2 * device quirks for PCI devices
4 * Copyright Red Hat, Inc. 2012-2015
7 * Alex Williamson <alex.williamson@redhat.com>
9 * This work is licensed under the terms of the GNU GPL, version 2. See
10 * the COPYING file in the top-level directory.
13 #include "qemu/osdep.h"
14 #include "qemu/units.h"
15 #include "qemu/error-report.h"
16 #include "qemu/main-loop.h"
17 #include "qemu/module.h"
18 #include "qemu/range.h"
19 #include "qapi/error.h"
20 #include "qapi/visitor.h"
21 #include <sys/ioctl.h>
22 #include "hw/nvram/fw_cfg.h"
26 /* Use uin32_t for vendor & device so PCI_ANY_ID expands and cannot match hw */
27 static bool vfio_pci_is(VFIOPCIDevice
*vdev
, uint32_t vendor
, uint32_t device
)
29 return (vendor
== PCI_ANY_ID
|| vendor
== vdev
->vendor_id
) &&
30 (device
== PCI_ANY_ID
|| device
== vdev
->device_id
);
33 static bool vfio_is_vga(VFIOPCIDevice
*vdev
)
35 PCIDevice
*pdev
= &vdev
->pdev
;
36 uint16_t class = pci_get_word(pdev
->config
+ PCI_CLASS_DEVICE
);
38 return class == PCI_CLASS_DISPLAY_VGA
;
42 * List of device ids/vendor ids for which to disable
43 * option rom loading. This avoids the guest hangs during rom
44 * execution as noticed with the BCM 57810 card for lack of a
45 * more better way to handle such issues.
46 * The user can still override by specifying a romfile or
48 * Please see https://bugs.launchpad.net/qemu/+bug/1284874
49 * for an analysis of the 57810 card hang. When adding
50 * a new vendor id/device id combination below, please also add
51 * your card/environment details and information that could
52 * help in debugging to the bug tracking this issue
58 { 0x14e4, 0x168e }, /* Broadcom BCM 57810 */
61 bool vfio_blacklist_opt_rom(VFIOPCIDevice
*vdev
)
65 for (i
= 0 ; i
< ARRAY_SIZE(romblacklist
); i
++) {
66 if (vfio_pci_is(vdev
, romblacklist
[i
].vendor
, romblacklist
[i
].device
)) {
67 trace_vfio_quirk_rom_blacklisted(vdev
->vbasedev
.name
,
68 romblacklist
[i
].vendor
,
69 romblacklist
[i
].device
);
77 * Device specific region quirks (mostly backdoors to PCI config space)
81 * The generic window quirks operate on an address and data register,
82 * vfio_generic_window_address_quirk handles the address register and
83 * vfio_generic_window_data_quirk handles the data register. These ops
84 * pass reads and writes through to hardware until a value matching the
85 * stored address match/mask is written. When this occurs, the data
86 * register access emulated PCI config space for the device rather than
87 * passing through accesses. This enables devices where PCI config space
88 * is accessible behind a window register to maintain the virtualization
89 * provided through vfio.
91 typedef struct VFIOConfigWindowMatch
{
94 } VFIOConfigWindowMatch
;
96 typedef struct VFIOConfigWindowQuirk
{
97 struct VFIOPCIDevice
*vdev
;
101 uint32_t address_offset
;
102 uint32_t data_offset
;
107 MemoryRegion
*addr_mem
;
108 MemoryRegion
*data_mem
;
111 VFIOConfigWindowMatch matches
[];
112 } VFIOConfigWindowQuirk
;
114 static uint64_t vfio_generic_window_quirk_address_read(void *opaque
,
118 VFIOConfigWindowQuirk
*window
= opaque
;
119 VFIOPCIDevice
*vdev
= window
->vdev
;
121 return vfio_region_read(&vdev
->bars
[window
->bar
].region
,
122 addr
+ window
->address_offset
, size
);
125 static void vfio_generic_window_quirk_address_write(void *opaque
, hwaddr addr
,
129 VFIOConfigWindowQuirk
*window
= opaque
;
130 VFIOPCIDevice
*vdev
= window
->vdev
;
133 window
->window_enabled
= false;
135 vfio_region_write(&vdev
->bars
[window
->bar
].region
,
136 addr
+ window
->address_offset
, data
, size
);
138 for (i
= 0; i
< window
->nr_matches
; i
++) {
139 if ((data
& ~window
->matches
[i
].mask
) == window
->matches
[i
].match
) {
140 window
->window_enabled
= true;
141 window
->address_val
= data
& window
->matches
[i
].mask
;
142 trace_vfio_quirk_generic_window_address_write(vdev
->vbasedev
.name
,
143 memory_region_name(window
->addr_mem
), data
);
149 static const MemoryRegionOps vfio_generic_window_address_quirk
= {
150 .read
= vfio_generic_window_quirk_address_read
,
151 .write
= vfio_generic_window_quirk_address_write
,
152 .endianness
= DEVICE_LITTLE_ENDIAN
,
155 static uint64_t vfio_generic_window_quirk_data_read(void *opaque
,
156 hwaddr addr
, unsigned size
)
158 VFIOConfigWindowQuirk
*window
= opaque
;
159 VFIOPCIDevice
*vdev
= window
->vdev
;
162 /* Always read data reg, discard if window enabled */
163 data
= vfio_region_read(&vdev
->bars
[window
->bar
].region
,
164 addr
+ window
->data_offset
, size
);
166 if (window
->window_enabled
) {
167 data
= vfio_pci_read_config(&vdev
->pdev
, window
->address_val
, size
);
168 trace_vfio_quirk_generic_window_data_read(vdev
->vbasedev
.name
,
169 memory_region_name(window
->data_mem
), data
);
175 static void vfio_generic_window_quirk_data_write(void *opaque
, hwaddr addr
,
176 uint64_t data
, unsigned size
)
178 VFIOConfigWindowQuirk
*window
= opaque
;
179 VFIOPCIDevice
*vdev
= window
->vdev
;
181 if (window
->window_enabled
) {
182 vfio_pci_write_config(&vdev
->pdev
, window
->address_val
, data
, size
);
183 trace_vfio_quirk_generic_window_data_write(vdev
->vbasedev
.name
,
184 memory_region_name(window
->data_mem
), data
);
188 vfio_region_write(&vdev
->bars
[window
->bar
].region
,
189 addr
+ window
->data_offset
, data
, size
);
192 static const MemoryRegionOps vfio_generic_window_data_quirk
= {
193 .read
= vfio_generic_window_quirk_data_read
,
194 .write
= vfio_generic_window_quirk_data_write
,
195 .endianness
= DEVICE_LITTLE_ENDIAN
,
199 * The generic mirror quirk handles devices which expose PCI config space
200 * through a region within a BAR. When enabled, reads and writes are
201 * redirected through to emulated PCI config space. XXX if PCI config space
202 * used memory regions, this could just be an alias.
204 typedef struct VFIOConfigMirrorQuirk
{
205 struct VFIOPCIDevice
*vdev
;
210 } VFIOConfigMirrorQuirk
;
212 static uint64_t vfio_generic_quirk_mirror_read(void *opaque
,
213 hwaddr addr
, unsigned size
)
215 VFIOConfigMirrorQuirk
*mirror
= opaque
;
216 VFIOPCIDevice
*vdev
= mirror
->vdev
;
219 /* Read and discard in case the hardware cares */
220 (void)vfio_region_read(&vdev
->bars
[mirror
->bar
].region
,
221 addr
+ mirror
->offset
, size
);
223 data
= vfio_pci_read_config(&vdev
->pdev
, addr
, size
);
224 trace_vfio_quirk_generic_mirror_read(vdev
->vbasedev
.name
,
225 memory_region_name(mirror
->mem
),
230 static void vfio_generic_quirk_mirror_write(void *opaque
, hwaddr addr
,
231 uint64_t data
, unsigned size
)
233 VFIOConfigMirrorQuirk
*mirror
= opaque
;
234 VFIOPCIDevice
*vdev
= mirror
->vdev
;
236 vfio_pci_write_config(&vdev
->pdev
, addr
, data
, size
);
237 trace_vfio_quirk_generic_mirror_write(vdev
->vbasedev
.name
,
238 memory_region_name(mirror
->mem
),
242 static const MemoryRegionOps vfio_generic_mirror_quirk
= {
243 .read
= vfio_generic_quirk_mirror_read
,
244 .write
= vfio_generic_quirk_mirror_write
,
245 .endianness
= DEVICE_LITTLE_ENDIAN
,
248 /* Is range1 fully contained within range2? */
249 static bool vfio_range_contained(uint64_t first1
, uint64_t len1
,
250 uint64_t first2
, uint64_t len2
) {
251 return (first1
>= first2
&& first1
+ len1
<= first2
+ len2
);
254 #define PCI_VENDOR_ID_ATI 0x1002
257 * Radeon HD cards (HD5450 & HD7850) report the upper byte of the I/O port BAR
258 * through VGA register 0x3c3. On newer cards, the I/O port BAR is always
259 * BAR4 (older cards like the X550 used BAR1, but we don't care to support
260 * those). Note that on bare metal, a read of 0x3c3 doesn't always return the
261 * I/O port BAR address. Originally this was coded to return the virtual BAR
262 * address only if the physical register read returns the actual BAR address,
263 * but users have reported greater success if we return the virtual address
266 static uint64_t vfio_ati_3c3_quirk_read(void *opaque
,
267 hwaddr addr
, unsigned size
)
269 VFIOPCIDevice
*vdev
= opaque
;
270 uint64_t data
= vfio_pci_read_config(&vdev
->pdev
,
271 PCI_BASE_ADDRESS_4
+ 1, size
);
273 trace_vfio_quirk_ati_3c3_read(vdev
->vbasedev
.name
, data
);
278 static const MemoryRegionOps vfio_ati_3c3_quirk
= {
279 .read
= vfio_ati_3c3_quirk_read
,
280 .endianness
= DEVICE_LITTLE_ENDIAN
,
283 static VFIOQuirk
*vfio_quirk_alloc(int nr_mem
)
285 VFIOQuirk
*quirk
= g_new0(VFIOQuirk
, 1);
286 QLIST_INIT(&quirk
->ioeventfds
);
287 quirk
->mem
= g_new0(MemoryRegion
, nr_mem
);
288 quirk
->nr_mem
= nr_mem
;
293 static void vfio_ioeventfd_exit(VFIOPCIDevice
*vdev
, VFIOIOEventFD
*ioeventfd
)
295 QLIST_REMOVE(ioeventfd
, next
);
296 memory_region_del_eventfd(ioeventfd
->mr
, ioeventfd
->addr
, ioeventfd
->size
,
297 true, ioeventfd
->data
, &ioeventfd
->e
);
299 if (ioeventfd
->vfio
) {
300 struct vfio_device_ioeventfd vfio_ioeventfd
;
302 vfio_ioeventfd
.argsz
= sizeof(vfio_ioeventfd
);
303 vfio_ioeventfd
.flags
= ioeventfd
->size
;
304 vfio_ioeventfd
.data
= ioeventfd
->data
;
305 vfio_ioeventfd
.offset
= ioeventfd
->region
->fd_offset
+
306 ioeventfd
->region_addr
;
307 vfio_ioeventfd
.fd
= -1;
309 if (ioctl(vdev
->vbasedev
.fd
, VFIO_DEVICE_IOEVENTFD
, &vfio_ioeventfd
)) {
310 error_report("Failed to remove vfio ioeventfd for %s+0x%"
311 HWADDR_PRIx
"[%d]:0x%"PRIx64
" (%m)",
312 memory_region_name(ioeventfd
->mr
), ioeventfd
->addr
,
313 ioeventfd
->size
, ioeventfd
->data
);
316 qemu_set_fd_handler(event_notifier_get_fd(&ioeventfd
->e
),
320 event_notifier_cleanup(&ioeventfd
->e
);
321 trace_vfio_ioeventfd_exit(memory_region_name(ioeventfd
->mr
),
322 (uint64_t)ioeventfd
->addr
, ioeventfd
->size
,
327 static void vfio_drop_dynamic_eventfds(VFIOPCIDevice
*vdev
, VFIOQuirk
*quirk
)
329 VFIOIOEventFD
*ioeventfd
, *tmp
;
331 QLIST_FOREACH_SAFE(ioeventfd
, &quirk
->ioeventfds
, next
, tmp
) {
332 if (ioeventfd
->dynamic
) {
333 vfio_ioeventfd_exit(vdev
, ioeventfd
);
338 static void vfio_ioeventfd_handler(void *opaque
)
340 VFIOIOEventFD
*ioeventfd
= opaque
;
342 if (event_notifier_test_and_clear(&ioeventfd
->e
)) {
343 vfio_region_write(ioeventfd
->region
, ioeventfd
->region_addr
,
344 ioeventfd
->data
, ioeventfd
->size
);
345 trace_vfio_ioeventfd_handler(memory_region_name(ioeventfd
->mr
),
346 (uint64_t)ioeventfd
->addr
, ioeventfd
->size
,
351 static VFIOIOEventFD
*vfio_ioeventfd_init(VFIOPCIDevice
*vdev
,
352 MemoryRegion
*mr
, hwaddr addr
,
353 unsigned size
, uint64_t data
,
355 hwaddr region_addr
, bool dynamic
)
357 VFIOIOEventFD
*ioeventfd
;
359 if (vdev
->no_kvm_ioeventfd
) {
363 ioeventfd
= g_malloc0(sizeof(*ioeventfd
));
365 if (event_notifier_init(&ioeventfd
->e
, 0)) {
371 * MemoryRegion and relative offset, plus additional ioeventfd setup
372 * parameters for configuring and later tearing down KVM ioeventfd.
