table should always be accessed as a dword (full
|
|
* mask). Bits 0:11 is offset within the type.
|
|
*
|
|
* Example trace:
|
|
*
|
|
* Read from MSI-X table offset 0
|
|
* vfio: vfio_bar_write(0000:05:00.0:BAR2+0x74, 0x1f000, 4) // store read addr
|
|
* vfio: vfio_bar_read(0000:05:00.0:BAR2+0x74, 4) = 0x8001f000 // latch
|
|
* vfio: vfio_bar_read(0000:05:00.0:BAR2+0x70, 4) = 0xfee00398 // read data
|
|
*
|
|
* Write 0xfee00000 to MSI-X table offset 0
|
|
* vfio: vfio_bar_write(0000:05:00.0:BAR2+0x70, 0xfee00000, 4) // write data
|
|
* vfio: vfio_bar_write(0000:05:00.0:BAR2+0x74, 0x8001f000, 4) // do write
|
|
* vfio: vfio_bar_read(0000:05:00.0:BAR2+0x74, 4) = 0x1f000 // complete
|
|
*/
|
|
typedef struct VFIOrtl8168Quirk {
|
|
VFIOPCIDevice *vdev;
|
|
uint32_t addr;
|
|
uint32_t data;
|
|
bool enabled;
|
|
} VFIOrtl8168Quirk;
|
|
|
|
static uint64_t vfio_rtl8168_quirk_address_read(void *opaque,
|
|
hwaddr addr, unsigned size)
|
|
{
|
|
VFIOrtl8168Quirk *rtl = opaque;
|
|
VFIOPCIDevice *vdev = rtl->vdev;
|
|
uint64_t data = vfio_region_read(&vdev->bars[2].region, addr + 0x74, size);
|
|
|
|
if (rtl->enabled) {
|
|
data = rtl->addr ^ 0x80000000U; /* latch/complete */
|
|
trace_vfio_quirk_rtl8168_fake_latch(vdev->vbasedev.name, data);
|
|
}
|
|
|
|
return data;
|
|
}
|
|
|
|
static void vfio_rtl8168_quirk_address_write(void *opaque, hwaddr addr,
|
|
uint64_t data, unsigned size)
|
|
{
|
|
VFIOrtl8168Quirk *rtl = opaque;
|
|
VFIOPCIDevice *vdev = rtl->vdev;
|
|
|
|
rtl->enabled = false;
|
|
|
|
if ((data & 0x7fff0000) == 0x10000) { /* MSI-X table */
|
|
rtl->enabled = true;
|
|
rtl->addr = (uint32_t)data;
|
|
|
|
if (data & 0x80000000U) { /* Do write */
|
|
if (vdev->pdev.cap_present & QEMU_PCI_CAP_MSIX) {
|
|
hwaddr offset = data & 0xfff;
|
|
uint64_t val = rtl->data;
|
|
|
|
trace_vfio_quirk_rtl8168_msix_write(vdev->vbasedev.name,
|
|
(uint16_t)offset, val);
|
|
|
|
/* Write to the proper guest MSI-X table instead */
|
|
memory_region_dispatch_write(&vdev->pdev.msix_table_mmio,
|
|
offset, val, size,
|
|
MEMTXATTRS_UNSPECIFIED);
|
|
}
|
|
return; /* Do not write guest MSI-X data to hardware */
|
|
}
|
|
}
|
|
|
|
vfio_region_write(&vdev->bars[2].region, addr + 0x74, data, size);
|
|
}
|
|
|
|
static const MemoryRegionOps vfio_rtl_address_quirk = {
|
|
.read = vfio_rtl8168_quirk_address_read,
|
|
.write = vfio_rtl8168_quirk_address_write,
|
|
.valid = {
|
|
.min_access_size = 4,
|
|
.max_access_size = 4,
|
|
.unaligned = false,
|
|
},
|
|
.endianness = DEVICE_LITTLE_ENDIAN,
|
|
};
|
|
|
|
static uint64_t vfio_rtl8168_quirk_data_read(void *opaque,
|
|
hwaddr addr, unsigned size)
|
|
{
|
|
VFIOrtl8168Quirk *rtl = opaque;
|
|
VFIOPCIDevice *vdev = rtl->vdev;
|
|
uint64_t data = vfio_region_read(&vdev->bars[2].region, addr + 0x70, size);
|
|
|
|
if (rtl->enabled && (vdev->pdev.cap_present & QEMU_PCI_CAP_MSIX)) {
|
|
hwaddr offset = rtl->addr & 0xfff;
|
|
memory_region_dispatch_read(&vdev->pdev.msix_table_mmio, offset,
|
|
&data, size, MEMTXATTRS_UNSPECIFIED);
|
|
trace_vfio_quirk_rtl8168_msix_read(vdev->vbasedev.name, offset, data);
|
|
}
|
|
|
|
return data;
|
|
}
|
|
|
|
static void vfio_rtl8168_quirk_data_write(void *opaque, hwaddr addr,
|
|
uint64_t data, unsigned size)
|
|
{
|
|
VFIOrtl8168Quirk *rtl = opaque;
|
|
VFIOPCIDevice *vdev = rtl->vdev;
|
|
|
|
rtl->data = (uint32_t)data;
|
|
|
|
vfio_region_write(&vdev->bars[2].region, addr + 0x70, data, size);
|
|
}
|
|
|
|
static const MemoryRegionOps vfio_rtl_data_quirk = {
|
|
.read = vfio_rtl8168_quirk_data_read,
|
|
.write = vfio_rtl8168_quirk_data_write,
|
|
.valid = {
|
|
.min_access_size = 4,
|
|
.max_access_size = 4,
|
|
.unaligned = false,
|
|
},
|
|
.endianness = DEVICE_LITTLE_ENDIAN,
|
|
};
|
|
|
|
static void vfio_probe_rtl8168_bar2_quirk(VFIOPCIDevice *vdev, int nr)
|
|
{
|
|
VFIOQuirk *quirk;
|
|
VFIOrtl8168Quirk *rtl;
|
|
|
|
if (!vfio_pci_is(vdev, PCI_VENDOR_ID_REALTEK, 0x8168) || nr != 2) {
|
|
return;
|
|
}
|
|
|
|
quirk = g_malloc0(sizeof(*quirk));
|
|
quirk->mem = g_new0(MemoryRegion, 2);
|
|
quirk->nr_mem = 2;
|
|
quirk->data = rtl = g_malloc0(sizeof(*rtl));
|
|
rtl->vdev = vdev;
|
|
|
|
memory_region_init_io(&quirk->mem[0], OBJECT(vdev),
|
|
&vfio_rtl_address_quirk, rtl,
|
|
"vfio-rtl8168-window-address-quirk", 4);
|
|
memory_region_add_subregion_overlap(vdev->bars[nr].region.mem,
|
|
0x74, &quirk->mem[0], 1);
|
|
|
|
memory_region_init_io(&quirk->mem[1], OBJECT(vdev),
|
|
&vfio_rtl_data_quirk, rtl,
|
|
"vfio-rtl8168-window-data-quirk", 4);
|
|
memory_region_add_subregion_overlap(vdev->bars[nr].region.mem,
|
|
0x70, &quirk->mem[1], 1);
|
|
|
|
QLIST_INSERT_HEAD(&vdev->bars[nr].quirks, quirk, next);
|
|
|
|
trace_vfio_quirk_rtl8168_probe(vdev->vbasedev.name);
|
|
}
|
|
|
|
/*
|
|
* Intel IGD support
|
|
*
|
|
* Obviously IGD is not a discrete device, this is evidenced not only by it
|
|
* being integrated into the CPU, but by the various chipset and BIOS
|
|
* dependencies that it brings along with it. Intel is trying to move away
|
|
* from this and Broadwell and newer devices can run in what Intel calls
|
|
* "Universal Pass-Through" mode, or UPT. Theoretically in UPT mode, nothing
|
|
* more is required beyond assigning the IGD device to a VM. There are
|
|
* however support limitations to this mode. It only supports IGD as a
|
|
* secondary graphics device in the VM and it doesn't officially support any
|
|
* physical outputs.
