1 /* 2 * IGD device quirks 3 * 4 * Copyright Red Hat, Inc. 2016 5 * 6 * Authors: 7 * Alex Williamson <alex.williamson@redhat.com> 8 * 9 * This work is licensed under the terms of the GNU GPL, version 2. See 10 * the COPYING file in the top-level directory. 11 */ 12 13 #include "qemu/osdep.h" 14 #include "qemu/units.h" 15 #include "qemu/error-report.h" 16 #include "qapi/error.h" 17 #include "qapi/qmp/qerror.h" 18 #include "hw/hw.h" 19 #include "hw/nvram/fw_cfg.h" 20 #include "pci.h" 21 #include "pci-quirks.h" 22 #include "trace.h" 23 24 /* 25 * Intel IGD support 26 * 27 * Obviously IGD is not a discrete device, this is evidenced not only by it 28 * being integrated into the CPU, but by the various chipset and BIOS 29 * dependencies that it brings along with it. Intel is trying to move away 30 * from this and Broadwell and newer devices can run in what Intel calls 31 * "Universal Pass-Through" mode, or UPT. Theoretically in UPT mode, nothing 32 * more is required beyond assigning the IGD device to a VM. There are 33 * however support limitations to this mode. It only supports IGD as a 34 * secondary graphics device in the VM and it doesn't officially support any 35 * physical outputs. 36 * 37 * The code here attempts to enable what we'll call legacy mode assignment, 38 * IGD retains most of the capabilities we expect for it to have on bare 39 * metal. To enable this mode, the IGD device must be assigned to the VM 40 * at PCI address 00:02.0, it must have a ROM, it very likely needs VGA 41 * support, we must have VM BIOS support for reserving and populating some 42 * of the required tables, and we need to tweak the chipset with revisions 43 * and IDs and an LPC/ISA bridge device. The intention is to make all of 44 * this happen automatically by installing the device at the correct VM PCI 45 * bus address. If any of the conditions are not met, we cross our fingers 46 * and hope the user knows better. 47 * 48 * NB - It is possible to enable physical outputs in UPT mode by supplying 49 * an OpRegion table. We don't do this by default because the guest driver 50 * behaves differently if an OpRegion is provided and no monitor is attached 51 * vs no OpRegion and a monitor being attached or not. Effectively, if a 52 * headless setup is desired, the OpRegion gets in the way of that. 53 */ 54 55 /* 56 * This presumes the device is already known to be an Intel VGA device, so we 57 * take liberties in which device ID bits match which generation. This should 58 * not be taken as an indication that all the devices are supported, or even 59 * supportable, some of them don't even support VT-d. 60 * See linux:include/drm/i915_pciids.h for IDs. 61 */ 62 static int igd_gen(VFIOPCIDevice *vdev) 63 { 64 /* 65 * Device IDs for Broxton/Apollo Lake are 0x0a84, 0x1a84, 0x1a85, 0x5a84 66 * and 0x5a85, match bit 11:1 here 67 * Prefix 0x0a is taken by Haswell, this rule should be matched first. 