1 /* 2 * Copyright (C) 2012 Red Hat, Inc. All rights reserved. 3 * Author: Alex Williamson <alex.williamson@redhat.com> 4 * 5 * This program is free software; you can redistribute it and/or modify 6 * it under the terms of the GNU General Public License version 2 as 7 * published by the Free Software Foundation. 8 * 9 * Derived from original vfio: 10 * Copyright 2010 Cisco Systems, Inc. All rights reserved. 11 * Author: Tom Lyon, pugs@cisco.com 12 */ 13 14 #include <linux/device.h> 15 #include <linux/eventfd.h> 16 #include <linux/interrupt.h> 17 #include <linux/iommu.h> 18 #include <linux/module.h> 19 #include <linux/mutex.h> 20 #include <linux/notifier.h> 21 #include <linux/pci.h> 22 #include <linux/pm_runtime.h> 23 #include <linux/slab.h> 24 #include <linux/types.h> 25 #include <linux/uaccess.h> 26 #include <linux/vfio.h> 27 28 #include "vfio_pci_private.h" 29 30 #define DRIVER_VERSION "0.2" 31 #define DRIVER_AUTHOR "Alex Williamson <alex.williamson@redhat.com>" 32 #define DRIVER_DESC "VFIO PCI - User Level meta-driver" 33 34 static bool nointxmask; 35 module_param_named(nointxmask, nointxmask, bool, S_IRUGO | S_IWUSR); 36 MODULE_PARM_DESC(nointxmask, 37 "Disable support for PCI 2.3 style INTx masking. If this resolves problems for specific devices, report lspci -vvvxxx to linux-pci@vger.kernel.org so the device can be fixed automatically via the broken_intx_masking flag."); 38 39 static int vfio_pci_enable(struct vfio_pci_device *vdev) 40 { 41 struct pci_dev *pdev = vdev->pdev; 42 int ret; 43 u16 cmd; 44 u8 msix_pos; 45 46 ret = pci_enable_device(pdev); 47 if (ret) 48 return ret; 49 50 vdev->reset_works = (pci_reset_function(pdev) == 0); 51 pci_save_state(pdev); 52 vdev->pci_saved_state = pci_store_saved_state(pdev); 53 if (!vdev->pci_saved_state) 54 pr_debug("%s: Couldn't store %s saved state\n", 55 __func__, dev_name(&pdev->dev)); 56 57 ret = vfio_config_init(vdev); 58 if (ret) { 59 pci_load_and_free_saved_state(pdev, &vdev->pci_saved_state); 60 pci_disable_device(pdev); 61 return ret; 62 } 63 64 if (likely(!nointxmask)) 65 vdev->pci_2_3 = pci_intx_mask_supported(pdev); 66 67 pci_read_config_word(pdev, PCI_COMMAND, &cmd); 68 if (vdev->pci_2_3 && (cmd & PCI_COMMAND_INTX_DISABLE)) { 69 cmd &= ~PCI_COMMAND_INTX_DISABLE; 70 pci_write_config_word(pdev, PCI_COMMAND, cmd); 71 } 72 73 msix_pos = pdev->msix_cap; 74 if (msix_pos) { 75 u16 flags; 76 u32 table; 77 78 pci_read_config_word(pdev, msix_pos + PCI_MSIX_FLAGS, &flags); 79 pci_read_config_dword(pdev, msix_pos + PCI_MSIX_TABLE, &table); 80 81 vdev->msix_bar = table & PCI_MSIX_TABLE_BIR; 82 vdev->msix_offset = table & PCI_MSIX_TABLE_OFFSET; 83 vdev->msix_size = ((flags & PCI_MSIX_FLAGS_QSIZE) + 1) * 16; 84 } else 85 vdev->msix_bar = 0xFF; 86 87 #ifdef CONFIG_VFIO_PCI_VGA 88 if ((pdev->class >> 8) == PCI_CLASS_DISPLAY_VGA) 89 vdev->has_vga = true; 90 #endif 91 92 return 0; 93 } 94 95 static void vfio_pci_disable(struct vfio_pci_device *vdev) 96 { 97 struct pci_dev *pdev = vdev->pdev; 98 int bar; 99 100 pci_disable_device(pdev); 101 102 vfio_pci_set_irqs_ioctl(vdev, VFIO_IRQ_SET_DATA_NONE | 103 VFIO_IRQ_SET_ACTION_TRIGGER, 104 vdev->irq_type, 0, 0, NULL); 105 106 vdev->virq_disabled = false; 107 108 vfio_config_free(vdev); 109 110 for (bar = PCI_STD_RESOURCES; bar <= PCI_STD_RESOURCE_END; bar++) { 111 if (!vdev->barmap[bar]) 112 continue; 113 pci_iounmap(pdev, vdev->barmap[bar]); 114 pci_release_selected_regions(pdev, 1 << bar); 115 vdev->barmap[bar] = NULL; 116 } 117 118 /* 119 * If we have saved state, restore it. If we can reset the device, 120 * even better. Resetting with current state seems better than 121 * nothing, but saving and restoring current state without reset 122 * is just busy work. 123 */ 124 if (pci_load_and_free_saved_state(pdev, &vdev->pci_saved_state)) { 125 pr_info("%s: Couldn't reload %s saved state\n", 126 __func__, dev_name(&pdev->dev)); 127 128 if (!vdev->reset_works) 129 return; 130 131 pci_save_state(pdev); 132 } 133 134 /* 135 * Disable INTx and MSI, presumably to avoid spurious interrupts 136 * during reset. Stolen from pci_reset_function() 137 */ 138 pci_write_config_word(pdev, PCI_COMMAND, PCI_COMMAND_INTX_DISABLE); 139 140 /* 141 * Careful, device_lock may already be held. This is the case if 142 * a driver unbind is blocked. Try to get the locks ourselves to 143 * prevent a deadlock. 144 */ 145 if (vdev->reset_works) { 146 bool reset_done = false; 147 148 if (pci_cfg_access_trylock(pdev)) { 149 if (device_trylock(&pdev->dev)) { 150 __pci_reset_function_locked(pdev); 151 reset_done = true; 152 device_unlock(&pdev->dev); 153 } 154 pci_cfg_access_unlock(pdev); 155 } 156 157 if (!reset_done) 158 pr_warn("%s: Unable to acquire locks for reset of %s\n", 159 __func__, dev_name(&pdev->dev)); 160 } 161 162 pci_restore_state(pdev); 163 } 164 165 static void vfio_pci_release(void *device_data) 166 { 167 struct vfio_pci_device *vdev = device_data; 168 169 if (atomic_dec_and_test(&vdev->refcnt)) 170 vfio_pci_disable(vdev); 171 172 module_put(THIS_MODULE); 173 } 174 175 static int vfio_pci_open(void *device_data) 176 { 177 struct vfio_pci_device *vdev = device_data; 178 179 if (!try_module_get(THIS_MODULE)) 180 return -ENODEV; 181 182 if (atomic_inc_return(&vdev->refcnt) == 1) { 183 int ret = vfio_pci_enable(vdev); 184 if (ret) { 185 module_put(THIS_MODULE); 186 return ret; 187 } 188 } 189 190 return 0; 191 } 192 193 static int vfio_pci_get_irq_count(struct vfio_pci_device *vdev, int irq_type) 194 { 195 if (irq_type == VFIO_PCI_INTX_IRQ_INDEX) { 196 u8 pin; 197 pci_read_config_byte(vdev->pdev, PCI_INTERRUPT_PIN, &pin); 198 if (pin) 199 return 1; 200 201 } else if (irq_type == VFIO_PCI_MSI_IRQ_INDEX) { 202 u8 pos; 203 u16 flags; 204 205 pos = vdev->pdev->msi_cap; 206 if (pos) { 207 pci_read_config_word(vdev->pdev, 208 pos + PCI_MSI_FLAGS, &flags); 209 210 return 1 << (flags & PCI_MSI_FLAGS_QMASK); 211 } 212 } else if (irq_type == VFIO_PCI_MSIX_IRQ_INDEX) { 213 u8 