Commit 2a3dab19 authored by Jason Gunthorpe's avatar Jason Gunthorpe
Browse files

vfio-iommufd: Allow iommufd to be used in place of a container fd 

This makes VFIO_GROUP_SET_CONTAINER accept both a vfio container FD and an
iommufd.

In iommufd mode an IOAS will exist after the SET_CONTAINER, but it will
not be attached to any groups.

For VFIO this means that the VFIO_GROUP_GET_STATUS and
VFIO_GROUP_FLAGS_VIABLE works subtly differently. With the container FD
the iommu_group_claim_dma_owner() is done during SET_CONTAINER but for
IOMMUFD this is done during VFIO_GROUP_GET_DEVICE_FD. Meaning that
VFIO_GROUP_FLAGS_VIABLE could be set but GET_DEVICE_FD will fail due to
viability.

As GET_DEVICE_FD can fail for many reasons already this is not expected to
be a meaningful difference.

Reorganize the tests for if the group has an assigned container or iommu
into a vfio_group_has_iommu() function and consolidate all the duplicated
WARN_ON's etc related to this.

Call container functions only if a container is actually present on the
group.

Link: https://lore.kernel.org/r/5-v4-42cd2eb0e3eb+335a-vfio_iommufd_jgg@nvidia.com


Reviewed-by: default avatarKevin Tian <kevin.tian@intel.com>
Reviewed-by: default avatarAlex Williamson <alex.williamson@redhat.com>
Tested-by: default avatarAlex Williamson <alex.williamson@redhat.com>
Tested-by: default avatarNicolin Chen <nicolinc@nvidia.com>
Tested-by: default avatarYi Liu <yi.l.liu@intel.com>
Tested-by: default avatarLixiao Yang <lixiao.yang@intel.com>
Tested-by: default avatarMatthew Rosato <mjrosato@linux.ibm.com>
Tested-by: default avatarYu He <yu.he@intel.com>
Signed-off-by: default avatarJason Gunthorpe <jgg@nvidia.com>
parent 0d8227b6

drivers/vfio/Kconfig

+1 −0
Original line number Diff line number Diff line
@@ -2,6 +2,7 @@ 
menuconfig VFIO

	tristate "VFIO Non-Privileged userspace driver framework"

	select IOMMU_API

	depends on IOMMUFD || !IOMMUFD

	select VFIO_IOMMU_TYPE1 if MMU && (X86 || S390 || ARM || ARM64)

	select INTERVAL_TREE

	help

drivers/vfio/container.c

+5 −2
Original line number Diff line number Diff line
@@ -516,8 +516,11 @@ int vfio_group_use_container(struct vfio_group *group) 
{

	lockdep_assert_held(&group->group_lock);



	if (!group->container || !group->container->iommu_driver ||

	    WARN_ON(!group->container_users))

	/*

	 * The container fd has been assigned with VFIO_GROUP_SET_CONTAINER but

	 * VFIO_SET_IOMMU hasn't been done yet.

	 */

	if (!group->container->iommu_driver)

		return -EINVAL;



	if (group->type == VFIO_NO_IOMMU && !capable(CAP_SYS_RAWIO))

drivers/vfio/vfio.h

+2 −0
Original line number Diff line number Diff line
@@ -10,6 +10,7 @@ 
#include <linux/cdev.h>

#include <linux/module.h>



struct iommufd_ctx;

struct iommu_group;

struct vfio_device;

struct vfio_container;
@@ -60,6 +61,7 @@ struct vfio_group { 
	struct kvm			*kvm;

	struct file			*opened_file;

	struct blocking_notifier_head	notifier;

	struct iommufd_ctx		*iommufd;

};



/* events for the backend driver notify callback */

drivers/vfio/vfio_main.c

+74 −14
Original line number Diff line number Diff line
@@ -35,6 +35,7 @@ 
#include <linux/pm_runtime.h>

#include <linux/interval_tree.h>

#include <linux/iova_bitmap.h>

#include <linux/iommufd.h>

#include "vfio.h"



#define DRIVER_VERSION	"0.3"
@@ -662,6 +663,18 @@ EXPORT_SYMBOL_GPL(vfio_unregister_group_dev); 
/*

 * VFIO Group fd, /dev/vfio/$GROUP

 */

static bool vfio_group_has_iommu(struct vfio_group *group)

{

	lockdep_assert_held(&group->group_lock);

	/*

	 * There can only be users if there is a container, and if there is a

	 * container there must be users.

