1 /* 2 * vhost support 3 * 4 * Copyright Red Hat, Inc. 2010 5 * 6 * Authors: 7 * Michael S. Tsirkin <mst@redhat.com> 8 * 9 * This work is licensed under the terms of the GNU GPL, version 2. See 10 * the COPYING file in the top-level directory. 11 * 12 * Contributions after 2012-01-13 are licensed under the terms of the 13 * GNU GPL, version 2 or (at your option) any later version. 14 */ 15 16 #include "qemu/osdep.h" 17 #include "qapi/error.h" 18 #include "hw/virtio/vhost.h" 19 #include "qemu/atomic.h" 20 #include "qemu/range.h" 21 #include "qemu/error-report.h" 22 #include "qemu/memfd.h" 23 #include "standard-headers/linux/vhost_types.h" 24 #include "exec/address-spaces.h" 25 #include "hw/virtio/virtio-bus.h" 26 #include "hw/virtio/virtio-access.h" 27 #include "migration/blocker.h" 28 #include "migration/qemu-file-types.h" 29 #include "sysemu/dma.h" 30 #include "sysemu/tcg.h" 31 #include "trace.h" 32 33 /* enabled until disconnected backend stabilizes */ 34 #define _VHOST_DEBUG 1 35 36 #ifdef _VHOST_DEBUG 37 #define VHOST_OPS_DEBUG(fmt, ...) \ 38 do { error_report(fmt ": %s (%d)", ## __VA_ARGS__, \ 39 strerror(errno), errno); } while (0) 40 #else 41 #define VHOST_OPS_DEBUG(fmt, ...) \ 42 do { } while (0) 43 #endif 44 45 static struct vhost_log *vhost_log; 46 static struct vhost_log *vhost_log_shm; 47 48 static unsigned int used_memslots; 49 static QLIST_HEAD(, vhost_dev) vhost_devices = 50 QLIST_HEAD_INITIALIZER(vhost_devices); 51 52 bool vhost_has_free_slot(void) 53 { 54 unsigned int slots_limit = ~0U; 55 struct vhost_dev *hdev; 56 57 QLIST_FOREACH(hdev, &vhost_devices, entry) { 58 unsigned int r = hdev->vhost_ops->vhost_backend_memslots_limit(hdev); 59 slots_limit = MIN(slots_limit, r); 60 } 61 return slots_limit > used_memslots; 62 } 63 64 static void vhost_dev_sync_region(struct vhost_dev *dev, 65 MemoryRegionSection *section, 66 uint64_t mfirst, uint64_t mlast, 67 uint64_t rfirst, uint64_t rlast) 68 { 69 vhost_log_chunk_t *log = dev->log->log; 70 71 uint64_t start = MAX(mfirst, rfirst); 72 uint64_t end = MIN(mlast, rlast); 73 vhost_log_chunk_t *from = log + start / VHOST_LOG_CHUNK; 74 vhost_log_chunk_t *to = log + end / VHOST_LOG_CHUNK + 1; 75 uint64_t addr = QEMU_ALIGN_DOWN(start, VHOST_LOG_CHUNK); 76 77 if (end < start) { 78 return; 79 } 80 assert(end / VHOST_LOG_CHUNK < dev->log_size); 81 assert(start / VHOST_LOG_CHUNK < dev->log_size); 82 83 for (;from < to; ++from) { 84 vhost_log_chunk_t log; 85 /* We first check with non-atomic: much cheaper, 86 * and we expect non-dirty to be the common case. */ 87 if (!*from) { 88 addr += VHOST_LOG_CHUNK; 89 continue; 90 } 91 /* Data must be read atomically. We don't really need barrier semantics 92 * but it's easier to use atomic_* than roll our own. */ 93 log = qatomic_xchg(from, 0); 94 while (log) { 95 int bit = ctzl(log); 96 hwaddr page_addr; 97 hwaddr section_offset; 98 hwaddr mr_offset; 99 page_addr = addr + bit * VHOST_LOG_PAGE; 100 section_offset = page_addr - section->offset_within_address_space; 101 mr_offset = section_offset + section->offset_within_region; 102 memory_region_set_dirty(section->mr, mr_offset, VHOST_LOG_PAGE); 103 log &= ~(0x1ull << bit); 104 } 105 addr += VHOST_LOG_CHUNK; 106 } 107 } 108 109 static int vhost_sync_dirty_bitmap(struct vhost_dev *dev, 110 MemoryRegionSection *section, 111 hwaddr first, 112 hwaddr last) 113 { 114 int i; 115 hwaddr start_addr; 116 hwaddr end_addr; 117 118 if (!dev->log_enabled || !dev->started) { 119 return 0; 120 } 121 start_addr = section->offset_within_address_space; 122 end_addr = range_get_last(start_addr, int128_get64(section->size)); 123 start_addr = MAX(first, start_addr); 124 end_addr = MIN(last, end_addr); 125 126 for (i = 0; i < dev->mem->nregions; ++i) { 127 struct vhost_memory_region *reg = dev->mem->regions + i; 128 vhost_dev_sync_region(dev, section, start_addr, end_addr, 129 reg->guest_phys_addr, 130 range_get_last(reg->guest_phys_addr, 131 reg->memory_size)); 132 } 133 for (i = 0; i < dev->nvqs; ++i) { 134 struct vhost_virtqueue *vq = dev->vqs + i; 135 136 if (!vq->used_phys && !vq->used_size) { 137 continue; 138 } 139 140 vhost_dev_sync_region(dev, section, start_addr, end_addr, vq->used_phys, 141 range_get_last(vq->used_phys, vq->used_size)); 142 } 143 return 0; 144 } 145 146 static void vhost_log_sync(MemoryListener *listener, 147 MemoryRegionSection *section) 148 { 149 struct vhost_dev *dev = container_of(listener, struct vhost_dev, 150 memory_listener); 151 vhost_sync_dirty_bitmap(dev, section, 0x0, ~0x0ULL); 152 } 153 154 static void vhost_log_sync_range(struct vhost_dev *dev, 155 hwaddr first, hwaddr last) 156 { 157 int i; 158 /* FIXME: this is N^2 in number of sections */ 159 for (i = 0; i < dev->n_mem_sections; ++i) { 160 MemoryRegionSection *section = &dev->mem_sections[i]; 161 vhost_sync_dirty_bitmap(dev, section, first, last); 162 } 163 } 164 165 static uint64_t vhost_get_log_size(struct vhost_dev *dev) 166 { 167 uint64_t log_size = 0; 168 int i; 169 for (i = 0; i < dev->mem->nregions; ++i) { 170 struct vhost_memory_region *reg = dev->mem->regions + i; 171 uint64_t last = range_get_last(reg->guest_phys_addr, 172 reg->memory_size); 173 log_size = MAX(log_size, last / VHOST_LOG_CHUNK + 1); 174 } 175 return log_size; 176 } 177 178 static struct vhost_log *vhost_log_alloc(uint64_t size, bool share) 179 { 180 Error *err = NULL; 181 struct vhost_log *log; 182 uint64_t logsize = size * sizeof(*(log->log)); 183 int fd = -1; 184 185 log = g_new0(struct vhost_log, 1); 186 if (share) { 187 log->log = qemu_memfd_alloc("vhost-log", logsize, 188 F_SEAL_GROW | F_SEAL_SHRINK | F_SEAL_SEAL, 189 &fd, &err); 190 if (err) { 191 error_report_err(err); 192 g_free(log); 193 return NULL; 194 } 195 memset(log->log, 0, logsize); 196 } else { 197 log->log = g_malloc0(logsize); 198 } 199 200 log->size = size; 201 log->refcnt = 1; 202 log->fd = fd; 203 204 return log; 205 } 206 207 static struct vhost_log *vhost_log_get(uint64_t size, bool share) 208 { 209 struct vhost_log *log = share ? vhost_log_shm : vhost_log; 210 211 if (!log || log->size != size) { 212 log = vhost_log_alloc(size, share); 213 if (share) { 214 vhost_log_shm = log; 215 } else { 216 vhost_log = log; 217 } 218 } else { 219 ++log->refcnt; 220 } 221 222 return log; 223 } 224 225 static void vhost_log_put(struct vhost_dev *dev, bool sync) 226 { 227 struct vhost_log *log = dev->log; 228 229 if (!log) { 230 return; 231 } 232 233 --log->refcnt; 234 if (log->refcnt == 0) { 235 /* Sync only the range covered by the old log */ 236 if (dev->log_size && sync) { 