375 ioeventfd
->addr
= addr
;
376 ioeventfd
->size
= size
;
377 ioeventfd
->data
= data
;
378 ioeventfd
->dynamic
= dynamic
;
380 * VFIORegion and relative offset for implementing the userspace
381 * handler. data & size fields shared for both uses.
383 ioeventfd
->region
= region
;
384 ioeventfd
->region_addr
= region_addr
;
386 if (!vdev
->no_vfio_ioeventfd
) {
387 struct vfio_device_ioeventfd vfio_ioeventfd
;
389 vfio_ioeventfd
.argsz
= sizeof(vfio_ioeventfd
);
390 vfio_ioeventfd
.flags
= ioeventfd
->size
;
391 vfio_ioeventfd
.data
= ioeventfd
->data
;
392 vfio_ioeventfd
.offset
= ioeventfd
->region
->fd_offset
+
393 ioeventfd
->region_addr
;
394 vfio_ioeventfd
.fd
= event_notifier_get_fd(&ioeventfd
->e
);
396 ioeventfd
->vfio
= !ioctl(vdev
->vbasedev
.fd
,
397 VFIO_DEVICE_IOEVENTFD
, &vfio_ioeventfd
);
400 if (!ioeventfd
->vfio
) {
401 qemu_set_fd_handler(event_notifier_get_fd(&ioeventfd
->e
),
402 vfio_ioeventfd_handler
, NULL
, ioeventfd
);
405 memory_region_add_eventfd(ioeventfd
->mr
, ioeventfd
->addr
, ioeventfd
->size
,
406 true, ioeventfd
->data
, &ioeventfd
->e
);
407 trace_vfio_ioeventfd_init(memory_region_name(mr
), (uint64_t)addr
,
408 size
, data
, ioeventfd
->vfio
);
413 static void vfio_vga_probe_ati_3c3_quirk(VFIOPCIDevice
*vdev
)
418 * As long as the BAR is >= 256 bytes it will be aligned such that the
419 * lower byte is always zero. Filter out anything else, if it exists.
421 if (!vfio_pci_is(vdev
, PCI_VENDOR_ID_ATI
, PCI_ANY_ID
) ||
422 !vdev
->bars
[4].ioport
|| vdev
->bars
[4].region
.size
< 256) {
426 quirk
= vfio_quirk_alloc(1);
428 memory_region_init_io(quirk
->mem
, OBJECT(vdev
), &vfio_ati_3c3_quirk
, vdev
,
429 "vfio-ati-3c3-quirk", 1);
430 memory_region_add_subregion(&vdev
->vga
->region
[QEMU_PCI_VGA_IO_HI
].mem
,
431 3 /* offset 3 bytes from 0x3c0 */, quirk
->mem
);
433 QLIST_INSERT_HEAD(&vdev
->vga
->region
[QEMU_PCI_VGA_IO_HI
].quirks
,
436 trace_vfio_quirk_ati_3c3_probe(vdev
->vbasedev
.name
);
440 * Newer ATI/AMD devices, including HD5450 and HD7850, have a mirror to PCI
441 * config space through MMIO BAR2 at offset 0x4000. Nothing seems to access
442 * the MMIO space directly, but a window to this space is provided through
443 * I/O port BAR4. Offset 0x0 is the address register and offset 0x4 is the
444 * data register. When the address is programmed to a range of 0x4000-0x4fff
445 * PCI configuration space is available. Experimentation seems to indicate
446 * that read-only may be provided by hardware.
448 static void vfio_probe_ati_bar4_quirk(VFIOPCIDevice
*vdev
, int nr
)
451 VFIOConfigWindowQuirk
*window
;
453 /* This windows doesn't seem to be used except by legacy VGA code */
454 if (!vfio_pci_is(vdev
, PCI_VENDOR_ID_ATI
, PCI_ANY_ID
) ||
455 !vdev
->vga
|| nr
!= 4) {
459 quirk
= vfio_quirk_alloc(2);
460 window
= quirk
->data
= g_malloc0(sizeof(*window
) +
461 sizeof(VFIOConfigWindowMatch
));
463 window
->address_offset
= 0;
464 window
->data_offset
= 4;
465 window
->nr_matches
= 1;
466 window
->matches
[0].match
= 0x4000;
467 window
->matches
[0].mask
= vdev
->config_size
- 1;
469 window
->addr_mem
= &quirk
->mem
[0];
470 window
->data_mem
= &quirk
->mem
[1];
472 memory_region_init_io(window
->addr_mem
, OBJECT(vdev
),
473 &vfio_generic_window_address_quirk
, window
,
474 "vfio-ati-bar4-window-address-quirk", 4);
475 memory_region_add_subregion_overlap(vdev
->bars
[nr
].region
.mem
,
476 window
->address_offset
,
477 window
->addr_mem
, 1);
479 memory_region_init_io(window
->data_mem
, OBJECT(vdev
),
480 &vfio_generic_window_data_quirk
, window
,
481 "vfio-ati-bar4-window-data-quirk", 4);
482 memory_region_add_subregion_overlap(vdev
->bars
[nr
].region
.mem
,
484 window
->data_mem
, 1);
486 QLIST_INSERT_HEAD(&vdev
->bars
[nr
].quirks
, quirk
, next
);
488 trace_vfio_quirk_ati_bar4_probe(vdev
->vbasedev
.name
);
492 * Trap the BAR2 MMIO mirror to config space as well.
494 static void vfio_probe_ati_bar2_quirk(VFIOPCIDevice
*vdev
, int nr
)
497 VFIOConfigMirrorQuirk
*mirror
;
499 /* Only enable on newer devices where BAR2 is 64bit */
500 if (!vfio_pci_is(vdev
, PCI_VENDOR_ID_ATI
, PCI_ANY_ID
) ||
501 !vdev
->vga
|| nr
!= 2 || !vdev
->bars
[2].mem64
) {
505 quirk
= vfio_quirk_alloc(1);
506 mirror
= quirk
->data
= g_malloc0(sizeof(*mirror
));
507 mirror
->mem
= quirk
->mem
;
509 mirror
->offset
= 0x4000;
512 memory_region_init_io(mirror
->mem
, OBJECT(vdev
),
513 &vfio_generic_mirror_quirk
, mirror
,
514 "vfio-ati-bar2-4000-quirk", PCI_CONFIG_SPACE_SIZE
);
515 memory_region_add_subregion_overlap(vdev
->bars
[nr
].region
.mem
,
516 mirror
->offset
, mirror
->mem
, 1);
518 QLIST_INSERT_HEAD(&vdev
->bars
[nr
].quirks
, quirk
, next
);
520 trace_vfio_quirk_ati_bar2_probe(vdev
->vbasedev
.name
);
524 * Older ATI/AMD cards like the X550 have a similar window to that above.
525 * I/O port BAR1 provides a window to a mirror of PCI config space located
526 * in BAR2 at offset 0xf00. We don't care to support such older cards, but
527 * note it for future reference.
531 * Nvidia has several different methods to get to config space, the
532 * nouveu project has several of these documented here:
533 * https://github.com/pathscale/envytools/tree/master/hwdocs
535 * The first quirk is actually not documented in envytools and is found
536 * on 10de:01d1 (NVIDIA Corporation G72 [GeForce 7300 LE]). This is an
537 * NV46 chipset. The backdoor uses the legacy VGA I/O ports to access
538 * the mirror of PCI config space found at BAR0 offset 0x1800. The access
539 * sequence first writes 0x338 to I/O port 0x3d4. The target offset is
540 * then written to 0x3d0. Finally 0x538 is written for a read and 0x738
541 * is written for a write to 0x3d4. The BAR0 offset is then accessible
542 * through 0x3d0. This quirk doesn't seem to be necessary on newer cards
543 * that use the I/O port BAR5 window but it doesn't hurt to leave it.
