2 * device quirks for PCI devices
4 * Copyright Red Hat, Inc. 2012-2015
7 * Alex Williamson <alex.williamson@redhat.com>
9 * This work is licensed under the terms of the GNU GPL, version 2. See
10 * the COPYING file in the top-level directory.
13 #include "qemu/osdep.h"
14 #include "qemu/error-report.h"
15 #include "qemu/range.h"
16 #include "qapi/error.h"
17 #include "qapi/visitor.h"
18 #include "hw/nvram/fw_cfg.h"
22 /* Use uin32_t for vendor & device so PCI_ANY_ID expands and cannot match hw */
23 static bool vfio_pci_is(VFIOPCIDevice
*vdev
, uint32_t vendor
, uint32_t device
)
25 return (vendor
== PCI_ANY_ID
|| vendor
== vdev
->vendor_id
) &&
26 (device
== PCI_ANY_ID
|| device
== vdev
->device_id
);
29 static bool vfio_is_vga(VFIOPCIDevice
*vdev
)
31 PCIDevice
*pdev
= &vdev
->pdev
;
32 uint16_t class = pci_get_word(pdev
->config
+ PCI_CLASS_DEVICE
);
34 return class == PCI_CLASS_DISPLAY_VGA
;
38 * List of device ids/vendor ids for which to disable
39 * option rom loading. This avoids the guest hangs during rom
40 * execution as noticed with the BCM 57810 card for lack of a
41 * more better way to handle such issues.
42 * The user can still override by specifying a romfile or
44 * Please see https://bugs.launchpad.net/qemu/+bug/1284874
45 * for an analysis of the 57810 card hang. When adding
46 * a new vendor id/device id combination below, please also add
47 * your card/environment details and information that could
48 * help in debugging to the bug tracking this issue
54 { 0x14e4, 0x168e }, /* Broadcom BCM 57810 */
57 bool vfio_blacklist_opt_rom(VFIOPCIDevice
*vdev
)
61 for (i
= 0 ; i
< ARRAY_SIZE(romblacklist
); i
++) {
62 if (vfio_pci_is(vdev
, romblacklist
[i
].vendor
, romblacklist
[i
].device
)) {
63 trace_vfio_quirk_rom_blacklisted(vdev
->vbasedev
.name
,
64 romblacklist
[i
].vendor
,
65 romblacklist
[i
].device
);
73 * Device specific region quirks (mostly backdoors to PCI config space)
77 * The generic window quirks operate on an address and data register,
78 * vfio_generic_window_address_quirk handles the address register and
79 * vfio_generic_window_data_quirk handles the data register. These ops
80 * pass reads and writes through to hardware until a value matching the
81 * stored address match/mask is written. When this occurs, the data
82 * register access emulated PCI config space for the device rather than
83 * passing through accesses. This enables devices where PCI config space
84 * is accessible behind a window register to maintain the virtualization
85 * provided through vfio.
87 typedef struct VFIOConfigWindowMatch
{
90 } VFIOConfigWindowMatch
;
92 typedef struct VFIOConfigWindowQuirk
{
93 struct VFIOPCIDevice
*vdev
;
97 uint32_t address_offset
;
103 MemoryRegion
*addr_mem
;
104 MemoryRegion
*data_mem
;
107 VFIOConfigWindowMatch matches
[];
108 } VFIOConfigWindowQuirk
;
110 static uint64_t vfio_generic_window_quirk_address_read(void *opaque
,
114 VFIOConfigWindowQuirk
*window
= opaque
;
115 VFIOPCIDevice
*vdev
= window
->vdev
;
117 return vfio_region_read(&vdev
->bars
[window
->bar
].region
,
118 addr
+ window
->address_offset
, size
);
121 static void vfio_generic_window_quirk_address_write(void *opaque
, hwaddr addr
,
125 VFIOConfigWindowQuirk
*window
= opaque
;
126 VFIOPCIDevice
*vdev
= window
->vdev
;
129 window
->window_enabled
= false;
131 vfio_region_write(&vdev
->bars
[window
->bar
].region
,
132 addr
+ window
->address_offset
, data
, size
);
134 for (i
= 0; i
< window
->nr_matches
; i
++) {
135 if ((data
& ~window
->matches
[i
].mask
) == window
->matches
[i
].match
) {
136 window
->window_enabled
= true;
137 window
->address_val
= data
& window
->matches
[i
].mask
;
138 trace_vfio_quirk_generic_window_address_write(vdev
->vbasedev
.name
,
139 memory_region_name(window
->addr_mem
), data
);
145 static const MemoryRegionOps vfio_generic_window_address_quirk
= {
146 .read
= vfio_generic_window_quirk_address_read
,
147 .write
= vfio_generic_window_quirk_address_write
,
148 .endianness
= DEVICE_LITTLE_ENDIAN
,
151 static uint64_t vfio_generic_window_quirk_data_read(void *opaque
,
152 hwaddr addr
, unsigned size
)
154 VFIOConfigWindowQuirk
*window
= opaque
;
155 VFIOPCIDevice
*vdev
= window
->vdev
;
158 /* Always read data reg, discard if window enabled */
159 data
= vfio_region_read(&vdev
->bars
[window
->bar
].region
,
160 addr
+ window
->data_offset
, size
);
162 if (window
->window_enabled
) {
163 data
= vfio_pci_read_config(&vdev
->pdev
, window
->address_val
, size
);
164 trace_vfio_quirk_generic_window_data_read(vdev
->vbasedev
.name
,
165 memory_region_name(window
->data_mem
), data
);
171 static void vfio_generic_window_quirk_data_write(void *opaque
, hwaddr addr
,
172 uint64_t data
, unsigned size
)
174 VFIOConfigWindowQuirk
*window
= opaque
;
175 VFIOPCIDevice
*vdev
= window
->vdev
;
177 if (window
->window_enabled
) {
178 vfio_pci_write_config(&vdev
->pdev
, window
->address_val
, data
, size
);
179 trace_vfio_quirk_generic_window_data_write(vdev
->vbasedev
.name
,
180 memory_region_name(window
->data_mem
), data
);
184 vfio_region_write(&vdev
->bars
[window
->bar
].region
,
185 addr
+ window
->data_offset
, data
, size
);
188 static const MemoryRegionOps vfio_generic_window_data_quirk
= {
189 .read
= vfio_generic_window_quirk_data_read
,
190 .write
= vfio_generic_window_quirk_data_write
,
191 .endianness
= DEVICE_LITTLE_ENDIAN
,
195 * The generic mirror quirk handles devices which expose PCI config space
196 * through a region within a BAR. When enabled, reads and writes are
197 * redirected through to emulated PCI config space. XXX if PCI config space
198 * used memory regions, this could just be an alias.
200 typedef struct VFIOConfigMirrorQuirk
{
201 struct VFIOPCIDevice
*vdev
;
205 } VFIOConfigMirrorQuirk
;
207 static uint64_t vfio_generic_quirk_mirror_read(void *opaque
,
208 hwaddr addr
, unsigned size
)
210 VFIOConfigMirrorQuirk
*mirror
= opaque
;
211 VFIOPCIDevice
*vdev
= mirror
->vdev
;
214 /* Read and discard in case the hardware cares */
215 (void)vfio_region_read(&vdev
->bars
[mirror
->bar
].region
,
216 addr
+ mirror
->offset
, size
);
218 data
= vfio_pci_read_config(&vdev
->pdev
, addr
, size
);
219 trace_vfio_quirk_generic_mirror_read(vdev
->vbasedev
.name
,
220 memory_region_name(mirror
->mem
),
225 static void vfio_generic_quirk_mirror_write(void *opaque
, hwaddr addr
,
226 uint64_t data
, unsigned size
)
228 VFIOConfigMirrorQuirk
*mirror
= opaque
;
229 VFIOPCIDevice
*vdev
= mirror
->vdev
;
231 vfio_pci_write_config(&vdev
->pdev
, addr
, data
, size
);
232 trace_vfio_quirk_generic_mirror_write(vdev
->vbasedev
.name
,
233 memory_region_name(mirror
->mem
),
237 static const MemoryRegionOps vfio_generic_mirror_quirk
= {
238 .read
= vfio_generic_quirk_mirror_read
,
239 .write
= vfio_generic_quirk_mirror_write
,
240 .endianness
= DEVICE_LITTLE_ENDIAN
,
243 /* Is range1 fully contained within range2? */
244 static bool vfio_range_contained(uint64_t first1
, uint64_t len1
,
245 uint64_t first2
, uint64_t len2
) {
246 return (first1
>= first2
&& first1
+ len1
<= first2
+ len2
);
249 #define PCI_VENDOR_ID_ATI 0x1002
252 * Radeon HD cards (HD5450 & HD7850) report the upper byte of the I/O port BAR
253 * through VGA register 0x3c3. On newer cards, the I/O port BAR is always
254 * BAR4 (older cards like the X550 used BAR1, but we don't care to support
255 * those). Note that on bare metal, a read of 0x3c3 doesn't always return the
256 * I/O port BAR address. Originally this was coded to return the virtual BAR
257 * address only if the physical register read returns the actual BAR address,
258 * but users have reported greater success if we return the virtual address
261 static uint64_t vfio_ati_3c3_quirk_read(void *opaque
,
262 hwaddr addr
, unsigned size
)
264 VFIOPCIDevice
*vdev
= opaque
;
265 uint64_t data
= vfio_pci_read_config(&vdev
->pdev
,
266 PCI_BASE_ADDRESS_4
+ 1, size
);
268 trace_vfio_quirk_ati_3c3_read(vdev
->vbasedev
.name
, data
);
273 static const MemoryRegionOps vfio_ati_3c3_quirk
= {
274 .read
= vfio_ati_3c3_quirk_read
,
275 .endianness
= DEVICE_LITTLE_ENDIAN
,
278 static void vfio_vga_probe_ati_3c3_quirk(VFIOPCIDevice
*vdev
)
283 * As long as the BAR is >= 256 bytes it will be aligned such that the
284 * lower byte is always zero. Filter out anything else, if it exists.
