xref: /openbmc/qemu/hw/vfio/container.c (revision fb6051e7)
1 /*
2  * generic functions used by VFIO devices
3  *
4  * Copyright Red Hat, Inc. 2012
5  *
6  * Authors:
7  *  Alex Williamson <alex.williamson@redhat.com>
8  *
9  * This work is licensed under the terms of the GNU GPL, version 2.  See
10  * the COPYING file in the top-level directory.
11  *
12  * Based on qemu-kvm device-assignment:
13  *  Adapted for KVM by Qumranet.
14  *  Copyright (c) 2007, Neocleus, Alex Novik (alex@neocleus.com)
15  *  Copyright (c) 2007, Neocleus, Guy Zana (guy@neocleus.com)
16  *  Copyright (C) 2008, Qumranet, Amit Shah (amit.shah@qumranet.com)
17  *  Copyright (C) 2008, Red Hat, Amit Shah (amit.shah@redhat.com)
18  *  Copyright (C) 2008, IBM, Muli Ben-Yehuda (muli@il.ibm.com)
19  */
20 
21 #include "qemu/osdep.h"
22 #include <sys/ioctl.h>
23 #include <linux/vfio.h>
24 
25 #include "hw/vfio/vfio-common.h"
26 #include "exec/address-spaces.h"
27 #include "exec/memory.h"
28 #include "exec/ram_addr.h"
29 #include "qemu/error-report.h"
30 #include "qemu/range.h"
31 #include "sysemu/reset.h"
32 #include "trace.h"
33 #include "qapi/error.h"
34 #include "pci.h"
35 
36 VFIOGroupList vfio_group_list =
37     QLIST_HEAD_INITIALIZER(vfio_group_list);
38 
39 static int vfio_ram_block_discard_disable(VFIOContainer *container, bool state)
40 {
41     switch (container->iommu_type) {
42     case VFIO_TYPE1v2_IOMMU:
43     case VFIO_TYPE1_IOMMU:
44         /*
45          * We support coordinated discarding of RAM via the RamDiscardManager.
46          */
47         return ram_block_uncoordinated_discard_disable(state);
48     default:
49         /*
50          * VFIO_SPAPR_TCE_IOMMU most probably works just fine with
51          * RamDiscardManager, however, it is completely untested.
52          *
53          * VFIO_SPAPR_TCE_v2_IOMMU with "DMA memory preregistering" does
54          * completely the opposite of managing mapping/pinning dynamically as
55          * required by RamDiscardManager. We would have to special-case sections
56          * with a RamDiscardManager.
57          */
58         return ram_block_discard_disable(state);
59     }
60 }
61 
62 static int vfio_dma_unmap_bitmap(const VFIOContainer *container,
63                                  hwaddr iova, ram_addr_t size,
64                                  IOMMUTLBEntry *iotlb)
65 {
66     const VFIOContainerBase *bcontainer = &container->bcontainer;
67     struct vfio_iommu_type1_dma_unmap *unmap;
68     struct vfio_bitmap *bitmap;
69     VFIOBitmap vbmap;
70     int ret;
71 
72     ret = vfio_bitmap_alloc(&vbmap, size);
73     if (ret) {
74         return ret;
75     }
76 
77     unmap = g_malloc0(sizeof(*unmap) + sizeof(*bitmap));
78 
79     unmap->argsz = sizeof(*unmap) + sizeof(*bitmap);
80     unmap->iova = iova;
81     unmap->size = size;
82     unmap->flags |= VFIO_DMA_UNMAP_FLAG_GET_DIRTY_BITMAP;
83     bitmap = (struct vfio_bitmap *)&unmap->data;
84 
85     /*
86      * cpu_physical_memory_set_dirty_lebitmap() supports pages in bitmap of
87      * qemu_real_host_page_size to mark those dirty. Hence set bitmap_pgsize
88      * to qemu_real_host_page_size.
89      */
90     bitmap->pgsize = qemu_real_host_page_size();
91     bitmap->size = vbmap.size;
92     bitmap->data = (__u64 *)vbmap.bitmap;
93 
94     if (vbmap.size > bcontainer->max_dirty_bitmap_size) {
95         error_report("UNMAP: Size of bitmap too big 0x%"PRIx64, vbmap.size);
96         ret = -E2BIG;
97         goto unmap_exit;
98     }
99 
100     ret = ioctl(container->fd, VFIO_IOMMU_UNMAP_DMA, unmap);
101     if (!ret) {
102         cpu_physical_memory_set_dirty_lebitmap(vbmap.bitmap,
103                 iotlb->translated_addr, vbmap.pages);
104     } else {
105         error_report("VFIO_UNMAP_DMA with DIRTY_BITMAP : %m");
106     }
107 
108 unmap_exit:
109     g_free(unmap);
110     g_free(vbmap.bitmap);
111 
112     return ret;
113 }
114 
115 /*
116  * DMA - Mapping and unmapping for the "type1" IOMMU interface used on x86
117  */
118 static int vfio_legacy_dma_unmap(const VFIOContainerBase *bcontainer,
119                                  hwaddr iova, ram_addr_t size,
120                                  IOMMUTLBEntry *iotlb)
121 {
122     const VFIOContainer *container = container_of(bcontainer, VFIOContainer,
123                                                   bcontainer);
124     struct vfio_iommu_type1_dma_unmap unmap = {
125         .argsz = sizeof(unmap),
126         .flags = 0,
127         .iova = iova,
128         .size = size,
129     };
130     bool need_dirty_sync = false;
131     int ret;
132     Error *local_err = NULL;
133 
134     if (iotlb && vfio_devices_all_running_and_mig_active(bcontainer)) {
135         if (!vfio_devices_all_device_dirty_tracking(bcontainer) &&
136             bcontainer->dirty_pages_supported) {
137             return vfio_dma_unmap_bitmap(container, iova, size, iotlb);
138         }
139 
140         need_dirty_sync = true;
141     }
142 
143     while (ioctl(container->fd, VFIO_IOMMU_UNMAP_DMA, &unmap)) {
144         /*
145          * The type1 backend has an off-by-one bug in the kernel (71a7d3d78e3c
146          * v4.15) where an overflow in its wrap-around check prevents us from
147          * unmapping the last page of the address space.  Test for the error
148          * condition and re-try the unmap excluding the last page.  The
149          * expectation is that we've never mapped the last page anyway and this
150          * unmap request comes via vIOMMU support which also makes it unlikely
151          * that this page is used.  This bug was introduced well after type1 v2
152          * support was introduced, so we shouldn't need to test for v1.  A fix
153          * is queued for kernel v5.0 so this workaround can be removed once
154          * affected kernels are sufficiently deprecated.
