meson: convert qapi-specific to meson
[qemu.git] / hw / vfio / pci-quirks.c
1 /*
2 * device quirks for PCI devices
3 *
4 * Copyright Red Hat, Inc. 2012-2015
5 *
6 * Authors:
7 * Alex Williamson <alex.williamson@redhat.com>
8 *
9 * This work is licensed under the terms of the GNU GPL, version 2. See
10 * the COPYING file in the top-level directory.
11 */
12
13 #include "qemu/osdep.h"
14 #include CONFIG_DEVICES
15 #include "exec/memop.h"
16 #include "qemu/units.h"
17 #include "qemu/error-report.h"
18 #include "qemu/main-loop.h"
19 #include "qemu/module.h"
20 #include "qemu/range.h"
21 #include "qapi/error.h"
22 #include "qapi/visitor.h"
23 #include <sys/ioctl.h>
24 #include "hw/hw.h"
25 #include "hw/nvram/fw_cfg.h"
26 #include "hw/qdev-properties.h"
27 #include "pci.h"
28 #include "trace.h"
29
30 /*
31 * List of device ids/vendor ids for which to disable
32 * option rom loading. This avoids the guest hangs during rom
33 * execution as noticed with the BCM 57810 card for lack of a
34 * more better way to handle such issues.
35 * The user can still override by specifying a romfile or
36 * rombar=1.
37 * Please see https://bugs.launchpad.net/qemu/+bug/1284874
38 * for an analysis of the 57810 card hang. When adding
39 * a new vendor id/device id combination below, please also add
40 * your card/environment details and information that could
41 * help in debugging to the bug tracking this issue
42 */
43 static const struct {
44 uint32_t vendor;
45 uint32_t device;
46 } romblacklist[] = {
47 { 0x14e4, 0x168e }, /* Broadcom BCM 57810 */
48 };
49
50 bool vfio_blacklist_opt_rom(VFIOPCIDevice *vdev)
51 {
52 int i;
53
54 for (i = 0 ; i < ARRAY_SIZE(romblacklist); i++) {
55 if (vfio_pci_is(vdev, romblacklist[i].vendor, romblacklist[i].device)) {
56 trace_vfio_quirk_rom_blacklisted(vdev->vbasedev.name,
57 romblacklist[i].vendor,
58 romblacklist[i].device);
59 return true;
60 }
61 }
62 return false;
63 }
64
65 /*
66 * Device specific region quirks (mostly backdoors to PCI config space)
67 */
68
69 /*
70 * The generic window quirks operate on an address and data register,
71 * vfio_generic_window_address_quirk handles the address register and
72 * vfio_generic_window_data_quirk handles the data register. These ops
73 * pass reads and writes through to hardware until a value matching the
74 * stored address match/mask is written. When this occurs, the data
75 * register access emulated PCI config space for the device rather than
76 * passing through accesses. This enables devices where PCI config space
77 * is accessible behind a window register to maintain the virtualization
78 * provided through vfio.
79 */
80 typedef struct VFIOConfigWindowMatch {
81 uint32_t match;
82 uint32_t mask;
83 } VFIOConfigWindowMatch;
84
85 typedef struct VFIOConfigWindowQuirk {
86 struct VFIOPCIDevice *vdev;
87
88 uint32_t address_val;
89
90 uint32_t address_offset;
91 uint32_t data_offset;
92
93 bool window_enabled;
94 uint8_t bar;
95
96 MemoryRegion *addr_mem;
97 MemoryRegion *data_mem;
98
99 uint32_t nr_matches;
100 VFIOConfigWindowMatch matches[];
101 } VFIOConfigWindowQuirk;
102
103 static uint64_t vfio_generic_window_quirk_address_read(void *opaque,
104 hwaddr addr,
105 unsigned size)
106 {
107 VFIOConfigWindowQuirk *window = opaque;
108 VFIOPCIDevice *vdev = window->vdev;
109
110 return vfio_region_read(&vdev->bars[window->bar].region,
111 addr + window->address_offset, size);
112 }
113
114 static void vfio_generic_window_quirk_address_write(void *opaque, hwaddr addr,
115 uint64_t data,
116 unsigned size)
117 {
118 VFIOConfigWindowQuirk *window = opaque;
119 VFIOPCIDevice *vdev = window->vdev;
120 int i;
121
122 window->window_enabled = false;
123
124 vfio_region_write(&vdev->bars[window->bar].region,
125 addr + window->address_offset, data, size);
126
127 for (i = 0; i < window->nr_matches; i++) {
128 if ((data & ~window->matches[i].mask) == window->matches[i].match) {
129 window->window_enabled = true;
130 window->address_val = data & window->matches[i].mask;
131 trace_vfio_quirk_generic_window_address_write(vdev->vbasedev.name,
132 memory_region_name(window->addr_mem), data);
133 break;
134 }
135 }
136 }
137
138 static const MemoryRegionOps vfio_generic_window_address_quirk = {
139 .read = vfio_generic_window_quirk_address_read,
140 .write = vfio_generic_window_quirk_address_write,
141 .endianness = DEVICE_LITTLE_ENDIAN,
142 };
143
144 static uint64_t vfio_generic_window_quirk_data_read(void *opaque,
145 hwaddr addr, unsigned size)
146 {
147 VFIOConfigWindowQuirk *window = opaque;
148 VFIOPCIDevice *vdev = window->vdev;
149 uint64_t data;
150
151 /* Always read data reg, discard if window enabled */
152 data = vfio_region_read(&vdev->bars[window->bar].region,
153 addr + window->data_offset, size);
154
155 if (window->window_enabled) {
156 data = vfio_pci_read_config(&vdev->pdev, window->address_val, size);
157 trace_vfio_quirk_generic_window_data_read(vdev->vbasedev.name,
158 memory_region_name(window->data_mem), data);
159 }
160
161 return data;
162 }
163
164 static void vfio_generic_window_quirk_data_write(void *opaque, hwaddr addr,
165 uint64_t data, unsigned size)
166 {
167 VFIOConfigWindowQuirk *window = opaque;
168 VFIOPCIDevice *vdev = window->vdev;
169
170 if (window->window_enabled) {
171 vfio_pci_write_config(&vdev->pdev, window->address_val, data, size);
172 trace_vfio_quirk_generic_window_data_write(vdev->vbasedev.name,
173 memory_region_name(window->data_mem), data);
174 return;
175 }
176
177 vfio_region_write(&vdev->bars[window->bar].region,
178 addr + window->data_offset, data, size);
179 }
180
181 static const MemoryRegionOps vfio_generic_window_data_quirk = {
182 .read = vfio_generic_window_quirk_data_read,
183 .write = vfio_generic_window_quirk_data_write,
184 .endianness = DEVICE_LITTLE_ENDIAN,
185 };
186
187 /*
188 * The generic mirror quirk handles devices which expose PCI config space
189 * through a region within a BAR. When enabled, reads and writes are
190 * redirected through to emulated PCI config space. XXX if PCI config space
191 * used memory regions, this could just be an alias.
192 */
193 typedef struct VFIOConfigMirrorQuirk {
194 struct VFIOPCIDevice *vdev;
195 uint32_t offset;
196 uint8_t bar;
197 MemoryRegion *mem;
198 uint8_t data[];
199 } VFIOConfigMirrorQuirk;
200
201 static uint64_t vfio_generic_quirk_mirror_read(void *opaque,
202 hwaddr addr, unsigned size)
203 {
204 VFIOConfigMirrorQuirk *mirror = opaque;
205 VFIOPCIDevice *vdev = mirror->vdev;
206 uint64_t data;
207
208 /* Read and discard in case the hardware cares */
209 (void)vfio_region_read(&vdev->bars[mirror->bar].region,
210 addr + mirror->offset, size);
211
212 data = vfio_pci_read_config(&vdev->pdev, addr, size);
213 trace_vfio_quirk_generic_mirror_read(vdev->vbasedev.name,
214 memory_region_name(mirror->mem),
215 addr, data);
216 return data;
217 }
218
219 static void vfio_generic_quirk_mirror_write(void *opaque, hwaddr addr,
220 uint64_t data, unsigned size)
221 {
222 VFIOConfigMirrorQuirk *mirror = opaque;
223 VFIOPCIDevice *vdev = mirror->vdev;
224
225 vfio_pci_write_config(&vdev->pdev, addr, data, size);
226 trace_vfio_quirk_generic_mirror_write(vdev->vbasedev.name,
227 memory_region_name(mirror->mem),
228 addr, data);
229 }
230
231 static const MemoryRegionOps vfio_generic_mirror_quirk = {
232 .read = vfio_generic_quirk_mirror_read,
233 .write = vfio_generic_quirk_mirror_write,
234 .endianness = DEVICE_LITTLE_ENDIAN,
235 };
236
237 /* Is range1 fully contained within range2? */
238 static bool vfio_range_contained(uint64_t first1, uint64_t len1,
239 uint64_t first2, uint64_t len2) {
240 return (first1 >= first2 && first1 + len1 <= first2 + len2);
241 }
242
243 #define PCI_VENDOR_ID_ATI 0x1002
244
245 /*
246 * Radeon HD cards (HD5450 & HD7850) report the upper byte of the I/O port BAR
247 * through VGA register 0x3c3. On newer cards, the I/O port BAR is always
248 * BAR4 (older cards like the X550 used BAR1, but we don't care to support
249 * those). Note that on bare metal, a read of 0x3c3 doesn't always return the
250 * I/O port BAR address. Originally this was coded to return the virtual BAR
251 * address only if the physical register read returns the actual BAR address,
252 * but users have reported greater success if we return the virtual address
253 * unconditionally.