286 if (!vfio_pci_is(vdev
, PCI_VENDOR_ID_ATI
, PCI_ANY_ID
) ||
287 !vdev
->bars
[4].ioport
|| vdev
->bars
[4].region
.size
< 256) {
291 quirk
= g_malloc0(sizeof(*quirk
));
292 quirk
->mem
= g_new0(MemoryRegion
, 1);
295 memory_region_init_io(quirk
->mem
, OBJECT(vdev
), &vfio_ati_3c3_quirk
, vdev
,
296 "vfio-ati-3c3-quirk", 1);
297 memory_region_add_subregion(&vdev
->vga
->region
[QEMU_PCI_VGA_IO_HI
].mem
,
298 3 /* offset 3 bytes from 0x3c0 */, quirk
->mem
);
300 QLIST_INSERT_HEAD(&vdev
->vga
->region
[QEMU_PCI_VGA_IO_HI
].quirks
,
303 trace_vfio_quirk_ati_3c3_probe(vdev
->vbasedev
.name
);
307 * Newer ATI/AMD devices, including HD5450 and HD7850, have a mirror to PCI
308 * config space through MMIO BAR2 at offset 0x4000. Nothing seems to access
309 * the MMIO space directly, but a window to this space is provided through
310 * I/O port BAR4. Offset 0x0 is the address register and offset 0x4 is the
311 * data register. When the address is programmed to a range of 0x4000-0x4fff
312 * PCI configuration space is available. Experimentation seems to indicate
313 * that read-only may be provided by hardware.
315 static void vfio_probe_ati_bar4_quirk(VFIOPCIDevice
*vdev
, int nr
)
318 VFIOConfigWindowQuirk
*window
;
320 /* This windows doesn't seem to be used except by legacy VGA code */
321 if (!vfio_pci_is(vdev
, PCI_VENDOR_ID_ATI
, PCI_ANY_ID
) ||
322 !vdev
->vga
|| nr
!= 4) {
326 quirk
= g_malloc0(sizeof(*quirk
));
327 quirk
->mem
= g_new0(MemoryRegion
, 2);
329 window
= quirk
->data
= g_malloc0(sizeof(*window
) +
330 sizeof(VFIOConfigWindowMatch
));
332 window
->address_offset
= 0;
333 window
->data_offset
= 4;
334 window
->nr_matches
= 1;
335 window
->matches
[0].match
= 0x4000;
336 window
->matches
[0].mask
= vdev
->config_size
- 1;
338 window
->addr_mem
= &quirk
->mem
[0];
339 window
->data_mem
= &quirk
->mem
[1];
341 memory_region_init_io(window
->addr_mem
, OBJECT(vdev
),
342 &vfio_generic_window_address_quirk
, window
,
343 "vfio-ati-bar4-window-address-quirk", 4);
344 memory_region_add_subregion_overlap(vdev
->bars
[nr
].region
.mem
,
345 window
->address_offset
,
346 window
->addr_mem
, 1);
348 memory_region_init_io(window
->data_mem
, OBJECT(vdev
),
349 &vfio_generic_window_data_quirk
, window
,
350 "vfio-ati-bar4-window-data-quirk", 4);
351 memory_region_add_subregion_overlap(vdev
->bars
[nr
].region
.mem
,
353 window
->data_mem
, 1);
355 QLIST_INSERT_HEAD(&vdev
->bars
[nr
].quirks
, quirk
, next
);
357 trace_vfio_quirk_ati_bar4_probe(vdev
->vbasedev
.name
);
361 * Trap the BAR2 MMIO mirror to config space as well.
363 static void vfio_probe_ati_bar2_quirk(VFIOPCIDevice
*vdev
, int nr
)
366 VFIOConfigMirrorQuirk
*mirror
;
368 /* Only enable on newer devices where BAR2 is 64bit */
369 if (!vfio_pci_is(vdev
, PCI_VENDOR_ID_ATI
, PCI_ANY_ID
) ||
370 !vdev
->vga
|| nr
!= 2 || !vdev
->bars
[2].mem64
) {
374 quirk
= g_malloc0(sizeof(*quirk
));
375 mirror
= quirk
->data
= g_malloc0(sizeof(*mirror
));
376 mirror
->mem
= quirk
->mem
= g_new0(MemoryRegion
, 1);
379 mirror
->offset
= 0x4000;
382 memory_region_init_io(mirror
->mem
, OBJECT(vdev
),
383 &vfio_generic_mirror_quirk
, mirror
,
384 "vfio-ati-bar2-4000-quirk", PCI_CONFIG_SPACE_SIZE
);
385 memory_region_add_subregion_overlap(vdev
->bars
[nr
].region
.mem
,
386 mirror
->offset
, mirror
->mem
, 1);
388 QLIST_INSERT_HEAD(&vdev
->bars
[nr
].quirks
, quirk
, next
);
390 trace_vfio_quirk_ati_bar2_probe(vdev
->vbasedev
.name
);
394 * Older ATI/AMD cards like the X550 have a similar window to that above.
395 * I/O port BAR1 provides a window to a mirror of PCI config space located
396 * in BAR2 at offset 0xf00. We don't care to support such older cards, but
397 * note it for future reference.
400 #define PCI_VENDOR_ID_NVIDIA 0x10de
403 * Nvidia has several different methods to get to config space, the
404 * nouveu project has several of these documented here:
405 * https://github.com/pathscale/envytools/tree/master/hwdocs
407 * The first quirk is actually not documented in envytools and is found
408 * on 10de:01d1 (NVIDIA Corporation G72 [GeForce 7300 LE]). This is an
409 * NV46 chipset. The backdoor uses the legacy VGA I/O ports to access
410 * the mirror of PCI config space found at BAR0 offset 0x1800. The access
411 * sequence first writes 0x338 to I/O port 0x3d4. The target offset is
412 * then written to 0x3d0. Finally 0x538 is written for a read and 0x738
413 * is written for a write to 0x3d4. The BAR0 offset is then accessible
414 * through 0x3d0. This quirk doesn't seem to be necessary on newer cards
415 * that use the I/O port BAR5 window but it doesn't hurt to leave it.
417 typedef enum {NONE
= 0, SELECT
, WINDOW
, READ
, WRITE
} VFIONvidia3d0State
;
418 static const char *nv3d0_states
[] = { "NONE", "SELECT",
419 "WINDOW", "READ", "WRITE" };
421 typedef struct VFIONvidia3d0Quirk
{
423 VFIONvidia3d0State state
;
425 } VFIONvidia3d0Quirk
;
427 static uint64_t vfio_nvidia_3d4_quirk_read(void *opaque
,
428 hwaddr addr
, unsigned size
)
430 VFIONvidia3d0Quirk
*quirk
= opaque
;
431 VFIOPCIDevice
*vdev
= quirk
->vdev
;
435 return vfio_vga_read(&vdev
->vga
->region
[QEMU_PCI_VGA_IO_HI
],
439 static void vfio_nvidia_3d4_quirk_write(void *opaque
, hwaddr addr
,
440 uint64_t data
, unsigned size
)
442 VFIONvidia3d0Quirk
*quirk
= opaque
;
443 VFIOPCIDevice
*vdev
= quirk
->vdev
;
444 VFIONvidia3d0State old_state
= quirk
->state
;
450 if (old_state
== NONE
) {
451 quirk
->state
= SELECT
;
452 trace_vfio_quirk_nvidia_3d0_state(vdev
->vbasedev
.name
,
453 nv3d0_states
[quirk
->state
]);
457 if (old_state
== WINDOW
) {
459 trace_vfio_quirk_nvidia_3d0_state(vdev
->vbasedev
.name
,
460 nv3d0_states
[quirk
->state
]);
464 if (old_state
== WINDOW
) {
465 quirk
->state
= WRITE
;
466 trace_vfio_quirk_nvidia_3d0_state(vdev
->vbasedev
.name
,
467 nv3d0_states
[quirk
->state
]);
472 vfio_vga_write(&vdev
->vga
->region
[QEMU_PCI_VGA_IO_HI
],
473 addr
+ 0x14, data
, size
);
476 static const MemoryRegionOps vfio_nvidia_3d4_quirk
= {
477 .read
= vfio_nvidia_3d4_quirk_read
,
478 .write
= vfio_nvidia_3d4_quirk_write
,
479 .endianness
= DEVICE_LITTLE_ENDIAN
,
482 static uint64_t vfio_nvidia_3d0_quirk_read(void *opaque
,
483 hwaddr addr
, unsigned size
)
485 VFIONvidia3d0Quirk
*quirk
= opaque
;
486 VFIOPCIDevice
*vdev
= quirk
->vdev
;
487 VFIONvidia3d0State old_state
= quirk
->state
;
488 uint64_t data
= vfio_vga_read(&vdev
->vga
->region
[QEMU_PCI_VGA_IO_HI
],
493 if (old_state
== READ
&&
494 (quirk
->offset
& ~(PCI_CONFIG_SPACE_SIZE
- 1)) == 0x1800) {
495 uint8_t offset
= quirk
->offset
& (PCI_CONFIG_SPACE_SIZE
- 1);
497 data
= vfio_pci_read_config(&vdev
->pdev
, offset
, size
);
498 trace_vfio_quirk_nvidia_3d0_read(vdev
->vbasedev
.name
,
505 static void vfio_nvidia_3d0_quirk_write(void *opaque
, hwaddr addr
,
506 uint64_t data
, unsigned size
)
508 VFIONvidia3d0Quirk
*quirk
= opaque
;
509 VFIOPCIDevice
*vdev
= quirk
->vdev
;
510 VFIONvidia3d0State old_state
= quirk
->state
;
514 if (old_state
== SELECT
) {
515 quirk
->offset
= (uint32_t)data
;
516 quirk
->state
= WINDOW
;
517 trace_vfio_quirk_nvidia_3d0_state(vdev
->vbasedev
.name
,
518 nv3d0_states
[quirk
->state
]);
519 } else if (old_state
== WRITE
) {
520 if ((quirk
->offset
& ~(PCI_CONFIG_SPACE_SIZE
- 1)) == 0x1800) {
521 uint8_t offset
= quirk
->offset
& (PCI_CONFIG_SPACE_SIZE
- 1);
523 vfio_pci_write_config(&vdev
->pdev
, offset
, data
, size
);
524 trace_vfio_quirk_nvidia_3d0_write(vdev
->vbasedev
.name
,
530 vfio_vga_write(&vdev
->vga
->region
[QEMU_PCI_VGA_IO_HI
],
531 addr
+ 0x10, data
, size
);
534 static const MemoryRegionOps vfio_nvidia_3d0_quirk
= {
535 .read
= vfio_nvidia_3d0_quirk_read
,
536 .write
= vfio_nvidia_3d0_quirk_write
,
537 .endianness
= DEVICE_LITTLE_ENDIAN
,
540 static void vfio_vga_probe_nvidia_3d0_quirk(VFIOPCIDevice
*vdev
)
543 VFIONvidia3d0Quirk
*data
;
545 if (!vfio_pci_is(vdev
, PCI_VENDOR_ID_NVIDIA
, PCI_ANY_ID
) ||
546 !vdev
->bars
[1].region
.size
) {
550 quirk
= g_malloc0(sizeof(*quirk
));
551 quirk
->data
= data
= g_malloc0(sizeof(*data
));
552 quirk
->mem
= g_new0(MemoryRegion
, 2);
556 memory_region_init_io(&quirk
->mem
[0], OBJECT(vdev
), &vfio_nvidia_3d4_quirk
,
557 data
, "vfio-nvidia-3d4-quirk", 2);
558 memory_region_add_subregion(&vdev
->vga
->region
[QEMU_PCI_VGA_IO_HI
].mem
,
559 0x14 /* 0x3c0 + 0x14 */, &quirk
->mem
[0]);
561 memory_region_init_io(&quirk
->mem
[1], OBJECT(vdev
), &vfio_nvidia_3d0_quirk
,
562 data
, "vfio-nvidia-3d0-quirk", 2);
563 memory_region_add_subregion(&vdev
->vga
->region
[QEMU_PCI_VGA_IO_HI
].mem
,
564 0x10 /* 0x3c0 + 0x10 */, &quirk
->mem
[1]);
566 QLIST_INSERT_HEAD(&vdev
->vga
->region
[QEMU_PCI_VGA_IO_HI
].quirks
,
569 trace_vfio_quirk_nvidia_3d0_probe(vdev
->vbasedev
.name
);
573 * The second quirk is documented in envytools. The I/O port BAR5 is just
574 * a set of address/data ports to the MMIO BARs. The BAR we care about is
575 * again BAR0. This backdoor is apparently a bit newer than the one above
576 * so we need to not only trap 256 bytes @0x1800, but all of PCI config
577 * space, including extended space is available at the 4k @0x88000.