545 typedef enum {NONE
= 0, SELECT
, WINDOW
, READ
, WRITE
} VFIONvidia3d0State
;
546 static const char *nv3d0_states
[] = { "NONE", "SELECT",
547 "WINDOW", "READ", "WRITE" };
549 typedef struct VFIONvidia3d0Quirk
{
551 VFIONvidia3d0State state
;
553 } VFIONvidia3d0Quirk
;
555 static uint64_t vfio_nvidia_3d4_quirk_read(void *opaque
,
556 hwaddr addr
, unsigned size
)
558 VFIONvidia3d0Quirk
*quirk
= opaque
;
559 VFIOPCIDevice
*vdev
= quirk
->vdev
;
563 return vfio_vga_read(&vdev
->vga
->region
[QEMU_PCI_VGA_IO_HI
],
567 static void vfio_nvidia_3d4_quirk_write(void *opaque
, hwaddr addr
,
568 uint64_t data
, unsigned size
)
570 VFIONvidia3d0Quirk
*quirk
= opaque
;
571 VFIOPCIDevice
*vdev
= quirk
->vdev
;
572 VFIONvidia3d0State old_state
= quirk
->state
;
578 if (old_state
== NONE
) {
579 quirk
->state
= SELECT
;
580 trace_vfio_quirk_nvidia_3d0_state(vdev
->vbasedev
.name
,
581 nv3d0_states
[quirk
->state
]);
585 if (old_state
== WINDOW
) {
587 trace_vfio_quirk_nvidia_3d0_state(vdev
->vbasedev
.name
,
588 nv3d0_states
[quirk
->state
]);
592 if (old_state
== WINDOW
) {
593 quirk
->state
= WRITE
;
594 trace_vfio_quirk_nvidia_3d0_state(vdev
->vbasedev
.name
,
595 nv3d0_states
[quirk
->state
]);
600 vfio_vga_write(&vdev
->vga
->region
[QEMU_PCI_VGA_IO_HI
],
601 addr
+ 0x14, data
, size
);
604 static const MemoryRegionOps vfio_nvidia_3d4_quirk
= {
605 .read
= vfio_nvidia_3d4_quirk_read
,
606 .write
= vfio_nvidia_3d4_quirk_write
,
607 .endianness
= DEVICE_LITTLE_ENDIAN
,
610 static uint64_t vfio_nvidia_3d0_quirk_read(void *opaque
,
611 hwaddr addr
, unsigned size
)
613 VFIONvidia3d0Quirk
*quirk
= opaque
;
614 VFIOPCIDevice
*vdev
= quirk
->vdev
;
615 VFIONvidia3d0State old_state
= quirk
->state
;
616 uint64_t data
= vfio_vga_read(&vdev
->vga
->region
[QEMU_PCI_VGA_IO_HI
],
621 if (old_state
== READ
&&
622 (quirk
->offset
& ~(PCI_CONFIG_SPACE_SIZE
- 1)) == 0x1800) {
623 uint8_t offset
= quirk
->offset
& (PCI_CONFIG_SPACE_SIZE
- 1);
625 data
= vfio_pci_read_config(&vdev
->pdev
, offset
, size
);
626 trace_vfio_quirk_nvidia_3d0_read(vdev
->vbasedev
.name
,
633 static void vfio_nvidia_3d0_quirk_write(void *opaque
, hwaddr addr
,
634 uint64_t data
, unsigned size
)
636 VFIONvidia3d0Quirk
*quirk
= opaque
;
637 VFIOPCIDevice
*vdev
= quirk
->vdev
;
638 VFIONvidia3d0State old_state
= quirk
->state
;
642 if (old_state
== SELECT
) {
643 quirk
->offset
= (uint32_t)data
;
644 quirk
->state
= WINDOW
;
645 trace_vfio_quirk_nvidia_3d0_state(vdev
->vbasedev
.name
,
646 nv3d0_states
[quirk
->state
]);
647 } else if (old_state
== WRITE
) {
648 if ((quirk
->offset
& ~(PCI_CONFIG_SPACE_SIZE
- 1)) == 0x1800) {
649 uint8_t offset
= quirk
->offset
& (PCI_CONFIG_SPACE_SIZE
- 1);
651 vfio_pci_write_config(&vdev
->pdev
, offset
, data
, size
);
652 trace_vfio_quirk_nvidia_3d0_write(vdev
->vbasedev
.name
,
658 vfio_vga_write(&vdev
->vga
->region
[QEMU_PCI_VGA_IO_HI
],
659 addr
+ 0x10, data
, size
);
662 static const MemoryRegionOps vfio_nvidia_3d0_quirk
= {
663 .read
= vfio_nvidia_3d0_quirk_read
,
664 .write
= vfio_nvidia_3d0_quirk_write
,
665 .endianness
= DEVICE_LITTLE_ENDIAN
,
668 static void vfio_vga_probe_nvidia_3d0_quirk(VFIOPCIDevice
*vdev
)
671 VFIONvidia3d0Quirk
*data
;
673 if (vdev
->no_geforce_quirks
||
674 !vfio_pci_is(vdev
, PCI_VENDOR_ID_NVIDIA
, PCI_ANY_ID
) ||
675 !vdev
->bars
[1].region
.size
) {
679 quirk
= vfio_quirk_alloc(2);
680 quirk
->data
= data
= g_malloc0(sizeof(*data
));
683 memory_region_init_io(&quirk
->mem
[0], OBJECT(vdev
), &vfio_nvidia_3d4_quirk
,
684 data
, "vfio-nvidia-3d4-quirk", 2);
685 memory_region_add_subregion(&vdev
->vga
->region
[QEMU_PCI_VGA_IO_HI
].mem
,
686 0x14 /* 0x3c0 + 0x14 */, &quirk
->mem
[0]);
688 memory_region_init_io(&quirk
->mem
[1], OBJECT(vdev
), &vfio_nvidia_3d0_quirk
,
689 data
, "vfio-nvidia-3d0-quirk", 2);
690 memory_region_add_subregion(&vdev
->vga
->region
[QEMU_PCI_VGA_IO_HI
].mem
,
691 0x10 /* 0x3c0 + 0x10 */, &quirk
->mem
[1]);
693 QLIST_INSERT_HEAD(&vdev
->vga
->region
[QEMU_PCI_VGA_IO_HI
].quirks
,
696 trace_vfio_quirk_nvidia_3d0_probe(vdev
->vbasedev
.name
);
700 * The second quirk is documented in envytools. The I/O port BAR5 is just
701 * a set of address/data ports to the MMIO BARs. The BAR we care about is
702 * again BAR0. This backdoor is apparently a bit newer than the one above
703 * so we need to not only trap 256 bytes @0x1800, but all of PCI config
704 * space, including extended space is available at the 4k @0x88000.
706 typedef struct VFIONvidiaBAR5Quirk
{
709 MemoryRegion
*addr_mem
;
710 MemoryRegion
*data_mem
;
712 VFIOConfigWindowQuirk window
; /* last for match data */
713 } VFIONvidiaBAR5Quirk
;
715 static void vfio_nvidia_bar5_enable(VFIONvidiaBAR5Quirk
*bar5
)
717 VFIOPCIDevice
*vdev
= bar5
->window
.vdev
;
719 if (((bar5
->master
& bar5
->enable
) & 0x1) == bar5
->enabled
) {
723 bar5
->enabled
= !bar5
->enabled
;
724 trace_vfio_quirk_nvidia_bar5_state(vdev
->vbasedev
.name
,
725 bar5
->enabled
? "Enable" : "Disable");
726 memory_region_set_enabled(bar5
->addr_mem
, bar5
->enabled
);
727 memory_region_set_enabled(bar5
->data_mem
, bar5
->enabled
);
730 static uint64_t vfio_nvidia_bar5_quirk_master_read(void *opaque
,
731 hwaddr addr
, unsigned size
)
733 VFIONvidiaBAR5Quirk
*bar5
= opaque
;
734 VFIOPCIDevice
*vdev
= bar5
->window
.vdev
;
736 return vfio_region_read(&vdev
->bars
[5].region
, addr
, size
);
739 static void vfio_nvidia_bar5_quirk_master_write(void *opaque
, hwaddr addr
,
740 uint64_t data
, unsigned size
)
742 VFIONvidiaBAR5Quirk
*bar5
= opaque
;
743 VFIOPCIDevice
*vdev
= bar5
->window
.vdev
;
745 vfio_region_write(&vdev
->bars
[5].region
, addr
, data
, size
);
748 vfio_nvidia_bar5_enable(bar5
);
751 static const MemoryRegionOps vfio_nvidia_bar5_quirk_master
= {
752 .read
= vfio_nvidia_bar5_quirk_master_read
,
753 .write
= vfio_nvidia_bar5_quirk_master_write
,
754 .endianness
= DEVICE_LITTLE_ENDIAN
,
757 static uint64_t vfio_nvidia_bar5_quirk_enable_read(void *opaque
,
758 hwaddr addr
, unsigned size
)
760 VFIONvidiaBAR5Quirk
*bar5
= opaque
;
761 VFIOPCIDevice
*vdev
= bar5
->window
.vdev
;
763 return vfio_region_read(&vdev
->bars
[5].region
, addr
+ 4, size
);
766 static void vfio_nvidia_bar5_quirk_enable_write(void *opaque
, hwaddr addr
,
767 uint64_t data
, unsigned size
)
769 VFIONvidiaBAR5Quirk
*bar5
= opaque
;
770 VFIOPCIDevice
*vdev
= bar5
->window
.vdev
;
772 vfio_region_write(&vdev
->bars
[5].region
, addr
+ 4, data
, size
);
775 vfio_nvidia_bar5_enable(bar5
);
778 static const MemoryRegionOps vfio_nvidia_bar5_quirk_enable
= {
779 .read
= vfio_nvidia_bar5_quirk_enable_read
,
780 .write
= vfio_nvidia_bar5_quirk_enable_write
,
781 .endianness
= DEVICE_LITTLE_ENDIAN
,
784 static void vfio_probe_nvidia_bar5_quirk(VFIOPCIDevice
*vdev
, int nr
)
787 VFIONvidiaBAR5Quirk
*bar5
;
788 VFIOConfigWindowQuirk
*window
;
790 if (vdev
->no_geforce_quirks
||
791 !vfio_pci_is(vdev
, PCI_VENDOR_ID_NVIDIA
, PCI_ANY_ID
) ||
792 !vdev
->vga
|| nr
!= 5 || !vdev
->bars
[5].ioport
) {
796 quirk
= vfio_quirk_alloc(4);
797 bar5
= quirk
->data
= g_malloc0(sizeof(*bar5
) +
798 (sizeof(VFIOConfigWindowMatch
) * 2));
799 window
= &bar5
->window
;
802 window
->address_offset
= 0x8;
803 window
->data_offset
= 0xc;
804 window
->nr_matches
= 2;
805 window
->matches
[0].match
= 0x1800;
806 window
->matches
[0].mask
= PCI_CONFIG_SPACE_SIZE
- 1;
807 window
->matches
[1].match
= 0x88000;
808 window
->matches
[1].mask
= vdev
->config_size
- 1;
810 window
->addr_mem
= bar5
->addr_mem
= &quirk
->mem
[0];
811 window
->data_mem
= bar5
->data_mem
= &quirk
->mem
[1];
813 memory_region_init_io(window
->addr_mem
, OBJECT(vdev
),
814 &vfio_generic_window_address_quirk
, window
,
815 "vfio-nvidia-bar5-window-address-quirk", 4);
816 memory_region_add_subregion_overlap(vdev
->bars
[nr
].region
.mem
,
817 window
->address_offset
,
818 window
->addr_mem
, 1);
819 memory_region_set_enabled(window
->addr_mem
, false);
821 memory_region_init_io(window
->data_mem
, OBJECT(vdev
),
822 &vfio_generic_window_data_quirk
, window
,
823 "vfio-nvidia-bar5-window-data-quirk", 4);
824 memory_region_add_subregion_overlap(vdev
->bars
[nr
].region
.mem
,
826 window
->data_mem
, 1);
827 memory_region_set_enabled(window
->data_mem
, false);
829 memory_region_init_io(&quirk
->mem
[2], OBJECT(vdev
),
830 &vfio_nvidia_bar5_quirk_master
, bar5
,
831 "vfio-nvidia-bar5-master-quirk", 4);
832 memory_region_add_subregion_overlap(vdev
->bars
[nr
].region
.mem
,
833 0, &quirk
->mem
[2], 1);
835 memory_region_init_io(&quirk
->mem
[3], OBJECT(vdev
),
836 &vfio_nvidia_bar5_quirk_enable
, bar5
,
837 "vfio-nvidia-bar5-enable-quirk", 4);
838 memory_region_add_subregion_overlap(vdev
->bars
[nr
].region
.mem
,
839 4, &quirk
->mem
[3], 1);
841 QLIST_INSERT_HEAD(&vdev
->bars
[nr
].quirks
, quirk
, next
);
843 trace_vfio_quirk_nvidia_bar5_probe(vdev
->vbasedev
.name
);
846 typedef struct LastDataSet
{
855 #define MAX_DYN_IOEVENTFD 10
856 #define HITS_FOR_IOEVENTFD 10
859 * Finally, BAR0 itself. We want to redirect any accesses to either
860 * 0x1800 or 0x88000 through the PCI config space access functions.
862 static void vfio_nvidia_quirk_mirror_write(void *opaque
, hwaddr addr
,
863 uint64_t data
, unsigned size
)
865 VFIOConfigMirrorQuirk
*mirror
= opaque
;
866 VFIOPCIDevice
*vdev
= mirror
->vdev
;
867 PCIDevice
*pdev
= &vdev
->pdev
;
868 LastDataSet
*last
= (LastDataSet
*)&mirror
->data
;
870 vfio_generic_quirk_mirror_write(opaque
, addr
, data
, size
);
873 * Nvidia seems to acknowledge MSI interrupts by writing 0xff to the
874 * MSI capability ID register. Both the ID and next register are
875 * read-only, so we allow writes covering either of those to real hw.
