xref: /qemu/hw/vfio/container.c (revision 3dd5fc53)
1 /*
2  * generic functions used by VFIO devices
3  *
4  * Copyright Red Hat, Inc. 2012
5  *
6  * Authors:
7  *  Alex Williamson <alex.williamson@redhat.com>
8  *
9  * This work is licensed under the terms of the GNU GPL, version 2.  See
10  * the COPYING file in the top-level directory.
11  *
12  * Based on qemu-kvm device-assignment:
13  *  Adapted for KVM by Qumranet.
14  *  Copyright (c) 2007, Neocleus, Alex Novik (alex@neocleus.com)
15  *  Copyright (c) 2007, Neocleus, Guy Zana (guy@neocleus.com)
16  *  Copyright (C) 2008, Qumranet, Amit Shah (amit.shah@qumranet.com)
17  *  Copyright (C) 2008, Red Hat, Amit Shah (amit.shah@redhat.com)
18  *  Copyright (C) 2008, IBM, Muli Ben-Yehuda (muli@il.ibm.com)
19  */
20 
21 #include "qemu/osdep.h"
22 #include <sys/ioctl.h>
23 #include <linux/vfio.h>
24 
25 #include "hw/vfio/vfio-common.h"
26 #include "exec/address-spaces.h"
27 #include "exec/memory.h"
28 #include "exec/ram_addr.h"
29 #include "hw/hw.h"
30 #include "qemu/error-report.h"
31 #include "qemu/range.h"
32 #include "sysemu/reset.h"
33 #include "trace.h"
34 #include "qapi/error.h"
35 #include "migration/migration.h"
36 #include "pci.h"
37 
38 VFIOGroupList vfio_group_list =
39     QLIST_HEAD_INITIALIZER(vfio_group_list);
40 
41 static int vfio_ram_block_discard_disable(VFIOContainer *container, bool state)
42 {
43     switch (container->iommu_type) {
44     case VFIO_TYPE1v2_IOMMU:
45     case VFIO_TYPE1_IOMMU:
46         /*
47          * We support coordinated discarding of RAM via the RamDiscardManager.
48          */
49         return ram_block_uncoordinated_discard_disable(state);
50     default:
51         /*
52          * VFIO_SPAPR_TCE_IOMMU most probably works just fine with
53          * RamDiscardManager, however, it is completely untested.
54          *
55          * VFIO_SPAPR_TCE_v2_IOMMU with "DMA memory preregistering" does
56          * completely the opposite of managing mapping/pinning dynamically as
57          * required by RamDiscardManager. We would have to special-case sections
58          * with a RamDiscardManager.
59          */
60         return ram_block_discard_disable(state);
61     }
62 }
63 
64 static int vfio_dma_unmap_bitmap(const VFIOContainer *container,
65                                  hwaddr iova, ram_addr_t size,
66                                  IOMMUTLBEntry *iotlb)
67 {
68     const VFIOContainerBase *bcontainer = &container->bcontainer;
69     struct vfio_iommu_type1_dma_unmap *unmap;
70     struct vfio_bitmap *bitmap;
71     VFIOBitmap vbmap;
72     int ret;
73 
74     ret = vfio_bitmap_alloc(&vbmap, size);
75     if (ret) {
76         return ret;
77     }
78 
79     unmap = g_malloc0(sizeof(*unmap) + sizeof(*bitmap));
80 
81     unmap->argsz = sizeof(*unmap) + sizeof(*bitmap);
82     unmap->iova = iova;
83     unmap->size = size;
84     unmap->flags |= VFIO_DMA_UNMAP_FLAG_GET_DIRTY_BITMAP;
85     bitmap = (struct vfio_bitmap *)&unmap->data;
86 
87     /*
88      * cpu_physical_memory_set_dirty_lebitmap() supports pages in bitmap of
89      * qemu_real_host_page_size to mark those dirty. Hence set bitmap_pgsize
90      * to qemu_real_host_page_size.
91      */
92     bitmap->pgsize = qemu_real_host_page_size();
93     bitmap->size = vbmap.size;
94     bitmap->data = (__u64 *)vbmap.bitmap;
95 
96     if (vbmap.size > bcontainer->max_dirty_bitmap_size) {
97         error_report("UNMAP: Size of bitmap too big 0x%"PRIx64, vbmap.size);
98         ret = -E2BIG;
99         goto unmap_exit;
100     }
101 
102     ret = ioctl(container->fd, VFIO_IOMMU_UNMAP_DMA, unmap);
103     if (!ret) {
104         cpu_physical_memory_set_dirty_lebitmap(vbmap.bitmap,
105                 iotlb->translated_addr, vbmap.pages);
106     } else {
107         error_report("VFIO_UNMAP_DMA with DIRTY_BITMAP : %m");
108     }
109 
110 unmap_exit:
111     g_free(unmap);
112     g_free(vbmap.bitmap);
113 
114     return ret;
115 }
116 
117 /*
118  * DMA - Mapping and unmapping for the "type1" IOMMU interface used on x86
119  */
120 static int vfio_legacy_dma_unmap(const VFIOContainerBase *bcontainer,
121                                  hwaddr iova, ram_addr_t size,
122                                  IOMMUTLBEntry *iotlb)
123 {
124     const VFIOContainer *container = container_of(bcontainer, VFIOContainer,
125                                                   bcontainer);
126     struct vfio_iommu_type1_dma_unmap unmap = {
127         .argsz = sizeof(unmap),
128         .flags = 0,
129         .iova = iova,
130         .size = size,
131     };
132     bool need_dirty_sync = false;
133     int ret;
134 
135     if (iotlb && vfio_devices_all_running_and_mig_active(bcontainer)) {
136         if (!vfio_devices_all_device_dirty_tracking(bcontainer) &&
137             bcontainer->dirty_pages_supported) {
138             return vfio_dma_unmap_bitmap(container, iova, size, iotlb);
139         }
140 
141         need_dirty_sync = true;
142     }
143 
144     while (ioctl(container->fd, VFIO_IOMMU_UNMAP_DMA, &unmap)) {
145         /*
146          * The type1 backend has an off-by-one bug in the kernel (71a7d3d78e3c
147          * v4.15) where an overflow in its wrap-around check prevents us from
148          * unmapping the last page of the address space.  Test for the error
149          * condition and re-try the unmap excluding the last page.  The
150          * expectation is that we've never mapped the last page anyway and this
151          * unmap request comes via vIOMMU support which also makes it unlikely
152          * that this page is used.  This bug was introduced well after type1 v2
153          * support was introduced, so we shouldn't need to test for v1.  A fix
154          * is queued for kernel v5.0 so this workaround can be removed once
155          * affected kernels are sufficiently deprecated.