	 */

	WARN_ON(!group->container != !group->container_users);



	return group->container || group->iommufd;

}



/*

 * VFIO_GROUP_UNSET_CONTAINER should fail if there are other users or

 * if there was no container to unset.  Since the ioctl is called on
@@ -673,15 +686,21 @@ static int vfio_group_ioctl_unset_container(struct vfio_group *group) 
	int ret = 0;



	mutex_lock(&group->group_lock);

	if (!group->container) {

	if (!vfio_group_has_iommu(group)) {

		ret = -EINVAL;

		goto out_unlock;

	}

	if (group->container) {

		if (group->container_users != 1) {

			ret = -EBUSY;

			goto out_unlock;

		}

		vfio_group_detach_container(group);

	}

	if (group->iommufd) {

		iommufd_ctx_put(group->iommufd);

		group->iommufd = NULL;

	}



out_unlock:

	mutex_unlock(&group->group_lock);
@@ -692,6 +711,7 @@ static int vfio_group_ioctl_set_container(struct vfio_group *group, 
					  int __user *arg)

{

	struct vfio_container *container;

	struct iommufd_ctx *iommufd;

	struct fd f;

	int ret;

	int fd;
@@ -704,7 +724,7 @@ static int vfio_group_ioctl_set_container(struct vfio_group *group, 
		return -EBADF;



	mutex_lock(&group->group_lock);

	if (group->container || WARN_ON(group->container_users)) {

	if (vfio_group_has_iommu(group)) {

		ret = -EINVAL;

		goto out_unlock;

	}
@@ -714,12 +734,28 @@ static int vfio_group_ioctl_set_container(struct vfio_group *group, 
	}



	container = vfio_container_from_file(f.file);

	ret = -EINVAL;

	if (container) {

		ret = vfio_container_attach_group(container, group);

		goto out_unlock;

	}



	iommufd = iommufd_ctx_from_file(f.file);

	if (!IS_ERR(iommufd)) {

		u32 ioas_id;



		ret = iommufd_vfio_compat_ioas_id(iommufd, &ioas_id);

		if (ret) {

			iommufd_ctx_put(group->iommufd);

			goto out_unlock;

		}



		group->iommufd = iommufd;

		goto out_unlock;

	}



	/* The FD passed is not recognized. */

	ret = -EBADFD;



out_unlock:

	mutex_unlock(&group->group_lock);

	fdput(f);
@@ -749,9 +785,16 @@ static int vfio_device_first_open(struct vfio_device *device) 
	 * during close_device.

	 */

	mutex_lock(&device->group->group_lock);

	if (!vfio_group_has_iommu(device->group)) {

		ret = -EINVAL;

		goto err_module_put;

	}



	if (device->group->container) {

		ret = vfio_group_use_container(device->group);

		if (ret)

			goto err_module_put;

	}



	device->kvm = device->group->kvm;

	if (device->ops->open_device) {
@@ -759,12 +802,14 @@ static int vfio_device_first_open(struct vfio_device *device) 
		if (ret)

			goto err_container;

	}

	if (device->group->container)

		vfio_device_container_register(device);

	mutex_unlock(&device->group->group_lock);

	return 0;



err_container:

	device->kvm = NULL;

	if (device->group->container)

		vfio_group_unuse_container(device->group);

err_module_put:

	mutex_unlock(&device->group->group_lock);
@@ -777,10 +822,12 @@ static void vfio_device_last_close(struct vfio_device *device) 
	lockdep_assert_held(&device->dev_set->lock);



	mutex_lock(&device->group->group_lock);

	if (device->group->container)

		vfio_device_container_unregister(device);

	if (device->ops->close_device)

		device->ops->close_device(device);

	device->kvm = NULL;

	if (device->group->container)

		vfio_group_unuse_container(device->group);

	mutex_unlock(&device->group->group_lock);

	module_put(device->dev->driver->owner);
@@ -897,7 +944,14 @@ static int vfio_group_ioctl_get_status(struct vfio_group *group, 
		return -ENODEV;

	}



	if (group->container)

	/*

	 * With the container FD the iommu_group_claim_dma_owner() is done

	 * during SET_CONTAINER but for IOMMFD this is done during

	 * VFIO_GROUP_GET_DEVICE_FD. Meaning that with iommufd

	 * VFIO_GROUP_FLAGS_VIABLE could be set but GET_DEVICE_FD will fail due

	 * to viability.

	 */

	if (vfio_group_has_iommu(group))

		status.flags |= VFIO_GROUP_FLAGS_CONTAINER_SET |

				VFIO_GROUP_FLAGS_VIABLE;

	else if (!iommu_group_dma_owner_claimed(group->iommu_group))
@@ -980,6 +1034,10 @@ static int vfio_group_fops_release(struct inode *inode, struct file *filep) 
	WARN_ON(group->notifier.head);

	if (group->container)

		vfio_group_detach_container(group);

	if (group->iommufd) {

		iommufd_ctx_put(group->iommufd);

		group->iommufd = NULL;

	}

	group->opened_file = NULL;

	mutex_unlock(&group->group_lock);

	return 0;
@@ -1878,6 +1936,8 @@ static void __exit vfio_cleanup(void) 
module_init(vfio_init);

module_exit(vfio_cleanup);



MODULE_IMPORT_NS(IOMMUFD);

MODULE_IMPORT_NS(IOMMUFD_VFIO);

MODULE_VERSION(DRIVER_VERSION);

MODULE_LICENSE("GPL v2");

MODULE_AUTHOR(DRIVER_AUTHOR);