[Qemu-devel] [PATCH 3/3] vfio-pci: [NOT FOR COMMIT] Hack around HD5450 I/O port backdoor

[Alex Williamson]

This is a hack specific to my system which I haven't even attempted
to generalize yet.  The ATI/AMD Radeon HD5450 VGA BIOS appears to have
a backdoor to determine the physical address of the device.  It reads
a value matching the top byte of the I/O Port BAR from a register in
VGA I/O port space then uses in/out to that address during BIOS
execution.  On my setup the I/O port BAR is at 0x4000 physically and
emulated for the guest at 0xc0000.  So I simply look for this access
and replace 0x40 with 0xc0.  That's enough for it to get through BIOS
init, but it's still only partially functional (no VGA text mode).

Signed-off-by: Alex Williamson <address@hidden>
---
 hw/vfio_pci.c |    9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/hw/vfio_pci.c b/hw/vfio_pci.c
index 846e8de..5db076f 100644
--- a/hw/vfio_pci.c
+++ b/hw/vfio_pci.c
@@ -1041,6 +1041,15 @@ static uint64_t vfio_legacy_read(void *opaque, hwaddr 
addr, unsigned size)
         break;
     }
 
+    /* XXX - Complete hardcoded hack, need to figure out how common this is and
+     * come up with a device quirk and match host phys to guest phys.  This is
+     * only known to be needed for an ATI/AMD Radeon HD5450 which stores the
+     * upper byte of the I/O port address in this unused VGA I/O port register.
+     */
+    if (io->region_offset == 0x3c0 && addr == 3 && size == 1 && data == 0x40) {
+        data = 0xc0;
+    }
+
     DPRINTF("%s(0x%"HWADDR_PRIx", %d) = 0x%"PRIx64"\n",
             __func__, io->region_offset + addr, size, data);