156          */
157         if (errno == EINVAL && unmap.size && !(unmap.iova + unmap.size) &&
158             container->iommu_type == VFIO_TYPE1v2_IOMMU) {
159             trace_vfio_legacy_dma_unmap_overflow_workaround();
160             unmap.size -= 1ULL << ctz64(bcontainer->pgsizes);
161             continue;
162         }
163         error_report("VFIO_UNMAP_DMA failed: %s", strerror(errno));
164         return -errno;
165     }
166 
167     if (need_dirty_sync) {
168         ret = vfio_get_dirty_bitmap(bcontainer, iova, size,
169                                     iotlb->translated_addr);
170         if (ret) {
171             return ret;
172         }
173     }
174 
175     return 0;
176 }
177 
178 static int vfio_legacy_dma_map(const VFIOContainerBase *bcontainer, hwaddr iova,
179                                ram_addr_t size, void *vaddr, bool readonly)
180 {
181     const VFIOContainer *container = container_of(bcontainer, VFIOContainer,
182                                                   bcontainer);
183     struct vfio_iommu_type1_dma_map map = {
184         .argsz = sizeof(map),
185         .flags = VFIO_DMA_MAP_FLAG_READ,
186         .vaddr = (__u64)(uintptr_t)vaddr,
187         .iova = iova,
188         .size = size,
189     };
190 
191     if (!readonly) {
192         map.flags |= VFIO_DMA_MAP_FLAG_WRITE;
193     }
194 
195     /*
196      * Try the mapping, if it fails with EBUSY, unmap the region and try
197      * again.  This shouldn't be necessary, but we sometimes see it in
198      * the VGA ROM space.
199      */
200     if (ioctl(container->fd, VFIO_IOMMU_MAP_DMA, &map) == 0 ||
201         (errno == EBUSY &&
202          vfio_legacy_dma_unmap(bcontainer, iova, size, NULL) == 0 &&
203          ioctl(container->fd, VFIO_IOMMU_MAP_DMA, &map) == 0)) {
204         return 0;
205     }
206 
207     error_report("VFIO_MAP_DMA failed: %s", strerror(errno));
208     return -errno;
209 }
210 
211 static int
212 vfio_legacy_set_dirty_page_tracking(const VFIOContainerBase *bcontainer,
213                                     bool start)
214 {
215     const VFIOContainer *container = container_of(bcontainer, VFIOContainer,
216                                                   bcontainer);
217     int ret;
218     struct vfio_iommu_type1_dirty_bitmap dirty = {
219         .argsz = sizeof(dirty),
220     };
221 
222     if (start) {
223         dirty.flags = VFIO_IOMMU_DIRTY_PAGES_FLAG_START;
224     } else {
225         dirty.flags = VFIO_IOMMU_DIRTY_PAGES_FLAG_STOP;
226     }
227 
228     ret = ioctl(container->fd, VFIO_IOMMU_DIRTY_PAGES, &dirty);
229     if (ret) {
230         ret = -errno;
231         error_report("Failed to set dirty tracking flag 0x%x errno: %d",
232                      dirty.flags, errno);
233     }
234 
235     return ret;
236 }
237 
238 static int vfio_legacy_query_dirty_bitmap(const VFIOContainerBase *bcontainer,
239                                           VFIOBitmap *vbmap,
240                                           hwaddr iova, hwaddr size)
241 {
242     const VFIOContainer *container = container_of(bcontainer, VFIOContainer,
243                                                   bcontainer);
244     struct vfio_iommu_type1_dirty_bitmap *dbitmap;
245     struct vfio_iommu_type1_dirty_bitmap_get *range;
246     int ret;
247 
248     dbitmap = g_malloc0(sizeof(*dbitmap) + sizeof(*range));
249 
250     dbitmap->argsz = sizeof(*dbitmap) + sizeof(*range);
251     dbitmap->flags = VFIO_IOMMU_DIRTY_PAGES_FLAG_GET_BITMAP;
252     range = (struct vfio_iommu_type1_dirty_bitmap_get *)&dbitmap->data;
253     range->iova = iova;
254     range->size = size;
255 
256     /*
257      * cpu_physical_memory_set_dirty_lebitmap() supports pages in bitmap of
258      * qemu_real_host_page_size to mark those dirty. Hence set bitmap's pgsize
259      * to qemu_real_host_page_size.
