2 * Copyright (C) 2012 Red Hat, Inc. All rights reserved.
3 * Author: Alex Williamson <alex.williamson@redhat.com>
5 * This program is free software; you can redistribute it and/or modify
6 * it under the terms of the GNU General Public License version 2 as
7 * published by the Free Software Foundation.
9 * Derived from original vfio:
10 * Copyright 2010 Cisco Systems, Inc. All rights reserved.
11 * Author: Tom Lyon, pugs@cisco.com
14 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
16 #include <linux/device.h>
17 #include <linux/eventfd.h>
18 #include <linux/file.h>
19 #include <linux/interrupt.h>
20 #include <linux/iommu.h>
21 #include <linux/module.h>
22 #include <linux/mutex.h>
23 #include <linux/notifier.h>
24 #include <linux/pci.h>
25 #include <linux/pm_runtime.h>
26 #include <linux/slab.h>
27 #include <linux/types.h>
28 #include <linux/uaccess.h>
29 #include <linux/vfio.h>
30 #include <linux/vgaarb.h>
31 #include <linux/nospec.h>
33 #include "vfio_pci_private.h"
35 #define DRIVER_VERSION "0.2"
36 #define DRIVER_AUTHOR "Alex Williamson <alex.williamson@redhat.com>"
37 #define DRIVER_DESC "VFIO PCI - User Level meta-driver"
39 static char ids
[1024] __initdata
;
40 module_param_string(ids
, ids
, sizeof(ids
), 0);
41 MODULE_PARM_DESC(ids
, "Initial PCI IDs to add to the vfio driver, format is \"vendor:device[:subvendor[:subdevice[:class[:class_mask]]]]\" and multiple comma separated entries can be specified");
43 static bool nointxmask
;
44 module_param_named(nointxmask
, nointxmask
, bool, S_IRUGO
| S_IWUSR
);
45 MODULE_PARM_DESC(nointxmask
,
46 "Disable support for PCI 2.3 style INTx masking. If this resolves problems for specific devices, report lspci -vvvxxx to linux-pci@vger.kernel.org so the device can be fixed automatically via the broken_intx_masking flag.");
48 #ifdef CONFIG_VFIO_PCI_VGA
49 static bool disable_vga
;
50 module_param(disable_vga
, bool, S_IRUGO
);
51 MODULE_PARM_DESC(disable_vga
, "Disable VGA resource access through vfio-pci");
54 static bool disable_idle_d3
;
55 module_param(disable_idle_d3
, bool, S_IRUGO
| S_IWUSR
);
56 MODULE_PARM_DESC(disable_idle_d3
,
57 "Disable using the PCI D3 low power state for idle, unused devices");
59 static DEFINE_MUTEX(driver_lock
);
61 static inline bool vfio_vga_disabled(void)
63 #ifdef CONFIG_VFIO_PCI_VGA
71 * Our VGA arbiter participation is limited since we don't know anything
72 * about the device itself. However, if the device is the only VGA device
73 * downstream of a bridge and VFIO VGA support is disabled, then we can
74 * safely return legacy VGA IO and memory as not decoded since the user
75 * has no way to get to it and routing can be disabled externally at the
78 static unsigned int vfio_pci_set_vga_decode(void *opaque
, bool single_vga
)
80 struct vfio_pci_device
*vdev
= opaque
;
81 struct pci_dev
*tmp
= NULL
, *pdev
= vdev
->pdev
;
82 unsigned char max_busnr
;
85 if (single_vga
|| !vfio_vga_disabled() || pci_is_root_bus(pdev
->bus
))
86 return VGA_RSRC_NORMAL_IO
| VGA_RSRC_NORMAL_MEM
|
87 VGA_RSRC_LEGACY_IO
| VGA_RSRC_LEGACY_MEM
;
89 max_busnr
= pci_bus_max_busnr(pdev
->bus
);
90 decodes
= VGA_RSRC_NORMAL_IO
| VGA_RSRC_NORMAL_MEM
;
92 while ((tmp
= pci_get_class(PCI_CLASS_DISPLAY_VGA
<< 8, tmp
)) != NULL
) {
94 pci_domain_nr(tmp
->bus
) != pci_domain_nr(pdev
->bus
) ||
95 pci_is_root_bus(tmp
->bus
))
98 if (tmp
->bus
->number
>= pdev
->bus
->number
&&
99 tmp
->bus
->number
<= max_busnr
) {
101 decodes
|= VGA_RSRC_LEGACY_IO
| VGA_RSRC_LEGACY_MEM
;
109 static inline bool vfio_pci_is_vga(struct pci_dev
*pdev
)
111 return (pdev
->class >> 8) == PCI_CLASS_DISPLAY_VGA
;
114 static void vfio_pci_probe_mmaps(struct vfio_pci_device
*vdev
)
116 struct resource
*res
;
118 struct vfio_pci_dummy_resource
*dummy_res
;
120 INIT_LIST_HEAD(&vdev
->dummy_resources_list
);
122 for (bar
= PCI_STD_RESOURCES
; bar
<= PCI_STD_RESOURCE_END
; bar
++) {
123 res
= vdev
->pdev
->resource
+ bar
;
125 if (!IS_ENABLED(CONFIG_VFIO_PCI_MMAP
))
128 if (!(res
->flags
& IORESOURCE_MEM
))
132 * The PCI core shouldn't set up a resource with a
133 * type but zero size. But there may be bugs that
134 * cause us to do that.
136 if (!resource_size(res
))
139 if (resource_size(res
) >= PAGE_SIZE
) {
140 vdev
->bar_mmap_supported
[bar
] = true;
144 if (!(res
->start
& ~PAGE_MASK
)) {
146 * Add a dummy resource to reserve the remainder
147 * of the exclusive page in case that hot-add
148 * device's bar is assigned into it.