|
|
*
|
|
* The code here attempts to enable what we'll call legacy mode assignment,
|
|
* IGD retains most of the capabilities we expect for it to have on bare
|
|
* metal. To enable this mode, the IGD device must be assigned to the VM
|
|
* at PCI address 00:02.0, it must have a ROM, it very likely needs VGA
|
|
* support, we must have VM BIOS support for reserving and populating some
|
|
* of the required tables, and we need to tweak the chipset with revisions
|
|
* and IDs and an LPC/ISA bridge device. The intention is to make all of
|
|
* this happen automatically by installing the device at the correct VM PCI
|
|
* bus address. If any of the conditions are not met, we cross our fingers
|
|
* and hope the user knows better.
|
|
*
|
|
* NB - It is possible to enable physical outputs in UPT mode by supplying
|
|
* an OpRegion table. We don't do this by default because the guest driver
|
|
* behaves differently if an OpRegion is provided and no monitor is attached
|
|
* vs no OpRegion and a monitor being attached or not. Effectively, if a
|
|
* headless setup is desired, the OpRegion gets in the way of that.
|
|
*/
|
|
|
|
/*
|
|
* This presumes the device is already known to be an Intel VGA device, so we
|
|
* take liberties in which device ID bits match which generation. This should
|
|
* not be taken as an indication that all the devices are supported, or even
|
|
* supportable, some of them don't even support VT-d.
|
|
* See linux:include/drm/i915_pciids.h for IDs.
|
|
*/
|
|
static int igd_gen(VFIOPCIDevice *vdev)
|
|
{
|
|
if ((vdev->device_id & 0xfff) == 0xa84) {
|
|
return 8; /* Broxton */
|
|
}
|
|
|
|
switch (vdev->device_id & 0xff00) {
|
|
/* Old, untested, unavailable, unknown */
|
|
case 0x0000:
|
|
case 0x2500:
|
|
case 0x2700:
|
|
case 0x2900:
|
|
case 0x2a00:
|
|
case 0x2e00:
|
|
case 0x3500:
|
|
case 0xa000:
|
|
return -1;
|
|
/* SandyBridge, IvyBridge, ValleyView, Haswell */
|
|
case 0x0100:
|
|
case 0x0400:
|
|
case 0x0a00:
|
|
case 0x0c00:
|
|
case 0x0d00:
|
|
case 0x0f00:
|
|
return 6;
|
|
/* BroadWell, CherryView, SkyLake, KabyLake */
|
|
case 0x1600:
|
|
case 0x1900:
|
|
case 0x2200:
|
|
case 0x5900:
|
|
return 8;
|
|
}
|
|
|
|
return 8; /* Assume newer is compatible */
|
|
}
|
|
|
|
typedef struct VFIOIGDQuirk {
|
|
struct VFIOPCIDevice *vdev;
|
|
uint32_t index;
|
|
} VFIOIGDQuirk;
|
|
|
|
#define IGD_GMCH 0x50 /* Graphics Control Register */
|
|
#define IGD_BDSM 0x5c /* Base Data of Stolen Memory */
|
|
#define IGD_ASLS 0xfc /* ASL Storage Register */
|
|
|
|
/*
|
|
* The OpRegion includes the Video BIOS Table, which seems important for
|
|
* telling the driver what sort of outputs it has. Without this, the device
|
|
* may work in the guest, but we may not get output. This also requires BIOS
|
|
* support to reserve and populate a section of guest memory sufficient for
|
|
* the table and to write the base address of that memory to the ASLS register
|
|
* of the IGD device.
|
|
*/
|
|
int vfio_pci_igd_opregion_init(VFIOPCIDevice *vdev,
|
|
struct vfio_region_info *info, Error **errp)
|
|
{
|
|
int ret;
|
|
|
|
vdev->igd_opregion = g_malloc0(info->size);
|
|
ret = pread(vdev->vbasedev.fd, vdev->igd_opregion,
|
|
info->size, info->offset);
|
|
if (ret != info->size) {
|
|
error_setg(errp, "failed to read IGD OpRegion");
|
|
g_free(vdev->igd_opregion);
|
|
vdev->igd_opregion = NULL;
|
|
return -EINVAL;
|
|
}
|
|
|
|
/*
|
|
* Provide fw_cfg with a copy of the OpRegion which the VM firmware is to
|
|
* allocate 32bit reserved memory for, copy these contents into, and write
|
|
* the reserved memory base address to the device ASLS register at 0xFC.