254 */
255 static uint64_t vfio_ati_3c3_quirk_read(void *opaque,
256 hwaddr addr, unsigned size)
257 {
258 VFIOPCIDevice *vdev = opaque;
259 uint64_t data = vfio_pci_read_config(&vdev->pdev,
260 PCI_BASE_ADDRESS_4 + 1, size);
261
262 trace_vfio_quirk_ati_3c3_read(vdev->vbasedev.name, data);
263
264 return data;
265 }
266
267 static const MemoryRegionOps vfio_ati_3c3_quirk = {
268 .read = vfio_ati_3c3_quirk_read,
269 .endianness = DEVICE_LITTLE_ENDIAN,
270 };
271
272 VFIOQuirk *vfio_quirk_alloc(int nr_mem)
273 {
274 VFIOQuirk *quirk = g_new0(VFIOQuirk, 1);
275 QLIST_INIT(&quirk->ioeventfds);
276 quirk->mem = g_new0(MemoryRegion, nr_mem);
277 quirk->nr_mem = nr_mem;
278
279 return quirk;
280 }
281
282 static void vfio_ioeventfd_exit(VFIOPCIDevice *vdev, VFIOIOEventFD *ioeventfd)
283 {
284 QLIST_REMOVE(ioeventfd, next);
285 memory_region_del_eventfd(ioeventfd->mr, ioeventfd->addr, ioeventfd->size,
286 true, ioeventfd->data, &ioeventfd->e);
287
288 if (ioeventfd->vfio) {
289 struct vfio_device_ioeventfd vfio_ioeventfd;
290
291 vfio_ioeventfd.argsz = sizeof(vfio_ioeventfd);
292 vfio_ioeventfd.flags = ioeventfd->size;
293 vfio_ioeventfd.data = ioeventfd->data;
294 vfio_ioeventfd.offset = ioeventfd->region->fd_offset +
295 ioeventfd->region_addr;
296 vfio_ioeventfd.fd = -1;
297
298 if (ioctl(vdev->vbasedev.fd, VFIO_DEVICE_IOEVENTFD, &vfio_ioeventfd)) {
299 error_report("Failed to remove vfio ioeventfd for %s+0x%"
300 HWADDR_PRIx"[%d]:0x%"PRIx64" (%m)",
301 memory_region_name(ioeventfd->mr), ioeventfd->addr,
302 ioeventfd->size, ioeventfd->data);
303 }
304 } else {
305 qemu_set_fd_handler(event_notifier_get_fd(&ioeventfd->e),
306 NULL, NULL, NULL);
307 }
308
309 event_notifier_cleanup(&ioeventfd->e);
310 trace_vfio_ioeventfd_exit(memory_region_name(ioeventfd->mr),
311 (uint64_t)ioeventfd->addr, ioeventfd->size,
312 ioeventfd->data);
313 g_free(ioeventfd);
314 }
315
316 static void vfio_drop_dynamic_eventfds(VFIOPCIDevice *vdev, VFIOQuirk *quirk)
317 {
318 VFIOIOEventFD *ioeventfd, *tmp;
319
320 QLIST_FOREACH_SAFE(ioeventfd, &quirk->ioeventfds, next, tmp) {
321 if (ioeventfd->dynamic) {
322 vfio_ioeventfd_exit(vdev, ioeventfd);
323 }
324 }
325 }
326
327 static void vfio_ioeventfd_handler(void *opaque)
328 {
329 VFIOIOEventFD *ioeventfd = opaque;
330
331 if (event_notifier_test_and_clear(&ioeventfd->e)) {
332 vfio_region_write(ioeventfd->region, ioeventfd->region_addr,
333 ioeventfd->data, ioeventfd->size);
334 trace_vfio_ioeventfd_handler(memory_region_name(ioeventfd->mr),
335 (uint64_t)ioeventfd->addr, ioeventfd->size,
336 ioeventfd->data);
337 }
338 }
339
340 static VFIOIOEventFD *vfio_ioeventfd_init(VFIOPCIDevice *vdev,
341 MemoryRegion *mr, hwaddr addr,
342 unsigned size, uint64_t data,
343 VFIORegion *region,
344 hwaddr region_addr, bool dynamic)
345 {
346 VFIOIOEventFD *ioeventfd;
347
348 if (vdev->no_kvm_ioeventfd) {
349 return NULL;
350 }
351
352 ioeventfd = g_malloc0(sizeof(*ioeventfd));
353
354 if (event_notifier_init(&ioeventfd->e, 0)) {
355 g_free(ioeventfd);
356 return NULL;
357 }
358
359 /*
360 * MemoryRegion and relative offset, plus additional ioeventfd setup
361 * parameters for configuring and later tearing down KVM ioeventfd.
362 */
363 ioeventfd->mr = mr;
364 ioeventfd->addr = addr;
365 ioeventfd->size = size;
366 ioeventfd->data = data;
367 ioeventfd->dynamic = dynamic;
368 /*
369 * VFIORegion and relative offset for implementing the userspace
370 * handler. data & size fields shared for both uses.
371 */
372 ioeventfd->region = region;
373 ioeventfd->region_addr = region_addr;
374
375 if (!vdev->no_vfio_ioeventfd) {
376 struct vfio_device_ioeventfd vfio_ioeventfd;
377
378 vfio_ioeventfd.argsz = sizeof(vfio_ioeventfd);
379 vfio_ioeventfd.flags = ioeventfd->size;
380 vfio_ioeventfd.data = ioeventfd->data;
381 vfio_ioeventfd.offset = ioeventfd->region->fd_offset +
382 ioeventfd->region_addr;
383 vfio_ioeventfd.fd = event_notifier_get_fd(&ioeventfd->e);
384
385 ioeventfd->vfio = !ioctl(vdev->vbasedev.fd,
386 VFIO_DEVICE_IOEVENTFD, &vfio_ioeventfd);
387 }
388
389 if (!ioeventfd->vfio) {
390 qemu_set_fd_handler(event_notifier_get_fd(&ioeventfd->e),
391 vfio_ioeventfd_handler, NULL, ioeventfd);
392 }
393
394 memory_region_add_eventfd(ioeventfd->mr, ioeventfd->addr, ioeventfd->size,
395 true, ioeventfd->data, &ioeventfd->e);
396 trace_vfio_ioeventfd_init(memory_region_name(mr), (uint64_t)addr,
397 size, data, ioeventfd->vfio);
398
399 return ioeventfd;
400 }
401
402 static void vfio_vga_probe_ati_3c3_quirk(VFIOPCIDevice *vdev)
403 {
404 VFIOQuirk *quirk;
405
406 /*
407 * As long as the BAR is >= 256 bytes it will be aligned such that the
408 * lower byte is always zero. Filter out anything else, if it exists.
409 */
410 if (!vfio_pci_is(vdev, PCI_VENDOR_ID_ATI, PCI_ANY_ID) ||
411 !vdev->bars[4].ioport || vdev->bars[4].region.size < 256) {
412 return;
413 }
414
415 quirk = vfio_quirk_alloc(1);
416
417 memory_region_init_io(quirk->mem, OBJECT(vdev), &vfio_ati_3c3_quirk, vdev,
418 "vfio-ati-3c3-quirk", 1);
419 memory_region_add_subregion(&vdev->vga->region[QEMU_PCI_VGA_IO_HI].mem,
420 3 /* offset 3 bytes from 0x3c0 */, quirk->mem);
421
422 QLIST_INSERT_HEAD(&vdev->vga->region[QEMU_PCI_VGA_IO_HI].quirks,
423 quirk, next);
424
425 trace_vfio_quirk_ati_3c3_probe(vdev->vbasedev.name);
426 }
427
428 /*
429 * Newer ATI/AMD devices, including HD5450 and HD7850, have a mirror to PCI
430 * config space through MMIO BAR2 at offset 0x4000. Nothing seems to access
431 * the MMIO space directly, but a window to this space is provided through
432 * I/O port BAR4. Offset 0x0 is the address register and offset 0x4 is the
433 * data register. When the address is programmed to a range of 0x4000-0x4fff
434 * PCI configuration space is available. Experimentation seems to indicate
435 * that read-only may be provided by hardware.
436 */
437 static void vfio_probe_ati_bar4_quirk(VFIOPCIDevice *vdev, int nr)
438 {
439 VFIOQuirk *quirk;
440 VFIOConfigWindowQuirk *window;
441
442 /* This windows doesn't seem to be used except by legacy VGA code */
443 if (!vfio_pci_is(vdev, PCI_VENDOR_ID_ATI, PCI_ANY_ID) ||
444 !vdev->vga || nr != 4) {
445 return;
446 }
447
448 quirk = vfio_quirk_alloc(2);
449 window = quirk->data = g_malloc0(sizeof(*window) +
450 sizeof(VFIOConfigWindowMatch));
451 window->vdev = vdev;
452 window->address_offset = 0;
453 window->data_offset = 4;
454 window->nr_matches = 1;
455 window->matches[0].match = 0x4000;
456 window->matches[0].mask = vdev->config_size - 1;
457 window->bar = nr;
458 window->addr_mem = &quirk->mem[0];
459 window->data_mem = &quirk->mem[1];
460
461 memory_region_init_io(window->addr_mem, OBJECT(vdev),
462 &vfio_generic_window_address_quirk, window,
463 "vfio-ati-bar4-window-address-quirk", 4);
464 memory_region_add_subregion_overlap(vdev->bars[nr].region.mem,
465 window->address_offset,
466 window->addr_mem, 1);
467
468 memory_region_init_io(window->data_mem, OBJECT(vdev),
469 &vfio_generic_window_data_quirk, window,
470 "vfio-ati-bar4-window-data-quirk", 4);
471 memory_region_add_subregion_overlap(vdev->bars[nr].region.mem,
472 window->data_offset,
473 window->data_mem, 1);
474
475 QLIST_INSERT_HEAD(&vdev->bars[nr].quirks, quirk, next);
476
477 trace_vfio_quirk_ati_bar4_probe(vdev->vbasedev.name);
478 }
479
480 /*
481 * Trap the BAR2 MMIO mirror to config space as well.