pos; 214 u16 flags; 215 216 pos = vdev->pdev->msix_cap; 217 if (pos) { 218 pci_read_config_word(vdev->pdev, 219 pos + PCI_MSIX_FLAGS, &flags); 220 221 return (flags & PCI_MSIX_FLAGS_QSIZE) + 1; 222 } 223 } else if (irq_type == VFIO_PCI_ERR_IRQ_INDEX) 224 if (pci_is_pcie(vdev->pdev)) 225 return 1; 226 227 return 0; 228 } 229 230 static long vfio_pci_ioctl(void *device_data, 231 unsigned int cmd, unsigned long arg) 232 { 233 struct vfio_pci_device *vdev = device_data; 234 unsigned long minsz; 235 236 if (cmd == VFIO_DEVICE_GET_INFO) { 237 struct vfio_device_info info; 238 239 minsz = offsetofend(struct vfio_device_info, num_irqs); 240 241 if (copy_from_user(&info, (void __user *)arg, minsz)) 242 return -EFAULT; 243 244 if (info.argsz < minsz) 245 return -EINVAL; 246 247 info.flags = VFIO_DEVICE_FLAGS_PCI; 248 249 if (vdev->reset_works) 250 info.flags |= VFIO_DEVICE_FLAGS_RESET; 251 252 info.num_regions = VFIO_PCI_NUM_REGIONS; 253 info.num_irqs = VFIO_PCI_NUM_IRQS; 254 255 return copy_to_user((void __user *)arg, &info, minsz); 256 257 } else if (cmd == VFIO_DEVICE_GET_REGION_INFO) { 258 struct pci_dev *pdev = vdev->pdev; 259 struct vfio_region_info info; 260 261 minsz = offsetofend(struct vfio_region_info, offset); 262 263 if (copy_from_user(&info, (void __user *)arg, minsz)) 264 return -EFAULT; 265 266 if (info.argsz < minsz) 267 return -EINVAL; 268 269 switch (info.index) { 270 case VFIO_PCI_CONFIG_REGION_INDEX: 271 info.offset = VFIO_PCI_INDEX_TO_OFFSET(info.index); 272 info.size = pdev->cfg_size; 273 info.flags = VFIO_REGION_INFO_FLAG_READ | 274 VFIO_REGION_INFO_FLAG_WRITE; 275 break; 276 case VFIO_PCI_BAR0_REGION_INDEX ... VFIO_PCI_BAR5_REGION_INDEX: 277 info.offset = VFIO_PCI_INDEX_TO_OFFSET(info.index); 278 info.size = pci_resource_len(pdev, info.index); 279 if (!info.size) { 280 info.flags = 0; 281 break; 282 } 283 284 info.flags = VFIO_REGION_INFO_FLAG_READ | 285 VFIO_REGION_INFO_FLAG_WRITE; 286 if (pci_resource_flags(pdev, info.index) & 287 IORESOURCE_MEM && info.size >= PAGE_SIZE) 288 info.flags |= VFIO_REGION_INFO_FLAG_MMAP; 289 break; 290 case VFIO_PCI_ROM_REGION_INDEX: 291 { 292 void __iomem *io; 293 size_t size; 294 295 info.offset = VFIO_PCI_INDEX_TO_OFFSET(info.index); 296 info.flags = 0; 297 298 /* Report the BAR size, not the ROM size */ 299 info.size = pci_resource_len(pdev, info.index); 300 if (!info.size) 301 break; 302 303 /* Is it really there? */ 304 io = pci_map_rom(pdev, &size); 305 if (!io || !size) { 306 info.size = 0; 307 break; 308 } 309 pci_unmap_rom(pdev, io); 310 311 info.flags = VFIO_REGION_INFO_FLAG_READ; 312 break; 313 } 314 case VFIO_PCI_VGA_REGION_INDEX: 315 if (!vdev->has_vga) 316 return -EINVAL; 317 318 info.offset = VFIO_PCI_INDEX_TO_OFFSET(info.index); 319 info.size = 0xc0000; 320 info.flags = VFIO_REGION_INFO_FLAG_READ | 321 VFIO_REGION_INFO_FLAG_WRITE; 322 323 break; 324 default: 325 return -EINVAL; 326 } 327 328 return copy_to_user((void __user *)arg, &info, minsz); 329 330 } else if (cmd == VFIO_DEVICE_GET_IRQ_INFO) { 331 struct vfio_irq_info info; 332 333 minsz = offsetofend(struct vfio_irq_info, count); 334 335 if (copy_from_user(&info, (void __user *)arg, minsz)) 336 return -EFAULT; 337 338 if (info.argsz < minsz || info.index >= VFIO_PCI_NUM_IRQS) 339 return -EINVAL; 340 341 switch (info.index) { 342 case VFIO_PCI_INTX_IRQ_INDEX ... VFIO_PCI_MSIX_IRQ_INDEX: 343 break; 344 case VFIO_PCI_ERR_IRQ_INDEX: 345 if (pci_is_pcie(vdev->pdev)) 346 break; 347 /* pass thru to return error */ 348 default: 349 return -EINVAL; 350 } 351 352 info.flags = VFIO_IRQ_INFO_EVENTFD; 353 354 info.count = vfio_pci_get_irq_count(vdev, info.index); 355 356 if (info.index == VFIO_PCI_INTX_IRQ_INDEX) 357 info.flags |= (VFIO_IRQ_INFO_MASKABLE | 358 VFIO_IRQ_INFO_AUTOMASKED); 359 else 360 info.flags |= VFIO_IRQ_INFO_NORESIZE; 361 362 return copy_to_user((void __user *)arg, &info, minsz); 363 364 } else if (cmd == VFIO_DEVICE_SET_IRQS) { 365 struct vfio_irq_set hdr; 366 u8 *data = NULL; 367 int ret = 0; 368 369 minsz = offsetofend(struct vfio_irq_set, count); 370 371 if (copy_from_user(&hdr, (void __user *)arg, minsz)) 372 return -EFAULT; 373 374 if (hdr.argsz < minsz || hdr.index >= VFIO_PCI_NUM_IRQS || 375 hdr.flags & ~(VFIO_IRQ_SET_DATA_TYPE_MASK | 376 VFIO_IRQ_SET_ACTION_TYPE_MASK)) 377 return -EINVAL; 378 379 if (!(hdr.flags & VFIO_IRQ_SET_DATA_NONE)) { 380 size_t size; 381 int max = vfio_pci_get_irq_count(vdev, hdr.index); 382 383 if (hdr.flags & VFIO_IRQ_SET_DATA_BOOL) 384 size = sizeof(uint8_t); 385 else if (hdr.flags & VFIO_IRQ_SET_DATA_EVENTFD) 386 size = sizeof(int32_t); 387 else 388 return -EINVAL; 389 390 if (hdr.argsz - minsz < hdr.count * size || 391 hdr.start >= max || hdr.start + hdr.count > max) 392 return -EINVAL; 393 394 data = memdup_user((void __user *)(arg + minsz), 395 hdr.count * size); 396 if (IS_ERR(data)) 397 return PTR_ERR(data); 398 } 399 400 mutex_lock(&vdev->igate); 401 402 ret = vfio_pci_set_irqs_ioctl(vdev, hdr.flags, hdr.index, 403 hdr.start, hdr.count, data); 404 405 mutex_unlock(&vdev->igate); 406 kfree(data); 407 408 return ret; 409 410 } else if (cmd == VFIO_DEVICE_RESET) 411 return vdev->reset_works ? 412 pci_reset_function(vdev->pdev) : -EINVAL; 413 414 return -ENOTTY; 415 } 416 417 static ssize_t vfio_pci_rw(void *device_data, char __user *buf, 418 size_t count, loff_t *ppos, bool iswrite) 419 { 420 unsigned int index = VFIO_PCI_OFFSET_TO_INDEX(*ppos); 421 struct vfio_pci_device *vdev = device_data; 422 423 if (index >= VFIO_PCI_NUM_REGIONS) 424 return -EINVAL; 425 426 switch (index) { 427 case VFIO_PCI_CONFIG_REGION_INDEX: 428 return vfio_pci_config_rw(vdev, buf, count, ppos, iswrite); 429 430 case VFIO_PCI_ROM_REGION_INDEX: 431 if (iswrite) 432 return -EINVAL; 433 return vfio_pci_bar_rw(vdev, buf, count, ppos, false); 434 435 case VFIO_PCI_BAR0_REGION_INDEX ... VFIO_PCI_BAR5_REGION_INDEX: 436 return vfio_pci_bar_rw(vdev, buf, count, ppos, iswrite); 437 438 case