150 dummy_res
= kzalloc(sizeof(*dummy_res
), GFP_KERNEL
);
151 if (dummy_res
== NULL
)
154 dummy_res
->resource
.name
= "vfio sub-page reserved";
155 dummy_res
->resource
.start
= res
->end
+ 1;
156 dummy_res
->resource
.end
= res
->start
+ PAGE_SIZE
- 1;
157 dummy_res
->resource
.flags
= res
->flags
;
158 if (request_resource(res
->parent
,
159 &dummy_res
->resource
)) {
163 dummy_res
->index
= bar
;
164 list_add(&dummy_res
->res_next
,
165 &vdev
->dummy_resources_list
);
166 vdev
->bar_mmap_supported
[bar
] = true;
170 * Here we don't handle the case when the BAR is not page
171 * aligned because we can't expect the BAR will be
172 * assigned into the same location in a page in guest
173 * when we passthrough the BAR. And it's hard to access
174 * this BAR in userspace because we have no way to get
175 * the BAR's location in a page.
178 vdev
->bar_mmap_supported
[bar
] = false;
182 static void vfio_pci_try_bus_reset(struct vfio_pci_device
*vdev
);
183 static void vfio_pci_disable(struct vfio_pci_device
*vdev
);
186 * INTx masking requires the ability to disable INTx signaling via PCI_COMMAND
187 * _and_ the ability detect when the device is asserting INTx via PCI_STATUS.
188 * If a device implements the former but not the latter we would typically
189 * expect broken_intx_masking be set and require an exclusive interrupt.
190 * However since we do have control of the device's ability to assert INTx,
191 * we can instead pretend that the device does not implement INTx, virtualizing
192 * the pin register to report zero and maintaining DisINTx set on the host.
194 static bool vfio_pci_nointx(struct pci_dev
*pdev
)
196 switch (pdev
->vendor
) {
197 case PCI_VENDOR_ID_INTEL
:
198 switch (pdev
->device
) {
199 /* All i40e (XL710/X710/XXV710) 10/20/25/40GbE NICs */
202 case 0x1580 ... 0x1581:
203 case 0x1583 ... 0x158b:
204 case 0x37d0 ... 0x37d2:
214 static int vfio_pci_enable(struct vfio_pci_device
*vdev
)
216 struct pci_dev
*pdev
= vdev
->pdev
;
221 pci_set_power_state(pdev
, PCI_D0
);
223 /* Don't allow our initial saved state to include busmaster */
224 pci_clear_master(pdev
);
226 ret
= pci_enable_device(pdev
);
230 /* If reset fails because of the device lock, fail this path entirely */
231 ret
= pci_try_reset_function(pdev
);
232 if (ret
== -EAGAIN
) {
233 pci_disable_device(pdev
);
237 vdev
->reset_works
= !ret
;
238 pci_save_state(pdev
);
239 vdev
->pci_saved_state
= pci_store_saved_state(pdev
);
240 if (!vdev
->pci_saved_state
)
241 pr_debug("%s: Couldn't store %s saved state\n",
242 __func__
, dev_name(&pdev
->dev
));
244 if (likely(!nointxmask
)) {
245 if (vfio_pci_nointx(pdev
)) {
246 dev_info(&pdev
->dev
, "Masking broken INTx support\n");
250 vdev
->pci_2_3
= pci_intx_mask_supported(pdev
);
253 pci_read_config_word(pdev
, PCI_COMMAND
, &cmd
);
254 if (vdev
->pci_2_3
&& (cmd
& PCI_COMMAND_INTX_DISABLE
)) {
255 cmd
&= ~PCI_COMMAND_INTX_DISABLE
;
256 pci_write_config_word(pdev
, PCI_COMMAND
, cmd
);
259 ret
= vfio_config_init(vdev
);
261 kfree(vdev
->pci_saved_state
);
262 vdev
->pci_saved_state
= NULL
;
263 pci_disable_device(pdev
);
267 msix_pos
= pdev
->msix_cap
;
272 pci_read_config_word(pdev
, msix_pos
+ PCI_MSIX_FLAGS
, &flags
);
273 pci_read_config_dword(pdev
, msix_pos
+ PCI_MSIX_TABLE
, &table
);
275 vdev
->msix_bar
= table
& PCI_MSIX_TABLE_BIR
;
276 vdev
->msix_offset
= table
& PCI_MSIX_TABLE_OFFSET
;
277 vdev
->msix_size
= ((flags
& PCI_MSIX_FLAGS_QSIZE
) + 1) * 16;
279 vdev
->msix_bar
= 0xFF;
281 if (!vfio_vga_disabled() && vfio_pci_is_vga(pdev
))
282 vdev
->has_vga
= true;
285 if (vfio_pci_is_vga(pdev
) &&
286 pdev
->vendor
== PCI_VENDOR_ID_INTEL
&&
287 IS_ENABLED(CONFIG_VFIO_PCI_IGD
)) {
288 ret
= vfio_pci_igd_init(vdev
);
290 dev_warn(&vdev
->pdev
->dev
,
291 "Failed to setup Intel IGD regions\n");
292 vfio_pci_disable(vdev
);
297 vfio_pci_probe_mmaps(vdev
);
302 static void vfio_pci_disable(struct vfio_pci_device
*vdev
)
304 struct pci_dev
*pdev
= vdev
->pdev
;
305 struct vfio_pci_dummy_resource
*dummy_res
, *tmp
;
306 struct vfio_pci_ioeventfd
*ioeventfd
, *ioeventfd_tmp
;
309 /* Stop the device from further DMA */
310 pci_clear_master(pdev
);
312 vfio_pci_set_irqs_ioctl(vdev
, VFIO_IRQ_SET_DATA_NONE
|
313 VFIO_IRQ_SET_ACTION_TRIGGER
,
314 vdev
->irq_type
, 0, 0, NULL
);
316 /* Device closed, don't need mutex here */
317 list_for_each_entry_safe(ioeventfd
, ioeventfd_tmp
,
318 &vdev
->ioeventfds_list
, next
) {
319 vfio_virqfd_disable(&ioeventfd
->virqfd
);
320 list_del(&ioeventfd
->next
);
323 vdev
->ioeventfds_nr
= 0;
325 vdev
->virq_disabled
= false;
327 for (i
= 0; i
< vdev
->num_regions
; i
++)
328 vdev
->region
[i
].ops
->release(vdev
, &vdev
->region
[i
]);
330 vdev
->num_regions
= 0;
332 vdev
->region
= NULL
; /* don't krealloc a freed pointer */
334 vfio_config_free(vdev
);
336 for (bar
= PCI_STD_RESOURCES
; bar
<= PCI_STD_RESOURCE_END
; bar
++) {
337 if (!vdev
->barmap
[bar
])
339 pci_iounmap(pdev
, vdev
->barmap
[bar
]);
340 pci_release_selected_regions(pdev
, 1 << bar
);
341 vdev
->barmap
[bar
] = NULL
;
344 list_for_each_entry_safe(dummy_res
, tmp
,
345 &vdev
->dummy_resources_list
, res_next
) {
346 list_del(&dummy_res
->res_next
);
347 release_resource(&dummy_res
->resource
);
351 vdev
->needs_reset
= true;
354 * If we have saved state, restore it. If we can reset the device,
355 * even better. Resetting with current state seems better than
356 * nothing, but saving and restoring current state without reset
359 if (pci_load_and_free_saved_state(pdev
, &vdev
->pci_saved_state
)) {
360 pr_info("%s: Couldn't reload %s saved state\n",
361 __func__
, dev_name(&pdev
->dev
));
363 if (!vdev
->reset_works
)
366 pci_save_state(pdev
);
370 * Disable INTx and MSI, presumably to avoid spurious interrupts
371 * during reset. Stolen from pci_reset_function()
373 pci_write_config_word(pdev
, PCI_COMMAND
, PCI_COMMAND_INTX_DISABLE
);
376 * Try to get the locks ourselves to prevent a deadlock. The
377 * success of this is dependent on being able to lock the device,
378 * which is not always possible.