482 */
483 static void vfio_probe_ati_bar2_quirk(VFIOPCIDevice *vdev, int nr)
484 {
485 VFIOQuirk *quirk;
486 VFIOConfigMirrorQuirk *mirror;
487
488 /* Only enable on newer devices where BAR2 is 64bit */
489 if (!vfio_pci_is(vdev, PCI_VENDOR_ID_ATI, PCI_ANY_ID) ||
490 !vdev->vga || nr != 2 || !vdev->bars[2].mem64) {
491 return;
492 }
493
494 quirk = vfio_quirk_alloc(1);
495 mirror = quirk->data = g_malloc0(sizeof(*mirror));
496 mirror->mem = quirk->mem;
497 mirror->vdev = vdev;
498 mirror->offset = 0x4000;
499 mirror->bar = nr;
500
501 memory_region_init_io(mirror->mem, OBJECT(vdev),
502 &vfio_generic_mirror_quirk, mirror,
503 "vfio-ati-bar2-4000-quirk", PCI_CONFIG_SPACE_SIZE);
504 memory_region_add_subregion_overlap(vdev->bars[nr].region.mem,
505 mirror->offset, mirror->mem, 1);
506
507 QLIST_INSERT_HEAD(&vdev->bars[nr].quirks, quirk, next);
508
509 trace_vfio_quirk_ati_bar2_probe(vdev->vbasedev.name);
510 }
511
512 /*
513 * Older ATI/AMD cards like the X550 have a similar window to that above.
514 * I/O port BAR1 provides a window to a mirror of PCI config space located
515 * in BAR2 at offset 0xf00. We don't care to support such older cards, but
516 * note it for future reference.
517 */
518
519 /*
520 * Nvidia has several different methods to get to config space, the
521 * nouveu project has several of these documented here:
522 * https://github.com/pathscale/envytools/tree/master/hwdocs
523 *
524 * The first quirk is actually not documented in envytools and is found
525 * on 10de:01d1 (NVIDIA Corporation G72 [GeForce 7300 LE]). This is an
526 * NV46 chipset. The backdoor uses the legacy VGA I/O ports to access
527 * the mirror of PCI config space found at BAR0 offset 0x1800. The access
528 * sequence first writes 0x338 to I/O port 0x3d4. The target offset is
529 * then written to 0x3d0. Finally 0x538 is written for a read and 0x738
530 * is written for a write to 0x3d4. The BAR0 offset is then accessible
531 * through 0x3d0. This quirk doesn't seem to be necessary on newer cards
532 * that use the I/O port BAR5 window but it doesn't hurt to leave it.
533 */
534 typedef enum {NONE = 0, SELECT, WINDOW, READ, WRITE} VFIONvidia3d0State;
535 static const char *nv3d0_states[] = { "NONE", "SELECT",
536 "WINDOW", "READ", "WRITE" };
537
538 typedef struct VFIONvidia3d0Quirk {
539 VFIOPCIDevice *vdev;
540 VFIONvidia3d0State state;
541 uint32_t offset;
542 } VFIONvidia3d0Quirk;
543
544 static uint64_t vfio_nvidia_3d4_quirk_read(void *opaque,
545 hwaddr addr, unsigned size)
546 {
547 VFIONvidia3d0Quirk *quirk = opaque;
548 VFIOPCIDevice *vdev = quirk->vdev;
549
550 quirk->state = NONE;
551
552 return vfio_vga_read(&vdev->vga->region[QEMU_PCI_VGA_IO_HI],
553 addr + 0x14, size);
554 }
555
556 static void vfio_nvidia_3d4_quirk_write(void *opaque, hwaddr addr,
557 uint64_t data, unsigned size)
558 {
559 VFIONvidia3d0Quirk *quirk = opaque;
560 VFIOPCIDevice *vdev = quirk->vdev;
561 VFIONvidia3d0State old_state = quirk->state;
562
563 quirk->state = NONE;
564
565 switch (data) {
566 case 0x338:
567 if (old_state == NONE) {
568 quirk->state = SELECT;
569 trace_vfio_quirk_nvidia_3d0_state(vdev->vbasedev.name,
570 nv3d0_states[quirk->state]);
571 }
572 break;
573 case 0x538:
574 if (old_state == WINDOW) {
575 quirk->state = READ;
576 trace_vfio_quirk_nvidia_3d0_state(vdev->vbasedev.name,
577 nv3d0_states[quirk->state]);
578 }
579 break;
580 case 0x738:
581 if (old_state == WINDOW) {
582 quirk->state = WRITE;
583 trace_vfio_quirk_nvidia_3d0_state(vdev->vbasedev.name,
584 nv3d0_states[quirk->state]);
585 }
586 break;
587 }
588
589 vfio_vga_write(&vdev->vga->region[QEMU_PCI_VGA_IO_HI],
590 addr + 0x14, data, size);
591 }
592
593 static const MemoryRegionOps vfio_nvidia_3d4_quirk = {
594 .read = vfio_nvidia_3d4_quirk_read,
595 .write = vfio_nvidia_3d4_quirk_write,
596 .endianness = DEVICE_LITTLE_ENDIAN,
597 };
598
599 static uint64_t vfio_nvidia_3d0_quirk_read(void *opaque,
600 hwaddr addr, unsigned size)
601 {
602 VFIONvidia3d0Quirk *quirk = opaque;
603 VFIOPCIDevice *vdev = quirk->vdev;
604 VFIONvidia3d0State old_state = quirk->state;
605 uint64_t data = vfio_vga_read(&vdev->vga->region[QEMU_PCI_VGA_IO_HI],
606 addr + 0x10, size);
607
608 quirk->state = NONE;
609
610 if (old_state == READ &&
611 (quirk->offset & ~(PCI_CONFIG_SPACE_SIZE - 1)) == 0x1800) {
612 uint8_t offset = quirk->offset & (PCI_CONFIG_SPACE_SIZE - 1);
613
614 data = vfio_pci_read_config(&vdev->pdev, offset, size);
615 trace_vfio_quirk_nvidia_3d0_read(vdev->vbasedev.name,
616 offset, size, data);
617 }
618
619 return data;
620 }
621
622 static void vfio_nvidia_3d0_quirk_write(void *opaque, hwaddr addr,
623 uint64_t data, unsigned size)
624 {
625 VFIONvidia3d0Quirk *quirk = opaque;
626 VFIOPCIDevice *vdev = quirk->vdev;
627 VFIONvidia3d0State old_state = quirk->state;
628
629 quirk->state = NONE;
630
631 if (old_state == SELECT) {
632 quirk->offset = (uint32_t)data;
633 quirk->state = WINDOW;
634 trace_vfio_quirk_nvidia_3d0_state(vdev->vbasedev.name,
635 nv3d0_states[quirk->state]);
636 } else if (old_state == WRITE) {
637 if ((quirk->offset & ~(PCI_CONFIG_SPACE_SIZE - 1)) == 0x1800) {
638 uint8_t offset = quirk->offset & (PCI_CONFIG_SPACE_SIZE - 1);
639
640 vfio_pci_write_config(&vdev->pdev, offset, data, size);
641 trace_vfio_quirk_nvidia_3d0_write(vdev->vbasedev.name,
642 offset, data, size);
643 return;
644 }
645 }
646
647 vfio_vga_write(&vdev->vga->region[QEMU_PCI_VGA_IO_HI],
648 addr + 0x10, data, size);
649 }
650
651 static const MemoryRegionOps vfio_nvidia_3d0_quirk = {
652 .read = vfio_nvidia_3d0_quirk_read,
653 .write = vfio_nvidia_3d0_quirk_write,
654 .endianness = DEVICE_LITTLE_ENDIAN,
655 };
656
657 static void vfio_vga_probe_nvidia_3d0_quirk(VFIOPCIDevice *vdev)
658 {
659 VFIOQuirk *quirk;
660 VFIONvidia3d0Quirk *data;
661
662 if (vdev->no_geforce_quirks ||
663 !vfio_pci_is(vdev, PCI_VENDOR_ID_NVIDIA, PCI_ANY_ID) ||
664 !vdev->bars[1].region.size) {
665 return;
666 }
667
668 quirk = vfio_quirk_alloc(2);
669 quirk->data = data = g_malloc0(sizeof(*data));
670 data->vdev = vdev;
671
672 memory_region_init_io(&quirk->mem[0], OBJECT(vdev), &vfio_nvidia_3d4_quirk,
673 data, "vfio-nvidia-3d4-quirk", 2);
674 memory_region_add_subregion(&vdev->vga->region[QEMU_PCI_VGA_IO_HI].mem,
675 0x14 /* 0x3c0 + 0x14 */, &quirk->mem[0]);
676
677 memory_region_init_io(&quirk->mem[1], OBJECT(vdev), &vfio_nvidia_3d0_quirk,
678 data, "vfio-nvidia-3d0-quirk", 2);
679 memory_region_add_subregion(&vdev->vga->region[QEMU_PCI_VGA_IO_HI].mem,
680 0x10 /* 0x3c0 + 0x10 */, &quirk->mem[1]);
681
682 QLIST_INSERT_HEAD(&vdev->vga->region[QEMU_PCI_VGA_IO_HI].quirks,
683 quirk, next);
684
685 trace_vfio_quirk_nvidia_3d0_probe(vdev->vbasedev.name);
686 }
687
688 /*
689 * The second quirk is documented in envytools. The I/O port BAR5 is just
690 * a set of address/data ports to the MMIO BARs. The BAR we care about is
691 * again BAR0. This backdoor is apparently a bit newer than the one above
692 * so we need to not only trap 256 bytes @0x1800, but all of PCI config
693 * space, including extended space is available at the 4k @0x88000.