VFIO_PCI_VGA_REGION_INDEX: 439 return vfio_pci_vga_rw(vdev, buf, count, ppos, iswrite); 440 } 441 442 return -EINVAL; 443 } 444 445 static ssize_t vfio_pci_read(void *device_data, char __user *buf, 446 size_t count, loff_t *ppos) 447 { 448 if (!count) 449 return 0; 450 451 return vfio_pci_rw(device_data, buf, count, ppos, false); 452 } 453 454 static ssize_t vfio_pci_write(void *device_data, const char __user *buf, 455 size_t count, loff_t *ppos) 456 { 457 if (!count) 458 return 0; 459 460 return vfio_pci_rw(device_data, (char __user *)buf, count, ppos, true); 461 } 462 463 static int vfio_pci_mmap(void *device_data, struct vm_area_struct *vma) 464 { 465 struct vfio_pci_device *vdev = device_data; 466 struct pci_dev *pdev = vdev->pdev; 467 unsigned int index; 468 u64 phys_len, req_len, pgoff, req_start; 469 int ret; 470 471 index = vma->vm_pgoff >> (VFIO_PCI_OFFSET_SHIFT - PAGE_SHIFT); 472 473 if (vma->vm_end < vma->vm_start) 474 return -EINVAL; 475 if ((vma->vm_flags & VM_SHARED) == 0) 476 return -EINVAL; 477 if (index >= VFIO_PCI_ROM_REGION_INDEX) 478 return -EINVAL; 479 if (!(pci_resource_flags(pdev, index) & IORESOURCE_MEM)) 480 return -EINVAL; 481 482 phys_len = pci_resource_len(pdev, index); 483 req_len = vma->vm_end - vma->vm_start; 484 pgoff = vma->vm_pgoff & 485 ((1U << (VFIO_PCI_OFFSET_SHIFT - PAGE_SHIFT)) - 1); 486 req_start = pgoff << PAGE_SHIFT; 487 488 if (phys_len < PAGE_SIZE || req_start + req_len > phys_len) 489 return -EINVAL; 490 491 if (index == vdev->msix_bar) { 492 /* 493 * Disallow mmaps overlapping the MSI-X table; users don't 494 * get to touch this directly. We could find somewhere 495 * else to map the overlap, but page granularity is only 496 * a recommendation, not a requirement, so the user needs 497 * to know which bits are real. Requiring them to mmap 498 * around the table makes that clear. 499 */ 500 501 /* If neither entirely above nor below, then it overlaps */ 502 if (!(req_start >= vdev->msix_offset + vdev->msix_size || 503 req_start + req_len <= vdev->msix_offset)) 504 return -EINVAL; 505 } 506 507 /* 508 * Even though we don't make use of the barmap for the mmap, 509 * we need to request the region and the barmap tracks that. 510 */ 511 if (!vdev->barmap[index]) { 512 ret = pci_request_selected_regions(pdev, 513 1 << index, "vfio-pci"); 514 if (ret) 515 return ret; 516 517 vdev->barmap[index] = pci_iomap(pdev, index, 0); 518 } 519 520 vma->vm_private_data = vdev; 521 vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot); 522 vma->vm_pgoff = (pci_resource_start(pdev, index) >> PAGE_SHIFT) + pgoff; 523 524 return remap_pfn_range(vma, vma->vm_start, vma->vm_pgoff, 525 req_len, vma->vm_page_prot); 526 } 527 528 static const struct vfio_device_ops vfio_pci_ops = { 529 .name = "vfio-pci", 530 .open = vfio_pci_open, 531 .release = vfio_pci_release, 532 .ioctl = vfio_pci_ioctl, 533 .read = vfio_pci_read, 534 .write = vfio_pci_write, 535 .mmap = vfio_pci_mmap, 536 }; 537 538 static int