|
|
* Alignment of this reserved region seems flexible, but using a 4k page
|
|
* alignment seems to work well. This interface assumes a single IGD
|
|
* device, which may be at VM address 00:02.0 in legacy mode or another
|
|
* address in UPT mode.
|
|
*
|
|
* NB, there may be future use cases discovered where the VM should have
|
|
* direct interaction with the host OpRegion, in which case the write to
|
|
* the ASLS register would trigger MemoryRegion setup to enable that.
|
|
*/
|
|
fw_cfg_add_file(fw_cfg_find(), "etc/igd-opregion",
|
|
vdev->igd_opregion, info->size);
|
|
|
|
trace_vfio_pci_igd_opregion_enabled(vdev->vbasedev.name);
|
|
|
|
pci_set_long(vdev->pdev.config + IGD_ASLS, 0);
|
|
pci_set_long(vdev->pdev.wmask + IGD_ASLS, ~0);
|
|
pci_set_long(vdev->emulated_config_bits + IGD_ASLS, ~0);
|
|
|
|
return 0;
|
|
}
|
|
|
|
/*
|
|
* The rather short list of registers that we copy from the host devices.
|
|
* The LPC/ISA bridge values are definitely needed to support the vBIOS, the
|
|
* host bridge values may or may not be needed depending on the guest OS.
|
|
* Since we're only munging revision and subsystem values on the host bridge,
|
|
* we don't require our own device. The LPC/ISA bridge needs to be our very
|
|
* own though.
|
|
*/
|
|
typedef struct {
|
|
uint8_t offset;
|
|
uint8_t len;
|
|
} IGDHostInfo;
|
|
|
|
static const IGDHostInfo igd_host_bridge_infos[] = {
|
|
{PCI_REVISION_ID, 2},
|
|
{PCI_SUBSYSTEM_VENDOR_ID, 2},
|
|
{PCI_SUBSYSTEM_ID, 2},
|
|
};
|
|
|
|
static const IGDHostInfo igd_lpc_bridge_infos[] = {
|
|
{PCI_VENDOR_ID, 2},
|
|
{PCI_DEVICE_ID, 2},
|
|
{PCI_REVISION_ID, 2},
|
|
{PCI_SUBSYSTEM_VENDOR_ID, 2},
|
|
{PCI_SUBSYSTEM_ID, 2},
|
|
};
|
|
|
|
static int vfio_pci_igd_copy(VFIOPCIDevice *vdev, PCIDevice *pdev,
|
|
struct vfio_region_info *info,
|
|
const IGDHostInfo *list, int len)
|
|
{
|
|
int i, ret;
|
|
|
|
for (i = 0; i < len; i++) {
|
|
ret = pread(vdev->vbasedev.fd, pdev->config + list[i].offset,
|
|
list[i].len, info->offset + list[i].offset);
|
|
if (ret != list[i].len) {
|
|
error_report("IGD copy failed: %m");
|
|
return -errno;
|
|
}
|
|
}
|
|
|
|
return 0;
|
|
}
|
|
|
|
/*
|
|
* Stuff a few values into the host bridge.
|
|
*/
|
|
static int vfio_pci_igd_host_init(VFIOPCIDevice *vdev,
|
|
struct vfio_region_info *info)
|
|
{
|
|
PCIBus *bus;
|
|
PCIDevice *host_bridge;
|
|
int ret;
|
|
|
|
bus = pci_device_root_bus(&vdev->pdev);
|
|
host_bridge = pci_find_device(bus, 0, PCI_DEVFN(0, 0));
|
|
|
|
if (!host_bridge) {
|
|
error_report("Can't find host bridge");
|
|
return -ENODEV;
|
|
}
|
|
|
|
ret = vfio_pci_igd_copy(vdev, host_bridge, info, igd_host_bridge_infos,
|
|
ARRAY_SIZE(igd_host_bridge_infos));
|
|
if (!ret) {
|
|
trace_vfio_pci_igd_host_bridge_enabled(vdev->vbasedev.name);
|
|
}
|
|
|
|
return ret;
|
|
}
|
|
|
|
/*
|
|
* IGD LPC/ISA bridge support code. The vBIOS needs this, but we can't write
|
|
* arbitrary values into just any bridge, so we must create our own. We try
|
|
* to handle if the user has created it for us, which they might want to do
|
|
* to enable multifuction so we don't occupy the whole PCI slot.
|
|
*/
|
|
static void vfio_pci_igd_lpc_bridge_realize(PCIDevice *pdev, Error **errp)
|
|
{
|
|
if (pdev->devfn != PCI_DEVFN(0x1f, 0)) {
|
|
error_setg(errp, "VFIO dummy ISA/LPC bridge must have address 1f.0");
|
|
}
|
|
}
|
|
|
|
static void vfio_pci_igd_lpc_bridge_class_init(ObjectClass *klass, void *data)
|
|
{
|
|
DeviceClass *dc = DEVICE_CLASS(klass);
|
|
PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
|
|
|
|
dc->desc = "VFIO dummy ISA/LPC bridge for IGD assignment";
|
|
dc->hotpluggable = false;
|
|
k->realize = vfio_pci_igd_lpc_bridge_realize;
|
|
k->class_id = PCI_CLASS_BRIDGE_ISA;
|
|
}
|
|
|
|
static TypeInfo vfio_pci_igd_lpc_bridge_info = {
|
|
.name = "vfio-pci-igd-lpc-bridge",
|
|
.parent = TYPE_PCI_DEVICE,
|
|
.class_init = vfio_pci_igd_lpc_bridge_class_init,
|
|
};
|
|
|
|
static void vfio_pci_igd_register_types(void)
|
|
{
|
|
type_register_static(&vfio_pci_igd_lpc_bridge_info);
|
|
}
|
|
|
|
type_init(vfio_pci_igd_register_types)
|
|
|
|
static int vfio_pci_igd_lpc_init(VFIOPCIDevice *vdev,
|
|
struct vfio_region_info *info)
|
|
{
|
|
PCIDevice *lpc_bridge;
|
|
int ret;
|
|
|
|
lpc_bridge = pci_find_device(pci_device_root_bus(&vdev->pdev),
|
|
0, PCI_DEVFN(0x1f, 0));
|
|
if (!lpc_bridge) {
|
|
lpc_bridge = pci_create_simple(pci_device_root_bus(&vdev->pdev),
|
|
PCI_DEVFN(0x1f, 0), "vfio-pci-igd-lpc-bridge");
|
|
}
|
|
|
|
ret = vfio_pci_igd_copy(vdev, lpc_bridge, info, igd_lpc_bridge_infos,
|
|
ARRAY_SIZE(igd_lpc_bridge_infos));
|
|
if (!ret) {
|
|
trace_vfio_pci_igd_lpc_bridge_enabled(vdev->vbasedev.name);
|
|
}
|
|
|
|
return ret;
|
|
}
|
|
|
|
/*
|
|
* IGD Gen8 and newer support up to 8MB for the GTT and use a 64bit PTE
|
|
* entry, older IGDs use 2MB and 32bit. Each PTE maps a 4k page. Therefore
|
|
* we either have 2M/4k * 4 = 2k or 8M/4k * 8 = 16k as the maximum iobar index
|
|
* for programming the GTT.