68 */ 69 if ((vdev->device_id & 0xffe) == 0xa84) { 70 return 9; 71 } 72 73 switch (vdev->device_id & 0xff00) { 74 case 0x0100: /* SandyBridge, IvyBridge */ 75 return 6; 76 case 0x0400: /* Haswell */ 77 case 0x0a00: /* Haswell */ 78 case 0x0c00: /* Haswell */ 79 case 0x0d00: /* Haswell */ 80 case 0x0f00: /* Valleyview/Bay Trail */ 81 return 7; 82 case 0x1600: /* Broadwell */ 83 case 0x2200: /* Cherryview */ 84 return 8; 85 case 0x1900: /* Skylake */ 86 case 0x3100: /* Gemini Lake */ 87 case 0x5900: /* Kaby Lake */ 88 case 0x3e00: /* Coffee Lake */ 89 case 0x9B00: /* Comet Lake */ 90 return 9; 91 case 0x8A00: /* Ice Lake */ 92 case 0x4500: /* Elkhart Lake */ 93 case 0x4E00: /* Jasper Lake */ 94 return 11; 95 case 0x9A00: /* Tiger Lake */ 96 case 0x4C00: /* Rocket Lake */ 97 case 0x4600: /* Alder Lake */ 98 case 0xA700: /* Raptor Lake */ 99 return 12; 100 } 101 102 /* 103 * Unfortunately, Intel changes it's specification quite often. This makes 104 * it impossible to use a suitable default value for unknown devices. 105 */ 106 return -1; 107 } 108 109 typedef struct VFIOIGDQuirk { 110 struct VFIOPCIDevice *vdev; 111 uint32_t index; 112 uint64_t bdsm; 113 } VFIOIGDQuirk; 114 115 #define IGD_GMCH 0x50 /* Graphics Control Register */ 116 #define IGD_BDSM 0x5c /* Base Data of Stolen Memory */ 117 #define IGD_BDSM_GEN11 0xc0 /* Base Data of Stolen Memory of gen 11 and later */ 118 119 #define IGD_GMCH_GEN6_GMS_SHIFT 3 /* SNB_GMCH in i915 */ 120 #define IGD_GMCH_GEN6_GMS_MASK 0x1f 121 #define IGD_GMCH_GEN6_GGMS_SHIFT 8 122 #define IGD_GMCH_GEN6_GGMS_MASK 0x3 123 #define IGD_GMCH_GEN8_GMS_SHIFT 8 /* BDW_GMCH in i915 */ 124 #define IGD_GMCH_GEN8_GMS_MASK 0xff 125 #define IGD_GMCH_GEN8_GGMS_SHIFT 6 126 #define IGD_GMCH_GEN8_GGMS_MASK 0x3 127 128 static uint64_t igd_gtt_memory_size(int gen, uint16_t gmch) 129 { 130 uint64_t ggms; 131 132 if (gen < 8) { 133 ggms = (gmch >> IGD_GMCH_GEN6_GGMS_SHIFT) & IGD_GMCH_GEN6_GGMS_MASK; 134 } else { 135 ggms = (gmch >> IGD_GMCH_GEN8_GGMS_SHIFT) & IGD_GMCH_GEN8_GGMS_MASK; 136 if (ggms != 0) { 137 ggms = 1ULL << ggms; 138 } 139 } 140 141 return ggms * MiB; 142 } 143 144 static uint64_t igd_stolen_memory_size(int gen, uint32_t gmch) 145 { 146 uint64_t gms; 147 148 if (gen < 8) { 149 gms = (gmch >> IGD_GMCH_GEN6_GMS_SHIFT) & IGD_GMCH_GEN6_GMS_MASK; 150 } else { 151 gms = (gmch >> IGD_GMCH_GEN8_GMS_SHIFT) & IGD_GMCH_GEN8_GMS_MASK; 152 } 153 154 if (gen < 9) { 155 return gms * 32 * MiB; 156 } else { 157 if (gms < 0xf0) { 158 return gms * 32 * MiB; 159 } else { 160 return (gms - 0xf0 + 1) * 4 * MiB; 161 } 162 } 163 164 return 0; 165 } 166 167 /* 168 * The rather short list of registers that we copy from the host devices. 169 * The LPC/ISA bridge values are definitely needed to support the vBIOS, the 170 * host bridge values may or may not be needed depending on the guest OS. 171 * Since we're only munging revision and subsystem values on the host bridge, 172 * we don't require our own device. The LPC/ISA bridge needs to be our very 173 * own though. 174 */ 175 typedef struct { 176 uint8_t offset; 177 uint8_t len; 178 } IGDHostInfo; 179 180 static const IGDHostInfo igd_host_bridge_infos[] = { 181 {PCI_REVISION_ID, 2}, 182 {PCI_SUBSYSTEM_VENDOR_ID, 2}, 183 {PCI_SUBSYSTEM_ID, 2}, 184 }; 185 186 static const IGDHostInfo igd_lpc_bridge_infos[] = { 187 {PCI_VENDOR_ID, 2}, 188 {PCI_DEVICE_ID, 2}, 189 {PCI_REVISION_ID, 2}, 190 {PCI_SUBSYSTEM_VENDOR_ID, 2}, 191 {PCI_SUBSYSTEM_ID, 2}, 192 }; 193 194 static int vfio_pci_igd_copy(VFIOPCIDevice *vdev, PCIDevice *pdev, 195 struct vfio_region_info *info, 196 const IGDHostInfo *list, int len) 197 { 198 int i, ret; 199 200 for (i = 0; i < len; i++) { 201 ret = pread(vdev->vbasedev.fd, pdev->config + list[i].offset, 202 list[i].len, info->offset + list[i].offset); 203 if (ret != list[i].len) { 204 error_report("IGD copy failed: %m"); 205 return -errno; 206 } 207 } 208 209 return 0; 210 } 211 212 /* 213 * Stuff a few values into the host bridge. 