877 if ((pdev
->cap_present
& QEMU_PCI_CAP_MSI
) &&
878 vfio_range_contained(addr
, size
, pdev
->msi_cap
, PCI_MSI_FLAGS
)) {
879 vfio_region_write(&vdev
->bars
[mirror
->bar
].region
,
880 addr
+ mirror
->offset
, data
, size
);
881 trace_vfio_quirk_nvidia_bar0_msi_ack(vdev
->vbasedev
.name
);
885 * Automatically add an ioeventfd to handle any repeated write with the
886 * same data and size above the standard PCI config space header. This is
887 * primarily expected to accelerate the MSI-ACK behavior, such as noted
888 * above. Current hardware/drivers should trigger an ioeventfd at config
889 * offset 0x704 (region offset 0x88704), with data 0x0, size 4.
891 * The criteria of 10 successive hits is arbitrary but reliably adds the
892 * MSI-ACK region. Note that as some writes are bypassed via the ioeventfd,
893 * the remaining ones have a greater chance of being seen successively.
894 * To avoid the pathological case of burning up all of QEMU's open file
895 * handles, arbitrarily limit this algorithm from adding no more than 10
896 * ioeventfds, print an error if we would have added an 11th, and then
899 if (!vdev
->no_kvm_ioeventfd
&&
900 addr
>= PCI_STD_HEADER_SIZEOF
&& last
->added
<= MAX_DYN_IOEVENTFD
) {
901 if (addr
!= last
->addr
|| data
!= last
->data
|| size
!= last
->size
) {
906 } else if (++last
->hits
>= HITS_FOR_IOEVENTFD
) {
907 if (last
->added
< MAX_DYN_IOEVENTFD
) {
908 VFIOIOEventFD
*ioeventfd
;
909 ioeventfd
= vfio_ioeventfd_init(vdev
, mirror
->mem
, addr
, size
,
910 data
, &vdev
->bars
[mirror
->bar
].region
,
911 mirror
->offset
+ addr
, true);
913 VFIOQuirk
*quirk
= last
->quirk
;
915 QLIST_INSERT_HEAD(&quirk
->ioeventfds
, ioeventfd
, next
);
920 warn_report("NVIDIA ioeventfd queue full for %s, unable to "
921 "accelerate 0x%"HWADDR_PRIx
", data 0x%"PRIx64
", "
922 "size %u", vdev
->vbasedev
.name
, addr
, data
, size
);
928 static const MemoryRegionOps vfio_nvidia_mirror_quirk
= {
929 .read
= vfio_generic_quirk_mirror_read
,
930 .write
= vfio_nvidia_quirk_mirror_write
,
931 .endianness
= DEVICE_LITTLE_ENDIAN
,
934 static void vfio_nvidia_bar0_quirk_reset(VFIOPCIDevice
*vdev
, VFIOQuirk
*quirk
)
936 VFIOConfigMirrorQuirk
*mirror
= quirk
->data
;
937 LastDataSet
*last
= (LastDataSet
*)&mirror
->data
;
939 last
->addr
= last
->data
= last
->size
= last
->hits
= last
->added
= 0;
941 vfio_drop_dynamic_eventfds(vdev
, quirk
);
944 static void vfio_probe_nvidia_bar0_quirk(VFIOPCIDevice
*vdev
, int nr
)
947 VFIOConfigMirrorQuirk
*mirror
;
950 if (vdev
->no_geforce_quirks
||
951 !vfio_pci_is(vdev
, PCI_VENDOR_ID_NVIDIA
, PCI_ANY_ID
) ||
952 !vfio_is_vga(vdev
) || nr
!= 0) {
956 quirk
= vfio_quirk_alloc(1);
957 quirk
->reset
= vfio_nvidia_bar0_quirk_reset
;
958 mirror
= quirk
->data
= g_malloc0(sizeof(*mirror
) + sizeof(LastDataSet
));
959 mirror
->mem
= quirk
->mem
;
961 mirror
->offset
= 0x88000;
963 last
= (LastDataSet
*)&mirror
->data
;
966 memory_region_init_io(mirror
->mem
, OBJECT(vdev
),
967 &vfio_nvidia_mirror_quirk
, mirror
,
968 "vfio-nvidia-bar0-88000-mirror-quirk",
970 memory_region_add_subregion_overlap(vdev
->bars
[nr
].region
.mem
,
971 mirror
->offset
, mirror
->mem
, 1);
973 QLIST_INSERT_HEAD(&vdev
->bars
[nr
].quirks
, quirk
, next
);
975 /* The 0x1800 offset mirror only seems to get used by legacy VGA */
977 quirk
= vfio_quirk_alloc(1);
978 quirk
->reset
= vfio_nvidia_bar0_quirk_reset
;
979 mirror
= quirk
->data
= g_malloc0(sizeof(*mirror
) + sizeof(LastDataSet
));
980 mirror
->mem
= quirk
->mem
;
982 mirror
->offset
= 0x1800;
984 last
= (LastDataSet
*)&mirror
->data
;
987 memory_region_init_io(mirror
->mem
, OBJECT(vdev
),
988 &vfio_nvidia_mirror_quirk
, mirror
,
989 "vfio-nvidia-bar0-1800-mirror-quirk",
990 PCI_CONFIG_SPACE_SIZE
);
991 memory_region_add_subregion_overlap(vdev
->bars
[nr
].region
.mem
,
992 mirror
->offset
, mirror
->mem
, 1);
994 QLIST_INSERT_HEAD(&vdev
->bars
[nr
].quirks
, quirk
, next
);
997 trace_vfio_quirk_nvidia_bar0_probe(vdev
->vbasedev
.name
);
1001 * TODO - Some Nvidia devices provide config access to their companion HDA
1002 * device and even to their parent bridge via these config space mirrors.
1003 * Add quirks for those regions.
1006 #define PCI_VENDOR_ID_REALTEK 0x10ec
1009 * RTL8168 devices have a backdoor that can access the MSI-X table. At BAR2
1010 * offset 0x70 there is a dword data register, offset 0x74 is a dword address
1011 * register. According to the Linux r8169 driver, the MSI-X table is addressed
1012 * when the "type" portion of the address register is set to 0x1. This appears
1013 * to be bits 16:30. Bit 31 is both a write indicator and some sort of
1014 * "address latched" indicator. Bits 12:15 are a mask field, which we can
1015 * ignore because the MSI-X table should always be accessed as a dword (full
1016 * mask). Bits 0:11 is offset within the type.
1020 * Read from MSI-X table offset 0
1021 * vfio: vfio_bar_write(0000:05:00.0:BAR2+0x74, 0x1f000, 4) // store read addr
1022 * vfio: vfio_bar_read(0000:05:00.0:BAR2+0x74, 4) = 0x8001f000 // latch
1023 * vfio: vfio_bar_read(0000:05:00.0:BAR2+0x70, 4) = 0xfee00398 // read data
1025 * Write 0xfee00000 to MSI-X table offset 0
1026 * vfio: vfio_bar_write(0000:05:00.0:BAR2+0x70, 0xfee00000, 4) // write data
1027 * vfio: vfio_bar_write(0000:05:00.0:BAR2+0x74, 0x8001f000, 4) // do write
1028 * vfio: vfio_bar_read(0000:05:00.0:BAR2+0x74, 4) = 0x1f000 // complete
1030 typedef struct VFIOrtl8168Quirk
{
1031 VFIOPCIDevice
*vdev
;
1037 static uint64_t vfio_rtl8168_quirk_address_read(void *opaque
,
1038 hwaddr addr
, unsigned size
)
1040 VFIOrtl8168Quirk
*rtl
= opaque
;
1041 VFIOPCIDevice
*vdev
= rtl
->vdev
;
1042 uint64_t data
= vfio_region_read(&vdev
->bars
[2].region
, addr
+ 0x74, size
);
1045 data
= rtl
->addr
^ 0x80000000U
; /* latch/complete */
1046 trace_vfio_quirk_rtl8168_fake_latch(vdev
->vbasedev
.name
, data
);
1052 static void vfio_rtl8168_quirk_address_write(void *opaque
, hwaddr addr
,
1053 uint64_t data
, unsigned size
)
1055 VFIOrtl8168Quirk
*rtl
= opaque
;
1056 VFIOPCIDevice
*vdev
= rtl
->vdev
;
1058 rtl
->enabled
= false;
1060 if ((data
& 0x7fff0000) == 0x10000) { /* MSI-X table */
1061 rtl
->enabled
= true;
1062 rtl
->addr
= (uint32_t)data
;
1064 if (data
& 0x80000000U
) { /* Do write */
1065 if (vdev
->pdev
.cap_present
& QEMU_PCI_CAP_MSIX
) {
1066 hwaddr offset
= data
& 0xfff;
1067 uint64_t val
= rtl
->data
;
1069 trace_vfio_quirk_rtl8168_msix_write(vdev
->vbasedev
.name
,
1070 (uint16_t)offset
, val
);
1072 /* Write to the proper guest MSI-X table instead */
1073 memory_region_dispatch_write(&vdev
->pdev
.msix_table_mmio
,
1075 MEMTXATTRS_UNSPECIFIED
);
1077 return; /* Do not write guest MSI-X data to hardware */
1081 vfio_region_write(&vdev
->bars
[2].region
, addr
+ 0x74, data
, size
);
1084 static const MemoryRegionOps vfio_rtl_address_quirk
= {
1085 .read
= vfio_rtl8168_quirk_address_read
,
1086 .write
= vfio_rtl8168_quirk_address_write
,
1088 .min_access_size
= 4,
1089 .max_access_size
= 4,
1092 .endianness
= DEVICE_LITTLE_ENDIAN
,
1095 static uint64_t vfio_rtl8168_quirk_data_read(void *opaque
,
1096 hwaddr addr
, unsigned size
)
1098 VFIOrtl8168Quirk
*rtl
= opaque
;
1099 VFIOPCIDevice
*vdev
= rtl
->vdev
;
1100 uint64_t data
= vfio_region_read(&vdev
->bars
[2].region
, addr
+ 0x70, size
);
1102 if (rtl
->enabled
&& (vdev
->pdev
.cap_present
& QEMU_PCI_CAP_MSIX
)) {
1103 hwaddr offset
= rtl
->addr
& 0xfff;
1104 memory_region_dispatch_read(&vdev
->pdev
.msix_table_mmio
, offset
,
1105 &data
, size
, MEMTXATTRS_UNSPECIFIED
);
1106 trace_vfio_quirk_rtl8168_msix_read(vdev
->vbasedev
.name
, offset
, data
);
1112 static void vfio_rtl8168_quirk_data_write(void *opaque
, hwaddr addr
,
1113 uint64_t data
, unsigned size
)
1115 VFIOrtl8168Quirk
*rtl
= opaque
;
1116 VFIOPCIDevice
*vdev
= rtl
->vdev
;
1118 rtl
->data
= (uint32_t)data
;
1120 vfio_region_write(&vdev
->bars
[2].region
, addr
+ 0x70, data
, size
);
1123 static const MemoryRegionOps vfio_rtl_data_quirk
= {
1124 .read
= vfio_rtl8168_quirk_data_read
,
1125 .write
= vfio_rtl8168_quirk_data_write
,
1127 .min_access_size
= 4,
1128 .max_access_size
= 4,
1131 .endianness
= DEVICE_LITTLE_ENDIAN
,
1134 static void vfio_probe_rtl8168_bar2_quirk(VFIOPCIDevice
*vdev
, int nr
)
1137 VFIOrtl8168Quirk
*rtl
;
1139 if (!vfio_pci_is(vdev
, PCI_VENDOR_ID_REALTEK
, 0x8168) || nr
!= 2) {
1143 quirk
= vfio_quirk_alloc(2);
1144 quirk
->data
= rtl
= g_malloc0(sizeof(*rtl
));
1147 memory_region_init_io(&quirk
->mem
[0], OBJECT(vdev
),
1148 &vfio_rtl_address_quirk
, rtl
,
1149 "vfio-rtl8168-window-address-quirk", 4);
1150 memory_region_add_subregion_overlap(vdev
->bars
[nr
].region
.mem
,
1151 0x74, &quirk
->mem
[0], 1);
1153 memory_region_init_io(&quirk
->mem
[1], OBJECT(vdev
),
1154 &vfio_rtl_data_quirk
, rtl
,
1155 "vfio-rtl8168-window-data-quirk", 4);
1156 memory_region_add_subregion_overlap(vdev
->bars
[nr
].region
.mem
,
1157 0x70, &quirk
->mem
[1], 1);
1159 QLIST_INSERT_HEAD(&vdev
->bars
[nr
].quirks
, quirk
, next
);
1161 trace_vfio_quirk_rtl8168_probe(vdev
->vbasedev
.name
);
1167 * Obviously IGD is not a discrete device, this is evidenced not only by it
1168 * being integrated into the CPU, but by the various chipset and BIOS
1169 * dependencies that it brings along with it. Intel is trying to move away
1170 * from this and Broadwell and newer devices can run in what Intel calls
1171 * "Universal Pass-Through" mode, or UPT. Theoretically in UPT mode, nothing
1172 * more is required beyond assigning the IGD device to a VM. There are
1173 * however support limitations to this mode. It only supports IGD as a
1174 * secondary graphics device in the VM and it doesn't officially support any
1177 * The code here attempts to enable what we'll call legacy mode assignment,
1178 * IGD retains most of the capabilities we expect for it to have on bare
1179 * metal. To enable this mode, the IGD device must be assigned to the VM
1180 * at PCI address 00:02.0, it must have a ROM, it very likely needs VGA
1181 * support, we must have VM BIOS support for reserving and populating some
1182 * of the required tables, and we need to tweak the chipset with revisions
1183 * and IDs and an LPC/ISA bridge device. The intention is to make all of
1184 * this happen automatically by installing the device at the correct VM PCI
1185 * bus address. If any of the conditions are not met, we cross our fingers
1186 * and hope the user knows better.