579 typedef struct VFIONvidiaBAR5Quirk
{
582 MemoryRegion
*addr_mem
;
583 MemoryRegion
*data_mem
;
585 VFIOConfigWindowQuirk window
; /* last for match data */
586 } VFIONvidiaBAR5Quirk
;
588 static void vfio_nvidia_bar5_enable(VFIONvidiaBAR5Quirk
*bar5
)
590 VFIOPCIDevice
*vdev
= bar5
->window
.vdev
;
592 if (((bar5
->master
& bar5
->enable
) & 0x1) == bar5
->enabled
) {
596 bar5
->enabled
= !bar5
->enabled
;
597 trace_vfio_quirk_nvidia_bar5_state(vdev
->vbasedev
.name
,
598 bar5
->enabled
? "Enable" : "Disable");
599 memory_region_set_enabled(bar5
->addr_mem
, bar5
->enabled
);
600 memory_region_set_enabled(bar5
->data_mem
, bar5
->enabled
);
603 static uint64_t vfio_nvidia_bar5_quirk_master_read(void *opaque
,
604 hwaddr addr
, unsigned size
)
606 VFIONvidiaBAR5Quirk
*bar5
= opaque
;
607 VFIOPCIDevice
*vdev
= bar5
->window
.vdev
;
609 return vfio_region_read(&vdev
->bars
[5].region
, addr
, size
);
612 static void vfio_nvidia_bar5_quirk_master_write(void *opaque
, hwaddr addr
,
613 uint64_t data
, unsigned size
)
615 VFIONvidiaBAR5Quirk
*bar5
= opaque
;
616 VFIOPCIDevice
*vdev
= bar5
->window
.vdev
;
618 vfio_region_write(&vdev
->bars
[5].region
, addr
, data
, size
);
621 vfio_nvidia_bar5_enable(bar5
);
624 static const MemoryRegionOps vfio_nvidia_bar5_quirk_master
= {
625 .read
= vfio_nvidia_bar5_quirk_master_read
,
626 .write
= vfio_nvidia_bar5_quirk_master_write
,
627 .endianness
= DEVICE_LITTLE_ENDIAN
,
630 static uint64_t vfio_nvidia_bar5_quirk_enable_read(void *opaque
,
631 hwaddr addr
, unsigned size
)
633 VFIONvidiaBAR5Quirk
*bar5
= opaque
;
634 VFIOPCIDevice
*vdev
= bar5
->window
.vdev
;
636 return vfio_region_read(&vdev
->bars
[5].region
, addr
+ 4, size
);
639 static void vfio_nvidia_bar5_quirk_enable_write(void *opaque
, hwaddr addr
,
640 uint64_t data
, unsigned size
)
642 VFIONvidiaBAR5Quirk
*bar5
= opaque
;
643 VFIOPCIDevice
*vdev
= bar5
->window
.vdev
;
645 vfio_region_write(&vdev
->bars
[5].region
, addr
+ 4, data
, size
);
648 vfio_nvidia_bar5_enable(bar5
);
651 static const MemoryRegionOps vfio_nvidia_bar5_quirk_enable
= {
652 .read
= vfio_nvidia_bar5_quirk_enable_read
,
653 .write
= vfio_nvidia_bar5_quirk_enable_write
,
654 .endianness
= DEVICE_LITTLE_ENDIAN
,
657 static void vfio_probe_nvidia_bar5_quirk(VFIOPCIDevice
*vdev
, int nr
)
660 VFIONvidiaBAR5Quirk
*bar5
;
661 VFIOConfigWindowQuirk
*window
;
663 if (!vfio_pci_is(vdev
, PCI_VENDOR_ID_NVIDIA
, PCI_ANY_ID
) ||
664 !vdev
->vga
|| nr
!= 5 || !vdev
->bars
[5].ioport
) {
668 quirk
= g_malloc0(sizeof(*quirk
));
669 quirk
->mem
= g_new0(MemoryRegion
, 4);
671 bar5
= quirk
->data
= g_malloc0(sizeof(*bar5
) +
672 (sizeof(VFIOConfigWindowMatch
) * 2));
673 window
= &bar5
->window
;
676 window
->address_offset
= 0x8;
677 window
->data_offset
= 0xc;
678 window
->nr_matches
= 2;
679 window
->matches
[0].match
= 0x1800;
680 window
->matches
[0].mask
= PCI_CONFIG_SPACE_SIZE
- 1;
681 window
->matches
[1].match
= 0x88000;
682 window
->matches
[1].mask
= vdev
->config_size
- 1;
684 window
->addr_mem
= bar5
->addr_mem
= &quirk
->mem
[0];
685 window
->data_mem
= bar5
->data_mem
= &quirk
->mem
[1];
687 memory_region_init_io(window
->addr_mem
, OBJECT(vdev
),
688 &vfio_generic_window_address_quirk
, window
,
689 "vfio-nvidia-bar5-window-address-quirk", 4);
690 memory_region_add_subregion_overlap(vdev
->bars
[nr
].region
.mem
,
691 window
->address_offset
,
692 window
->addr_mem
, 1);
693 memory_region_set_enabled(window
->addr_mem
, false);
695 memory_region_init_io(window
->data_mem
, OBJECT(vdev
),
696 &vfio_generic_window_data_quirk
, window
,
697 "vfio-nvidia-bar5-window-data-quirk", 4);
698 memory_region_add_subregion_overlap(vdev
->bars
[nr
].region
.mem
,
700 window
->data_mem
, 1);
701 memory_region_set_enabled(window
->data_mem
, false);
703 memory_region_init_io(&quirk
->mem
[2], OBJECT(vdev
),
704 &vfio_nvidia_bar5_quirk_master
, bar5
,
705 "vfio-nvidia-bar5-master-quirk", 4);
706 memory_region_add_subregion_overlap(vdev
->bars
[nr
].region
.mem
,
707 0, &quirk
->mem
[2], 1);
709 memory_region_init_io(&quirk
->mem
[3], OBJECT(vdev
),
710 &vfio_nvidia_bar5_quirk_enable
, bar5
,
711 "vfio-nvidia-bar5-enable-quirk", 4);
712 memory_region_add_subregion_overlap(vdev
->bars
[nr
].region
.mem
,
713 4, &quirk
->mem
[3], 1);
715 QLIST_INSERT_HEAD(&vdev
->bars
[nr
].quirks
, quirk
, next
);
717 trace_vfio_quirk_nvidia_bar5_probe(vdev
->vbasedev
.name
);
721 * Finally, BAR0 itself. We want to redirect any accesses to either
722 * 0x1800 or 0x88000 through the PCI config space access functions.
724 static void vfio_nvidia_quirk_mirror_write(void *opaque
, hwaddr addr
,
725 uint64_t data
, unsigned size
)
727 VFIOConfigMirrorQuirk
*mirror
= opaque
;
728 VFIOPCIDevice
*vdev
= mirror
->vdev
;
729 PCIDevice
*pdev
= &vdev
->pdev
;
731 vfio_generic_quirk_mirror_write(opaque
, addr
, data
, size
);
734 * Nvidia seems to acknowledge MSI interrupts by writing 0xff to the
735 * MSI capability ID register. Both the ID and next register are
736 * read-only, so we allow writes covering either of those to real hw.