214 */ 215 static int vfio_pci_igd_host_init(VFIOPCIDevice *vdev, 216 struct vfio_region_info *info) 217 { 218 PCIBus *bus; 219 PCIDevice *host_bridge; 220 int ret; 221 222 bus = pci_device_root_bus(&vdev->pdev); 223 host_bridge = pci_find_device(bus, 0, PCI_DEVFN(0, 0)); 224 225 if (!host_bridge) { 226 error_report("Can't find host bridge"); 227 return -ENODEV; 228 } 229 230 ret = vfio_pci_igd_copy(vdev, host_bridge, info, igd_host_bridge_infos, 231 ARRAY_SIZE(igd_host_bridge_infos)); 232 if (!ret) { 233 trace_vfio_pci_igd_host_bridge_enabled(vdev->vbasedev.name); 234 } 235 236 return ret; 237 } 238 239 /* 240 * IGD LPC/ISA bridge support code. The vBIOS needs this, but we can't write 241 * arbitrary values into just any bridge, so we must create our own. We try 242 * to handle if the user has created it for us, which they might want to do 243 * to enable multifunction so we don't occupy the whole PCI slot. 244 */ 245 static void vfio_pci_igd_lpc_bridge_realize(PCIDevice *pdev, Error **errp) 246 { 247 if (pdev->devfn != PCI_DEVFN(0x1f, 0)) { 248 error_setg(errp, "VFIO dummy ISA/LPC bridge must have address 1f.0"); 249 } 250 } 251 252 static void vfio_pci_igd_lpc_bridge_class_init(ObjectClass *klass, void *data) 253 { 254 DeviceClass *dc = DEVICE_CLASS(klass); 255 PCIDeviceClass *k = PCI_DEVICE_CLASS(klass); 256 257 set_bit(DEVICE_CATEGORY_BRIDGE, dc->categories); 258 dc->desc = "VFIO dummy ISA/LPC bridge for IGD assignment"; 259 dc->hotpluggable = false; 260 k->realize = vfio_pci_igd_lpc_bridge_realize; 261 k->class_id = PCI_CLASS_BRIDGE_ISA; 262 } 263 264 static const TypeInfo vfio_pci_igd_lpc_bridge_info = { 265 .name = "vfio-pci-igd-lpc-bridge", 266 .parent = TYPE_PCI_DEVICE, 267 .class_init = vfio_pci_igd_lpc_bridge_class_init, 268 .interfaces = (InterfaceInfo[]) { 269 { INTERFACE_CONVENTIONAL_PCI_DEVICE }, 270 { }, 271 }, 272 }; 273 274 static void vfio_pci_igd_register_types(void) 275 { 276 type_register_static(&vfio_pci_igd_lpc_bridge_info); 277 } 278 279 type_init(vfio_pci_igd_register_types) 280 281 static int vfio_pci_igd_lpc_init(VFIOPCIDevice *vdev, 282 struct vfio_region_info *info) 283 { 284 PCIDevice *lpc_bridge; 285 int ret; 286 287 lpc_bridge = pci_find_device(pci_device_root_bus(&vdev->pdev), 288 0, PCI_DEVFN(0x1f, 0)); 289 if (!lpc_bridge) { 290 lpc_bridge = pci_create_simple(pci_device_root_bus(&vdev->pdev), 291 PCI_DEVFN(0x1f, 0), "vfio-pci-igd-lpc-bridge"); 292 } 293 294 ret = vfio_pci_igd_copy(vdev, lpc_bridge, info, igd_lpc_bridge_infos, 295 ARRAY_SIZE(igd_lpc_bridge_infos)); 296 if (!ret) { 297 trace_vfio_pci_igd_lpc_bridge_enabled(vdev->vbasedev.name); 298 } 299 300 return ret; 301 } 302 303 /* 304 * IGD Gen8 and newer support up to 8MB for the GTT and use a 64bit PTE 305 * entry, older IGDs use 2MB and 32bit. Each PTE maps a 4k page. Therefore 306 * we either have 2M/4k * 4 = 2k or 8M/4k * 8 = 16k as the maximum iobar index 307 * for programming the GTT. 308 * 309 * See linux:include/drm/i915_drm.h for shift and mask values. 