694 */
695 typedef struct VFIONvidiaBAR5Quirk {
696 uint32_t master;
697 uint32_t enable;
698 MemoryRegion *addr_mem;
699 MemoryRegion *data_mem;
700 bool enabled;
701 VFIOConfigWindowQuirk window; /* last for match data */
702 } VFIONvidiaBAR5Quirk;
703
704 static void vfio_nvidia_bar5_enable(VFIONvidiaBAR5Quirk *bar5)
705 {
706 VFIOPCIDevice *vdev = bar5->window.vdev;
707
708 if (((bar5->master & bar5->enable) & 0x1) == bar5->enabled) {
709 return;
710 }
711
712 bar5->enabled = !bar5->enabled;
713 trace_vfio_quirk_nvidia_bar5_state(vdev->vbasedev.name,
714 bar5->enabled ? "Enable" : "Disable");
715 memory_region_set_enabled(bar5->addr_mem, bar5->enabled);
716 memory_region_set_enabled(bar5->data_mem, bar5->enabled);
717 }
718
719 static uint64_t vfio_nvidia_bar5_quirk_master_read(void *opaque,
720 hwaddr addr, unsigned size)
721 {
722 VFIONvidiaBAR5Quirk *bar5 = opaque;
723 VFIOPCIDevice *vdev = bar5->window.vdev;
724
725 return vfio_region_read(&vdev->bars[5].region, addr, size);
726 }
727
728 static void vfio_nvidia_bar5_quirk_master_write(void *opaque, hwaddr addr,
729 uint64_t data, unsigned size)
730 {
731 VFIONvidiaBAR5Quirk *bar5 = opaque;
732 VFIOPCIDevice *vdev = bar5->window.vdev;
733
734 vfio_region_write(&vdev->bars[5].region, addr, data, size);
735
736 bar5->master = data;
737 vfio_nvidia_bar5_enable(bar5);
738 }
739
740 static const MemoryRegionOps vfio_nvidia_bar5_quirk_master = {
741 .read = vfio_nvidia_bar5_quirk_master_read,
742 .write = vfio_nvidia_bar5_quirk_master_write,
743 .endianness = DEVICE_LITTLE_ENDIAN,
744 };
745
746 static uint64_t vfio_nvidia_bar5_quirk_enable_read(void *opaque,
747 hwaddr addr, unsigned size)
748 {
749 VFIONvidiaBAR5Quirk *bar5 = opaque;
750 VFIOPCIDevice *vdev = bar5->window.vdev;
751
752 return vfio_region_read(&vdev->bars[5].region, addr + 4, size);
753 }
754
755 static void vfio_nvidia_bar5_quirk_enable_write(void *opaque, hwaddr addr,
756 uint64_t data, unsigned size)
757 {
758 VFIONvidiaBAR5Quirk *bar5 = opaque;
759 VFIOPCIDevice *vdev = bar5->window.vdev;
760
761 vfio_region_write(&vdev->bars[5].region, addr + 4, data, size);
762
763 bar5->enable = data;
764 vfio_nvidia_bar5_enable(bar5);
765 }
766
767 static const MemoryRegionOps vfio_nvidia_bar5_quirk_enable = {
768 .read = vfio_nvidia_bar5_quirk_enable_read,
769 .write = vfio_nvidia_bar5_quirk_enable_write,
770 .endianness = DEVICE_LITTLE_ENDIAN,
771 };
772
773 static void vfio_probe_nvidia_bar5_quirk(VFIOPCIDevice *vdev, int nr)
774 {
775 VFIOQuirk *quirk;
776 VFIONvidiaBAR5Quirk *bar5;
777 VFIOConfigWindowQuirk *window;
778
779 if (vdev->no_geforce_quirks ||
780 !vfio_pci_is(vdev, PCI_VENDOR_ID_NVIDIA, PCI_ANY_ID) ||
781 !vdev->vga || nr != 5 || !vdev->bars[5].ioport) {
782 return;
783 }
784
785 quirk = vfio_quirk_alloc(4);
786 bar5 = quirk->data = g_malloc0(sizeof(*bar5) +
787 (sizeof(VFIOConfigWindowMatch) * 2));
788 window = &bar5->window;
789
790 window->vdev = vdev;
791 window->address_offset = 0x8;
792 window->data_offset = 0xc;
793 window->nr_matches = 2;
794 window->matches[0].match = 0x1800;
795 window->matches[0].mask = PCI_CONFIG_SPACE_SIZE - 1;
796 window->matches[1].match = 0x88000;
797 window->matches[1].mask = vdev->config_size - 1;
798 window->bar = nr;
799 window->addr_mem = bar5->addr_mem = &quirk->mem[0];
800 window->data_mem = bar5->data_mem = &quirk->mem[1];
801
802 memory_region_init_io(window->addr_mem, OBJECT(vdev),
803 &vfio_generic_window_address_quirk, window,
804 "vfio-nvidia-bar5-window-address-quirk", 4);
805 memory_region_add_subregion_overlap(vdev->bars[nr].region.mem,
806 window->address_offset,
807 window->addr_mem, 1);
808 memory_region_set_enabled(window->addr_mem, false);
809
810 memory_region_init_io(window->data_mem, OBJECT(vdev),
811 &vfio_generic_window_data_quirk, window,
812 "vfio-nvidia-bar5-window-data-quirk", 4);
813 memory_region_add_subregion_overlap(vdev->bars[nr].region.mem,
814 window->data_offset,
815 window->data_mem, 1);
816 memory_region_set_enabled(window->data_mem, false);
817
818 memory_region_init_io(&quirk->mem[2], OBJECT(vdev),
819 &vfio_nvidia_bar5_quirk_master, bar5,
820 "vfio-nvidia-bar5-master-quirk", 4);
821 memory_region_add_subregion_overlap(vdev->bars[nr].region.mem,
822 0, &quirk->mem[2], 1);
823
824 memory_region_init_io(&quirk->mem[3], OBJECT(vdev),
825 &vfio_nvidia_bar5_quirk_enable, bar5,
826 "vfio-nvidia-bar5-enable-quirk", 4);
827 memory_region_add_subregion_overlap(vdev->bars[nr].region.mem,
828 4, &quirk->mem[3], 1);
829
830 QLIST_INSERT_HEAD(&vdev->bars[nr].quirks, quirk, next);
831
832 trace_vfio_quirk_nvidia_bar5_probe(vdev->vbasedev.name);
833 }
834
835 typedef struct LastDataSet {
836 VFIOQuirk *quirk;
837 hwaddr addr;
838 uint64_t data;
839 unsigned size;
840 int hits;
841 int added;
842 } LastDataSet;
843
844 #define MAX_DYN_IOEVENTFD 10
845 #define HITS_FOR_IOEVENTFD 10
846
847 /*
848 * Finally, BAR0 itself. We want to redirect any accesses to either
849 * 0x1800 or 0x88000 through the PCI config space access functions.
850 */
851 static void vfio_nvidia_quirk_mirror_write(void *opaque, hwaddr addr,
852 uint64_t data, unsigned size)
853 {
854 VFIOConfigMirrorQuirk *mirror = opaque;
855 VFIOPCIDevice *vdev = mirror->vdev;
856 PCIDevice *pdev = &vdev->pdev;
857 LastDataSet *last = (LastDataSet *)&mirror->data;
858
859 vfio_generic_quirk_mirror_write(opaque, addr, data, size);
860
861 /*
862 * Nvidia seems to acknowledge MSI interrupts by writing 0xff to the
863 * MSI capability ID register. Both the ID and next register are
864 * read-only, so we allow writes covering either of those to real hw.
865 */
866 if ((pdev->cap_present & QEMU_PCI_CAP_MSI) &&
867 vfio_range_contained(addr, size, pdev->msi_cap, PCI_MSI_FLAGS)) {
868 vfio_region_write(&vdev->bars[mirror->bar].region,
869 addr + mirror->offset, data, size);
870 trace_vfio_quirk_nvidia_bar0_msi_ack(vdev->vbasedev.name);
871 }
872
873 /*
874 * Automatically add an ioeventfd to handle any repeated write with the
875 * same data and size above the standard PCI config space header. This is
876 * primarily expected to accelerate the MSI-ACK behavior, such as noted
877 * above. Current hardware/drivers should trigger an ioeventfd at config
878 * offset 0x704 (region offset 0x88704), with data 0x0, size 4.
879 *
880 * The criteria of 10 successive hits is arbitrary but reliably adds the
881 * MSI-ACK region. Note that as some writes are bypassed via the ioeventfd,
882 * the remaining ones have a greater chance of being seen successively.
883 * To avoid the pathological case of burning up all of QEMU's open file
884 * handles, arbitrarily limit this algorithm from adding no more than 10
885 * ioeventfds, print an error if we would have added an 11th, and then
886 * stop counting.