738 if ((pdev
->cap_present
& QEMU_PCI_CAP_MSI
) &&
739 vfio_range_contained(addr
, size
, pdev
->msi_cap
, PCI_MSI_FLAGS
)) {
740 vfio_region_write(&vdev
->bars
[mirror
->bar
].region
,
741 addr
+ mirror
->offset
, data
, size
);
742 trace_vfio_quirk_nvidia_bar0_msi_ack(vdev
->vbasedev
.name
);
746 static const MemoryRegionOps vfio_nvidia_mirror_quirk
= {
747 .read
= vfio_generic_quirk_mirror_read
,
748 .write
= vfio_nvidia_quirk_mirror_write
,
749 .endianness
= DEVICE_LITTLE_ENDIAN
,
752 static void vfio_probe_nvidia_bar0_quirk(VFIOPCIDevice
*vdev
, int nr
)
755 VFIOConfigMirrorQuirk
*mirror
;
757 if (!vfio_pci_is(vdev
, PCI_VENDOR_ID_NVIDIA
, PCI_ANY_ID
) ||
758 !vfio_is_vga(vdev
) || nr
!= 0) {
762 quirk
= g_malloc0(sizeof(*quirk
));
763 mirror
= quirk
->data
= g_malloc0(sizeof(*mirror
));
764 mirror
->mem
= quirk
->mem
= g_new0(MemoryRegion
, 1);
767 mirror
->offset
= 0x88000;
770 memory_region_init_io(mirror
->mem
, OBJECT(vdev
),
771 &vfio_nvidia_mirror_quirk
, mirror
,
772 "vfio-nvidia-bar0-88000-mirror-quirk",
774 memory_region_add_subregion_overlap(vdev
->bars
[nr
].region
.mem
,
775 mirror
->offset
, mirror
->mem
, 1);
777 QLIST_INSERT_HEAD(&vdev
->bars
[nr
].quirks
, quirk
, next
);
779 /* The 0x1800 offset mirror only seems to get used by legacy VGA */
781 quirk
= g_malloc0(sizeof(*quirk
));
782 mirror
= quirk
->data
= g_malloc0(sizeof(*mirror
));
783 mirror
->mem
= quirk
->mem
= g_new0(MemoryRegion
, 1);
786 mirror
->offset
= 0x1800;
789 memory_region_init_io(mirror
->mem
, OBJECT(vdev
),
790 &vfio_nvidia_mirror_quirk
, mirror
,
791 "vfio-nvidia-bar0-1800-mirror-quirk",
792 PCI_CONFIG_SPACE_SIZE
);
793 memory_region_add_subregion_overlap(vdev
->bars
[nr
].region
.mem
,
794 mirror
->offset
, mirror
->mem
, 1);
796 QLIST_INSERT_HEAD(&vdev
->bars
[nr
].quirks
, quirk
, next
);
799 trace_vfio_quirk_nvidia_bar0_probe(vdev
->vbasedev
.name
);
803 * TODO - Some Nvidia devices provide config access to their companion HDA
804 * device and even to their parent bridge via these config space mirrors.
805 * Add quirks for those regions.
808 #define PCI_VENDOR_ID_REALTEK 0x10ec
811 * RTL8168 devices have a backdoor that can access the MSI-X table. At BAR2
812 * offset 0x70 there is a dword data register, offset 0x74 is a dword address
813 * register. According to the Linux r8169 driver, the MSI-X table is addressed
814 * when the "type" portion of the address register is set to 0x1. This appears
815 * to be bits 16:30. Bit 31 is both a write indicator and some sort of
816 * "address latched" indicator. Bits 12:15 are a mask field, which we can
817 * ignore because the MSI-X table should always be accessed as a dword (full
818 * mask). Bits 0:11 is offset within the type.
822 * Read from MSI-X table offset 0
823 * vfio: vfio_bar_write(0000:05:00.0:BAR2+0x74, 0x1f000, 4) // store read addr
824 * vfio: vfio_bar_read(0000:05:00.0:BAR2+0x74, 4) = 0x8001f000 // latch
825 * vfio: vfio_bar_read(0000:05:00.0:BAR2+0x70, 4) = 0xfee00398 // read data
827 * Write 0xfee00000 to MSI-X table offset 0
828 * vfio: vfio_bar_write(0000:05:00.0:BAR2+0x70, 0xfee00000, 4) // write data
829 * vfio: vfio_bar_write(0000:05:00.0:BAR2+0x74, 0x8001f000, 4) // do write
830 * vfio: vfio_bar_read(0000:05:00.0:BAR2+0x74, 4) = 0x1f000 // complete
832 typedef struct VFIOrtl8168Quirk
{
839 static uint64_t vfio_rtl8168_quirk_address_read(void *opaque
,
840 hwaddr addr
, unsigned size
)
842 VFIOrtl8168Quirk
*rtl
= opaque
;
843 VFIOPCIDevice
*vdev
= rtl
->vdev
;
844 uint64_t data
= vfio_region_read(&vdev
->bars
[2].region
, addr
+ 0x74, size
);
847 data
= rtl
->addr
^ 0x80000000U
; /* latch/complete */
848 trace_vfio_quirk_rtl8168_fake_latch(vdev
->vbasedev
.name
, data
);
854 static void vfio_rtl8168_quirk_address_write(void *opaque
, hwaddr addr
,
855 uint64_t data
, unsigned size
)
857 VFIOrtl8168Quirk
*rtl
= opaque
;
858 VFIOPCIDevice
*vdev
= rtl
->vdev
;
860 rtl
->enabled
= false;
862 if ((data
& 0x7fff0000) == 0x10000) { /* MSI-X table */
864 rtl
->addr
= (uint32_t)data
;
866 if (data
& 0x80000000U
) { /* Do write */
867 if (vdev
->pdev
.cap_present
& QEMU_PCI_CAP_MSIX
) {
868 hwaddr offset
= data
& 0xfff;
869 uint64_t val
= rtl
->data
;
871 trace_vfio_quirk_rtl8168_msix_write(vdev
->vbasedev
.name
,
872 (uint16_t)offset
, val
);
874 /* Write to the proper guest MSI-X table instead */
875 memory_region_dispatch_write(&vdev
->pdev
.msix_table_mmio
,
877 MEMTXATTRS_UNSPECIFIED
);
879 return; /* Do not write guest MSI-X data to hardware */
883 vfio_region_write(&vdev
->bars
[2].region
, addr
+ 0x74, data
, size
);
886 static const MemoryRegionOps vfio_rtl_address_quirk
= {
887 .read
= vfio_rtl8168_quirk_address_read
,
888 .write
= vfio_rtl8168_quirk_address_write
,
890 .min_access_size
= 4,
891 .max_access_size
= 4,
894 .endianness
= DEVICE_LITTLE_ENDIAN
,
897 static uint64_t vfio_rtl8168_quirk_data_read(void *opaque
,
898 hwaddr addr
, unsigned size
)
900 VFIOrtl8168Quirk
*rtl
= opaque
;
901 VFIOPCIDevice
*vdev
= rtl
->vdev
;
902 uint64_t data
= vfio_region_read(&vdev
->bars
[2].region
, addr
+ 0x70, size
);
904 if (rtl
->enabled
&& (vdev
->pdev
.cap_present
& QEMU_PCI_CAP_MSIX
)) {
905 hwaddr offset
= rtl
->addr
& 0xfff;
906 memory_region_dispatch_read(&vdev
->pdev
.msix_table_mmio
, offset
,
907 &data
, size
, MEMTXATTRS_UNSPECIFIED
);
908 trace_vfio_quirk_rtl8168_msix_read(vdev
->vbasedev
.name
, offset
, data
);
914 static void vfio_rtl8168_quirk_data_write(void *opaque
, hwaddr addr
,
915 uint64_t data
, unsigned size
)
917 VFIOrtl8168Quirk
*rtl
= opaque
;
918 VFIOPCIDevice
*vdev
= rtl
->vdev
;
920 rtl
->data
= (uint32_t)data
;
922 vfio_region_write(&vdev
->bars
[2].region
, addr
+ 0x70, data
, size
);
925 static const MemoryRegionOps vfio_rtl_data_quirk
= {
926 .read
= vfio_rtl8168_quirk_data_read
,
927 .write
= vfio_rtl8168_quirk_data_write
,
929 .min_access_size
= 4,
930 .max_access_size
= 4,
933 .endianness
= DEVICE_LITTLE_ENDIAN
,
936 static void vfio_probe_rtl8168_bar2_quirk(VFIOPCIDevice
*vdev
, int nr
)
939 VFIOrtl8168Quirk
*rtl
;
941 if (!vfio_pci_is(vdev
, PCI_VENDOR_ID_REALTEK
, 0x8168) || nr
!= 2) {
945 quirk
= g_malloc0(sizeof(*quirk
));
946 quirk
->mem
= g_new0(MemoryRegion
, 2);
948 quirk
->data
= rtl
= g_malloc0(sizeof(*rtl
));
951 memory_region_init_io(&quirk
->mem
[0], OBJECT(vdev
),
952 &vfio_rtl_address_quirk
, rtl
,
953 "vfio-rtl8168-window-address-quirk", 4);
954 memory_region_add_subregion_overlap(vdev
->bars
[nr
].region
.mem
,
955 0x74, &quirk
->mem
[0], 1);
957 memory_region_init_io(&quirk
->mem
[1], OBJECT(vdev
),
958 &vfio_rtl_data_quirk
, rtl
,
959 "vfio-rtl8168-window-data-quirk", 4);
960 memory_region_add_subregion_overlap(vdev
->bars
[nr
].region
.mem
,
961 0x70, &quirk
->mem
[1], 1);
963 QLIST_INSERT_HEAD(&vdev
->bars
[nr
].quirks
, quirk
, next
);
965 trace_vfio_quirk_rtl8168_probe(vdev
->vbasedev
.name
);
971 * Obviously IGD is not a discrete device, this is evidenced not only by it
972 * being integrated into the CPU, but by the various chipset and BIOS
973 * dependencies that it brings along with it. Intel is trying to move away
974 * from this and Broadwell and newer devices can run in what Intel calls
975 * "Universal Pass-Through" mode, or UPT. Theoretically in UPT mode, nothing
976 * more is required beyond assigning the IGD device to a VM. There are
977 * however support limitations to this mode. It only supports IGD as a
978 * secondary graphics device in the VM and it doesn't officially support any
981 * The code here attempts to enable what we'll call legacy mode assignment,
982 * IGD retains most of the capabilities we expect for it to have on bare
983 * metal. To enable this mode, the IGD device must be assigned to the VM
984 * at PCI address 00:02.0, it must have a ROM, it very likely needs VGA
985 * support, we must have VM BIOS support for reserving and populating some
986 * of the required tables, and we need to tweak the chipset with revisions
987 * and IDs and an LPC/ISA bridge device. The intention is to make all of
988 * this happen automatically by installing the device at the correct VM PCI
989 * bus address. If any of the conditions are not met, we cross our fingers
990 * and hope the user knows better.