vfio_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id) 539 { 540 u8 type; 541 struct vfio_pci_device *vdev; 542 struct iommu_group *group; 543 int ret; 544 545 pci_read_config_byte(pdev, PCI_HEADER_TYPE, &type); 546 if ((type & PCI_HEADER_TYPE) != PCI_HEADER_TYPE_NORMAL) 547 return -EINVAL; 548 549 group = iommu_group_get(&pdev->dev); 550 if (!group) 551 return -EINVAL; 552 553 vdev = kzalloc(sizeof(*vdev), GFP_KERNEL); 554 if (!vdev) { 555 iommu_group_put(group); 556 return -ENOMEM; 557 } 558 559 vdev->pdev = pdev; 560 vdev->irq_type = VFIO_PCI_NUM_IRQS; 561 mutex_init(&vdev->igate); 562 spin_lock_init(&vdev->irqlock); 563 atomic_set(&vdev->refcnt, 0); 564 565 ret = vfio_add_group_dev(&pdev->dev, &vfio_pci_ops, vdev); 566 if (ret) { 567 iommu_group_put(group); 568 kfree(vdev); 569 } 570 571 return ret; 572 } 573 574 static void vfio_pci_remove(struct pci_dev *pdev) 575 { 576 struct vfio_pci_device *vdev; 577 578 vdev = vfio_del_group_dev(&pdev->dev); 579 if (!vdev) 580 return; 581 582 iommu_group_put(pdev->dev.iommu_group); 583 kfree(vdev); 584 } 585 586 static pci_ers_result_t vfio_pci_aer_err_detected(struct pci_dev *pdev, 587 pci_channel_state_t state) 588 { 589 struct vfio_pci_device *vdev; 590 struct vfio_device *device; 591 592 device = vfio_device_get_from_dev(&pdev->dev); 593 if (device == NULL) 594 return PCI_ERS_RESULT_DISCONNECT; 595 596 vdev = vfio_device_data(device); 597 if (vdev == NULL) { 598 vfio_device_put(device); 599 return PCI_ERS_RESULT_DISCONNECT; 600 } 601 602 if (vdev->err_trigger) 603 eventfd_signal(vdev->err_trigger, 1); 604 605 vfio_device_put(device); 606 607 return PCI_ERS_RESULT_CAN_RECOVER; 608 } 609 610 static struct pci_error_handlers vfio_err_handlers = { 611 .error_detected = vfio_pci_aer_err_detected, 612 }; 613 614 static struct pci_driver vfio_pci_driver = { 615 .name = "vfio-pci", 616 .id_table = NULL, /* only dynamic ids */ 617 .probe = vfio_pci_probe, 618 .remove = vfio_pci_remove, 619 .err_handler = &vfio_err_handlers, 620 }; 621 622 static void __exit vfio_pci_cleanup(void) 623 { 624 pci_unregister_driver(&vfio_pci_driver); 625 vfio_pci_virqfd_exit(); 626 vfio_pci_uninit_perm_bits(); 627 } 628 629 static int __init vfio_pci_init(void) 630 { 631 int ret; 632 633 /* Allocate shared config space permision data used by all devices */ 634 ret = vfio_pci_init_perm_bits(); 635 if (ret) 636 return ret; 637 638 /* Start the virqfd cleanup handler */ 639 ret = vfio_pci_virqfd_init(); 640 if (ret) 641 goto out_virqfd; 642 643 /* Register and scan for devices */ 644 ret = pci_register_driver(&vfio_pci_driver); 645 if (ret) 646 goto out_driver; 647 648 return 0; 649 650 out_driver: 651 vfio_pci_virqfd_exit(); 652 out_virqfd: 653 vfio_pci_uninit_perm_bits(); 654 return ret; 655 } 656 657 module_init(vfio_pci_init); 658 module_exit(vfio_pci_cleanup); 659 660 MODULE_VERSION(DRIVER_VERSION); 661 MODULE_LICENSE("GPL v2"); 662 MODULE_AUTHOR(DRIVER_AUTHOR); 663 MODULE_DESCRIPTION(DRIVER_DESC); 664