260      */
261     range->bitmap.pgsize = qemu_real_host_page_size();
262     range->bitmap.size = vbmap->size;
263     range->bitmap.data = (__u64 *)vbmap->bitmap;
264 
265     ret = ioctl(container->fd, VFIO_IOMMU_DIRTY_PAGES, dbitmap);
266     if (ret) {
267         ret = -errno;
268         error_report("Failed to get dirty bitmap for iova: 0x%"PRIx64
269                 " size: 0x%"PRIx64" err: %d", (uint64_t)range->iova,
270                 (uint64_t)range->size, errno);
271     }
272 
273     g_free(dbitmap);
274 
275     return ret;
276 }
277 
278 static struct vfio_info_cap_header *
279 vfio_get_iommu_type1_info_cap(struct vfio_iommu_type1_info *info, uint16_t id)
280 {
281     if (!(info->flags & VFIO_IOMMU_INFO_CAPS)) {
282         return NULL;
283     }
284 
285     return vfio_get_cap((void *)info, info->cap_offset, id);
286 }
287 
288 bool vfio_get_info_dma_avail(struct vfio_iommu_type1_info *info,
289                              unsigned int *avail)
290 {
291     struct vfio_info_cap_header *hdr;
292     struct vfio_iommu_type1_info_dma_avail *cap;
293 
294     /* If the capability cannot be found, assume no DMA limiting */
295     hdr = vfio_get_iommu_type1_info_cap(info,
296                                         VFIO_IOMMU_TYPE1_INFO_DMA_AVAIL);
297     if (!hdr) {
298         return false;
299     }
300 
301     if (avail != NULL) {
302         cap = (void *) hdr;
303         *avail = cap->avail;
304     }
305 
306     return true;
307 }
308 
309 static bool vfio_get_info_iova_range(struct vfio_iommu_type1_info *info,
310                                      VFIOContainerBase *bcontainer)
311 {
312     struct vfio_info_cap_header *hdr;
313     struct vfio_iommu_type1_info_cap_iova_range *cap;
314 
315     hdr = vfio_get_iommu_type1_info_cap(info,
316                                         VFIO_IOMMU_TYPE1_INFO_CAP_IOVA_RANGE);
317     if (!hdr) {
318         return false;
319     }
320 
321     cap = (void *)hdr;
322 
323     for (int i = 0; i < cap->nr_iovas; i++) {
324         Range *range = g_new(Range, 1);
325 
326         range_set_bounds(range, cap->iova_ranges[i].start,
327                          cap->iova_ranges[i].end);
328         bcontainer->iova_ranges =
329             range_list_insert(bcontainer->iova_ranges, range);
330     }
331 
332     return true;
333 }
334 
335 static void vfio_kvm_device_add_group(VFIOGroup *group)
336 {
337     Error *err = NULL;
338 
339     if (vfio_kvm_device_add_fd(group->fd, &err)) {
340         error_reportf_err(err, "group ID %d: ", group->groupid);
341     }
342 }
343 
344 static void vfio_kvm_device_del_group(VFIOGroup *group)
345 {
346     Error *err = NULL;
347 
348     if (vfio_kvm_device_del_fd(group->fd, &err)) {
349         error_reportf_err(err, "group ID %d: ", group->groupid);
350     }
351 }
352 
353 /*
354  * vfio_get_iommu_type - selects the richest iommu_type (v2 first)
355  */
356 static int vfio_get_iommu_type(VFIOContainer *container,
357                                Error **errp)
358 {
359     int iommu_types[] = { VFIO_TYPE1v2_IOMMU, VFIO_TYPE1_IOMMU,
360                           VFIO_SPAPR_TCE_v2_IOMMU, VFIO_SPAPR_TCE_IOMMU };
361     int i;
362 
363     for (i = 0; i < ARRAY_SIZE(iommu_types); i++) {
364         if (ioctl(container->fd, VFIO_CHECK_EXTENSION, iommu_types[i])) {
365             return iommu_types[i];
366         }
367     }
368     error_setg(errp, "No available IOMMU models");
369     return -EINVAL;
370 }
371 
372 /*
373  * vfio_get_iommu_ops - get a VFIOIOMMUClass associated with a type
374  */
375 static const VFIOIOMMUClass *vfio_get_iommu_class(int iommu_type, Error **errp)
376 {
377     ObjectClass *klass = NULL;
378 
379     switch (iommu_type) {
380     case VFIO_TYPE1v2_IOMMU:
381     case VFIO_TYPE1_IOMMU:
382         klass = object_class_by_name(TYPE_VFIO_IOMMU_LEGACY);
383         break;
384     case VFIO_SPAPR_TCE_v2_IOMMU:
385     case VFIO_SPAPR_TCE_IOMMU:
386         klass = object_class_by_name(TYPE_VFIO_IOMMU_SPAPR);
387         break;
388     default:
389         g_assert_not_reached();
390     };
391 
392     return VFIO_IOMMU_CLASS(klass);
393 }
394 
395 static int vfio_set_iommu(VFIOContainer *container, int group_fd,
396                           VFIOAddressSpace *space, Error **errp)
397 {
398     int iommu_type, ret;
399     const VFIOIOMMUClass *vioc;
400 
401     iommu_type = vfio_get_iommu_type(container, errp);
402     if (iommu_type < 0) {
403         return iommu_type;
404     }
405 
406     ret = ioctl(group_fd, VFIO_GROUP_SET_CONTAINER, &container->fd);
407     if (ret) {
408         error_setg_errno(errp, errno, "Failed to set group container");
409         return -errno;
410     }
411 
412     while (ioctl(container->fd, VFIO_SET_IOMMU, iommu_type)) {
413         if (iommu_type == VFIO_SPAPR_TCE_v2_IOMMU) {
414             /*
415              * On sPAPR, despite the IOMMU subdriver always advertises v1 and
416              * v2, the running platform may not support v2 and there is no
417              * way to guess it until an IOMMU group gets added to the container.