992 * NB - It is possible to enable physical outputs in UPT mode by supplying
993 * an OpRegion table. We don't do this by default because the guest driver
994 * behaves differently if an OpRegion is provided and no monitor is attached
995 * vs no OpRegion and a monitor being attached or not. Effectively, if a
996 * headless setup is desired, the OpRegion gets in the way of that.
1000 * This presumes the device is already known to be an Intel VGA device, so we
1001 * take liberties in which device ID bits match which generation. This should
1002 * not be taken as an indication that all the devices are supported, or even
1003 * supportable, some of them don't even support VT-d.
1004 * See linux:include/drm/i915_pciids.h for IDs.
1006 static int igd_gen(VFIOPCIDevice
*vdev
)
1008 if ((vdev
->device_id
& 0xfff) == 0xa84) {
1009 return 8; /* Broxton */
1012 switch (vdev
->device_id
& 0xff00) {
1013 /* Old, untested, unavailable, unknown */
1023 /* SandyBridge, IvyBridge, ValleyView, Haswell */
1031 /* BroadWell, CherryView, SkyLake, KabyLake */
1039 return 8; /* Assume newer is compatible */
1042 typedef struct VFIOIGDQuirk
{
1043 struct VFIOPCIDevice
*vdev
;
1048 #define IGD_GMCH 0x50 /* Graphics Control Register */
1049 #define IGD_BDSM 0x5c /* Base Data of Stolen Memory */
1050 #define IGD_ASLS 0xfc /* ASL Storage Register */
1053 * The OpRegion includes the Video BIOS Table, which seems important for
1054 * telling the driver what sort of outputs it has. Without this, the device
1055 * may work in the guest, but we may not get output. This also requires BIOS
1056 * support to reserve and populate a section of guest memory sufficient for
1057 * the table and to write the base address of that memory to the ASLS register
1058 * of the IGD device.
1060 int vfio_pci_igd_opregion_init(VFIOPCIDevice
*vdev
,
1061 struct vfio_region_info
*info
, Error
**errp
)
1065 vdev
->igd_opregion
= g_malloc0(info
->size
);
1066 ret
= pread(vdev
->vbasedev
.fd
, vdev
->igd_opregion
,
1067 info
->size
, info
->offset
);
1068 if (ret
!= info
->size
) {
1069 error_setg(errp
, "failed to read IGD OpRegion");
1070 g_free(vdev
->igd_opregion
);
1071 vdev
->igd_opregion
= NULL
;
1076 * Provide fw_cfg with a copy of the OpRegion which the VM firmware is to
1077 * allocate 32bit reserved memory for, copy these contents into, and write
1078 * the reserved memory base address to the device ASLS register at 0xFC.
1079 * Alignment of this reserved region seems flexible, but using a 4k page
1080 * alignment seems to work well. This interface assumes a single IGD
1081 * device, which may be at VM address 00:02.0 in legacy mode or another
1082 * address in UPT mode.
1084 * NB, there may be future use cases discovered where the VM should have
1085 * direct interaction with the host OpRegion, in which case the write to
1086 * the ASLS register would trigger MemoryRegion setup to enable that.
1088 fw_cfg_add_file(fw_cfg_find(), "etc/igd-opregion",
1089 vdev
->igd_opregion
, info
->size
);
1091 trace_vfio_pci_igd_opregion_enabled(vdev
->vbasedev
.name
);
1093 pci_set_long(vdev
->pdev
.config
+ IGD_ASLS
, 0);
1094 pci_set_long(vdev
->pdev
.wmask
+ IGD_ASLS
, ~0);
1095 pci_set_long(vdev
->emulated_config_bits
+ IGD_ASLS
, ~0);
1101 * The rather short list of registers that we copy from the host devices.
1102 * The LPC/ISA bridge values are definitely needed to support the vBIOS, the
1103 * host bridge values may or may not be needed depending on the guest OS.
1104 * Since we're only munging revision and subsystem values on the host bridge,
1105 * we don't require our own device. The LPC/ISA bridge needs to be our very
1113 static const IGDHostInfo igd_host_bridge_infos
[] = {
1114 {PCI_REVISION_ID
, 2},
1115 {PCI_SUBSYSTEM_VENDOR_ID
, 2},
1116 {PCI_SUBSYSTEM_ID
, 2},
1119 static const IGDHostInfo igd_lpc_bridge_infos
[] = {
1122 {PCI_REVISION_ID
, 2},
1123 {PCI_SUBSYSTEM_VENDOR_ID
, 2},
1124 {PCI_SUBSYSTEM_ID
, 2},
1127 static int vfio_pci_igd_copy(VFIOPCIDevice
*vdev
, PCIDevice
*pdev
,
1128 struct vfio_region_info
*info
,
1129 const IGDHostInfo
*list
, int len
)
1133 for (i
= 0; i
< len
; i
++) {
1134 ret
= pread(vdev
->vbasedev
.fd
, pdev
->config
+ list
[i
].offset
,
1135 list
[i
].len
, info
->offset
+ list
[i
].offset
);
1136 if (ret
!= list
[i
].len
) {
1137 error_report("IGD copy failed: %m");
1146 * Stuff a few values into the host bridge.
1148 static int vfio_pci_igd_host_init(VFIOPCIDevice
*vdev
,
1149 struct vfio_region_info
*info
)
1152 PCIDevice
*host_bridge
;
1155 bus
= pci_device_root_bus(&vdev
->pdev
);
1156 host_bridge
= pci_find_device(bus
, 0, PCI_DEVFN(0, 0));
1159 error_report("Can't find host bridge");
1163 ret
= vfio_pci_igd_copy(vdev
, host_bridge
, info
, igd_host_bridge_infos
,
1164 ARRAY_SIZE(igd_host_bridge_infos
));
1166 trace_vfio_pci_igd_host_bridge_enabled(vdev
->vbasedev
.name
);
1173 * IGD LPC/ISA bridge support code. The vBIOS needs this, but we can't write
1174 * arbitrary values into just any bridge, so we must create our own. We try
1175 * to handle if the user has created it for us, which they might want to do
1176 * to enable multifunction so we don't occupy the whole PCI slot.
1178 static void vfio_pci_igd_lpc_bridge_realize(PCIDevice
*pdev
, Error
**errp
)
1180 if (pdev
->devfn
!= PCI_DEVFN(0x1f, 0)) {
1181 error_setg(errp
, "VFIO dummy ISA/LPC bridge must have address 1f.0");
1185 static void vfio_pci_igd_lpc_bridge_class_init(ObjectClass
*klass
, void *data
)
1187 DeviceClass
*dc
= DEVICE_CLASS(klass
);
1188 PCIDeviceClass
*k
= PCI_DEVICE_CLASS(klass
);
1190 set_bit(DEVICE_CATEGORY_BRIDGE
, dc
->categories
);
1191 dc
->desc
= "VFIO dummy ISA/LPC bridge for IGD assignment";
1192 dc
->hotpluggable
= false;
1193 k
->realize
= vfio_pci_igd_lpc_bridge_realize
;
1194 k
->class_id
= PCI_CLASS_BRIDGE_ISA
;
1197 static TypeInfo vfio_pci_igd_lpc_bridge_info
= {
1198 .name
= "vfio-pci-igd-lpc-bridge",
1199 .parent
= TYPE_PCI_DEVICE
,
1200 .class_init
= vfio_pci_igd_lpc_bridge_class_init
,
1203 static void vfio_pci_igd_register_types(void)
1205 type_register_static(&vfio_pci_igd_lpc_bridge_info
);
1208 type_init(vfio_pci_igd_register_types
)
1210 static int vfio_pci_igd_lpc_init(VFIOPCIDevice
*vdev
,
1211 struct vfio_region_info
*info
)
1213 PCIDevice
*lpc_bridge
;
1216 lpc_bridge
= pci_find_device(pci_device_root_bus(&vdev
->pdev
),
1217 0, PCI_DEVFN(0x1f, 0));
1219 lpc_bridge
= pci_create_simple(pci_device_root_bus(&vdev
->pdev
),
1220 PCI_DEVFN(0x1f, 0), "vfio-pci-igd-lpc-bridge");
1223 ret
= vfio_pci_igd_copy(vdev
, lpc_bridge
, info
, igd_lpc_bridge_infos
,
1224 ARRAY_SIZE(igd_lpc_bridge_infos
));
1226 trace_vfio_pci_igd_lpc_bridge_enabled(vdev
->vbasedev
.name
);
1233 * IGD Gen8 and newer support up to 8MB for the GTT and use a 64bit PTE
1234 * entry, older IGDs use 2MB and 32bit. Each PTE maps a 4k page. Therefore
1235 * we either have 2M/4k * 4 = 2k or 8M/4k * 8 = 16k as the maximum iobar index
1236 * for programming the GTT.
1238 * See linux:include/drm/i915_drm.h for shift and mask values.