310 */ 311 static int vfio_igd_gtt_max(VFIOPCIDevice *vdev) 312 { 313 uint32_t gmch = vfio_pci_read_config(&vdev->pdev, IGD_GMCH, sizeof(gmch)); 314 int gen = igd_gen(vdev); 315 uint64_t ggms_size = igd_gtt_memory_size(gen, gmch); 316 317 return (ggms_size / (4 * KiB)) * (gen < 8 ? 4 : 8); 318 } 319 320 /* 321 * The IGD ROM will make use of stolen memory (GGMS) for support of VESA modes. 322 * Somehow the host stolen memory range is used for this, but how the ROM gets 323 * it is a mystery, perhaps it's hardcoded into the ROM. Thankfully though, it 324 * reprograms the GTT through the IOBAR where we can trap it and transpose the 325 * programming to the VM allocated buffer. That buffer gets reserved by the VM 326 * firmware via the fw_cfg entry added below. Here we're just monitoring the 327 * IOBAR address and data registers to detect a write sequence targeting the 328 * GTTADR. This code is developed by observed behavior and doesn't have a 329 * direct spec reference, unfortunately. 330 */ 331 static uint64_t vfio_igd_quirk_data_read(void *opaque, 332 hwaddr addr, unsigned size) 333 { 334 VFIOIGDQuirk *igd = opaque; 335 VFIOPCIDevice *vdev = igd->vdev; 336 337 igd->index = ~0; 338 339 return vfio_region_read(&vdev->bars[4].region, addr + 4, size); 340 } 341 342 static void vfio_igd_quirk_data_write(void *opaque, hwaddr addr, 343 uint64_t data, unsigned size) 344 { 345 VFIOIGDQuirk *igd = opaque; 346 VFIOPCIDevice *vdev = igd->vdev; 347 uint64_t val = data; 348 int gen = igd_gen(vdev); 349 350 /* 351 * Programming the GGMS starts at index 0x1 and uses every 4th index (ie. 352 * 0x1, 0x5, 0x9, 0xd,...). For pre-Gen8 each 4-byte write is a whole PTE 353 * entry, with 0th bit enable set. For Gen8 and up, PTEs are 64bit, so 354 * entries 0x5 & 0xd are the high dword, in our case zero. Each PTE points 355 * to a 4k page, which we translate to a page from the VM allocated region, 356 * pointed to by the BDSM register. If this is not set, we fail. 357 * 358 * We trap writes to the full configured GTT size, but we typically only 359 * see the vBIOS writing up to (nearly) the 1MB barrier. In fact it often 360 * seems to miss the last entry for an even 1MB GTT. Doing a gratuitous 361 * write of that last entry does work, but is hopefully unnecessary since 362 * we clear the previous GTT on initialization. 363 */ 364 if ((igd->index % 4 == 1) && igd->index < vfio_igd_gtt_max(vdev)) { 365 if (gen < 8 || (igd->index % 8 == 1)) { 366 uint64_t base; 367 368 if (gen < 11) { 369 base = pci_get_long(vdev->pdev.config + IGD_BDSM); 370 } else { 371 base = pci_get_quad(vdev->pdev.config + IGD_BDSM_GEN11); 372 } 373 if (!base) { 374 hw_error("vfio-igd: Guest attempted to program IGD GTT before " 375 "BIOS reserved stolen memory. Unsupported BIOS?"); 376 } 377 378 val = data - igd->bdsm + base; 379 } else { 380 val = 0; /* upper 32bits of pte, we only enable below 4G PTEs */ 381 } 382 383 trace_vfio_pci_igd_bar4_write(vdev->vbasedev.name, 