237 vhost_log_sync_range(dev, 0, dev->log_size * VHOST_LOG_CHUNK - 1); 238 } 239 240 if (vhost_log == log) { 241 g_free(log->log); 242 vhost_log = NULL; 243 } else if (vhost_log_shm == log) { 244 qemu_memfd_free(log->log, log->size * sizeof(*(log->log)), 245 log->fd); 246 vhost_log_shm = NULL; 247 } 248 249 g_free(log); 250 } 251 252 dev->log = NULL; 253 dev->log_size = 0; 254 } 255 256 static bool vhost_dev_log_is_shared(struct vhost_dev *dev) 257 { 258 return dev->vhost_ops->vhost_requires_shm_log && 259 dev->vhost_ops->vhost_requires_shm_log(dev); 260 } 261 262 static inline void vhost_dev_log_resize(struct vhost_dev *dev, uint64_t size) 263 { 264 struct vhost_log *log = vhost_log_get(size, vhost_dev_log_is_shared(dev)); 265 uint64_t log_base = (uintptr_t)log->log; 266 int r; 267 268 /* inform backend of log switching, this must be done before 269 releasing the current log, to ensure no logging is lost */ 270 r = dev->vhost_ops->vhost_set_log_base(dev, log_base, log); 271 if (r < 0) { 272 VHOST_OPS_DEBUG("vhost_set_log_base failed"); 273 } 274 275 vhost_log_put(dev, true); 276 dev->log = log; 277 dev->log_size = size; 278 } 279 280 static int vhost_dev_has_iommu(struct vhost_dev *dev) 281 { 282 VirtIODevice *vdev = dev->vdev; 283 284 /* 285 * For vhost, VIRTIO_F_IOMMU_PLATFORM means the backend support 286 * incremental memory mapping API via IOTLB API. For platform that 287 * does not have IOMMU, there's no need to enable this feature 288 * which may cause unnecessary IOTLB miss/update trnasactions. 289 */ 290 return vdev->dma_as != &address_space_memory && 291 virtio_host_has_feature(vdev, VIRTIO_F_IOMMU_PLATFORM); 292 } 293 294 static void *vhost_memory_map(struct vhost_dev *dev, hwaddr addr, 295 hwaddr *plen, bool is_write) 296 { 297 if (!vhost_dev_has_iommu(dev)) { 298 return cpu_physical_memory_map(addr, plen, is_write); 299 } else { 300 return (void *)(uintptr_t)addr; 301 } 302 } 303 304 static void vhost_memory_unmap(struct vhost_dev *dev, void *buffer, 305 hwaddr len, int is_write, 306 hwaddr access_len) 307 { 308 if (!vhost_dev_has_iommu(dev)) { 309 cpu_physical_memory_unmap(buffer, len, is_write, access_len); 310 } 311 } 312 313 static int vhost_verify_ring_part_mapping(void *ring_hva, 314 uint64_t ring_gpa, 315 uint64_t ring_size, 316 void *reg_hva, 317 uint64_t reg_gpa, 318 uint64_t reg_size) 319 { 320 uint64_t hva_ring_offset; 321 uint64_t ring_last = range_get_last(ring_gpa, ring_size); 322 uint64_t reg_last = range_get_last(reg_gpa, reg_size); 323 324 if (ring_last < reg_gpa || ring_gpa > reg_last) { 325 return 0; 326 } 327 /* check that whole ring's is mapped */ 328 if (ring_last > reg_last) { 329 return -ENOMEM; 330 } 331 /* check that ring's MemoryRegion wasn't replaced */ 332 hva_ring_offset = ring_gpa - reg_gpa; 333 if (ring_hva != reg_hva + hva_ring_offset) { 334 return -EBUSY; 335 } 336 337 return 0; 338 } 339 340 static int vhost_verify_ring_mappings(struct vhost_dev *dev, 341 void *reg_hva, 342 uint64_t reg_gpa, 343 uint64_t reg_size) 344 { 345 int i, j; 346 int r = 0; 347 const char *part_name[] = { 348 "descriptor table", 349 "available ring", 350 "used ring" 351 }; 352 353 if (vhost_dev_has_iommu(dev)) { 354 return 0; 355 } 356 357 for (i = 0; i < dev->nvqs; ++i) { 358 struct vhost_virtqueue *vq = dev->vqs + i; 359 360 if (vq->desc_phys == 0) { 361 continue; 362 } 363 364 j = 0; 365 r = vhost_verify_ring_part_mapping( 366 vq->desc, vq->desc_phys, vq->desc_size, 367 reg_hva, reg_gpa, reg_size); 368 if (r) { 369 break; 370 } 371 372 j++; 373 r = vhost_verify_ring_part_mapping( 374 vq->avail, vq->avail_phys, vq->avail_size, 375 reg_hva, reg_gpa, reg_size); 376 if (r) { 377 break; 378 } 379 380 j++; 381 r = vhost_verify_ring_part_mapping( 382 vq->used, vq->used_phys, vq->used_size, 383 reg_hva, reg_gpa, reg_size); 384 if (r) { 385 break; 386 } 387 } 388 389 if (r == -ENOMEM) { 390 error_report("Unable to map %s for ring %d", part_name[j], i); 391 } else if (r == -EBUSY) { 392 error_report("%s relocated for ring %d", part_name[j], i); 393 } 394 return r; 395 } 396 397 /* 398 * vhost_section: identify sections needed for vhost access 399 * 400 * We only care about RAM sections here (where virtqueue and guest 401 * internals accessed by virtio might live). If we find one we still 402 * allow the backend to potentially filter it out of our list. 403 */ 404 static bool vhost_section(struct vhost_dev *dev, MemoryRegionSection *section) 405 { 406 MemoryRegion *mr = section->mr; 407 408 if (memory_region_is_ram(mr) && !memory_region_is_rom(mr)) { 409 uint8_t dirty_mask = memory_region_get_dirty_log_mask(mr); 410 uint8_t handled_dirty; 411 412 /* 413 * Kernel based vhost doesn't handle any block which is doing 414 * dirty-tracking other than migration for which it has 415 * specific logging support. However for TCG the kernel never 416 * gets involved anyway so we can also ignore it's 417 * self-modiying code detection flags. However a vhost-user 418 * client could still confuse a TCG guest if it re-writes 419 * executable memory that has already been translated. 420 */ 421 handled_dirty = (1 << DIRTY_MEMORY_MIGRATION) | 422 (1 << DIRTY_MEMORY_CODE); 423 424 if (dirty_mask & ~handled_dirty) { 425 trace_vhost_reject_section(mr->name, 1); 426 return false; 427 } 428 429 if (dev->vhost_ops->vhost_backend_mem_section_filter && 430 !dev->vhost_ops->vhost_backend_mem_section_filter(dev, section)) { 431 trace_vhost_reject_section(mr->name, 2); 432 return false; 433 } 434 435 trace_vhost_section(mr->name); 436 return true; 437 } else { 438 trace_vhost_reject_section(mr->name, 3); 439 return false; 440 } 441 } 442 443 static void vhost_begin(MemoryListener *listener) 444 { 445 struct vhost_dev *dev = container_of(listener, struct vhost_dev, 446 memory_listener); 447 dev->tmp_sections = NULL; 448 dev->n_tmp_sections = 0; 449 } 450 451 static void vhost_commit(MemoryListener *listener) 452 { 453 struct vhost_dev *dev = container_of(listener, struct vhost_dev, 454 memory_listener); 455 MemoryRegionSection *old_sections; 456 int n_old_sections; 457 uint64_t log_size; 458 size_t regions_size; 459 int r; 460 int i; 461 bool changed = false; 462 463 /* Note we can be called before the device is started, but then 464 * starting the device calls set_mem_table, so we need to have 465 * built the data structures. 