|
|
*
|
|
* See linux:include/drm/i915_drm.h for shift and mask values.
|
|
*/
|
|
static int vfio_igd_gtt_max(VFIOPCIDevice *vdev)
|
|
{
|
|
uint32_t gmch = vfio_pci_read_config(&vdev->pdev, IGD_GMCH, sizeof(gmch));
|
|
int ggms, gen = igd_gen(vdev);
|
|
|
|
gmch = vfio_pci_read_config(&vdev->pdev, IGD_GMCH, sizeof(gmch));
|
|
ggms = (gmch >> (gen < 8 ? 8 : 6)) & 0x3;
|
|
if (gen > 6) {
|
|
ggms = 1 << ggms;
|
|
}
|
|
|
|
ggms *= 1024 * 1024;
|
|
|
|
return (ggms / (4 * 1024)) * (gen < 8 ? 4 : 8);
|
|
}
|
|
|
|
/*
|
|
* The IGD ROM will make use of stolen memory (GGMS) for support of VESA modes.
|
|
* Somehow the host stolen memory range is used for this, but how the ROM gets
|
|
* it is a mystery, perhaps it's hardcoded into the ROM. Thankfully though, it
|
|
* reprograms the GTT through the IOBAR where we can trap it and transpose the
|
|
* programming to the VM allocated buffer. That buffer gets reserved by the VM
|
|
* firmware via the fw_cfg entry added below. Here we're just monitoring the
|
|
* IOBAR address and data registers to detect a write sequence targeting the
|
|
* GTTADR. This code is developed by observed behavior and doesn't have a
|
|
* direct spec reference, unfortunately.
|
|
*/
|
|
static uint64_t vfio_igd_quirk_data_read(void *opaque,
|
|
hwaddr addr, unsigned size)
|
|
{
|
|
VFIOIGDQuirk *igd = opaque;
|
|
VFIOPCIDevice *vdev = igd->vdev;
|
|
|
|
igd->index = ~0;
|
|
|
|
return vfio_region_read(&vdev->bars[4].region, addr + 4, size);
|
|
}
|
|
|
|
static void vfio_igd_quirk_data_write(void *opaque, hwaddr addr,
|
|
uint64_t data, unsigned size)
|
|
{
|
|
VFIOIGDQuirk *igd = opaque;
|
|
VFIOPCIDevice *vdev = igd->vdev;
|
|
uint64_t val = data;
|
|
int gen = igd_gen(vdev);
|
|
|
|
/*
|
|
* Programming the GGMS starts at index 0x1 and uses every 4th index (ie.
|
|
* 0x1, 0x5, 0x9, 0xd,...). For pre-Gen8 each 4-byte write is a whole PTE
|
|
* entry, with 0th bit enable set. For Gen8 and up, PTEs are 64bit, so
|
|
* entries 0x5 & 0xd are the high dword, in our case zero. Each PTE points
|
|
* to a 4k page, which we translate to a page from the VM allocated region,
|
|
* pointed to by the BDSM register. If this is not set, we fail.
|
|
*
|
|
* We trap writes to the full configured GTT size, but we typically only
|
|
* see the vBIOS writing up to (nearly) the 1MB barrier. In fact it often
|
|
* seems to miss the last entry for an even 1MB GTT. Doing a gratuitous
|
|
* write of that last entry does work, but is hopefully unnecessary since
|
|
* we clear the previous GTT on initialization.
|
|
*/
|
|
if ((igd->index % 4 == 1) && igd->index < vfio_igd_gtt_max(vdev)) {
|
|
if (gen < 8 || (igd->index % 8 == 1)) {
|
|
uint32_t base;
|
|
|
|
base = pci_get_long(vdev->pdev.config + IGD_BDSM);
|
|
if (!base) {
|
|
hw_error("vfio-igd: Guest attempted to program IGD GTT before "
|
|
"BIOS reserved stolen memory. Unsupported BIOS?");
|
|
}
|
|
|
|
val = base | (data & ((1 << 20) - 1));
|
|
} else {
|
|
val = 0; /* upper 32bits of pte, we only enable below 4G PTEs */
|
|
}
|
|
|
|
trace_vfio_pci_igd_bar4_write(vdev->vbasedev.name,
|
|
igd->index, data, val);
|
|
}
|
|
|
|
vfio_region_write(&vdev->bars[4].region, addr + 4, val, size);
|
|
|
|
igd->index = ~0;
|
|
}
|
|
|
|
static const MemoryRegionOps vfio_igd_data_quirk = {
|
|
.read = vfio_igd_quirk_data_read,
|
|
.write = vfio_igd_quirk_data_write,
|
|
.endianness = DEVICE_LITTLE_ENDIAN,
|
|
};
|
|
|
|
static uint64_t vfio_igd_quirk_index_read(void *opaque,
|
|
hwaddr addr, unsigned size)
|
|
{
|
|
VFIOIGDQuirk *igd = opaque;
|
|
VFIOPCIDevice *vdev = igd->vdev;
|
|
|
|
igd->index = ~0;
|
|
|
|
return vfio_region_read(&vdev->bars[4].region, addr, size);
|
|
}
|
|
|
|
static void vfio_igd_quirk_index_write(void *opaque, hwaddr addr,
|
|
uint64_t data, unsigned size)
|
|
{
|
|
VFIOIGDQuirk *igd = opaque;
|
|
VFIOPCIDevice *vdev = igd->vdev;
|
|
|
|
igd->index = data;
|
|
|
|
vfio_region_write(&vdev->bars[4].region, addr, data, size);
|
|
}
|
|
|
|
static const MemoryRegionOps vfio_igd_index_quirk = {
|
|
.read = vfio_igd_quirk_index_read,
|
|
.write = vfio_igd_quirk_index_write,
|
|
.endianness = DEVICE_LITTLE_ENDIAN,
|
|
};
|
|
|
|
static void vfio_probe_igd_bar4_quirk(VFIOPCIDevice *vdev, int nr)
|
|
{
|
|
struct vfio_region_info *rom = NULL, *opregion = NULL,
|
|
*host = NULL, *lpc = NULL;
|
|
VFIOQuirk *quirk;
|
|
VFIOIGDQuirk *igd;
|
|
PCIDevice *lpc_bridge;
|
|
int i, ret, ggms_mb, gms_mb = 0, gen;
|
|
uint64_t *bdsm_size;
|
|
uint32_t gmch;
|
|
uint16_t cmd_orig, cmd;
|
|
Error *err = NULL;
|
|
|
|
/*
|
|
* This must be an Intel VGA device at address 00:02.0 for us to even
|
|
* consider enabling legacy mode. The vBIOS has dependencies on the
|
|
* PCI bus address.
