Skip to content

Commit

Permalink
q35: implement 128K SMRAM at default SMBASE address
Browse files Browse the repository at this point in the history 
It's not what real HW does, implementing which would be overkill [**]
and would require complex cross stack changes (QEMU+firmware) to make
it work.
So considering that SMRAM is owned by MCH, for simplicity (ab)use
reserved Q35 register, which allows QEMU and firmware easily init
and make RAM at SMBASE available only from SMM context.

Patch uses commit (2f29516 q35/mch: implement extended TSEG sizes)
for inspiration and uses reserved register in config space at 0x9c
offset [*] to extend q35 pci-host with ability to use 128K at
0x30000 as SMRAM and hide it (like TSEG) from non-SMM context.

Usage:
  1: write 0xff in the register
  2: if the feature is supported, follow up read from the register
     should return 0x01. At this point RAM at 0x30000 is still
     available for SMI handler configuration from non-SMM context
  3: writing 0x02 in the register, locks SMBASE area, making its contents
     available only from SMM context. In non-SMM context, reads return
     0xff and writes are ignored. Further writes into the register are
     ignored until the system reset.

*) https://www.mail-archive.com/qemu-devel@nongnu.org/msg455991.html
**) https://www.mail-archive.com/qemu-devel@nongnu.org/msg646965.html

Signed-off-by: Igor Mammedov <imammedo@redhat.com>
Message-Id: <1575896942-331151-3-git-send-email-imammedo@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Tested-by: Laszlo Ersek <lersek@redhat.com>
  • Loading branch information
@mstsirkin
Igor Mammedov authored and mstsirkin committed Jan 22, 2020
1 parent 3e08b2b commit f404220
Show file tree
Hide file tree
Showing 3 changed files with 90 additions and 8 deletions.
4 changes: 3 additions & 1 deletion hw/i386/pc.c
View file
Expand Up @@ -93,7 +93,9 @@
#include "fw_cfg.h"
#include "trace.h"

GlobalProperty pc_compat_4_2[] = {};
GlobalProperty pc_compat_4_2[] = {
{ "mch", "smbase-smram", "off" },
};
const size_t pc_compat_4_2_len = G_N_ELEMENTS(pc_compat_4_2);

GlobalProperty pc_compat_4_1[] = {};
Expand Down
84 changes: 77 additions & 7 deletions hw/pci-host/q35.c
View file
Expand Up @@ -275,20 +275,20 @@ static const TypeInfo q35_host_info = {
* MCH D0:F0
*/

static uint64_t tseg_blackhole_read(void *ptr, hwaddr reg, unsigned size)
static uint64_t blackhole_read(void *ptr, hwaddr reg, unsigned size)
{
return 0xffffffff;
}

static void tseg_blackhole_write(void *opaque, hwaddr addr, uint64_t val,
unsigned width)
static void blackhole_write(void *opaque, hwaddr addr, uint64_t val,
unsigned width)
{
/* nothing */
}

static const MemoryRegionOps tseg_blackhole_ops = {
.read = tseg_blackhole_read,
.write = tseg_blackhole_write,
static const MemoryRegionOps blackhole_ops = {
.read = blackhole_read,
.write = blackhole_write,
.endianness = DEVICE_NATIVE_ENDIAN,
.valid.min_access_size = 1,
.valid.max_access_size = 4,
Expand Down Expand Up @@ -430,6 +430,46 @@ static void mch_update_ext_tseg_mbytes(MCHPCIState *mch)
}
}

static void mch_update_smbase_smram(MCHPCIState *mch)
{
PCIDevice *pd = PCI_DEVICE(mch);
uint8_t *reg = pd->config + MCH_HOST_BRIDGE_F_SMBASE;
bool lck;

if (!mch->has_smram_at_smbase) {
return;
}

if (*reg == MCH_HOST_BRIDGE_F_SMBASE_QUERY) {
pd->wmask[MCH_HOST_BRIDGE_F_SMBASE] =
MCH_HOST_BRIDGE_F_SMBASE_LCK;
*reg = MCH_HOST_BRIDGE_F_SMBASE_IN_RAM;
return;
}

/*
* default/reset state, discard written value
* which will disable SMRAM balackhole at SMBASE
*/
if (pd->wmask[MCH_HOST_BRIDGE_F_SMBASE] == 0xff) {
*reg = 0x00;
}

memory_region_transaction_begin();
if (*reg & MCH_HOST_BRIDGE_F_SMBASE_LCK) {
/* disable all writes */
pd->wmask[MCH_HOST_BRIDGE_F_SMBASE] &=
~MCH_HOST_BRIDGE_F_SMBASE_LCK;
*reg = MCH_HOST_BRIDGE_F_SMBASE_LCK;
lck = true;
} else {
lck = false;
}
memory_region_set_enabled(&mch->smbase_blackhole, lck);
memory_region_set_enabled(&mch->smbase_window, lck);
memory_region_transaction_commit();
}

static void mch_write_config(PCIDevice *d,
uint32_t address, uint32_t val, int len)
{
Expand All @@ -456,6 +496,10 @@ static void mch_write_config(PCIDevice *d,
MCH_HOST_BRIDGE_EXT_TSEG_MBYTES_SIZE)) {
mch_update_ext_tseg_mbytes(mch);
}

if (ranges_overlap(address, len, MCH_HOST_BRIDGE_F_SMBASE, 1)) {
mch_update_smbase_smram(mch);
}
}

static void mch_update(MCHPCIState *mch)
Expand All @@ -464,6 +508,7 @@ static void mch_update(MCHPCIState *mch)
mch_update_pam(mch);
mch_update_smram(mch);
mch_update_ext_tseg_mbytes(mch);
mch_update_smbase_smram(mch);