379 * We can not use the "try" reset interface here, which will
380 * overwrite the previously restored configuration information.
382 if (vdev
->reset_works
&& pci_cfg_access_trylock(pdev
)) {
383 if (device_trylock(&pdev
->dev
)) {
384 if (!__pci_reset_function_locked(pdev
))
385 vdev
->needs_reset
= false;
386 device_unlock(&pdev
->dev
);
388 pci_cfg_access_unlock(pdev
);
391 pci_restore_state(pdev
);
393 pci_disable_device(pdev
);
395 vfio_pci_try_bus_reset(vdev
);
397 if (!disable_idle_d3
)
398 pci_set_power_state(pdev
, PCI_D3hot
);
401 static void vfio_pci_release(void *device_data
)
403 struct vfio_pci_device
*vdev
= device_data
;
405 mutex_lock(&driver_lock
);
407 if (!(--vdev
->refcnt
)) {
408 vfio_spapr_pci_eeh_release(vdev
->pdev
);
409 vfio_pci_disable(vdev
);
412 mutex_unlock(&driver_lock
);
414 module_put(THIS_MODULE
);
417 static int vfio_pci_open(void *device_data
)
419 struct vfio_pci_device
*vdev
= device_data
;
422 if (!try_module_get(THIS_MODULE
))
425 mutex_lock(&driver_lock
);
428 ret
= vfio_pci_enable(vdev
);
432 vfio_spapr_pci_eeh_open(vdev
->pdev
);
436 mutex_unlock(&driver_lock
);
438 module_put(THIS_MODULE
);
442 static int vfio_pci_get_irq_count(struct vfio_pci_device
*vdev
, int irq_type
)
444 if (irq_type
== VFIO_PCI_INTX_IRQ_INDEX
) {
447 if (!IS_ENABLED(CONFIG_VFIO_PCI_INTX
) ||
448 vdev
->nointx
|| vdev
->pdev
->is_virtfn
)
451 pci_read_config_byte(vdev
->pdev
, PCI_INTERRUPT_PIN
, &pin
);
454 } else if (irq_type
== VFIO_PCI_MSI_IRQ_INDEX
) {
458 pos
= vdev
->pdev
->msi_cap
;
460 pci_read_config_word(vdev
->pdev
,
461 pos
+ PCI_MSI_FLAGS
, &flags
);
462 return 1 << ((flags
& PCI_MSI_FLAGS_QMASK
) >> 1);
464 } else if (irq_type
== VFIO_PCI_MSIX_IRQ_INDEX
) {
468 pos
= vdev
->pdev
->msix_cap
;
470 pci_read_config_word(vdev
->pdev
,
471 pos
+ PCI_MSIX_FLAGS
, &flags
);
473 return (flags
& PCI_MSIX_FLAGS_QSIZE
) + 1;
475 } else if (irq_type
== VFIO_PCI_ERR_IRQ_INDEX
) {
476 if (pci_is_pcie(vdev
->pdev
))
478 } else if (irq_type
== VFIO_PCI_REQ_IRQ_INDEX
) {
485 static int vfio_pci_count_devs(struct pci_dev
*pdev
, void *data
)
491 struct vfio_pci_fill_info
{
494 struct vfio_pci_dependent_device
*devices
;
497 static int vfio_pci_fill_devs(struct pci_dev
*pdev
, void *data
)
499 struct vfio_pci_fill_info
*fill
= data
;
500 struct iommu_group
*iommu_group
;
502 if (fill
->cur
== fill
->max
)
503 return -EAGAIN
; /* Something changed, try again */
505 iommu_group
= iommu_group_get(&pdev
->dev
);
507 return -EPERM
; /* Cannot reset non-isolated devices */
509 fill
->devices
[fill
->cur
].group_id
= iommu_group_id(iommu_group
);
510 fill
->devices
[fill
->cur
].segment
= pci_domain_nr(pdev
->bus
);
511 fill
->devices
[fill
->cur
].bus
= pdev
->bus
->number
;
512 fill
->devices
[fill
->cur
].devfn
= pdev
->devfn
;
514 iommu_group_put(iommu_group
);
518 struct vfio_pci_group_entry
{
519 struct vfio_group
*group
;
523 struct vfio_pci_group_info
{
525 struct vfio_pci_group_entry
*groups
;
528 static int vfio_pci_validate_devs(struct pci_dev
*pdev
, void *data
)
530 struct vfio_pci_group_info
*info
= data
;
531 struct iommu_group
*group
;
534 group
= iommu_group_get(&pdev
->dev
);
538 id
= iommu_group_id(group
);
540 for (i
= 0; i
< info
->count
; i
++)
541 if (info
->groups
[i
].id
== id
)
544 iommu_group_put(group
);
546 return (i
== info
->count
) ? -EINVAL
: 0;
549 static bool vfio_pci_dev_below_slot(struct pci_dev
*pdev
, struct pci_slot
*slot
)
551 for (; pdev
; pdev
= pdev
->bus
->self
)
552 if (pdev
->bus
== slot
->bus
)
553 return (pdev
->slot
== slot
);
557 struct vfio_pci_walk_info
{
558 int (*fn
)(struct pci_dev
*, void *data
);