1240 static int vfio_igd_gtt_max(VFIOPCIDevice
*vdev
)
1242 uint32_t gmch
= vfio_pci_read_config(&vdev
->pdev
, IGD_GMCH
, sizeof(gmch
));
1243 int ggms
, gen
= igd_gen(vdev
);
1245 gmch
= vfio_pci_read_config(&vdev
->pdev
, IGD_GMCH
, sizeof(gmch
));
1246 ggms
= (gmch
>> (gen
< 8 ? 8 : 6)) & 0x3;
1251 ggms
*= 1024 * 1024;
1253 return (ggms
/ (4 * 1024)) * (gen
< 8 ? 4 : 8);
1257 * The IGD ROM will make use of stolen memory (GGMS) for support of VESA modes.
1258 * Somehow the host stolen memory range is used for this, but how the ROM gets
1259 * it is a mystery, perhaps it's hardcoded into the ROM. Thankfully though, it
1260 * reprograms the GTT through the IOBAR where we can trap it and transpose the
1261 * programming to the VM allocated buffer. That buffer gets reserved by the VM
1262 * firmware via the fw_cfg entry added below. Here we're just monitoring the
1263 * IOBAR address and data registers to detect a write sequence targeting the
1264 * GTTADR. This code is developed by observed behavior and doesn't have a
1265 * direct spec reference, unfortunately.
1267 static uint64_t vfio_igd_quirk_data_read(void *opaque
,
1268 hwaddr addr
, unsigned size
)
1270 VFIOIGDQuirk
*igd
= opaque
;
1271 VFIOPCIDevice
*vdev
= igd
->vdev
;
1275 return vfio_region_read(&vdev
->bars
[4].region
, addr
+ 4, size
);
1278 static void vfio_igd_quirk_data_write(void *opaque
, hwaddr addr
,
1279 uint64_t data
, unsigned size
)
1281 VFIOIGDQuirk
*igd
= opaque
;
1282 VFIOPCIDevice
*vdev
= igd
->vdev
;
1283 uint64_t val
= data
;
1284 int gen
= igd_gen(vdev
);
1287 * Programming the GGMS starts at index 0x1 and uses every 4th index (ie.
1288 * 0x1, 0x5, 0x9, 0xd,...). For pre-Gen8 each 4-byte write is a whole PTE
1289 * entry, with 0th bit enable set. For Gen8 and up, PTEs are 64bit, so
1290 * entries 0x5 & 0xd are the high dword, in our case zero. Each PTE points
1291 * to a 4k page, which we translate to a page from the VM allocated region,
1292 * pointed to by the BDSM register. If this is not set, we fail.
1294 * We trap writes to the full configured GTT size, but we typically only
1295 * see the vBIOS writing up to (nearly) the 1MB barrier. In fact it often
1296 * seems to miss the last entry for an even 1MB GTT. Doing a gratuitous
1297 * write of that last entry does work, but is hopefully unnecessary since
1298 * we clear the previous GTT on initialization.
1300 if ((igd
->index
% 4 == 1) && igd
->index
< vfio_igd_gtt_max(vdev
)) {
1301 if (gen
< 8 || (igd
->index
% 8 == 1)) {
1304 base
= pci_get_long(vdev
->pdev
.config
+ IGD_BDSM
);
1306 hw_error("vfio-igd: Guest attempted to program IGD GTT before "
1307 "BIOS reserved stolen memory. Unsupported BIOS?");
1310 val
= data
- igd
->bdsm
+ base
;
1312 val
= 0; /* upper 32bits of pte, we only enable below 4G PTEs */
1315 trace_vfio_pci_igd_bar4_write(vdev
->vbasedev
.name
,
1316 igd
->index
, data
, val
);
1319 vfio_region_write(&vdev
->bars
[4].region
, addr
+ 4, val
, size
);
1324 static const MemoryRegionOps vfio_igd_data_quirk
= {
1325 .read
= vfio_igd_quirk_data_read
,
1326 .write
= vfio_igd_quirk_data_write
,
1327 .endianness
= DEVICE_LITTLE_ENDIAN
,
1330 static uint64_t vfio_igd_quirk_index_read(void *opaque
,
1331 hwaddr addr
, unsigned size
)
1333 VFIOIGDQuirk
*igd
= opaque
;
1334 VFIOPCIDevice
*vdev
= igd
->vdev
;
1338 return vfio_region_read(&vdev
->bars
[4].region
, addr
, size
);
1341 static void vfio_igd_quirk_index_write(void *opaque
, hwaddr addr
,
1342 uint64_t data
, unsigned size
)
1344 VFIOIGDQuirk
*igd
= opaque
;
1345 VFIOPCIDevice
*vdev
= igd
->vdev
;
1349 vfio_region_write(&vdev
->bars
[4].region
, addr
, data
, size
);
1352 static const MemoryRegionOps vfio_igd_index_quirk
= {
1353 .read
= vfio_igd_quirk_index_read
,
1354 .write
= vfio_igd_quirk_index_write
,
1355 .endianness
= DEVICE_LITTLE_ENDIAN
,
1358 static void vfio_probe_igd_bar4_quirk(VFIOPCIDevice
*vdev
, int nr
)
1360 struct vfio_region_info
*rom
= NULL
, *opregion
= NULL
,
1361 *host
= NULL
, *lpc
= NULL
;
1364 PCIDevice
*lpc_bridge
;
1365 int i
, ret
, ggms_mb
, gms_mb
= 0, gen
;
1366 uint64_t *bdsm_size
;
1368 uint16_t cmd_orig
, cmd
;
1372 * This must be an Intel VGA device at address 00:02.0 for us to even
1373 * consider enabling legacy mode. The vBIOS has dependencies on the
1376 if (!vfio_pci_is(vdev
, PCI_VENDOR_ID_INTEL
, PCI_ANY_ID
) ||
1377 !vfio_is_vga(vdev
) || nr
!= 4 ||
1378 &vdev
->pdev
!= pci_find_device(pci_device_root_bus(&vdev
->pdev
),
1379 0, PCI_DEVFN(0x2, 0))) {
1384 * We need to create an LPC/ISA bridge at PCI bus address 00:1f.0 that we
1385 * can stuff host values into, so if there's already one there and it's not
1386 * one we can hack on, legacy mode is no-go. Sorry Q35.
1388 lpc_bridge
= pci_find_device(pci_device_root_bus(&vdev
->pdev
),
1389 0, PCI_DEVFN(0x1f, 0));
1390 if (lpc_bridge
&& !object_dynamic_cast(OBJECT(lpc_bridge
),
1391 "vfio-pci-igd-lpc-bridge")) {
1392 error_report("IGD device %s cannot support legacy mode due to existing "
1393 "devices at address 1f.0", vdev
->vbasedev
.name
);
1398 * IGD is not a standard, they like to change their specs often. We
1399 * only attempt to support back to SandBridge and we hope that newer
1400 * devices maintain compatibility with generation 8.
1402 gen
= igd_gen(vdev
);
1403 if (gen
!= 6 && gen
!= 8) {
1404 error_report("IGD device %s is unsupported in legacy mode, "
1405 "try SandyBridge or newer", vdev
->vbasedev
.name
);
1410 * Most of what we're doing here is to enable the ROM to run, so if
1411 * there's no ROM, there's no point in setting up this quirk.
1412 * NB. We only seem to get BIOS ROMs, so a UEFI VM would need CSM support.
1414 ret
= vfio_get_region_info(&vdev
->vbasedev
,
1415 VFIO_PCI_ROM_REGION_INDEX
, &rom
);
1416 if ((ret
|| !rom
->size
) && !vdev
->pdev
.romfile
) {
1417 error_report("IGD device %s has no ROM, legacy mode disabled",
1418 vdev
->vbasedev
.name
);
1423 * Ignore the hotplug corner case, mark the ROM failed, we can't
1424 * create the devices we need for legacy mode in the hotplug scenario.
1426 if (vdev
->pdev
.qdev
.hotplugged
) {
1427 error_report("IGD device %s hotplugged, ROM disabled, "
1428 "legacy mode disabled", vdev
->vbasedev
.name
);
1429 vdev
->rom_read_failed
= true;
1434 * Check whether we have all the vfio device specific regions to
1435 * support legacy mode (added in Linux v4.6). If not, bail.
1437 ret
= vfio_get_dev_region_info(&vdev
->vbasedev
,
1438 VFIO_REGION_TYPE_PCI_VENDOR_TYPE
| PCI_VENDOR_ID_INTEL
,
1439 VFIO_REGION_SUBTYPE_INTEL_IGD_OPREGION
, &opregion
);
1441 error_report("IGD device %s does not support OpRegion access,"
1442 "legacy mode disabled", vdev
->vbasedev
.name
);
1446 ret
= vfio_get_dev_region_info(&vdev
->vbasedev
,
1447 VFIO_REGION_TYPE_PCI_VENDOR_TYPE
| PCI_VENDOR_ID_INTEL
,
1448 VFIO_REGION_SUBTYPE_INTEL_IGD_HOST_CFG
, &host
);
1450 error_report("IGD device %s does not support host bridge access,"
1451 "legacy mode disabled", vdev
->vbasedev
.name
);
1455 ret
= vfio_get_dev_region_info(&vdev
->vbasedev
,
1456 VFIO_REGION_TYPE_PCI_VENDOR_TYPE
| PCI_VENDOR_ID_INTEL
,
1457 VFIO_REGION_SUBTYPE_INTEL_IGD_LPC_CFG
, &lpc
);
1459 error_report("IGD device %s does not support LPC bridge access,"
1460 "legacy mode disabled", vdev
->vbasedev
.name
);
1464 gmch
= vfio_pci_read_config(&vdev
->pdev
, IGD_GMCH
, 4);
1467 * If IGD VGA Disable is clear (expected) and VGA is not already enabled,
1468 * try to enable it. Probably shouldn't be using legacy mode without VGA,
1469 * but also no point in us enabling VGA if disabled in hardware.