/*
* pci hole goes from end-of-low-ram to io-apic.
Expand Down Expand Up @@ -514,6 +559,9 @@ static void mch_reset(DeviceState *qdev)
MCH_HOST_BRIDGE_EXT_TSEG_MBYTES_QUERY);
}

d->config[MCH_HOST_BRIDGE_F_SMBASE] = 0;
d->wmask[MCH_HOST_BRIDGE_F_SMBASE] = 0xff;

mch_update(mch);
}

Expand Down Expand Up @@ -563,7 +611,7 @@ static void mch_realize(PCIDevice *d, Error **errp)
memory_region_add_subregion(&mch->smram, 0xfeda0000, &mch->high_smram);

memory_region_init_io(&mch->tseg_blackhole, OBJECT(mch),
&tseg_blackhole_ops, NULL,
&blackhole_ops, NULL,
"tseg-blackhole", 0);
memory_region_set_enabled(&mch->tseg_blackhole, false);
memory_region_add_subregion_overlap(mch->system_memory,
Expand All @@ -575,6 +623,27 @@ static void mch_realize(PCIDevice *d, Error **errp)
memory_region_set_enabled(&mch->tseg_window, false);
memory_region_add_subregion(&mch->smram, mch->below_4g_mem_size,
&mch->tseg_window);

/*
* This is not what hardware does, so it's QEMU specific hack.
* See commit message for details.
*/
memory_region_init_io(&mch->smbase_blackhole, OBJECT(mch), &blackhole_ops,
NULL, "smbase-blackhole",
MCH_HOST_BRIDGE_SMBASE_SIZE);
memory_region_set_enabled(&mch->smbase_blackhole, false);
memory_region_add_subregion_overlap(mch->system_memory,
MCH_HOST_BRIDGE_SMBASE_ADDR,
&mch->smbase_blackhole, 1);

memory_region_init_alias(&mch->smbase_window, OBJECT(mch),
"smbase-window", mch->ram_memory,
MCH_HOST_BRIDGE_SMBASE_ADDR,
MCH_HOST_BRIDGE_SMBASE_SIZE);
memory_region_set_enabled(&mch->smbase_window, false);
memory_region_add_subregion(&mch->smram, MCH_HOST_BRIDGE_SMBASE_ADDR,
&mch->smbase_window);

object_property_add_const_link(qdev_get_machine(), "smram",
OBJECT(&mch->smram), &error_abort);

Expand All @@ -601,6 +670,7 @@ uint64_t mch_mcfg_base(void)
static Property mch_props[] = {
DEFINE_PROP_UINT16("extended-tseg-mbytes", MCHPCIState, ext_tseg_mbytes,
16),
DEFINE_PROP_BOOL("smbase-smram", MCHPCIState, has_smram_at_smbase, true),
DEFINE_PROP_END_OF_LIST(),
};

Expand Down
10 changes: 10 additions & 0 deletions include/hw/pci-host/q35.h
View file
Expand Up @@ -32,6 +32,7 @@
#include "hw/acpi/ich9.h"
#include "hw/pci-host/pam.h"
#include "hw/i386/intel_iommu.h"
#include "qemu/units.h"

#define TYPE_Q35_HOST_DEVICE "q35-pcihost"
#define Q35_HOST_DEVICE(obj) \
Expand All @@ -54,6 +55,8 @@ typedef struct MCHPCIState {
MemoryRegion smram_region, open_high_smram;
MemoryRegion smram, low_smram, high_smram;
MemoryRegion tseg_blackhole, tseg_window;
MemoryRegion smbase_blackhole, smbase_window;
bool has_smram_at_smbase;
Range pci_hole;
uint64_t below_4g_mem_size;
uint64_t above_4g_mem_size;
Expand Down Expand Up @@ -97,6 +100,13 @@ typedef struct Q35PCIHost {
#define MCH_HOST_BRIDGE_EXT_TSEG_MBYTES_QUERY 0xffff
#define MCH_HOST_BRIDGE_EXT_TSEG_MBYTES_MAX 0xfff

#define MCH_HOST_BRIDGE_SMBASE_SIZE (128 * KiB)
#define MCH_HOST_BRIDGE_SMBASE_ADDR 0x30000
#define MCH_HOST_BRIDGE_F_SMBASE 0x9c
#define MCH_HOST_BRIDGE_F_SMBASE_QUERY 0xff
#define MCH_HOST_BRIDGE_F_SMBASE_IN_RAM 0x01
#define MCH_HOST_BRIDGE_F_SMBASE_LCK 0x02

#define MCH_HOST_BRIDGE_PCIEXBAR 0x60 /* 64bit register */
#define MCH_HOST_BRIDGE_PCIEXBAR_SIZE 8 /* 64bit register */
#define MCH_HOST_BRIDGE_PCIEXBAR_DEFAULT 0xb0000000
Expand Down

0 comments on commit f404220

Please sign in to comment.