1188 * NB - It is possible to enable physical outputs in UPT mode by supplying
1189 * an OpRegion table. We don't do this by default because the guest driver
1190 * behaves differently if an OpRegion is provided and no monitor is attached
1191 * vs no OpRegion and a monitor being attached or not. Effectively, if a
1192 * headless setup is desired, the OpRegion gets in the way of that.
1196 * This presumes the device is already known to be an Intel VGA device, so we
1197 * take liberties in which device ID bits match which generation. This should
1198 * not be taken as an indication that all the devices are supported, or even
1199 * supportable, some of them don't even support VT-d.
1200 * See linux:include/drm/i915_pciids.h for IDs.
1202 static int igd_gen(VFIOPCIDevice
*vdev
)
1204 if ((vdev
->device_id
& 0xfff) == 0xa84) {
1205 return 8; /* Broxton */
1208 switch (vdev
->device_id
& 0xff00) {
1209 /* Old, untested, unavailable, unknown */
1219 /* SandyBridge, IvyBridge, ValleyView, Haswell */
1227 /* BroadWell, CherryView, SkyLake, KabyLake */
1235 return 8; /* Assume newer is compatible */
1238 typedef struct VFIOIGDQuirk
{
1239 struct VFIOPCIDevice
*vdev
;
1244 #define IGD_GMCH 0x50 /* Graphics Control Register */
1245 #define IGD_BDSM 0x5c /* Base Data of Stolen Memory */
1246 #define IGD_ASLS 0xfc /* ASL Storage Register */
1249 * The OpRegion includes the Video BIOS Table, which seems important for
1250 * telling the driver what sort of outputs it has. Without this, the device
1251 * may work in the guest, but we may not get output. This also requires BIOS
1252 * support to reserve and populate a section of guest memory sufficient for
1253 * the table and to write the base address of that memory to the ASLS register
1254 * of the IGD device.
1256 int vfio_pci_igd_opregion_init(VFIOPCIDevice
*vdev
,
1257 struct vfio_region_info
*info
, Error
**errp
)
1261 vdev
->igd_opregion
= g_malloc0(info
->size
);
1262 ret
= pread(vdev
->vbasedev
.fd
, vdev
->igd_opregion
,
1263 info
->size
, info
->offset
);
1264 if (ret
!= info
->size
) {
1265 error_setg(errp
, "failed to read IGD OpRegion");
1266 g_free(vdev
->igd_opregion
);
1267 vdev
->igd_opregion
= NULL
;
1272 * Provide fw_cfg with a copy of the OpRegion which the VM firmware is to
1273 * allocate 32bit reserved memory for, copy these contents into, and write
1274 * the reserved memory base address to the device ASLS register at 0xFC.
1275 * Alignment of this reserved region seems flexible, but using a 4k page
1276 * alignment seems to work well. This interface assumes a single IGD
1277 * device, which may be at VM address 00:02.0 in legacy mode or another
1278 * address in UPT mode.
1280 * NB, there may be future use cases discovered where the VM should have
1281 * direct interaction with the host OpRegion, in which case the write to
1282 * the ASLS register would trigger MemoryRegion setup to enable that.
1284 fw_cfg_add_file(fw_cfg_find(), "etc/igd-opregion",
1285 vdev
->igd_opregion
, info
->size
);
1287 trace_vfio_pci_igd_opregion_enabled(vdev
->vbasedev
.name
);
1289 pci_set_long(vdev
->pdev
.config
+ IGD_ASLS
, 0);
1290 pci_set_long(vdev
->pdev
.wmask
+ IGD_ASLS
, ~0);
1291 pci_set_long(vdev
->emulated_config_bits
+ IGD_ASLS
, ~0);
1297 * The rather short list of registers that we copy from the host devices.
1298 * The LPC/ISA bridge values are definitely needed to support the vBIOS, the
1299 * host bridge values may or may not be needed depending on the guest OS.
1300 * Since we're only munging revision and subsystem values on the host bridge,
1301 * we don't require our own device. The LPC/ISA bridge needs to be our very
1309 static const IGDHostInfo igd_host_bridge_infos
[] = {
1310 {PCI_REVISION_ID
, 2},
1311 {PCI_SUBSYSTEM_VENDOR_ID
, 2},
1312 {PCI_SUBSYSTEM_ID
, 2},
1315 static const IGDHostInfo igd_lpc_bridge_infos
[] = {
1318 {PCI_REVISION_ID
, 2},
1319 {PCI_SUBSYSTEM_VENDOR_ID
, 2},
1320 {PCI_SUBSYSTEM_ID
, 2},
1323 static int vfio_pci_igd_copy(VFIOPCIDevice
*vdev
, PCIDevice
*pdev
,
1324 struct vfio_region_info
*info
,
1325 const IGDHostInfo
*list
, int len
)
1329 for (i
= 0; i
< len
; i
++) {
1330 ret
= pread(vdev
->vbasedev
.fd
, pdev
->config
+ list
[i
].offset
,
1331 list
[i
].len
, info
->offset
+ list
[i
].offset
);
1332 if (ret
!= list
[i
].len
) {
1333 error_report("IGD copy failed: %m");
1342 * Stuff a few values into the host bridge.
1344 static int vfio_pci_igd_host_init(VFIOPCIDevice
*vdev
,
1345 struct vfio_region_info
*info
)
1348 PCIDevice
*host_bridge
;
1351 bus
= pci_device_root_bus(&vdev
->pdev
);
1352 host_bridge
= pci_find_device(bus
, 0, PCI_DEVFN(0, 0));
1355 error_report("Can't find host bridge");
1359 ret
= vfio_pci_igd_copy(vdev
, host_bridge
, info
, igd_host_bridge_infos
,
1360 ARRAY_SIZE(igd_host_bridge_infos
));
1362 trace_vfio_pci_igd_host_bridge_enabled(vdev
->vbasedev
.name
);
1369 * IGD LPC/ISA bridge support code. The vBIOS needs this, but we can't write
1370 * arbitrary values into just any bridge, so we must create our own. We try
1371 * to handle if the user has created it for us, which they might want to do
1372 * to enable multifunction so we don't occupy the whole PCI slot.
1374 static void vfio_pci_igd_lpc_bridge_realize(PCIDevice
*pdev
, Error
**errp
)
1376 if (pdev
->devfn
!= PCI_DEVFN(0x1f, 0)) {
1377 error_setg(errp
, "VFIO dummy ISA/LPC bridge must have address 1f.0");
1381 static void vfio_pci_igd_lpc_bridge_class_init(ObjectClass
*klass
, void *data
)
1383 DeviceClass
*dc
= DEVICE_CLASS(klass
);
1384 PCIDeviceClass
*k
= PCI_DEVICE_CLASS(klass
);
1386 set_bit(DEVICE_CATEGORY_BRIDGE
, dc
->categories
);
1387 dc
->desc
= "VFIO dummy ISA/LPC bridge for IGD assignment";
1388 dc
->hotpluggable
= false;
1389 k
->realize
= vfio_pci_igd_lpc_bridge_realize
;
1390 k
->class_id
= PCI_CLASS_BRIDGE_ISA
;
1393 static TypeInfo vfio_pci_igd_lpc_bridge_info
= {
1394 .name
= "vfio-pci-igd-lpc-bridge",
1395 .parent
= TYPE_PCI_DEVICE
,
1396 .class_init
= vfio_pci_igd_lpc_bridge_class_init
,
1397 .interfaces
= (InterfaceInfo
[]) {
1398 { INTERFACE_CONVENTIONAL_PCI_DEVICE
},
1403 static void vfio_pci_igd_register_types(void)
1405 type_register_static(&vfio_pci_igd_lpc_bridge_info
);
1408 type_init(vfio_pci_igd_register_types
)
1410 static int vfio_pci_igd_lpc_init(VFIOPCIDevice
*vdev
,
1411 struct vfio_region_info
*info
)
1413 PCIDevice
*lpc_bridge
;
1416 lpc_bridge
= pci_find_device(pci_device_root_bus(&vdev
->pdev
),
1417 0, PCI_DEVFN(0x1f, 0));
1419 lpc_bridge
= pci_create_simple(pci_device_root_bus(&vdev
->pdev
),
1420 PCI_DEVFN(0x1f, 0), "vfio-pci-igd-lpc-bridge");
1423 ret
= vfio_pci_igd_copy(vdev
, lpc_bridge
, info
, igd_lpc_bridge_infos
,
1424 ARRAY_SIZE(igd_lpc_bridge_infos
));
1426 trace_vfio_pci_igd_lpc_bridge_enabled(vdev
->vbasedev
.name
);
1433 * IGD Gen8 and newer support up to 8MB for the GTT and use a 64bit PTE
1434 * entry, older IGDs use 2MB and 32bit. Each PTE maps a 4k page. Therefore
1435 * we either have 2M/4k * 4 = 2k or 8M/4k * 8 = 16k as the maximum iobar index
1436 * for programming the GTT.
1438 * See linux:include/drm/i915_drm.h for shift and mask values.
1440 static int vfio_igd_gtt_max(VFIOPCIDevice
*vdev
)
1442 uint32_t gmch
= vfio_pci_read_config(&vdev
->pdev
, IGD_GMCH
, sizeof(gmch
));
1443 int ggms
, gen
= igd_gen(vdev
);
1445 gmch
= vfio_pci_read_config(&vdev
->pdev
, IGD_GMCH
, sizeof(gmch
));
1446 ggms
= (gmch
>> (gen
< 8 ? 8 : 6)) & 0x3;
1453 return (ggms
/ (4 * KiB
)) * (gen
< 8 ? 4 : 8);
1457 * The IGD ROM will make use of stolen memory (GGMS) for support of VESA modes.