418              * So in case it fails with v2, try v1 as a fallback.
419              */
420             iommu_type = VFIO_SPAPR_TCE_IOMMU;
421             continue;
422         }
423         error_setg_errno(errp, errno, "Failed to set iommu for container");
424         return -errno;
425     }
426 
427     container->iommu_type = iommu_type;
428 
429     vioc = vfio_get_iommu_class(iommu_type, errp);
430     if (!vioc) {
431         error_setg(errp, "No available IOMMU models");
432         return -EINVAL;
433     }
434 
435     vfio_container_init(&container->bcontainer, space, vioc);
436     return 0;
437 }
438 
439 static int vfio_get_iommu_info(VFIOContainer *container,
440                                struct vfio_iommu_type1_info **info)
441 {
442 
443     size_t argsz = sizeof(struct vfio_iommu_type1_info);
444 
445     *info = g_new0(struct vfio_iommu_type1_info, 1);
446 again:
447     (*info)->argsz = argsz;
448 
449     if (ioctl(container->fd, VFIO_IOMMU_GET_INFO, *info)) {
450         g_free(*info);
451         *info = NULL;
452         return -errno;
453     }
454 
455     if (((*info)->argsz > argsz)) {
456         argsz = (*info)->argsz;
457         *info = g_realloc(*info, argsz);
458         goto again;
459     }
460 
461     return 0;
462 }
463 
464 static struct vfio_info_cap_header *
465 vfio_get_iommu_info_cap(struct vfio_iommu_type1_info *info, uint16_t id)
466 {
467     struct vfio_info_cap_header *hdr;
468     void *ptr = info;
469 
470     if (!(info->flags & VFIO_IOMMU_INFO_CAPS)) {
471         return NULL;
472     }
473 
474     for (hdr = ptr + info->cap_offset; hdr != ptr; hdr = ptr + hdr->next) {
475         if (hdr->id == id) {
476             return hdr;
477         }
478     }
479 
480     return NULL;
481 }
482 
483 static void vfio_get_iommu_info_migration(VFIOContainer *container,
484                                           struct vfio_iommu_type1_info *info)
485 {
486     struct vfio_info_cap_header *hdr;
487     struct vfio_iommu_type1_info_cap_migration *cap_mig;
488     VFIOContainerBase *bcontainer = &container->bcontainer;
489 
490     hdr = vfio_get_iommu_info_cap(info, VFIO_IOMMU_TYPE1_INFO_CAP_MIGRATION);
491     if (!hdr) {
492         return;
493     }
494 
495     cap_mig = container_of(hdr, struct vfio_iommu_type1_info_cap_migration,
496                             header);
497 
498     /*
499      * cpu_physical_memory_set_dirty_lebitmap() supports pages in bitmap of
500      * qemu_real_host_page_size to mark those dirty.
501      */
502     if (cap_mig->pgsize_bitmap & qemu_real_host_page_size()) {
503         bcontainer->dirty_pages_supported = true;
504         bcontainer->max_dirty_bitmap_size = cap_mig->max_dirty_bitmap_size;
505         bcontainer->dirty_pgsizes = cap_mig->pgsize_bitmap;
506     }
507 }
508 
509 static int vfio_legacy_setup(VFIOContainerBase *bcontainer, Error **errp)
510 {
511     VFIOContainer *container = container_of(bcontainer, VFIOContainer,
512                                             bcontainer);
513     g_autofree struct vfio_iommu_type1_info *info = NULL;
514     int ret;
515 
516     ret = vfio_get_iommu_info(container, &info);
517     if (ret) {
518         error_setg_errno(errp, -ret, "Failed to get VFIO IOMMU info");
519         return ret;
520     }
521 
522     if (info->flags & VFIO_IOMMU_INFO_PGSIZES) {
523         bcontainer->pgsizes = info->iova_pgsizes;
524     } else {
525         bcontainer->pgsizes = qemu_real_host_page_size();
526     }
527 
528     if (!vfio_get_info_dma_avail(info, &bcontainer->dma_max_mappings)) {
529         bcontainer->dma_max_mappings = 65535;
530     }
531 
532     vfio_get_info_iova_range(info, bcontainer);
533 
534     vfio_get_iommu_info_migration(container, info);
535     return 0;
536 }
537 
538 static int vfio_connect_container(VFIOGroup *group, AddressSpace *as,
539                                   Error **errp)
540 {
541     VFIOContainer *container;
542     VFIOContainerBase *bcontainer;
543     int ret, fd;
544     VFIOAddressSpace *space;
545 
546     space = vfio_get_address_space(as);
547 
548     /*
549      * VFIO is currently incompatible with discarding of RAM insofar as the
550      * madvise to purge (zap) the page from QEMU's address space does not
551      * interact with the memory API and therefore leaves stale virtual to
552      * physical mappings in the IOMMU if the page was previously pinned.  We
553      * therefore set discarding broken for each group added to a container,
554      * whether the container is used individually or shared.  This provides
555      * us with options to allow devices within a group to opt-in and allow
556      * discarding, so long as it is done consistently for a group (for instance
557      * if the device is an mdev device where it is known that the host vendor
558      * driver will never pin pages outside of the working set of the guest
559      * driver, which would thus not be discarding candidates).