887 */
888 if (!vdev->no_kvm_ioeventfd &&
889 addr >= PCI_STD_HEADER_SIZEOF && last->added <= MAX_DYN_IOEVENTFD) {
890 if (addr != last->addr || data != last->data || size != last->size) {
891 last->addr = addr;
892 last->data = data;
893 last->size = size;
894 last->hits = 1;
895 } else if (++last->hits >= HITS_FOR_IOEVENTFD) {
896 if (last->added < MAX_DYN_IOEVENTFD) {
897 VFIOIOEventFD *ioeventfd;
898 ioeventfd = vfio_ioeventfd_init(vdev, mirror->mem, addr, size,
899 data, &vdev->bars[mirror->bar].region,
900 mirror->offset + addr, true);
901 if (ioeventfd) {
902 VFIOQuirk *quirk = last->quirk;
903
904 QLIST_INSERT_HEAD(&quirk->ioeventfds, ioeventfd, next);
905 last->added++;
906 }
907 } else {
908 last->added++;
909 warn_report("NVIDIA ioeventfd queue full for %s, unable to "
910 "accelerate 0x%"HWADDR_PRIx", data 0x%"PRIx64", "
911 "size %u", vdev->vbasedev.name, addr, data, size);
912 }
913 }
914 }
915 }
916
917 static const MemoryRegionOps vfio_nvidia_mirror_quirk = {
918 .read = vfio_generic_quirk_mirror_read,
919 .write = vfio_nvidia_quirk_mirror_write,
920 .endianness = DEVICE_LITTLE_ENDIAN,
921 };
922
923 static void vfio_nvidia_bar0_quirk_reset(VFIOPCIDevice *vdev, VFIOQuirk *quirk)
924 {
925 VFIOConfigMirrorQuirk *mirror = quirk->data;
926 LastDataSet *last = (LastDataSet *)&mirror->data;
927
928 last->addr = last->data = last->size = last->hits = last->added = 0;
929
930 vfio_drop_dynamic_eventfds(vdev, quirk);
931 }
932
933 static void vfio_probe_nvidia_bar0_quirk(VFIOPCIDevice *vdev, int nr)
934 {
935 VFIOQuirk *quirk;
936 VFIOConfigMirrorQuirk *mirror;
937 LastDataSet *last;
938
939 if (vdev->no_geforce_quirks ||
940 !vfio_pci_is(vdev, PCI_VENDOR_ID_NVIDIA, PCI_ANY_ID) ||
941 !vfio_is_vga(vdev) || nr != 0) {
942 return;
943 }
944
945 quirk = vfio_quirk_alloc(1);
946 quirk->reset = vfio_nvidia_bar0_quirk_reset;
947 mirror = quirk->data = g_malloc0(sizeof(*mirror) + sizeof(LastDataSet));
948 mirror->mem = quirk->mem;
949 mirror->vdev = vdev;
950 mirror->offset = 0x88000;
951 mirror->bar = nr;
952 last = (LastDataSet *)&mirror->data;
953 last->quirk = quirk;
954
955 memory_region_init_io(mirror->mem, OBJECT(vdev),
956 &vfio_nvidia_mirror_quirk, mirror,
957 "vfio-nvidia-bar0-88000-mirror-quirk",
958 vdev->config_size);
959 memory_region_add_subregion_overlap(vdev->bars[nr].region.mem,
960 mirror->offset, mirror->mem, 1);
961
962 QLIST_INSERT_HEAD(&vdev->bars[nr].quirks, quirk, next);
963
964 /* The 0x1800 offset mirror only seems to get used by legacy VGA */
965 if (vdev->vga) {
966 quirk = vfio_quirk_alloc(1);
967 quirk->reset = vfio_nvidia_bar0_quirk_reset;
968 mirror = quirk->data = g_malloc0(sizeof(*mirror) + sizeof(LastDataSet));
969 mirror->mem = quirk->mem;
970 mirror->vdev = vdev;
971 mirror->offset = 0x1800;
972 mirror->bar = nr;
973 last = (LastDataSet *)&mirror->data;
974 last->quirk = quirk;
975
976 memory_region_init_io(mirror->mem, OBJECT(vdev),
977 &vfio_nvidia_mirror_quirk, mirror,
978 "vfio-nvidia-bar0-1800-mirror-quirk",
979 PCI_CONFIG_SPACE_SIZE);
980 memory_region_add_subregion_overlap(vdev->bars[nr].region.mem,
981 mirror->offset, mirror->mem, 1);
982
983 QLIST_INSERT_HEAD(&vdev->bars[nr].quirks, quirk, next);
984 }
985
986 trace_vfio_quirk_nvidia_bar0_probe(vdev->vbasedev.name);
987 }
988
989 /*
990 * TODO - Some Nvidia devices provide config access to their companion HDA
991 * device and even to their parent bridge via these config space mirrors.
992 * Add quirks for those regions.
993 */
994
995 #define PCI_VENDOR_ID_REALTEK 0x10ec
996
997 /*
998 * RTL8168 devices have a backdoor that can access the MSI-X table. At BAR2
999 * offset 0x70 there is a dword data register, offset 0x74 is a dword address
1000 * register. According to the Linux r8169 driver, the MSI-X table is addressed
1001 * when the "type" portion of the address register is set to 0x1. This appears
1002 * to be bits 16:30. Bit 31 is both a write indicator and some sort of
1003 * "address latched" indicator. Bits 12:15 are a mask field, which we can
1004 * ignore because the MSI-X table should always be accessed as a dword (full
1005 * mask). Bits 0:11 is offset within the type.
1006 *
1007 * Example trace:
1008 *
1009 * Read from MSI-X table offset 0
1010 * vfio: vfio_bar_write(0000:05:00.0:BAR2+0x74, 0x1f000, 4) // store read addr
1011 * vfio: vfio_bar_read(0000:05:00.0:BAR2+0x74, 4) = 0x8001f000 // latch
1012 * vfio: vfio_bar_read(0000:05:00.0:BAR2+0x70, 4) = 0xfee00398 // read data
1013 *
1014 * Write 0xfee00000 to MSI-X table offset 0
1015 * vfio: vfio_bar_write(0000:05:00.0:BAR2+0x70, 0xfee00000, 4) // write data
1016 * vfio: vfio_bar_write(0000:05:00.0:BAR2+0x74, 0x8001f000, 4) // do write
1017 * vfio: vfio_bar_read(0000:05:00.0:BAR2+0x74, 4) = 0x1f000 // complete
1018 */
1019 typedef struct VFIOrtl8168Quirk {
1020 VFIOPCIDevice *vdev;
1021 uint32_t addr;
1022 uint32_t data;
1023 bool enabled;
1024 } VFIOrtl8168Quirk;
1025
1026 static uint64_t vfio_rtl8168_quirk_address_read(void *opaque,
1027 hwaddr addr, unsigned size)
1028 {
1029 VFIOrtl8168Quirk *rtl = opaque;
1030 VFIOPCIDevice *vdev = rtl->vdev;
1031 uint64_t data = vfio_region_read(&vdev->bars[2].region, addr + 0x74, size);
1032
1033 if (rtl->enabled) {
1034 data = rtl->addr ^ 0x80000000U; /* latch/complete */
1035 trace_vfio_quirk_rtl8168_fake_latch(vdev->vbasedev.name, data);
1036 }
1037
1038 return data;
1039 }
1040
1041 static void vfio_rtl8168_quirk_address_write(void *opaque, hwaddr addr,
1042 uint64_t data, unsigned size)
1043 {
1044 VFIOrtl8168Quirk *rtl = opaque;
1045 VFIOPCIDevice *vdev = rtl->vdev;
1046
1047 rtl->enabled = false;
1048
1049 if ((data & 0x7fff0000) == 0x10000) { /* MSI-X table */
1050 rtl->enabled = true;
1051 rtl->addr = (uint32_t)data;
1052
1053 if (data & 0x80000000U) { /* Do write */
1054 if (vdev->pdev.cap_present & QEMU_PCI_CAP_MSIX) {
1055 hwaddr offset = data & 0xfff;
1056 uint64_t val = rtl->data;
1057
1058 trace_vfio_quirk_rtl8168_msix_write(vdev->vbasedev.name,
1059 (uint16_t)offset, val);
1060
1061 /* Write to the proper guest MSI-X table instead */
1062 memory_region_dispatch_write(&vdev->pdev.msix_table_mmio,
1063 offset, val,
1064 size_memop(size) | MO_LE,
1065 MEMTXATTRS_UNSPECIFIED);
1066 }
1067 return; /* Do not write guest MSI-X data to hardware */
1068 }
1069 }
1070
1071 vfio_region_write(&vdev->bars[2].region, addr + 0x74, data, size);
1072 }
1073
1074 static const MemoryRegionOps vfio_rtl_address_quirk = {
1075 .read = vfio_rtl8168_quirk_address_read,
1076 .write = vfio_rtl8168_quirk_address_write,
1077 .valid = {
1078 .min_access_size = 4,
1079 .max_access_size = 4,
1080 .unaligned = false,
1081 },
1082 .endianness = DEVICE_LITTLE_ENDIAN,
1083 };
1084
1085 static uint64_t vfio_rtl8168_quirk_data_read(void *opaque,
1086 hwaddr addr, unsigned size)
1087 {
1088 VFIOrtl8168Quirk *rtl = opaque;
1089 VFIOPCIDevice *vdev = rtl->vdev;
1090 uint64_t data = vfio_region_read(&vdev->bars[2].region, addr + 0x70, size);
1091
1092 if (rtl->enabled && (vdev->pdev.cap_present & QEMU_PCI_CAP_MSIX)) {
1093 hwaddr offset = rtl->addr & 0xfff;
1094 memory_region_dispatch_read(&vdev->pdev.msix_table_mmio, offset,
1095 &data, size_memop(size) | MO_LE,
1096 MEMTXATTRS_UNSPECIFIED);
1097 trace_vfio_quirk_rtl8168_msix_read(vdev->vbasedev.name, offset, data);
1098 }
1099
1100 return data;
1101 }
1102
1103 static void vfio_rtl8168_quirk_data_write(void *opaque, hwaddr addr,
1104 uint64_t data, unsigned size)
1105 {
1106 VFIOrtl8168Quirk *rtl = opaque;
1107 VFIOPCIDevice *vdev = rtl->vdev;
1108
1109 rtl->data = (uint32_t)data;
1110
1111 vfio_region_write(&vdev->bars[2].region, addr + 0x70, data, size);
1112 }
1113
1114 static const MemoryRegionOps vfio_rtl_data_quirk = {
1115 .read = vfio_rtl8168_quirk_data_read,
1116 .write = vfio_rtl8168_quirk_data_write,
1117 .valid = {
1118 .min_access_size = 4,
1119 .max_access_size = 4,
1120 .unaligned = false,
1121 },
1122 .endianness = DEVICE_LITTLE_ENDIAN,
1123 };
1124
1125 static void vfio_probe_rtl8168_bar2_quirk(VFIOPCIDevice *vdev, int nr)
1126 {
1127 VFIOQuirk *quirk;
1128 VFIOrtl8168Quirk *rtl;
1129
1130 if (!vfio_pci_is(vdev, PCI_VENDOR_ID_REALTEK, 0x8168) || nr != 2) {
1131 return;
1132 }
1133
1134 quirk = vfio_quirk_alloc(2);
1135 quirk->data = rtl = g_malloc0(sizeof(*rtl));
1136 rtl->vdev = vdev;
1137
1138 memory_region_init_io(&quirk->mem[0], OBJECT(vdev),
1139 &vfio_rtl_address_quirk, rtl,
1140 "vfio-rtl8168-window-address-quirk", 4);
1141 memory_region_add_subregion_overlap(vdev->bars[nr].region.mem,
1142 0x74, &quirk->mem[0], 1);
1143
1144 memory_region_init_io(&quirk->mem[1], OBJECT(vdev),
1145 &vfio_rtl_data_quirk, rtl,
1146 "vfio-rtl8168-window-data-quirk", 4);
1147 memory_region_add_subregion_overlap(vdev->bars[nr].region.mem,
1148 0x70, &quirk->mem[1], 1);
1149
1150 QLIST_INSERT_HEAD(&vdev->bars[nr].quirks, quirk, next);
1151
1152 trace_vfio_quirk_rtl8168_probe(vdev->vbasedev.name);
1153 }
1154
1155 #define IGD_ASLS 0xfc /* ASL Storage Register */
1156
1157 /*
1158 * The OpRegion includes the Video BIOS Table, which seems important for
1159 * telling the driver what sort of outputs it has. Without this, the device
1160 * may work in the guest, but we may not get output. This also requires BIOS
1161 * support to reserve and populate a section of guest memory sufficient for
1162 * the table and to write the base address of that memory to the ASLS register
1163 * of the IGD device.