|
|
*/
|
|
if (!vfio_pci_is(vdev, PCI_VENDOR_ID_INTEL, PCI_ANY_ID) ||
|
|
!vfio_is_vga(vdev) || nr != 4 ||
|
|
&vdev->pdev != pci_find_device(pci_device_root_bus(&vdev->pdev),
|
|
0, PCI_DEVFN(0x2, 0))) {
|
|
return;
|
|
}
|
|
|
|
/*
|
|
* We need to create an LPC/ISA bridge at PCI bus address 00:1f.0 that we
|
|
* can stuff host values into, so if there's already one there and it's not
|
|
* one we can hack on, legacy mode is no-go. Sorry Q35.
|
|
*/
|
|
lpc_bridge = pci_find_device(pci_device_root_bus(&vdev->pdev),
|
|
0, PCI_DEVFN(0x1f, 0));
|
|
if (lpc_bridge && !object_dynamic_cast(OBJECT(lpc_bridge),
|
|
"vfio-pci-igd-lpc-bridge")) {
|
|
error_report("IGD device %s cannot support legacy mode due to existing "
|
|
"devices at address 1f.0", vdev->vbasedev.name);
|
|
return;
|
|
}
|
|
|
|
/*
|
|
* IGD is not a standard, they like to change their specs often. We
|
|
* only attempt to support back to SandBridge and we hope that newer
|
|
* devices maintain compatibility with generation 8.
|
|
*/
|
|
gen = igd_gen(vdev);
|
|
if (gen != 6 && gen != 8) {
|
|
error_report("IGD device %s is unsupported in legacy mode, "
|
|
"try SandyBridge or newer", vdev->vbasedev.name);
|
|
return;
|
|
}
|
|
|
|
/*
|
|
* Most of what we're doing here is to enable the ROM to run, so if
|
|
* there's no ROM, there's no point in setting up this quirk.
|
|
* NB. We only seem to get BIOS ROMs, so a UEFI VM would need CSM support.
|
|
*/
|
|
ret = vfio_get_region_info(&vdev->vbasedev,
|
|
VFIO_PCI_ROM_REGION_INDEX, &rom);
|
|
if ((ret || !rom->size) && !vdev->pdev.romfile) {
|
|
error_report("IGD device %s has no ROM, legacy mode disabled",
|
|
vdev->vbasedev.name);
|
|
goto out;
|
|
}
|
|
|
|
/*
|
|
* Ignore the hotplug corner case, mark the ROM failed, we can't
|
|
* create the devices we need for legacy mode in the hotplug scenario.
|
|
*/
|
|
if (vdev->pdev.qdev.hotplugged) {
|
|
error_report("IGD device %s hotplugged, ROM disabled, "
|
|
"legacy mode disabled", vdev->vbasedev.name);
|
|
vdev->rom_read_failed = true;
|
|
goto out;
|
|
}
|
|
|
|
/*
|
|
* Check whether we have all the vfio device specific regions to
|
|
* support legacy mode (added in Linux v4.6). If not, bail.
|
|
*/
|
|
ret = vfio_get_dev_region_info(&vdev->vbasedev,
|
|
VFIO_REGION_TYPE_PCI_VENDOR_TYPE | PCI_VENDOR_ID_INTEL,
|
|
VFIO_REGION_SUBTYPE_INTEL_IGD_OPREGION, &opregion);
|
|
if (ret) {
|
|
error_report("IGD device %s does not support OpRegion access,"
|
|
"legacy mode disabled", vdev->vbasedev.name);
|
|
goto out;
|
|
}
|
|
|
|
ret = vfio_get_dev_region_info(&vdev->vbasedev,
|
|
VFIO_REGION_TYPE_PCI_VENDOR_TYPE | PCI_VENDOR_ID_INTEL,
|
|
VFIO_REGION_SUBTYPE_INTEL_IGD_HOST_CFG, &host);
|
|
if (ret) {
|
|
error_report("IGD device %s does not support host bridge access,"
|
|
"legacy mode disabled", vdev->vbasedev.name);
|
|
goto out;
|
|
}
|
|
|
|
ret = vfio_get_dev_region_info(&vdev->vbasedev,
|
|
VFIO_REGION_TYPE_PCI_VENDOR_TYPE | PCI_VENDOR_ID_INTEL,
|
|
VFIO_REGION_SUBTYPE_INTEL_IGD_LPC_CFG, &lpc);
|
|
if (ret) {
|
|
error_report("IGD device %s does not support LPC bridge access,"
|
|
"legacy mode disabled", vdev->vbasedev.name);
|
|
goto out;
|
|
}
|
|
|
|
gmch = vfio_pci_read_config(&vdev->pdev, IGD_GMCH, 4);
|
|
|
|
/*
|
|
* If IGD VGA Disable is clear (expected) and VGA is not already enabled,
|
|
* try to enable it. Probably shouldn't be using legacy mode without VGA,
|
|
* but also no point in us enabling VGA if disabled in hardware.