560 struct pci_dev
*pdev
;
565 static int vfio_pci_walk_wrapper(struct pci_dev
*pdev
, void *data
)
567 struct vfio_pci_walk_info
*walk
= data
;
569 if (!walk
->slot
|| vfio_pci_dev_below_slot(pdev
, walk
->pdev
->slot
))
570 walk
->ret
= walk
->fn(pdev
, walk
->data
);
575 static int vfio_pci_for_each_slot_or_bus(struct pci_dev
*pdev
,
576 int (*fn
)(struct pci_dev
*,
577 void *data
), void *data
,
580 struct vfio_pci_walk_info walk
= {
581 .fn
= fn
, .data
= data
, .pdev
= pdev
, .slot
= slot
, .ret
= 0,
584 pci_walk_bus(pdev
->bus
, vfio_pci_walk_wrapper
, &walk
);
589 static int msix_mmappable_cap(struct vfio_pci_device
*vdev
,
590 struct vfio_info_cap
*caps
)
592 struct vfio_info_cap_header header
= {
593 .id
= VFIO_REGION_INFO_CAP_MSIX_MAPPABLE
,
597 return vfio_info_add_capability(caps
, &header
, sizeof(header
));
600 int vfio_pci_register_dev_region(struct vfio_pci_device
*vdev
,
601 unsigned int type
, unsigned int subtype
,
602 const struct vfio_pci_regops
*ops
,
603 size_t size
, u32 flags
, void *data
)
605 struct vfio_pci_region
*region
;
607 region
= krealloc(vdev
->region
,
608 (vdev
->num_regions
+ 1) * sizeof(*region
),
613 vdev
->region
= region
;
614 vdev
->region
[vdev
->num_regions
].type
= type
;
615 vdev
->region
[vdev
->num_regions
].subtype
= subtype
;
616 vdev
->region
[vdev
->num_regions
].ops
= ops
;
617 vdev
->region
[vdev
->num_regions
].size
= size
;
618 vdev
->region
[vdev
->num_regions
].flags
= flags
;
619 vdev
->region
[vdev
->num_regions
].data
= data
;
626 static long vfio_pci_ioctl(void *device_data
,
627 unsigned int cmd
, unsigned long arg
)
629 struct vfio_pci_device
*vdev
= device_data
;
632 if (cmd
== VFIO_DEVICE_GET_INFO
) {
633 struct vfio_device_info info
;
635 minsz
= offsetofend(struct vfio_device_info
, num_irqs
);
637 if (copy_from_user(&info
, (void __user
*)arg
, minsz
))
640 if (info
.argsz
< minsz
)
643 info
.flags
= VFIO_DEVICE_FLAGS_PCI
;
645 if (vdev
->reset_works
)
646 info
.flags
|= VFIO_DEVICE_FLAGS_RESET
;
648 info
.num_regions
= VFIO_PCI_NUM_REGIONS
+ vdev
->num_regions
;
649 info
.num_irqs
= VFIO_PCI_NUM_IRQS
;
651 return copy_to_user((void __user
*)arg
, &info
, minsz
) ?
654 } else if (cmd
== VFIO_DEVICE_GET_REGION_INFO
) {
655 struct pci_dev
*pdev
= vdev
->pdev
;
656 struct vfio_region_info info
;
657 struct vfio_info_cap caps
= { .buf
= NULL
, .size
= 0 };
660 minsz
= offsetofend(struct vfio_region_info
, offset
);
662 if (copy_from_user(&info
, (void __user
*)arg
, minsz
))
665 if (info
.argsz
< minsz
)
668 switch (info
.index
) {
669 case VFIO_PCI_CONFIG_REGION_INDEX
:
670 info
.offset
= VFIO_PCI_INDEX_TO_OFFSET(info
.index
);
671 info
.size
= pdev
->cfg_size
;
672 info
.flags
= VFIO_REGION_INFO_FLAG_READ
|
673 VFIO_REGION_INFO_FLAG_WRITE
;
675 case VFIO_PCI_BAR0_REGION_INDEX
... VFIO_PCI_BAR5_REGION_INDEX
:
676 info
.offset
= VFIO_PCI_INDEX_TO_OFFSET(info
.index
);
677 info
.size
= pci_resource_len(pdev
, info
.index
);
683 info
.flags
= VFIO_REGION_INFO_FLAG_READ
|
684 VFIO_REGION_INFO_FLAG_WRITE
;
685 if (vdev
->bar_mmap_supported
[info
.index
]) {
686 info
.flags
|= VFIO_REGION_INFO_FLAG_MMAP
;
687 if (info
.index
== vdev
->msix_bar
) {
688 ret
= msix_mmappable_cap(vdev
, &caps
);
695 case VFIO_PCI_ROM_REGION_INDEX
:
701 info
.offset
= VFIO_PCI_INDEX_TO_OFFSET(info
.index
);
704 /* Report the BAR size, not the ROM size */
705 info
.size
= pci_resource_len(pdev
, info
.index
);
707 /* Shadow ROMs appear as PCI option ROMs */
708 if (pdev
->resource
[PCI_ROM_RESOURCE
].flags
&
709 IORESOURCE_ROM_SHADOW
)
716 * Is it really there? Enable memory decode for
717 * implicit access in pci_map_rom().