155          */
156         if (errno == EINVAL && unmap.size && !(unmap.iova + unmap.size) &&
157             container->iommu_type == VFIO_TYPE1v2_IOMMU) {
158             trace_vfio_legacy_dma_unmap_overflow_workaround();
159             unmap.size -= 1ULL << ctz64(bcontainer->pgsizes);
160             continue;
161         }
162         error_report("VFIO_UNMAP_DMA failed: %s", strerror(errno));
163         return -errno;
164     }
165 
166     if (need_dirty_sync) {
167         ret = vfio_get_dirty_bitmap(bcontainer, iova, size,
168                                     iotlb->translated_addr, &local_err);
169         if (ret) {
170             error_report_err(local_err);
171             return ret;
172         }
173     }
174 
175     return 0;
176 }
177 
178 static int vfio_legacy_dma_map(const VFIOContainerBase *bcontainer, hwaddr iova,
179                                ram_addr_t size, void *vaddr, bool readonly)
180 {
181     const VFIOContainer *container = container_of(bcontainer, VFIOContainer,
182                                                   bcontainer);
183     struct vfio_iommu_type1_dma_map map = {
184         .argsz = sizeof(map),
185         .flags = VFIO_DMA_MAP_FLAG_READ,
186         .vaddr = (__u64)(uintptr_t)vaddr,
187         .iova = iova,
188         .size = size,
189     };
190 
191     if (!readonly) {
192         map.flags |= VFIO_DMA_MAP_FLAG_WRITE;
193     }
194 
195     /*
196      * Try the mapping, if it fails with EBUSY, unmap the region and try
197      * again.  This shouldn't be necessary, but we sometimes see it in
198      * the VGA ROM space.
199      */
200     if (ioctl(container->fd, VFIO_IOMMU_MAP_DMA, &map) == 0 ||
201         (errno == EBUSY &&
202          vfio_legacy_dma_unmap(bcontainer, iova, size, NULL) == 0 &&
203          ioctl(container->fd, VFIO_IOMMU_MAP_DMA, &map) == 0)) {
204         return 0;
205     }
206 
207     error_report("VFIO_MAP_DMA failed: %s", strerror(errno));
208     return -errno;
209 }
210 
211 static int
212 vfio_legacy_set_dirty_page_tracking(const VFIOContainerBase *bcontainer,
213                                     bool start, Error **errp)
214 {
215     const VFIOContainer *container = container_of(bcontainer, VFIOContainer,
216                                                   bcontainer);
217     int ret;
218     struct vfio_iommu_type1_dirty_bitmap dirty = {
219         .argsz = sizeof(dirty),
220     };
221 
222     if (start) {
223         dirty.flags = VFIO_IOMMU_DIRTY_PAGES_FLAG_START;
224     } else {
225         dirty.flags = VFIO_IOMMU_DIRTY_PAGES_FLAG_STOP;
226     }
227 
228     ret = ioctl(container->fd, VFIO_IOMMU_DIRTY_PAGES, &dirty);
229     if (ret) {
230         ret = -errno;
231         error_setg_errno(errp, errno, "Failed to set dirty tracking flag 0x%x",
232                          dirty.flags);
233     }
234 
235     return ret;
236 }
237 
238 static int vfio_legacy_query_dirty_bitmap(const VFIOContainerBase *bcontainer,
239                       VFIOBitmap *vbmap, hwaddr iova, hwaddr size, Error **errp)
240 {
241     const VFIOContainer *container = container_of(bcontainer, VFIOContainer,
242                                                   bcontainer);
243     struct vfio_iommu_type1_dirty_bitmap *dbitmap;
244     struct vfio_iommu_type1_dirty_bitmap_get *range;
245     int ret;
246 
247     dbitmap = g_malloc0(sizeof(*dbitmap) + sizeof(*range));
248 
249     dbitmap->argsz = sizeof(*dbitmap) + sizeof(*range);
250     dbitmap->flags = VFIO_IOMMU_DIRTY_PAGES_FLAG_GET_BITMAP;
251     range = (struct vfio_iommu_type1_dirty_bitmap_get *)&dbitmap->data;
252     range->iova = iova;
253     range->size = size;
254 
255     /*
256      * cpu_physical_memory_set_dirty_lebitmap() supports pages in bitmap of
257      * qemu_real_host_page_size to mark those dirty. Hence set bitmap's pgsize
258      * to qemu_real_host_page_size.
