Device Discovery

An introduction to the PCI configuration space registers

In the beginning…

• The original IBM-PC was built using an assortment of off-the-shelf components produced by a variety of manufacturers

• Certain peripheral components were a mandatory part of the design (e.g., timer, keyboard, diskette-drive, etc), while others were considered optional “add-ons” (e.g., color display, floating-point coprocessor, line-printer, modem, mouse, etc)

…there was chaos!

• The PC’s operating system was a mass-produced piece of software (e.g. PC-DOS) that needed to execute successfully on all the different PC equipment configurations

• There had to be a way for the OS to find out which kinds of devices were actually attached to the particular machine it was running on – so it could avoid attempts at using hardware which wasn’t present

The ROM-BIOS POST

• During startup, the ROM-BIOS code did a “Power-On Self-Test” routine to detect the presence of those peripheral components that were standard features of the PC, and also to initialize them where necessary

• For example, the Programmable Interrupt Controller needed its mask-register to be initialized, and the Programmable Interval Timer’s latch-registers needed to be setup

Simplified Block Diagram

CPU main memory

(amount varies) optional

FPUoptional

EMS

system bus

serial 1

serial 2

serial 3

serial 4

keyboard controller

interrupt controller

parallel 1

parallel 2

parallel 3

programmable timer/counter

…plus other peripheral components (not shown)

Components were all different

• There was no standard way to detect the various peripheral devices – each needed its own “non-reusable” code-sequence for discovering it and configuring it to operate

• System programmers had to learn details of the unique designs for all the different possible microprocessors’ capabilities

Older probing methods…

• Originally the IBM PC/AT’s hardware and BIOS supported up to 4 serial-port UARTs (Universal Asynchronous Receiver/Transmitter)

• IBM’s PC designers reserved four I/O-port address-ranges for these devices:– COM1: 0x03F8-0x03FF </dev/ttyS0>– COM2: 0x02F8-0x02FF </dev/ttyS1>– COM3: 0x03E8-0x03EF </dev/ttyS2>– COM4: 0x02E8-0x02EF </dev/ttyS3>

…checked ‘reserved’ ports

• Example: Any 16550 serial-UART device always has a “scratch” register (at offset 7) – a register that performs no functions, but it can be used by programmers to save, and read back, values

• Thus system software can detect the presence of these serial UARTs by attempting to write and read back some test-values at these ‘reserved’ port-locations: if those values can be read back successfully, it means this UART is installed

Probing for 16550 UARTs

ports: .short 0x03F8, 0x02F8, 0x03E8, 0x02E8ndevs: .short 0

# loop to count the number of 16550 serial-port devices installed

xor %esi, %esi # array-index and loop-counternxtry: mov ports(, %esi, 2), %dx # base of port-address range

add $7, %dx # plus offset to scratch-registermov $0x55, %al # setup test-value in ALmov %al, %ah # save copy of test-value in AHoutb %al, %dx # try writing to the scratch registerin %dx, %al # try reading back that test-valuexor %ah, %al # see if these two values agreejne fail # the scratch-register isn’t there!incw ndevs # else count this 16550 UART

fail: incl %esi # advance array-indexcmp $4, %esi # all reserved ranges checked?jb nxtry # no, try next expected location

# when we arrive here, the ‘ndevs’ variable holds the number of UART devices found

Some background on PCI• ISA: Industry Standard Architecture (1981)

• PCI: Peripheral Component Interconnect

• An Intel-backed industry initiative (1992-9)

• Main goals:– Reduce the diversity inherent in legacy ISA– Improve data-xfers to/from peripheral devices– Eliminate (or reduce) platform dependencies– Simplify adding/removing peripheral devices– Lower total consumption of electrical power

PCI Configuration Space

PCI Configuration Space Body(48 doublewords – variable format)

64doublewords

PCI Configuration Space Header(16 doublewords – fixed format)

A non-volatile parameter-storage area for each PCI device-function

Example: Header Type 0

StatusRegister

CommandRegister

DeviceID

VendorID

BISTCacheLineSize

Class CodeClass/SubClass/ProgIF

RevisionID

Base Address 0

SubsystemDevice ID

SubsystemVendor ID

CardBus CIS Pointer

reservedcapabilities

pointer Expansion ROM Base Address

MinimumGrant

InterruptPin

reserved

LatencyTimer

HeaderType

Base Address 1

Base Address 2Base Address 3

Base Address 4Base Address 5

InterruptLine

MaximumLatency

31 0 31 0

16 doublewords

Dwords

1 - 0

3 - 2

5 - 4

7 - 6

9 - 8

11 - 10

13 - 12

15 - 14

The ‘Header Type’ field

Header Type

Multi-FunctionDevice

flag

7 6 0

0 = Single-Function Device1 = Multi-Function Device

Configuration Header Format ID

reserved

Interface to PCI Configuration Space

CONFADD( 0x0CF8)

CONFDAT( 0x0CFC)

31 23 16 15 11 10 8 7 2 0

EN

bus(8-bits)

device(5-bits)

doubleword (6-bits)

function(3-bits) 00

PCI Configuration Space Address Port (32-bits)