560      *
561      * The first opportunity to induce pinning occurs here where we attempt to
562      * attach the group to existing containers within the AddressSpace.  If any
563      * pages are already zapped from the virtual address space, such as from
564      * previous discards, new pinning will cause valid mappings to be
565      * re-established.  Likewise, when the overall MemoryListener for a new
566      * container is registered, a replay of mappings within the AddressSpace
567      * will occur, re-establishing any previously zapped pages as well.
568      *
569      * Especially virtio-balloon is currently only prevented from discarding
570      * new memory, it will not yet set ram_block_discard_set_required() and
571      * therefore, neither stops us here or deals with the sudden memory
572      * consumption of inflated memory.
573      *
574      * We do support discarding of memory coordinated via the RamDiscardManager
575      * with some IOMMU types. vfio_ram_block_discard_disable() handles the
576      * details once we know which type of IOMMU we are using.
577      */
578 
579     QLIST_FOREACH(bcontainer, &space->containers, next) {
580         container = container_of(bcontainer, VFIOContainer, bcontainer);
581         if (!ioctl(group->fd, VFIO_GROUP_SET_CONTAINER, &container->fd)) {
582             ret = vfio_ram_block_discard_disable(container, true);
583             if (ret) {
584                 error_setg_errno(errp, -ret,
585                                  "Cannot set discarding of RAM broken");
586                 if (ioctl(group->fd, VFIO_GROUP_UNSET_CONTAINER,
587                           &container->fd)) {
588                     error_report("vfio: error disconnecting group %d from"
589                                  " container", group->groupid);
590                 }
591                 return ret;
592             }
593             group->container = container;
594             QLIST_INSERT_HEAD(&container->group_list, group, container_next);
595             vfio_kvm_device_add_group(group);
596             return 0;
597         }
598     }
599 
600     fd = qemu_open_old("/dev/vfio/vfio", O_RDWR);
601     if (fd < 0) {
602         error_setg_errno(errp, errno, "failed to open /dev/vfio/vfio");
603         ret = -errno;
604         goto put_space_exit;
605     }
606 
607     ret = ioctl(fd, VFIO_GET_API_VERSION);
608     if (ret != VFIO_API_VERSION) {
609         error_setg(errp, "supported vfio version: %d, "
610                    "reported version: %d", VFIO_API_VERSION, ret);
611         ret = -EINVAL;
612         goto close_fd_exit;
613     }
614 
615     container = g_malloc0(sizeof(*container));
616     container->fd = fd;
617     bcontainer = &container->bcontainer;
618 
619     ret = vfio_set_iommu(container, group->fd, space, errp);
620     if (ret) {
621         goto free_container_exit;
622     }
623 
624     ret = vfio_ram_block_discard_disable(container, true);
625     if (ret) {
626         error_setg_errno(errp, -ret, "Cannot set discarding of RAM broken");
627         goto free_container_exit;
628     }
629 
630     assert(bcontainer->ops->setup);
631 
632     ret = bcontainer->ops->setup(bcontainer, errp);
633     if (ret) {
634         goto enable_discards_exit;
635     }
636 
637     vfio_kvm_device_add_group(group);
638 
639     QLIST_INIT(&container->group_list);
640     QLIST_INSERT_HEAD(&space->containers, bcontainer, next);
641 
642     group->container = container;
643     QLIST_INSERT_HEAD(&container->group_list, group, container_next);
644 
645     bcontainer->listener = vfio_memory_listener;
646     memory_listener_register(&bcontainer->listener, bcontainer->space->as);
647 
648     if (bcontainer->error) {
649         ret = -1;
650         error_propagate_prepend(errp, bcontainer->error,
651             "memory listener initialization failed: ");
652         goto listener_release_exit;
653     }
654 
655     bcontainer->initialized = true;
656 
657     return 0;
658 listener_release_exit:
659     QLIST_REMOVE(group, container_next);
660     QLIST_REMOVE(bcontainer, next);
661     vfio_kvm_device_del_group(group);
662     memory_listener_unregister(&bcontainer->listener);
663     if (bcontainer->ops->release) {
664         bcontainer->ops->release(bcontainer);
665     }
666 
667 enable_discards_exit:
668     vfio_ram_block_discard_disable(container, false);
669 
670 free_container_exit:
671     g_free(container);
672 
673 close_fd_exit:
674     close(fd);
675 
676 put_space_exit:
677     vfio_put_address_space(space);
678 
679     return ret;
680 }
681 
682 static void vfio_disconnect_container(VFIOGroup *group)
683 {
684     VFIOContainer *container = group->container;
685     VFIOContainerBase *bcontainer = &container->bcontainer;
686 
687     QLIST_REMOVE(group, container_next);
688     group->container = NULL;
689 
690     /*
691      * Explicitly release the listener first before unset container,
692      * since unset may destroy the backend container if it's the last
693      * group.