259      */
260     range->bitmap.pgsize = qemu_real_host_page_size();
261     range->bitmap.size = vbmap->size;
262     range->bitmap.data = (__u64 *)vbmap->bitmap;
263 
264     ret = ioctl(container->fd, VFIO_IOMMU_DIRTY_PAGES, dbitmap);
265     if (ret) {
266         ret = -errno;
267         error_setg_errno(errp, errno,
268                          "Failed to get dirty bitmap for iova: 0x%"PRIx64
269                          " size: 0x%"PRIx64, (uint64_t)range->iova,
270                          (uint64_t)range->size);
271     }
272 
273     g_free(dbitmap);
274 
275     return ret;
276 }
277 
278 static struct vfio_info_cap_header *
279 vfio_get_iommu_type1_info_cap(struct vfio_iommu_type1_info *info, uint16_t id)
280 {
281     if (!(info->flags & VFIO_IOMMU_INFO_CAPS)) {
282         return NULL;
283     }
284 
285     return vfio_get_cap((void *)info, info->cap_offset, id);
286 }
287 
288 bool vfio_get_info_dma_avail(struct vfio_iommu_type1_info *info,
289                              unsigned int *avail)
290 {
291     struct vfio_info_cap_header *hdr;
292     struct vfio_iommu_type1_info_dma_avail *cap;
293 
294     /* If the capability cannot be found, assume no DMA limiting */
295     hdr = vfio_get_iommu_type1_info_cap(info,
296                                         VFIO_IOMMU_TYPE1_INFO_DMA_AVAIL);
297     if (!hdr) {
298         return false;
299     }
300 
301     if (avail != NULL) {
302         cap = (void *) hdr;
303         *avail = cap->avail;
304     }
305 
306     return true;
307 }
308 
309 static bool vfio_get_info_iova_range(struct vfio_iommu_type1_info *info,
310                                      VFIOContainerBase *bcontainer)
311 {
312     struct vfio_info_cap_header *hdr;
313     struct vfio_iommu_type1_info_cap_iova_range *cap;
314 
315     hdr = vfio_get_iommu_type1_info_cap(info,
316                                         VFIO_IOMMU_TYPE1_INFO_CAP_IOVA_RANGE);
317     if (!hdr) {
318         return false;
319     }
320 
321     cap = (void *)hdr;
322 
323     for (int i = 0; i < cap->nr_iovas; i++) {
324         Range *range = g_new(Range, 1);
325 
326         range_set_bounds(range, cap->iova_ranges[i].start,
327                          cap->iova_ranges[i].end);
328         bcontainer->iova_ranges =
329             range_list_insert(bcontainer->iova_ranges, range);
330     }
331 
332     return true;
333 }
334 
335 static void vfio_kvm_device_add_group(VFIOGroup *group)
336 {
337     Error *err = NULL;
338 
339     if (vfio_kvm_device_add_fd(group->fd, &err)) {
340         error_reportf_err(err, "group ID %d: ", group->groupid);
341     }
342 }
343 
344 static void vfio_kvm_device_del_group(VFIOGroup *group)
345 {
346     Error *err = NULL;
347 
348     if (vfio_kvm_device_del_fd(group->fd, &err)) {
349         error_reportf_err(err, "group ID %d: ", group->groupid);
350     }
351 }
352 
353 /*
354  * vfio_get_iommu_type - selects the richest iommu_type (v2 first)
355  */
356 static int vfio_get_iommu_type(int container_fd,
357                                Error **errp)
358 {
359     int iommu_types[] = { VFIO_TYPE1v2_IOMMU, VFIO_TYPE1_IOMMU,
360                           VFIO_SPAPR_TCE_v2_IOMMU, VFIO_SPAPR_TCE_IOMMU };
361     int i;
362 
363     for (i = 0; i < ARRAY_SIZE(iommu_types); i++) {
364         if (ioctl(container_fd, VFIO_CHECK_EXTENSION, iommu_types[i])) {
365             return iommu_types[i];
366         }
367     }
368     error_setg(errp, "No available IOMMU models");
369     return -EINVAL;
370 }
371 
372 /*
373  * vfio_get_iommu_ops - get a VFIOIOMMUClass associated with a type
374  */
375 static const char *vfio_get_iommu_class_name(int iommu_type)
376 {
377     switch (iommu_type) {
378     case VFIO_TYPE1v2_IOMMU:
379     case VFIO_TYPE1_IOMMU:
380         return TYPE_VFIO_IOMMU_LEGACY;
381         break;
382     case VFIO_SPAPR_TCE_v2_IOMMU:
383     case VFIO_SPAPR_TCE_IOMMU:
384         return TYPE_VFIO_IOMMU_SPAPR;
385         break;
386     default:
387         g_assert_not_reached();
388     };
389 }
390 
391 static bool vfio_set_iommu(int container_fd, int group_fd,
392                            int *iommu_type, Error **errp)
393 {
394     if (ioctl(group_fd, VFIO_GROUP_SET_CONTAINER, &container_fd)) {
395         error_setg_errno(errp, errno, "Failed to set group container");
396         return false;
397     }
398 
399     while (ioctl(container_fd, VFIO_SET_IOMMU, *iommu_type)) {
400         if (*iommu_type == VFIO_SPAPR_TCE_v2_IOMMU) {
401             /*
402              * On sPAPR, despite the IOMMU subdriver always advertises v1 and
403              * v2, the running platform may not support v2 and there is no
404              * way to guess it until an IOMMU group gets added to the container.
405              * So in case it fails with v2, try v1 as a fallback.
