This series brings the VFIO part of HW nested paging support
in the SMMUv3.
This is a rebase on top of v5.10-rc4
The series depends on:
[PATCH v12 00/15] SMMUv3 Nested Stage Setup (IOMMU part)
3 new IOCTLs are introduced that allow the userspace to
1) pass the guest stage 1 configuration
2) pass stage 1 MSI bindings
3) invalidate stage 1 related caches
They map onto the related new IOMMU API functions.
We introduce the capability to register specific interrupt
indexes (see [1]). A new DMA_FAULT interrupt index allows to register
an eventfd to be signaled whenever a stage 1 related fault
is detected at physical level. Also two specific regions allow to
- expose the fault records to the user space and
- inject page responses.
This latter functionality is not exercised in this series
but is provided as a POC for further vSVA activities (Shameer's input).
Best Regards
Eric
This series can be found at:
https://github.com/eauger/linux/tree/5.10-rc4-2stage-v12
The series series includes Tina's patch steming from
[1] "[RFC PATCH v2 1/3] vfio: Use capability chains to handle device
specific irq" plus patches originally contributed by Yi.
History:
v10 -> v11:
- rebase on top of v5.10-rc4
- adapt to changes on the IOMMU API (compliant with the doc
written by Jacob/Yi)
- addition of the page response region
- Took into account Zenghui's comments
- In this version I have kept the ioctl separate. Since
Yi's series [2] is currently stalled, I've just rebased here.
[2] [PATCH v7 00/16] vfio: expose virtual Shared Virtual Addressing
to VMs
v9 -> v10
- rebase on top of 5.6.0-rc3 (no change versus v9)
v8 -> v9:
- introduce specific irq framework
- single fault region
- iommu_unregister_device_fault_handler failure case not handled
yet.
v7 -> v8:
- rebase on top of v5.2-rc1 and especially
8be39a1a04c1 iommu/arm-smmu-v3: Add a master->domain pointer
- dynamic alloc of s1_cfg/s2_cfg
- __arm_smmu_tlb_inv_asid/s1_range_nosync
- check there is no HW MSI regions
- asid invalidation using pasid extended struct (change in the uapi)
- add s1_live/s2_live checks
- move check about support of nested stages in domain finalise
- fixes in error reporting according to the discussion with Robin
- reordered the patches to have first iommu/smmuv3 patches and then
VFIO patches
v6 -> v7:
- removed device handle from bind/unbind_guest_msi
- added "iommu/smmuv3: Nested mode single MSI doorbell per domain
enforcement"
- added few uapi comments as suggested by Jean, Jacop and Alex
v5 -> v6:
- Fix compilation issue when CONFIG_IOMMU_API is unset
v4 -> v5:
- fix bug reported by Vincent: fault handler unregistration now happens in
vfio_pci_release
- IOMMU_FAULT_PERM_* moved outside of struct definition + small
uapi changes suggested by Kean-Philippe (except fetch_addr)
- iommu: introduce device fault report API: removed the PRI part.
- see individual logs for more details
- reset the ste abort flag on detach
v3 -> v4:
- took into account Alex, jean-Philippe and Robin's comments on v3
- rework of the smmuv3 driver integration
- add tear down ops for msi binding and PASID table binding
- fix S1 fault propagation
- put fault reporting patches at the beginning of the series following
Jean-Philippe's request
- update of the cache invalidate and fault API uapis
- VFIO fault reporting rework with 2 separate regions and one mmappable
segment for the fault queue
- moved to PATCH
v2 -> v3:
- When registering the S1 MSI binding we now store the device handle. This
addresses Robin's comment about discimination of devices beonging to
different S1 groups and using different physical MSI doorbells.
- Change the fault reporting API: use VFIO_PCI_DMA_FAULT_IRQ_INDEX to
set the eventfd and expose the faults through an mmappable fault region
v1 -> v2:
- Added the fault reporting capability
- asid properly passed on invalidation (fix assignment of multiple
devices)
- see individual change logs for more info
Eric Auger (10):
vfio: VFIO_IOMMU_SET_MSI_BINDING
vfio/pci: Add VFIO_REGION_TYPE_NESTED region type
vfio/pci: Register an iommu fault handler
vfio/pci: Allow to mmap the fault queue
vfio/pci: Add framework for custom interrupt indices
vfio: Add new IRQ for DMA fault reporting
vfio/pci: Register and allow DMA FAULT IRQ signaling
vfio: Document nested stage control
vfio/pci: Register a DMA fault response region
vfio/pci: Inject page response upon response region fill
Liu, Yi L (2):
vfio: VFIO_IOMMU_SET_PASID_TABLE
vfio: VFIO_IOMMU_CACHE_INVALIDATE
Tina Zhang (1):
vfio: Use capability chains to handle device specific irq
Documentation/driver-api/vfio.rst | 77 +++++
drivers/vfio/pci/vfio_pci.c | 430 ++++++++++++++++++++++++++--
drivers/vfio/pci/vfio_pci_intrs.c | 62 ++++
drivers/vfio/pci/vfio_pci_private.h | 33 +++
drivers/vfio/pci/vfio_pci_rdwr.c | 84 ++++++
drivers/vfio/vfio_iommu_type1.c | 186 ++++++++++++
include/uapi/linux/vfio.h | 140 ++++++++-
7 files changed, 993 insertions(+), 19 deletions(-)
--
2.21.3
This patch adds the VFIO_IOMMU_SET_MSI_BINDING ioctl which aim
to (un)register the guest MSI binding to the host. This latter
then can use those stage 1 bindings to build a nested stage
binding targeting the physical MSIs.
Signed-off-by: Eric Auger <[email protected]>
---
v10 -> v11:
- renamed ustruct into msi_binding
- return 0 on unbind
v8 -> v9:
- merge VFIO_IOMMU_BIND_MSI/VFIO_IOMMU_UNBIND_MSI into a single
VFIO_IOMMU_SET_MSI_BINDING ioctl
- ioctl id changed
v6 -> v7:
- removed the dev arg
v3 -> v4:
- add UNBIND
- unwind on BIND error
v2 -> v3:
- adapt to new proto of bind_guest_msi
- directly use vfio_iommu_for_each_dev
v1 -> v2:
- s/vfio_iommu_type1_guest_msi_binding/vfio_iommu_type1_bind_guest_msi
---
drivers/vfio/vfio_iommu_type1.c | 63 +++++++++++++++++++++++++++++++++
include/uapi/linux/vfio.h | 20 +++++++++++
2 files changed, 83 insertions(+)
diff --git a/drivers/vfio/vfio_iommu_type1.c b/drivers/vfio/vfio_iommu_type1.c
index 966909f542f1..bb2bc0971fb0 100644
--- a/drivers/vfio/vfio_iommu_type1.c
+++ b/drivers/vfio/vfio_iommu_type1.c
@@ -2657,6 +2657,41 @@ static int vfio_cache_inv_fn(struct device *dev, void *data)
return iommu_uapi_cache_invalidate(dc->domain, dev, (void __user *)arg);
}
+static int
+vfio_bind_msi(struct vfio_iommu *iommu,
+ dma_addr_t giova, phys_addr_t gpa, size_t size)
+{
+ struct vfio_domain *d;
+ int ret = 0;
+
+ mutex_lock(&iommu->lock);
+
+ list_for_each_entry(d, &iommu->domain_list, next) {
+ ret = iommu_bind_guest_msi(d->domain, giova, gpa, size);
+ if (ret)
+ goto unwind;
+ }
+ goto unlock;
+unwind:
+ list_for_each_entry_continue_reverse(d, &iommu->domain_list, next) {
+ iommu_unbind_guest_msi(d->domain, giova);
+ }
+unlock:
+ mutex_unlock(&iommu->lock);
+ return ret;
+}
+
+static void
+vfio_unbind_msi(struct vfio_iommu *iommu, dma_addr_t giova)
+{
+ struct vfio_domain *d;
+
+ mutex_lock(&iommu->lock);
+ list_for_each_entry(d, &iommu->domain_list, next)
+ iommu_unbind_guest_msi(d->domain, giova);
+ mutex_unlock(&iommu->lock);
+}
+
static int vfio_iommu_migration_build_caps(struct vfio_iommu *iommu,
struct vfio_info_cap *caps)
{
@@ -2866,6 +2901,32 @@ static int vfio_iommu_type1_cache_invalidate(struct vfio_iommu *iommu,
return ret;
}
+static int vfio_iommu_type1_set_msi_binding(struct vfio_iommu *iommu,
+ unsigned long arg)
+{
+ struct vfio_iommu_type1_set_msi_binding msi_binding;
+ unsigned long minsz;
+ int ret = -EINVAL;
+
+ minsz = offsetofend(struct vfio_iommu_type1_set_msi_binding,
+ size);
+
+ if (copy_from_user(&msi_binding, (void __user *)arg, minsz))
+ return -EFAULT;
+
+ if (msi_binding.argsz < minsz)
+ return -EINVAL;
+
+ if (msi_binding.flags == VFIO_IOMMU_UNBIND_MSI) {
+ vfio_unbind_msi(iommu, msi_binding.iova);
+ ret = 0;
+ } else if (msi_binding.flags == VFIO_IOMMU_BIND_MSI) {
+ ret = vfio_bind_msi(iommu, msi_binding.iova,
+ msi_binding.gpa, msi_binding.size);
+ }
+ return ret;
+}
+
static int vfio_iommu_type1_dirty_pages(struct vfio_iommu *iommu,
unsigned long arg)
{
@@ -2990,6 +3051,8 @@ static long vfio_iommu_type1_ioctl(void *iommu_data,
return vfio_iommu_type1_set_pasid_table(iommu, arg);
case VFIO_IOMMU_CACHE_INVALIDATE:
return vfio_iommu_type1_cache_invalidate(iommu, arg);
+ case VFIO_IOMMU_SET_MSI_BINDING:
+ return vfio_iommu_type1_set_msi_binding(iommu, arg);
default:
return -ENOTTY;
}
diff --git a/include/uapi/linux/vfio.h b/include/uapi/linux/vfio.h
index 0e6d94cc2ba4..b352e76cfb71 100644
--- a/include/uapi/linux/vfio.h
+++ b/include/uapi/linux/vfio.h
@@ -1212,6 +1212,26 @@ struct vfio_iommu_type1_cache_invalidate {
};
#define VFIO_IOMMU_CACHE_INVALIDATE _IO(VFIO_TYPE, VFIO_BASE + 23)
+/**
+ * VFIO_IOMMU_SET_MSI_BINDING - _IOWR(VFIO_TYPE, VFIO_BASE + 24,
+ * struct vfio_iommu_type1_set_msi_binding)
+ *
+ * Pass a stage 1 MSI doorbell mapping to the host so that this
+ * latter can build a nested stage2 mapping. Or conversely tear
+ * down a previously bound stage 1 MSI binding.
+ */
+struct vfio_iommu_type1_set_msi_binding {
+ __u32 argsz;
+ __u32 flags;
+#define VFIO_IOMMU_BIND_MSI (1 << 0)
+#define VFIO_IOMMU_UNBIND_MSI (1 << 1)
+ __u64 iova; /* MSI guest IOVA */
+ /* Fields below are used on BIND */
+ __u64 gpa; /* MSI guest physical address */
+ __u64 size; /* size of stage1 mapping (bytes) */
+};
+#define VFIO_IOMMU_SET_MSI_BINDING _IO(VFIO_TYPE, VFIO_BASE + 24)
+
/* -------- Additional API for SPAPR TCE (Server POWERPC) IOMMU -------- */
/*
--
2.21.3
Add a new specific DMA_FAULT region aiming to exposed nested mode
translation faults. This region only is exposed if the device
is attached to a nested domain.
The region has a ring buffer that contains the actual fault
records plus a header allowing to handle it (tail/head indices,
max capacity, entry size). At the moment the region is dimensionned
for 512 fault records.
Signed-off-by: Eric Auger <[email protected]>
---
v11 -> v12:
- set fault_pages to NULL after free
- check new_tail >= header->nb_entries (Zenghui)
v10 -> v11:
- rename vfio_pci_init_dma_fault_region into
vfio_pci_dma_fault_init
- free fault_pages in vfio_pci_dma_fault_release
- only register the region if the device is attached
to a nested domain
v8 -> v9:
- Use a single region instead of a prod/cons region
v4 -> v5
- check cons is not null in vfio_pci_check_cons_fault
v3 -> v4:
- use 2 separate regions, respectively in read and write modes
- add the version capability
---
drivers/vfio/pci/vfio_pci.c | 76 +++++++++++++++++++++++++++++
drivers/vfio/pci/vfio_pci_private.h | 6 +++
drivers/vfio/pci/vfio_pci_rdwr.c | 44 +++++++++++++++++
include/uapi/linux/vfio.h | 34 +++++++++++++
4 files changed, 160 insertions(+)
diff --git a/drivers/vfio/pci/vfio_pci.c b/drivers/vfio/pci/vfio_pci.c
index e6190173482c..7546a81e7fb6 100644
--- a/drivers/vfio/pci/vfio_pci.c
+++ b/drivers/vfio/pci/vfio_pci.c
@@ -311,6 +311,78 @@ int vfio_pci_set_power_state(struct vfio_pci_device *vdev, pci_power_t state)
return ret;
}
+static void vfio_pci_dma_fault_release(struct vfio_pci_device *vdev,
+ struct vfio_pci_region *region)
+{
+ kfree(vdev->fault_pages);
+}
+
+static int vfio_pci_dma_fault_add_capability(struct vfio_pci_device *vdev,
+ struct vfio_pci_region *region,
+ struct vfio_info_cap *caps)
+{
+ struct vfio_region_info_cap_fault cap = {
+ .header.id = VFIO_REGION_INFO_CAP_DMA_FAULT,
+ .header.version = 1,
+ .version = 1,
+ };
+ return vfio_info_add_capability(caps, &cap.header, sizeof(cap));
+}
+
+static const struct vfio_pci_regops vfio_pci_dma_fault_regops = {
+ .rw = vfio_pci_dma_fault_rw,
+ .release = vfio_pci_dma_fault_release,
+ .add_capability = vfio_pci_dma_fault_add_capability,
+};
+
+#define DMA_FAULT_RING_LENGTH 512
+
+static int vfio_pci_dma_fault_init(struct vfio_pci_device *vdev)
+{
+ struct vfio_region_dma_fault *header;
+ struct iommu_domain *domain;
+ size_t size;
+ bool nested;
+ int ret;
+
+ domain = iommu_get_domain_for_dev(&vdev->pdev->dev);
+ ret = iommu_domain_get_attr(domain, DOMAIN_ATTR_NESTING, &nested);
+ if (ret || !nested)
+ return ret;
+
+ mutex_init(&vdev->fault_queue_lock);
+
+ /*
+ * We provision 1 page for the header and space for
+ * DMA_FAULT_RING_LENGTH fault records in the ring buffer.
+ */
+ size = ALIGN(sizeof(struct iommu_fault) *
+ DMA_FAULT_RING_LENGTH, PAGE_SIZE) + PAGE_SIZE;
+
+ vdev->fault_pages = kzalloc(size, GFP_KERNEL);
+ if (!vdev->fault_pages)
+ return -ENOMEM;
+
+ ret = vfio_pci_register_dev_region(vdev,
+ VFIO_REGION_TYPE_NESTED,
+ VFIO_REGION_SUBTYPE_NESTED_DMA_FAULT,
+ &vfio_pci_dma_fault_regops, size,
+ VFIO_REGION_INFO_FLAG_READ | VFIO_REGION_INFO_FLAG_WRITE,
+ vdev->fault_pages);
+ if (ret)
+ goto out;
+
+ header = (struct vfio_region_dma_fault *)vdev->fault_pages;
+ header->entry_size = sizeof(struct iommu_fault);
+ header->nb_entries = DMA_FAULT_RING_LENGTH;
+ header->offset = sizeof(struct vfio_region_dma_fault);
+ return 0;
+out:
+ kfree(vdev->fault_pages);
+ vdev->fault_pages = NULL;
+ return ret;
+}
+
static int vfio_pci_enable(struct vfio_pci_device *vdev)
{
struct pci_dev *pdev = vdev->pdev;
@@ -409,6 +481,10 @@ static int vfio_pci_enable(struct vfio_pci_device *vdev)
}
}
+ ret = vfio_pci_dma_fault_init(vdev);
+ if (ret)
+ goto disable_exit;
+
vfio_pci_probe_mmaps(vdev);
return 0;
diff --git a/drivers/vfio/pci/vfio_pci_private.h b/drivers/vfio/pci/vfio_pci_private.h
index 5c90e560c5c7..1d9b0f648133 100644
--- a/drivers/vfio/pci/vfio_pci_private.h
+++ b/drivers/vfio/pci/vfio_pci_private.h
@@ -134,6 +134,8 @@ struct vfio_pci_device {
int ioeventfds_nr;
struct eventfd_ctx *err_trigger;
struct eventfd_ctx *req_trigger;
+ u8 *fault_pages;
+ struct mutex fault_queue_lock;
struct list_head dummy_resources_list;
struct mutex ioeventfds_lock;
struct list_head ioeventfds_list;
@@ -170,6 +172,10 @@ extern ssize_t vfio_pci_vga_rw(struct vfio_pci_device *vdev, char __user *buf,
extern long vfio_pci_ioeventfd(struct vfio_pci_device *vdev, loff_t offset,
uint64_t data, int count, int fd);
+extern size_t vfio_pci_dma_fault_rw(struct vfio_pci_device *vdev,
+ char __user *buf, size_t count,
+ loff_t *ppos, bool iswrite);
+
extern int vfio_pci_init_perm_bits(void);
extern void vfio_pci_uninit_perm_bits(void);
diff --git a/drivers/vfio/pci/vfio_pci_rdwr.c b/drivers/vfio/pci/vfio_pci_rdwr.c
index a0b5fc8e46f4..164120607469 100644
--- a/drivers/vfio/pci/vfio_pci_rdwr.c
+++ b/drivers/vfio/pci/vfio_pci_rdwr.c
@@ -356,6 +356,50 @@ ssize_t vfio_pci_vga_rw(struct vfio_pci_device *vdev, char __user *buf,
return done;
}
+size_t vfio_pci_dma_fault_rw(struct vfio_pci_device *vdev, char __user *buf,
+ size_t count, loff_t *ppos, bool iswrite)
+{
+ unsigned int i = VFIO_PCI_OFFSET_TO_INDEX(*ppos) - VFIO_PCI_NUM_REGIONS;
+ loff_t pos = *ppos & VFIO_PCI_OFFSET_MASK;
+ void *base = vdev->region[i].data;
+ int ret = -EFAULT;
+
+ if (pos >= vdev->region[i].size)
+ return -EINVAL;
+
+ count = min(count, (size_t)(vdev->region[i].size - pos));
+
+ mutex_lock(&vdev->fault_queue_lock);
+
+ if (iswrite) {
+ struct vfio_region_dma_fault *header =
+ (struct vfio_region_dma_fault *)base;
+ u32 new_tail;
+
+ if (pos != 0 || count != 4) {
+ ret = -EINVAL;
+ goto unlock;
+ }
+
+ if (copy_from_user((void *)&new_tail, buf, count))
+ goto unlock;
+
+ if (new_tail >= header->nb_entries) {
+ ret = -EINVAL;
+ goto unlock;
+ }
+ header->tail = new_tail;
+ } else {
+ if (copy_to_user(buf, base + pos, count))
+ goto unlock;
+ }
+ *ppos += count;
+ ret = count;
+unlock:
+ mutex_unlock(&vdev->fault_queue_lock);
+ return ret;
+}
+
static void vfio_pci_ioeventfd_do_write(struct vfio_pci_ioeventfd *ioeventfd,
bool test_mem)
{
diff --git a/include/uapi/linux/vfio.h b/include/uapi/linux/vfio.h
index b352e76cfb71..629dfb38d9e7 100644
--- a/include/uapi/linux/vfio.h
+++ b/include/uapi/linux/vfio.h
@@ -343,6 +343,9 @@ struct vfio_region_info_cap_type {
/* sub-types for VFIO_REGION_TYPE_GFX */
#define VFIO_REGION_SUBTYPE_GFX_EDID (1)
+#define VFIO_REGION_TYPE_NESTED (2)
+#define VFIO_REGION_SUBTYPE_NESTED_DMA_FAULT (1)
+
/**
* struct vfio_region_gfx_edid - EDID region layout.