694      */
695     if (QLIST_EMPTY(&container->group_list)) {
696         memory_listener_unregister(&bcontainer->listener);
697         if (bcontainer->ops->release) {
698             bcontainer->ops->release(bcontainer);
699         }
700     }
701 
702     if (ioctl(group->fd, VFIO_GROUP_UNSET_CONTAINER, &container->fd)) {
703         error_report("vfio: error disconnecting group %d from container",
704                      group->groupid);
705     }
706 
707     if (QLIST_EMPTY(&container->group_list)) {
708         VFIOAddressSpace *space = bcontainer->space;
709 
710         vfio_container_destroy(bcontainer);
711 
712         trace_vfio_disconnect_container(container->fd);
713         close(container->fd);
714         g_free(container);
715 
716         vfio_put_address_space(space);
717     }
718 }
719 
720 static VFIOGroup *vfio_get_group(int groupid, AddressSpace *as, Error **errp)
721 {
722     ERRP_GUARD();
723     VFIOGroup *group;
724     char path[32];
725     struct vfio_group_status status = { .argsz = sizeof(status) };
726 
727     QLIST_FOREACH(group, &vfio_group_list, next) {
728         if (group->groupid == groupid) {
729             /* Found it.  Now is it already in the right context? */
730             if (group->container->bcontainer.space->as == as) {
731                 return group;
732             } else {
733                 error_setg(errp, "group %d used in multiple address spaces",
734                            group->groupid);
735                 return NULL;
736             }
737         }
738     }
739 
740     group = g_malloc0(sizeof(*group));
741 
742     snprintf(path, sizeof(path), "/dev/vfio/%d", groupid);
743     group->fd = qemu_open_old(path, O_RDWR);
744     if (group->fd < 0) {
745         error_setg_errno(errp, errno, "failed to open %s", path);
746         goto free_group_exit;
747     }
748 
749     if (ioctl(group->fd, VFIO_GROUP_GET_STATUS, &status)) {
750         error_setg_errno(errp, errno, "failed to get group %d status", groupid);
751         goto close_fd_exit;
752     }
753 
754     if (!(status.flags & VFIO_GROUP_FLAGS_VIABLE)) {
755         error_setg(errp, "group %d is not viable", groupid);
756         error_append_hint(errp,
757                           "Please ensure all devices within the iommu_group "
758                           "are bound to their vfio bus driver.\n");
759         goto close_fd_exit;
760     }
761 
762     group->groupid = groupid;
763     QLIST_INIT(&group->device_list);
764 
765     if (vfio_connect_container(group, as, errp)) {
766         error_prepend(errp, "failed to setup container for group %d: ",
767                       groupid);
768         goto close_fd_exit;
769     }
770 
771     QLIST_INSERT_HEAD(&vfio_group_list, group, next);
772 
773     return group;
774 
775 close_fd_exit:
776     close(group->fd);
777 
778 free_group_exit:
779     g_free(group);
780 
781     return NULL;
782 }
783 
784 static void vfio_put_group(VFIOGroup *group)
785 {
786     if (!group || !QLIST_EMPTY(&group->device_list)) {
787         return;
788     }
789 
790     if (!group->ram_block_discard_allowed) {
791         vfio_ram_block_discard_disable(group->container, false);
792     }
793     vfio_kvm_device_del_group(group);
794     vfio_disconnect_container(group);
795     QLIST_REMOVE(group, next);
796     trace_vfio_put_group(group->fd);
797     close(group->fd);
798     g_free(group);
799 }
800 
801 static int vfio_get_device(VFIOGroup *group, const char *name,
802                            VFIODevice *vbasedev, Error **errp)
803 {
804     g_autofree struct vfio_device_info *info = NULL;
805     int fd;
806 
807     fd = ioctl(group->fd, VFIO_GROUP_GET_DEVICE_FD, name);
808     if (fd < 0) {
809         error_setg_errno(errp, errno, "error getting device from group %d",
810                          group->groupid);
811         error_append_hint(errp,
812                       "Verify all devices in group %d are bound to vfio-<bus> "
813                       "or pci-stub and not already in use\n", group->groupid);
814         return fd;
815     }
816 
817     info = vfio_get_device_info(fd);
818     if (!info) {
819         error_setg_errno(errp, errno, "error getting device info");
820         close(fd);
821         return -1;
822     }
823 
824     /*
825      * Set discarding of RAM as not broken for this group if the driver knows
826      * the device operates compatibly with discarding.  Setting must be
827      * consistent per group, but since compatibility is really only possible
828      * with mdev currently, we expect singleton groups.