406              */
407             *iommu_type = VFIO_SPAPR_TCE_IOMMU;
408             continue;
409         }
410         error_setg_errno(errp, errno, "Failed to set iommu for container");
411         return false;
412     }
413 
414     return true;
415 }
416 
417 static VFIOContainer *vfio_create_container(int fd, VFIOGroup *group,
418                                             Error **errp)
419 {
420     int iommu_type;
421     const char *vioc_name;
422     VFIOContainer *container;
423 
424     iommu_type = vfio_get_iommu_type(fd, errp);
425     if (iommu_type < 0) {
426         return NULL;
427     }
428 
429     if (!vfio_set_iommu(fd, group->fd, &iommu_type, errp)) {
430         return NULL;
431     }
432 
433     vioc_name = vfio_get_iommu_class_name(iommu_type);
434 
435     container = VFIO_IOMMU_LEGACY(object_new(vioc_name));
436     container->fd = fd;
437     container->iommu_type = iommu_type;
438     return container;
439 }
440 
441 static int vfio_get_iommu_info(VFIOContainer *container,
442                                struct vfio_iommu_type1_info **info)
443 {
444 
445     size_t argsz = sizeof(struct vfio_iommu_type1_info);
446 
447     *info = g_new0(struct vfio_iommu_type1_info, 1);
448 again:
449     (*info)->argsz = argsz;
450 
451     if (ioctl(container->fd, VFIO_IOMMU_GET_INFO, *info)) {
452         g_free(*info);
453         *info = NULL;
454         return -errno;
455     }
456 
457     if (((*info)->argsz > argsz)) {
458         argsz = (*info)->argsz;
459         *info = g_realloc(*info, argsz);
460         goto again;
461     }
462 
463     return 0;
464 }
465 
466 static struct vfio_info_cap_header *
467 vfio_get_iommu_info_cap(struct vfio_iommu_type1_info *info, uint16_t id)
468 {
469     struct vfio_info_cap_header *hdr;
470     void *ptr = info;
471 
472     if (!(info->flags & VFIO_IOMMU_INFO_CAPS)) {
473         return NULL;
474     }
475 
476     for (hdr = ptr + info->cap_offset; hdr != ptr; hdr = ptr + hdr->next) {
477         if (hdr->id == id) {
478             return hdr;
479         }
480     }
481 
482     return NULL;
483 }
484 
485 static void vfio_get_iommu_info_migration(VFIOContainer *container,
486                                           struct vfio_iommu_type1_info *info)
487 {
488     struct vfio_info_cap_header *hdr;
489     struct vfio_iommu_type1_info_cap_migration *cap_mig;
490     VFIOContainerBase *bcontainer = &container->bcontainer;
491 
492     hdr = vfio_get_iommu_info_cap(info, VFIO_IOMMU_TYPE1_INFO_CAP_MIGRATION);
493     if (!hdr) {
494         return;
495     }
496 
497     cap_mig = container_of(hdr, struct vfio_iommu_type1_info_cap_migration,
498                             header);
499 
500     /*
501      * cpu_physical_memory_set_dirty_lebitmap() supports pages in bitmap of
502      * qemu_real_host_page_size to mark those dirty.
503      */
504     if (cap_mig->pgsize_bitmap & qemu_real_host_page_size()) {
505         bcontainer->dirty_pages_supported = true;
506         bcontainer->max_dirty_bitmap_size = cap_mig->max_dirty_bitmap_size;
507         bcontainer->dirty_pgsizes = cap_mig->pgsize_bitmap;
508     }
509 }
510 
511 static bool vfio_legacy_setup(VFIOContainerBase *bcontainer, Error **errp)
512 {
513     VFIOContainer *container = container_of(bcontainer, VFIOContainer,
514                                             bcontainer);
515     g_autofree struct vfio_iommu_type1_info *info = NULL;
516     int ret;
517 
518     ret = vfio_get_iommu_info(container, &info);
519     if (ret) {
520         error_setg_errno(errp, -ret, "Failed to get VFIO IOMMU info");
521         return false;
522     }
523 
524     if (info->flags & VFIO_IOMMU_INFO_PGSIZES) {
525         bcontainer->pgsizes = info->iova_pgsizes;
526     } else {
527         bcontainer->pgsizes = qemu_real_host_page_size();
528     }
529 
530     if (!vfio_get_info_dma_avail(info, &bcontainer->dma_max_mappings)) {
531         bcontainer->dma_max_mappings = 65535;
532     }
533 
534     vfio_get_info_iova_range(info, bcontainer);
535 
536     vfio_get_iommu_info_migration(container, info);
537     return true;
538 }
539 
540 static bool vfio_connect_container(VFIOGroup *group, AddressSpace *as,
541                                    Error **errp)
542 {
543     VFIOContainer *container;
544     VFIOContainerBase *bcontainer;
545     int ret, fd;
546     VFIOAddressSpace *space;
547     VFIOIOMMUClass *vioc;
548 
549     space = vfio_get_address_space(as);
550 
551     /*
552      * VFIO is currently incompatible with discarding of RAM insofar as the
553      * madvise to purge (zap) the page from QEMU's address space does not
554      * interact with the memory API and therefore leaves stale virtual to
555      * physical mappings in the IOMMU if the page was previously pinned.  We
556      * therefore set discarding broken for each group added to a container,
557      * whether the container is used individually or shared.  This provides
558      * us with options to allow devices within a group to opt-in and allow
559      * discarding, so long as it is done consistently for a group (for instance
560      * if the device is an mdev device where it is known that the host vendor
561      * driver will never pin pages outside of the working set of the guest
562      * driver, which would thus not be discarding candidates).
563      *
564      * The first opportunity to induce pinning occurs here where we attempt to
565      * attach the group to existing containers within the AddressSpace.  If any
566      * pages are already zapped from the virtual address space, such as from
567      * previous discards, new pinning will cause valid mappings to be
568      * re-established.  Likewise, when the overall MemoryListener for a new
569      * container is registered, a replay of mappings within the AddressSpace
570      * will occur, re-establishing any previously zapped pages as well.
571      *
572      * Especially virtio-balloon is currently only prevented from discarding
573      * new memory, it will not yet set ram_block_discard_set_required() and
574      * therefore, neither stops us here or deals with the sudden memory
575      * consumption of inflated memory.
576      *
577      * We do support discarding of memory coordinated via the RamDiscardManager
578      * with some IOMMU types. vfio_ram_block_discard_disable() handles the
579      * details once we know which type of IOMMU we are using.