1458 * Somehow the host stolen memory range is used for this, but how the ROM gets
1459 * it is a mystery, perhaps it's hardcoded into the ROM. Thankfully though, it
1460 * reprograms the GTT through the IOBAR where we can trap it and transpose the
1461 * programming to the VM allocated buffer. That buffer gets reserved by the VM
1462 * firmware via the fw_cfg entry added below. Here we're just monitoring the
1463 * IOBAR address and data registers to detect a write sequence targeting the
1464 * GTTADR. This code is developed by observed behavior and doesn't have a
1465 * direct spec reference, unfortunately.
1467 static uint64_t vfio_igd_quirk_data_read(void *opaque
,
1468 hwaddr addr
, unsigned size
)
1470 VFIOIGDQuirk
*igd
= opaque
;
1471 VFIOPCIDevice
*vdev
= igd
->vdev
;
1475 return vfio_region_read(&vdev
->bars
[4].region
, addr
+ 4, size
);
1478 static void vfio_igd_quirk_data_write(void *opaque
, hwaddr addr
,
1479 uint64_t data
, unsigned size
)
1481 VFIOIGDQuirk
*igd
= opaque
;
1482 VFIOPCIDevice
*vdev
= igd
->vdev
;
1483 uint64_t val
= data
;
1484 int gen
= igd_gen(vdev
);
1487 * Programming the GGMS starts at index 0x1 and uses every 4th index (ie.
1488 * 0x1, 0x5, 0x9, 0xd,...). For pre-Gen8 each 4-byte write is a whole PTE
1489 * entry, with 0th bit enable set. For Gen8 and up, PTEs are 64bit, so
1490 * entries 0x5 & 0xd are the high dword, in our case zero. Each PTE points
1491 * to a 4k page, which we translate to a page from the VM allocated region,
1492 * pointed to by the BDSM register. If this is not set, we fail.
1494 * We trap writes to the full configured GTT size, but we typically only
1495 * see the vBIOS writing up to (nearly) the 1MB barrier. In fact it often
1496 * seems to miss the last entry for an even 1MB GTT. Doing a gratuitous
1497 * write of that last entry does work, but is hopefully unnecessary since
1498 * we clear the previous GTT on initialization.
1500 if ((igd
->index
% 4 == 1) && igd
->index
< vfio_igd_gtt_max(vdev
)) {
1501 if (gen
< 8 || (igd
->index
% 8 == 1)) {
1504 base
= pci_get_long(vdev
->pdev
.config
+ IGD_BDSM
);
1506 hw_error("vfio-igd: Guest attempted to program IGD GTT before "
1507 "BIOS reserved stolen memory. Unsupported BIOS?");
1510 val
= data
- igd
->bdsm
+ base
;
1512 val
= 0; /* upper 32bits of pte, we only enable below 4G PTEs */
1515 trace_vfio_pci_igd_bar4_write(vdev
->vbasedev
.name
,
1516 igd
->index
, data
, val
);
1519 vfio_region_write(&vdev
->bars
[4].region
, addr
+ 4, val
, size
);
1524 static const MemoryRegionOps vfio_igd_data_quirk
= {
1525 .read
= vfio_igd_quirk_data_read
,
1526 .write
= vfio_igd_quirk_data_write
,
1527 .endianness
= DEVICE_LITTLE_ENDIAN
,
1530 static uint64_t vfio_igd_quirk_index_read(void *opaque
,
1531 hwaddr addr
, unsigned size
)
1533 VFIOIGDQuirk
*igd
= opaque
;
1534 VFIOPCIDevice
*vdev
= igd
->vdev
;
1538 return vfio_region_read(&vdev
->bars
[4].region
, addr
, size
);
1541 static void vfio_igd_quirk_index_write(void *opaque
, hwaddr addr
,
1542 uint64_t data
, unsigned size
)
1544 VFIOIGDQuirk
*igd
= opaque
;
1545 VFIOPCIDevice
*vdev
= igd
->vdev
;
1549 vfio_region_write(&vdev
->bars
[4].region
, addr
, data
, size
);
1552 static const MemoryRegionOps vfio_igd_index_quirk
= {
1553 .read
= vfio_igd_quirk_index_read
,
1554 .write
= vfio_igd_quirk_index_write
,
1555 .endianness
= DEVICE_LITTLE_ENDIAN
,
1558 static void vfio_probe_igd_bar4_quirk(VFIOPCIDevice
*vdev
, int nr
)
1560 struct vfio_region_info
*rom
= NULL
, *opregion
= NULL
,
1561 *host
= NULL
, *lpc
= NULL
;
1564 PCIDevice
*lpc_bridge
;
1565 int i
, ret
, ggms_mb
, gms_mb
= 0, gen
;
1566 uint64_t *bdsm_size
;
1568 uint16_t cmd_orig
, cmd
;
1572 * This must be an Intel VGA device at address 00:02.0 for us to even
1573 * consider enabling legacy mode. The vBIOS has dependencies on the
1576 if (!vfio_pci_is(vdev
, PCI_VENDOR_ID_INTEL
, PCI_ANY_ID
) ||
1577 !vfio_is_vga(vdev
) || nr
!= 4 ||
1578 &vdev
->pdev
!= pci_find_device(pci_device_root_bus(&vdev
->pdev
),
1579 0, PCI_DEVFN(0x2, 0))) {
1584 * We need to create an LPC/ISA bridge at PCI bus address 00:1f.0 that we
1585 * can stuff host values into, so if there's already one there and it's not
1586 * one we can hack on, legacy mode is no-go. Sorry Q35.
1588 lpc_bridge
= pci_find_device(pci_device_root_bus(&vdev
->pdev
),
1589 0, PCI_DEVFN(0x1f, 0));
1590 if (lpc_bridge
&& !object_dynamic_cast(OBJECT(lpc_bridge
),
1591 "vfio-pci-igd-lpc-bridge")) {
1592 error_report("IGD device %s cannot support legacy mode due to existing "
1593 "devices at address 1f.0", vdev
->vbasedev
.name
);
1598 * IGD is not a standard, they like to change their specs often. We
1599 * only attempt to support back to SandBridge and we hope that newer
1600 * devices maintain compatibility with generation 8.
1602 gen
= igd_gen(vdev
);
1603 if (gen
!= 6 && gen
!= 8) {
1604 error_report("IGD device %s is unsupported in legacy mode, "
1605 "try SandyBridge or newer", vdev
->vbasedev
.name
);
1610 * Most of what we're doing here is to enable the ROM to run, so if
1611 * there's no ROM, there's no point in setting up this quirk.
1612 * NB. We only seem to get BIOS ROMs, so a UEFI VM would need CSM support.
1614 ret
= vfio_get_region_info(&vdev
->vbasedev
,
1615 VFIO_PCI_ROM_REGION_INDEX
, &rom
);
1616 if ((ret
|| !rom
->size
) && !vdev
->pdev
.romfile
) {
1617 error_report("IGD device %s has no ROM, legacy mode disabled",
1618 vdev
->vbasedev
.name
);
1623 * Ignore the hotplug corner case, mark the ROM failed, we can't
1624 * create the devices we need for legacy mode in the hotplug scenario.
1626 if (vdev
->pdev
.qdev
.hotplugged
) {
1627 error_report("IGD device %s hotplugged, ROM disabled, "
1628 "legacy mode disabled", vdev
->vbasedev
.name
);
1629 vdev
->rom_read_failed
= true;
1634 * Check whether we have all the vfio device specific regions to
1635 * support legacy mode (added in Linux v4.6). If not, bail.
1637 ret
= vfio_get_dev_region_info(&vdev
->vbasedev
,
1638 VFIO_REGION_TYPE_PCI_VENDOR_TYPE
| PCI_VENDOR_ID_INTEL
,
1639 VFIO_REGION_SUBTYPE_INTEL_IGD_OPREGION
, &opregion
);
1641 error_report("IGD device %s does not support OpRegion access,"
1642 "legacy mode disabled", vdev
->vbasedev
.name
);
1646 ret
= vfio_get_dev_region_info(&vdev
->vbasedev
,
1647 VFIO_REGION_TYPE_PCI_VENDOR_TYPE
| PCI_VENDOR_ID_INTEL
,
1648 VFIO_REGION_SUBTYPE_INTEL_IGD_HOST_CFG
, &host
);
1650 error_report("IGD device %s does not support host bridge access,"
1651 "legacy mode disabled", vdev
->vbasedev
.name
);
1655 ret
= vfio_get_dev_region_info(&vdev
->vbasedev
,
1656 VFIO_REGION_TYPE_PCI_VENDOR_TYPE
| PCI_VENDOR_ID_INTEL
,
1657 VFIO_REGION_SUBTYPE_INTEL_IGD_LPC_CFG
, &lpc
);
1659 error_report("IGD device %s does not support LPC bridge access,"
1660 "legacy mode disabled", vdev
->vbasedev
.name
);
1664 gmch
= vfio_pci_read_config(&vdev
->pdev
, IGD_GMCH
, 4);
1667 * If IGD VGA Disable is clear (expected) and VGA is not already enabled,
1668 * try to enable it. Probably shouldn't be using legacy mode without VGA,
1669 * but also no point in us enabling VGA if disabled in hardware.
1671 if (!(gmch
& 0x2) && !vdev
->vga
&& vfio_populate_vga(vdev
, &err
)) {
1672 error_reportf_err(err
, VFIO_MSG_PREFIX
, vdev
->vbasedev
.name
);
1673 error_report("IGD device %s failed to enable VGA access, "
1674 "legacy mode disabled", vdev
->vbasedev
.name
);
1678 /* Create our LPC/ISA bridge */
1679 ret
= vfio_pci_igd_lpc_init(vdev
, lpc
);
1681 error_report("IGD device %s failed to create LPC bridge, "
1682 "legacy mode disabled", vdev
->vbasedev
.name
);
1686 /* Stuff some host values into the VM PCI host bridge */
1687 ret
= vfio_pci_igd_host_init(vdev
, host
);
1689 error_report("IGD device %s failed to modify host bridge, "
1690 "legacy mode disabled", vdev
->vbasedev
.name
);
1694 /* Setup OpRegion access */
1695 ret
= vfio_pci_igd_opregion_init(vdev
, opregion
, &err
);
1697 error_append_hint(&err
, "IGD legacy mode disabled\n");
1698 error_reportf_err(err
, VFIO_MSG_PREFIX
, vdev
->vbasedev
.name
);
1702 /* Setup our quirk to munge GTT addresses to the VM allocated buffer */
1703 quirk
= vfio_quirk_alloc(2);
1704 igd
= quirk
->data
= g_malloc0(sizeof(*igd
));
1707 igd
->bdsm
= vfio_pci_read_config(&vdev
->pdev
, IGD_BDSM
, 4);
1708 igd
->bdsm
&= ~((1 * MiB
) - 1); /* 1MB aligned */
1710 memory_region_init_io(&quirk
->mem
[0], OBJECT(vdev
), &vfio_igd_index_quirk
,
1711 igd
, "vfio-igd-index-quirk", 4);
1712 memory_region_add_subregion_overlap(vdev
->bars
[nr
].region
.mem
,
1713 0, &quirk
->mem
[0], 1);
1715 memory_region_init_io(&quirk
->mem
[1], OBJECT(vdev
), &vfio_igd_data_quirk
,
1716 igd
, "vfio-igd-data-quirk", 4);
1717 memory_region_add_subregion_overlap(vdev
->bars
[nr
].region
.mem
,
1718 4, &quirk
->mem
[1], 1);
1720 QLIST_INSERT_HEAD(&vdev
->bars
[nr
].quirks
, quirk
, next
);
1722 /* Determine the size of stolen memory needed for GTT */
1723 ggms_mb
= (gmch
>> (gen
< 8 ? 8 : 6)) & 0x3;
1725 ggms_mb
= 1 << ggms_mb
;
1729 * Assume we have no GMS memory, but allow it to be overrided by device
1730 * option (experimental). The spec doesn't actually allow zero GMS when
1731 * when IVD (IGD VGA Disable) is clear, but the claim is that it's unused,
1732 * so let's not waste VM memory for it.