466 */ 467 old_sections = dev->mem_sections; 468 n_old_sections = dev->n_mem_sections; 469 dev->mem_sections = dev->tmp_sections; 470 dev->n_mem_sections = dev->n_tmp_sections; 471 472 if (dev->n_mem_sections != n_old_sections) { 473 changed = true; 474 } else { 475 /* Same size, lets check the contents */ 476 for (int i = 0; i < n_old_sections; i++) { 477 if (!MemoryRegionSection_eq(&old_sections[i], 478 &dev->mem_sections[i])) { 479 changed = true; 480 break; 481 } 482 } 483 } 484 485 trace_vhost_commit(dev->started, changed); 486 if (!changed) { 487 goto out; 488 } 489 490 /* Rebuild the regions list from the new sections list */ 491 regions_size = offsetof(struct vhost_memory, regions) + 492 dev->n_mem_sections * sizeof dev->mem->regions[0]; 493 dev->mem = g_realloc(dev->mem, regions_size); 494 dev->mem->nregions = dev->n_mem_sections; 495 used_memslots = dev->mem->nregions; 496 for (i = 0; i < dev->n_mem_sections; i++) { 497 struct vhost_memory_region *cur_vmr = dev->mem->regions + i; 498 struct MemoryRegionSection *mrs = dev->mem_sections + i; 499 500 cur_vmr->guest_phys_addr = mrs->offset_within_address_space; 501 cur_vmr->memory_size = int128_get64(mrs->size); 502 cur_vmr->userspace_addr = 503 (uintptr_t)memory_region_get_ram_ptr(mrs->mr) + 504 mrs->offset_within_region; 505 cur_vmr->flags_padding = 0; 506 } 507 508 if (!dev->started) { 509 goto out; 510 } 511 512 for (i = 0; i < dev->mem->nregions; i++) { 513 if (vhost_verify_ring_mappings(dev, 514 (void *)(uintptr_t)dev->mem->regions[i].userspace_addr, 515 dev->mem->regions[i].guest_phys_addr, 516 dev->mem->regions[i].memory_size)) { 517 error_report("Verify ring failure on region %d", i); 518 abort(); 519 } 520 } 521 522 if (!dev->log_enabled) { 523 r = dev->vhost_ops->vhost_set_mem_table(dev, dev->mem); 524 if (r < 0) { 525 VHOST_OPS_DEBUG("vhost_set_mem_table failed"); 526 } 527 goto out; 528 } 529 log_size = vhost_get_log_size(dev); 530 /* We allocate an extra 4K bytes to log, 531 * to reduce the * number of reallocations. */ 532 #define VHOST_LOG_BUFFER (0x1000 / sizeof *dev->log) 533 /* To log more, must increase log size before table update. */ 534 if (dev->log_size < log_size) { 535 vhost_dev_log_resize(dev, log_size + VHOST_LOG_BUFFER); 536 } 537 r = dev->vhost_ops->vhost_set_mem_table(dev, dev->mem); 538 if (r < 0) { 539 VHOST_OPS_DEBUG("vhost_set_mem_table failed"); 540 } 541 /* To log less, can only decrease log size after table update. */ 542 if (dev->log_size > log_size + VHOST_LOG_BUFFER) { 543 vhost_dev_log_resize(dev, log_size); 544 } 545 546 out: 547 /* Deref the old list of sections, this must happen _after_ the 548 * vhost_set_mem_table to ensure the client isn't still using the 549 * section we're about to unref. 550 */ 551 while (n_old_sections--) { 552 memory_region_unref(old_sections[n_old_sections].mr); 553 } 554 g_free(old_sections); 555 return; 556 } 557 558 /* Adds the section data to the tmp_section structure. 559 * It relies on the listener calling us in memory address order 560 * and for each region (via the _add and _nop methods) to 561 * join neighbours. 562 */ 563 static void vhost_region_add_section(struct vhost_dev *dev, 564 MemoryRegionSection *section) 565 { 566 bool need_add = true; 567 uint64_t mrs_size = int128_get64(section->size); 568 uint64_t mrs_gpa = section->offset_within_address_space; 569 uintptr_t mrs_host = (uintptr_t)memory_region_get_ram_ptr(section->mr) + 570 section->offset_within_region; 571 RAMBlock *mrs_rb = section->mr->ram_block; 572 573 trace_vhost_region_add_section(section->mr->name, mrs_gpa, mrs_size, 574 mrs_host); 575 576 if (dev->vhost_ops->backend_type == VHOST_BACKEND_TYPE_USER) { 577 /* Round the section to it's page size */ 578 /* First align the start down to a page boundary */ 579 size_t mrs_page = qemu_ram_pagesize(mrs_rb); 580 uint64_t alignage = mrs_host & (mrs_page - 1); 581 if (alignage) { 582 mrs_host -= alignage; 583 mrs_size += alignage; 584 mrs_gpa -= alignage; 585 } 586 /* Now align the size up to a page boundary */ 587 alignage = mrs_size & (mrs_page - 1); 588 if (alignage) { 589 mrs_size += mrs_page - alignage; 590 } 591 trace_vhost_region_add_section_aligned(section->mr->name, mrs_gpa, 592 mrs_size, mrs_host); 593 } 594 595 if (dev->n_tmp_sections) { 596 /* Since we already have at least one section, lets see if 597 * this extends it; since we're scanning in order, we only 598 * have to look at the last one, and the FlatView that calls 599 * us shouldn't have overlaps. 600 */ 601 MemoryRegionSection *prev_sec = dev->tmp_sections + 602 (dev->n_tmp_sections - 1); 603 uint64_t prev_gpa_start = prev_sec->offset_within_address_space; 604 uint64_t prev_size = int128_get64(prev_sec->size); 605 uint64_t prev_gpa_end = range_get_last(prev_gpa_start, prev_size); 606 uint64_t prev_host_start = 607 (uintptr_t)memory_region_get_ram_ptr(prev_sec->mr) + 608 prev_sec->offset_within_region; 609 uint64_t prev_host_end = range_get_last(prev_host_start, prev_size); 610 611 if (mrs_gpa <= (prev_gpa_end + 1)) { 612 /* OK, looks like overlapping/intersecting - it's possible that 613 * the rounding to page sizes has made them overlap, but they should 614 * match up in the same RAMBlock if they do. 615 */ 616 if (mrs_gpa < prev_gpa_start) { 617 error_report("%s:Section '%s' rounded to %"PRIx64 618 " prior to previous '%s' %"PRIx64, 619 __func__, section->mr->name, mrs_gpa, 620 prev_sec->mr->name, prev_gpa_start); 621 /* A way to cleanly fail here would be better */ 622 return; 623 } 624 /* Offset from the start of the previous GPA to this GPA */ 625 size_t offset = mrs_gpa - prev_gpa_start; 626 627 if (prev_host_start + offset == mrs_host && 628 section->mr == prev_sec->mr && 629 (!dev->vhost_ops->vhost_backend_can_merge || 630 dev->vhost_ops->vhost_backend_can_merge(dev, 631 mrs_host, mrs_size, 632 prev_host_start, prev_size))) { 633 uint64_t max_end = MAX(prev_host_end, mrs_host + mrs_size); 634 need_add = false; 635 prev_sec->offset_within_address_space = 636 MIN(prev_gpa_start, mrs_gpa); 637 prev_sec->offset_within_region = 638 MIN(prev_host_start, mrs_host) - 639 (uintptr_t)memory_region_get_ram_ptr(prev_sec->mr); 640 prev_sec->size = int128_make64(max_end - MIN(prev_host_start, 641 mrs_host)); 642 trace_vhost_region_add_section_merge(section->mr->name, 643 int128_get64(prev_sec->size), 644 prev_sec->offset_within_address_space, 645 prev_sec->offset_within_region); 646 } else { 647 /* adjoining regions are fine, but overlapping ones with 648 * different blocks/offsets shouldn't happen 649 */ 650 if (mrs_gpa != prev_gpa_end + 1) { 651 error_report("%s: Overlapping but not coherent sections " 652 "at %"PRIx64, 653 __func__, mrs_gpa); 654 return; 655 } 656 } 657 } 658 } 659 660 if (need_add) { 661 ++dev->n_tmp_sections; 662 dev->tmp_sections = g_renew(MemoryRegionSection, dev->tmp_sections, 663 dev->n_tmp_sections); 664 dev->tmp_sections[dev->n_tmp_sections - 1] = *section; 665 /* The flatview isn't stable and we don't use it, making it NULL 666 * means we can memcmp the list. 667 */ 668 dev->tmp_sections[dev->n_tmp_sections - 1].fv = NULL; 669 memory_region_ref(section->mr); 670 } 671 } 672 673 /* Used for both add and nop callbacks */ 674 static void vhost_region_addnop(MemoryListener *listener, 675 MemoryRegionSection *section) 676 { 677 struct vhost_dev *dev = container_of(listener, struct vhost_dev, 678 memory_listener); 679 680 if (!vhost_section(dev, section)) { 681 return; 682 } 683 vhost_region_add_section(dev, section); 684 } 685 686 static void vhost_iommu_unmap_notify(IOMMUNotifier *n, IOMMUTLBEntry *iotlb) 687 { 688 struct vhost_iommu *iommu = container_of(n, struct vhost_iommu, n); 689 struct vhost_dev *hdev = iommu->hdev; 690 hwaddr iova = iotlb->iova + iommu->iommu_offset; 691 692 if (vhost_backend_invalidate_device_iotlb(hdev, iova, 693 iotlb->addr_mask + 1)) { 694 error_report("Fail to invalidate device iotlb"); 695 } 696 } 697 698 static void vhost_iommu_region_add(MemoryListener *listener, 699 MemoryRegionSection *section) 700 { 701 struct vhost_dev *dev = container_of(listener, struct vhost_dev, 702 iommu_listener); 703 struct vhost_iommu *iommu; 704 Int128 end; 705 int iommu_idx; 706 IOMMUMemoryRegion *iommu_mr; 707 int ret; 708 709 if (!memory_region_is_iommu(section->mr)) { 710 return; 711 } 712 713 iommu_mr = IOMMU_MEMORY_REGION(section->mr); 714 715 iommu = g_malloc0(sizeof(*iommu)); 716 end = int128_add(int128_make64(section->offset_within_region), 717 section->size); 718 end = int128_sub(end, int128_one()); 719 iommu_idx = memory_region_iommu_attrs_to_index(iommu_mr, 720 MEMTXATTRS_UNSPECIFIED); 721 iommu_notifier_init(&iommu->n, vhost_iommu_unmap_notify, 722 IOMMU_NOTIFIER_DEVIOTLB_UNMAP, 723 section->offset_within_region, 724 int128_get64(end), 725 iommu_idx); 726 iommu->mr = section->mr; 727 iommu->iommu_offset = section->offset_within_address_space - 728 section->offset_within_region; 729 iommu->hdev = dev; 730 ret = memory_region_register_iommu_notifier(section->mr, &iommu->n, NULL); 731 if (ret) { 732 /* 733 * Some vIOMMUs do not support dev-iotlb yet. If so, try to use the 734 * UNMAP legacy message 735 */ 736 iommu->n.notifier_flags = IOMMU_NOTIFIER_UNMAP; 737 memory_region_register_iommu_notifier(section->mr, &iommu->n, 738 &error_fatal); 739 } 740 QLIST_INSERT_HEAD(&dev->iommu_list, iommu, iommu_next); 741 /* TODO: can replay help performance here? */ 742 } 743 744 static void vhost_iommu_region_del(MemoryListener *listener, 745 MemoryRegionSection *section) 746 { 747 struct vhost_dev *dev = container_of(listener, struct vhost_dev, 748 iommu_listener); 749 struct vhost_iommu *iommu; 750 751 if (!memory_region_is_iommu(section->mr)) { 752 return; 753 } 754 755 QLIST_FOREACH(iommu, &dev->iommu_list, iommu_next) { 756 if (iommu->mr == section->mr && 757 iommu->n.start == section->offset_within_region) { 758 memory_region_unregister_iommu_notifier(iommu->mr, 759 &iommu->n); 760 QLIST_REMOVE(iommu, iommu_next); 761 g_free(iommu); 762 break; 763 } 764 } 765 } 766 767 static int vhost_virtqueue_set_addr(struct vhost_dev *dev, 768 struct vhost_virtqueue *vq, 769 unsigned idx, bool enable_log) 770 { 771 struct vhost_vring_addr addr; 772 int r; 773 memset(&addr, 0, sizeof(struct vhost_vring_addr)); 774 775 if (dev->vhost_ops->vhost_vq_get_addr) { 776 r = dev->vhost_ops->vhost_vq_get_addr(dev, &addr, vq); 777 if (r < 0) { 778 VHOST_OPS_DEBUG("vhost_vq_get_addr failed"); 779 return -errno; 780 } 781 } else { 782 addr.desc_user_addr = (uint64_t)(unsigned long)vq->desc; 783 addr.avail_user_addr = (uint64_t)(unsigned long)vq->avail; 784 addr.used_user_addr = (uint64_t)(unsigned long)vq->used; 785 } 786 addr.index = idx; 787 addr.log_guest_addr = vq->used_phys; 788 addr.flags = enable_log ? (1 << VHOST_VRING_F_LOG) : 0; 789 r = dev->vhost_ops->vhost_set_vring_addr(dev, &addr); 790 if (r < 0) { 791 VHOST_OPS_DEBUG("vhost_set_vring_addr failed"); 792 return -errno; 793 } 794 return 0; 795 } 796 797 static int vhost_dev_set_features(struct vhost_dev *dev, 798 bool enable_log) 799 { 800 uint64_t features = dev->acked_features; 801 int r; 802 if (enable_log) { 803 features |= 0x1ULL << VHOST_F_LOG_ALL; 804 } 805 if (!vhost_dev_has_iommu(dev)) { 806 features &= ~(0x1ULL << VIRTIO_F_IOMMU_PLATFORM); 807 } 808 if (dev->vhost_ops->vhost_force_iommu) { 809 if (dev->vhost_ops->vhost_force_iommu(dev) == true) { 810 features |= 0x1ULL << VIRTIO_F_IOMMU_PLATFORM; 811 } 812 } 813 r = dev->vhost_ops->vhost_set_features(dev, features); 814 if (r < 0) { 815 VHOST_OPS_DEBUG("vhost_set_features failed"); 816 goto out; 817 } 818 if (dev->vhost_ops->vhost_set_backend_cap) { 819 r = dev->vhost_ops->vhost_set_backend_cap(dev); 820 if (r < 0) { 821 VHOST_OPS_DEBUG("vhost_set_backend_cap failed"); 822 goto out; 823 } 824 } 825 826 out: 827 return r < 0 ? -errno : 0; 828 } 829 830 static int vhost_dev_set_log(struct vhost_dev *dev, bool enable_log) 831 { 832 int r, i, idx; 833 hwaddr addr; 834 835 r = vhost_dev_set_features(dev, enable_log); 836 if (r < 0) { 837 goto err_features; 838 } 839 for (i = 0; i < dev->nvqs; ++i) { 840 idx = dev->vhost_ops->vhost_get_vq_index(dev, dev->vq_index + i); 841 addr = virtio_queue_get_desc_addr(dev->vdev, idx); 842 if (!addr) { 843 /* 844 * The queue might not be ready for start. If this 845 * is the case there is no reason to continue the process. 846 * The similar logic is used by the vhost_virtqueue_start() 847 * routine. 848 */ 849 continue; 850 } 851 r = vhost_virtqueue_set_addr(dev, dev->vqs + i, idx, 852 enable_log); 853 if (r < 0) { 854 goto err_vq; 855 } 856 } 857 return 0; 858 err_vq: 859 for (; i >= 0; --i) { 860 idx = dev->vhost_ops->vhost_get_vq_index(dev, dev->vq_index + i); 861 vhost_virtqueue_set_addr(dev, dev->vqs + i, idx, 862 dev->log_enabled); 863 } 864 vhost_dev_set_features(dev, dev->log_enabled); 865 err_features: 866 return r; 867 } 868 869 static int vhost_migration_log(MemoryListener *listener, bool enable) 870 { 871 struct vhost_dev *dev = container_of(listener, struct vhost_dev, 872 memory_listener); 873 int r; 874 if (enable == dev->log_enabled) { 875 return 0; 876 } 877 if (!dev->started) { 878 dev->log_enabled = enable; 879 return 0; 880 } 881 882 r = 0; 883 if (!enable) { 884 r = vhost_dev_set_log(dev, false); 885 if (r < 0) { 886 goto check_dev_state; 887 } 888 vhost_log_put(dev, false); 889 } else { 890 vhost_dev_log_resize(dev, vhost_get_log_size(dev)); 891 r = vhost_dev_set_log(dev, true); 892 if (r < 0) { 893 goto check_dev_state; 894 } 895 } 896 897 check_dev_state: 898 dev->log_enabled = enable; 899 /* 900 * vhost-user-* devices could change their state during log 901 * initialization due to disconnect. So check dev state after 902 * vhost communication. 