580      */
581 
582     QLIST_FOREACH(bcontainer, &space->containers, next) {
583         container = container_of(bcontainer, VFIOContainer, bcontainer);
584         if (!ioctl(group->fd, VFIO_GROUP_SET_CONTAINER, &container->fd)) {
585             ret = vfio_ram_block_discard_disable(container, true);
586             if (ret) {
587                 error_setg_errno(errp, -ret,
588                                  "Cannot set discarding of RAM broken");
589                 if (ioctl(group->fd, VFIO_GROUP_UNSET_CONTAINER,
590                           &container->fd)) {
591                     error_report("vfio: error disconnecting group %d from"
592                                  " container", group->groupid);
593                 }
594                 return false;
595             }
596             group->container = container;
597             QLIST_INSERT_HEAD(&container->group_list, group, container_next);
598             vfio_kvm_device_add_group(group);
599             return true;
600         }
601     }
602 
603     fd = qemu_open("/dev/vfio/vfio", O_RDWR, errp);
604     if (fd < 0) {
605         goto put_space_exit;
606     }
607 
608     ret = ioctl(fd, VFIO_GET_API_VERSION);
609     if (ret != VFIO_API_VERSION) {
610         error_setg(errp, "supported vfio version: %d, "
611                    "reported version: %d", VFIO_API_VERSION, ret);
612         goto close_fd_exit;
613     }
614 
615     container = vfio_create_container(fd, group, errp);
616     if (!container) {
617         goto close_fd_exit;
618     }
619     bcontainer = &container->bcontainer;
620 
621     if (!vfio_cpr_register_container(bcontainer, errp)) {
622         goto free_container_exit;
623     }
624 
625     ret = vfio_ram_block_discard_disable(container, true);
626     if (ret) {
627         error_setg_errno(errp, -ret, "Cannot set discarding of RAM broken");
628         goto unregister_container_exit;
629     }
630 
631     vioc = VFIO_IOMMU_GET_CLASS(bcontainer);
632     assert(vioc->setup);
633 
634     if (!vioc->setup(bcontainer, errp)) {
635         goto enable_discards_exit;
636     }
637 
638     vfio_kvm_device_add_group(group);
639 
640     vfio_address_space_insert(space, bcontainer);
641 
642     group->container = container;
643     QLIST_INSERT_HEAD(&container->group_list, group, container_next);
644 
645     bcontainer->listener = vfio_memory_listener;
646     memory_listener_register(&bcontainer->listener, bcontainer->space->as);
647 
648     if (bcontainer->error) {
649         error_propagate_prepend(errp, bcontainer->error,
650             "memory listener initialization failed: ");
651         goto listener_release_exit;
652     }
653 
654     bcontainer->initialized = true;
655 
656     return true;
657 listener_release_exit:
658     QLIST_REMOVE(group, container_next);
659     vfio_kvm_device_del_group(group);
660     memory_listener_unregister(&bcontainer->listener);
661     if (vioc->release) {
662         vioc->release(bcontainer);
663     }
664 
665 enable_discards_exit:
666     vfio_ram_block_discard_disable(container, false);
667 
668 unregister_container_exit:
669     vfio_cpr_unregister_container(bcontainer);
670 
671 free_container_exit:
672     object_unref(container);
673 
674 close_fd_exit:
675     close(fd);
676 
677 put_space_exit:
678     vfio_put_address_space(space);
679 
680     return false;
681 }
682 
683 static void vfio_disconnect_container(VFIOGroup *group)
684 {
685     VFIOContainer *container = group->container;
686     VFIOContainerBase *bcontainer = &container->bcontainer;
687     VFIOIOMMUClass *vioc = VFIO_IOMMU_GET_CLASS(bcontainer);
688 
689     QLIST_REMOVE(group, container_next);
690     group->container = NULL;
691 
692     /*
693      * Explicitly release the listener first before unset container,
694      * since unset may destroy the backend container if it's the last
695      * group.
696      */
697     if (QLIST_EMPTY(&container->group_list)) {
698         memory_listener_unregister(&bcontainer->listener);
699         if (vioc->release) {
700             vioc->release(bcontainer);
701         }
702     }
703 
704     if (ioctl(group->fd, VFIO_GROUP_UNSET_CONTAINER, &container->fd)) {
705         error_report("vfio: error disconnecting group %d from container",
706                      group->groupid);
707     }
708 
709     if (QLIST_EMPTY(&container->group_list)) {
710         VFIOAddressSpace *space = bcontainer->space;
711 
712         trace_vfio_disconnect_container(container->fd);
713         vfio_cpr_unregister_container(bcontainer);
714         close(container->fd);
715         object_unref(container);
716 
717         vfio_put_address_space(space);
718     }
719 }
720 
721 static VFIOGroup *vfio_get_group(int groupid, AddressSpace *as, Error **errp)
722 {
723     ERRP_GUARD();
724     VFIOGroup *group;
725     char path[32];
726     struct vfio_group_status status = { .argsz = sizeof(status) };
727 
728     QLIST_FOREACH(group, &vfio_group_list, next) {
729         if (group->groupid == groupid) {
730             /* Found it.  Now is it already in the right context? */
731             if (group->container->bcontainer.space->as == as) {
732                 return group;
733             } else {
734                 error_setg(errp, "group %d used in multiple address spaces",
735                            group->groupid);