|
|
*/
|
|
if (!(gmch & 0x2) && !vdev->vga && vfio_populate_vga(vdev, &err)) {
|
|
error_reportf_err(err, ERR_PREFIX, vdev->vbasedev.name);
|
|
error_report("IGD device %s failed to enable VGA access, "
|
|
"legacy mode disabled", vdev->vbasedev.name);
|
|
goto out;
|
|
}
|
|
|
|
/* Create our LPC/ISA bridge */
|
|
ret = vfio_pci_igd_lpc_init(vdev, lpc);
|
|
if (ret) {
|
|
error_report("IGD device %s failed to create LPC bridge, "
|
|
"legacy mode disabled", vdev->vbasedev.name);
|
|
goto out;
|
|
}
|
|
|
|
/* Stuff some host values into the VM PCI host bridge */
|
|
ret = vfio_pci_igd_host_init(vdev, host);
|
|
if (ret) {
|
|
error_report("IGD device %s failed to modify host bridge, "
|
|
"legacy mode disabled", vdev->vbasedev.name);
|
|
goto out;
|
|
}
|
|
|
|
/* Setup OpRegion access */
|
|
ret = vfio_pci_igd_opregion_init(vdev, opregion, &err);
|
|
if (ret) {
|
|
error_append_hint(&err, "IGD legacy mode disabled\n");
|
|
error_reportf_err(err, ERR_PREFIX, vdev->vbasedev.name);
|
|
goto out;
|
|
}
|
|
|
|
/* Setup our quirk to munge GTT addresses to the VM allocated buffer */
|
|
quirk = g_malloc0(sizeof(*quirk));
|
|
quirk->mem = g_new0(MemoryRegion, 2);
|
|
quirk->nr_mem = 2;
|
|
igd = quirk->data = g_malloc0(sizeof(*igd));
|
|
igd->vdev = vdev;
|
|
igd->index = ~0;
|
|
|
|
memory_region_init_io(&quirk->mem[0], OBJECT(vdev), &vfio_igd_index_quirk,
|
|
igd, "vfio-igd-index-quirk", 4);
|
|
memory_region_add_subregion_overlap(vdev->bars[nr].region.mem,
|
|
0, &quirk->mem[0], 1);
|
|
|
|
memory_region_init_io(&quirk->mem[1], OBJECT(vdev), &vfio_igd_data_quirk,
|
|
igd, "vfio-igd-data-quirk", 4);
|
|
memory_region_add_subregion_overlap(vdev->bars[nr].region.mem,
|
|
4, &quirk->mem[1], 1);
|
|
|
|
QLIST_INSERT_HEAD(&vdev->bars[nr].quirks, quirk, next);
|
|
|
|
/* Determine the size of stolen memory needed for GTT */
|
|
ggms_mb = (gmch >> (gen < 8 ? 8 : 6)) & 0x3;
|
|
if (gen > 6) {
|
|
ggms_mb = 1 << ggms_mb;
|
|
}
|
|
|
|
/*
|
|
* Assume we have no GMS memory, but allow it to be overrided by device
|
|
* option (experimental). The spec doesn't actually allow zero GMS when
|
|
* when IVD (IGD VGA Disable) is clear, but the claim is that it's unused,
|
|
* so let's not waste VM memory for it.
|
|
*/
|
|
gmch &= ~((gen < 8 ? 0x1f : 0xff) << (gen < 8 ? 3 : 8));
|
|
|
|
if (vdev->igd_gms) {
|
|
if (vdev->igd_gms <= 0x10) {
|
|
gms_mb = vdev->igd_gms * 32;
|
|
gmch |= vdev->igd_gms << (gen < 8 ? 3 : 8);
|
|
} else {
|
|
error_report("Unsupported IGD GMS value 0x%x", vdev->igd_gms);
|
|
vdev->igd_gms = 0;
|
|
}
|
|
}
|
|
|
|
/*
|
|
* Request reserved memory for stolen memory via fw_cfg. VM firmware
|
|
* must allocate a 1MB aligned reserved memory region below 4GB with
|
|
* the requested size (in bytes) for use by the Intel PCI class VGA
|
|
* device at VM address 00:02.0. The base address of this reserved
|
|
* memory region must be written to the device BDSM regsiter at PCI
|
|
* config offset 0x5C.
|
|
*/
|
|
bdsm_size = g_malloc(sizeof(*bdsm_size));
|
|
*bdsm_size = cpu_to_le64((ggms_mb + gms_mb) * 1024 * 1024);
|
|
fw_cfg_add_file(fw_cfg_find(), "etc/igd-bdsm-size",
|
|
bdsm_size, sizeof(*bdsm_size));
|
|
|
|
/* GMCH is read-only, emulated */
|
|
pci_set_long(vdev->pdev.config + IGD_GMCH, gmch);
|
|
pci_set_long(vdev->pdev.wmask + IGD_GMCH, 0);
|
|
pci_set_long(vdev->emulated_config_bits + IGD_GMCH, ~0);
|
|
|
|
/* BDSM is read-write, emulated. The BIOS needs to be able to write it */
|
|
pci_set_long(vdev->pdev.config + IGD_BDSM, 0);
|
|
pci_set_long(vdev->pdev.wmask + IGD_BDSM, ~0);
|
|
pci_set_long(vdev->emulated_config_bits + IGD_BDSM, ~0);
|
|
|
|
/*
|
|
* This IOBAR gives us access to GTTADR, which allows us to write to
|
|
* the GTT itself. So let's go ahead and write zero to all the GTT
|
|
* entries to avoid spurious DMA faults. Be sure I/O access is enabled
|
|
* before talking to the device.