903 */ 904 if (!dev->started) { 905 /* 906 * Since device is in the stopped state, it is okay for 907 * migration. Return success. 908 */ 909 r = 0; 910 } 911 if (r) { 912 /* An error is occured. */ 913 dev->log_enabled = false; 914 } 915 916 return r; 917 } 918 919 static void vhost_log_global_start(MemoryListener *listener) 920 { 921 int r; 922 923 r = vhost_migration_log(listener, true); 924 if (r < 0) { 925 abort(); 926 } 927 } 928 929 static void vhost_log_global_stop(MemoryListener *listener) 930 { 931 int r; 932 933 r = vhost_migration_log(listener, false); 934 if (r < 0) { 935 abort(); 936 } 937 } 938 939 static void vhost_log_start(MemoryListener *listener, 940 MemoryRegionSection *section, 941 int old, int new) 942 { 943 /* FIXME: implement */ 944 } 945 946 static void vhost_log_stop(MemoryListener *listener, 947 MemoryRegionSection *section, 948 int old, int new) 949 { 950 /* FIXME: implement */ 951 } 952 953 /* The vhost driver natively knows how to handle the vrings of non 954 * cross-endian legacy devices and modern devices. Only legacy devices 955 * exposed to a bi-endian guest may require the vhost driver to use a 956 * specific endianness. 957 */ 958 static inline bool vhost_needs_vring_endian(VirtIODevice *vdev) 959 { 960 if (virtio_vdev_has_feature(vdev, VIRTIO_F_VERSION_1)) { 961 return false; 962 } 963 #ifdef HOST_WORDS_BIGENDIAN 964 return vdev->device_endian == VIRTIO_DEVICE_ENDIAN_LITTLE; 965 #else 966 return vdev->device_endian == VIRTIO_DEVICE_ENDIAN_BIG; 967 #endif 968 } 969 970 static int vhost_virtqueue_set_vring_endian_legacy(struct vhost_dev *dev, 971 bool is_big_endian, 972 int vhost_vq_index) 973 { 974 struct vhost_vring_state s = { 975 .index = vhost_vq_index, 976 .num = is_big_endian 977 }; 978 979 if (!dev->vhost_ops->vhost_set_vring_endian(dev, &s)) { 980 return 0; 981 } 982 983 VHOST_OPS_DEBUG("vhost_set_vring_endian failed"); 984 if (errno == ENOTTY) { 985 error_report("vhost does not support cross-endian"); 986 return -ENOSYS; 987 } 988 989 return -errno; 990 } 991 992 static int vhost_memory_region_lookup(struct vhost_dev *hdev, 993 uint64_t gpa, uint64_t *uaddr, 994 uint64_t *len) 995 { 996 int i; 997 998 for (i = 0; i < hdev->mem->nregions; i++) { 999 struct vhost_memory_region *reg = hdev->mem->regions + i; 1000 1001 if (gpa >= reg->guest_phys_addr && 1002 reg->guest_phys_addr + reg->memory_size > gpa) { 1003 *uaddr = reg->userspace_addr + gpa - reg->guest_phys_addr; 1004 *len = reg->guest_phys_addr + reg->memory_size - gpa; 1005 return 0; 1006 } 1007 } 1008 1009 return -EFAULT; 1010 } 1011 1012 int vhost_device_iotlb_miss(struct vhost_dev *dev, uint64_t iova, int write) 1013 { 1014 IOMMUTLBEntry iotlb; 1015 uint64_t uaddr, len; 1016 int ret = -EFAULT; 1017 1018 RCU_READ_LOCK_GUARD(); 1019 1020 trace_vhost_iotlb_miss(dev, 1); 1021 1022 iotlb = address_space_get_iotlb_entry(dev->vdev->dma_as, 1023 iova, write, 1024 MEMTXATTRS_UNSPECIFIED); 1025 if (iotlb.target_as != NULL) { 1026 ret = vhost_memory_region_lookup(dev, iotlb.translated_addr, 1027 &uaddr, &len); 1028 if (ret) { 1029 trace_vhost_iotlb_miss(dev, 3); 1030 error_report("Fail to lookup the translated address " 1031 "%"PRIx64, iotlb.translated_addr); 1032 goto out; 1033 } 1034 1035 len = MIN(iotlb.addr_mask + 1, len); 1036 iova = iova & ~iotlb.addr_mask; 1037 1038 ret = vhost_backend_update_device_iotlb(dev, iova, uaddr, 1039 len, iotlb.perm); 1040 if (ret) { 1041 trace_vhost_iotlb_miss(dev, 4); 1042 error_report("Fail to update device iotlb"); 1043 goto out; 1044 } 1045 } 1046 1047 trace_vhost_iotlb_miss(dev, 2); 1048 1049 out: 1050 return ret; 1051 } 1052 1053 static int vhost_virtqueue_start(struct vhost_dev *dev, 1054 struct VirtIODevice *vdev, 1055 struct vhost_virtqueue *vq, 1056 unsigned idx) 1057 { 1058 BusState *qbus = BUS(qdev_get_parent_bus(DEVICE(vdev))); 1059 VirtioBusState *vbus = VIRTIO_BUS(qbus); 1060 VirtioBusClass *k = VIRTIO_BUS_GET_CLASS(vbus); 1061 hwaddr s, l, a; 1062 int r; 1063 int vhost_vq_index = dev->vhost_ops->vhost_get_vq_index(dev, idx); 1064 struct vhost_vring_file file = { 1065 .index = vhost_vq_index 1066 }; 1067 struct vhost_vring_state state = { 1068 .index = vhost_vq_index 1069 }; 1070 struct VirtQueue *vvq = virtio_get_queue(vdev, idx); 1071 1072 a = virtio_queue_get_desc_addr(vdev, idx); 1073 if (a == 0) { 1074 /* Queue might not be ready for start */ 1075 return 0; 1076 } 1077 1078 vq->num = state.num = virtio_queue_get_num(vdev, idx); 1079 r = dev->vhost_ops->vhost_set_vring_num(dev, &state); 1080 if (r) { 1081 VHOST_OPS_DEBUG("vhost_set_vring_num failed"); 1082 return -errno; 1083 } 1084 1085 state.num = virtio_queue_get_last_avail_idx(vdev, idx); 1086 r = dev->vhost_ops->vhost_set_vring_base(dev, &state); 1087 if (r) { 1088 VHOST_OPS_DEBUG("vhost_set_vring_base failed"); 1089 return -errno; 1090 } 1091 1092 if (vhost_needs_vring_endian(vdev)) { 1093 r = vhost_virtqueue_set_vring_endian_legacy(dev, 1094 virtio_is_big_endian(vdev), 1095 vhost_vq_index); 1096 if (r) { 1097 return -errno; 1098 } 1099 } 1100 1101 vq->desc_size = s = l = virtio_queue_get_desc_size(vdev, idx); 1102 vq->desc_phys = a; 1103 vq->desc = vhost_memory_map(dev, a, &l, false); 1104 if (!vq->desc || l != s) { 1105 r = -ENOMEM; 1106 goto fail_alloc_desc; 1107 } 1108 vq->avail_size = s = l = virtio_queue_get_avail_size(vdev, idx); 1109 vq->avail_phys = a = virtio_queue_get_avail_addr(vdev, idx); 1110 vq->avail = vhost_memory_map(dev, a, &l, false); 1111 if (!vq->avail || l != s) { 1112 r = -ENOMEM; 1113 goto fail_alloc_avail; 1114 } 1115 vq->used_size = s = l = virtio_queue_get_used_size(vdev, idx); 1116 vq->used_phys = a = virtio_queue_get_used_addr(vdev, idx); 1117 vq->used = vhost_memory_map(dev, a, &l, true); 1118 if (!vq->used || l != s) { 1119 r = -ENOMEM; 1120 goto fail_alloc_used; 1121 } 1122 1123 r = vhost_virtqueue_set_addr(dev, vq, vhost_vq_index, dev->log_enabled); 1124 if (r < 0) { 1125 r = -errno; 1126 goto fail_alloc; 1127 } 1128 1129 file.fd = event_notifier_get_fd(virtio_queue_get_host_notifier(vvq)); 1130 r = dev->vhost_ops->vhost_set_vring_kick(dev, &file); 1131 if (r) { 1132 VHOST_OPS_DEBUG("vhost_set_vring_kick failed"); 1133 r = -errno; 1134 goto fail_kick; 1135 } 1136 1137 /* Clear and discard previous events if any. */ 1138 event_notifier_test_and_clear(&vq->masked_notifier); 1139 1140 /* Init vring in unmasked state, unless guest_notifier_mask 1141 * will do it later. 