829      */
830     if (vbasedev->ram_block_discard_allowed !=
831         group->ram_block_discard_allowed) {
832         if (!QLIST_EMPTY(&group->device_list)) {
833             error_setg(errp, "Inconsistent setting of support for discarding "
834                        "RAM (e.g., balloon) within group");
835             close(fd);
836             return -1;
837         }
838 
839         if (!group->ram_block_discard_allowed) {
840             group->ram_block_discard_allowed = true;
841             vfio_ram_block_discard_disable(group->container, false);
842         }
843     }
844 
845     vbasedev->fd = fd;
846     vbasedev->group = group;
847     QLIST_INSERT_HEAD(&group->device_list, vbasedev, next);
848 
849     vbasedev->num_irqs = info->num_irqs;
850     vbasedev->num_regions = info->num_regions;
851     vbasedev->flags = info->flags;
852 
853     trace_vfio_get_device(name, info->flags, info->num_regions, info->num_irqs);
854 
855     vbasedev->reset_works = !!(info->flags & VFIO_DEVICE_FLAGS_RESET);
856 
857     return 0;
858 }
859 
860 static void vfio_put_base_device(VFIODevice *vbasedev)
861 {
862     if (!vbasedev->group) {
863         return;
864     }
865     QLIST_REMOVE(vbasedev, next);
866     vbasedev->group = NULL;
867     trace_vfio_put_base_device(vbasedev->fd);
868     close(vbasedev->fd);
869 }
870 
871 static int vfio_device_groupid(VFIODevice *vbasedev, Error **errp)
872 {
873     char *tmp, group_path[PATH_MAX];
874     g_autofree char *group_name = NULL;
875     int ret, groupid;
876     ssize_t len;
877 
878     tmp = g_strdup_printf("%s/iommu_group", vbasedev->sysfsdev);
879     len = readlink(tmp, group_path, sizeof(group_path));
880     g_free(tmp);
881 
882     if (len <= 0 || len >= sizeof(group_path)) {
883         ret = len < 0 ? -errno : -ENAMETOOLONG;
884         error_setg_errno(errp, -ret, "no iommu_group found");
885         return ret;
886     }
887 
888     group_path[len] = 0;
889 
890     group_name = g_path_get_basename(group_path);
891     if (sscanf(group_name, "%d", &groupid) != 1) {
892         error_setg_errno(errp, errno, "failed to read %s", group_path);
893         return -errno;
894     }
895     return groupid;
896 }
897 
898 /*
899  * vfio_attach_device: attach a device to a security context
900  * @name and @vbasedev->name are likely to be different depending
901  * on the type of the device, hence the need for passing @name
902  */
903 static int vfio_legacy_attach_device(const char *name, VFIODevice *vbasedev,
904                                      AddressSpace *as, Error **errp)
905 {
906     int groupid = vfio_device_groupid(vbasedev, errp);
907     VFIODevice *vbasedev_iter;
908     VFIOGroup *group;
909     VFIOContainerBase *bcontainer;
910     int ret;
911 
912     if (groupid < 0) {
913         return groupid;
914     }
915 
916     trace_vfio_attach_device(vbasedev->name, groupid);
917 
918     group = vfio_get_group(groupid, as, errp);
919     if (!group) {
920         return -ENOENT;
921     }
922 
923     QLIST_FOREACH(vbasedev_iter, &group->device_list, next) {
924         if (strcmp(vbasedev_iter->name, vbasedev->name) == 0) {
925             error_setg(errp, "device is already attached");
926             vfio_put_group(group);
927             return -EBUSY;
928         }
929     }
930     ret = vfio_get_device(group, name, vbasedev, errp);
931     if (ret) {
932         vfio_put_group(group);
933         return ret;
934     }
935 
936     bcontainer = &group->container->bcontainer;
937     vbasedev->bcontainer = bcontainer;
938     QLIST_INSERT_HEAD(&bcontainer->device_list, vbasedev, container_next);
939     QLIST_INSERT_HEAD(&vfio_device_list, vbasedev, global_next);
940 
941     return ret;
942 }
943 
944 static void vfio_legacy_detach_device(VFIODevice *vbasedev)
945 {
946     VFIOGroup *group = vbasedev->group;
947 
948     QLIST_REMOVE(vbasedev, global_next);
949     QLIST_REMOVE(vbasedev, container_next);
950     vbasedev->bcontainer = NULL;
951     trace_vfio_detach_device(vbasedev->name, group->groupid);
952     vfio_put_base_device(vbasedev);
953     vfio_put_group(group);
954 }
955 
956 static int vfio_legacy_pci_hot_reset(VFIODevice *vbasedev, bool single)
957 {
958     VFIOPCIDevice *vdev = container_of(vbasedev, VFIOPCIDevice, vbasedev);
959     VFIOGroup *group;
960     struct vfio_pci_hot_reset_info *info = NULL;
961     struct vfio_pci_dependent_device *devices;
962     struct vfio_pci_hot_reset *reset;
963     int32_t *fds;
964     int ret, i, count;
965     bool multi = false;
966 
967     trace_vfio_pci_hot_reset(vdev->vbasedev.name, single ? "one" : "multi");
968 
969     if (!single) {
970         vfio_pci_pre_reset(vdev);
971     }
972     vdev->vbasedev.needs_reset = false;
973 
974     ret = vfio_pci_get_pci_hot_reset_info(vdev, &info);
975 
976     if (ret) {
977         goto out_single;
978     }
979     devices = &info->devices[0];
980 
981     trace_vfio_pci_hot_reset_has_dep_devices(vdev->vbasedev.name);
982 
983     /* Verify that we have all the groups required */
984     for (i = 0; i < info->count; i++) {
985         PCIHostDeviceAddress host;
986         VFIOPCIDevice *tmp;
987         VFIODevice *vbasedev_iter;
988 
989         host.domain = devices[i].segment;
990         host.bus = devices[i].bus;
991         host.slot = PCI_SLOT(devices[i].devfn);