1471 if (!(gmch
& 0x2) && !vdev
->vga
&& vfio_populate_vga(vdev
, &err
)) {
1472 error_reportf_err(err
, ERR_PREFIX
, vdev
->vbasedev
.name
);
1473 error_report("IGD device %s failed to enable VGA access, "
1474 "legacy mode disabled", vdev
->vbasedev
.name
);
1478 /* Create our LPC/ISA bridge */
1479 ret
= vfio_pci_igd_lpc_init(vdev
, lpc
);
1481 error_report("IGD device %s failed to create LPC bridge, "
1482 "legacy mode disabled", vdev
->vbasedev
.name
);
1486 /* Stuff some host values into the VM PCI host bridge */
1487 ret
= vfio_pci_igd_host_init(vdev
, host
);
1489 error_report("IGD device %s failed to modify host bridge, "
1490 "legacy mode disabled", vdev
->vbasedev
.name
);
1494 /* Setup OpRegion access */
1495 ret
= vfio_pci_igd_opregion_init(vdev
, opregion
, &err
);
1497 error_append_hint(&err
, "IGD legacy mode disabled\n");
1498 error_reportf_err(err
, ERR_PREFIX
, vdev
->vbasedev
.name
);
1502 /* Setup our quirk to munge GTT addresses to the VM allocated buffer */
1503 quirk
= g_malloc0(sizeof(*quirk
));
1504 quirk
->mem
= g_new0(MemoryRegion
, 2);
1506 igd
= quirk
->data
= g_malloc0(sizeof(*igd
));
1509 igd
->bdsm
= vfio_pci_read_config(&vdev
->pdev
, IGD_BDSM
, 4);
1510 igd
->bdsm
&= ~((1 << 20) - 1); /* 1MB aligned */
1512 memory_region_init_io(&quirk
->mem
[0], OBJECT(vdev
), &vfio_igd_index_quirk
,
1513 igd
, "vfio-igd-index-quirk", 4);
1514 memory_region_add_subregion_overlap(vdev
->bars
[nr
].region
.mem
,
1515 0, &quirk
->mem
[0], 1);
1517 memory_region_init_io(&quirk
->mem
[1], OBJECT(vdev
), &vfio_igd_data_quirk
,
1518 igd
, "vfio-igd-data-quirk", 4);
1519 memory_region_add_subregion_overlap(vdev
->bars
[nr
].region
.mem
,
1520 4, &quirk
->mem
[1], 1);
1522 QLIST_INSERT_HEAD(&vdev
->bars
[nr
].quirks
, quirk
, next
);
1524 /* Determine the size of stolen memory needed for GTT */
1525 ggms_mb
= (gmch
>> (gen
< 8 ? 8 : 6)) & 0x3;
1527 ggms_mb
= 1 << ggms_mb
;
1531 * Assume we have no GMS memory, but allow it to be overrided by device
1532 * option (experimental). The spec doesn't actually allow zero GMS when
1533 * when IVD (IGD VGA Disable) is clear, but the claim is that it's unused,
1534 * so let's not waste VM memory for it.
1536 gmch
&= ~((gen
< 8 ? 0x1f : 0xff) << (gen
< 8 ? 3 : 8));
1538 if (vdev
->igd_gms
) {
1539 if (vdev
->igd_gms
<= 0x10) {
1540 gms_mb
= vdev
->igd_gms
* 32;
1541 gmch
|= vdev
->igd_gms
<< (gen
< 8 ? 3 : 8);
1543 error_report("Unsupported IGD GMS value 0x%x", vdev
->igd_gms
);
1549 * Request reserved memory for stolen memory via fw_cfg. VM firmware
1550 * must allocate a 1MB aligned reserved memory region below 4GB with
1551 * the requested size (in bytes) for use by the Intel PCI class VGA
1552 * device at VM address 00:02.0. The base address of this reserved
1553 * memory region must be written to the device BDSM regsiter at PCI
1554 * config offset 0x5C.
1556 bdsm_size
= g_malloc(sizeof(*bdsm_size
));
1557 *bdsm_size
= cpu_to_le64((ggms_mb
+ gms_mb
) * 1024 * 1024);
1558 fw_cfg_add_file(fw_cfg_find(), "etc/igd-bdsm-size",
1559 bdsm_size
, sizeof(*bdsm_size
));
1561 /* GMCH is read-only, emulated */
1562 pci_set_long(vdev
->pdev
.config
+ IGD_GMCH
, gmch
);
1563 pci_set_long(vdev
->pdev
.wmask
+ IGD_GMCH
, 0);
1564 pci_set_long(vdev
->emulated_config_bits
+ IGD_GMCH
, ~0);
1566 /* BDSM is read-write, emulated. The BIOS needs to be able to write it */
1567 pci_set_long(vdev
->pdev
.config
+ IGD_BDSM
, 0);
1568 pci_set_long(vdev
->pdev
.wmask
+ IGD_BDSM
, ~0);
1569 pci_set_long(vdev
->emulated_config_bits
+ IGD_BDSM
, ~0);
1572 * This IOBAR gives us access to GTTADR, which allows us to write to
1573 * the GTT itself. So let's go ahead and write zero to all the GTT
1574 * entries to avoid spurious DMA faults. Be sure I/O access is enabled
1575 * before talking to the device.
1577 if (pread(vdev
->vbasedev
.fd
, &cmd_orig
, sizeof(cmd_orig
),
1578 vdev
->config_offset
+ PCI_COMMAND
) != sizeof(cmd_orig
)) {
1579 error_report("IGD device %s - failed to read PCI command register",
1580 vdev
->vbasedev
.name
);
1583 cmd
= cmd_orig
| PCI_COMMAND_IO
;
1585 if (pwrite(vdev
->vbasedev
.fd
, &cmd
, sizeof(cmd
),
1586 vdev
->config_offset
+ PCI_COMMAND
) != sizeof(cmd
)) {
1587 error_report("IGD device %s - failed to write PCI command register",
1588 vdev
->vbasedev
.name
);
1591 for (i
= 1; i
< vfio_igd_gtt_max(vdev
); i
+= 4) {
1592 vfio_region_write(&vdev
->bars
[4].region
, 0, i
, 4);
1593 vfio_region_write(&vdev
->bars
[4].region
, 4, 0, 4);
1596 if (pwrite(vdev
->vbasedev
.fd
, &cmd_orig
, sizeof(cmd_orig
),
1597 vdev
->config_offset
+ PCI_COMMAND
) != sizeof(cmd_orig
)) {
1598 error_report("IGD device %s - failed to restore PCI command register",
1599 vdev
->vbasedev
.name
);
1602 trace_vfio_pci_igd_bdsm_enabled(vdev
->vbasedev
.name
, ggms_mb
+ gms_mb
);
1612 * Common quirk probe entry points.
1614 void vfio_vga_quirk_setup(VFIOPCIDevice
*vdev
)
1616 vfio_vga_probe_ati_3c3_quirk(vdev
);
1617 vfio_vga_probe_nvidia_3d0_quirk(vdev
);
1620 void vfio_vga_quirk_exit(VFIOPCIDevice
*vdev
)
1625 for (i
= 0; i
< ARRAY_SIZE(vdev
->vga
->region
); i
++) {
1626 QLIST_FOREACH(quirk
, &vdev
->vga
->region
[i
].quirks
, next
) {
1627 for (j
= 0; j
< quirk
->nr_mem
; j
++) {
1628 memory_region_del_subregion(&vdev
->vga
->region
[i
].mem
,
1635 void vfio_vga_quirk_finalize(VFIOPCIDevice
*vdev
)
1639 for (i
= 0; i
< ARRAY_SIZE(vdev
->vga
->region
); i
++) {
1640 while (!QLIST_EMPTY(&vdev
->vga
->region
[i
].quirks
)) {
1641 VFIOQuirk
*quirk
= QLIST_FIRST(&vdev
->vga
->region
[i
].quirks
);
1642 QLIST_REMOVE(quirk
, next
);
1643 for (j
= 0; j
< quirk
->nr_mem
; j
++) {
1644 object_unparent(OBJECT(&quirk
->mem
[j
]));
1647 g_free(quirk
->data
);
1653 void vfio_bar_quirk_setup(VFIOPCIDevice
*vdev
, int nr
)
1655 vfio_probe_ati_bar4_quirk(vdev
, nr
);
1656 vfio_probe_ati_bar2_quirk(vdev
, nr
);
1657 vfio_probe_nvidia_bar5_quirk(vdev
, nr
);
1658 vfio_probe_nvidia_bar0_quirk(vdev
, nr
);
1659 vfio_probe_rtl8168_bar2_quirk(vdev
, nr
);
1660 vfio_probe_igd_bar4_quirk(vdev
, nr
);
1663 void vfio_bar_quirk_exit(VFIOPCIDevice
*vdev
, int nr
)
1665 VFIOBAR
*bar
= &vdev
->bars
[nr
];
1669 QLIST_FOREACH(quirk
, &bar
->quirks
, next
) {
1670 for (i
= 0; i
< quirk
->nr_mem
; i
++) {
1671 memory_region_del_subregion(bar
->region
.mem
, &quirk
->mem
[i
]);
1676 void vfio_bar_quirk_finalize(VFIOPCIDevice
*vdev
, int nr
)
1678 VFIOBAR
*bar
= &vdev
->bars
[nr
];
1681 while (!QLIST_EMPTY(&bar
->quirks
)) {
1682 VFIOQuirk
*quirk
= QLIST_FIRST(&bar
->quirks
);
1683 QLIST_REMOVE(quirk
, next
);
1684 for (i
= 0; i
< quirk
->nr_mem
; i
++) {
1685 object_unparent(OBJECT(&quirk
->mem
[i
]));
1688 g_free(quirk
->data
);
1698 * AMD Radeon PCI config reset, based on Linux:
1699 * drivers/gpu/drm/radeon/ci_smc.c:ci_is_smc_running()
1700 * drivers/gpu/drm/radeon/radeon_device.c:radeon_pci_config_reset
1701 * drivers/gpu/drm/radeon/ci_smc.c:ci_reset_smc()
1702 * drivers/gpu/drm/radeon/ci_smc.c:ci_stop_smc_clock()
1703 * IDs: include/drm/drm_pciids.h
1704 * Registers: http://cgit.freedesktop.org/~agd5f/linux/commit/?id=4e2aa447f6f0
1706 * Bonaire and Hawaii GPUs do not respond to a bus reset. This is a bug in the
1707 * hardware that should be fixed on future ASICs. The symptom of this is that
1708 * once the accerlated driver loads, Windows guests will bsod on subsequent
1709 * attmpts to load the driver, such as after VM reset or shutdown/restart. To
1710 * work around this, we do an AMD specific PCI config reset, followed by an SMC
1711 * reset. The PCI config reset only works if SMC firmware is running, so we
1712 * have a dependency on the state of the device as to whether this reset will
1713 * be effective. There are still cases where we won't be able to kick the
1714 * device into working, but this greatly improves the usability overall. The
1715 * config reset magic is relatively common on AMD GPUs, but the setup and SMC
1716 * poking is largely ASIC specific.