736                 return NULL;
737             }
738         }
739     }
740 
741     group = g_malloc0(sizeof(*group));
742 
743     snprintf(path, sizeof(path), "/dev/vfio/%d", groupid);
744     group->fd = qemu_open(path, O_RDWR, errp);
745     if (group->fd < 0) {
746         goto free_group_exit;
747     }
748 
749     if (ioctl(group->fd, VFIO_GROUP_GET_STATUS, &status)) {
750         error_setg_errno(errp, errno, "failed to get group %d status", groupid);
751         goto close_fd_exit;
752     }
753 
754     if (!(status.flags & VFIO_GROUP_FLAGS_VIABLE)) {
755         error_setg(errp, "group %d is not viable", groupid);
756         error_append_hint(errp,
757                           "Please ensure all devices within the iommu_group "
758                           "are bound to their vfio bus driver.\n");
759         goto close_fd_exit;
760     }
761 
762     group->groupid = groupid;
763     QLIST_INIT(&group->device_list);
764 
765     if (!vfio_connect_container(group, as, errp)) {
766         error_prepend(errp, "failed to setup container for group %d: ",
767                       groupid);
768         goto close_fd_exit;
769     }
770 
771     QLIST_INSERT_HEAD(&vfio_group_list, group, next);
772 
773     return group;
774 
775 close_fd_exit:
776     close(group->fd);
777 
778 free_group_exit:
779     g_free(group);
780 
781     return NULL;
782 }
783 
784 static void vfio_put_group(VFIOGroup *group)
785 {
786     if (!group || !QLIST_EMPTY(&group->device_list)) {
787         return;
788     }
789 
790     if (!group->ram_block_discard_allowed) {
791         vfio_ram_block_discard_disable(group->container, false);
792     }
793     vfio_kvm_device_del_group(group);
794     vfio_disconnect_container(group);
795     QLIST_REMOVE(group, next);
796     trace_vfio_put_group(group->fd);
797     close(group->fd);
798     g_free(group);
799 }
800 
801 static bool vfio_get_device(VFIOGroup *group, const char *name,
802                             VFIODevice *vbasedev, Error **errp)
803 {
804     g_autofree struct vfio_device_info *info = NULL;
805     int fd;
806 
807     fd = ioctl(group->fd, VFIO_GROUP_GET_DEVICE_FD, name);
808     if (fd < 0) {
809         error_setg_errno(errp, errno, "error getting device from group %d",
810                          group->groupid);
811         error_append_hint(errp,
812                       "Verify all devices in group %d are bound to vfio-<bus> "
813                       "or pci-stub and not already in use\n", group->groupid);
814         return false;
815     }
816 
817     info = vfio_get_device_info(fd);
818     if (!info) {
819         error_setg_errno(errp, errno, "error getting device info");
820         close(fd);
821         return false;
822     }
823 
824     /*
825      * Set discarding of RAM as not broken for this group if the driver knows
826      * the device operates compatibly with discarding.  Setting must be
827      * consistent per group, but since compatibility is really only possible
828      * with mdev currently, we expect singleton groups.
829      */
830     if (vbasedev->ram_block_discard_allowed !=
831         group->ram_block_discard_allowed) {
832         if (!QLIST_EMPTY(&group->device_list)) {
833             error_setg(errp, "Inconsistent setting of support for discarding "
834                        "RAM (e.g., balloon) within group");
835             close(fd);
836             return false;
837         }
838 
839         if (!group->ram_block_discard_allowed) {
840             group->ram_block_discard_allowed = true;
841             vfio_ram_block_discard_disable(group->container, false);
842         }
843     }
844 
845     vbasedev->fd = fd;
846     vbasedev->group = group;
847     QLIST_INSERT_HEAD(&group->device_list, vbasedev, next);
848 
849     vbasedev->num_irqs = info->num_irqs;
850     vbasedev->num_regions = info->num_regions;
851     vbasedev->flags = info->flags;
852 
853     trace_vfio_get_device(name, info->flags, info->num_regions, info->num_irqs);
854 
855     vbasedev->reset_works = !!(info->flags & VFIO_DEVICE_FLAGS_RESET);
856 
857     return true;
858 }
859 
860 static void vfio_put_base_device(VFIODevice *vbasedev)
861 {
862     if (!vbasedev->group) {
863         return;
864     }
865     QLIST_REMOVE(vbasedev, next);
866     vbasedev->group = NULL;
867     trace_vfio_put_base_device(vbasedev->fd);
868     close(vbasedev->fd);
869 }
870 
871 static int vfio_device_groupid(VFIODevice *vbasedev, Error **errp)
872 {
873     char *tmp, group_path[PATH_MAX];
874     g_autofree char *group_name = NULL;
875     int ret, groupid;
876     ssize_t len;
877 
878     tmp = g_strdup_printf("%s/iommu_group", vbasedev->sysfsdev);
879     len = readlink(tmp, group_path, sizeof(group_path));
880     g_free(tmp);
881 
882     if (len <= 0 || len >= sizeof(group_path)) {
883         ret = len < 0 ? -errno : -ENAMETOOLONG;
884         error_setg_errno(errp, -ret, "no iommu_group found");
885         return ret;
886     }
887 
888     group_path[len] = 0;
889 
890     group_name = g_path_get_basename(group_path);
891     if (sscanf(group_name, "%d", &groupid) != 1) {
892         error_setg_errno(errp, errno, "failed to read %s", group_path);
893         return -errno;
894     }
895     return groupid;
896 }
897 
898 /*