1142 */ 1143 if (!vdev->use_guest_notifier_mask) { 1144 /* TODO: check and handle errors. */ 1145 vhost_virtqueue_mask(dev, vdev, idx, false); 1146 } 1147 1148 if (k->query_guest_notifiers && 1149 k->query_guest_notifiers(qbus->parent) && 1150 virtio_queue_vector(vdev, idx) == VIRTIO_NO_VECTOR) { 1151 file.fd = -1; 1152 r = dev->vhost_ops->vhost_set_vring_call(dev, &file); 1153 if (r) { 1154 goto fail_vector; 1155 } 1156 } 1157 1158 return 0; 1159 1160 fail_vector: 1161 fail_kick: 1162 fail_alloc: 1163 vhost_memory_unmap(dev, vq->used, virtio_queue_get_used_size(vdev, idx), 1164 0, 0); 1165 fail_alloc_used: 1166 vhost_memory_unmap(dev, vq->avail, virtio_queue_get_avail_size(vdev, idx), 1167 0, 0); 1168 fail_alloc_avail: 1169 vhost_memory_unmap(dev, vq->desc, virtio_queue_get_desc_size(vdev, idx), 1170 0, 0); 1171 fail_alloc_desc: 1172 return r; 1173 } 1174 1175 static void vhost_virtqueue_stop(struct vhost_dev *dev, 1176 struct VirtIODevice *vdev, 1177 struct vhost_virtqueue *vq, 1178 unsigned idx) 1179 { 1180 int vhost_vq_index = dev->vhost_ops->vhost_get_vq_index(dev, idx); 1181 struct vhost_vring_state state = { 1182 .index = vhost_vq_index, 1183 }; 1184 int r; 1185 1186 if (virtio_queue_get_desc_addr(vdev, idx) == 0) { 1187 /* Don't stop the virtqueue which might have not been started */ 1188 return; 1189 } 1190 1191 r = dev->vhost_ops->vhost_get_vring_base(dev, &state); 1192 if (r < 0) { 1193 VHOST_OPS_DEBUG("vhost VQ %u ring restore failed: %d", idx, r); 1194 /* Connection to the backend is broken, so let's sync internal 1195 * last avail idx to the device used idx. 1196 */ 1197 virtio_queue_restore_last_avail_idx(vdev, idx); 1198 } else { 1199 virtio_queue_set_last_avail_idx(vdev, idx, state.num); 1200 } 1201 virtio_queue_invalidate_signalled_used(vdev, idx); 1202 virtio_queue_update_used_idx(vdev, idx); 1203 1204 /* In the cross-endian case, we need to reset the vring endianness to 1205 * native as legacy devices expect so by default. 1206 */ 1207 if (vhost_needs_vring_endian(vdev)) { 1208 vhost_virtqueue_set_vring_endian_legacy(dev, 1209 !virtio_is_big_endian(vdev), 1210 vhost_vq_index); 1211 } 1212 1213 vhost_memory_unmap(dev, vq->used, virtio_queue_get_used_size(vdev, idx), 1214 1, virtio_queue_get_used_size(vdev, idx)); 1215 vhost_memory_unmap(dev, vq->avail, virtio_queue_get_avail_size(vdev, idx), 1216 0, virtio_queue_get_avail_size(vdev, idx)); 1217 vhost_memory_unmap(dev, vq->desc, virtio_queue_get_desc_size(vdev, idx), 1218 0, virtio_queue_get_desc_size(vdev, idx)); 1219 } 1220 1221 static void vhost_eventfd_add(MemoryListener *listener, 1222 MemoryRegionSection *section, 1223 bool match_data, uint64_t data, EventNotifier *e) 1224 { 1225 } 1226 1227 static void vhost_eventfd_del(MemoryListener *listener, 1228 MemoryRegionSection *section, 1229 bool match_data, uint64_t data, EventNotifier *e) 1230 { 1231 } 1232 1233 static int vhost_virtqueue_set_busyloop_timeout(struct vhost_dev *dev, 1234 int n, uint32_t timeout) 1235 { 1236 int vhost_vq_index = dev->vhost_ops->vhost_get_vq_index(dev, n); 1237 struct vhost_vring_state state = { 1238 .index = vhost_vq_index, 1239 .num = timeout, 1240 }; 1241 int r; 1242 1243 if (!dev->vhost_ops->vhost_set_vring_busyloop_timeout) { 1244 return -EINVAL; 1245 } 1246 1247 r = dev->vhost_ops->vhost_set_vring_busyloop_timeout(dev, &state); 1248 if (r) { 1249 VHOST_OPS_DEBUG("vhost_set_vring_busyloop_timeout failed"); 1250 return r; 1251 } 1252 1253 return 0; 1254 } 1255 1256 static int vhost_virtqueue_init(struct vhost_dev *dev, 1257 struct vhost_virtqueue *vq, int n) 1258 { 1259 int vhost_vq_index = dev->vhost_ops->vhost_get_vq_index(dev, n); 1260 struct vhost_vring_file file = { 1261 .index = vhost_vq_index, 1262 }; 1263 int r = event_notifier_init(&vq->masked_notifier, 0); 1264 if (r < 0) { 1265 return r; 1266 } 1267 1268 file.fd = event_notifier_get_fd(&vq->masked_notifier); 1269 r = dev->vhost_ops->vhost_set_vring_call(dev, &file); 1270 if (r) { 1271 VHOST_OPS_DEBUG("vhost_set_vring_call failed"); 1272 r = -errno; 1273 goto fail_call; 1274 } 1275 1276 vq->dev = dev; 1277 1278 return 0; 1279 fail_call: 1280 event_notifier_cleanup(&vq->masked_notifier); 1281 return r; 1282 } 1283 1284 static void vhost_virtqueue_cleanup(struct vhost_virtqueue *vq) 1285 { 1286 event_notifier_cleanup(&vq->masked_notifier); 1287 } 1288 1289 int vhost_dev_init(struct vhost_dev *hdev, void *opaque, 1290 VhostBackendType backend_type, uint32_t busyloop_timeout) 1291 { 1292 uint64_t features; 1293 int i, r, n_initialized_vqs = 0; 1294 Error *local_err = NULL; 1295 1296 hdev->vdev = NULL; 1297 hdev->migration_blocker = NULL; 1298 1299 r = vhost_set_backend_type(hdev, backend_type); 1300 assert(r >= 0); 1301 1302 r = hdev->vhost_ops->vhost_backend_init(hdev, opaque); 1303 if (r < 0) { 1304 goto fail; 1305 } 1306 1307 r = hdev->vhost_ops->vhost_set_owner(hdev); 1308 if (r < 0) { 1309 VHOST_OPS_DEBUG("vhost_set_owner failed"); 1310 goto fail; 1311 } 1312 1313 r = hdev->vhost_ops->vhost_get_features(hdev, &features); 1314 if (r < 0) { 1315 VHOST_OPS_DEBUG("vhost_get_features failed"); 1316 goto fail; 1317 } 1318 1319 for (i = 0; i < hdev->nvqs; ++i, ++n_initialized_vqs) { 1320 r = vhost_virtqueue_init(hdev, hdev->vqs + i, hdev->vq_index + i); 1321 if (r < 0) { 1322 goto fail; 1323 } 1324 } 1325 1326 if (busyloop_timeout) { 1327 for (i = 0; i < hdev->nvqs; ++i) { 1328 r = vhost_virtqueue_set_busyloop_timeout(hdev, hdev->vq_index + i, 1329 busyloop_timeout); 1330 if (r < 0) { 1331 goto fail_busyloop; 1332 } 1333 } 1334 } 1335 1336 hdev->features = features; 1337 1338 hdev->memory_listener = (MemoryListener) { 1339 .begin = vhost_begin, 1340 .commit = vhost_commit, 1341 .region_add = vhost_region_addnop, 1342 .region_nop = vhost_region_addnop, 1343 .log_start = vhost_log_start, 1344 .log_stop = vhost_log_stop, 1345 .log_sync = vhost_log_sync, 1346 .log_global_start = vhost_log_global_start, 1347 .log_global_stop = vhost_log_global_stop, 1348 .eventfd_add = vhost_eventfd_add, 1349 .eventfd_del = vhost_eventfd_del, 1350 .priority = 10 1351 }; 1352 1353 hdev->iommu_listener = (MemoryListener) { 1354 .region_add = vhost_iommu_region_add, 1355 .region_del = vhost_iommu_region_del, 1356 }; 1357 1358 if (hdev->migration_blocker == NULL) { 1359 if (!