*
@@ -988,6 +991,37 @@ struct vfio_device_feature {
*/
#define VFIO_DEVICE_FEATURE_PCI_VF_TOKEN (0)
+/*
+ * Capability exposed by the DMA fault region
+ * @version: ABI version
+ */
+#define VFIO_REGION_INFO_CAP_DMA_FAULT 6
+
+struct vfio_region_info_cap_fault {
+ struct vfio_info_cap_header header;
+ __u32 version;
+};
+
+/*
+ * DMA Fault Region Layout
+ * @tail: index relative to the start of the ring buffer at which the
+ * consumer finds the next item in the buffer
+ * @entry_size: fault ring buffer entry size in bytes
+ * @nb_entries: max capacity of the fault ring buffer
+ * @offset: ring buffer offset relative to the start of the region
+ * @head: index relative to the start of the ring buffer at which the
+ * producer (kernel) inserts items into the buffers
+ */
+struct vfio_region_dma_fault {
+ /* Write-Only */
+ __u32 tail;
+ /* Read-Only */
+ __u32 entry_size;
+ __u32 nb_entries;
+ __u32 offset;
+ __u32 head;
+};
+
/* -------- API for Type1 VFIO IOMMU -------- */
/**
--
2.21.3
Register an IOMMU fault handler which records faults in
the DMA FAULT region ring buffer. In a subsequent patch, we
will add the signaling of a specific eventfd to allow the
userspace to be notified whenever a new fault as shown up.
Signed-off-by: Eric Auger <[email protected]>
---
v11 -> v12:
- take the fault_queue_lock before reading header (Zenghui)
- also record recoverable errors
v10 -> v11:
- move iommu_unregister_device_fault_handler into
vfio_pci_disable
- check fault_pages != 0
v8 -> v9:
- handler now takes an iommu_fault handle
- eventfd signaling moved to a subsequent patch
- check the fault type and return an error if != UNRECOV
- still the fault handler registration can fail. We need to
reach an agreement about how to deal with the situation
v3 -> v4:
- move iommu_unregister_device_fault_handler to vfio_pci_release
---
drivers/vfio/pci/vfio_pci.c | 45 +++++++++++++++++++++++++++++++++++++
1 file changed, 45 insertions(+)
diff --git a/drivers/vfio/pci/vfio_pci.c b/drivers/vfio/pci/vfio_pci.c
index 7546a81e7fb6..b39d6ed66c71 100644
--- a/drivers/vfio/pci/vfio_pci.c
+++ b/drivers/vfio/pci/vfio_pci.c
@@ -27,6 +27,7 @@
#include <linux/vgaarb.h>
#include <linux/nospec.h>
#include <linux/sched/mm.h>
+#include <linux/circ_buf.h>
#include "vfio_pci_private.h"
@@ -335,6 +336,41 @@ static const struct vfio_pci_regops vfio_pci_dma_fault_regops = {
.add_capability = vfio_pci_dma_fault_add_capability,
};
+int vfio_pci_iommu_dev_fault_handler(struct iommu_fault *fault, void *data)
+{
+ struct vfio_pci_device *vdev = (struct vfio_pci_device *)data;
+ struct vfio_region_dma_fault *reg =
+ (struct vfio_region_dma_fault *)vdev->fault_pages;
+ struct iommu_fault *new;
+ u32 head, tail, size;
+ int ret = -EINVAL;
+
+
+ if (WARN_ON(!reg))
+ return ret;
+
+ mutex_lock(&vdev->fault_queue_lock);
+
+ head = reg->head;
+ tail = reg->tail;
+ size = reg->nb_entries;
+
+ new = (struct iommu_fault *)(vdev->fault_pages + reg->offset +
+ head * reg->entry_size);
+
+ if (CIRC_SPACE(head, tail, size) < 1) {
+ ret = -ENOSPC;
+ goto unlock;
+ }
+
+ *new = *fault;
+ reg->head = (head + 1) % size;
+ ret = 0;
+unlock:
+ mutex_unlock(&vdev->fault_queue_lock);
+ return ret;
+}
+
#define DMA_FAULT_RING_LENGTH 512
static int vfio_pci_dma_fault_init(struct vfio_pci_device *vdev)
@@ -376,6 +412,13 @@ static int vfio_pci_dma_fault_init(struct vfio_pci_device *vdev)
header->entry_size = sizeof(struct iommu_fault);
header->nb_entries = DMA_FAULT_RING_LENGTH;
header->offset = sizeof(struct vfio_region_dma_fault);
+
+ ret = iommu_register_device_fault_handler(&vdev->pdev->dev,
+ vfio_pci_iommu_dev_fault_handler,
+ vdev);
+ if (ret) /* the dma fault region is freed in vfio_pci_disable() */
+ goto out;
+
return 0;
out:
kfree(vdev->fault_pages);
@@ -508,6 +551,8 @@ static void vfio_pci_disable(struct vfio_pci_device *vdev)
VFIO_IRQ_SET_ACTION_TRIGGER,
vdev->irq_type, 0, 0, NULL);
+ WARN_ON(iommu_unregister_device_fault_handler(&vdev->pdev->dev));
+
/* Device closed, don't need mutex here */
list_for_each_entry_safe(ioeventfd, ioeventfd_tmp,
&vdev->ioeventfds_list, next) {
--
2.21.3
Register the VFIO_IRQ_TYPE_NESTED/VFIO_IRQ_SUBTYPE_DMA_FAULT
IRQ that allows to signal a nested mode DMA fault.
Signed-off-by: Eric Auger <[email protected]>
---
v10 -> v11:
- the irq now is registered in vfio_pci_dma_fault_init()
in case the domain is nested
---
drivers/vfio/pci/vfio_pci.c | 21 ++++++++++++++++++++-
1 file changed, 20 insertions(+), 1 deletion(-)
diff --git a/drivers/vfio/pci/vfio_pci.c b/drivers/vfio/pci/vfio_pci.c
index 93e03a4a5f32..65a83fd0e8c0 100644
--- a/drivers/vfio/pci/vfio_pci.c
+++ b/drivers/vfio/pci/vfio_pci.c
@@ -397,6 +397,7 @@ int vfio_pci_iommu_dev_fault_handler(struct iommu_fault *fault, void *data)
(struct vfio_region_dma_fault *)vdev->fault_pages;
struct iommu_fault *new;
u32 head, tail, size;
+ int ext_irq_index;
int ret = -EINVAL;
@@ -422,7 +423,19 @@ int vfio_pci_iommu_dev_fault_handler(struct iommu_fault *fault, void *data)
ret = 0;
unlock:
mutex_unlock(&vdev->fault_queue_lock);
- return ret;
+ if (ret)
+ return ret;
+
+ ext_irq_index = vfio_pci_get_ext_irq_index(vdev, VFIO_IRQ_TYPE_NESTED,
+ VFIO_IRQ_SUBTYPE_DMA_FAULT);
+ if (ext_irq_index < 0)
+ return -EINVAL;
+
+ mutex_lock(&vdev->igate);
+ if (vdev->ext_irqs[ext_irq_index].trigger)
+ eventfd_signal(vdev->ext_irqs[ext_irq_index].trigger, 1);
+ mutex_unlock(&vdev->igate);
+ return 0;
}
#define DMA_FAULT_RING_LENGTH 512
@@ -474,6 +487,12 @@ static int vfio_pci_dma_fault_init(struct vfio_pci_device *vdev)
if (ret) /* the dma fault region is freed in vfio_pci_disable() */
goto out;
+ ret = vfio_pci_register_irq(vdev, VFIO_IRQ_TYPE_NESTED,
+ VFIO_IRQ_SUBTYPE_DMA_FAULT,
+ VFIO_IRQ_INFO_EVENTFD);
+ if (ret) /* the fault handler is also freed in vfio_pci_disable() */
+ goto out;
+
return 0;
out:
kfree(vdev->fault_pages);
--
2.21.3
From: Tina Zhang <[email protected]>
Caps the number of irqs with fixed indexes and uses capability chains
to chain device specific irqs.
Signed-off-by: Tina Zhang <[email protected]>
Signed-off-by: Eric Auger <[email protected]>
[Eric: Put cap_offset at the end of the vfio_irq_info struct,
remove GFX IRQ at the moment and remove any reference to this latter
in the commit message]
---
---
include/uapi/linux/vfio.h | 19 ++++++++++++++++++-
1 file changed, 18 insertions(+), 1 deletion(-)
diff --git a/include/uapi/linux/vfio.h b/include/uapi/linux/vfio.h
index 629dfb38d9e7..0e2bfbeccd08 100644
--- a/include/uapi/linux/vfio.h
+++ b/include/uapi/linux/vfio.h
@@ -701,11 +701,27 @@ struct vfio_irq_info {
#define VFIO_IRQ_INFO_MASKABLE (1 << 1)
#define VFIO_IRQ_INFO_AUTOMASKED (1 << 2)
#define VFIO_IRQ_INFO_NORESIZE (1 << 3)
+#define VFIO_IRQ_INFO_FLAG_CAPS (1 << 4) /* Info supports caps */
__u32 index; /* IRQ index */
__u32 count; /* Number of IRQs within this index */
+ __u32 cap_offset; /* Offset within info struct of first cap */
};
#define VFIO_DEVICE_GET_IRQ_INFO _IO(VFIO_TYPE, VFIO_BASE + 9)
+/*
+ * The irq type capability allows IRQs unique to a specific device or
+ * class of devices to be exposed.
+ *
+ * The structures below define version 1 of this capability.
+ */
+#define VFIO_IRQ_INFO_CAP_TYPE 3
+
+struct vfio_irq_info_cap_type {
+ struct vfio_info_cap_header header;
+ __u32 type; /* global per bus driver */
+ __u32 subtype; /* type specific */
+};
+
/**
* VFIO_DEVICE_SET_IRQS - _IOW(VFIO_TYPE, VFIO_BASE + 10, struct vfio_irq_set)
*
@@ -807,7 +823,8 @@ enum {
VFIO_PCI_MSIX_IRQ_INDEX,
VFIO_PCI_ERR_IRQ_INDEX,
VFIO_PCI_REQ_IRQ_INDEX,
- VFIO_PCI_NUM_IRQS
+ VFIO_PCI_NUM_IRQS = 5 /* Fixed user ABI, IRQ indexes >=5 use */
+ /* device specific cap to define content */
};
/*
--
2.21.3
When the userspace increments the head of the page response
buffer ring, let's push the response into the iommu layer.
This is done through a workqueue that pops the responses from
the ring buffer and increment the tail.
Signed-off-by: Eric Auger <[email protected]>
---
drivers/vfio/pci/vfio_pci.c | 40 +++++++++++++++++++++++++++++
drivers/vfio/pci/vfio_pci_private.h | 8 ++++++
drivers/vfio/pci/vfio_pci_rdwr.c | 1 +
3 files changed, 49 insertions(+)
diff --git a/drivers/vfio/pci/vfio_pci.c b/drivers/vfio/pci/vfio_pci.c
index e9a904ce3f0d..beea70d70151 100644
--- a/drivers/vfio/pci/vfio_pci.c
+++ b/drivers/vfio/pci/vfio_pci.c
@@ -542,6 +542,32 @@ static int vfio_pci_dma_fault_init(struct vfio_pci_device *vdev)
return ret;
}
+static void dma_response_inject(struct work_struct *work)
+{
+ struct vfio_pci_dma_fault_response_work *rwork =
+ container_of(work, struct vfio_pci_dma_fault_response_work, inject);
+ struct vfio_region_dma_fault_response *header = rwork->header;
+ struct vfio_pci_device *vdev = rwork->vdev;
+ struct iommu_page_response *resp;
+ u32 tail, head, size;
+
+ mutex_lock(&vdev->fault_response_queue_lock);
+
+ tail = header->tail;
+ head = header->head;
+ size = header->nb_entries;
+
+ while (CIRC_CNT(head, tail, size) >= 1) {
+ resp = (struct iommu_page_response *)(vdev->fault_response_pages + header->offset +
+ tail * header->entry_size);
+
+ /* TODO: properly handle the return value */
+ iommu_page_response(&vdev->pdev->dev, resp);
+ header->tail = tail = (tail + 1) % size;
+ }
+ mutex_unlock(&vdev->fault_response_queue_lock);
+}
+
#define DMA_FAULT_RESPONSE_RING_LENGTH 512
static int vfio_pci_dma_fault_response_init(struct vfio_pci_device *vdev)
@@ -585,8 +611,22 @@ static int vfio_pci_dma_fault_response_init(struct vfio_pci_device *vdev)
header->nb_entries = DMA_FAULT_RESPONSE_RING_LENGTH;
header->offset = PAGE_SIZE;
+ vdev->response_work = kzalloc(sizeof(*vdev->response_work), GFP_KERNEL);
+ if (!vdev->response_work)
+ goto out;
+ vdev->response_work->header = header;
+ vdev->response_work->vdev = vdev;
+
+ /* launch the thread that will extract the response */
+ INIT_WORK(&vdev->response_work->inject, dma_response_inject);
+ vdev->dma_fault_response_wq =
+ create_singlethread_workqueue("vfio-dma-fault-response");
+ if (!vdev->dma_fault_response_wq)
+ return -ENOMEM;
+
return 0;
out:
+ kfree(vdev->fault_response_pages);
vdev->fault_response_pages = NULL;
return ret;
}
diff --git a/drivers/vfio/pci/vfio_pci_private.h b/drivers/vfio/pci/vfio_pci_private.h
index 035634521cd0..5944f96ced0c 100644
--- a/drivers/vfio/pci/vfio_pci_private.h
+++ b/drivers/vfio/pci/vfio_pci_private.h
@@ -52,6 +52,12 @@ struct vfio_pci_irq_ctx {
struct irq_bypass_producer producer;
};
+struct vfio_pci_dma_fault_response_work {
+ struct work_struct inject;
+ struct vfio_region_dma_fault_response *header;
+ struct vfio_pci_device *vdev;
+};
+
struct vfio_pci_device;
struct vfio_pci_region;
@@ -145,6 +151,8 @@ struct vfio_pci_device {
struct eventfd_ctx *req_trigger;
u8 *fault_pages;
u8 *fault_response_pages;
+ struct workqueue_struct *dma_fault_response_wq;
+ struct vfio_pci_dma_fault_response_work *response_work;
struct mutex fault_queue_lock;
struct mutex fault_response_queue_lock;
struct list_head dummy_resources_list;
diff --git a/drivers/vfio/pci/vfio_pci_rdwr.c b/drivers/vfio/pci/vfio_pci_rdwr.c
index efde0793360b..78c494fe35cc 100644
--- a/drivers/vfio/pci/vfio_pci_rdwr.c
+++ b/drivers/vfio/pci/vfio_pci_rdwr.c
@@ -430,6 +430,7 @@ size_t vfio_pci_dma_fault_response_rw(struct vfio_pci_device *vdev, char __user
mutex_lock(&vdev->fault_response_queue_lock);
header->head = new_head;
mutex_unlock(&vdev->fault_response_queue_lock);
+ queue_work(vdev->dma_fault_response_wq, &vdev->response_work->inject);
} else {
if (copy_to_user(buf, base + pos, count))
return -EFAULT;
--
2.21.3
The DMA FAULT region contains the fault ring buffer.
There is benefit to let the userspace mmap this area.
Expose this mmappable area through a sparse mmap entry
and implement the mmap operation.