PCI Configuration Space Data Port (32-bits)

31 0

Enable Configuration Space Mapping (1=yes, 0=no)

Reading PCI Configuration Data

• Step one: Output the desired longword’s address (bus, device, function, and dword) with bit 31 set to 1 (to enable access) to the Configuration-Space Address-Port

• Step two: Read the designated data from the Configuration-Space Data-Port:# read the PCI Header-Type field (byte 2 of dword 3) for bus=0, device=0, function=0

movl $0x8000000C, %eax # setup address in EAXmovw $0x0CF8, %dx # setup port-number in DX outl %eax, %dx # output address to port

mov $0x0CFC, %dx # setup port-number in DXinl %dx, %eax # input configuration longwordshr $16, %eax # shift word 2 into AL registermovb %al, header_type # store Header Type in variable

Examples of VENDOR-IDs

• 0x8086 – Intel Corporation• 0x1022 – Advanced Micro Devices, Inc• 0x1002 – Advanced Technologies, Inc• 0x10EC – RealTek, Incorporated • 0x10DE – Nvidia Corporation• 0x10B7 – 3Com Corporation• 0x101C – Western Digital, Inc• 0x1014 – IBM Corporation• 0x0E11 – Compaq Corporation• 0x1057 – Motorola Corporation• 0x106B – Apple Computers, Inc• 0x5333 – Silicon Integrated Systems, Inc

Examples of DEVICE-IDs

• 0x5347: ATI RAGE128 SG• 0x4C58: ATI RADEON LX• 0x5950: ATI RS480• 0x436E: ATI IXP300 SATA• 0x438C: ATI IXP600 IDE

See this Linux header-file for lots more:</usr/src/linux/include/linux/pci_ids.h>

Defined PCI Class Codes• 0x00: Legacy Device (i.e., built before class-codes were defined)• 0x01: Mass Storage controller • 0x02: Network controller• 0x03: Display controller• 0x04: Multimedia device• 0x05: Memory Controller• 0x06: Bridge device• 0x07: Simple Communications controller• 0x08: Base System peripherals• 0x09: Input device• 0x0A: Docking stations• 0x0B: Processors• 0x0C: Serial Bus controllers• 0x0D: Wireless controllers• 0x0E: Intelligent I/O controllers • 0x0F: Encryption/Decryption controllers• 0x10: Satellite Communications controllers• 0x11: Data Acquisition and Signal Processing controllers

Example of Sub-Class Codes

• Class Code 0x01: Mass Storage controller– 0x00: SCSI controller– 0x01: IDE controller– 0x02: Floppy Disk controller– 0x03: IPI controller– 0x04: RAID controller– 0x80: Other Mass Storage controller

Example of Sub-Class Codes

• Class Code 0x02: Network controller– 0x00: Ethernet controller– 0x01: Token Ring controller– 0x02: FDDI controller– 0x03: ATM controller– 0x04: ISDN controller– 0x80: Other Network controller

Using the BIOS PCI services

• To assist system software authors in doing “device detection”, the PC’s ROM-BIOS now includes service-functions that search for particular devices or classes of devices

• These service-functions are invoked while in real-mode via software interrupt 0x1A, with function-number 0xB1 in register AH and with a PCI sub-function ID-number in register AL (about a dozen sub-functions)

PCI BIOS example

• Search for your PC’s ethernet controller (Device Class is 0x02, Sub-Class is 0x00)# code-example: Finding the Vendor-ID for your computer’s ethernet controller

mov $0xB103, %ax # PCI Find Class functionmov $0x020000, %ecx # PCI Class (network/ethernet)xor %esi, %esi # initialize search indexint $0x1A # request BIOS servicejnc found # function was successfuljmp error # else the function failed

found:# if successful, BX = bus/device/function mov $0xB109, %ax # PCI Read Configuration Wordmov $0x0000, %di # PCI Register-Number int $0x1A # request BIOS servicejc success # vendor-ID is in register CXjmp error # else the function failed

# NOTE: This code was written for execution while the Pentium is in real-mode

Some references

• Professor Ralf Brown’s Interrupt List (see the online link on our CS630 website)

• Tom Shanley and Don Anderson,

“PCI System Architecture (4th Edition),”

MindShare, Inc. (Addison-Wesley, 1999)

Demo Program

• We created a short Linux utility that searches for a system’s PCI devices (named “pciprobe.cpp” on CS630 website)

• It uses some C++ macros that expand to Intel input/output instructions -- which normally are ‘privileged’ instructions that a Linux application-program is not allowed to execute (segfault!)

• Our system administrator (Alex Fedosov) has created a utility (named “iopl3”) that will allow your command-shell to acquire root privileges

In-Class Exercise

• After you have experimented with running the “pciprobe.cpp” utility (be sure you run the “iopl3” program first), see if you can modify “pciprobe” so that it will display the Class Code for each PCI device-function that it identifies as being present

• This will give you practice in reading some useful data from PCI Configuration Space