(hdev->features & (0x1ULL << VHOST_F_LOG_ALL))) { 1360 error_setg(&hdev->migration_blocker, 1361 "Migration disabled: vhost lacks VHOST_F_LOG_ALL feature."); 1362 } else if (vhost_dev_log_is_shared(hdev) && !qemu_memfd_alloc_check()) { 1363 error_setg(&hdev->migration_blocker, 1364 "Migration disabled: failed to allocate shared memory"); 1365 } 1366 } 1367 1368 if (hdev->migration_blocker != NULL) { 1369 r = migrate_add_blocker(hdev->migration_blocker, &local_err); 1370 if (local_err) { 1371 error_report_err(local_err); 1372 error_free(hdev->migration_blocker); 1373 goto fail_busyloop; 1374 } 1375 } 1376 1377 hdev->mem = g_malloc0(offsetof(struct vhost_memory, regions)); 1378 hdev->n_mem_sections = 0; 1379 hdev->mem_sections = NULL; 1380 hdev->log = NULL; 1381 hdev->log_size = 0; 1382 hdev->log_enabled = false; 1383 hdev->started = false; 1384 memory_listener_register(&hdev->memory_listener, &address_space_memory); 1385 QLIST_INSERT_HEAD(&vhost_devices, hdev, entry); 1386 1387 if (used_memslots > hdev->vhost_ops->vhost_backend_memslots_limit(hdev)) { 1388 error_report("vhost backend memory slots limit is less" 1389 " than current number of present memory slots"); 1390 r = -1; 1391 if (busyloop_timeout) { 1392 goto fail_busyloop; 1393 } else { 1394 goto fail; 1395 } 1396 } 1397 1398 return 0; 1399 1400 fail_busyloop: 1401 while (--i >= 0) { 1402 vhost_virtqueue_set_busyloop_timeout(hdev, hdev->vq_index + i, 0); 1403 } 1404 fail: 1405 hdev->nvqs = n_initialized_vqs; 1406 vhost_dev_cleanup(hdev); 1407 return r; 1408 } 1409 1410 void vhost_dev_cleanup(struct vhost_dev *hdev) 1411 { 1412 int i; 1413 1414 for (i = 0; i < hdev->nvqs; ++i) { 1415 vhost_virtqueue_cleanup(hdev->vqs + i); 1416 } 1417 if (hdev->mem) { 1418 /* those are only safe after successful init */ 1419 memory_listener_unregister(&hdev->memory_listener); 1420 QLIST_REMOVE(hdev, entry); 1421 } 1422 if (hdev->migration_blocker) { 1423 migrate_del_blocker(hdev->migration_blocker); 1424 error_free(hdev->migration_blocker); 1425 } 1426 g_free(hdev->mem); 1427 g_free(hdev->mem_sections); 1428 if (hdev->vhost_ops) { 1429 hdev->vhost_ops->vhost_backend_cleanup(hdev); 1430 } 1431 assert(!hdev->log); 1432 1433 memset(hdev, 0, sizeof(struct vhost_dev)); 1434 } 1435 1436 /* Stop processing guest IO notifications in qemu. 1437 * Start processing them in vhost in kernel. 1438 */ 1439 int vhost_dev_enable_notifiers(struct vhost_dev *hdev, VirtIODevice *vdev) 1440 { 1441 BusState *qbus = BUS(qdev_get_parent_bus(DEVICE(vdev))); 1442 int i, r, e; 1443 1444 /* We will pass the notifiers to the kernel, make sure that QEMU 1445 * doesn't interfere. 1446 */ 1447 r = virtio_device_grab_ioeventfd(vdev); 1448 if (r < 0) { 1449 error_report("binding does not support host notifiers"); 1450 goto fail; 1451 } 1452 1453 for (i = 0; i < hdev->nvqs; ++i) { 1454 r = virtio_bus_set_host_notifier(VIRTIO_BUS(qbus), hdev->vq_index + i, 1455 true); 1456 if (r < 0) { 1457 error_report("vhost VQ %d notifier binding failed: %d", i, -r); 1458 goto fail_vq; 1459 } 1460 } 1461 1462 return 0; 1463 fail_vq: 1464 while (--i >= 0) { 1465 e = virtio_bus_set_host_notifier(VIRTIO_BUS(qbus), hdev->vq_index + i, 1466 false); 1467 if (e < 0) { 1468 error_report("vhost VQ %d notifier cleanup error: %d", i, -r); 1469 } 1470 assert (e >= 0); 1471 virtio_bus_cleanup_host_notifier(VIRTIO_BUS(qbus), hdev->vq_index + i); 1472 } 1473 virtio_device_release_ioeventfd(vdev); 1474 fail: 1475 return r; 1476 } 1477 1478 /* Stop processing guest IO notifications in vhost. 1479 * Start processing them in qemu. 1480 * This might actually run the qemu handlers right away, 1481 * so virtio in qemu must be completely setup when this is called. 1482 */ 1483 void vhost_dev_disable_notifiers(struct vhost_dev *hdev, VirtIODevice *vdev) 1484 { 1485 BusState *qbus = BUS(qdev_get_parent_bus(DEVICE(vdev))); 1486 int i, r; 1487 1488 for (i = 0; i < hdev->nvqs; ++i) { 1489 r = virtio_bus_set_host_notifier(VIRTIO_BUS(qbus), hdev->vq_index + i, 1490 false); 1491 if (r < 0) { 1492 error_report("vhost VQ %d notifier cleanup failed: %d", i, -r); 1493 } 1494 assert (r >= 0); 1495 virtio_bus_cleanup_host_notifier(VIRTIO_BUS(qbus), hdev->vq_index + i); 1496 } 1497 virtio_device_release_ioeventfd(vdev); 1498 } 1499 1500 /* Test and clear event pending status. 1501 * Should be called after unmask to avoid losing events. 1502 */ 1503 bool vhost_virtqueue_pending(struct vhost_dev *hdev, int n) 1504 { 1505 struct vhost_virtqueue *vq = hdev->vqs + n - hdev->vq_index; 1506 assert(n >= hdev->vq_index && n < hdev->vq_index + hdev->nvqs); 1507 return event_notifier_test_and_clear(&vq->masked_notifier); 1508 } 1509 1510 /* Mask/unmask events from this vq. */ 1511 void vhost_virtqueue_mask(struct vhost_dev *hdev, VirtIODevice *vdev, int n, 1512 bool mask) 1513 { 1514 struct VirtQueue *vvq = virtio_get_queue(vdev, n); 1515 int r, index = n - hdev->vq_index; 1516 struct vhost_vring_file file; 1517 1518 /* should only be called after backend is connected */ 1519 assert(hdev->vhost_ops); 1520 1521 if (mask) { 1522 assert(vdev->use_guest_notifier_mask); 1523 file.fd = event_notifier_get_fd(&hdev->vqs[index].masked_notifier); 1524 } else { 1525 file.fd = event_notifier_get_fd(virtio_queue_get_guest_notifier(vvq)); 1526 } 1527 1528 file.index = hdev->vhost_ops->vhost_get_vq_index(hdev, n); 1529 r = hdev->vhost_ops->vhost_set_vring_call(hdev, &file); 1530 if (r < 0) { 1531 VHOST_OPS_DEBUG("vhost_set_vring_call failed"); 1532 } 1533 } 1534 1535 uint64_t vhost_get_features(struct vhost_dev *hdev, const int *feature_bits, 1536 uint64_t features) 1537 { 1538 const int *bit = feature_bits; 1539 while (*bit != VHOST_INVALID_FEATURE_BIT) { 1540 uint64_t bit_mask = (1ULL << *bit); 1541 if (!