Signed-off-by: Eric Auger <[email protected]>
---
v8 -> v9:
- remove unused index local variable in vfio_pci_fault_mmap
---
drivers/vfio/pci/vfio_pci.c | 61 +++++++++++++++++++++++++++++++++++--
1 file changed, 58 insertions(+), 3 deletions(-)
diff --git a/drivers/vfio/pci/vfio_pci.c b/drivers/vfio/pci/vfio_pci.c
index b39d6ed66c71..2a6cc1a87323 100644
--- a/drivers/vfio/pci/vfio_pci.c
+++ b/drivers/vfio/pci/vfio_pci.c
@@ -318,21 +318,75 @@ static void vfio_pci_dma_fault_release(struct vfio_pci_device *vdev,
kfree(vdev->fault_pages);
}
+static int vfio_pci_dma_fault_mmap(struct vfio_pci_device *vdev,
+ struct vfio_pci_region *region,
+ struct vm_area_struct *vma)
+{
+ u64 phys_len, req_len, pgoff, req_start;
+ unsigned long long addr;
+ unsigned int ret;
+
+ phys_len = region->size;
+
+ req_len = vma->vm_end - vma->vm_start;
+ pgoff = vma->vm_pgoff &
+ ((1U << (VFIO_PCI_OFFSET_SHIFT - PAGE_SHIFT)) - 1);
+ req_start = pgoff << PAGE_SHIFT;
+
+ /* only the second page of the producer fault region is mmappable */
+ if (req_start < PAGE_SIZE)
+ return -EINVAL;
+
+ if (req_start + req_len > phys_len)
+ return -EINVAL;
+
+ addr = virt_to_phys(vdev->fault_pages);
+ vma->vm_private_data = vdev;
+ vma->vm_pgoff = (addr >> PAGE_SHIFT) + pgoff;
+
+ ret = remap_pfn_range(vma, vma->vm_start, vma->vm_pgoff,
+ req_len, vma->vm_page_prot);
+ return ret;
+}
+
static int vfio_pci_dma_fault_add_capability(struct vfio_pci_device *vdev,
struct vfio_pci_region *region,
struct vfio_info_cap *caps)
{
+ struct vfio_region_info_cap_sparse_mmap *sparse = NULL;
struct vfio_region_info_cap_fault cap = {
.header.id = VFIO_REGION_INFO_CAP_DMA_FAULT,
.header.version = 1,
.version = 1,
};
- return vfio_info_add_capability(caps, &cap.header, sizeof(cap));
+ size_t size = sizeof(*sparse) + sizeof(*sparse->areas);
+ int ret;
+
+ ret = vfio_info_add_capability(caps, &cap.header, sizeof(cap));
+ if (ret)
+ return ret;
+
+ sparse = kzalloc(size, GFP_KERNEL);
+ if (!sparse)
+ return -ENOMEM;
+
+ sparse->header.id = VFIO_REGION_INFO_CAP_SPARSE_MMAP;
+ sparse->header.version = 1;
+ sparse->nr_areas = 1;
+ sparse->areas[0].offset = PAGE_SIZE;
+ sparse->areas[0].size = region->size - PAGE_SIZE;
+
+ ret = vfio_info_add_capability(caps, &sparse->header, size);
+ if (ret)
+ kfree(sparse);
+
+ return ret;
}
static const struct vfio_pci_regops vfio_pci_dma_fault_regops = {
.rw = vfio_pci_dma_fault_rw,
.release = vfio_pci_dma_fault_release,
+ .mmap = vfio_pci_dma_fault_mmap,
.add_capability = vfio_pci_dma_fault_add_capability,
};
@@ -403,7 +457,8 @@ static int vfio_pci_dma_fault_init(struct vfio_pci_device *vdev)
VFIO_REGION_TYPE_NESTED,
VFIO_REGION_SUBTYPE_NESTED_DMA_FAULT,
&vfio_pci_dma_fault_regops, size,
- VFIO_REGION_INFO_FLAG_READ | VFIO_REGION_INFO_FLAG_WRITE,
+ VFIO_REGION_INFO_FLAG_READ | VFIO_REGION_INFO_FLAG_WRITE |
+ VFIO_REGION_INFO_FLAG_MMAP,
vdev->fault_pages);
if (ret)
goto out;
@@ -411,7 +466,7 @@ static int vfio_pci_dma_fault_init(struct vfio_pci_device *vdev)
header = (struct vfio_region_dma_fault *)vdev->fault_pages;
header->entry_size = sizeof(struct iommu_fault);
header->nb_entries = DMA_FAULT_RING_LENGTH;
- header->offset = sizeof(struct vfio_region_dma_fault);
+ header->offset = PAGE_SIZE;
ret = iommu_register_device_fault_handler(&vdev->pdev->dev,
vfio_pci_iommu_dev_fault_handler,
--
2.21.3
Add a new IRQ type/subtype to get notification on nested
stage DMA faults.
Signed-off-by: Eric Auger <[email protected]>
---
include/uapi/linux/vfio.h | 3 +++
1 file changed, 3 insertions(+)
diff --git a/include/uapi/linux/vfio.h b/include/uapi/linux/vfio.h
index 0e2bfbeccd08..1e5c82f9d14d 100644
--- a/include/uapi/linux/vfio.h
+++ b/include/uapi/linux/vfio.h
@@ -722,6 +722,9 @@ struct vfio_irq_info_cap_type {
__u32 subtype; /* type specific */
};
+#define VFIO_IRQ_TYPE_NESTED (1)
+#define VFIO_IRQ_SUBTYPE_DMA_FAULT (1)
+
/**
* VFIO_DEVICE_SET_IRQS - _IOW(VFIO_TYPE, VFIO_BASE + 10, struct vfio_irq_set)
*
--
2.21.3
The VFIO API was enhanced to support nested stage control: a bunch of
new iotcls, one DMA FAULT region and an associated specific IRQ.
Let's document the process to follow to set up nested mode.
Signed-off-by: Eric Auger <[email protected]>
---
v11 -> v12:
s/VFIO_REGION_INFO_CAP_PRODUCER_FAULT/VFIO_REGION_INFO_CAP_DMA_FAULT
v8 -> v9:
- new names for SET_MSI_BINDING and SET_PASID_TABLE
- new layout for the DMA FAULT memory region and specific IRQ
v2 -> v3:
- document the new fault API
v1 -> v2:
- use the new ioctl names
- add doc related to fault handling
---
Documentation/driver-api/vfio.rst | 77 +++++++++++++++++++++++++++++++
1 file changed, 77 insertions(+)
diff --git a/Documentation/driver-api/vfio.rst b/Documentation/driver-api/vfio.rst
index f1a4d3c3ba0b..14e41324237d 100644
--- a/Documentation/driver-api/vfio.rst
+++ b/Documentation/driver-api/vfio.rst
@@ -239,6 +239,83 @@ group and can access them as follows::
/* Gratuitous device reset and go... */
ioctl(device, VFIO_DEVICE_RESET);
+IOMMU Dual Stage Control
+------------------------
+
+Some IOMMUs support 2 stages/levels of translation. "Stage" corresponds to
+the ARM terminology while "level" corresponds to Intel's VTD terminology. In
+the following text we use either without distinction.
+
+This is useful when the guest is exposed with a virtual IOMMU and some
+devices are assigned to the guest through VFIO. Then the guest OS can use
+stage 1 (IOVA -> GPA), while the hypervisor uses stage 2 for VM isolation
+(GPA -> HPA).
+
+The guest gets ownership of the stage 1 page tables and also owns stage 1
+configuration structures. The hypervisor owns the root configuration structure
+(for security reason), including stage 2 configuration. This works as long
+configuration structures and page table format are compatible between the
+virtual IOMMU and the physical IOMMU.
+
+Assuming the HW supports it, this nested mode is selected by choosing the
+VFIO_TYPE1_NESTING_IOMMU type through:
+
+ioctl(container, VFIO_SET_IOMMU, VFIO_TYPE1_NESTING_IOMMU);
+
+This forces the hypervisor to use the stage 2, leaving stage 1 available for
+guest usage.
+
+Once groups are attached to the container, the guest stage 1 translation
+configuration data can be passed to VFIO by using
+
+ioctl(container, VFIO_IOMMU_SET_PASID_TABLE, &pasid_table_info);
+
+This allows to combine the guest stage 1 configuration structure along with
+the hypervisor stage 2 configuration structure. Stage 1 configuration
+structures are dependent on the IOMMU type.
+
+As the stage 1 translation is fully delegated to the HW, translation faults
+encountered during the translation process need to be propagated up to
+the virtualizer and re-injected into the guest.
+
+The userspace must be prepared to receive faults. The VFIO-PCI device
+exposes one dedicated DMA FAULT region: it contains a ring buffer and
+its header that allows to manage the head/tail indices. The region is
+identified by the following index/subindex:
+- VFIO_REGION_TYPE_NESTED/VFIO_REGION_SUBTYPE_NESTED_DMA_FAULT
+
+The DMA FAULT region exposes a VFIO_REGION_INFO_CAP_DMA_FAULT
+region capability that allows the userspace to retrieve the ABI version
+of the fault records filled by the host.
+
+On top of that region, the userspace can be notified whenever a fault
+occurs at the physical level. It can use the VFIO_IRQ_TYPE_NESTED/
+VFIO_IRQ_SUBTYPE_DMA_FAULT specific IRQ to attach the eventfd to be
+signalled.
+
+The ring buffer containing the fault records can be mmapped. When
+the userspace consumes a fault in the queue, it should increment
+the consumer index to allow new fault records to replace the used ones.
+
+The queue size and the entry size can be retrieved in the header.
+The tail index should never overshoot the producer index as in any
+other circular buffer scheme. Also it must be less than the queue size
+otherwise the change fails.
+
+When the guest invalidates stage 1 related caches, invalidations must be
+forwarded to the host through
+ioctl(container, VFIO_IOMMU_CACHE_INVALIDATE, &inv_data);
+Those invalidations can happen at various granularity levels, page, context, ...
+
+The ARM SMMU specification introduces another challenge: MSIs are translated by
+both the virtual SMMU and the physical SMMU. To build a nested mapping for the
+IOVA programmed into the assigned device, the guest needs to pass its IOVA/MSI
+doorbell GPA binding to the host. Then the hypervisor can build a nested stage 2
+binding eventually translating into the physical MSI doorbell.
+
+This is achieved by calling
+ioctl(container, VFIO_IOMMU_SET_MSI_BINDING, &guest_binding);
+
VFIO User API
-------------------------------------------------------------------------------
--
2.21.3
Implement IRQ capability chain infrastructure. All interrupt
indexes beyond VFIO_PCI_NUM_IRQS are handled as extended
interrupts. They are registered with a specific type/subtype
and supported flags.
Signed-off-by: Eric Auger <[email protected]>
---
drivers/vfio/pci/vfio_pci.c | 99 +++++++++++++++++++++++------
drivers/vfio/pci/vfio_pci_intrs.c | 62 ++++++++++++++++++
drivers/vfio/pci/vfio_pci_private.h | 14 ++++
3 files changed, 157 insertions(+), 18 deletions(-)
diff --git a/drivers/vfio/pci/vfio_pci.c b/drivers/vfio/pci/vfio_pci.c
index 2a6cc1a87323..93e03a4a5f32 100644
--- a/drivers/vfio/pci/vfio_pci.c
+++ b/drivers/vfio/pci/vfio_pci.c
@@ -608,6 +608,14 @@ static void vfio_pci_disable(struct vfio_pci_device *vdev)
WARN_ON(iommu_unregister_device_fault_handler(&vdev->pdev->dev));
+ for (i = 0; i < vdev->num_ext_irqs; i++)
+ vfio_pci_set_irqs_ioctl(vdev, VFIO_IRQ_SET_DATA_NONE |
+ VFIO_IRQ_SET_ACTION_TRIGGER,
+ VFIO_PCI_NUM_IRQS + i, 0, 0, NULL);
+ vdev->num_ext_irqs = 0;
+ kfree(vdev->ext_irqs);
+ vdev->ext_irqs = NULL;
+
/* Device closed, don't need mutex here */
list_for_each_entry_safe(ioeventfd, ioeventfd_tmp,
&vdev->ioeventfds_list, next) {
@@ -823,6 +831,9 @@ static int vfio_pci_get_irq_count(struct vfio_pci_device *vdev, int irq_type)
return 1;
} else if (irq_type == VFIO_PCI_REQ_IRQ_INDEX) {
return 1;
+ } else if (irq_type >= VFIO_PCI_NUM_IRQS &&
+ irq_type < VFIO_PCI_NUM_IRQS + vdev->num_ext_irqs) {
+ return 1;
}
return 0;
@@ -1008,7 +1019,7 @@ static long vfio_pci_ioctl(void *device_data,
info.flags |= VFIO_DEVICE_FLAGS_RESET;
info.num_regions = VFIO_PCI_NUM_REGIONS + vdev->num_regions;
- info.num_irqs = VFIO_PCI_NUM_IRQS;
+ info.num_irqs = VFIO_PCI_NUM_IRQS + vdev->num_ext_irqs;
if (IS_ENABLED(CONFIG_VFIO_PCI_ZDEV)) {
int ret = vfio_pci_info_zdev_add_caps(vdev, &caps);
@@ -1187,36 +1198,87 @@ static long vfio_pci_ioctl(void *device_data,
} else if (cmd == VFIO_DEVICE_GET_IRQ_INFO) {
struct vfio_irq_info info;
+ struct vfio_info_cap caps = { .buf = NULL, .size = 0 };
+ unsigned long capsz;
minsz = offsetofend(struct vfio_irq_info, count);
+ /* For backward compatibility, cannot require this */
+ capsz = offsetofend(struct vfio_irq_info, cap_offset);
+
if (copy_from_user(&info, (void __user *)arg, minsz))
return -EFAULT;
- if (info.argsz < minsz || info.index >= VFIO_PCI_NUM_IRQS)
+ if (info.argsz < minsz ||
+ info.index >= VFIO_PCI_NUM_IRQS + vdev->num_ext_irqs)
return -EINVAL;
- switch (info.index) {
- case VFIO_PCI_INTX_IRQ_INDEX ... VFIO_PCI_MSIX_IRQ_INDEX:
- case VFIO_PCI_REQ_IRQ_INDEX:
- break;
- case VFIO_PCI_ERR_IRQ_INDEX:
- if (pci_is_pcie(vdev->pdev))
- break;
- fallthrough;
- default:
- return -EINVAL;
- }
+ if (info.argsz >= capsz)
+ minsz = capsz;
info.flags = VFIO_IRQ_INFO_EVENTFD;
- info.count = vfio_pci_get_irq_count(vdev, info.index);
-
- if (info.index == VFIO_PCI_INTX_IRQ_INDEX)
+ switch (info.index) {
+ case VFIO_PCI_INTX_IRQ_INDEX:
info.flags |= (VFIO_IRQ_INFO_MASKABLE |
VFIO_IRQ_INFO_AUTOMASKED);
- else
+ break;
+ case VFIO_PCI_MSI_IRQ_INDEX ... VFIO_PCI_MSIX_IRQ_INDEX:
+ case VFIO_PCI_REQ_IRQ_INDEX:
info.flags |= VFIO_IRQ_INFO_NORESIZE;
+ break;
+ case VFIO_PCI_ERR_IRQ_INDEX:
+ info.flags |= VFIO_IRQ_INFO_NORESIZE;
+ if (!pci_is_pcie(vdev->pdev))
+ return -EINVAL;
+ break;
+ default:
+ {
+ struct vfio_irq_info_cap_type cap_type = {
+ .header.id = VFIO_IRQ_INFO_CAP_TYPE,
+ .header.version = 1 };
+ int ret, i;
+
+ if (info.index >= VFIO_PCI_NUM_IRQS +
+ vdev->num_ext_irqs)
+ return -EINVAL;
+ info.index = array_index_nospec(info.index,
+ VFIO_PCI_NUM_IRQS +
+ vdev->num_ext_irqs);
+ i = info.index - VFIO_PCI_NUM_IRQS;
+
+ info.flags = vdev->ext_irqs[i].flags;
+ cap_type.type = vdev->ext_irqs[i].type;
+ cap_type.subtype = vdev->ext_irqs[i].subtype;
+
+ ret = vfio_info_add_capability(&caps,
+ &cap_type.header,
+ sizeof(cap_type));
+ if (ret)
+ return ret;
+ }
+ }
+
+ info.count = vfio_pci_get_irq_count(vdev, info.index);
+
+ if (caps.size) {
+ info.flags |= VFIO_IRQ_INFO_FLAG_CAPS;
+ if (info.argsz < sizeof(info) + caps.size) {
+ info.argsz = sizeof(info) + caps.size;
+ info.cap_offset = 0;
+ } else {
+ vfio_info_cap_shift(&caps, sizeof(info));
+ if (copy_to_user((void __user *)arg +
+ sizeof(info), caps.buf,
+ caps.size)) {
+ kfree(caps.buf);
+ return -EFAULT;
+ }
+ info.cap_offset = sizeof(info);
+ }
+
+ kfree(caps.buf);
+ }
return copy_to_user((void __user *)arg, &info, minsz) ?