1164 */
1165 int vfio_pci_igd_opregion_init(VFIOPCIDevice *vdev,
1166 struct vfio_region_info *info, Error **errp)
1167 {
1168 int ret;
1169
1170 vdev->igd_opregion = g_malloc0(info->size);
1171 ret = pread(vdev->vbasedev.fd, vdev->igd_opregion,
1172 info->size, info->offset);
1173 if (ret != info->size) {
1174 error_setg(errp, "failed to read IGD OpRegion");
1175 g_free(vdev->igd_opregion);
1176 vdev->igd_opregion = NULL;
1177 return -EINVAL;
1178 }
1179
1180 /*
1181 * Provide fw_cfg with a copy of the OpRegion which the VM firmware is to
1182 * allocate 32bit reserved memory for, copy these contents into, and write
1183 * the reserved memory base address to the device ASLS register at 0xFC.
1184 * Alignment of this reserved region seems flexible, but using a 4k page
1185 * alignment seems to work well. This interface assumes a single IGD
1186 * device, which may be at VM address 00:02.0 in legacy mode or another
1187 * address in UPT mode.
1188 *
1189 * NB, there may be future use cases discovered where the VM should have
1190 * direct interaction with the host OpRegion, in which case the write to
1191 * the ASLS register would trigger MemoryRegion setup to enable that.
1192 */
1193 fw_cfg_add_file(fw_cfg_find(), "etc/igd-opregion",
1194 vdev->igd_opregion, info->size);
1195
1196 trace_vfio_pci_igd_opregion_enabled(vdev->vbasedev.name);
1197
1198 pci_set_long(vdev->pdev.config + IGD_ASLS, 0);
1199 pci_set_long(vdev->pdev.wmask + IGD_ASLS, ~0);
1200 pci_set_long(vdev->emulated_config_bits + IGD_ASLS, ~0);
1201
1202 return 0;
1203 }
1204
1205 /*
1206 * Common quirk probe entry points.
1207 */
1208 void vfio_vga_quirk_setup(VFIOPCIDevice *vdev)
1209 {
1210 vfio_vga_probe_ati_3c3_quirk(vdev);
1211 vfio_vga_probe_nvidia_3d0_quirk(vdev);
1212 }
1213
1214 void vfio_vga_quirk_exit(VFIOPCIDevice *vdev)
1215 {
1216 VFIOQuirk *quirk;
1217 int i, j;
1218
1219 for (i = 0; i < ARRAY_SIZE(vdev->vga->region); i++) {
1220 QLIST_FOREACH(quirk, &vdev->vga->region[i].quirks, next) {
1221 for (j = 0; j < quirk->nr_mem; j++) {
1222 memory_region_del_subregion(&vdev->vga->region[i].mem,
1223 &quirk->mem[j]);
1224 }
1225 }
1226 }
1227 }
1228
1229 void vfio_vga_quirk_finalize(VFIOPCIDevice *vdev)
1230 {
1231 int i, j;
1232
1233 for (i = 0; i < ARRAY_SIZE(vdev->vga->region); i++) {
1234 while (!QLIST_EMPTY(&vdev->vga->region[i].quirks)) {
1235 VFIOQuirk *quirk = QLIST_FIRST(&vdev->vga->region[i].quirks);
1236 QLIST_REMOVE(quirk, next);
1237 for (j = 0; j < quirk->nr_mem; j++) {
1238 object_unparent(OBJECT(&quirk->mem[j]));
1239 }
1240 g_free(quirk->mem);
1241 g_free(quirk->data);
1242 g_free(quirk);
1243 }
1244 }
1245 }
1246
1247 void vfio_bar_quirk_setup(VFIOPCIDevice *vdev, int nr)
1248 {
1249 vfio_probe_ati_bar4_quirk(vdev, nr);
1250 vfio_probe_ati_bar2_quirk(vdev, nr);
1251 vfio_probe_nvidia_bar5_quirk(vdev, nr);
1252 vfio_probe_nvidia_bar0_quirk(vdev, nr);
1253 vfio_probe_rtl8168_bar2_quirk(vdev, nr);
1254 #ifdef CONFIG_VFIO_IGD
1255 vfio_probe_igd_bar4_quirk(vdev, nr);
1256 #endif
1257 }
1258
1259 void vfio_bar_quirk_exit(VFIOPCIDevice *vdev, int nr)
1260 {
1261 VFIOBAR *bar = &vdev->bars[nr];
1262 VFIOQuirk *quirk;
1263 int i;
1264
1265 QLIST_FOREACH(quirk, &bar->quirks, next) {
1266 while (!QLIST_EMPTY(&quirk->ioeventfds)) {
1267 vfio_ioeventfd_exit(vdev, QLIST_FIRST(&quirk->ioeventfds));
1268 }
1269
1270 for (i = 0; i < quirk->nr_mem; i++) {
1271 memory_region_del_subregion(bar->region.mem, &quirk->mem[i]);
1272 }
1273 }
1274 }
1275
1276 void vfio_bar_quirk_finalize(VFIOPCIDevice *vdev, int nr)
1277 {
1278 VFIOBAR *bar = &vdev->bars[nr];
1279 int i;
1280
1281 while (!QLIST_EMPTY(&bar->quirks)) {
1282 VFIOQuirk *quirk = QLIST_FIRST(&bar->quirks);
1283 QLIST_REMOVE(quirk, next);
1284 for (i = 0; i < quirk->nr_mem; i++) {
1285 object_unparent(OBJECT(&quirk->mem[i]));
1286 }
1287 g_free(quirk->mem);
1288 g_free(quirk->data);
1289 g_free(quirk);
1290 }
1291 }
1292
1293 /*
1294 * Reset quirks
1295 */
1296 void vfio_quirk_reset(VFIOPCIDevice *vdev)
1297 {
1298 int i;
1299
1300 for (i = 0; i < PCI_ROM_SLOT; i++) {
1301 VFIOQuirk *quirk;
1302 VFIOBAR *bar = &vdev->bars[i];
1303
1304 QLIST_FOREACH(quirk, &bar->quirks, next) {
1305 if (quirk->reset) {
1306 quirk->reset(vdev, quirk);
1307 }
1308 }
1309 }
1310 }
1311
1312 /*
1313 * AMD Radeon PCI config reset, based on Linux:
1314 * drivers/gpu/drm/radeon/ci_smc.c:ci_is_smc_running()
1315 * drivers/gpu/drm/radeon/radeon_device.c:radeon_pci_config_reset
1316 * drivers/gpu/drm/radeon/ci_smc.c:ci_reset_smc()
1317 * drivers/gpu/drm/radeon/ci_smc.c:ci_stop_smc_clock()
1318 * IDs: include/drm/drm_pciids.h
1319 * Registers: http://cgit.freedesktop.org/~agd5f/linux/commit/?id=4e2aa447f6f0
1320 *
1321 * Bonaire and Hawaii GPUs do not respond to a bus reset. This is a bug in the
1322 * hardware that should be fixed on future ASICs. The symptom of this is that
1323 * once the accerlated driver loads, Windows guests will bsod on subsequent
1324 * attmpts to load the driver, such as after VM reset or shutdown/restart. To
1325 * work around this, we do an AMD specific PCI config reset, followed by an SMC
1326 * reset. The PCI config reset only works if SMC firmware is running, so we
1327 * have a dependency on the state of the device as to whether this reset will
1328 * be effective. There are still cases where we won't be able to kick the
1329 * device into working, but this greatly improves the usability overall. The
1330 * config reset magic is relatively common on AMD GPUs, but the setup and SMC
1331 * poking is largely ASIC specific.
1332 */
1333 static bool vfio_radeon_smc_is_running(VFIOPCIDevice *vdev)
1334 {
1335 uint32_t clk, pc_c;
1336
1337 /*
1338 * Registers 200h and 204h are index and data registers for accessing
1339 * indirect configuration registers within the device.