384 igd->index, data, val); 385 } 386 387 vfio_region_write(&vdev->bars[4].region, addr + 4, val, size); 388 389 igd->index = ~0; 390 } 391 392 static const MemoryRegionOps vfio_igd_data_quirk = { 393 .read = vfio_igd_quirk_data_read, 394 .write = vfio_igd_quirk_data_write, 395 .endianness = DEVICE_LITTLE_ENDIAN, 396 }; 397 398 static uint64_t vfio_igd_quirk_index_read(void *opaque, 399 hwaddr addr, unsigned size) 400 { 401 VFIOIGDQuirk *igd = opaque; 402 VFIOPCIDevice *vdev = igd->vdev; 403 404 igd->index = ~0; 405 406 return vfio_region_read(&vdev->bars[4].region, addr, size); 407 } 408 409 static void vfio_igd_quirk_index_write(void *opaque, hwaddr addr, 410 uint64_t data, unsigned size) 411 { 412 VFIOIGDQuirk *igd = opaque; 413 VFIOPCIDevice *vdev = igd->vdev; 414 415 igd->index = data; 416 417 vfio_region_write(&vdev->bars[4].region, addr, data, size); 418 } 419 420 static const MemoryRegionOps vfio_igd_index_quirk = { 421 .read = vfio_igd_quirk_index_read, 422 .write = vfio_igd_quirk_index_write, 423 .endianness = DEVICE_LITTLE_ENDIAN, 424 }; 425 426 #define IGD_GGC_MMIO_OFFSET 0x108040 427 #define IGD_BDSM_MMIO_OFFSET 0x1080C0 428 429 void vfio_probe_igd_bar0_quirk(VFIOPCIDevice *vdev, int nr) 430 { 431 VFIOQuirk *ggc_quirk, *bdsm_quirk; 432 VFIOConfigMirrorQuirk *ggc_mirror, *bdsm_mirror; 433 int gen; 434 435 /* 436 * This must be an Intel VGA device at address 00:02.0 for us to even 437 * consider enabling legacy mode. Some driver have dependencies on the PCI 438 * bus address. 439 */ 440 if (!vfio_pci_is(vdev, PCI_VENDOR_ID_INTEL, PCI_ANY_ID) || 441 !vfio_is_vga(vdev) || nr != 0 || 442 &vdev->pdev != pci_find_device(pci_device_root_bus(&vdev->pdev), 443 0, PCI_DEVFN(0x2, 0))) { 444 return; 445 } 446 447 /* 448 * Only on IGD devices of gen 11 and above, the BDSM register is mirrored 449 * into MMIO space and read from MMIO space by the Windows driver. 450 */ 451 gen = igd_gen(vdev); 452 if (gen < 6) { 453 return; 454 } 455 456 ggc_quirk = vfio_quirk_alloc(1); 457 ggc_mirror = ggc_quirk->data = g_malloc0(sizeof(*ggc_mirror)); 458 ggc_mirror->mem = ggc_quirk->mem; 459 ggc_mirror->vdev = vdev; 460 ggc_mirror->bar = nr; 461 ggc_mirror->offset = IGD_GGC_MMIO_OFFSET; 462 ggc_mirror->config_offset = IGD_GMCH; 463 464 memory_region_init_io(ggc_mirror->mem, OBJECT(vdev), 465 &vfio_generic_mirror_quirk, ggc_mirror, 466 "vfio-igd-ggc-quirk", 2); 467 memory_region_add_subregion_overlap(vdev->bars[nr].region.mem, 468 ggc_mirror->offset, ggc_mirror->mem, 469 1); 470 471 QLIST_INSERT_HEAD(&vdev->bars[nr].quirks, ggc_quirk, next); 472 473 bdsm_quirk = vfio_quirk_alloc(1); 474 bdsm_mirror = bdsm_quirk->data = g_malloc0(sizeof(*bdsm_mirror)); 475 bdsm_mirror->mem = bdsm_quirk->mem; 476 bdsm_mirror->vdev = vdev; 477 bdsm_mirror->bar = nr; 478 bdsm_mirror->offset = IGD_BDSM_MMIO_OFFSET; 479 bdsm_mirror->config_offset = (gen < 11) ? IGD_BDSM : IGD_BDSM_GEN11; 480 481 memory_region_init_io(bdsm_mirror->mem, OBJECT(vdev), 482 &vfio_generic_mirror_quirk, bdsm_mirror, 483 "vfio-igd-bdsm-quirk", (gen < 11) ? 