-EFAULT : 0;
@@ -1235,7 +1297,8 @@ static long vfio_pci_ioctl(void *device_data,
max = vfio_pci_get_irq_count(vdev, hdr.index);
ret = vfio_set_irqs_validate_and_prepare(&hdr, max,
- VFIO_PCI_NUM_IRQS, &data_size);
+ VFIO_PCI_NUM_IRQS + vdev->num_ext_irqs,
+ &data_size);
if (ret)
return ret;
diff --git a/drivers/vfio/pci/vfio_pci_intrs.c b/drivers/vfio/pci/vfio_pci_intrs.c
index 869dce5f134d..1e785a5f5fb2 100644
--- a/drivers/vfio/pci/vfio_pci_intrs.c
+++ b/drivers/vfio/pci/vfio_pci_intrs.c
@@ -19,6 +19,7 @@
#include <linux/vfio.h>
#include <linux/wait.h>
#include <linux/slab.h>
+#include <linux/nospec.h>
#include "vfio_pci_private.h"
@@ -635,6 +636,24 @@ static int vfio_pci_set_req_trigger(struct vfio_pci_device *vdev,
count, flags, data);
}
+static int vfio_pci_set_ext_irq_trigger(struct vfio_pci_device *vdev,
+ unsigned int index, unsigned int start,
+ unsigned int count, uint32_t flags,
+ void *data)
+{
+ int i;
+
+ if (start != 0 || count > 1)
+ return -EINVAL;
+
+ index = array_index_nospec(index,
+ VFIO_PCI_NUM_IRQS + vdev->num_ext_irqs);
+ i = index - VFIO_PCI_NUM_IRQS;
+
+ return vfio_pci_set_ctx_trigger_single(&vdev->ext_irqs[i].trigger,
+ count, flags, data);
+}
+
int vfio_pci_set_irqs_ioctl(struct vfio_pci_device *vdev, uint32_t flags,
unsigned index, unsigned start, unsigned count,
void *data)
@@ -684,6 +703,13 @@ int vfio_pci_set_irqs_ioctl(struct vfio_pci_device *vdev, uint32_t flags,
break;
}
break;
+ default:
+ switch (flags & VFIO_IRQ_SET_ACTION_TYPE_MASK) {
+ case VFIO_IRQ_SET_ACTION_TRIGGER:
+ func = vfio_pci_set_ext_irq_trigger;
+ break;
+ }
+ break;
}
if (!func)
@@ -691,3 +717,39 @@ int vfio_pci_set_irqs_ioctl(struct vfio_pci_device *vdev, uint32_t flags,
return func(vdev, index, start, count, flags, data);
}
+
+int vfio_pci_get_ext_irq_index(struct vfio_pci_device *vdev,
+ unsigned int type, unsigned int subtype)
+{
+ int i;
+
+ for (i = 0; i < vdev->num_ext_irqs; i++) {
+ if (vdev->ext_irqs[i].type == type &&
+ vdev->ext_irqs[i].subtype == subtype) {
+ return i;
+ }
+ }
+ return -EINVAL;
+}
+
+int vfio_pci_register_irq(struct vfio_pci_device *vdev,
+ unsigned int type, unsigned int subtype,
+ u32 flags)
+{
+ struct vfio_ext_irq *ext_irqs;
+
+ ext_irqs = krealloc(vdev->ext_irqs,
+ (vdev->num_ext_irqs + 1) * sizeof(*ext_irqs),
+ GFP_KERNEL);
+ if (!ext_irqs)
+ return -ENOMEM;
+
+ vdev->ext_irqs = ext_irqs;
+
+ vdev->ext_irqs[vdev->num_ext_irqs].type = type;
+ vdev->ext_irqs[vdev->num_ext_irqs].subtype = subtype;
+ vdev->ext_irqs[vdev->num_ext_irqs].flags = flags;
+ vdev->ext_irqs[vdev->num_ext_irqs].trigger = NULL;
+ vdev->num_ext_irqs++;
+ return 0;
+}
diff --git a/drivers/vfio/pci/vfio_pci_private.h b/drivers/vfio/pci/vfio_pci_private.h
index 1d9b0f648133..e180b5435c8f 100644
--- a/drivers/vfio/pci/vfio_pci_private.h
+++ b/drivers/vfio/pci/vfio_pci_private.h
@@ -77,6 +77,13 @@ struct vfio_pci_region {
u32 flags;
};
+struct vfio_ext_irq {
+ u32 type;
+ u32 subtype;
+ u32 flags;
+ struct eventfd_ctx *trigger;
+};
+
struct vfio_pci_dummy_resource {
struct resource resource;
int index;
@@ -111,6 +118,8 @@ struct vfio_pci_device {
struct vfio_pci_irq_ctx *ctx;
int num_ctx;
int irq_type;
+ struct vfio_ext_irq *ext_irqs;
+ int num_ext_irqs;
int num_regions;
struct vfio_pci_region *region;
u8 msi_qmax;
@@ -154,6 +163,11 @@ struct vfio_pci_device {
extern void vfio_pci_intx_mask(struct vfio_pci_device *vdev);
extern void vfio_pci_intx_unmask(struct vfio_pci_device *vdev);
+extern int vfio_pci_register_irq(struct vfio_pci_device *vdev,
+ unsigned int type, unsigned int subtype,
+ u32 flags);
+extern int vfio_pci_get_ext_irq_index(struct vfio_pci_device *vdev,
+ unsigned int type, unsigned int subtype);
extern int vfio_pci_set_irqs_ioctl(struct vfio_pci_device *vdev,
uint32_t flags, unsigned index,
--
2.21.3
In preparation for vSVA, let's register a DMA fault response region,
where the userspace will push the page responses and increment the
head of the buffer. The kernel will pop those responses and inject them
on iommu side.
Signed-off-by: Eric Auger <[email protected]>
---
drivers/vfio/pci/vfio_pci.c | 114 +++++++++++++++++++++++++---
drivers/vfio/pci/vfio_pci_private.h | 5 ++
drivers/vfio/pci/vfio_pci_rdwr.c | 39 ++++++++++
include/uapi/linux/vfio.h | 32 ++++++++
4 files changed, 181 insertions(+), 9 deletions(-)
diff --git a/drivers/vfio/pci/vfio_pci.c b/drivers/vfio/pci/vfio_pci.c
index 65a83fd0e8c0..e9a904ce3f0d 100644
--- a/drivers/vfio/pci/vfio_pci.c
+++ b/drivers/vfio/pci/vfio_pci.c
@@ -318,9 +318,20 @@ static void vfio_pci_dma_fault_release(struct vfio_pci_device *vdev,
kfree(vdev->fault_pages);
}
-static int vfio_pci_dma_fault_mmap(struct vfio_pci_device *vdev,
- struct vfio_pci_region *region,
- struct vm_area_struct *vma)
+static void
+vfio_pci_dma_fault_response_release(struct vfio_pci_device *vdev,
+ struct vfio_pci_region *region)
+{
+ if (vdev->dma_fault_response_wq)
+ destroy_workqueue(vdev->dma_fault_response_wq);
+ kfree(vdev->fault_response_pages);
+ vdev->fault_response_pages = NULL;
+}
+
+static int __vfio_pci_dma_fault_mmap(struct vfio_pci_device *vdev,
+ struct vfio_pci_region *region,
+ struct vm_area_struct *vma,
+ u8 *pages)
{
u64 phys_len, req_len, pgoff, req_start;
unsigned long long addr;
@@ -333,14 +344,14 @@ static int vfio_pci_dma_fault_mmap(struct vfio_pci_device *vdev,
((1U << (VFIO_PCI_OFFSET_SHIFT - PAGE_SHIFT)) - 1);
req_start = pgoff << PAGE_SHIFT;
- /* only the second page of the producer fault region is mmappable */
+ /* only the second page of the fault region is mmappable */
if (req_start < PAGE_SIZE)
return -EINVAL;
if (req_start + req_len > phys_len)
return -EINVAL;
- addr = virt_to_phys(vdev->fault_pages);
+ addr = virt_to_phys(pages);
vma->vm_private_data = vdev;
vma->vm_pgoff = (addr >> PAGE_SHIFT) + pgoff;
@@ -349,13 +360,29 @@ static int vfio_pci_dma_fault_mmap(struct vfio_pci_device *vdev,
return ret;
}
-static int vfio_pci_dma_fault_add_capability(struct vfio_pci_device *vdev,
- struct vfio_pci_region *region,
- struct vfio_info_cap *caps)
+static int vfio_pci_dma_fault_mmap(struct vfio_pci_device *vdev,
+ struct vfio_pci_region *region,
+ struct vm_area_struct *vma)
+{
+ return __vfio_pci_dma_fault_mmap(vdev, region, vma, vdev->fault_pages);
+}
+
+static int
+vfio_pci_dma_fault_response_mmap(struct vfio_pci_device *vdev,
+ struct vfio_pci_region *region,
+ struct vm_area_struct *vma)
+{
+ return __vfio_pci_dma_fault_mmap(vdev, region, vma, vdev->fault_response_pages);
+}
+
+static int __vfio_pci_dma_fault_add_capability(struct vfio_pci_device *vdev,
+ struct vfio_pci_region *region,
+ struct vfio_info_cap *caps,
+ u32 cap_id)
{
struct vfio_region_info_cap_sparse_mmap *sparse = NULL;
struct vfio_region_info_cap_fault cap = {
- .header.id = VFIO_REGION_INFO_CAP_DMA_FAULT,
+ .header.id = cap_id,
.header.version = 1,
.version = 1,
};
@@ -383,6 +410,14 @@ static int vfio_pci_dma_fault_add_capability(struct vfio_pci_device *vdev,
return ret;
}
+static int vfio_pci_dma_fault_add_capability(struct vfio_pci_device *vdev,
+ struct vfio_pci_region *region,
+ struct vfio_info_cap *caps)
+{
+ return __vfio_pci_dma_fault_add_capability(vdev, region, caps,
+ VFIO_REGION_INFO_CAP_DMA_FAULT);
+}
+
static const struct vfio_pci_regops vfio_pci_dma_fault_regops = {
.rw = vfio_pci_dma_fault_rw,
.release = vfio_pci_dma_fault_release,
@@ -390,6 +425,13 @@ static const struct vfio_pci_regops vfio_pci_dma_fault_regops = {
.add_capability = vfio_pci_dma_fault_add_capability,
};
+static const struct vfio_pci_regops vfio_pci_dma_fault_response_regops = {
+ .rw = vfio_pci_dma_fault_response_rw,
+ .release = vfio_pci_dma_fault_response_release,
+ .mmap = vfio_pci_dma_fault_response_mmap,
+ .add_capability = vfio_pci_dma_fault_add_capability,
+};
+
int vfio_pci_iommu_dev_fault_handler(struct iommu_fault *fault, void *data)
{
struct vfio_pci_device *vdev = (struct vfio_pci_device *)data;
@@ -500,6 +542,55 @@ static int vfio_pci_dma_fault_init(struct vfio_pci_device *vdev)
return ret;
}
+#define DMA_FAULT_RESPONSE_RING_LENGTH 512
+
+static int vfio_pci_dma_fault_response_init(struct vfio_pci_device *vdev)
+{
+ struct vfio_region_dma_fault_response *header;
+ struct iommu_domain *domain;
+ size_t size;
+ bool nested;
+ int ret;
+
+ domain = iommu_get_domain_for_dev(&vdev->pdev->dev);
+ ret = iommu_domain_get_attr(domain, DOMAIN_ATTR_NESTING, &nested);
+ if (ret || !nested)
+ return ret;
+
+ mutex_init(&vdev->fault_response_queue_lock);
+
+ /*
+ * We provision 1 page for the header and space for
+ * DMA_FAULT_RING_LENGTH fault records in the ring buffer.
+ */
+ size = ALIGN(sizeof(struct iommu_page_response) *
+ DMA_FAULT_RESPONSE_RING_LENGTH, PAGE_SIZE) + PAGE_SIZE;
+
+ vdev->fault_response_pages = kzalloc(size, GFP_KERNEL);
+ if (!vdev->fault_response_pages)
+ return -ENOMEM;
+
+ ret = vfio_pci_register_dev_region(vdev,
+ VFIO_REGION_TYPE_NESTED,
+ VFIO_REGION_SUBTYPE_NESTED_DMA_FAULT_RESPONSE,
+ &vfio_pci_dma_fault_response_regops, size,
+ VFIO_REGION_INFO_FLAG_READ | VFIO_REGION_INFO_FLAG_WRITE |
+ VFIO_REGION_INFO_FLAG_MMAP,
+ vdev->fault_response_pages);
+ if (ret)
+ goto out;
+
+ header = (struct vfio_region_dma_fault_response *)vdev->fault_response_pages;
+ header->entry_size = sizeof(struct iommu_page_response);
+ header->nb_entries = DMA_FAULT_RESPONSE_RING_LENGTH;
+ header->offset = PAGE_SIZE;
+
+ return 0;
+out:
+ vdev->fault_response_pages = NULL;
+ return ret;
+}
+
static int vfio_pci_enable(struct vfio_pci_device *vdev)
{
struct pci_dev *pdev = vdev->pdev;
@@ -602,6 +693,10 @@ static int vfio_pci_enable(struct vfio_pci_device *vdev)
if (ret)
goto disable_exit;
+ ret = vfio_pci_dma_fault_response_init(vdev);
+ if (ret)
+ goto disable_exit;
+
vfio_pci_probe_mmaps(vdev);
return 0;
@@ -2227,6 +2322,7 @@ static int vfio_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)
INIT_LIST_HEAD(&vdev->ioeventfds_list);
mutex_init(&vdev->vma_lock);
INIT_LIST_HEAD(&vdev->vma_list);
+ INIT_LIST_HEAD(&vdev->dummy_resources_list);
init_rwsem(&vdev->memory_lock);
ret = vfio_add_group_dev(&pdev->dev, &vfio_pci_ops, vdev);
diff --git a/drivers/vfio/pci/vfio_pci_private.h b/drivers/vfio/pci/vfio_pci_private.h
index e180b5435c8f..035634521cd0 100644
--- a/drivers/vfio/pci/vfio_pci_private.h
+++ b/drivers/vfio/pci/vfio_pci_private.h
@@ -144,7 +144,9 @@ struct vfio_pci_device {
struct eventfd_ctx *err_trigger;
struct eventfd_ctx *req_trigger;
u8 *fault_pages;
+ u8 *fault_response_pages;
struct mutex fault_queue_lock;
+ struct mutex fault_response_queue_lock;
struct list_head dummy_resources_list;
struct mutex ioeventfds_lock;
struct list_head ioeventfds_list;
@@ -189,6 +191,9 @@ extern long vfio_pci_ioeventfd(struct vfio_pci_device *vdev, loff_t offset,
extern size_t vfio_pci_dma_fault_rw(struct vfio_pci_device *vdev,
char __user *buf, size_t count,
loff_t *ppos, bool iswrite);
+extern size_t vfio_pci_dma_fault_response_rw(struct vfio_pci_device *vdev,
+ char __user *buf, size_t count,
+ loff_t *ppos, bool iswrite);
extern int vfio_pci_init_perm_bits(void);
extern void vfio_pci_uninit_perm_bits(void);
diff --git a/drivers/vfio/pci/vfio_pci_rdwr.c b/drivers/vfio/pci/vfio_pci_rdwr.c
index 164120607469..efde0793360b 100644
--- a/drivers/vfio/pci/vfio_pci_rdwr.c
+++ b/drivers/vfio/pci/vfio_pci_rdwr.c
@@ -400,6 +400,45 @@ size_t vfio_pci_dma_fault_rw(struct vfio_pci_device *vdev, char __user *buf,
return ret;
}
+size_t vfio_pci_dma_fault_response_rw(struct vfio_pci_device *vdev, char __user *buf,
+ size_t count, loff_t *ppos, bool iswrite)
+{
+ unsigned int i = VFIO_PCI_OFFSET_TO_INDEX(*ppos) - VFIO_PCI_NUM_REGIONS;
+ loff_t pos = *ppos & VFIO_PCI_OFFSET_MASK;
+ void *base = vdev->region[i].data;
+ int ret = -EFAULT;
+
+ if (pos >= vdev->region[i].size)
+ return -EINVAL;
+
+ count = min(count, (size_t)(vdev->region[i].size - pos));
+
+ if (iswrite) {
+ struct vfio_region_dma_fault_response *header =
+ (struct vfio_region_dma_fault_response *)base;
+ uint32_t new_head;
+
+ if (pos != 0 || count != 4)
+ return -EINVAL;
+
+ if (copy_from_user((void *)&new_head, buf, count))
+ return -EFAULT;
+
+ if (new_head >= header->nb_entries)
+ return -EINVAL;
+
+ mutex_lock(&vdev->fault_response_queue_lock);
+ header->head = new_head;
+ mutex_unlock(&vdev->fault_response_queue_lock);
+ } else {
+ if (copy_to_user(buf, base + pos, count))
+ return -EFAULT;
+ }
+ *ppos += count;
+ ret = count;
+ return ret;
+}
+
static void vfio_pci_ioeventfd_do_write(struct vfio_pci_ioeventfd *ioeventfd,
bool test_mem)
{
diff --git a/include/uapi/linux/vfio.h b/include/uapi/linux/vfio.h
index 1e5c82f9d14d..5d106db7a4c5 100644
--- a/include/uapi/linux/vfio.h
+++ b/include/uapi/linux/vfio.h
@@ -345,6 +345,7 @@ struct vfio_region_info_cap_type {
#define VFIO_REGION_TYPE_NESTED (2)
#define VFIO_REGION_SUBTYPE_NESTED_DMA_FAULT (1)
+#define VFIO_REGION_SUBTYPE_NESTED_DMA_FAULT_RESPONSE (2)
/**
* struct vfio_region_gfx_edid - EDID region layout.