1340 */
1341 vfio_region_write(&vdev->bars[5].region, 0x200, 0x80000004, 4);
1342 clk = vfio_region_read(&vdev->bars[5].region, 0x204, 4);
1343 vfio_region_write(&vdev->bars[5].region, 0x200, 0x80000370, 4);
1344 pc_c = vfio_region_read(&vdev->bars[5].region, 0x204, 4);
1345
1346 return (!(clk & 1) && (0x20100 <= pc_c));
1347 }
1348
1349 /*
1350 * The scope of a config reset is controlled by a mode bit in the misc register
1351 * and a fuse, exposed as a bit in another register. The fuse is the default
1352 * (0 = GFX, 1 = whole GPU), the misc bit is a toggle, with the forumula
1353 * scope = !(misc ^ fuse), where the resulting scope is defined the same as
1354 * the fuse. A truth table therefore tells us that if misc == fuse, we need
1355 * to flip the value of the bit in the misc register.
1356 */
1357 static void vfio_radeon_set_gfx_only_reset(VFIOPCIDevice *vdev)
1358 {
1359 uint32_t misc, fuse;
1360 bool a, b;
1361
1362 vfio_region_write(&vdev->bars[5].region, 0x200, 0xc00c0000, 4);
1363 fuse = vfio_region_read(&vdev->bars[5].region, 0x204, 4);
1364 b = fuse & 64;
1365
1366 vfio_region_write(&vdev->bars[5].region, 0x200, 0xc0000010, 4);
1367 misc = vfio_region_read(&vdev->bars[5].region, 0x204, 4);
1368 a = misc & 2;
1369
1370 if (a == b) {
1371 vfio_region_write(&vdev->bars[5].region, 0x204, misc ^ 2, 4);
1372 vfio_region_read(&vdev->bars[5].region, 0x204, 4); /* flush */
1373 }
1374 }
1375
1376 static int vfio_radeon_reset(VFIOPCIDevice *vdev)
1377 {
1378 PCIDevice *pdev = &vdev->pdev;
1379 int i, ret = 0;
1380 uint32_t data;
1381
1382 /* Defer to a kernel implemented reset */
1383 if (vdev->vbasedev.reset_works) {
1384 trace_vfio_quirk_ati_bonaire_reset_skipped(vdev->vbasedev.name);
1385 return -ENODEV;
1386 }
1387
1388 /* Enable only memory BAR access */
1389 vfio_pci_write_config(pdev, PCI_COMMAND, PCI_COMMAND_MEMORY, 2);
1390
1391 /* Reset only works if SMC firmware is loaded and running */
1392 if (!vfio_radeon_smc_is_running(vdev)) {
1393 ret = -EINVAL;
1394 trace_vfio_quirk_ati_bonaire_reset_no_smc(vdev->vbasedev.name);
1395 goto out;
1396 }
1397
1398 /* Make sure only the GFX function is reset */
1399 vfio_radeon_set_gfx_only_reset(vdev);
1400
1401 /* AMD PCI config reset */
1402 vfio_pci_write_config(pdev, 0x7c, 0x39d5e86b, 4);
1403 usleep(100);
1404
1405 /* Read back the memory size to make sure we're out of reset */
1406 for (i = 0; i < 100000; i++) {
1407 if (vfio_region_read(&vdev->bars[5].region, 0x5428, 4) != 0xffffffff) {
1408 goto reset_smc;
1409 }
1410 usleep(1);
1411 }
1412
1413 trace_vfio_quirk_ati_bonaire_reset_timeout(vdev->vbasedev.name);
1414
1415 reset_smc:
1416 /* Reset SMC */
1417 vfio_region_write(&vdev->bars[5].region, 0x200, 0x80000000, 4);
1418 data = vfio_region_read(&vdev->bars[5].region, 0x204, 4);
1419 data |= 1;
1420 vfio_region_write(&vdev->bars[5].region, 0x204, data, 4);
1421
1422 /* Disable SMC clock */
1423 vfio_region_write(&vdev->bars[5].region, 0x200, 0x80000004, 4);
1424 data = vfio_region_read(&vdev->bars[5].region, 0x204, 4);
1425 data |= 1;
1426 vfio_region_write(&vdev->bars[5].region, 0x204, data, 4);
1427
1428 trace_vfio_quirk_ati_bonaire_reset_done(vdev->vbasedev.name);
1429
1430 out:
1431 /* Restore PCI command register */
1432 vfio_pci_write_config(pdev, PCI_COMMAND, 0, 2);
1433
1434 return ret;
1435 }
1436
1437 void vfio_setup_resetfn_quirk(VFIOPCIDevice *vdev)
1438 {
1439 switch (vdev->vendor_id) {
1440 case 0x1002:
1441 switch (vdev->device_id) {
1442 /* Bonaire */
1443 case 0x6649: /* Bonaire [FirePro W5100] */
1444 case 0x6650:
1445 case 0x6651:
1446 case 0x6658: /* Bonaire XTX [Radeon R7 260X] */
1447 case 0x665c: /* Bonaire XT [Radeon HD 7790/8770 / R9 260 OEM] */
1448 case 0x665d: /* Bonaire [Radeon R7 200 Series] */
1449 /* Hawaii */
1450 case 0x67A0: /* Hawaii XT GL [FirePro W9100] */
1451 case 0x67A1: /* Hawaii PRO GL [FirePro W8100] */
1452 case 0x67A2:
1453 case 0x67A8:
1454 case 0x67A9:
1455 case 0x67AA:
1456 case 0x67B0: /* Hawaii XT [Radeon R9 290X] */
1457 case 0x67B1: /* Hawaii PRO [Radeon R9 290] */
1458 case 0x67B8:
1459 case 0x67B9:
1460 case 0x67BA:
1461 case 0x67BE:
1462 vdev->resetfn = vfio_radeon_reset;
1463 trace_vfio_quirk_ati_bonaire_reset(vdev->vbasedev.name);
1464 break;
1465 }
1466 break;
1467 }
1468 }
1469
1470 /*
1471 * The NVIDIA GPUDirect P2P Vendor capability allows the user to specify
1472 * devices as a member of a clique. Devices within the same clique ID
1473 * are capable of direct P2P. It's the user's responsibility that this
1474 * is correct. The spec says that this may reside at any unused config
1475 * offset, but reserves and recommends hypervisors place this at C8h.
1476 * The spec also states that the hypervisor should place this capability
1477 * at the end of the capability list, thus next is defined as 0h.
1478 *
1479 * +----------------+----------------+----------------+----------------+
1480 * | sig 7:0 ('P') | vndr len (8h) | next (0h) | cap id (9h) |
1481 * +----------------+----------------+----------------+----------------+
1482 * | rsvd 15:7(0h),id 6:3,ver 2:0(0h)| sig 23:8 ('P2') |
1483 * +---------------------------------+---------------------------------+
1484 *
1485 * https://lists.gnu.org/archive/html/qemu-devel/2017-08/pdfUda5iEpgOS.pdf
1486 */
1487 static void get_nv_gpudirect_clique_id(Object *obj, Visitor *v,
1488 const char *name, void *opaque,
1489 Error **errp)
1490 {
1491 DeviceState *dev = DEVICE(obj);
1492 Property *prop = opaque;
1493 uint8_t *ptr = qdev_get_prop_ptr(dev, prop);
1494
1495 visit_type_uint8(v, name, ptr, errp);
1496 }
1497
1498 static void set_nv_gpudirect_clique_id(Object *obj, Visitor *v,
1499 const char *name, void *opaque,
1500 Error **errp)
1501 {
1502 DeviceState *dev = DEVICE(obj);
1503 Property *prop = opaque;
1504 uint8_t value, *ptr = qdev_get_prop_ptr(dev, prop);
1505
1506 if (dev->realized) {
1507 qdev_prop_set_after_realize(dev, name, errp);
1508 return;
1509 }
1510
1511 if (!visit_type_uint8(v, name, &value, errp)) {
1512 return;
1513 }
1514
1515 if (value & ~0xF) {
1516 error_setg(errp, "Property %s: valid range 0-15", name);
1517 return;
1518 }
1519
1520 *ptr = value;
1521 }
1522
1523 const PropertyInfo qdev_prop_nv_gpudirect_clique = {
1524 .name = "uint4",
1525 .description = "NVIDIA GPUDirect Clique ID (0 - 15)",
1526 .get = get_nv_gpudirect_clique_id,
1527 .set = set_nv_gpudirect_clique_id,
1528 };
1529
1530 static int vfio_add_nv_gpudirect_cap(VFIOPCIDevice *vdev, Error **errp)
1531 {
1532 PCIDevice *pdev = &vdev->pdev;
1533 int ret, pos = 0xC8;
1534
1535 if (vdev->nv_gpudirect_clique == 0xFF) {
1536 return 0;
1537 }
1538
1539 if (!vfio_pci_is(vdev, PCI_VENDOR_ID_NVIDIA, PCI_ANY_ID)) {
1540 error_setg(errp, "NVIDIA GPUDirect Clique ID: invalid device vendor");
1541 return -EINVAL;
1542 }
1543
1544 if (pci_get_byte(pdev->config + PCI_CLASS_DEVICE + 1) !=
1545 PCI_BASE_CLASS_DISPLAY) {
1546 error_setg(errp, "NVIDIA GPUDirect Clique ID: unsupported PCI class");
1547 return -EINVAL;
1548 }
1549