4 : 8); 484 memory_region_add_subregion_overlap(vdev->bars[nr].region.mem, 485 bdsm_mirror->offset, bdsm_mirror->mem, 486 1); 487 488 QLIST_INSERT_HEAD(&vdev->bars[nr].quirks, bdsm_quirk, next); 489 } 490 491 void vfio_probe_igd_bar4_quirk(VFIOPCIDevice *vdev, int nr) 492 { 493 g_autofree struct vfio_region_info *rom = NULL; 494 g_autofree struct vfio_region_info *opregion = NULL; 495 g_autofree struct vfio_region_info *host = NULL; 496 g_autofree struct vfio_region_info *lpc = NULL; 497 VFIOQuirk *quirk; 498 VFIOIGDQuirk *igd; 499 PCIDevice *lpc_bridge; 500 int i, ret, gen; 501 uint64_t ggms_size, gms_size; 502 uint64_t *bdsm_size; 503 uint32_t gmch; 504 uint16_t cmd_orig, cmd; 505 Error *err = NULL; 506 507 /* 508 * This must be an Intel VGA device at address 00:02.0 for us to even 509 * consider enabling legacy mode. The vBIOS has dependencies on the 510 * PCI bus address. 511 */ 512 if (!vfio_pci_is(vdev, PCI_VENDOR_ID_INTEL, PCI_ANY_ID) || 513 !vfio_is_vga(vdev) || nr != 4 || 514 &vdev->pdev != pci_find_device(pci_device_root_bus(&vdev->pdev), 515 0, PCI_DEVFN(0x2, 0))) { 516 return; 517 } 518 519 /* 520 * We need to create an LPC/ISA bridge at PCI bus address 00:1f.0 that we 521 * can stuff host values into, so if there's already one there and it's not 522 * one we can hack on, legacy mode is no-go. Sorry Q35. 523 */ 524 lpc_bridge = pci_find_device(pci_device_root_bus(&vdev->pdev), 525 0, PCI_DEVFN(0x1f, 0)); 526 if (lpc_bridge && !object_dynamic_cast(OBJECT(lpc_bridge), 527 "vfio-pci-igd-lpc-bridge")) { 528 error_report("IGD device %s cannot support legacy mode due to existing " 529 "devices at address 1f.0", vdev->vbasedev.name); 530 return; 531 } 532 533 /* 534 * IGD is not a standard, they like to change their specs often. We 535 * only attempt to support back to SandBridge and we hope that newer 536 * devices maintain compatibility with generation 8. 537 */ 538 gen = igd_gen(vdev); 539 if (gen == -1) { 540 error_report("IGD device %s is unsupported in legacy mode, " 541 "try SandyBridge or newer", vdev->vbasedev.name); 542 return; 543 } 544 545 /* 546 * Most of what we're doing here is to enable the ROM to run, so if 547 * there's no ROM, there's no point in setting up this quirk. 548 * NB. We only seem to get BIOS ROMs, so a UEFI VM would need CSM support. 549 */ 550 ret = vfio_get_region_info(&vdev->vbasedev, 551 VFIO_PCI_ROM_REGION_INDEX, &rom); 552 if ((ret || !rom->size) && !vdev->pdev.romfile) { 553 error_report("IGD device %s has no ROM, legacy mode disabled", 554 vdev->vbasedev.name); 555 return; 556 } 557 558 /* 559 * Ignore the hotplug corner case, mark the ROM failed, we can't 560 * create the devices we need for legacy mode in the hotplug scenario. 561 */ 562 if (vdev->pdev.qdev.hotplugged) { 563 error_report("IGD device %s hotplugged, ROM disabled, " 564 "legacy mode disabled", vdev->vbasedev.name); 565 vdev->rom_read_failed = true; 566 return; 567 } 568 569 /* 570 * Check whether we have all the vfio device specific regions to 571 * support legacy mode (added in Linux v4.6). If not, bail. 572 */ 573 ret = vfio_get_dev_region_info(&vdev->vbasedev, 574 VFIO_REGION_TYPE_PCI_VENDOR_TYPE | PCI_VENDOR_ID_INTEL, 575 VFIO_REGION_SUBTYPE_INTEL_IGD_OPREGION, &opregion); 576 if (ret) { 577 error_report("IGD device %s does not support OpRegion access," 578 "legacy mode