719 pci_read_config_word(pdev
, PCI_COMMAND
, &orig_cmd
);
720 pci_write_config_word(pdev
, PCI_COMMAND
,
721 orig_cmd
| PCI_COMMAND_MEMORY
);
723 io
= pci_map_rom(pdev
, &size
);
725 info
.flags
= VFIO_REGION_INFO_FLAG_READ
;
726 pci_unmap_rom(pdev
, io
);
731 pci_write_config_word(pdev
, PCI_COMMAND
, orig_cmd
);
734 case VFIO_PCI_VGA_REGION_INDEX
:
738 info
.offset
= VFIO_PCI_INDEX_TO_OFFSET(info
.index
);
740 info
.flags
= VFIO_REGION_INFO_FLAG_READ
|
741 VFIO_REGION_INFO_FLAG_WRITE
;
746 struct vfio_region_info_cap_type cap_type
= {
747 .header
.id
= VFIO_REGION_INFO_CAP_TYPE
,
748 .header
.version
= 1 };
751 VFIO_PCI_NUM_REGIONS
+ vdev
->num_regions
)
753 info
.index
= array_index_nospec(info
.index
,
754 VFIO_PCI_NUM_REGIONS
+
757 i
= info
.index
- VFIO_PCI_NUM_REGIONS
;
759 info
.offset
= VFIO_PCI_INDEX_TO_OFFSET(info
.index
);
760 info
.size
= vdev
->region
[i
].size
;
761 info
.flags
= vdev
->region
[i
].flags
;
763 cap_type
.type
= vdev
->region
[i
].type
;
764 cap_type
.subtype
= vdev
->region
[i
].subtype
;
766 ret
= vfio_info_add_capability(&caps
, &cap_type
.header
,
775 info
.flags
|= VFIO_REGION_INFO_FLAG_CAPS
;
776 if (info
.argsz
< sizeof(info
) + caps
.size
) {
777 info
.argsz
= sizeof(info
) + caps
.size
;
780 vfio_info_cap_shift(&caps
, sizeof(info
));
781 if (copy_to_user((void __user
*)arg
+
782 sizeof(info
), caps
.buf
,
787 info
.cap_offset
= sizeof(info
);
793 return copy_to_user((void __user
*)arg
, &info
, minsz
) ?
796 } else if (cmd
== VFIO_DEVICE_GET_IRQ_INFO
) {
797 struct vfio_irq_info info
;
799 minsz
= offsetofend(struct vfio_irq_info
, count
);
801 if (copy_from_user(&info
, (void __user
*)arg
, minsz
))
804 if (info
.argsz
< minsz
|| info
.index
>= VFIO_PCI_NUM_IRQS
)
807 switch (info
.index
) {
808 case VFIO_PCI_INTX_IRQ_INDEX
... VFIO_PCI_MSIX_IRQ_INDEX
:
809 case VFIO_PCI_REQ_IRQ_INDEX
:
811 case VFIO_PCI_ERR_IRQ_INDEX
:
812 if (pci_is_pcie(vdev
->pdev
))
819 info
.flags
= VFIO_IRQ_INFO_EVENTFD
;
821 info
.count
= vfio_pci_get_irq_count(vdev
, info
.index
);
823 if (info
.index
== VFIO_PCI_INTX_IRQ_INDEX
)
824 info
.flags
|= (VFIO_IRQ_INFO_MASKABLE
|
825 VFIO_IRQ_INFO_AUTOMASKED
);
827 info
.flags
|= VFIO_IRQ_INFO_NORESIZE
;
829 return copy_to_user((void __user
*)arg
, &info
, minsz
) ?
832 } else if (cmd
== VFIO_DEVICE_SET_IRQS
) {
833 struct vfio_irq_set hdr
;
836 size_t data_size
= 0;
838 minsz
= offsetofend(struct vfio_irq_set
, count
);
840 if (copy_from_user(&hdr
, (void __user
*)arg
, minsz
))
843 max
= vfio_pci_get_irq_count(vdev
, hdr
.index
);
845 ret
= vfio_set_irqs_validate_and_prepare(&hdr
, max
,
846 VFIO_PCI_NUM_IRQS
, &data_size
);
851 data
= memdup_user((void __user
*)(arg
+ minsz
),
854 return PTR_ERR(data
);
857 mutex_lock(&vdev
->igate
);
859 ret
= vfio_pci_set_irqs_ioctl(vdev
, hdr
.flags
, hdr
.index
,
860 hdr
.start
, hdr
.count
, data
);
862 mutex_unlock(&vdev
->igate
);
867 } else if (cmd
== VFIO_DEVICE_RESET
) {
868 return vdev
->reset_works
?
869 pci_try_reset_function(vdev
->pdev
) : -EINVAL
;
871 } else if (cmd
== VFIO_DEVICE_GET_PCI_HOT_RESET_INFO
) {
872 struct vfio_pci_hot_reset_info hdr
;
873 struct vfio_pci_fill_info fill
= { 0 };
874 struct vfio_pci_dependent_device
*devices
= NULL
;
878 minsz
= offsetofend(struct vfio_pci_hot_reset_info
, count
);
880 if (copy_from_user(&hdr
, (void __user
*)arg
, minsz
))
883 if (hdr
.argsz
< minsz
)
888 /* Can we do a slot or bus reset or neither? */
889 if (!pci_probe_reset_slot(vdev
->pdev
->slot
))
891 else if (pci_probe_reset_bus(vdev
->pdev
->bus
))
894 /* How many devices are affected? */
895 ret
= vfio_pci_for_each_slot_or_bus(vdev
->pdev
,
901 WARN_ON(!fill
.max
); /* Should always be at least one */
904 * If there's enough space, fill it now, otherwise return
905 * -ENOSPC and the number of devices affected.
907 if (hdr
.argsz
< sizeof(hdr
) + (fill
.max
* sizeof(*devices
))) {
909 hdr
.count
= fill
.max
;
910 goto reset_info_exit
;
913 devices
= kcalloc(fill
.max
, sizeof(*devices
), GFP_KERNEL
);
917 fill
.devices
= devices
;
919 ret
= vfio_pci_for_each_slot_or_bus(vdev
->pdev
,
924 * If a device was removed between counting and filling,
925 * we may come up short of fill.max. If a device was
926 * added, we'll have a return of -EAGAIN above.