1734 gmch
&= ~((gen
< 8 ? 0x1f : 0xff) << (gen
< 8 ? 3 : 8));
1736 if (vdev
->igd_gms
) {
1737 if (vdev
->igd_gms
<= 0x10) {
1738 gms_mb
= vdev
->igd_gms
* 32;
1739 gmch
|= vdev
->igd_gms
<< (gen
< 8 ? 3 : 8);
1741 error_report("Unsupported IGD GMS value 0x%x", vdev
->igd_gms
);
1747 * Request reserved memory for stolen memory via fw_cfg. VM firmware
1748 * must allocate a 1MB aligned reserved memory region below 4GB with
1749 * the requested size (in bytes) for use by the Intel PCI class VGA
1750 * device at VM address 00:02.0. The base address of this reserved
1751 * memory region must be written to the device BDSM regsiter at PCI
1752 * config offset 0x5C.
1754 bdsm_size
= g_malloc(sizeof(*bdsm_size
));
1755 *bdsm_size
= cpu_to_le64((ggms_mb
+ gms_mb
) * MiB
);
1756 fw_cfg_add_file(fw_cfg_find(), "etc/igd-bdsm-size",
1757 bdsm_size
, sizeof(*bdsm_size
));
1759 /* GMCH is read-only, emulated */
1760 pci_set_long(vdev
->pdev
.config
+ IGD_GMCH
, gmch
);
1761 pci_set_long(vdev
->pdev
.wmask
+ IGD_GMCH
, 0);
1762 pci_set_long(vdev
->emulated_config_bits
+ IGD_GMCH
, ~0);
1764 /* BDSM is read-write, emulated. The BIOS needs to be able to write it */
1765 pci_set_long(vdev
->pdev
.config
+ IGD_BDSM
, 0);
1766 pci_set_long(vdev
->pdev
.wmask
+ IGD_BDSM
, ~0);
1767 pci_set_long(vdev
->emulated_config_bits
+ IGD_BDSM
, ~0);
1770 * This IOBAR gives us access to GTTADR, which allows us to write to
1771 * the GTT itself. So let's go ahead and write zero to all the GTT
1772 * entries to avoid spurious DMA faults. Be sure I/O access is enabled
1773 * before talking to the device.
1775 if (pread(vdev
->vbasedev
.fd
, &cmd_orig
, sizeof(cmd_orig
),
1776 vdev
->config_offset
+ PCI_COMMAND
) != sizeof(cmd_orig
)) {
1777 error_report("IGD device %s - failed to read PCI command register",
1778 vdev
->vbasedev
.name
);
1781 cmd
= cmd_orig
| PCI_COMMAND_IO
;
1783 if (pwrite(vdev
->vbasedev
.fd
, &cmd
, sizeof(cmd
),
1784 vdev
->config_offset
+ PCI_COMMAND
) != sizeof(cmd
)) {
1785 error_report("IGD device %s - failed to write PCI command register",
1786 vdev
->vbasedev
.name
);
1789 for (i
= 1; i
< vfio_igd_gtt_max(vdev
); i
+= 4) {
1790 vfio_region_write(&vdev
->bars
[4].region
, 0, i
, 4);
1791 vfio_region_write(&vdev
->bars
[4].region
, 4, 0, 4);
1794 if (pwrite(vdev
->vbasedev
.fd
, &cmd_orig
, sizeof(cmd_orig
),
1795 vdev
->config_offset
+ PCI_COMMAND
) != sizeof(cmd_orig
)) {
1796 error_report("IGD device %s - failed to restore PCI command register",
1797 vdev
->vbasedev
.name
);
1800 trace_vfio_pci_igd_bdsm_enabled(vdev
->vbasedev
.name
, ggms_mb
+ gms_mb
);
1810 * Common quirk probe entry points.
1812 void vfio_vga_quirk_setup(VFIOPCIDevice
*vdev
)
1814 vfio_vga_probe_ati_3c3_quirk(vdev
);
1815 vfio_vga_probe_nvidia_3d0_quirk(vdev
);
1818 void vfio_vga_quirk_exit(VFIOPCIDevice
*vdev
)
1823 for (i
= 0; i
< ARRAY_SIZE(vdev
->vga
->region
); i
++) {
1824 QLIST_FOREACH(quirk
, &vdev
->vga
->region
[i
].quirks
, next
) {
1825 for (j
= 0; j
< quirk
->nr_mem
; j
++) {
1826 memory_region_del_subregion(&vdev
->vga
->region
[i
].mem
,
1833 void vfio_vga_quirk_finalize(VFIOPCIDevice
*vdev
)
1837 for (i
= 0; i
< ARRAY_SIZE(vdev
->vga
->region
); i
++) {
1838 while (!QLIST_EMPTY(&vdev
->vga
->region
[i
].quirks
)) {
1839 VFIOQuirk
*quirk
= QLIST_FIRST(&vdev
->vga
->region
[i
].quirks
);
1840 QLIST_REMOVE(quirk
, next
);
1841 for (j
= 0; j
< quirk
->nr_mem
; j
++) {
1842 object_unparent(OBJECT(&quirk
->mem
[j
]));
1845 g_free(quirk
->data
);
1851 void vfio_bar_quirk_setup(VFIOPCIDevice
*vdev
, int nr
)
1853 vfio_probe_ati_bar4_quirk(vdev
, nr
);
1854 vfio_probe_ati_bar2_quirk(vdev
, nr
);
1855 vfio_probe_nvidia_bar5_quirk(vdev
, nr
);
1856 vfio_probe_nvidia_bar0_quirk(vdev
, nr
);
1857 vfio_probe_rtl8168_bar2_quirk(vdev
, nr
);
1858 vfio_probe_igd_bar4_quirk(vdev
, nr
);
1861 void vfio_bar_quirk_exit(VFIOPCIDevice
*vdev
, int nr
)
1863 VFIOBAR
*bar
= &vdev
->bars
[nr
];
1867 QLIST_FOREACH(quirk
, &bar
->quirks
, next
) {
1868 while (!QLIST_EMPTY(&quirk
->ioeventfds
)) {
1869 vfio_ioeventfd_exit(vdev
, QLIST_FIRST(&quirk
->ioeventfds
));
1872 for (i
= 0; i
< quirk
->nr_mem
; i
++) {
1873 memory_region_del_subregion(bar
->region
.mem
, &quirk
->mem
[i
]);
1878 void vfio_bar_quirk_finalize(VFIOPCIDevice
*vdev
, int nr
)
1880 VFIOBAR
*bar
= &vdev
->bars
[nr
];
1883 while (!QLIST_EMPTY(&bar
->quirks
)) {
1884 VFIOQuirk
*quirk
= QLIST_FIRST(&bar
->quirks
);
1885 QLIST_REMOVE(quirk
, next
);
1886 for (i
= 0; i
< quirk
->nr_mem
; i
++) {
1887 object_unparent(OBJECT(&quirk
->mem
[i
]));
1890 g_free(quirk
->data
);
1898 void vfio_quirk_reset(VFIOPCIDevice
*vdev
)
1902 for (i
= 0; i
< PCI_ROM_SLOT
; i
++) {
1904 VFIOBAR
*bar
= &vdev
->bars
[i
];
1906 QLIST_FOREACH(quirk
, &bar
->quirks
, next
) {
1908 quirk
->reset(vdev
, quirk
);
1915 * AMD Radeon PCI config reset, based on Linux:
1916 * drivers/gpu/drm/radeon/ci_smc.c:ci_is_smc_running()
1917 * drivers/gpu/drm/radeon/radeon_device.c:radeon_pci_config_reset
1918 * drivers/gpu/drm/radeon/ci_smc.c:ci_reset_smc()
1919 * drivers/gpu/drm/radeon/ci_smc.c:ci_stop_smc_clock()
1920 * IDs: include/drm/drm_pciids.h
1921 * Registers: http://cgit.freedesktop.org/~agd5f/linux/commit/?id=4e2aa447f6f0
1923 * Bonaire and Hawaii GPUs do not respond to a bus reset. This is a bug in the
1924 * hardware that should be fixed on future ASICs. The symptom of this is that
1925 * once the accerlated driver loads, Windows guests will bsod on subsequent
1926 * attmpts to load the driver, such as after VM reset or shutdown/restart. To
1927 * work around this, we do an AMD specific PCI config reset, followed by an SMC
1928 * reset. The PCI config reset only works if SMC firmware is running, so we
1929 * have a dependency on the state of the device as to whether this reset will
1930 * be effective. There are still cases where we won't be able to kick the
1931 * device into working, but this greatly improves the usability overall. The
1932 * config reset magic is relatively common on AMD GPUs, but the setup and SMC
1933 * poking is largely ASIC specific.
1935 static bool vfio_radeon_smc_is_running(VFIOPCIDevice
*vdev
)
1940 * Registers 200h and 204h are index and data registers for accessing
1941 * indirect configuration registers within the device.
1943 vfio_region_write(&vdev
->bars
[5].region
, 0x200, 0x80000004, 4);
1944 clk
= vfio_region_read(&vdev
->bars
[5].region
, 0x204, 4);
1945 vfio_region_write(&vdev
->bars
[5].region
, 0x200, 0x80000370, 4);
1946 pc_c
= vfio_region_read(&vdev
->bars
[5].region
, 0x204, 4);
1948 return (!(clk
& 1) && (0x20100 <= pc_c
));
1952 * The scope of a config reset is controlled by a mode bit in the misc register
1953 * and a fuse, exposed as a bit in another register. The fuse is the default
1954 * (0 = GFX, 1 = whole GPU), the misc bit is a toggle, with the forumula
1955 * scope = !(misc ^ fuse), where the resulting scope is defined the same as
1956 * the fuse. A truth table therefore tells us that if misc == fuse, we need
1957 * to flip the value of the bit in the misc register.