@@ -1022,6 +1023,17 @@ struct vfio_region_info_cap_fault {
__u32 version;
};
+/*
+ * Capability exposed by the DMA fault response region
+ * @version: ABI version
+ */
+#define VFIO_REGION_INFO_CAP_DMA_FAULT_RESPONSE 7
+
+struct vfio_region_info_cap_fault_response {
+ struct vfio_info_cap_header header;
+ __u32 version;
+};
+
/*
* DMA Fault Region Layout
* @tail: index relative to the start of the ring buffer at which the
@@ -1042,6 +1054,26 @@ struct vfio_region_dma_fault {
__u32 head;
};
+/*
+ * DMA Fault Response Region Layout
+ * @head: index relative to the start of the ring buffer at which the
+ * producer (userspace) insert responses into the buffer
+ * @entry_size: fault ring buffer entry size in bytes
+ * @nb_entries: max capacity of the fault ring buffer
+ * @offset: ring buffer offset relative to the start of the region
+ * @tail: index relative to the start of the ring buffer at which the
+ * consumer (kernel) finds the next item in the buffer
+ */
+struct vfio_region_dma_fault_response {
+ /* Write-Only */
+ __u32 head;
+ /* Read-Only */
+ __u32 entry_size;
+ __u32 nb_entries;
+ __u32 offset;
+ __u32 tail;
+};
+
/* -------- API for Type1 VFIO IOMMU -------- */
/**
--
2.21.3
Hi Eric,
I love your patch! Perhaps something to improve:
[auto build test WARNING on v5.10-rc4]
[also build test WARNING on next-20201116]
[cannot apply to vfio/next]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch]
url: https://github.com/0day-ci/linux/commits/Eric-Auger/SMMUv3-Nested-Stage-Setup-VFIO-part/20201116-190742
base: 09162bc32c880a791c6c0668ce0745cf7958f576
config: powerpc64-randconfig-r026-20201116 (attached as .config)
compiler: clang version 12.0.0 (https://github.com/llvm/llvm-project c044709b8fbea2a9a375e4173a6bd735f6866c0c)
reproduce (this is a W=1 build):
wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross
chmod +x ~/bin/make.cross
# install powerpc64 cross compiling tool for clang build
# apt-get install binutils-powerpc64-linux-gnu
# https://github.com/0day-ci/linux/commit/747ef402696e1192684908ca99f06f3d68466c04
git remote add linux-review https://github.com/0day-ci/linux
git fetch --no-tags linux-review Eric-Auger/SMMUv3-Nested-Stage-Setup-VFIO-part/20201116-190742
git checkout 747ef402696e1192684908ca99f06f3d68466c04
# save the attached .config to linux build tree
COMPILER_INSTALL_PATH=$HOME/0day COMPILER=clang make.cross ARCH=powerpc64
If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <[email protected]>
All warnings (new ones prefixed by >>):
In file included from drivers/vfio/pci/vfio_pci.c:26:
In file included from include/linux/vfio.h:16:
include/uapi/linux/vfio.h:1231:34: error: field has incomplete type 'struct iommu_pasid_table_config'
struct iommu_pasid_table_config config; /* used on SET */
^
include/uapi/linux/vfio.h:1231:9: note: forward declaration of 'struct iommu_pasid_table_config'
struct iommu_pasid_table_config config; /* used on SET */
^
>> drivers/vfio/pci/vfio_pci.c:339:5: warning: no previous prototype for function 'vfio_pci_iommu_dev_fault_handler' [-Wmissing-prototypes]
int vfio_pci_iommu_dev_fault_handler(struct iommu_fault *fault, void *data)
^
drivers/vfio/pci/vfio_pci.c:339:1: note: declare 'static' if the function is not intended to be used outside of this translation unit
int vfio_pci_iommu_dev_fault_handler(struct iommu_fault *fault, void *data)
^
static
1 warning and 1 error generated.
vim +/vfio_pci_iommu_dev_fault_handler +339 drivers/vfio/pci/vfio_pci.c
338
> 339 int vfio_pci_iommu_dev_fault_handler(struct iommu_fault *fault, void *data)
340 {
341 struct vfio_pci_device *vdev = (struct vfio_pci_device *)data;
342 struct vfio_region_dma_fault *reg =
343 (struct vfio_region_dma_fault *)vdev->fault_pages;
344 struct iommu_fault *new;
345 u32 head, tail, size;
346 int ret = -EINVAL;
347
348
349 if (WARN_ON(!reg))
350 return ret;
351
352 mutex_lock(&vdev->fault_queue_lock);
353
354 head = reg->head;
355 tail = reg->tail;
356 size = reg->nb_entries;
357
358 new = (struct iommu_fault *)(vdev->fault_pages + reg->offset +
359 head * reg->entry_size);
360
361 if (CIRC_SPACE(head, tail, size) < 1) {
362 ret = -ENOSPC;
363 goto unlock;
364 }
365
366 *new = *fault;
367 reg->head = (head + 1) % size;
368 ret = 0;
369 unlock:
370 mutex_unlock(&vdev->fault_queue_lock);
371 return ret;
372 }
373
---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/[email protected]
Hi Eric,
I love your patch! Perhaps something to improve:
[auto build test WARNING on v5.10-rc4]
[also build test WARNING on next-20201116]
[cannot apply to vfio/next]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch]
url: https://github.com/0day-ci/linux/commits/Eric-Auger/SMMUv3-Nested-Stage-Setup-VFIO-part/20201116-190742
base: 09162bc32c880a791c6c0668ce0745cf7958f576
config: x86_64-allyesconfig (attached as .config)
compiler: gcc-9 (Debian 9.3.0-15) 9.3.0
reproduce (this is a W=1 build):
# https://github.com/0day-ci/linux/commit/747ef402696e1192684908ca99f06f3d68466c04
git remote add linux-review https://github.com/0day-ci/linux
git fetch --no-tags linux-review Eric-Auger/SMMUv3-Nested-Stage-Setup-VFIO-part/20201116-190742
git checkout 747ef402696e1192684908ca99f06f3d68466c04
# save the attached .config to linux build tree
make W=1 ARCH=x86_64
If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <[email protected]>
All warnings (new ones prefixed by >>):
In file included from include/linux/vfio.h:16,
from drivers/vfio/pci/vfio_pci.c:26:
include/uapi/linux/vfio.h:1231:34: error: field 'config' has incomplete type
1231 | struct iommu_pasid_table_config config; /* used on SET */
| ^~~~~~
>> drivers/vfio/pci/vfio_pci.c:339:5: warning: no previous prototype for 'vfio_pci_iommu_dev_fault_handler' [-Wmissing-prototypes]
339 | int vfio_pci_iommu_dev_fault_handler(struct iommu_fault *fault, void *data)
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
vim +/vfio_pci_iommu_dev_fault_handler +339 drivers/vfio/pci/vfio_pci.c
338
> 339 int vfio_pci_iommu_dev_fault_handler(struct iommu_fault *fault, void *data)
340 {
341 struct vfio_pci_device *vdev = (struct vfio_pci_device *)data;
342 struct vfio_region_dma_fault *reg =
343 (struct vfio_region_dma_fault *)vdev->fault_pages;
344 struct iommu_fault *new;
345 u32 head, tail, size;
346 int ret = -EINVAL;
347
348
349 if (WARN_ON(!reg))
350 return ret;
351
352 mutex_lock(&vdev->fault_queue_lock);
353
354 head = reg->head;
355 tail = reg->tail;
356 size = reg->nb_entries;
357
358 new = (struct iommu_fault *)(vdev->fault_pages + reg->offset +
359 head * reg->entry_size);
360
361 if (CIRC_SPACE(head, tail, size) < 1) {
362 ret = -ENOSPC;
363 goto unlock;
364 }
365
366 *new = *fault;
367 reg->head = (head + 1) % size;
368 ret = 0;
369 unlock:
370 mutex_unlock(&vdev->fault_queue_lock);
371 return ret;
372 }
373
---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/[email protected]
Hi Eric,
> -----Original Message-----
> From: Eric Auger [mailto:[email protected]]
> Sent: 16 November 2020 11:00
> To: [email protected]; [email protected];
> [email protected]; [email protected];
> [email protected]; [email protected]; [email protected];
> [email protected]; [email protected]; [email protected];
> [email protected]
> Cc: [email protected]; [email protected];
> [email protected]; [email protected]; Shameerali Kolothum
> Thodi <[email protected]>;
> [email protected]; [email protected]; [email protected];
> [email protected]; yuzenghui <[email protected]>
> Subject: [PATCH v11 08/13] vfio/pci: Add framework for custom interrupt
> indices
>
> Implement IRQ capability chain infrastructure. All interrupt
> indexes beyond VFIO_PCI_NUM_IRQS are handled as extended
> interrupts. They are registered with a specific type/subtype
> and supported flags.
>
> Signed-off-by: Eric Auger <[email protected]>
> ---
> drivers/vfio/pci/vfio_pci.c | 99 +++++++++++++++++++++++------
> drivers/vfio/pci/vfio_pci_intrs.c | 62 ++++++++++++++++++
> drivers/vfio/pci/vfio_pci_private.h | 14 ++++
> 3 files changed, 157 insertions(+), 18 deletions(-)
>
> diff --git a/drivers/vfio/pci/vfio_pci.c b/drivers/vfio/pci/vfio_pci.c
> index 2a6cc1a87323..93e03a4a5f32 100644
> --- a/drivers/vfio/pci/vfio_pci.c
> +++ b/drivers/vfio/pci/vfio_pci.c
> @@ -608,6 +608,14 @@ static void vfio_pci_disable(struct vfio_pci_device
> *vdev)
>
> WARN_ON(iommu_unregister_device_fault_handler(&vdev->pdev->dev));
>
> + for (i = 0; i < vdev->num_ext_irqs; i++)
> + vfio_pci_set_irqs_ioctl(vdev, VFIO_IRQ_SET_DATA_NONE |
> + VFIO_IRQ_SET_ACTION_TRIGGER,
> + VFIO_PCI_NUM_IRQS + i, 0, 0, NULL);
> + vdev->num_ext_irqs = 0;
> + kfree(vdev->ext_irqs);
> + vdev->ext_irqs = NULL;
> +
> /* Device closed, don't need mutex here */
> list_for_each_entry_safe(ioeventfd, ioeventfd_tmp,
> &vdev->ioeventfds_list, next) {
> @@ -823,6 +831,9 @@ static int vfio_pci_get_irq_count(struct vfio_pci_device
> *vdev, int irq_type)
> return 1;
> } else if (irq_type == VFIO_PCI_REQ_IRQ_INDEX) {
> return 1;
> + } else if (irq_type >= VFIO_PCI_NUM_IRQS &&
> + irq_type < VFIO_PCI_NUM_IRQS + vdev->num_ext_irqs) {
> + return 1;
> }
>
> return 0;
> @@ -1008,7 +1019,7 @@ static long vfio_pci_ioctl(void *device_data,
> info.flags |= VFIO_DEVICE_FLAGS_RESET;
>
> info.num_regions = VFIO_PCI_NUM_REGIONS + vdev->num_regions;
> - info.num_irqs = VFIO_PCI_NUM_IRQS;
> + info.num_irqs = VFIO_PCI_NUM_IRQS + vdev->num_ext_irqs;
>
> if (IS_ENABLED(CONFIG_VFIO_PCI_ZDEV)) {
> int ret = vfio_pci_info_zdev_add_caps(vdev, &caps);
> @@ -1187,36 +1198,87 @@ static long vfio_pci_ioctl(void *device_data,
>
> } else if (cmd == VFIO_DEVICE_GET_IRQ_INFO) {
> struct vfio_irq_info info;
> + struct vfio_info_cap caps = { .buf = NULL, .size = 0 };
> + unsigned long capsz;
>
> minsz = offsetofend(struct vfio_irq_info, count);
>
> + /* For backward compatibility, cannot require this */
> + capsz = offsetofend(struct vfio_irq_info, cap_offset);
> +
> if (copy_from_user(&info, (void __user *)arg, minsz))
> return -EFAULT;
>
> - if (info.argsz < minsz || info.index >= VFIO_PCI_NUM_IRQS)
> + if (info.argsz < minsz ||
> + info.index >= VFIO_PCI_NUM_IRQS + vdev->num_ext_irqs)
> return -EINVAL;
>
> - switch (info.index) {
> - case VFIO_PCI_INTX_IRQ_INDEX ... VFIO_PCI_MSIX_IRQ_INDEX:
> - case VFIO_PCI_REQ_IRQ_INDEX:
> - break;
> - case VFIO_PCI_ERR_IRQ_INDEX:
> - if (pci_is_pcie(vdev->pdev))
> - break;
> - fallthrough;
> - default:
> - return -EINVAL;
> - }
> + if (info.argsz >= capsz)
> + minsz = capsz;
>
> info.flags = VFIO_IRQ_INFO_EVENTFD;
>
> - info.count = vfio_pci_get_irq_count(vdev, info.index);
> -
> - if (info.index == VFIO_PCI_INTX_IRQ_INDEX)
> + switch (info.index) {
> + case VFIO_PCI_INTX_IRQ_INDEX:
> info.flags |= (VFIO_IRQ_INFO_MASKABLE |
> VFIO_IRQ_INFO_AUTOMASKED);
> - else
> + break;
> + case VFIO_PCI_MSI_IRQ_INDEX ... VFIO_PCI_MSIX_IRQ_INDEX:
> + case VFIO_PCI_REQ_IRQ_INDEX:
> info.flags |= VFIO_IRQ_INFO_NORESIZE;
> + break;
> + case VFIO_PCI_ERR_IRQ_INDEX:
> + info.flags |= VFIO_IRQ_INFO_NORESIZE;
> + if (!pci_is_pcie(vdev->pdev))
> + return -EINVAL;
> + break;
> + default:
> + {
> + struct vfio_irq_info_cap_type cap_type = {
> + .header.id = VFIO_IRQ_INFO_CAP_TYPE,
> + .header.version = 1 };
> + int ret, i;
> +
> + if (info.index >= VFIO_PCI_NUM_IRQS +
> + vdev->num_ext_irqs)
> + return -EINVAL;
> + info.index = array_index_nospec(info.index,
> + VFIO_PCI_NUM_IRQS +
> + vdev->num_ext_irqs);
> + i = info.index - VFIO_PCI_NUM_IRQS;
> +
> + info.flags = vdev->ext_irqs[i].flags;
> + cap_type.type = vdev->ext_irqs[i].type;
> + cap_type.subtype = vdev->ext_irqs[i].subtype;
> +
> + ret = vfio_info_add_capability(&caps,
> + &cap_type.header,
> + sizeof(cap_type));
> + if (ret)
> + return ret;
> + }
> + }
> +
> + info.count = vfio_pci_get_irq_count(vdev, info.index);
> +
> + if (caps.size) {
> + info.flags |= VFIO_IRQ_INFO_FLAG_CAPS;
> + if (info.argsz < sizeof(info) + caps.size) {
> + info.argsz = sizeof(info) + caps.size;
> + info.cap_offset = 0;
> + } else {
> + vfio_info_cap_shift(&caps, sizeof(info));
> + if (copy_to_user((void __user *)arg +
> + sizeof(info), caps.buf,
> + caps.size)) {
> + kfree(caps.buf);
> + return -EFAULT;
> + }
> + info.cap_offset = sizeof(info);
> + }
> +
> + kfree(caps.buf);
> + }
>
> return copy_to_user((void __user *)arg, &info, minsz) ?
> -EFAULT : 0;
> @@ -1235,7 +1297,8 @@ static long vfio_pci_ioctl(void *device_data,
> max = vfio_pci_get_irq_count(vdev, hdr.index);
>
> ret = vfio_set_irqs_validate_and_prepare(&hdr, max,
> - VFIO_PCI_NUM_IRQS, &data_size);
> + VFIO_PCI_NUM_IRQS + vdev->num_ext_irqs,
> + &data_size);
> if (ret)
> return ret;
>
> diff --git a/drivers/vfio/pci/vfio_pci_intrs.c b/drivers/vfio/pci/vfio_pci_intrs.c
> index 869dce5f134d..1e785a5f5fb2 100644
> --- a/drivers/vfio/pci/vfio_pci_intrs.c
> +++ b/drivers/vfio/pci/vfio_pci_intrs.c
> @@ -19,6 +19,7 @@
> #include <linux/vfio.h>
> #include <linux/wait.h>
> #include <linux/slab.h>
> +#include <linux/nospec.h>
>
> #include "vfio_pci_private.h"
>
> @@ -635,6 +636,24 @@ static int vfio_pci_set_req_trigger(struct
> vfio_pci_device *vdev,
> count, flags, data);
> }
>
> +static int vfio_pci_set_ext_irq_trigger(struct vfio_pci_device *vdev,
> + unsigned int index, unsigned int start,
> + unsigned int count, uint32_t flags,
> + void *data)
> +{
> + int i;
> +
> + if (start != 0 || count > 1)
> + return -EINVAL;
It looks like we need to add ! vdev->num_ext_irqs check above
as the vdev->ext_irqs is allocated for "nested" case only.
Thanks to qubingbing for reporting the below crash,
[ 5034.902114] Unable to handle kernel paging request at virtual address ffffffffffffff98
[ 5034.927645] Mem abort info:
...
[ 5035.088409] pc : vfio_pci_set_ctx_trigger_single+0x2c/0x108 [vfio_pci]
[ 5035.102140] lr : vfio_pci_set_ext_irq_trigger+0x84/0xa0 [vfio_pci]
...
[ 5035.289655] Call trace:
[ 5035.294796] vfio_pci_set_ctx_trigger_single+0x2c/0x108 [vfio_pci]
[ 5035.307795] vfio_pci_set_ext_irq_trigger+0x84/0xa0 [vfio_pci]
[ 5035.320062] vfio_pci_set_irqs_ioctl+0xf0/0x120 [vfio_pci]
[ 5035.331601] vfio_pci_disable+0x60/0x4e0 [vfio_pci]
[ 5035.341859] vfio_pci_release+0x74/0xb0 [vfio_pci]
This is observed when the Guest is launched without vsmmu and then "poweroff".
estuary:/home/vsmmu$ ./qemu-system-aarch64_vsmmu5.20 \
> -machine virt,gic-version=3 \
> -cpu host \
> -smp 1 \
> -m 1024 \
> -kernel Image_vsmmu \
> -initrd rootfs_vsmmu.cpio.gz \
> -device vfio-pci,host=7d:01.0,id=net0 \
> -net none \
> -nographic -D -d -enable-kvm \
> -append "rdinit=init console=ttyAMA0 ealycon=pl0ll,0x90000000"
estuary:/$ poweroff
Could you please take a look.