929 hdr
.count
= fill
.cur
;
932 if (copy_to_user((void __user
*)arg
, &hdr
, minsz
))
936 if (copy_to_user((void __user
*)(arg
+ minsz
), devices
,
937 hdr
.count
* sizeof(*devices
)))
944 } else if (cmd
== VFIO_DEVICE_PCI_HOT_RESET
) {
945 struct vfio_pci_hot_reset hdr
;
947 struct vfio_pci_group_entry
*groups
;
948 struct vfio_pci_group_info info
;
950 int i
, count
= 0, ret
= 0;
952 minsz
= offsetofend(struct vfio_pci_hot_reset
, count
);
954 if (copy_from_user(&hdr
, (void __user
*)arg
, minsz
))
957 if (hdr
.argsz
< minsz
|| hdr
.flags
)
960 /* Can we do a slot or bus reset or neither? */
961 if (!pci_probe_reset_slot(vdev
->pdev
->slot
))
963 else if (pci_probe_reset_bus(vdev
->pdev
->bus
))
967 * We can't let userspace give us an arbitrarily large
968 * buffer to copy, so verify how many we think there
969 * could be. Note groups can have multiple devices so
970 * one group per device is the max.
972 ret
= vfio_pci_for_each_slot_or_bus(vdev
->pdev
,
978 /* Somewhere between 1 and count is OK */
979 if (!hdr
.count
|| hdr
.count
> count
)
982 group_fds
= kcalloc(hdr
.count
, sizeof(*group_fds
), GFP_KERNEL
);
983 groups
= kcalloc(hdr
.count
, sizeof(*groups
), GFP_KERNEL
);
984 if (!group_fds
|| !groups
) {
990 if (copy_from_user(group_fds
, (void __user
*)(arg
+ minsz
),
991 hdr
.count
* sizeof(*group_fds
))) {
998 * For each group_fd, get the group through the vfio external
999 * user interface and store the group and iommu ID. This
1000 * ensures the group is held across the reset.
1002 for (i
= 0; i
< hdr
.count
; i
++) {
1003 struct vfio_group
*group
;
1004 struct fd f
= fdget(group_fds
[i
]);
1010 group
= vfio_group_get_external_user(f
.file
);
1012 if (IS_ERR(group
)) {
1013 ret
= PTR_ERR(group
);
1017 groups
[i
].group
= group
;
1018 groups
[i
].id
= vfio_external_user_iommu_id(group
);
1023 /* release reference to groups on error */
1025 goto hot_reset_release
;
1027 info
.count
= hdr
.count
;
1028 info
.groups
= groups
;
1031 * Test whether all the affected devices are contained
1032 * by the set of groups provided by the user.
1034 ret
= vfio_pci_for_each_slot_or_bus(vdev
->pdev
,
1035 vfio_pci_validate_devs
,
1038 /* User has access, do the reset */
1039 ret
= pci_reset_bus(vdev
->pdev
);
1042 for (i
--; i
>= 0; i
--)
1043 vfio_group_put_external_user(groups
[i
].group
);
1047 } else if (cmd
== VFIO_DEVICE_IOEVENTFD
) {
1048 struct vfio_device_ioeventfd ioeventfd
;
1051 minsz
= offsetofend(struct vfio_device_ioeventfd
, fd
);
1053 if (copy_from_user(&ioeventfd
, (void __user
*)arg
, minsz
))
1056 if (ioeventfd
.argsz
< minsz
)
1059 if (ioeventfd
.flags
& ~VFIO_DEVICE_IOEVENTFD_SIZE_MASK
)
1062 count
= ioeventfd
.flags
& VFIO_DEVICE_IOEVENTFD_SIZE_MASK
;
1064 if (hweight8(count
) != 1 || ioeventfd
.fd
< -1)
1067 return vfio_pci_ioeventfd(vdev
, ioeventfd
.offset
,
1068 ioeventfd
.data
, count
, ioeventfd
.fd
);
1074 static ssize_t
vfio_pci_rw(void *device_data
, char __user
*buf
,
1075 size_t count
, loff_t
*ppos
, bool iswrite
)
1077 unsigned int index
= VFIO_PCI_OFFSET_TO_INDEX(*ppos
);
1078 struct vfio_pci_device
*vdev
= device_data
;
1080 if (index
>= VFIO_PCI_NUM_REGIONS
+ vdev
->num_regions
)
1084 case VFIO_PCI_CONFIG_REGION_INDEX
:
1085 return vfio_pci_config_rw(vdev
, buf
, count
, ppos
, iswrite
);
1087 case VFIO_PCI_ROM_REGION_INDEX
:
1090 return vfio_pci_bar_rw(vdev
, buf
, count
, ppos
, false);
1092 case VFIO_PCI_BAR0_REGION_INDEX
... VFIO_PCI_BAR5_REGION_INDEX
:
1093 return vfio_pci_bar_rw(vdev
, buf
, count
, ppos
, iswrite
);
1095 case VFIO_PCI_VGA_REGION_INDEX
:
1096 return vfio_pci_vga_rw(vdev
, buf
, count
, ppos
, iswrite
);
1098 index
-= VFIO_PCI_NUM_REGIONS
;
1099 return vdev
->region
[index
].ops
->rw(vdev
, buf
,
1100 count
, ppos
, iswrite
);
1106 static ssize_t
vfio_pci_read(void *device_data
, char __user
*buf
,
1107 size_t count
, loff_t
*ppos
)
1112 return vfio_pci_rw(device_data
, buf
, count
, ppos
, false);
1115 static ssize_t
vfio_pci_write(void *device_data
, const char __user
*buf
,
1116 size_t count
, loff_t
*ppos
)
1121 return vfio_pci_rw(device_data
, (char __user
*)buf
, count
, ppos
, true);
1124 static int vfio_pci_mmap(void *device_data
, struct vm_area_struct
*vma
)
1126 struct vfio_pci_device
*vdev
= device_data
;
1127 struct pci_dev
*pdev
= vdev
->pdev
;
1129 u64 phys_len
, req_len
, pgoff
, req_start
;
1132 index
= vma
->vm_pgoff
>> (VFIO_PCI_OFFSET_SHIFT
- PAGE_SHIFT
);
1134 if (vma
->vm_end
< vma
->vm_start
)
1136 if ((vma
->vm_flags
& VM_SHARED
) == 0)
1138 if (index
>= VFIO_PCI_ROM_REGION_INDEX
)
1140 if (!vdev
->bar_mmap_supported
[index
])
1143 phys_len
= PAGE_ALIGN(pci_resource_len(pdev
, index
));
1144 req_len
= vma
->vm_end
- vma
->vm_start
;
1145 pgoff
= vma
->vm_pgoff
&
1146 ((1U << (VFIO_PCI_OFFSET_SHIFT
- PAGE_SHIFT
)) - 1);
1147 req_start
= pgoff
<< PAGE_SHIFT
;
1149 if (req_start
+ req_len
> phys_len
)
1153 * Even though we don't make use of the barmap for the mmap,
1154 * we need to request the region and the barmap tracks that.