1959 static void vfio_radeon_set_gfx_only_reset(VFIOPCIDevice
*vdev
)
1961 uint32_t misc
, fuse
;
1964 vfio_region_write(&vdev
->bars
[5].region
, 0x200, 0xc00c0000, 4);
1965 fuse
= vfio_region_read(&vdev
->bars
[5].region
, 0x204, 4);
1968 vfio_region_write(&vdev
->bars
[5].region
, 0x200, 0xc0000010, 4);
1969 misc
= vfio_region_read(&vdev
->bars
[5].region
, 0x204, 4);
1973 vfio_region_write(&vdev
->bars
[5].region
, 0x204, misc
^ 2, 4);
1974 vfio_region_read(&vdev
->bars
[5].region
, 0x204, 4); /* flush */
1978 static int vfio_radeon_reset(VFIOPCIDevice
*vdev
)
1980 PCIDevice
*pdev
= &vdev
->pdev
;
1984 /* Defer to a kernel implemented reset */
1985 if (vdev
->vbasedev
.reset_works
) {
1986 trace_vfio_quirk_ati_bonaire_reset_skipped(vdev
->vbasedev
.name
);
1990 /* Enable only memory BAR access */
1991 vfio_pci_write_config(pdev
, PCI_COMMAND
, PCI_COMMAND_MEMORY
, 2);
1993 /* Reset only works if SMC firmware is loaded and running */
1994 if (!vfio_radeon_smc_is_running(vdev
)) {
1996 trace_vfio_quirk_ati_bonaire_reset_no_smc(vdev
->vbasedev
.name
);
2000 /* Make sure only the GFX function is reset */
2001 vfio_radeon_set_gfx_only_reset(vdev
);
2003 /* AMD PCI config reset */
2004 vfio_pci_write_config(pdev
, 0x7c, 0x39d5e86b, 4);
2007 /* Read back the memory size to make sure we're out of reset */
2008 for (i
= 0; i
< 100000; i
++) {
2009 if (vfio_region_read(&vdev
->bars
[5].region
, 0x5428, 4) != 0xffffffff) {
2015 trace_vfio_quirk_ati_bonaire_reset_timeout(vdev
->vbasedev
.name
);
2019 vfio_region_write(&vdev
->bars
[5].region
, 0x200, 0x80000000, 4);
2020 data
= vfio_region_read(&vdev
->bars
[5].region
, 0x204, 4);
2022 vfio_region_write(&vdev
->bars
[5].region
, 0x204, data
, 4);
2024 /* Disable SMC clock */
2025 vfio_region_write(&vdev
->bars
[5].region
, 0x200, 0x80000004, 4);
2026 data
= vfio_region_read(&vdev
->bars
[5].region
, 0x204, 4);
2028 vfio_region_write(&vdev
->bars
[5].region
, 0x204, data
, 4);
2030 trace_vfio_quirk_ati_bonaire_reset_done(vdev
->vbasedev
.name
);
2033 /* Restore PCI command register */
2034 vfio_pci_write_config(pdev
, PCI_COMMAND
, 0, 2);
2039 void vfio_setup_resetfn_quirk(VFIOPCIDevice
*vdev
)
2041 switch (vdev
->vendor_id
) {
2043 switch (vdev
->device_id
) {
2045 case 0x6649: /* Bonaire [FirePro W5100] */
2048 case 0x6658: /* Bonaire XTX [Radeon R7 260X] */
2049 case 0x665c: /* Bonaire XT [Radeon HD 7790/8770 / R9 260 OEM] */
2050 case 0x665d: /* Bonaire [Radeon R7 200 Series] */
2052 case 0x67A0: /* Hawaii XT GL [FirePro W9100] */
2053 case 0x67A1: /* Hawaii PRO GL [FirePro W8100] */
2058 case 0x67B0: /* Hawaii XT [Radeon R9 290X] */
2059 case 0x67B1: /* Hawaii PRO [Radeon R9 290] */
2064 vdev
->resetfn
= vfio_radeon_reset
;
2065 trace_vfio_quirk_ati_bonaire_reset(vdev
->vbasedev
.name
);
2073 * The NVIDIA GPUDirect P2P Vendor capability allows the user to specify
2074 * devices as a member of a clique. Devices within the same clique ID
2075 * are capable of direct P2P. It's the user's responsibility that this
2076 * is correct. The spec says that this may reside at any unused config
2077 * offset, but reserves and recommends hypervisors place this at C8h.
2078 * The spec also states that the hypervisor should place this capability
2079 * at the end of the capability list, thus next is defined as 0h.
2081 * +----------------+----------------+----------------+----------------+
2082 * | sig 7:0 ('P') | vndr len (8h) | next (0h) | cap id (9h) |
2083 * +----------------+----------------+----------------+----------------+
2084 * | rsvd 15:7(0h),id 6:3,ver 2:0(0h)| sig 23:8 ('P2') |
2085 * +---------------------------------+---------------------------------+
2087 * https://lists.gnu.org/archive/html/qemu-devel/2017-08/pdfUda5iEpgOS.pdf
2089 static void get_nv_gpudirect_clique_id(Object
*obj
, Visitor
*v
,
2090 const char *name
, void *opaque
,
2093 DeviceState
*dev
= DEVICE(obj
);
2094 Property
*prop
= opaque
;
2095 uint8_t *ptr
= qdev_get_prop_ptr(dev
, prop
);
2097 visit_type_uint8(v
, name
, ptr
, errp
);
2100 static void set_nv_gpudirect_clique_id(Object
*obj
, Visitor
*v
,
2101 const char *name
, void *opaque
,
2104 DeviceState
*dev
= DEVICE(obj
);
2105 Property
*prop
= opaque
;
2106 uint8_t value
, *ptr
= qdev_get_prop_ptr(dev
, prop
);
2107 Error
*local_err
= NULL
;
2109 if (dev
->realized
) {
2110 qdev_prop_set_after_realize(dev
, name
, errp
);
2114 visit_type_uint8(v
, name
, &value
, &local_err
);
2116 error_propagate(errp
, local_err
);
2121 error_setg(errp
, "Property %s: valid range 0-15", name
);
2128 const PropertyInfo qdev_prop_nv_gpudirect_clique
= {
2130 .description
= "NVIDIA GPUDirect Clique ID (0 - 15)",
2131 .get
= get_nv_gpudirect_clique_id
,
2132 .set
= set_nv_gpudirect_clique_id
,
2135 static int vfio_add_nv_gpudirect_cap(VFIOPCIDevice
*vdev
, Error
**errp
)
2137 PCIDevice
*pdev
= &vdev
->pdev
;
2138 int ret
, pos
= 0xC8;
2140 if (vdev
->nv_gpudirect_clique
== 0xFF) {
2144 if (!vfio_pci_is(vdev
, PCI_VENDOR_ID_NVIDIA
, PCI_ANY_ID
)) {
2145 error_setg(errp
, "NVIDIA GPUDirect Clique ID: invalid device vendor");
2149 if (pci_get_byte(pdev
->config
+ PCI_CLASS_DEVICE
+ 1) !=
2150 PCI_BASE_CLASS_DISPLAY
) {
2151 error_setg(errp
, "NVIDIA GPUDirect Clique ID: unsupported PCI class");
2155 ret
= pci_add_capability(pdev
, PCI_CAP_ID_VNDR
, pos
, 8, errp
);
2157 error_prepend(errp
, "Failed to add NVIDIA GPUDirect cap: ");
2161 memset(vdev
->emulated_config_bits
+ pos
, 0xFF, 8);
2162 pos
+= PCI_CAP_FLAGS
;
2163 pci_set_byte(pdev
->config
+ pos
++, 8);
2164 pci_set_byte(pdev
->config
+ pos
++, 'P');
2165 pci_set_byte(pdev
->config
+ pos
++, '2');
2166 pci_set_byte(pdev
->config
+ pos
++, 'P');
2167 pci_set_byte(pdev
->config
+ pos
++, vdev
->nv_gpudirect_clique
<< 3);
2168 pci_set_byte(pdev
->config
+ pos
, 0);
2173 int vfio_add_virt_caps(VFIOPCIDevice
*vdev
, Error
**errp
)
2177 ret
= vfio_add_nv_gpudirect_cap(vdev
, errp
);
2185 static void vfio_pci_nvlink2_get_tgt(Object
*obj
, Visitor
*v
,
2187 void *opaque
, Error
**errp
)
2189 uint64_t tgt
= (uintptr_t) opaque
;
2190 visit_type_uint64(v
, name
, &tgt
, errp
);
2193 static void vfio_pci_nvlink2_get_link_speed(Object
*obj
, Visitor
*v
,
2195 void *opaque
, Error
**errp
)
2197 uint32_t link_speed
= (uint32_t)(uintptr_t) opaque
;
2198 visit_type_uint32(v
, name
, &link_speed
, errp
);
2201 int vfio_pci_nvidia_v100_ram_init(VFIOPCIDevice
*vdev
, Error
**errp
)
2205 struct vfio_region_info
*nv2reg
= NULL
;
2206 struct vfio_info_cap_header
*hdr
;
2207 struct vfio_region_info_cap_nvlink2_ssatgt
*cap
;
2210 ret
= vfio_get_dev_region_info(&vdev
->vbasedev
,
2211 VFIO_REGION_TYPE_PCI_VENDOR_TYPE
|
2212 PCI_VENDOR_ID_NVIDIA
,
2213 VFIO_REGION_SUBTYPE_NVIDIA_NVLINK2_RAM
,
2219 hdr
= vfio_get_region_info_cap(nv2reg
, VFIO_REGION_INFO_CAP_NVLINK2_SSATGT
);
2226 p
= mmap(NULL
, nv2reg
->size
, PROT_READ
| PROT_WRITE
| PROT_EXEC
,
2227 MAP_SHARED
, vdev
->vbasedev
.fd
, nv2reg
->offset
);
2228 if (p
== MAP_FAILED
) {
2233 quirk
= vfio_quirk_alloc(1);
2234 memory_region_init_ram_ptr(&quirk
->mem
[0], OBJECT(vdev
), "nvlink2-mr",
2236 QLIST_INSERT_HEAD(&vdev
->bars
[0].quirks
, quirk
, next
);
2238 object_property_add(OBJECT(vdev
), "nvlink2-tgt", "uint64",
2239 vfio_pci_nvlink2_get_tgt
, NULL
, NULL
,
2240 (void *) (uintptr_t) cap
->tgt
, NULL
);
2241 trace_vfio_pci_nvidia_gpu_setup_quirk(vdev
->vbasedev
.name
, cap
->tgt
,
2249 int vfio_pci_nvlink2_init(VFIOPCIDevice
*vdev
, Error
**errp
)
2253 struct vfio_region_info
*atsdreg
= NULL
;
2254 struct vfio_info_cap_header
*hdr
;
2255 struct vfio_region_info_cap_nvlink2_ssatgt
*captgt
;
2256 struct vfio_region_info_cap_nvlink2_lnkspd
*capspeed
;
2259 ret
= vfio_get_dev_region_info(&vdev
->vbasedev
,
2260 VFIO_REGION_TYPE_PCI_VENDOR_TYPE
|
2262 VFIO_REGION_SUBTYPE_IBM_NVLINK2_ATSD
,
2268 hdr
= vfio_get_region_info_cap(atsdreg
,
2269 VFIO_REGION_INFO_CAP_NVLINK2_SSATGT
);
2274 captgt
= (void *) hdr
;
2276 hdr
= vfio_get_region_info_cap(atsdreg
,
2277 VFIO_REGION_INFO_CAP_NVLINK2_LNKSPD
);
2282 capspeed
= (void *) hdr
;
2284 /* Some NVLink bridges may not have assigned ATSD */
2285 if (atsdreg
->size
) {
2286 p
= mmap(NULL
, atsdreg
->size
, PROT_READ
| PROT_WRITE
| PROT_EXEC
,
2287 MAP_SHARED
, vdev
->vbasedev
.fd
, atsdreg
->offset
);
2288 if (p
== MAP_FAILED
) {
2293 quirk
= vfio_quirk_alloc(1);
2294 memory_region_init_ram_device_ptr(&quirk
->mem
[0], OBJECT(vdev
),
2295 "nvlink2-atsd-mr", atsdreg
->size
, p
);
2296 QLIST_INSERT_HEAD(&vdev
->bars
[0].quirks
, quirk
, next
);
2299 object_property_add(OBJECT(vdev
), "nvlink2-tgt", "uint64",
2300 vfio_pci_nvlink2_get_tgt
, NULL
, NULL
,
2301 (void *) (uintptr_t) captgt
->tgt
, NULL
);
2302 trace_vfio_pci_nvlink2_setup_quirk_ssatgt(vdev
->vbasedev
.name
, captgt
->tgt
,
2305 object_property_add(OBJECT(vdev
), "nvlink2-link-speed", "uint32",
2306 vfio_pci_nvlink2_get_link_speed
, NULL
, NULL
,
2307 (void *) (uintptr_t) capspeed
->link_speed
, NULL
);
2308 trace_vfio_pci_nvlink2_setup_quirk_lnkspd(vdev
->vbasedev
.name
,
2309 capspeed
->link_speed
);