Thanks,
Shameer
> + index = array_index_nospec(index,
> + VFIO_PCI_NUM_IRQS + vdev->num_ext_irqs);
> + i = index - VFIO_PCI_NUM_IRQS;
> +
> + return vfio_pci_set_ctx_trigger_single(&vdev->ext_irqs[i].trigger,
> + count, flags, data);
> +}
> +
> int vfio_pci_set_irqs_ioctl(struct vfio_pci_device *vdev, uint32_t flags,
> unsigned index, unsigned start, unsigned count,
> void *data)
> @@ -684,6 +703,13 @@ int vfio_pci_set_irqs_ioctl(struct vfio_pci_device
> *vdev, uint32_t flags,
> break;
> }
> break;
> + default:
> + switch (flags & VFIO_IRQ_SET_ACTION_TYPE_MASK) {
> + case VFIO_IRQ_SET_ACTION_TRIGGER:
> + func = vfio_pci_set_ext_irq_trigger;
> + break;
> + }
> + break;
> }
>
> if (!func)
> @@ -691,3 +717,39 @@ int vfio_pci_set_irqs_ioctl(struct vfio_pci_device
> *vdev, uint32_t flags,
>
> return func(vdev, index, start, count, flags, data);
> }
> +
> +int vfio_pci_get_ext_irq_index(struct vfio_pci_device *vdev,
> + unsigned int type, unsigned int subtype)
> +{
> + int i;
> +
> + for (i = 0; i < vdev->num_ext_irqs; i++) {
> + if (vdev->ext_irqs[i].type == type &&
> + vdev->ext_irqs[i].subtype == subtype) {
> + return i;
> + }
> + }
> + return -EINVAL;
> +}
> +
> +int vfio_pci_register_irq(struct vfio_pci_device *vdev,
> + unsigned int type, unsigned int subtype,
> + u32 flags)
> +{
> + struct vfio_ext_irq *ext_irqs;
> +
> + ext_irqs = krealloc(vdev->ext_irqs,
> + (vdev->num_ext_irqs + 1) * sizeof(*ext_irqs),
> + GFP_KERNEL);
> + if (!ext_irqs)
> + return -ENOMEM;
> +
> + vdev->ext_irqs = ext_irqs;
> +
> + vdev->ext_irqs[vdev->num_ext_irqs].type = type;
> + vdev->ext_irqs[vdev->num_ext_irqs].subtype = subtype;
> + vdev->ext_irqs[vdev->num_ext_irqs].flags = flags;
> + vdev->ext_irqs[vdev->num_ext_irqs].trigger = NULL;
> + vdev->num_ext_irqs++;
> + return 0;
> +}
> diff --git a/drivers/vfio/pci/vfio_pci_private.h
> b/drivers/vfio/pci/vfio_pci_private.h
> index 1d9b0f648133..e180b5435c8f 100644
> --- a/drivers/vfio/pci/vfio_pci_private.h
> +++ b/drivers/vfio/pci/vfio_pci_private.h
> @@ -77,6 +77,13 @@ struct vfio_pci_region {
> u32 flags;
> };
>
> +struct vfio_ext_irq {
> + u32 type;
> + u32 subtype;
> + u32 flags;
> + struct eventfd_ctx *trigger;
> +};
> +
> struct vfio_pci_dummy_resource {
> struct resource resource;
> int index;
> @@ -111,6 +118,8 @@ struct vfio_pci_device {
> struct vfio_pci_irq_ctx *ctx;
> int num_ctx;
> int irq_type;
> + struct vfio_ext_irq *ext_irqs;
> + int num_ext_irqs;
> int num_regions;
> struct vfio_pci_region *region;
> u8 msi_qmax;
> @@ -154,6 +163,11 @@ struct vfio_pci_device {
>
> extern void vfio_pci_intx_mask(struct vfio_pci_device *vdev);
> extern void vfio_pci_intx_unmask(struct vfio_pci_device *vdev);
> +extern int vfio_pci_register_irq(struct vfio_pci_device *vdev,
> + unsigned int type, unsigned int subtype,
> + u32 flags);
> +extern int vfio_pci_get_ext_irq_index(struct vfio_pci_device *vdev,
> + unsigned int type, unsigned int subtype);
>
> extern int vfio_pci_set_irqs_ioctl(struct vfio_pci_device *vdev,
> uint32_t flags, unsigned index,
> --
> 2.21.3
Hi Shameer, Qubingbing
On 11/23/20 1:51 PM, Shameerali Kolothum Thodi wrote:
> Hi Eric,
>
>> -----Original Message-----
>> From: Eric Auger [mailto:[email protected]]
>> Sent: 16 November 2020 11:00
>> To: [email protected]; [email protected];
>> [email protected]; [email protected];
>> [email protected]; [email protected]; [email protected];
>> [email protected]; [email protected]; [email protected];
>> [email protected]
>> Cc: [email protected]; [email protected];
>> [email protected]; [email protected]; Shameerali Kolothum
>> Thodi <[email protected]>;
>> [email protected]; [email protected]; [email protected];
>> [email protected]; yuzenghui <[email protected]>
>> Subject: [PATCH v11 08/13] vfio/pci: Add framework for custom interrupt
>> indices
>>
>> Implement IRQ capability chain infrastructure. All interrupt
>> indexes beyond VFIO_PCI_NUM_IRQS are handled as extended
>> interrupts. They are registered with a specific type/subtype
>> and supported flags.
>>
>> Signed-off-by: Eric Auger <[email protected]>
>> ---
>> drivers/vfio/pci/vfio_pci.c | 99 +++++++++++++++++++++++------
>> drivers/vfio/pci/vfio_pci_intrs.c | 62 ++++++++++++++++++
>> drivers/vfio/pci/vfio_pci_private.h | 14 ++++
>> 3 files changed, 157 insertions(+), 18 deletions(-)
>>
>> diff --git a/drivers/vfio/pci/vfio_pci.c b/drivers/vfio/pci/vfio_pci.c
>> index 2a6cc1a87323..93e03a4a5f32 100644
>> --- a/drivers/vfio/pci/vfio_pci.c
>> +++ b/drivers/vfio/pci/vfio_pci.c
>> @@ -608,6 +608,14 @@ static void vfio_pci_disable(struct vfio_pci_device
>> *vdev)
>>
>> WARN_ON(iommu_unregister_device_fault_handler(&vdev->pdev->dev));
>>
>> + for (i = 0; i < vdev->num_ext_irqs; i++)
>> + vfio_pci_set_irqs_ioctl(vdev, VFIO_IRQ_SET_DATA_NONE |
>> + VFIO_IRQ_SET_ACTION_TRIGGER,
>> + VFIO_PCI_NUM_IRQS + i, 0, 0, NULL);
>> + vdev->num_ext_irqs = 0;
>> + kfree(vdev->ext_irqs);
>> + vdev->ext_irqs = NULL;
>> +
>> /* Device closed, don't need mutex here */
>> list_for_each_entry_safe(ioeventfd, ioeventfd_tmp,
>> &vdev->ioeventfds_list, next) {
>> @@ -823,6 +831,9 @@ static int vfio_pci_get_irq_count(struct vfio_pci_device
>> *vdev, int irq_type)
>> return 1;
>> } else if (irq_type == VFIO_PCI_REQ_IRQ_INDEX) {
>> return 1;
>> + } else if (irq_type >= VFIO_PCI_NUM_IRQS &&
>> + irq_type < VFIO_PCI_NUM_IRQS + vdev->num_ext_irqs) {
>> + return 1;
>> }
>>
>> return 0;
>> @@ -1008,7 +1019,7 @@ static long vfio_pci_ioctl(void *device_data,
>> info.flags |= VFIO_DEVICE_FLAGS_RESET;
>>
>> info.num_regions = VFIO_PCI_NUM_REGIONS + vdev->num_regions;
>> - info.num_irqs = VFIO_PCI_NUM_IRQS;
>> + info.num_irqs = VFIO_PCI_NUM_IRQS + vdev->num_ext_irqs;
>>
>> if (IS_ENABLED(CONFIG_VFIO_PCI_ZDEV)) {
>> int ret = vfio_pci_info_zdev_add_caps(vdev, &caps);
>> @@ -1187,36 +1198,87 @@ static long vfio_pci_ioctl(void *device_data,
>>
>> } else if (cmd == VFIO_DEVICE_GET_IRQ_INFO) {
>> struct vfio_irq_info info;
>> + struct vfio_info_cap caps = { .buf = NULL, .size = 0 };
>> + unsigned long capsz;
>>
>> minsz = offsetofend(struct vfio_irq_info, count);
>>
>> + /* For backward compatibility, cannot require this */
>> + capsz = offsetofend(struct vfio_irq_info, cap_offset);
>> +
>> if (copy_from_user(&info, (void __user *)arg, minsz))
>> return -EFAULT;
>>
>> - if (info.argsz < minsz || info.index >= VFIO_PCI_NUM_IRQS)
>> + if (info.argsz < minsz ||
>> + info.index >= VFIO_PCI_NUM_IRQS + vdev->num_ext_irqs)
>> return -EINVAL;
>>
>> - switch (info.index) {
>> - case VFIO_PCI_INTX_IRQ_INDEX ... VFIO_PCI_MSIX_IRQ_INDEX:
>> - case VFIO_PCI_REQ_IRQ_INDEX:
>> - break;
>> - case VFIO_PCI_ERR_IRQ_INDEX:
>> - if (pci_is_pcie(vdev->pdev))
>> - break;
>> - fallthrough;
>> - default:
>> - return -EINVAL;
>> - }
>> + if (info.argsz >= capsz)
>> + minsz = capsz;
>>
>> info.flags = VFIO_IRQ_INFO_EVENTFD;
>>
>> - info.count = vfio_pci_get_irq_count(vdev, info.index);
>> -
>> - if (info.index == VFIO_PCI_INTX_IRQ_INDEX)
>> + switch (info.index) {
>> + case VFIO_PCI_INTX_IRQ_INDEX:
>> info.flags |= (VFIO_IRQ_INFO_MASKABLE |
>> VFIO_IRQ_INFO_AUTOMASKED);
>> - else
>> + break;
>> + case VFIO_PCI_MSI_IRQ_INDEX ... VFIO_PCI_MSIX_IRQ_INDEX:
>> + case VFIO_PCI_REQ_IRQ_INDEX:
>> info.flags |= VFIO_IRQ_INFO_NORESIZE;
>> + break;
>> + case VFIO_PCI_ERR_IRQ_INDEX:
>> + info.flags |= VFIO_IRQ_INFO_NORESIZE;
>> + if (!pci_is_pcie(vdev->pdev))
>> + return -EINVAL;
>> + break;
>> + default:
>> + {
>> + struct vfio_irq_info_cap_type cap_type = {
>> + .header.id = VFIO_IRQ_INFO_CAP_TYPE,
>> + .header.version = 1 };
>> + int ret, i;
>> +
>> + if (info.index >= VFIO_PCI_NUM_IRQS +
>> + vdev->num_ext_irqs)
>> + return -EINVAL;
>> + info.index = array_index_nospec(info.index,
>> + VFIO_PCI_NUM_IRQS +
>> + vdev->num_ext_irqs);
>> + i = info.index - VFIO_PCI_NUM_IRQS;
>> +
>> + info.flags = vdev->ext_irqs[i].flags;
>> + cap_type.type = vdev->ext_irqs[i].type;
>> + cap_type.subtype = vdev->ext_irqs[i].subtype;
>> +
>> + ret = vfio_info_add_capability(&caps,
>> + &cap_type.header,
>> + sizeof(cap_type));
>> + if (ret)
>> + return ret;
>> + }
>> + }
>> +
>> + info.count = vfio_pci_get_irq_count(vdev, info.index);
>> +
>> + if (caps.size) {
>> + info.flags |= VFIO_IRQ_INFO_FLAG_CAPS;
>> + if (info.argsz < sizeof(info) + caps.size) {
>> + info.argsz = sizeof(info) + caps.size;
>> + info.cap_offset = 0;
>> + } else {
>> + vfio_info_cap_shift(&caps, sizeof(info));
>> + if (copy_to_user((void __user *)arg +
>> + sizeof(info), caps.buf,
>> + caps.size)) {
>> + kfree(caps.buf);
>> + return -EFAULT;
>> + }
>> + info.cap_offset = sizeof(info);
>> + }
>> +
>> + kfree(caps.buf);
>> + }
>>
>> return copy_to_user((void __user *)arg, &info, minsz) ?
>> -EFAULT : 0;
>> @@ -1235,7 +1297,8 @@ static long vfio_pci_ioctl(void *device_data,
>> max = vfio_pci_get_irq_count(vdev, hdr.index);
>>
>> ret = vfio_set_irqs_validate_and_prepare(&hdr, max,
>> - VFIO_PCI_NUM_IRQS, &data_size);
>> + VFIO_PCI_NUM_IRQS + vdev->num_ext_irqs,
>> + &data_size);
>> if (ret)
>> return ret;
>>
>> diff --git a/drivers/vfio/pci/vfio_pci_intrs.c b/drivers/vfio/pci/vfio_pci_intrs.c
>> index 869dce5f134d..1e785a5f5fb2 100644
>> --- a/drivers/vfio/pci/vfio_pci_intrs.c
>> +++ b/drivers/vfio/pci/vfio_pci_intrs.c
>> @@ -19,6 +19,7 @@
>> #include <linux/vfio.h>
>> #include <linux/wait.h>
>> #include <linux/slab.h>
>> +#include <linux/nospec.h>
>>
>> #include "vfio_pci_private.h"
>>
>> @@ -635,6 +636,24 @@ static int vfio_pci_set_req_trigger(struct
>> vfio_pci_device *vdev,
>> count, flags, data);
>> }
>>
>> +static int vfio_pci_set_ext_irq_trigger(struct vfio_pci_device *vdev,
>> + unsigned int index, unsigned int start,
>> + unsigned int count, uint32_t flags,
>> + void *data)
>> +{
>> + int i;
>> +
>> + if (start != 0 || count > 1)
>> + return -EINVAL;
>
> It looks like we need to add ! vdev->num_ext_irqs check above
> as the vdev->ext_irqs is allocated for "nested" case only.
>
> Thanks to qubingbing for reporting the below crash,
>
> [ 5034.902114] Unable to handle kernel paging request at virtual address ffffffffffffff98
> [ 5034.927645] Mem abort info:
> ...
> [ 5035.088409] pc : vfio_pci_set_ctx_trigger_single+0x2c/0x108 [vfio_pci]
> [ 5035.102140] lr : vfio_pci_set_ext_irq_trigger+0x84/0xa0 [vfio_pci]
> ...
> [ 5035.289655] Call trace:
> [ 5035.294796] vfio_pci_set_ctx_trigger_single+0x2c/0x108 [vfio_pci]
> [ 5035.307795] vfio_pci_set_ext_irq_trigger+0x84/0xa0 [vfio_pci]
> [ 5035.320062] vfio_pci_set_irqs_ioctl+0xf0/0x120 [vfio_pci]
> [ 5035.331601] vfio_pci_disable+0x60/0x4e0 [vfio_pci]
> [ 5035.341859] vfio_pci_release+0x74/0xb0 [vfio_pci]
>
> This is observed when the Guest is launched without vsmmu and then "poweroff".
>
> estuary:/home/vsmmu$ ./qemu-system-aarch64_vsmmu5.20 \
>> -machine virt,gic-version=3 \
>> -cpu host \
>> -smp 1 \
>> -m 1024 \
>> -kernel Image_vsmmu \
>> -initrd rootfs_vsmmu.cpio.gz \
>> -device vfio-pci,host=7d:01.0,id=net0 \
>> -net none \
>> -nographic -D -d -enable-kvm \
>> -append "rdinit=init console=ttyAMA0 ealycon=pl0ll,0x90000000"
>
> estuary:/$ poweroff
>
> Could you please take a look.
Sure I will.
Thanks
Eric
>
> Thanks,
> Shameer
>
>
>> + index = array_index_nospec(index,
>> + VFIO_PCI_NUM_IRQS + vdev->num_ext_irqs);
>> + i = index - VFIO_PCI_NUM_IRQS;
>> +
>> + return vfio_pci_set_ctx_trigger_single(&vdev->ext_irqs[i].trigger,
>> + count, flags, data);
>> +}
>> +
>> int vfio_pci_set_irqs_ioctl(struct vfio_pci_device *vdev, uint32_t flags,
>> unsigned index, unsigned start, unsigned count,
>> void *data)
>> @@ -684,6 +703,13 @@ int vfio_pci_set_irqs_ioctl(struct vfio_pci_device
>> *vdev, uint32_t flags,
>> break;
>> }
>> break;
>> + default:
>> + switch (flags & VFIO_IRQ_SET_ACTION_TYPE_MASK) {
>> + case VFIO_IRQ_SET_ACTION_TRIGGER:
>> + func = vfio_pci_set_ext_irq_trigger;
>> + break;
>> + }
>> + break;
>> }
>>
>> if (!func)
>> @@ -691,3 +717,39 @@ int vfio_pci_set_irqs_ioctl(struct vfio_pci_device
>> *vdev, uint32_t flags,
>>
>> return func(vdev, index, start, count, flags, data);
>> }
>> +
>> +int vfio_pci_get_ext_irq_index(struct vfio_pci_device *vdev,
>> + unsigned int type, unsigned int subtype)
>> +{
>> + int i;
>> +
>> + for (i = 0; i < vdev->num_ext_irqs; i++) {
>> + if (vdev->ext_irqs[i].type == type &&
>> + vdev->ext_irqs[i].subtype == subtype) {
>> + return i;
>> + }
>> + }
>> + return -EINVAL;
>> +}
>> +
>> +int vfio_pci_register_irq(struct vfio_pci_device *vdev,
>> + unsigned int type, unsigned int subtype,
>> + u32 flags)
>> +{
>> + struct vfio_ext_irq *ext_irqs;
>> +
>> + ext_irqs = krealloc(vdev->ext_irqs,
>> + (vdev->num_ext_irqs + 1) * sizeof(*ext_irqs),
>> + GFP_KERNEL);
>> + if (!ext_irqs)
>> + return -ENOMEM;
>> +
>> + vdev->ext_irqs = ext_irqs;
>> +
>> + vdev->ext_irqs[vdev->num_ext_irqs].type = type;
>> + vdev->ext_irqs[vdev->num_ext_irqs].subtype = subtype;
>> + vdev->ext_irqs[vdev->num_ext_irqs].flags = flags;
>> + vdev->ext_irqs[vdev->num_ext_irqs].trigger = NULL;
>> + vdev->num_ext_irqs++;
>> + return 0;
>> +}
>> diff --git a/drivers/vfio/pci/vfio_pci_private.h
>> b/drivers/vfio/pci/vfio_pci_private.h
>> index 1d9b0f648133..e180b5435c8f 100644
>> --- a/drivers/vfio/pci/vfio_pci_private.h
>> +++ b/drivers/vfio/pci/vfio_pci_private.h
>> @@ -77,6 +77,13 @@ struct vfio_pci_region {
>> u32 flags;
>> };
>>
>> +struct vfio_ext_irq {
>> + u32 type;
>> + u32 subtype;
>> + u32 flags;
>> + struct eventfd_ctx *trigger;
>> +};
>> +
>> struct vfio_pci_dummy_resource {
>> struct resource resource;
>> int index;
>> @@ -111,6 +118,8 @@ struct vfio_pci_device {
>> struct vfio_pci_irq_ctx *ctx;
>> int num_ctx;
>> int irq_type;
>> + struct vfio_ext_irq *ext_irqs;
>> + int num_ext_irqs;
>> int num_regions;
>> struct vfio_pci_region *region;
>> u8 msi_qmax;
>> @@ -154,6 +163,11 @@ struct vfio_pci_device {
>>
>> extern void vfio_pci_intx_mask(struct vfio_pci_device *vdev);
>> extern void vfio_pci_intx_unmask(struct vfio_pci_device *vdev);
>> +extern int vfio_pci_register_irq(struct vfio_pci_device *vdev,
>> + unsigned int type, unsigned int subtype,
>> + u32 flags);
>> +extern int vfio_pci_get_ext_irq_index(struct vfio_pci_device *vdev,
>> + unsigned int type, unsigned int subtype);
>>
>> extern int vfio_pci_set_irqs_ioctl(struct vfio_pci_device *vdev,
>> uint32_t flags, unsigned index,
>> --
>> 2.21.3
>
Hi Eric,
On 2020/11/16 19:00, Eric Auger wrote:
> Add a new specific DMA_FAULT region aiming to exposed nested mode
> translation faults. This region only is exposed if the device
> is attached to a nested domain.