1156 if (!vdev
->barmap
[index
]) {
1157 ret
= pci_request_selected_regions(pdev
,
1158 1 << index
, "vfio-pci");
1162 vdev
->barmap
[index
] = pci_iomap(pdev
, index
, 0);
1163 if (!vdev
->barmap
[index
]) {
1164 pci_release_selected_regions(pdev
, 1 << index
);
1169 vma
->vm_private_data
= vdev
;
1170 vma
->vm_page_prot
= pgprot_noncached(vma
->vm_page_prot
);
1171 vma
->vm_pgoff
= (pci_resource_start(pdev
, index
) >> PAGE_SHIFT
) + pgoff
;
1173 return remap_pfn_range(vma
, vma
->vm_start
, vma
->vm_pgoff
,
1174 req_len
, vma
->vm_page_prot
);
1177 static void vfio_pci_request(void *device_data
, unsigned int count
)
1179 struct vfio_pci_device
*vdev
= device_data
;
1181 mutex_lock(&vdev
->igate
);
1183 if (vdev
->req_trigger
) {
1185 dev_notice_ratelimited(&vdev
->pdev
->dev
,
1186 "Relaying device request to user (#%u)\n",
1188 eventfd_signal(vdev
->req_trigger
, 1);
1189 } else if (count
== 0) {
1190 dev_warn(&vdev
->pdev
->dev
,
1191 "No device request channel registered, blocked until released by user\n");
1194 mutex_unlock(&vdev
->igate
);
1197 static const struct vfio_device_ops vfio_pci_ops
= {
1199 .open
= vfio_pci_open
,
1200 .release
= vfio_pci_release
,
1201 .ioctl
= vfio_pci_ioctl
,
1202 .read
= vfio_pci_read
,
1203 .write
= vfio_pci_write
,
1204 .mmap
= vfio_pci_mmap
,
1205 .request
= vfio_pci_request
,
1208 static int vfio_pci_probe(struct pci_dev
*pdev
, const struct pci_device_id
*id
)
1210 struct vfio_pci_device
*vdev
;
1211 struct iommu_group
*group
;
1214 if (pdev
->hdr_type
!= PCI_HEADER_TYPE_NORMAL
)
1218 * Prevent binding to PFs with VFs enabled, this too easily allows
1219 * userspace instance with VFs and PFs from the same device, which
1220 * cannot work. Disabling SR-IOV here would initiate removing the
1221 * VFs, which would unbind the driver, which is prone to blocking
1222 * if that VF is also in use by vfio-pci. Just reject these PFs
1223 * and let the user sort it out.
1225 if (pci_num_vf(pdev
)) {
1226 pci_warn(pdev
, "Cannot bind to PF with SR-IOV enabled\n");
1230 group
= vfio_iommu_group_get(&pdev
->dev
);
1234 vdev
= kzalloc(sizeof(*vdev
), GFP_KERNEL
);
1236 vfio_iommu_group_put(group
, &pdev
->dev
);
1241 vdev
->irq_type
= VFIO_PCI_NUM_IRQS
;
1242 mutex_init(&vdev
->igate
);
1243 spin_lock_init(&vdev
->irqlock
);
1244 mutex_init(&vdev
->ioeventfds_lock
);
1245 INIT_LIST_HEAD(&vdev
->ioeventfds_list
);
1247 ret
= vfio_add_group_dev(&pdev
->dev
, &vfio_pci_ops
, vdev
);
1249 vfio_iommu_group_put(group
, &pdev
->dev
);
1254 if (vfio_pci_is_vga(pdev
)) {
1255 vga_client_register(pdev
, vdev
, NULL
, vfio_pci_set_vga_decode
);
1256 vga_set_legacy_decoding(pdev
,
1257 vfio_pci_set_vga_decode(vdev
, false));
1260 if (!disable_idle_d3
) {
1262 * pci-core sets the device power state to an unknown value at
1263 * bootup and after being removed from a driver. The only
1264 * transition it allows from this unknown state is to D0, which
1265 * typically happens when a driver calls pci_enable_device().
1266 * We're not ready to enable the device yet, but we do want to
1267 * be able to get to D3. Therefore first do a D0 transition
1268 * before going to D3.