899  * vfio_attach_device: attach a device to a security context
900  * @name and @vbasedev->name are likely to be different depending
901  * on the type of the device, hence the need for passing @name
902  */
903 static bool vfio_legacy_attach_device(const char *name, VFIODevice *vbasedev,
904                                       AddressSpace *as, Error **errp)
905 {
906     int groupid = vfio_device_groupid(vbasedev, errp);
907     VFIODevice *vbasedev_iter;
908     VFIOGroup *group;
909     VFIOContainerBase *bcontainer;
910 
911     if (groupid < 0) {
912         return false;
913     }
914 
915     trace_vfio_attach_device(vbasedev->name, groupid);
916 
917     if (!vfio_device_hiod_realize(vbasedev, errp)) {
918         return false;
919     }
920 
921     group = vfio_get_group(groupid, as, errp);
922     if (!group) {
923         return false;
924     }
925 
926     QLIST_FOREACH(vbasedev_iter, &group->device_list, next) {
927         if (strcmp(vbasedev_iter->name, vbasedev->name) == 0) {
928             error_setg(errp, "device is already attached");
929             vfio_put_group(group);
930             return false;
931         }
932     }
933     if (!vfio_get_device(group, name, vbasedev, errp)) {
934         vfio_put_group(group);
935         return false;
936     }
937 
938     bcontainer = &group->container->bcontainer;
939     vbasedev->bcontainer = bcontainer;
940     QLIST_INSERT_HEAD(&bcontainer->device_list, vbasedev, container_next);
941     QLIST_INSERT_HEAD(&vfio_device_list, vbasedev, global_next);
942 
943     return true;
944 }
945 
946 static void vfio_legacy_detach_device(VFIODevice *vbasedev)
947 {
948     VFIOGroup *group = vbasedev->group;
949 
950     QLIST_REMOVE(vbasedev, global_next);
951     QLIST_REMOVE(vbasedev, container_next);
952     vbasedev->bcontainer = NULL;
953     trace_vfio_detach_device(vbasedev->name, group->groupid);
954     vfio_put_base_device(vbasedev);
955     vfio_put_group(group);
956 }
957 
958 static int vfio_legacy_pci_hot_reset(VFIODevice *vbasedev, bool single)
959 {
960     VFIOPCIDevice *vdev = container_of(vbasedev, VFIOPCIDevice, vbasedev);
961     VFIOGroup *group;
962     struct vfio_pci_hot_reset_info *info = NULL;
963     struct vfio_pci_dependent_device *devices;
964     struct vfio_pci_hot_reset *reset;
965     int32_t *fds;
966     int ret, i, count;
967     bool multi = false;
968 
969     trace_vfio_pci_hot_reset(vdev->vbasedev.name, single ? "one" : "multi");
970 
971     if (!single) {
972         vfio_pci_pre_reset(vdev);
973     }
974     vdev->vbasedev.needs_reset = false;
975 
976     ret = vfio_pci_get_pci_hot_reset_info(vdev, &info);
977 
978     if (ret) {
979         goto out_single;
980     }
981     devices = &info->devices[0];
982 
983     trace_vfio_pci_hot_reset_has_dep_devices(vdev->vbasedev.name);
984 
985     /* Verify that we have all the groups required */
986     for (i = 0; i < info->count; i++) {
987         PCIHostDeviceAddress host;
988         VFIOPCIDevice *tmp;
989         VFIODevice *vbasedev_iter;
990 
991         host.domain = devices[i].segment;
992         host.bus = devices[i].bus;
993         host.slot = PCI_SLOT(devices[i].devfn);
994         host.function = PCI_FUNC(devices[i].devfn);
995 
996         trace_vfio_pci_hot_reset_dep_devices(host.domain,
997                 host.bus, host.slot, host.function, devices[i].group_id);
998 
999         if (vfio_pci_host_match(&host, vdev->vbasedev.name)) {
1000             continue;
1001         }
1002 
1003         QLIST_FOREACH(group, &vfio_group_list, next) {
1004             if (group->groupid == devices[i].group_id) {
1005                 break;
1006             }
1007         }
1008 
1009         if (!group) {
1010             if (!vdev->has_pm_reset) {
1011                 error_report("vfio: Cannot reset device %s, "
1012                              "depends on group %d which is not owned.",
1013                              vdev->vbasedev.name, devices[i].group_id);
1014             }
1015             ret = -EPERM;
1016             goto out;
1017         }
1018 
1019         /* Prep dependent devices for reset and clear our marker. */
1020         QLIST_FOREACH(vbasedev_iter, &group->device_list, next) {
1021             if (!vbasedev_iter->dev->realized ||
1022                 vbasedev_iter->type != VFIO_DEVICE_TYPE_PCI) {
1023                 continue;
1024             }
1025             tmp = container_of(vbasedev_iter, VFIOPCIDevice, vbasedev);
1026             if (vfio_pci_host_match(&host, tmp->vbasedev.name)) {
1027                 if (single) {
1028                     ret = -EINVAL;
1029                     goto out_single;
1030                 }
1031                 vfio_pci_pre_reset(tmp);
1032                 tmp->vbasedev.needs_reset = false;
1033                 multi = true;
1034                 break;
1035             }
1036         }
1037     }
1038 
1039     if (!single && !multi) {
1040         ret = -EINVAL;
1041         goto out_single;
1042     }
1043 
1044     /* Determine how many group fds need to be passed */
1045     count = 0;
1046     QLIST_FOREACH(group, &vfio_group_list, next) {
1047         for (i = 0; i < info->count; i++) {
1048             if (group->groupid == devices[i].group_id) {
1049                 count++;
1050                 break;
1051             }
1052         }
1053     }