|
|
*/
|
|
if (pread(vdev->vbasedev.fd, &cmd_orig, sizeof(cmd_orig),
|
|
vdev->config_offset + PCI_COMMAND) != sizeof(cmd_orig)) {
|
|
error_report("IGD device %s - failed to read PCI command register",
|
|
vdev->vbasedev.name);
|
|
}
|
|
|
|
cmd = cmd_orig | PCI_COMMAND_IO;
|
|
|
|
if (pwrite(vdev->vbasedev.fd, &cmd, sizeof(cmd),
|
|
vdev->config_offset + PCI_COMMAND) != sizeof(cmd)) {
|
|
error_report("IGD device %s - failed to write PCI command register",
|
|
vdev->vbasedev.name);
|
|
}
|
|
|
|
for (i = 1; i < vfio_igd_gtt_max(vdev); i += 4) {
|
|
vfio_region_write(&vdev->bars[4].region, 0, i, 4);
|
|
vfio_region_write(&vdev->bars[4].region, 4, 0, 4);
|
|
}
|
|
|
|
if (pwrite(vdev->vbasedev.fd, &cmd_orig, sizeof(cmd_orig),
|
|
vdev->config_offset + PCI_COMMAND) != sizeof(cmd_orig)) {
|
|
error_report("IGD device %s - failed to restore PCI command register",
|
|
vdev->vbasedev.name);
|
|
}
|
|
|
|
trace_vfio_pci_igd_bdsm_enabled(vdev->vbasedev.name, ggms_mb + gms_mb);
|
|
|
|
out:
|
|
g_free(rom);
|
|
g_free(opregion);
|
|
g_free(host);
|
|
g_free(lpc);
|
|
}
|
|
|
|
/*
|
|
* Common quirk probe entry points.
|
|
*/
|
|
void vfio_vga_quirk_setup(VFIOPCIDevice *vdev)
|
|
{
|
|
vfio_vga_probe_ati_3c3_quirk(vdev);
|
|
vfio_vga_probe_nvidia_3d0_quirk(vdev);
|
|
}
|
|
|
|
void vfio_vga_quirk_exit(VFIOPCIDevice *vdev)
|
|
{
|
|
VFIOQuirk *quirk;
|
|
int i, j;
|
|
|
|
for (i = 0; i < ARRAY_SIZE(vdev->vga->region); i++) {
|
|
QLIST_FOREACH(quirk, &vdev->vga->region[i].quirks, next) {
|
|
for (j = 0; j < quirk->nr_mem; j++) {
|
|
memory_region_del_subregion(&vdev->vga->region[i].mem,
|
|
&quirk->mem[j]);
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
void vfio_vga_quirk_finalize(VFIOPCIDevice *vdev)
|
|
{
|
|
int i, j;
|
|
|
|
for (i = 0; i < ARRAY_SIZE(vdev->vga->region); i++) {
|
|
while (!QLIST_EMPTY(&vdev->vga->region[i].quirks)) {
|
|
VFIOQuirk *quirk = QLIST_FIRST(&vdev->vga->region[i].quirks);
|
|
QLIST_REMOVE(quirk, next);
|
|
for (j = 0; j < quirk->nr_mem; j++) {
|
|
object_unparent(OBJECT(&quirk->mem[j]));
|
|
}
|
|
g_free(quirk->mem);
|
|
g_free(quirk->data);
|
|
g_free(quirk);
|
|
}
|
|
}
|
|
}
|
|
|
|
void vfio_bar_quirk_setup(VFIOPCIDevice *vdev, int nr)
|
|
{
|
|
vfio_probe_ati_bar4_quirk(vdev, nr);
|
|
vfio_probe_ati_bar2_quirk(vdev, nr);
|
|
vfio_probe_nvidia_bar5_quirk(vdev, nr);
|
|
vfio_probe_nvidia_bar0_quirk(vdev, nr);
|
|
vfio_probe_rtl8168_bar2_quirk(vdev, nr);
|
|
vfio_probe_igd_bar4_quirk(vdev, nr);
|
|
}
|
|
|
|
void vfio_bar_quirk_exit(VFIOPCIDevice *vdev, int nr)
|
|
{
|
|
VFIOBAR *bar = &vdev->bars[nr];
|
|
VFIOQuirk *quirk;
|
|
int i;
|
|
|
|
QLIST_FOREACH(quirk, &bar->quirks, next) {
|
|
for (i = 0; i < quirk->nr_mem; i++) {
|
|
memory_region_del_subregion(bar->region.mem, &quirk->mem[i]);
|
|
}
|
|
}
|
|
}
|
|
|
|
void vfio_bar_quirk_finalize(VFIOPCIDevice *vdev, int nr)
|
|
{
|
|
VFIOBAR *bar = &vdev->bars[nr];
|
|
int i;
|
|
|
|
while (!QLIST_EMPTY(&bar->quirks)) {
|
|
VFIOQuirk *quirk = QLIST_FIRST(&bar->quirks);
|
|
QLIST_REMOVE(quirk, next);
|
|
for (i = 0; i < quirk->nr_mem; i++) {
|
|
object_unparent(OBJECT(&quirk->mem[i]));
|
|
}
|
|
g_free(quirk->mem);
|
|
g_free(quirk->data);
|
|
g_free(quirk);
|
|
}
|
|
}
|
|
|
|
/*
|
|
* Reset quirks
|
|
*/
|
|
|
|
/*
|
|
* AMD Radeon PCI config reset, based on Linux:
|
|
* drivers/gpu/drm/radeon/ci_smc.c:ci_is_smc_running()
|
|
* drivers/gpu/drm/radeon/radeon_device.c:radeon_pci_config_reset
|
|
* drivers/gpu/drm/radeon/ci_smc.c:ci_reset_smc()
|
|
* drivers/gpu/drm/radeon/ci_smc.c:ci_stop_smc_clock()
|
|
* IDs: include/drm/drm_pciids.h
|
|
* Registers: http://cgit.freedesktop.org/~agd5f/linux/commit/?id=4e2aa447f6f0
|
|
*
|
|
* Bonaire and Hawaii GPUs do not respond to a bus reset. This is a bug in the
|
|
* hardware that should be fixed on future ASICs. The symptom of this is that
|
|
* once the accerlated driver loads, Windows guests will bsod on subsequent
|
|
* attmpts to load the driver, such as after VM reset or shutdown/restart. To
|
|
* work around this, we do an AMD specific PCI config reset, followed by an SMC
|
|
* reset. The PCI config reset only works if SMC firmware is running, so we
|
|
* have a dependency on the state of the device as to whether this reset will
|
|
* be effective. There are still cases where we won't be able to kick the
|
|
* device into working, but this greatly improves the usability overall. The
|
|
* config reset magic is relatively common on AMD GPUs, but the setup and SMC
|
|
* poking is largely ASIC specific.
|
|
*/
|
|
static bool vfio_radeon_smc_is_running(VFIOPCIDevice *vdev)
|
|
{
|
|
uint32_t clk, pc_c;
|
|
|
|
/*
|
|
* Registers 200h and 204h are index and data registers for accessing
|
|
* indirect configuration registers within the device.