1270 pci_set_power_state(pdev
, PCI_D0
);
1271 pci_set_power_state(pdev
, PCI_D3hot
);
1277 static void vfio_pci_remove(struct pci_dev
*pdev
)
1279 struct vfio_pci_device
*vdev
;
1281 vdev
= vfio_del_group_dev(&pdev
->dev
);
1285 vfio_iommu_group_put(pdev
->dev
.iommu_group
, &pdev
->dev
);
1286 kfree(vdev
->region
);
1287 mutex_destroy(&vdev
->ioeventfds_lock
);
1290 if (vfio_pci_is_vga(pdev
)) {
1291 vga_client_register(pdev
, NULL
, NULL
, NULL
);
1292 vga_set_legacy_decoding(pdev
,
1293 VGA_RSRC_NORMAL_IO
| VGA_RSRC_NORMAL_MEM
|
1294 VGA_RSRC_LEGACY_IO
| VGA_RSRC_LEGACY_MEM
);
1297 if (!disable_idle_d3
)
1298 pci_set_power_state(pdev
, PCI_D0
);
1301 static pci_ers_result_t
vfio_pci_aer_err_detected(struct pci_dev
*pdev
,
1302 pci_channel_state_t state
)
1304 struct vfio_pci_device
*vdev
;
1305 struct vfio_device
*device
;
1307 device
= vfio_device_get_from_dev(&pdev
->dev
);
1309 return PCI_ERS_RESULT_DISCONNECT
;
1311 vdev
= vfio_device_data(device
);
1313 vfio_device_put(device
);
1314 return PCI_ERS_RESULT_DISCONNECT
;
1317 mutex_lock(&vdev
->igate
);
1319 if (vdev
->err_trigger
)
1320 eventfd_signal(vdev
->err_trigger
, 1);
1322 mutex_unlock(&vdev
->igate
);
1324 vfio_device_put(device
);
1326 return PCI_ERS_RESULT_CAN_RECOVER
;
1329 static const struct pci_error_handlers vfio_err_handlers
= {
1330 .error_detected
= vfio_pci_aer_err_detected
,
1333 static struct pci_driver vfio_pci_driver
= {
1335 .id_table
= NULL
, /* only dynamic ids */
1336 .probe
= vfio_pci_probe
,
1337 .remove
= vfio_pci_remove
,
1338 .err_handler
= &vfio_err_handlers
,
1341 struct vfio_devices
{
1342 struct vfio_device
**devices
;
1347 static int vfio_pci_get_devs(struct pci_dev
*pdev
, void *data
)
1349 struct vfio_devices
*devs
= data
;
1350 struct vfio_device
*device
;
1352 if (devs
->cur_index
== devs
->max_index
)
1355 device
= vfio_device_get_from_dev(&pdev
->dev
);
1359 if (pci_dev_driver(pdev
) != &vfio_pci_driver
) {
1360 vfio_device_put(device
);
1364 devs
->devices
[devs
->cur_index
++] = device
;
1369 * Attempt to do a bus/slot reset if there are devices affected by a reset for
1370 * this device that are needs_reset and all of the affected devices are unused
1371 * (!refcnt). Callers are required to hold driver_lock when calling this to
1372 * prevent device opens and concurrent bus reset attempts. We prevent device
1373 * unbinds by acquiring and holding a reference to the vfio_device.
1375 * NB: vfio-core considers a group to be viable even if some devices are
1376 * bound to drivers like pci-stub or pcieport. Here we require all devices
1377 * to be bound to vfio_pci since that's the only way we can be sure they
1380 static void vfio_pci_try_bus_reset(struct vfio_pci_device
*vdev
)
1382 struct vfio_devices devs
= { .cur_index
= 0 };
1383 int i
= 0, ret
= -EINVAL
;
1384 bool needs_reset
= false, slot
= false;
1385 struct vfio_pci_device
*tmp
;
1387 if (!pci_probe_reset_slot(vdev
->pdev
->slot
))
1389 else if (pci_probe_reset_bus(vdev
->pdev
->bus
))
1392 if (vfio_pci_for_each_slot_or_bus(vdev
->pdev
, vfio_pci_count_devs
,
1397 devs
.devices
= kcalloc(i
, sizeof(struct vfio_device
*), GFP_KERNEL
);
1401 if (vfio_pci_for_each_slot_or_bus(vdev
->pdev
,
1402 vfio_pci_get_devs
, &devs
, slot
))
1405 for (i
= 0; i
< devs
.cur_index
; i
++) {
1406 tmp
= vfio_device_data(devs
.devices
[i
]);
1407 if (tmp
->needs_reset
)
1414 ret
= pci_reset_bus(vdev
->pdev
);
1417 for (i
= 0; i
< devs
.cur_index
; i
++) {
1418 tmp
= vfio_device_data(devs
.devices
[i
]);
1420 tmp
->needs_reset
= false;
1422 if (!tmp
->refcnt
&& !disable_idle_d3
)
1423 pci_set_power_state(tmp
->pdev
, PCI_D3hot
);
1425 vfio_device_put(devs
.devices
[i
]);
1428 kfree(devs
.devices
);
1431 static void __exit
vfio_pci_cleanup(void)
1433 pci_unregister_driver(&vfio_pci_driver
);
1434 vfio_pci_uninit_perm_bits();
1437 static void __init
vfio_pci_fill_ids(void)
1442 /* no ids passed actually */
1446 /* add ids specified in the module parameter */
1448 while ((id
= strsep(&p
, ","))) {
1449 unsigned int vendor
, device
, subvendor
= PCI_ANY_ID
,
1450 subdevice
= PCI_ANY_ID
, class = 0, class_mask
= 0;
1456 fields
= sscanf(id
, "%x:%x:%x:%x:%x:%x",
1457 &vendor
, &device
, &subvendor
, &subdevice
,
1458 &class, &class_mask
);
1461 pr_warn("invalid id string \"%s\"\n", id
);
1465 rc
= pci_add_dynid(&vfio_pci_driver
, vendor
, device
,
1466 subvendor
, subdevice
, class, class_mask
, 0);
1468 pr_warn("failed to add dynamic id [%04x:%04x[%04x:%04x]] class %#08x/%08x (%d)\n",
1469 vendor
, device
, subvendor
, subdevice
,
1470 class, class_mask
, rc
);
1472 pr_info("add [%04x:%04x[%04x:%04x]] class %#08x/%08x\n",
1473 vendor
, device
, subvendor
, subdevice
,
1478 static int __init
vfio_pci_init(void)
1482 /* Allocate shared config space permision data used by all devices */
1483 ret
= vfio_pci_init_perm_bits();
1487 /* Register and scan for devices */
1488 ret
= pci_register_driver(&vfio_pci_driver
);
1492 vfio_pci_fill_ids();
1497 vfio_pci_uninit_perm_bits();
1501 module_init(vfio_pci_init
);
1502 module_exit(vfio_pci_cleanup
);
1504 MODULE_VERSION(DRIVER_VERSION
);
1505 MODULE_LICENSE("GPL v2");
1506 MODULE_AUTHOR(DRIVER_AUTHOR
);
1507 MODULE_DESCRIPTION(DRIVER_DESC
);