(hdev->features & bit_mask)) { 1542 features &= ~bit_mask; 1543 } 1544 bit++; 1545 } 1546 return features; 1547 } 1548 1549 void vhost_ack_features(struct vhost_dev *hdev, const int *feature_bits, 1550 uint64_t features) 1551 { 1552 const int *bit = feature_bits; 1553 while (*bit != VHOST_INVALID_FEATURE_BIT) { 1554 uint64_t bit_mask = (1ULL << *bit); 1555 if (features & bit_mask) { 1556 hdev->acked_features |= bit_mask; 1557 } 1558 bit++; 1559 } 1560 } 1561 1562 int vhost_dev_get_config(struct vhost_dev *hdev, uint8_t *config, 1563 uint32_t config_len) 1564 { 1565 assert(hdev->vhost_ops); 1566 1567 if (hdev->vhost_ops->vhost_get_config) { 1568 return hdev->vhost_ops->vhost_get_config(hdev, config, config_len); 1569 } 1570 1571 return -1; 1572 } 1573 1574 int vhost_dev_set_config(struct vhost_dev *hdev, const uint8_t *data, 1575 uint32_t offset, uint32_t size, uint32_t flags) 1576 { 1577 assert(hdev->vhost_ops); 1578 1579 if (hdev->vhost_ops->vhost_set_config) { 1580 return hdev->vhost_ops->vhost_set_config(hdev, data, offset, 1581 size, flags); 1582 } 1583 1584 return -1; 1585 } 1586 1587 void vhost_dev_set_config_notifier(struct vhost_dev *hdev, 1588 const VhostDevConfigOps *ops) 1589 { 1590 hdev->config_ops = ops; 1591 } 1592 1593 void vhost_dev_free_inflight(struct vhost_inflight *inflight) 1594 { 1595 if (inflight && inflight->addr) { 1596 qemu_memfd_free(inflight->addr, inflight->size, inflight->fd); 1597 inflight->addr = NULL; 1598 inflight->fd = -1; 1599 } 1600 } 1601 1602 static int vhost_dev_resize_inflight(struct vhost_inflight *inflight, 1603 uint64_t new_size) 1604 { 1605 Error *err = NULL; 1606 int fd = -1; 1607 void *addr = qemu_memfd_alloc("vhost-inflight", new_size, 1608 F_SEAL_GROW | F_SEAL_SHRINK | F_SEAL_SEAL, 1609 &fd, &err); 1610 1611 if (err) { 1612 error_report_err(err); 1613 return -1; 1614 } 1615 1616 vhost_dev_free_inflight(inflight); 1617 inflight->offset = 0; 1618 inflight->addr = addr; 1619 inflight->fd = fd; 1620 inflight->size = new_size; 1621 1622 return 0; 1623 } 1624 1625 void vhost_dev_save_inflight(struct vhost_inflight *inflight, QEMUFile *f) 1626 { 1627 if (inflight->addr) { 1628 qemu_put_be64(f, inflight->size); 1629 qemu_put_be16(f, inflight->queue_size); 1630 qemu_put_buffer(f, inflight->addr, inflight->size); 1631 } else { 1632 qemu_put_be64(f, 0); 1633 } 1634 } 1635 1636 int vhost_dev_load_inflight(struct vhost_inflight *inflight, QEMUFile *f) 1637 { 1638 uint64_t size; 1639 1640 size = qemu_get_be64(f); 1641 if (!size) { 1642 return 0; 1643 } 1644 1645 if (inflight->size != size) { 1646 if (vhost_dev_resize_inflight(inflight, size)) { 1647 return -1; 1648 } 1649 } 1650 inflight->queue_size = qemu_get_be16(f); 1651 1652 qemu_get_buffer(f, inflight->addr, size); 1653 1654 return 0; 1655 } 1656 1657 int vhost_dev_prepare_inflight(struct vhost_dev *hdev, VirtIODevice *vdev) 1658 { 1659 int r; 1660 1661 if (hdev->vhost_ops->vhost_get_inflight_fd == NULL || 1662 hdev->vhost_ops->vhost_set_inflight_fd == NULL) { 1663 return 0; 1664 } 1665 1666 hdev->vdev = vdev; 1667 1668 r = vhost_dev_set_features(hdev, hdev->log_enabled); 1669 if (r < 0) { 1670 VHOST_OPS_DEBUG("vhost_dev_prepare_inflight failed"); 1671 return r; 1672 } 1673 1674 return 0; 1675 } 1676 1677 int vhost_dev_set_inflight(struct vhost_dev *dev, 1678 struct vhost_inflight *inflight) 1679 { 1680 int r; 1681 1682 if (dev->vhost_ops->vhost_set_inflight_fd && inflight->addr) { 1683 r = dev->vhost_ops->vhost_set_inflight_fd(dev, inflight); 1684 if (r) { 1685 VHOST_OPS_DEBUG("vhost_set_inflight_fd failed"); 1686 return -errno; 1687 } 1688 } 1689 1690 return 0; 1691 } 1692 1693 int vhost_dev_get_inflight(struct vhost_dev *dev, uint16_t queue_size, 1694 struct vhost_inflight *inflight) 1695 { 1696 int r; 1697 1698 if (dev->vhost_ops->vhost_get_inflight_fd) { 1699 r = dev->vhost_ops->vhost_get_inflight_fd(dev, queue_size, inflight); 1700 if (r) { 1701 VHOST_OPS_DEBUG("vhost_get_inflight_fd failed"); 1702 return -errno; 1703 } 1704 } 1705 1706 return 0; 1707 } 1708 1709 /* Host notifiers must be enabled at this point. */ 1710 int vhost_dev_start(struct vhost_dev *hdev, VirtIODevice *vdev) 1711 { 1712 int i, r; 1713 1714 /* should only be called after backend is connected */ 1715 assert(hdev->vhost_ops); 1716 1717 hdev->started = true; 1718 hdev->vdev = vdev; 1719 1720 r = vhost_dev_set_features(hdev, hdev->log_enabled); 1721 if (r < 0) { 1722 goto fail_features; 1723 } 1724 1725 if (vhost_dev_has_iommu(hdev)) { 1726 memory_listener_register(&hdev->iommu_listener, vdev->dma_as); 1727 } 1728 1729 r = hdev->vhost_ops->vhost_set_mem_table(hdev, hdev->mem); 1730 if (r < 0) { 1731 VHOST_OPS_DEBUG("vhost_set_mem_table failed"); 1732 r = -errno; 1733 goto fail_mem; 1734 } 1735 for (i = 0; i < hdev->nvqs; ++i) { 1736 r = vhost_virtqueue_start(hdev, 1737 vdev, 1738 hdev->vqs + i, 1739 hdev->vq_index + i); 1740 if (r < 0) { 1741 goto fail_vq; 1742 } 1743 } 1744 1745 if (hdev->log_enabled) { 1746 uint64_t log_base; 1747 1748 hdev->log_size = vhost_get_log_size(hdev); 1749 hdev->log = vhost_log_get(hdev->log_size, 1750 vhost_dev_log_is_shared(hdev)); 1751 log_base = (uintptr_t)hdev->log->log; 1752 r = hdev->vhost_ops->vhost_set_log_base(hdev, 1753 hdev->log_size ? log_base : 0, 1754 hdev->log); 1755 if (r < 0) { 1756 VHOST_OPS_DEBUG("vhost_set_log_base failed"); 1757 r = -errno; 1758 goto fail_log; 1759 } 1760 } 1761 if (hdev->vhost_ops->vhost_dev_start) { 1762 r = hdev->vhost_ops->vhost_dev_start(hdev, true); 1763 if (r) { 1764 goto fail_log; 1765 } 1766 } 1767 if (vhost_dev_has_iommu(hdev) && 1768 hdev->vhost_ops->vhost_set_iotlb_callback) { 1769 hdev->vhost_ops->vhost_set_iotlb_callback(hdev, true); 1770 1771 /* Update used ring information for IOTLB to work correctly, 1772 * vhost-kernel code requires for this.*/ 1773 for (i = 0; i < hdev->nvqs; ++i) { 1774 struct vhost_virtqueue *vq = hdev->vqs + i; 1775 vhost_device_iotlb_miss(hdev, vq->used_phys, true); 1776 } 1777 } 1778 return 0; 1779 fail_log: 1780 vhost_log_put(hdev, false); 1781 fail_vq: 1782 while (--i >= 0) { 1783 vhost_virtqueue_stop(hdev, 1784 vdev, 1785 hdev->vqs + i, 1786 hdev->vq_index + i); 1787 } 1788 1789 fail_mem: 1790 fail_features: 1791 1792 hdev->started = false; 1793 return r; 1794 } 1795 1796 /* Host notifiers must be enabled at this point. */ 1797 void vhost_dev_stop(struct vhost_dev *hdev, VirtIODevice *vdev) 1798 { 1799 int i; 1800 1801 /* should only be called after backend is connected */ 1802 assert(hdev->vhost_ops); 1803 1804 if (hdev->vhost_ops->vhost_dev_start) { 1805 hdev->vhost_ops->vhost_dev_start(hdev, false); 1806 } 1807 for (i = 0; i < hdev->nvqs; ++i) { 1808 vhost_virtqueue_stop(hdev, 1809 vdev, 1810 hdev->vqs + i, 1811 hdev->vq_index + i); 1812 } 1813 1814 if (vhost_dev_has_iommu(hdev)) { 1815 if (hdev->vhost_ops->vhost_set_iotlb_callback) { 1816 hdev->vhost_ops->vhost_set_iotlb_callback(hdev, false); 1817 } 1818 memory_listener_unregister(&hdev->iommu_listener); 1819 } 1820 vhost_log_put(hdev, true); 1821 hdev->started = false; 1822 hdev->vdev = NULL; 1823 } 1824 1825 int vhost_net_set_backend(struct vhost_dev *hdev, 1826 struct vhost_vring_file *file) 1827 { 1828 if (hdev->vhost_ops->vhost_net_set_backend) { 1829 return hdev->vhost_ops->vhost_net_set_backend(hdev, file); 1830 } 1831 1832 return -1; 1833 } 1834