992         host.function = PCI_FUNC(devices[i].devfn);
993 
994         trace_vfio_pci_hot_reset_dep_devices(host.domain,
995                 host.bus, host.slot, host.function, devices[i].group_id);
996 
997         if (vfio_pci_host_match(&host, vdev->vbasedev.name)) {
998             continue;
999         }
1000 
1001         QLIST_FOREACH(group, &vfio_group_list, next) {
1002             if (group->groupid == devices[i].group_id) {
1003                 break;
1004             }
1005         }
1006 
1007         if (!group) {
1008             if (!vdev->has_pm_reset) {
1009                 error_report("vfio: Cannot reset device %s, "
1010                              "depends on group %d which is not owned.",
1011                              vdev->vbasedev.name, devices[i].group_id);
1012             }
1013             ret = -EPERM;
1014             goto out;
1015         }
1016 
1017         /* Prep dependent devices for reset and clear our marker. */
1018         QLIST_FOREACH(vbasedev_iter, &group->device_list, next) {
1019             if (!vbasedev_iter->dev->realized ||
1020                 vbasedev_iter->type != VFIO_DEVICE_TYPE_PCI) {
1021                 continue;
1022             }
1023             tmp = container_of(vbasedev_iter, VFIOPCIDevice, vbasedev);
1024             if (vfio_pci_host_match(&host, tmp->vbasedev.name)) {
1025                 if (single) {
1026                     ret = -EINVAL;
1027                     goto out_single;
1028                 }
1029                 vfio_pci_pre_reset(tmp);
1030                 tmp->vbasedev.needs_reset = false;
1031                 multi = true;
1032                 break;
1033             }
1034         }
1035     }
1036 
1037     if (!single && !multi) {
1038         ret = -EINVAL;
1039         goto out_single;
1040     }
1041 
1042     /* Determine how many group fds need to be passed */
1043     count = 0;
1044     QLIST_FOREACH(group, &vfio_group_list, next) {
1045         for (i = 0; i < info->count; i++) {
1046             if (group->groupid == devices[i].group_id) {
1047                 count++;
1048                 break;
1049             }
1050         }
1051     }
1052 
1053     reset = g_malloc0(sizeof(*reset) + (count * sizeof(*fds)));
1054     reset->argsz = sizeof(*reset) + (count * sizeof(*fds));
1055     fds = &reset->group_fds[0];
1056 
1057     /* Fill in group fds */
1058     QLIST_FOREACH(group, &vfio_group_list, next) {
1059         for (i = 0; i < info->count; i++) {
1060             if (group->groupid == devices[i].group_id) {
1061                 fds[reset->count++] = group->fd;
1062                 break;
1063             }
1064         }
1065     }
1066 
1067     /* Bus reset! */
1068     ret = ioctl(vdev->vbasedev.fd, VFIO_DEVICE_PCI_HOT_RESET, reset);
1069     g_free(reset);
1070     if (ret) {
1071         ret = -errno;
1072     }
1073 
1074     trace_vfio_pci_hot_reset_result(vdev->vbasedev.name,
1075                                     ret ? strerror(errno) : "Success");
1076 
1077 out:
1078     /* Re-enable INTx on affected devices */
1079     for (i = 0; i < info->count; i++) {
1080         PCIHostDeviceAddress host;
1081         VFIOPCIDevice *tmp;
1082         VFIODevice *vbasedev_iter;
1083 
1084         host.domain = devices[i].segment;
1085         host.bus = devices[i].bus;
1086         host.slot = PCI_SLOT(devices[i].devfn);
1087         host.function = PCI_FUNC(devices[i].devfn);
1088 
1089         if (vfio_pci_host_match(&host, vdev->vbasedev.name)) {
1090             continue;
1091         }
1092 
1093         QLIST_FOREACH(group, &vfio_group_list, next) {
1094             if (group->groupid == devices[i].group_id) {
1095                 break;
1096             }
1097         }
1098 
1099         if (!group) {
1100             break;
1101         }
1102 
1103         QLIST_FOREACH(vbasedev_iter, &group->device_list, next) {
1104             if (!vbasedev_iter->dev->realized ||
1105                 vbasedev_iter->type != VFIO_DEVICE_TYPE_PCI) {
1106                 continue;
1107             }
1108             tmp = container_of(vbasedev_iter, VFIOPCIDevice, vbasedev);
1109             if (vfio_pci_host_match(&host, tmp->vbasedev.name)) {
1110                 vfio_pci_post_reset(tmp);
1111                 break;
1112             }
1113         }
1114     }
1115 out_single:
1116     if (!single) {
1117         vfio_pci_post_reset(vdev);
1118     }
1119     g_free(info);
1120 
1121     return ret;
1122 }
1123 
1124 static void vfio_iommu_legacy_class_init(ObjectClass *klass, void *data)
1125 {
1126     VFIOIOMMUClass *vioc = VFIO_IOMMU_CLASS(klass);
1127 
1128     vioc->setup = vfio_legacy_setup;
1129     vioc->dma_map = vfio_legacy_dma_map;
1130     vioc->dma_unmap = vfio_legacy_dma_unmap;
1131     vioc->attach_device = vfio_legacy_attach_device;
1132     vioc->detach_device = vfio_legacy_detach_device;
1133     vioc->set_dirty_page_tracking = vfio_legacy_set_dirty_page_tracking;
1134     vioc->query_dirty_bitmap = vfio_legacy_query_dirty_bitmap;
1135     vioc->pci_hot_reset = vfio_legacy_pci_hot_reset;
1136 };
1137 
1138 static const TypeInfo types[] = {
1139     {
1140         .name = TYPE_VFIO_IOMMU_LEGACY,
1141         .parent = TYPE_VFIO_IOMMU,
1142         .class_init = vfio_iommu_legacy_class_init,
1143     },
1144 };
1145 
1146 DEFINE_TYPES(types)
1147