1054 
1055     reset = g_malloc0(sizeof(*reset) + (count * sizeof(*fds)));
1056     reset->argsz = sizeof(*reset) + (count * sizeof(*fds));
1057     fds = &reset->group_fds[0];
1058 
1059     /* Fill in group fds */
1060     QLIST_FOREACH(group, &vfio_group_list, next) {
1061         for (i = 0; i < info->count; i++) {
1062             if (group->groupid == devices[i].group_id) {
1063                 fds[reset->count++] = group->fd;
1064                 break;
1065             }
1066         }
1067     }
1068 
1069     /* Bus reset! */
1070     ret = ioctl(vdev->vbasedev.fd, VFIO_DEVICE_PCI_HOT_RESET, reset);
1071     g_free(reset);
1072     if (ret) {
1073         ret = -errno;
1074     }
1075 
1076     trace_vfio_pci_hot_reset_result(vdev->vbasedev.name,
1077                                     ret ? strerror(errno) : "Success");
1078 
1079 out:
1080     /* Re-enable INTx on affected devices */
1081     for (i = 0; i < info->count; i++) {
1082         PCIHostDeviceAddress host;
1083         VFIOPCIDevice *tmp;
1084         VFIODevice *vbasedev_iter;
1085 
1086         host.domain = devices[i].segment;
1087         host.bus = devices[i].bus;
1088         host.slot = PCI_SLOT(devices[i].devfn);
1089         host.function = PCI_FUNC(devices[i].devfn);
1090 
1091         if (vfio_pci_host_match(&host, vdev->vbasedev.name)) {
1092             continue;
1093         }
1094 
1095         QLIST_FOREACH(group, &vfio_group_list, next) {
1096             if (group->groupid == devices[i].group_id) {
1097                 break;
1098             }
1099         }
1100 
1101         if (!group) {
1102             break;
1103         }
1104 
1105         QLIST_FOREACH(vbasedev_iter, &group->device_list, next) {
1106             if (!vbasedev_iter->dev->realized ||
1107                 vbasedev_iter->type != VFIO_DEVICE_TYPE_PCI) {
1108                 continue;
1109             }
1110             tmp = container_of(vbasedev_iter, VFIOPCIDevice, vbasedev);
1111             if (vfio_pci_host_match(&host, tmp->vbasedev.name)) {
1112                 vfio_pci_post_reset(tmp);
1113                 break;
1114             }
1115         }
1116     }
1117 out_single:
1118     if (!single) {
1119         vfio_pci_post_reset(vdev);
1120     }
1121     g_free(info);
1122 
1123     return ret;
1124 }
1125 
1126 static void vfio_iommu_legacy_class_init(ObjectClass *klass, void *data)
1127 {
1128     VFIOIOMMUClass *vioc = VFIO_IOMMU_CLASS(klass);
1129 
1130     vioc->hiod_typename = TYPE_HOST_IOMMU_DEVICE_LEGACY_VFIO;
1131 
1132     vioc->setup = vfio_legacy_setup;
1133     vioc->dma_map = vfio_legacy_dma_map;
1134     vioc->dma_unmap = vfio_legacy_dma_unmap;
1135     vioc->attach_device = vfio_legacy_attach_device;
1136     vioc->detach_device = vfio_legacy_detach_device;
1137     vioc->set_dirty_page_tracking = vfio_legacy_set_dirty_page_tracking;
1138     vioc->query_dirty_bitmap = vfio_legacy_query_dirty_bitmap;
1139     vioc->pci_hot_reset = vfio_legacy_pci_hot_reset;
1140 };
1141 
1142 static bool hiod_legacy_vfio_realize(HostIOMMUDevice *hiod, void *opaque,
1143                                      Error **errp)
1144 {
1145     VFIODevice *vdev = opaque;
1146 
1147     hiod->name = g_strdup(vdev->name);
1148     hiod->agent = opaque;
1149 
1150     return true;
1151 }
1152 
1153 static int hiod_legacy_vfio_get_cap(HostIOMMUDevice *hiod, int cap,
1154                                     Error **errp)
1155 {
1156     switch (cap) {
1157     case HOST_IOMMU_DEVICE_CAP_AW_BITS:
1158         return vfio_device_get_aw_bits(hiod->agent);
1159     default:
1160         error_setg(errp, "%s: unsupported capability %x", hiod->name, cap);
1161         return -EINVAL;
1162     }
1163 }
1164 
1165 static GList *
1166 hiod_legacy_vfio_get_iova_ranges(HostIOMMUDevice *hiod)
1167 {
1168     VFIODevice *vdev = hiod->agent;
1169 
1170     g_assert(vdev);
1171     return vfio_container_get_iova_ranges(vdev->bcontainer);
1172 }
1173 
1174 static uint64_t
1175 hiod_legacy_vfio_get_page_size_mask(HostIOMMUDevice *hiod)
1176 {
1177     VFIODevice *vdev = hiod->agent;
1178 
1179     g_assert(vdev);
1180     return vfio_container_get_page_size_mask(vdev->bcontainer);
1181 }
1182 
1183 static void vfio_iommu_legacy_instance_init(Object *obj)
1184 {
1185     VFIOContainer *container = VFIO_IOMMU_LEGACY(obj);
1186 
1187     QLIST_INIT(&container->group_list);
1188 }
1189 
1190 static void hiod_legacy_vfio_class_init(ObjectClass *oc, void *data)
1191 {
1192     HostIOMMUDeviceClass *hioc = HOST_IOMMU_DEVICE_CLASS(oc);
1193 
1194     hioc->realize = hiod_legacy_vfio_realize;
1195     hioc->get_cap = hiod_legacy_vfio_get_cap;
1196     hioc->get_iova_ranges = hiod_legacy_vfio_get_iova_ranges;
1197     hioc->get_page_size_mask = hiod_legacy_vfio_get_page_size_mask;
1198 };
1199 
1200 static const TypeInfo types[] = {
1201     {
1202         .name = TYPE_VFIO_IOMMU_LEGACY,
1203         .parent = TYPE_VFIO_IOMMU,
1204         .instance_init = vfio_iommu_legacy_instance_init,
1205         .instance_size = sizeof(VFIOContainer),
1206         .class_init = vfio_iommu_legacy_class_init,
1207     }, {
1208         .name = TYPE_HOST_IOMMU_DEVICE_LEGACY_VFIO,
1209         .parent = TYPE_HOST_IOMMU_DEVICE,
1210         .class_init = hiod_legacy_vfio_class_init,
1211     }
1212 };
1213 
1214 DEFINE_TYPES(types)
1215