|
|
*/
|
|
vfio_region_write(&vdev->bars[5].region, 0x200, 0x80000004, 4);
|
|
clk = vfio_region_read(&vdev->bars[5].region, 0x204, 4);
|
|
vfio_region_write(&vdev->bars[5].region, 0x200, 0x80000370, 4);
|
|
pc_c = vfio_region_read(&vdev->bars[5].region, 0x204, 4);
|
|
|
|
return (!(clk & 1) && (0x20100 <= pc_c));
|
|
}
|
|
|
|
/*
|
|
* The scope of a config reset is controlled by a mode bit in the misc register
|
|
* and a fuse, exposed as a bit in another register. The fuse is the default
|
|
* (0 = GFX, 1 = whole GPU), the misc bit is a toggle, with the forumula
|
|
* scope = !(misc ^ fuse), where the resulting scope is defined the same as
|
|
* the fuse. A truth table therefore tells us that if misc == fuse, we need
|
|
* to flip the value of the bit in the misc register.
|
|
*/
|
|
static void vfio_radeon_set_gfx_only_reset(VFIOPCIDevice *vdev)
|
|
{
|
|
uint32_t misc, fuse;
|
|
bool a, b;
|
|
|
|
vfio_region_write(&vdev->bars[5].region, 0x200, 0xc00c0000, 4);
|
|
fuse = vfio_region_read(&vdev->bars[5].region, 0x204, 4);
|
|
b = fuse & 64;
|
|
|
|
vfio_region_write(&vdev->bars[5].region, 0x200, 0xc0000010, 4);
|
|
misc = vfio_region_read(&vdev->bars[5].region, 0x204, 4);
|
|
a = misc & 2;
|
|
|
|
if (a == b) {
|
|
vfio_region_write(&vdev->bars[5].region, 0x204, misc ^ 2, 4);
|
|
vfio_region_read(&vdev->bars[5].region, 0x204, 4); /* flush */
|
|
}
|
|
}
|
|
|
|
static int vfio_radeon_reset(VFIOPCIDevice *vdev)
|
|
{
|
|
PCIDevice *pdev = &vdev->pdev;
|
|
int i, ret = 0;
|
|
uint32_t data;
|
|
|
|
/* Defer to a kernel implemented reset */
|
|
if (vdev->vbasedev.reset_works) {
|
|
trace_vfio_quirk_ati_bonaire_reset_skipped(vdev->vbasedev.name);
|
|
return -ENODEV;
|
|
}
|
|
|
|
/* Enable only memory BAR access */
|
|
vfio_pci_write_config(pdev, PCI_COMMAND, PCI_COMMAND_MEMORY, 2);
|
|
|
|
/* Reset only works if SMC firmware is loaded and running */
|
|
if (!vfio_radeon_smc_is_running(vdev)) {
|
|
ret = -EINVAL;
|
|
trace_vfio_quirk_ati_bonaire_reset_no_smc(vdev->vbasedev.name);
|
|
goto out;
|
|
}
|
|
|
|
/* Make sure only the GFX function is reset */
|
|
vfio_radeon_set_gfx_only_reset(vdev);
|
|
|
|
/* AMD PCI config reset */
|
|
vfio_pci_write_config(pdev, 0x7c, 0x39d5e86b, 4);
|
|
usleep(100);
|
|
|
|
/* Read back the memory size to make sure we're out of reset */
|
|
for (i = 0; i < 100000; i++) {
|
|
if (vfio_region_read(&vdev->bars[5].region, 0x5428, 4) != 0xffffffff) {
|
|
goto reset_smc;
|
|
}
|
|
usleep(1);
|
|
}
|
|
|
|
trace_vfio_quirk_ati_bonaire_reset_timeout(vdev->vbasedev.name);
|
|
|
|
reset_smc:
|
|
/* Reset SMC */
|
|
vfio_region_write(&vdev->bars[5].region, 0x200, 0x80000000, 4);
|
|
data = vfio_region_read(&vdev->bars[5].region, 0x204, 4);
|
|
data |= 1;
|
|
vfio_region_write(&vdev->bars[5].region, 0x204, data, 4);
|
|
|
|
/* Disable SMC clock */
|
|
vfio_region_write(&vdev->bars[5].region, 0x200, 0x80000004, 4);
|
|
data = vfio_region_read(&vdev->bars[5].region, 0x204, 4);
|
|
data |= 1;
|
|
vfio_region_write(&vdev->bars[5].region, 0x204, data, 4);
|
|
|
|
trace_vfio_quirk_ati_bonaire_reset_done(vdev->vbasedev.name);
|
|
|
|
out:
|
|
/* Restore PCI command register */
|
|
vfio_pci_write_config(pdev, PCI_COMMAND, 0, 2);
|
|
|
|
return ret;
|
|
}
|
|
|
|
void vfio_setup_resetfn_quirk(VFIOPCIDevice *vdev)
|
|
{
|
|
switch (vdev->vendor_id) {
|
|
case 0x1002:
|
|
switch (vdev->device_id) {
|
|
/* Bonaire */
|
|
case 0x6649: /* Bonaire [FirePro W5100] */
|
|
case 0x6650:
|
|
case 0x6651:
|
|
case 0x6658: /* Bonaire XTX [Radeon R7 260X] */
|
|
case 0x665c: /* Bonaire XT [Radeon HD 7790/8770 / R9 260 OEM] */
|
|
case 0x665d: /* Bonaire [Radeon R7 200 Series] */
|
|
/* Hawaii */
|
|
case 0x67A0: /* Hawaii XT GL [FirePro W9100] */
|
|
case 0x67A1: /* Hawaii PRO GL [FirePro W8100] */
|
|
case 0x67A2:
|
|
case 0x67A8:
|
|
case 0x67A9:
|
|
case 0x67AA:
|
|
case 0x67B0: /* Hawaii XT [Radeon R9 290X] */
|
|
case 0x67B1: /* Hawaii PRO [Radeon R9 290] */
|
|
case 0x67B8:
|
|
case 0x67B9:
|
|
case 0x67BA:
|
|
case 0x67BE:
|
|
vdev->resetfn = vfio_radeon_reset;
|
|
trace_vfio_quirk_ati_bonaire_reset(vdev->vbasedev.name);
|
|
break;
|
|
}
|
|
break;
|
|
}
|
|
}
|