>
> The region has a ring buffer that contains the actual fault
> records plus a header allowing to handle it (tail/head indices,
> max capacity, entry size). At the moment the region is dimensionned
> for 512 fault records.
>
> Signed-off-by: Eric Auger <[email protected]>
>
> ---
[...]
> diff --git a/include/uapi/linux/vfio.h b/include/uapi/linux/vfio.h
> index b352e76cfb71..629dfb38d9e7 100644
> --- a/include/uapi/linux/vfio.h
> +++ b/include/uapi/linux/vfio.h
> @@ -343,6 +343,9 @@ struct vfio_region_info_cap_type {
> /* sub-types for VFIO_REGION_TYPE_GFX */
> #define VFIO_REGION_SUBTYPE_GFX_EDID (1)
>
> +#define VFIO_REGION_TYPE_NESTED (2)
> +#define VFIO_REGION_SUBTYPE_NESTED_DMA_FAULT (1)
> +
The macro *define VFIO_REGION_TYPE_NESTED (2)* is in conflict with
*#define VFIO_REGION_TYPE_CCW (2)*.
Thanks,
Kunkun Jiang.
Hi Eric,
> -----Original Message-----
> From: Eric Auger [mailto:[email protected]]
> Sent: 16 November 2020 11:00
> To: [email protected]; [email protected];
> [email protected]; [email protected];
> [email protected]; [email protected]; [email protected];
> [email protected]; [email protected]; [email protected];
> [email protected]
> Cc: [email protected]; [email protected];
> [email protected]; [email protected]; Shameerali Kolothum
> Thodi <[email protected]>;
> [email protected]; [email protected]; [email protected];
> [email protected]; yuzenghui <[email protected]>
> Subject: [PATCH v11 12/13] vfio/pci: Register a DMA fault response region
>
> In preparation for vSVA, let's register a DMA fault response region,
> where the userspace will push the page responses and increment the
> head of the buffer. The kernel will pop those responses and inject them
> on iommu side.
>
> Signed-off-by: Eric Auger <[email protected]>
> ---
> drivers/vfio/pci/vfio_pci.c | 114 +++++++++++++++++++++++++---
> drivers/vfio/pci/vfio_pci_private.h | 5 ++
> drivers/vfio/pci/vfio_pci_rdwr.c | 39 ++++++++++
> include/uapi/linux/vfio.h | 32 ++++++++
> 4 files changed, 181 insertions(+), 9 deletions(-)
>
> diff --git a/drivers/vfio/pci/vfio_pci.c b/drivers/vfio/pci/vfio_pci.c
> index 65a83fd0e8c0..e9a904ce3f0d 100644
> --- a/drivers/vfio/pci/vfio_pci.c
> +++ b/drivers/vfio/pci/vfio_pci.c
> @@ -318,9 +318,20 @@ static void vfio_pci_dma_fault_release(struct
> vfio_pci_device *vdev,
> kfree(vdev->fault_pages);
> }
>
> -static int vfio_pci_dma_fault_mmap(struct vfio_pci_device *vdev,
> - struct vfio_pci_region *region,
> - struct vm_area_struct *vma)
> +static void
> +vfio_pci_dma_fault_response_release(struct vfio_pci_device *vdev,
> + struct vfio_pci_region *region)
> +{
> + if (vdev->dma_fault_response_wq)
> + destroy_workqueue(vdev->dma_fault_response_wq);
> + kfree(vdev->fault_response_pages);
> + vdev->fault_response_pages = NULL;
> +}
> +
> +static int __vfio_pci_dma_fault_mmap(struct vfio_pci_device *vdev,
> + struct vfio_pci_region *region,
> + struct vm_area_struct *vma,
> + u8 *pages)
> {
> u64 phys_len, req_len, pgoff, req_start;
> unsigned long long addr;
> @@ -333,14 +344,14 @@ static int vfio_pci_dma_fault_mmap(struct
> vfio_pci_device *vdev,
> ((1U << (VFIO_PCI_OFFSET_SHIFT - PAGE_SHIFT)) - 1);
> req_start = pgoff << PAGE_SHIFT;
>
> - /* only the second page of the producer fault region is mmappable */
> + /* only the second page of the fault region is mmappable */
> if (req_start < PAGE_SIZE)
> return -EINVAL;
>
> if (req_start + req_len > phys_len)
> return -EINVAL;
>
> - addr = virt_to_phys(vdev->fault_pages);
> + addr = virt_to_phys(pages);
> vma->vm_private_data = vdev;
> vma->vm_pgoff = (addr >> PAGE_SHIFT) + pgoff;
>
> @@ -349,13 +360,29 @@ static int vfio_pci_dma_fault_mmap(struct
> vfio_pci_device *vdev,
> return ret;
> }
>
> -static int vfio_pci_dma_fault_add_capability(struct vfio_pci_device *vdev,
> - struct vfio_pci_region *region,
> - struct vfio_info_cap *caps)
> +static int vfio_pci_dma_fault_mmap(struct vfio_pci_device *vdev,
> + struct vfio_pci_region *region,
> + struct vm_area_struct *vma)
> +{
> + return __vfio_pci_dma_fault_mmap(vdev, region, vma,
> vdev->fault_pages);
> +}
> +
> +static int
> +vfio_pci_dma_fault_response_mmap(struct vfio_pci_device *vdev,
> + struct vfio_pci_region *region,
> + struct vm_area_struct *vma)
> +{
> + return __vfio_pci_dma_fault_mmap(vdev, region, vma,
> vdev->fault_response_pages);
> +}
> +
> +static int __vfio_pci_dma_fault_add_capability(struct vfio_pci_device *vdev,
> + struct vfio_pci_region *region,
> + struct vfio_info_cap *caps,
> + u32 cap_id)
> {
> struct vfio_region_info_cap_sparse_mmap *sparse = NULL;
> struct vfio_region_info_cap_fault cap = {
> - .header.id = VFIO_REGION_INFO_CAP_DMA_FAULT,
> + .header.id = cap_id,
> .header.version = 1,
> .version = 1,
> };
> @@ -383,6 +410,14 @@ static int vfio_pci_dma_fault_add_capability(struct
> vfio_pci_device *vdev,
> return ret;
> }
>
> +static int vfio_pci_dma_fault_add_capability(struct vfio_pci_device *vdev,
> + struct vfio_pci_region *region,
> + struct vfio_info_cap *caps)
> +{
> + return __vfio_pci_dma_fault_add_capability(vdev, region, caps,
> + VFIO_REGION_INFO_CAP_DMA_FAULT);
> +}
> +
> static const struct vfio_pci_regops vfio_pci_dma_fault_regops = {
> .rw = vfio_pci_dma_fault_rw,
> .release = vfio_pci_dma_fault_release,
> @@ -390,6 +425,13 @@ static const struct vfio_pci_regops
> vfio_pci_dma_fault_regops = {
> .add_capability = vfio_pci_dma_fault_add_capability,
> };
>
> +static const struct vfio_pci_regops vfio_pci_dma_fault_response_regops = {
> + .rw = vfio_pci_dma_fault_response_rw,
> + .release = vfio_pci_dma_fault_response_release,
> + .mmap = vfio_pci_dma_fault_response_mmap,
> + .add_capability = vfio_pci_dma_fault_add_capability,
> +};
> +
> int vfio_pci_iommu_dev_fault_handler(struct iommu_fault *fault, void *data)
> {
> struct vfio_pci_device *vdev = (struct vfio_pci_device *)data;
> @@ -500,6 +542,55 @@ static int vfio_pci_dma_fault_init(struct
> vfio_pci_device *vdev)
> return ret;
> }
>
> +#define DMA_FAULT_RESPONSE_RING_LENGTH 512
> +
> +static int vfio_pci_dma_fault_response_init(struct vfio_pci_device *vdev)
> +{
> + struct vfio_region_dma_fault_response *header;
> + struct iommu_domain *domain;
> + size_t size;
> + bool nested;
> + int ret;
> +
> + domain = iommu_get_domain_for_dev(&vdev->pdev->dev);
> + ret = iommu_domain_get_attr(domain, DOMAIN_ATTR_NESTING,
> &nested);
The above will fail((Thanks to Zengtao for reporting this) if the Guest is
booted in "enable_unsafe_noiommu_mode" (CONFIG_VFIO_NOIOMMU)
and dpdk testpmd is attempted.
This is because even though there is an iommu group created for this
mode, no iommu domain gets attached to it. And results in below
crash,
root@ubuntu:/mnt/dpdk/build/app# ./testpmd -w 0000:00:02.0 --file-prefix socket0 -l 0-1 -n 2 -- -i
EAL: Detected 8 lcore(s)
EAL: Detected 1 NUMA nodes
EAL: Multi-process socket /var/run/dpdk/socket0/mp_socket
EAL: Selected IOVA mode 'PA'
EAL: No available hugepages reported in hugepages-32768kB
EAL: No available hugepages reported in hugepages-64kB
EAL: No available hugepages reported in hugepages-1048576kB
EAL: Probing VFIO support...
EAL: VFIO support initialized
EAL: Invalid NUMA socket, default to 0
EAL: using IOMMU type 8 (No-IOMMU)
[ 84.942213] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000008
[ 84.943047] Mem abort info:
---
I have pushed a temp fix for this in my test branch here,
https://github.com/hisilicon/kernel-dev/commit/7784d96fbac9c48e8093ec9dbf43a172b1cbe3c3
Please take a look.
(I am seeing another issue with testpmd + vsmmu. I will explain that in another thread).
Thanks,
Shameer
> + if (ret || !nested)
> + return ret;
> +
> + mutex_init(&vdev->fault_response_queue_lock);
> +
> + /*
> + * We provision 1 page for the header and space for
> + * DMA_FAULT_RING_LENGTH fault records in the ring buffer.
> + */
> + size = ALIGN(sizeof(struct iommu_page_response) *
> + DMA_FAULT_RESPONSE_RING_LENGTH, PAGE_SIZE) +
> PAGE_SIZE;
> +
> + vdev->fault_response_pages = kzalloc(size, GFP_KERNEL);
> + if (!vdev->fault_response_pages)
> + return -ENOMEM;
> +
> + ret = vfio_pci_register_dev_region(vdev,
> + VFIO_REGION_TYPE_NESTED,
> + VFIO_REGION_SUBTYPE_NESTED_DMA_FAULT_RESPONSE,
> + &vfio_pci_dma_fault_response_regops, size,
> + VFIO_REGION_INFO_FLAG_READ |
> VFIO_REGION_INFO_FLAG_WRITE |
> + VFIO_REGION_INFO_FLAG_MMAP,
> + vdev->fault_response_pages);
> + if (ret)
> + goto out;
> +
> + header = (struct vfio_region_dma_fault_response
> *)vdev->fault_response_pages;
> + header->entry_size = sizeof(struct iommu_page_response);
> + header->nb_entries = DMA_FAULT_RESPONSE_RING_LENGTH;
> + header->offset = PAGE_SIZE;
> +
> + return 0;
> +out:
> + vdev->fault_response_pages = NULL;
> + return ret;
> +}
> +
> static int vfio_pci_enable(struct vfio_pci_device *vdev)
> {
> struct pci_dev *pdev = vdev->pdev;
> @@ -602,6 +693,10 @@ static int vfio_pci_enable(struct vfio_pci_device
> *vdev)
> if (ret)
> goto disable_exit;
>
> + ret = vfio_pci_dma_fault_response_init(vdev);
> + if (ret)
> + goto disable_exit;
> +
> vfio_pci_probe_mmaps(vdev);
>
> return 0;
> @@ -2227,6 +2322,7 @@ static int vfio_pci_probe(struct pci_dev *pdev, const
> struct pci_device_id *id)
> INIT_LIST_HEAD(&vdev->ioeventfds_list);
> mutex_init(&vdev->vma_lock);
> INIT_LIST_HEAD(&vdev->vma_list);
> + INIT_LIST_HEAD(&vdev->dummy_resources_list);
> init_rwsem(&vdev->memory_lock);
>
> ret = vfio_add_group_dev(&pdev->dev, &vfio_pci_ops, vdev);
> diff --git a/drivers/vfio/pci/vfio_pci_private.h
> b/drivers/vfio/pci/vfio_pci_private.h
> index e180b5435c8f..035634521cd0 100644
> --- a/drivers/vfio/pci/vfio_pci_private.h
> +++ b/drivers/vfio/pci/vfio_pci_private.h
> @@ -144,7 +144,9 @@ struct vfio_pci_device {
> struct eventfd_ctx *err_trigger;
> struct eventfd_ctx *req_trigger;
> u8 *fault_pages;
> + u8 *fault_response_pages;
> struct mutex fault_queue_lock;
> + struct mutex fault_response_queue_lock;
> struct list_head dummy_resources_list;
> struct mutex ioeventfds_lock;
> struct list_head ioeventfds_list;
> @@ -189,6 +191,9 @@ extern long vfio_pci_ioeventfd(struct vfio_pci_device
> *vdev, loff_t offset,
> extern size_t vfio_pci_dma_fault_rw(struct vfio_pci_device *vdev,
> char __user *buf, size_t count,
> loff_t *ppos, bool iswrite);
> +extern size_t vfio_pci_dma_fault_response_rw(struct vfio_pci_device *vdev,
> + char __user *buf, size_t count,
> + loff_t *ppos, bool iswrite);
>
> extern int vfio_pci_init_perm_bits(void);
> extern void vfio_pci_uninit_perm_bits(void);
> diff --git a/drivers/vfio/pci/vfio_pci_rdwr.c b/drivers/vfio/pci/vfio_pci_rdwr.c
> index 164120607469..efde0793360b 100644
> --- a/drivers/vfio/pci/vfio_pci_rdwr.c
> +++ b/drivers/vfio/pci/vfio_pci_rdwr.c
> @@ -400,6 +400,45 @@ size_t vfio_pci_dma_fault_rw(struct vfio_pci_device
> *vdev, char __user *buf,
> return ret;
> }
>
> +size_t vfio_pci_dma_fault_response_rw(struct vfio_pci_device *vdev, char
> __user *buf,
> + size_t count, loff_t *ppos, bool iswrite)
> +{
> + unsigned int i = VFIO_PCI_OFFSET_TO_INDEX(*ppos) -
> VFIO_PCI_NUM_REGIONS;
> + loff_t pos = *ppos & VFIO_PCI_OFFSET_MASK;
> + void *base = vdev->region[i].data;
> + int ret = -EFAULT;
> +
> + if (pos >= vdev->region[i].size)
> + return -EINVAL;
> +
> + count = min(count, (size_t)(vdev->region[i].size - pos));
> +
> + if (iswrite) {
> + struct vfio_region_dma_fault_response *header =
> + (struct vfio_region_dma_fault_response *)base;
> + uint32_t new_head;
> +
> + if (pos != 0 || count != 4)
> + return -EINVAL;
> +
> + if (copy_from_user((void *)&new_head, buf, count))
> + return -EFAULT;
> +
> + if (new_head >= header->nb_entries)
> + return -EINVAL;
> +
> + mutex_lock(&vdev->fault_response_queue_lock);
> + header->head = new_head;
> + mutex_unlock(&vdev->fault_response_queue_lock);
> + } else {
> + if (copy_to_user(buf, base + pos, count))
> + return -EFAULT;
> + }
> + *ppos += count;
> + ret = count;
> + return ret;
> +}
> +
> static void vfio_pci_ioeventfd_do_write(struct vfio_pci_ioeventfd *ioeventfd,
> bool test_mem)
> {
> diff --git a/include/uapi/linux/vfio.h b/include/uapi/linux/vfio.h
> index 1e5c82f9d14d..5d106db7a4c5 100644
> --- a/include/uapi/linux/vfio.h
> +++ b/include/uapi/linux/vfio.h
> @@ -345,6 +345,7 @@ struct vfio_region_info_cap_type {
>
> #define VFIO_REGION_TYPE_NESTED (2)
> #define VFIO_REGION_SUBTYPE_NESTED_DMA_FAULT (1)
> +#define VFIO_REGION_SUBTYPE_NESTED_DMA_FAULT_RESPONSE (2)
>
> /**
> * struct vfio_region_gfx_edid - EDID region layout.