1550 ret = pci_add_capability(pdev, PCI_CAP_ID_VNDR, pos, 8, errp);
1551 if (ret < 0) {
1552 error_prepend(errp, "Failed to add NVIDIA GPUDirect cap: ");
1553 return ret;
1554 }
1555
1556 memset(vdev->emulated_config_bits + pos, 0xFF, 8);
1557 pos += PCI_CAP_FLAGS;
1558 pci_set_byte(pdev->config + pos++, 8);
1559 pci_set_byte(pdev->config + pos++, 'P');
1560 pci_set_byte(pdev->config + pos++, '2');
1561 pci_set_byte(pdev->config + pos++, 'P');
1562 pci_set_byte(pdev->config + pos++, vdev->nv_gpudirect_clique << 3);
1563 pci_set_byte(pdev->config + pos, 0);
1564
1565 return 0;
1566 }
1567
1568 static void vfio_pci_nvlink2_get_tgt(Object *obj, Visitor *v,
1569 const char *name,
1570 void *opaque, Error **errp)
1571 {
1572 uint64_t tgt = (uintptr_t) opaque;
1573 visit_type_uint64(v, name, &tgt, errp);
1574 }
1575
1576 static void vfio_pci_nvlink2_get_link_speed(Object *obj, Visitor *v,
1577 const char *name,
1578 void *opaque, Error **errp)
1579 {
1580 uint32_t link_speed = (uint32_t)(uintptr_t) opaque;
1581 visit_type_uint32(v, name, &link_speed, errp);
1582 }
1583
1584 int vfio_pci_nvidia_v100_ram_init(VFIOPCIDevice *vdev, Error **errp)
1585 {
1586 int ret;
1587 void *p;
1588 struct vfio_region_info *nv2reg = NULL;
1589 struct vfio_info_cap_header *hdr;
1590 struct vfio_region_info_cap_nvlink2_ssatgt *cap;
1591 VFIOQuirk *quirk;
1592
1593 ret = vfio_get_dev_region_info(&vdev->vbasedev,
1594 VFIO_REGION_TYPE_PCI_VENDOR_TYPE |
1595 PCI_VENDOR_ID_NVIDIA,
1596 VFIO_REGION_SUBTYPE_NVIDIA_NVLINK2_RAM,
1597 &nv2reg);
1598 if (ret) {
1599 return ret;
1600 }
1601
1602 hdr = vfio_get_region_info_cap(nv2reg, VFIO_REGION_INFO_CAP_NVLINK2_SSATGT);
1603 if (!hdr) {
1604 ret = -ENODEV;
1605 goto free_exit;
1606 }
1607 cap = (void *) hdr;
1608
1609 p = mmap(NULL, nv2reg->size, PROT_READ | PROT_WRITE,
1610 MAP_SHARED, vdev->vbasedev.fd, nv2reg->offset);
1611 if (p == MAP_FAILED) {
1612 ret = -errno;
1613 goto free_exit;
1614 }
1615
1616 quirk = vfio_quirk_alloc(1);
1617 memory_region_init_ram_ptr(&quirk->mem[0], OBJECT(vdev), "nvlink2-mr",
1618 nv2reg->size, p);
1619 QLIST_INSERT_HEAD(&vdev->bars[0].quirks, quirk, next);
1620
1621 object_property_add(OBJECT(vdev), "nvlink2-tgt", "uint64",
1622 vfio_pci_nvlink2_get_tgt, NULL, NULL,
1623 (void *) (uintptr_t) cap->tgt);
1624 trace_vfio_pci_nvidia_gpu_setup_quirk(vdev->vbasedev.name, cap->tgt,
1625 nv2reg->size);
1626 free_exit:
1627 g_free(nv2reg);
1628
1629 return ret;
1630 }
1631
1632 int vfio_pci_nvlink2_init(VFIOPCIDevice *vdev, Error **errp)
1633 {
1634 int ret;
1635 void *p;
1636 struct vfio_region_info *atsdreg = NULL;
1637 struct vfio_info_cap_header *hdr;
1638 struct vfio_region_info_cap_nvlink2_ssatgt *captgt;
1639 struct vfio_region_info_cap_nvlink2_lnkspd *capspeed;
1640 VFIOQuirk *quirk;
1641
1642 ret = vfio_get_dev_region_info(&vdev->vbasedev,
1643 VFIO_REGION_TYPE_PCI_VENDOR_TYPE |
1644 PCI_VENDOR_ID_IBM,
1645 VFIO_REGION_SUBTYPE_IBM_NVLINK2_ATSD,
1646 &atsdreg);
1647 if (ret) {
1648 return ret;
1649 }
1650
1651 hdr = vfio_get_region_info_cap(atsdreg,
1652 VFIO_REGION_INFO_CAP_NVLINK2_SSATGT);
1653 if (!hdr) {
1654 ret = -ENODEV;
1655 goto free_exit;
1656 }
1657 captgt = (void *) hdr;
1658
1659 hdr = vfio_get_region_info_cap(atsdreg,
1660 VFIO_REGION_INFO_CAP_NVLINK2_LNKSPD);
1661 if (!hdr) {
1662 ret = -ENODEV;
1663 goto free_exit;
1664 }
1665 capspeed = (void *) hdr;
1666
1667 /* Some NVLink bridges may not have assigned ATSD */
1668 if (atsdreg->size) {
1669 p = mmap(NULL, atsdreg->size, PROT_READ | PROT_WRITE,
1670 MAP_SHARED, vdev->vbasedev.fd, atsdreg->offset);
1671 if (p == MAP_FAILED) {
1672 ret = -errno;
1673 goto free_exit;
1674 }
1675
1676 quirk = vfio_quirk_alloc(1);
1677 memory_region_init_ram_device_ptr(&quirk->mem[0], OBJECT(vdev),
1678 "nvlink2-atsd-mr", atsdreg->size, p);
1679 QLIST_INSERT_HEAD(&vdev->bars[0].quirks, quirk, next);
1680 }
1681
1682 object_property_add(OBJECT(vdev), "nvlink2-tgt", "uint64",
1683 vfio_pci_nvlink2_get_tgt, NULL, NULL,
1684 (void *) (uintptr_t) captgt->tgt);
1685 trace_vfio_pci_nvlink2_setup_quirk_ssatgt(vdev->vbasedev.name, captgt->tgt,
1686 atsdreg->size);
1687
1688 object_property_add(OBJECT(vdev), "nvlink2-link-speed", "uint32",
1689 vfio_pci_nvlink2_get_link_speed, NULL, NULL,
1690 (void *) (uintptr_t) capspeed->link_speed);
1691 trace_vfio_pci_nvlink2_setup_quirk_lnkspd(vdev->vbasedev.name,
1692 capspeed->link_speed);
1693 free_exit:
1694 g_free(atsdreg);
1695
1696 return ret;
1697 }
1698
1699 /*
1700 * The VMD endpoint provides a real PCIe domain to the guest and the guest
1701 * kernel performs enumeration of the VMD sub-device domain. Guest transactions
1702 * to VMD sub-devices go through MMU translation from guest addresses to
1703 * physical addresses. When MMIO goes to an endpoint after being translated to
1704 * physical addresses, the bridge rejects the transaction because the window
1705 * has been programmed with guest addresses.
1706 *
1707 * VMD can use the Host Physical Address in order to correctly program the
1708 * bridge windows in its PCIe domain. VMD device 28C0 has HPA shadow registers
1709 * located at offset 0x2000 in MEMBAR2 (BAR 4). This quirk provides the HPA
1710 * shadow registers in a vendor-specific capability register for devices
1711 * without native support. The position of 0xE8-0xFF is in the reserved range
1712 * of the VMD device capability space following the Power Management
1713 * Capability.
1714 */
1715 #define VMD_SHADOW_CAP_VER 1
1716 #define VMD_SHADOW_CAP_LEN 24
1717 static int vfio_add_vmd_shadow_cap(VFIOPCIDevice *vdev, Error **errp)
1718 {
1719 uint8_t membar_phys[16];
1720 int ret, pos = 0xE8;
1721
1722 if (!(vfio_pci_is(vdev, PCI_VENDOR_ID_INTEL, 0x201D) ||
1723 vfio_pci_is(vdev, PCI_VENDOR_ID_INTEL, 0x467F) ||
1724 vfio_pci_is(vdev, PCI_VENDOR_ID_INTEL, 0x4C3D) ||
1725 vfio_pci_is(vdev, PCI_VENDOR_ID_INTEL, 0x9A0B))) {
1726 return 0;
1727 }
1728
1729 ret = pread(vdev->vbasedev.fd, membar_phys, 16,
1730 vdev->config_offset + PCI_BASE_ADDRESS_2);
1731 if (ret != 16) {
1732 error_report("VMD %s cannot read MEMBARs (%d)",
1733 vdev->vbasedev.name, ret);
1734 return -EFAULT;
1735 }
1736
1737 ret = pci_add_capability(&vdev->pdev, PCI_CAP_ID_VNDR, pos,
1738 VMD_SHADOW_CAP_LEN, errp);
1739 if (ret < 0) {
1740 error_prepend(errp, "Failed to add VMD MEMBAR Shadow cap: ");
1741 return ret;
1742 }
1743
1744 memset(vdev->emulated_config_bits + pos, 0xFF, VMD_SHADOW_CAP_LEN);
1745 pos += PCI_CAP_FLAGS;
1746 pci_set_byte(vdev->pdev.config + pos++, VMD_SHADOW_CAP_LEN);
1747 pci_set_byte(vdev->pdev.config + pos++, VMD_SHADOW_CAP_VER);
1748 pci_set_long(vdev->pdev.config + pos, 0x53484457); /* SHDW */
1749 memcpy(vdev->pdev.config + pos + 4, membar_phys, 16);
1750
1751 return 0;
1752 }
1753
1754 int vfio_add_virt_caps(VFIOPCIDevice *vdev, Error **errp)
1755 {
1756 int ret;
1757
1758 ret = vfio_add_nv_gpudirect_cap(vdev, errp);
1759 if (ret) {
1760 return ret;
1761 }
1762
1763 ret = vfio_add_vmd_shadow_cap(vdev, errp);
1764 if (ret) {
1765 return ret;
1766 }
1767
1768 return 0;
1769 }