disabled", vdev->vbasedev.name); 579 return; 580 } 581 582 ret = vfio_get_dev_region_info(&vdev->vbasedev, 583 VFIO_REGION_TYPE_PCI_VENDOR_TYPE | PCI_VENDOR_ID_INTEL, 584 VFIO_REGION_SUBTYPE_INTEL_IGD_HOST_CFG, &host); 585 if (ret) { 586 error_report("IGD device %s does not support host bridge access," 587 "legacy mode disabled", vdev->vbasedev.name); 588 return; 589 } 590 591 ret = vfio_get_dev_region_info(&vdev->vbasedev, 592 VFIO_REGION_TYPE_PCI_VENDOR_TYPE | PCI_VENDOR_ID_INTEL, 593 VFIO_REGION_SUBTYPE_INTEL_IGD_LPC_CFG, &lpc); 594 if (ret) { 595 error_report("IGD device %s does not support LPC bridge access," 596 "legacy mode disabled", vdev->vbasedev.name); 597 return; 598 } 599 600 gmch = vfio_pci_read_config(&vdev->pdev, IGD_GMCH, 4); 601 602 /* 603 * If IGD VGA Disable is clear (expected) and VGA is not already enabled, 604 * try to enable it. Probably shouldn't be using legacy mode without VGA, 605 * but also no point in us enabling VGA if disabled in hardware. 606 */ 607 if (!(gmch & 0x2) && !vdev->vga && !vfio_populate_vga(vdev, &err)) { 608 error_reportf_err(err, VFIO_MSG_PREFIX, vdev->vbasedev.name); 609 error_report("IGD device %s failed to enable VGA access, " 610 "legacy mode disabled", vdev->vbasedev.name); 611 return; 612 } 613 614 /* Create our LPC/ISA bridge */ 615 ret = vfio_pci_igd_lpc_init(vdev, lpc); 616 if (ret) { 617 error_report("IGD device %s failed to create LPC bridge, " 618 "legacy mode disabled", vdev->vbasedev.name); 619 return; 620 } 621 622 /* Stuff some host values into the VM PCI host bridge */ 623 ret = vfio_pci_igd_host_init(vdev, host); 624 if (ret) { 625 error_report("IGD device %s failed to modify host bridge, " 626 "legacy mode disabled", vdev->vbasedev.name); 627 return; 628 } 629 630 /* Setup OpRegion access */ 631 if (!vfio_pci_igd_opregion_init(vdev, opregion, &err)) { 632 error_append_hint(&err, "IGD legacy mode disabled\n"); 633 error_reportf_err(err, VFIO_MSG_PREFIX, vdev->vbasedev.name); 634 return; 635 } 636 637 /* Setup our quirk to munge GTT addresses to the VM allocated buffer */ 638 quirk = vfio_quirk_alloc(2); 639 igd = quirk->data = g_malloc0(sizeof(*igd)); 640 igd->vdev = vdev; 641 igd->index = ~0; 642 if (gen < 11) { 643 igd->bdsm = vfio_pci_read_config(&vdev->pdev, IGD_BDSM, 4); 644 } else { 645 igd->bdsm = vfio_pci_read_config(&vdev->pdev, IGD_BDSM_GEN11, 4); 646 igd->bdsm |= 647 (uint64_t)vfio_pci_read_config(&vdev->pdev, IGD_BDSM_GEN11 + 4, 4) << 32; 648 } 649 igd->bdsm &= ~((1 * MiB) - 1); /* 1MB aligned */ 650 651 memory_region_init_io(&quirk->mem[0], OBJECT(vdev), &vfio_igd_index_quirk, 652 igd, "vfio-igd-index-quirk", 4); 653 memory_region_add_subregion_overlap(vdev->bars[nr].region.mem, 654 0, &quirk->mem[0], 1); 655 656 memory_region_init_io(&quirk->mem[1], OBJECT(vdev), &vfio_igd_data_quirk, 657 igd, "vfio-igd-data-quirk", 4); 658 memory_region_add_subregion_overlap(vdev->bars[nr].region.mem, 659 4, &quirk->mem[1], 1); 660 661 QLIST_INSERT_HEAD(&vdev->bars[nr].quirks, quirk, next); 662 663 /* 664 * Allow user to override dsm size using x-igd-gms option, in multiples of 665 * 32MiB. This option should only be used when the desired size cannot be 666 * set from DVMT Pre-Allocated option in host