> @@ -1022,6 +1023,17 @@ struct vfio_region_info_cap_fault {
> __u32 version;
> };
>
> +/*
> + * Capability exposed by the DMA fault response region
> + * @version: ABI version
> + */
> +#define VFIO_REGION_INFO_CAP_DMA_FAULT_RESPONSE 7
> +
> +struct vfio_region_info_cap_fault_response {
> + struct vfio_info_cap_header header;
> + __u32 version;
> +};
> +
> /*
> * DMA Fault Region Layout
> * @tail: index relative to the start of the ring buffer at which the
> @@ -1042,6 +1054,26 @@ struct vfio_region_dma_fault {
> __u32 head;
> };
>
> +/*
> + * DMA Fault Response Region Layout
> + * @head: index relative to the start of the ring buffer at which the
> + * producer (userspace) insert responses into the buffer
> + * @entry_size: fault ring buffer entry size in bytes
> + * @nb_entries: max capacity of the fault ring buffer
> + * @offset: ring buffer offset relative to the start of the region
> + * @tail: index relative to the start of the ring buffer at which the
> + * consumer (kernel) finds the next item in the buffer
> + */
> +struct vfio_region_dma_fault_response {
> + /* Write-Only */
> + __u32 head;
> + /* Read-Only */
> + __u32 entry_size;
> + __u32 nb_entries;
> + __u32 offset;
> + __u32 tail;
> +};
> +
> /* -------- API for Type1 VFIO IOMMU -------- */
>
> /**
> --
> 2.21.3
Hi Eric,
On 2020/11/16 19:00, Eric Auger wrote:
> This patch adds the VFIO_IOMMU_SET_MSI_BINDING ioctl which aim
> to (un)register the guest MSI binding to the host. This latter
> then can use those stage 1 bindings to build a nested stage
> binding targeting the physical MSIs.
[...]
> +static int vfio_iommu_type1_set_msi_binding(struct vfio_iommu *iommu,
> + unsigned long arg)
> +{
> + struct vfio_iommu_type1_set_msi_binding msi_binding;
> + unsigned long minsz;
> + int ret = -EINVAL;
> +
> + minsz = offsetofend(struct vfio_iommu_type1_set_msi_binding,
> + size);
> +
> + if (copy_from_user(&msi_binding, (void __user *)arg, minsz))
> + return -EFAULT;
> +
> + if (msi_binding.argsz < minsz)
> + return -EINVAL;
We can check BIND and UNBIND are not set simultaneously, just like VFIO_IOMMU_SET_PASID_TABLE.
> +
> + if (msi_binding.flags == VFIO_IOMMU_UNBIND_MSI) {
> + vfio_unbind_msi(iommu, msi_binding.iova);
> + ret = 0;
> + } else if (msi_binding.flags == VFIO_IOMMU_BIND_MSI) {
> + ret = vfio_bind_msi(iommu, msi_binding.iova,
> + msi_binding.gpa, msi_binding.size);
> + }
> + return ret;
> +}
> +
Thanks,
Keqian
Hi Eric,
> > -----Original Message-----
> > From: Eric Auger [mailto:[email protected]]
> > Sent: 16 November 2020 11:00
> > To: [email protected]; [email protected];
> > [email protected]; [email protected];
> > [email protected]; [email protected]; [email protected];
> > [email protected]; [email protected]; [email protected];
> > [email protected]
> > Cc: [email protected]; [email protected];
> > [email protected]; [email protected]; Shameerali Kolothum
> > Thodi <[email protected]>;
> > [email protected]; [email protected]; [email protected];
> > [email protected]; yuzenghui <[email protected]>
> > Subject: [PATCH v11 12/13] vfio/pci: Register a DMA fault response
> > region
> >
> > In preparation for vSVA, let's register a DMA fault response region,
> > where the userspace will push the page responses and increment the
> > head of the buffer. The kernel will pop those responses and inject
> > them on iommu side.
> >
> > Signed-off-by: Eric Auger <[email protected]>
> > ---
> > drivers/vfio/pci/vfio_pci.c | 114 +++++++++++++++++++++++++---
> > drivers/vfio/pci/vfio_pci_private.h | 5 ++
> > drivers/vfio/pci/vfio_pci_rdwr.c | 39 ++++++++++
> > include/uapi/linux/vfio.h | 32 ++++++++
> > 4 files changed, 181 insertions(+), 9 deletions(-)
> >
> > diff --git a/drivers/vfio/pci/vfio_pci.c b/drivers/vfio/pci/vfio_pci.c
> > index 65a83fd0e8c0..e9a904ce3f0d 100644
> > --- a/drivers/vfio/pci/vfio_pci.c
> > +++ b/drivers/vfio/pci/vfio_pci.c
> > @@ -318,9 +318,20 @@ static void vfio_pci_dma_fault_release(struct
> > vfio_pci_device *vdev,
> > kfree(vdev->fault_pages);
> > }
> >
> > -static int vfio_pci_dma_fault_mmap(struct vfio_pci_device *vdev,
> > - struct vfio_pci_region *region,
> > - struct vm_area_struct *vma)
> > +static void
> > +vfio_pci_dma_fault_response_release(struct vfio_pci_device *vdev,
> > + struct vfio_pci_region *region) {
> > + if (vdev->dma_fault_response_wq)
> > + destroy_workqueue(vdev->dma_fault_response_wq);
> > + kfree(vdev->fault_response_pages);
> > + vdev->fault_response_pages = NULL;
> > +}
> > +
> > +static int __vfio_pci_dma_fault_mmap(struct vfio_pci_device *vdev,
> > + struct vfio_pci_region *region,
> > + struct vm_area_struct *vma,
> > + u8 *pages)
> > {
> > u64 phys_len, req_len, pgoff, req_start;
> > unsigned long long addr;
> > @@ -333,14 +344,14 @@ static int vfio_pci_dma_fault_mmap(struct
> > vfio_pci_device *vdev,
> > ((1U << (VFIO_PCI_OFFSET_SHIFT - PAGE_SHIFT)) - 1);
> > req_start = pgoff << PAGE_SHIFT;
> >
> > - /* only the second page of the producer fault region is mmappable */
> > + /* only the second page of the fault region is mmappable */
> > if (req_start < PAGE_SIZE)
> > return -EINVAL;
> >
> > if (req_start + req_len > phys_len)
> > return -EINVAL;
> >
> > - addr = virt_to_phys(vdev->fault_pages);
> > + addr = virt_to_phys(pages);
> > vma->vm_private_data = vdev;
> > vma->vm_pgoff = (addr >> PAGE_SHIFT) + pgoff;
> >
> > @@ -349,13 +360,29 @@ static int vfio_pci_dma_fault_mmap(struct
> > vfio_pci_device *vdev,
> > return ret;
> > }
> >
> > -static int vfio_pci_dma_fault_add_capability(struct vfio_pci_device *vdev,
> > - struct vfio_pci_region *region,
> > - struct vfio_info_cap *caps)
> > +static int vfio_pci_dma_fault_mmap(struct vfio_pci_device *vdev,
> > + struct vfio_pci_region *region,
> > + struct vm_area_struct *vma)
> > +{
> > + return __vfio_pci_dma_fault_mmap(vdev, region, vma,
> > vdev->fault_pages);
> > +}
> > +
> > +static int
> > +vfio_pci_dma_fault_response_mmap(struct vfio_pci_device *vdev,
> > + struct vfio_pci_region *region,
> > + struct vm_area_struct *vma)
> > +{
> > + return __vfio_pci_dma_fault_mmap(vdev, region, vma,
> > vdev->fault_response_pages);
> > +}
> > +
> > +static int __vfio_pci_dma_fault_add_capability(struct vfio_pci_device *vdev,
> > + struct vfio_pci_region *region,
> > + struct vfio_info_cap *caps,
> > + u32 cap_id)
> > {
> > struct vfio_region_info_cap_sparse_mmap *sparse = NULL;
> > struct vfio_region_info_cap_fault cap = {
> > - .header.id = VFIO_REGION_INFO_CAP_DMA_FAULT,
> > + .header.id = cap_id,
> > .header.version = 1,
> > .version = 1,
> > };
> > @@ -383,6 +410,14 @@ static int
> > vfio_pci_dma_fault_add_capability(struct
> > vfio_pci_device *vdev,
> > return ret;
> > }
> >
> > +static int vfio_pci_dma_fault_add_capability(struct vfio_pci_device *vdev,
> > + struct vfio_pci_region *region,
> > + struct vfio_info_cap *caps) {
> > + return __vfio_pci_dma_fault_add_capability(vdev, region, caps,
> > + VFIO_REGION_INFO_CAP_DMA_FAULT); }
> > +
> > static const struct vfio_pci_regops vfio_pci_dma_fault_regops = {
> > .rw = vfio_pci_dma_fault_rw,
> > .release = vfio_pci_dma_fault_release,
> > @@ -390,6 +425,13 @@ static const struct vfio_pci_regops
> > vfio_pci_dma_fault_regops = {
> > .add_capability = vfio_pci_dma_fault_add_capability,
> > };
> >
> > +static const struct vfio_pci_regops vfio_pci_dma_fault_response_regops = {
> > + .rw = vfio_pci_dma_fault_response_rw,
> > + .release = vfio_pci_dma_fault_response_release,
> > + .mmap = vfio_pci_dma_fault_response_mmap,
> > + .add_capability = vfio_pci_dma_fault_add_capability,
As I mentioned in the Qemu patch ([RFC v7 26/26] vfio/pci: Implement
return_page_response page response callback), it looks like we are using the
VFIO_REGION_INFO_CAP_DMA_FAULT cap id for the dma_fault_response here
as well. Is that intentional?
(Was wondering how it worked in the first place and noted this).
Please check.
Thanks,
Shameer
Hi Shameer,
On 2/18/21 11:36 AM, Shameerali Kolothum Thodi wrote:
> Hi Eric,
>
>>> -----Original Message-----
>>> From: Eric Auger [mailto:[email protected]]
>>> Sent: 16 November 2020 11:00
>>> To: [email protected]; [email protected];
>>> [email protected]; [email protected];
>>> [email protected]; [email protected]; [email protected];
>>> [email protected]; [email protected]; [email protected];
>>> [email protected]
>>> Cc: [email protected]; [email protected];
>>> [email protected]; [email protected]; Shameerali Kolothum
>>> Thodi <[email protected]>;
>>> [email protected]; [email protected]; [email protected];
>>> [email protected]; yuzenghui <[email protected]>
>>> Subject: [PATCH v11 12/13] vfio/pci: Register a DMA fault response
>>> region
>>>
>>> In preparation for vSVA, let's register a DMA fault response region,
>>> where the userspace will push the page responses and increment the
>>> head of the buffer. The kernel will pop those responses and inject
>>> them on iommu side.
>>>
>>> Signed-off-by: Eric Auger <[email protected]>
>>> ---
>>> drivers/vfio/pci/vfio_pci.c | 114 +++++++++++++++++++++++++---
>>> drivers/vfio/pci/vfio_pci_private.h | 5 ++
>>> drivers/vfio/pci/vfio_pci_rdwr.c | 39 ++++++++++
>>> include/uapi/linux/vfio.h | 32 ++++++++
>>> 4 files changed, 181 insertions(+), 9 deletions(-)
>>>
>>> diff --git a/drivers/vfio/pci/vfio_pci.c b/drivers/vfio/pci/vfio_pci.c
>>> index 65a83fd0e8c0..e9a904ce3f0d 100644
>>> --- a/drivers/vfio/pci/vfio_pci.c
>>> +++ b/drivers/vfio/pci/vfio_pci.c
>>> @@ -318,9 +318,20 @@ static void vfio_pci_dma_fault_release(struct
>>> vfio_pci_device *vdev,
>>> kfree(vdev->fault_pages);
>>> }
>>>
>>> -static int vfio_pci_dma_fault_mmap(struct vfio_pci_device *vdev,
>>> - struct vfio_pci_region *region,
>>> - struct vm_area_struct *vma)
>>> +static void
>>> +vfio_pci_dma_fault_response_release(struct vfio_pci_device *vdev,
>>> + struct vfio_pci_region *region) {
>>> + if (vdev->dma_fault_response_wq)
>>> + destroy_workqueue(vdev->dma_fault_response_wq);
>>> + kfree(vdev->fault_response_pages);
>>> + vdev->fault_response_pages = NULL;
>>> +}
>>> +
>>> +static int __vfio_pci_dma_fault_mmap(struct vfio_pci_device *vdev,
>>> + struct vfio_pci_region *region,
>>> + struct vm_area_struct *vma,
>>> + u8 *pages)
>>> {
>>> u64 phys_len, req_len, pgoff, req_start;
>>> unsigned long long addr;
>>> @@ -333,14 +344,14 @@ static int vfio_pci_dma_fault_mmap(struct
>>> vfio_pci_device *vdev,
>>> ((1U << (VFIO_PCI_OFFSET_SHIFT - PAGE_SHIFT)) - 1);
>>> req_start = pgoff << PAGE_SHIFT;
>>>
>>> - /* only the second page of the producer fault region is mmappable */
>>> + /* only the second page of the fault region is mmappable */
>>> if (req_start < PAGE_SIZE)
>>> return -EINVAL;
>>>
>>> if (req_start + req_len > phys_len)
>>> return -EINVAL;
>>>
>>> - addr = virt_to_phys(vdev->fault_pages);
>>> + addr = virt_to_phys(pages);
>>> vma->vm_private_data = vdev;
>>> vma->vm_pgoff = (addr >> PAGE_SHIFT) + pgoff;
>>>
>>> @@ -349,13 +360,29 @@ static int vfio_pci_dma_fault_mmap(struct
>>> vfio_pci_device *vdev,
>>> return ret;
>>> }
>>>
>>> -static int vfio_pci_dma_fault_add_capability(struct vfio_pci_device *vdev,
>>> - struct vfio_pci_region *region,
>>> - struct vfio_info_cap *caps)
>>> +static int vfio_pci_dma_fault_mmap(struct vfio_pci_device *vdev,
>>> + struct vfio_pci_region *region,
>>> + struct vm_area_struct *vma)
>>> +{
>>> + return __vfio_pci_dma_fault_mmap(vdev, region, vma,
>>> vdev->fault_pages);
>>> +}
>>> +
>>> +static int
>>> +vfio_pci_dma_fault_response_mmap(struct vfio_pci_device *vdev,
>>> + struct vfio_pci_region *region,
>>> + struct vm_area_struct *vma)
>>> +{
>>> + return __vfio_pci_dma_fault_mmap(vdev, region, vma,
>>> vdev->fault_response_pages);
>>> +}
>>> +
>>> +static int __vfio_pci_dma_fault_add_capability(struct vfio_pci_device *vdev,
>>> + struct vfio_pci_region *region,
>>> + struct vfio_info_cap *caps,
>>> + u32 cap_id)
>>> {
>>> struct vfio_region_info_cap_sparse_mmap *sparse = NULL;
>>> struct vfio_region_info_cap_fault cap = {
>>> - .header.id = VFIO_REGION_INFO_CAP_DMA_FAULT,
>>> + .header.id = cap_id,
>>> .header.version = 1,
>>> .version = 1,
>>> };
>>> @@ -383,6 +410,14 @@ static int
>>> vfio_pci_dma_fault_add_capability(struct
>>> vfio_pci_device *vdev,
>>> return ret;
>>> }
>>>
>>> +static int vfio_pci_dma_fault_add_capability(struct vfio_pci_device *vdev,
>>> + struct vfio_pci_region *region,
>>> + struct vfio_info_cap *caps) {
>>> + return __vfio_pci_dma_fault_add_capability(vdev, region, caps,
>>> + VFIO_REGION_INFO_CAP_DMA_FAULT); }
>>> +
>>> static const struct vfio_pci_regops vfio_pci_dma_fault_regops = {
>>> .rw = vfio_pci_dma_fault_rw,
>>> .release = vfio_pci_dma_fault_release,
>>> @@ -390,6 +425,13 @@ static const struct vfio_pci_regops
>>> vfio_pci_dma_fault_regops = {
>>> .add_capability = vfio_pci_dma_fault_add_capability,
>>> };
>>>
>>> +static const struct vfio_pci_regops vfio_pci_dma_fault_response_regops = {
>>> + .rw = vfio_pci_dma_fault_response_rw,
>>> + .release = vfio_pci_dma_fault_response_release,
>>> + .mmap = vfio_pci_dma_fault_response_mmap,
>>> + .add_capability = vfio_pci_dma_fault_add_capability,
>
> As I mentioned in the Qemu patch ([RFC v7 26/26] vfio/pci: Implement
> return_page_response page response callback), it looks like we are using the
> VFIO_REGION_INFO_CAP_DMA_FAULT cap id for the dma_fault_response here
> as well. Is that intentional?
> (Was wondering how it worked in the first place and noted this).
yep, copy paste error :-(
Thanks
Eric
>
> Please check.
>
> Thanks,
> Shameer
>
Hi Shenming,
On 2/23/21 1:45 PM, Shenming Lu wrote:
>> +static int vfio_pci_dma_fault_init(struct vfio_pci_device *vdev)
>> +{
>> + struct vfio_region_dma_fault *header;
>> + struct iommu_domain *domain;
>> + size_t size;
>> + bool nested;
>> + int ret;
>> +
>> + domain = iommu_get_domain_for_dev(&vdev->pdev->dev);
>> + ret = iommu_domain_get_attr(domain, DOMAIN_ATTR_NESTING, &nested);
>> + if (ret || !nested)
>> + return ret;
>
> Hi Eric,
>
> It seems that the type of nested should be int, the use of bool might trigger
> a panic in arm_smmu_domain_get_attr().
Thank you. That's fixed now.
Best Regards
Eric
>
> Thanks,
> Shenming
>
> +static int vfio_pci_dma_fault_init(struct vfio_pci_device *vdev)
> +{
> + struct vfio_region_dma_fault *header;
> + struct iommu_domain *domain;
> + size_t size;
> + bool nested;
> + int ret;
> +
> + domain = iommu_get_domain_for_dev(&vdev->pdev->dev);
> + ret = iommu_domain_get_attr(domain, DOMAIN_ATTR_NESTING, &nested);
> + if (ret || !nested)
> + return ret;
Hi Eric,
It seems that the type of nested should be int, the use of bool might trigger
a panic in arm_smmu_domain_get_attr().
Thanks,
Shenming
Tested-by: Krishna Reddy <[email protected]>
> 1) pass the guest stage 1 configuration
> 3) invalidate stage 1 related caches
Validated Nested SMMUv3 translations for NVMe PCIe device from Guest VM along with patch series "v13 SMMUv3 Nested Stage Setup (IOMMU part)" and QEMU patch series "vSMMUv3/pSMMUv3 2 stage VFIO integration" from v5.2.0-2stage-rfcv8.
NVMe PCIe device is functional with 2-stage translations and no issues observed.
-KR