1718 static bool vfio_radeon_smc_is_running(VFIOPCIDevice
*vdev
)
1723 * Registers 200h and 204h are index and data registers for accessing
1724 * indirect configuration registers within the device.
1726 vfio_region_write(&vdev
->bars
[5].region
, 0x200, 0x80000004, 4);
1727 clk
= vfio_region_read(&vdev
->bars
[5].region
, 0x204, 4);
1728 vfio_region_write(&vdev
->bars
[5].region
, 0x200, 0x80000370, 4);
1729 pc_c
= vfio_region_read(&vdev
->bars
[5].region
, 0x204, 4);
1731 return (!(clk
& 1) && (0x20100 <= pc_c
));
1735 * The scope of a config reset is controlled by a mode bit in the misc register
1736 * and a fuse, exposed as a bit in another register. The fuse is the default
1737 * (0 = GFX, 1 = whole GPU), the misc bit is a toggle, with the forumula
1738 * scope = !(misc ^ fuse), where the resulting scope is defined the same as
1739 * the fuse. A truth table therefore tells us that if misc == fuse, we need
1740 * to flip the value of the bit in the misc register.
1742 static void vfio_radeon_set_gfx_only_reset(VFIOPCIDevice
*vdev
)
1744 uint32_t misc
, fuse
;
1747 vfio_region_write(&vdev
->bars
[5].region
, 0x200, 0xc00c0000, 4);
1748 fuse
= vfio_region_read(&vdev
->bars
[5].region
, 0x204, 4);
1751 vfio_region_write(&vdev
->bars
[5].region
, 0x200, 0xc0000010, 4);
1752 misc
= vfio_region_read(&vdev
->bars
[5].region
, 0x204, 4);
1756 vfio_region_write(&vdev
->bars
[5].region
, 0x204, misc
^ 2, 4);
1757 vfio_region_read(&vdev
->bars
[5].region
, 0x204, 4); /* flush */
1761 static int vfio_radeon_reset(VFIOPCIDevice
*vdev
)
1763 PCIDevice
*pdev
= &vdev
->pdev
;
1767 /* Defer to a kernel implemented reset */
1768 if (vdev
->vbasedev
.reset_works
) {
1769 trace_vfio_quirk_ati_bonaire_reset_skipped(vdev
->vbasedev
.name
);
1773 /* Enable only memory BAR access */
1774 vfio_pci_write_config(pdev
, PCI_COMMAND
, PCI_COMMAND_MEMORY
, 2);
1776 /* Reset only works if SMC firmware is loaded and running */
1777 if (!vfio_radeon_smc_is_running(vdev
)) {
1779 trace_vfio_quirk_ati_bonaire_reset_no_smc(vdev
->vbasedev
.name
);
1783 /* Make sure only the GFX function is reset */
1784 vfio_radeon_set_gfx_only_reset(vdev
);
1786 /* AMD PCI config reset */
1787 vfio_pci_write_config(pdev
, 0x7c, 0x39d5e86b, 4);
1790 /* Read back the memory size to make sure we're out of reset */
1791 for (i
= 0; i
< 100000; i
++) {
1792 if (vfio_region_read(&vdev
->bars
[5].region
, 0x5428, 4) != 0xffffffff) {
1798 trace_vfio_quirk_ati_bonaire_reset_timeout(vdev
->vbasedev
.name
);
1802 vfio_region_write(&vdev
->bars
[5].region
, 0x200, 0x80000000, 4);
1803 data
= vfio_region_read(&vdev
->bars
[5].region
, 0x204, 4);
1805 vfio_region_write(&vdev
->bars
[5].region
, 0x204, data
, 4);
1807 /* Disable SMC clock */
1808 vfio_region_write(&vdev
->bars
[5].region
, 0x200, 0x80000004, 4);
1809 data
= vfio_region_read(&vdev
->bars
[5].region
, 0x204, 4);
1811 vfio_region_write(&vdev
->bars
[5].region
, 0x204, data
, 4);
1813 trace_vfio_quirk_ati_bonaire_reset_done(vdev
->vbasedev
.name
);
1816 /* Restore PCI command register */
1817 vfio_pci_write_config(pdev
, PCI_COMMAND
, 0, 2);
1822 void vfio_setup_resetfn_quirk(VFIOPCIDevice
*vdev
)
1824 switch (vdev
->vendor_id
) {
1826 switch (vdev
->device_id
) {
1828 case 0x6649: /* Bonaire [FirePro W5100] */
1831 case 0x6658: /* Bonaire XTX [Radeon R7 260X] */
1832 case 0x665c: /* Bonaire XT [Radeon HD 7790/8770 / R9 260 OEM] */
1833 case 0x665d: /* Bonaire [Radeon R7 200 Series] */
1835 case 0x67A0: /* Hawaii XT GL [FirePro W9100] */
1836 case 0x67A1: /* Hawaii PRO GL [FirePro W8100] */
1841 case 0x67B0: /* Hawaii XT [Radeon R9 290X] */
1842 case 0x67B1: /* Hawaii PRO [Radeon R9 290] */
1847 vdev
->resetfn
= vfio_radeon_reset
;
1848 trace_vfio_quirk_ati_bonaire_reset(vdev
->vbasedev
.name
);
1856 * The NVIDIA GPUDirect P2P Vendor capability allows the user to specify
1857 * devices as a member of a clique. Devices within the same clique ID
1858 * are capable of direct P2P. It's the user's responsibility that this
1859 * is correct. The spec says that this may reside at any unused config
1860 * offset, but reserves and recommends hypervisors place this at C8h.
1861 * The spec also states that the hypervisor should place this capability
1862 * at the end of the capability list, thus next is defined as 0h.
1864 * +----------------+----------------+----------------+----------------+
1865 * | sig 7:0 ('P') | vndr len (8h) | next (0h) | cap id (9h) |
1866 * +----------------+----------------+----------------+----------------+
1867 * | rsvd 15:7(0h),id 6:3,ver 2:0(0h)| sig 23:8 ('P2') |
1868 * +---------------------------------+---------------------------------+
1870 * https://lists.gnu.org/archive/html/qemu-devel/2017-08/pdfUda5iEpgOS.pdf
1872 static void get_nv_gpudirect_clique_id(Object
*obj
, Visitor
*v
,
1873 const char *name
, void *opaque
,
1876 DeviceState
*dev
= DEVICE(obj
);
1877 Property
*prop
= opaque
;
1878 uint8_t *ptr
= qdev_get_prop_ptr(dev
, prop
);
1880 visit_type_uint8(v
, name
, ptr
, errp
);
1883 static void set_nv_gpudirect_clique_id(Object
*obj
, Visitor
*v
,
1884 const char *name
, void *opaque
,
1887 DeviceState
*dev
= DEVICE(obj
);
1888 Property
*prop
= opaque
;
1889 uint8_t value
, *ptr
= qdev_get_prop_ptr(dev
, prop
);
1890 Error
*local_err
= NULL
;
1892 if (dev
->realized
) {
1893 qdev_prop_set_after_realize(dev
, name
, errp
);
1897 visit_type_uint8(v
, name
, &value
, &local_err
);
1899 error_propagate(errp
, local_err
);
1904 error_setg(errp
, "Property %s: valid range 0-15", name
);
1911 const PropertyInfo qdev_prop_nv_gpudirect_clique
= {
1913 .description
= "NVIDIA GPUDirect Clique ID (0 - 15)",
1914 .get
= get_nv_gpudirect_clique_id
,
1915 .set
= set_nv_gpudirect_clique_id
,
1918 static int vfio_add_nv_gpudirect_cap(VFIOPCIDevice
*vdev
, Error
**errp
)
1920 PCIDevice
*pdev
= &vdev
->pdev
;
1921 int ret
, pos
= 0xC8;
1923 if (vdev
->nv_gpudirect_clique
== 0xFF) {
1927 if (!vfio_pci_is(vdev
, PCI_VENDOR_ID_NVIDIA
, PCI_ANY_ID
)) {
1928 error_setg(errp
, "NVIDIA GPUDirect Clique ID: invalid device vendor");
1932 if (pci_get_byte(pdev
->config
+ PCI_CLASS_DEVICE
+ 1) !=
1933 PCI_BASE_CLASS_DISPLAY
) {
1934 error_setg(errp
, "NVIDIA GPUDirect Clique ID: unsupported PCI class");
1938 ret
= pci_add_capability(pdev
, PCI_CAP_ID_VNDR
, pos
, 8, errp
);
1940 error_prepend(errp
, "Failed to add NVIDIA GPUDirect cap: ");
1944 memset(vdev
->emulated_config_bits
+ pos
, 0xFF, 8);
1945 pos
+= PCI_CAP_FLAGS
;
1946 pci_set_byte(pdev
->config
+ pos
++, 8);
1947 pci_set_byte(pdev
->config
+ pos
++, 'P');
1948 pci_set_byte(pdev
->config
+ pos
++, '2');
1949 pci_set_byte(pdev
->config
+ pos
++, 'P');
1950 pci_set_byte(pdev
->config
+ pos
++, vdev
->nv_gpudirect_clique
<< 3);
1951 pci_set_byte(pdev
->config
+ pos
, 0);
1956 int vfio_add_virt_caps(VFIOPCIDevice
*vdev
, Error
**errp
)
1960 ret
= vfio_add_nv_gpudirect_cap(vdev
, errp
);