BIOS. 667 */ 668 if (vdev->igd_gms) { 669 if (gen < 8) { 670 if (vdev->igd_gms <= 0x10) { 671 gmch &= ~(IGD_GMCH_GEN6_GMS_MASK << IGD_GMCH_GEN6_GMS_SHIFT); 672 gmch |= vdev->igd_gms << IGD_GMCH_GEN6_GMS_SHIFT; 673 } else { 674 error_report(QERR_INVALID_PARAMETER_VALUE, 675 "x-igd-gms", "0~0x10"); 676 } 677 } else { 678 if (vdev->igd_gms <= 0x40) { 679 gmch &= ~(IGD_GMCH_GEN8_GMS_MASK << IGD_GMCH_GEN8_GMS_SHIFT); 680 gmch |= vdev->igd_gms << IGD_GMCH_GEN8_GMS_SHIFT; 681 } else { 682 error_report(QERR_INVALID_PARAMETER_VALUE, 683 "x-igd-gms", "0~0x40"); 684 } 685 } 686 } 687 688 ggms_size = igd_gtt_memory_size(gen, gmch); 689 gms_size = igd_stolen_memory_size(gen, gmch); 690 691 /* 692 * Request reserved memory for stolen memory via fw_cfg. VM firmware 693 * must allocate a 1MB aligned reserved memory region below 4GB with 694 * the requested size (in bytes) for use by the Intel PCI class VGA 695 * device at VM address 00:02.0. The base address of this reserved 696 * memory region must be written to the device BDSM register at PCI 697 * config offset 0x5C. 698 */ 699 bdsm_size = g_malloc(sizeof(*bdsm_size)); 700 *bdsm_size = cpu_to_le64(ggms_size + gms_size); 701 fw_cfg_add_file(fw_cfg_find(), "etc/igd-bdsm-size", 702 bdsm_size, sizeof(*bdsm_size)); 703 704 /* GMCH is read-only, emulated */ 705 pci_set_long(vdev->pdev.config + IGD_GMCH, gmch); 706 pci_set_long(vdev->pdev.wmask + IGD_GMCH, 0); 707 pci_set_long(vdev->emulated_config_bits + IGD_GMCH, ~0); 708 709 /* BDSM is read-write, emulated. The BIOS needs to be able to write it */ 710 if (gen < 11) { 711 pci_set_long(vdev->pdev.config + IGD_BDSM, 0); 712 pci_set_long(vdev->pdev.wmask + IGD_BDSM, ~0); 713 pci_set_long(vdev->emulated_config_bits + IGD_BDSM, ~0); 714 } else { 715 pci_set_quad(vdev->pdev.config + IGD_BDSM_GEN11, 0); 716 pci_set_quad(vdev->pdev.wmask + IGD_BDSM_GEN11, ~0); 717 pci_set_quad(vdev->emulated_config_bits + IGD_BDSM_GEN11, ~0); 718 } 719 720 /* 721 * This IOBAR gives us access to GTTADR, which allows us to write to 722 * the GTT itself. So let's go ahead and write zero to all the GTT 723 * entries to avoid spurious DMA faults. Be sure I/O access is enabled 724 * before talking to the device. 725 */ 726 if (pread(vdev->vbasedev.fd, &cmd_orig, sizeof(cmd_orig), 727 vdev->config_offset + PCI_COMMAND) != sizeof(cmd_orig)) { 728 error_report("IGD device %s - failed to read PCI command register", 729 vdev->vbasedev.name); 730 } 731 732 cmd = cmd_orig | PCI_COMMAND_IO; 733 734 if (pwrite(vdev->vbasedev.fd, &cmd, sizeof(cmd), 735 vdev->config_offset + PCI_COMMAND) != sizeof(cmd)) { 736 error_report("IGD device %s - failed to write PCI command register", 737 vdev->vbasedev.name); 738 } 739 740 for (i = 1; i < vfio_igd_gtt_max(vdev); i += 4) { 741 vfio_region_write(&vdev->bars[4].region, 0, i, 4); 742 vfio_region_write(&vdev->bars[4].region, 4, 0, 4); 743 } 744 745 if (pwrite(vdev->vbasedev.fd, &cmd_orig, sizeof(cmd_orig), 746 vdev->config_offset + PCI_COMMAND) != sizeof(cmd_orig)) { 747 error_report("IGD device %s - failed to restore PCI command register", 748 vdev->vbasedev.name); 749 } 750 751 trace_vfio_pci_igd_bdsm_enabled(vdev->vbasedev.name, 752 (ggms_size + gms_size) / MiB); 753 } 754