| 1 | /* |
| 2 | * VFIO regions |
| 3 | * |
| 4 | * Copyright Red Hat, Inc. 2012 |
| 5 | * |
| 6 | * Authors: |
| 7 | * Alex Williamson <alex.williamson@redhat.com> |
| 8 | * |
| 9 | * This work is licensed under the terms of the GNU GPL, version 2. See |
| 10 | * the COPYING file in the top-level directory. |
| 11 | * |
| 12 | * Based on qemu-kvm device-assignment: |
| 13 | * Adapted for KVM by Qumranet. |
| 14 | * Copyright (c) 2007, Neocleus, Alex Novik (alex@neocleus.com) |
| 15 | * Copyright (c) 2007, Neocleus, Guy Zana (guy@neocleus.com) |
| 16 | * Copyright (C) 2008, Qumranet, Amit Shah (amit.shah@qumranet.com) |
| 17 | * Copyright (C) 2008, Red Hat, Amit Shah (amit.shah@redhat.com) |
| 18 | * Copyright (C) 2008, IBM, Muli Ben-Yehuda (muli@il.ibm.com) |
| 19 | */ |
| 20 | |
| 21 | #include "qemu/osdep.h" |
| 22 | #include <sys/ioctl.h> |
| 23 | |
| 24 | #include "hw/vfio/vfio-region.h" |
| 25 | #include "hw/vfio/vfio-device.h" |
| 26 | #include "hw/core/hw-error.h" |
| 27 | #include "trace.h" |
| 28 | #include "qapi/error.h" |
| 29 | #include "qemu/error-report.h" |
| 30 | #include "qemu/units.h" |
| 31 | #include "monitor/monitor.h" |
| 32 | #include "system/ramblock.h" |
| 33 | #include "vfio-helpers.h" |
| 34 | |
| 35 | /* |
| 36 | * IO Port/MMIO - Beware of the endians, VFIO is always little endian |
| 37 | */ |
| 38 | void vfio_region_write(void *opaque, hwaddr addr, |
| 39 | uint64_t data, unsigned size) |
| 40 | { |
| 41 | VFIORegion *region = opaque; |
| 42 | VFIODevice *vbasedev = region->vbasedev; |
| 43 | union { |
| 44 | uint8_t byte; |
| 45 | uint16_t word; |
| 46 | uint32_t dword; |
| 47 | uint64_t qword; |
| 48 | } buf; |
| 49 | int ret; |
| 50 | |
| 51 | switch (size) { |
| 52 | case 1: |
| 53 | buf.byte = data; |
| 54 | break; |
| 55 | case 2: |
| 56 | buf.word = cpu_to_le16(data); |
| 57 | break; |
| 58 | case 4: |
| 59 | buf.dword = cpu_to_le32(data); |
| 60 | break; |
| 61 | case 8: |
| 62 | buf.qword = cpu_to_le64(data); |
| 63 | break; |
| 64 | default: |
| 65 | hw_error("vfio: unsupported write size, %u bytes", size); |
| 66 | break; |
| 67 | } |
| 68 | |
| 69 | ret = vbasedev->io_ops->region_write(vbasedev, region->nr, |
| 70 | addr, size, &buf, region->post_wr); |
| 71 | if (ret != size) { |
| 72 | error_report("%s(%s:region%d+0x%"HWADDR_PRIx", 0x%"PRIx64 |
| 73 | ",%d) failed: %s", |
| 74 | __func__, vbasedev->name, region->nr, |
| 75 | addr, data, size, strwriteerror(ret)); |
| 76 | } |
| 77 | |
| 78 | trace_vfio_region_write(vbasedev->name, region->nr, addr, data, size); |
| 79 | |
| 80 | /* |
| 81 | * A read or write to a BAR always signals an INTx EOI. This will |
| 82 | * do nothing if not pending (including not in INTx mode). We assume |
| 83 | * that a BAR access is in response to an interrupt and that BAR |
| 84 | * accesses will service the interrupt. Unfortunately, we don't know |
| 85 | * which access will service the interrupt, so we're potentially |
| 86 | * getting quite a few host interrupts per guest interrupt. |
| 87 | */ |
| 88 | vbasedev->ops->vfio_eoi(vbasedev); |
| 89 | } |
| 90 | |
| 91 | uint64_t vfio_region_read(void *opaque, |
| 92 | hwaddr addr, unsigned size) |
| 93 | { |
| 94 | VFIORegion *region = opaque; |
| 95 | VFIODevice *vbasedev = region->vbasedev; |
| 96 | union { |
| 97 | uint8_t byte; |
| 98 | uint16_t word; |
| 99 | uint32_t dword; |
| 100 | uint64_t qword; |
| 101 | } buf; |
| 102 | uint64_t data = 0; |
| 103 | int ret; |
| 104 | |
| 105 | ret = vbasedev->io_ops->region_read(vbasedev, region->nr, addr, size, &buf); |
| 106 | if (ret != size) { |
| 107 | error_report("%s(%s:region%d+0x%"HWADDR_PRIx", %d) failed: %s", |
| 108 | __func__, vbasedev->name, region->nr, |
| 109 | addr, size, strreaderror(ret)); |
| 110 | return (uint64_t)-1; |
| 111 | } |
| 112 | switch (size) { |
| 113 | case 1: |
| 114 | data = buf.byte; |
| 115 | break; |
| 116 | case 2: |
| 117 | data = le16_to_cpu(buf.word); |
| 118 | break; |
| 119 | case 4: |
| 120 | data = le32_to_cpu(buf.dword); |
| 121 | break; |
| 122 | case 8: |
| 123 | data = le64_to_cpu(buf.qword); |
| 124 | break; |
| 125 | default: |
| 126 | hw_error("vfio: unsupported read size, %u bytes", size); |
| 127 | break; |
| 128 | } |
| 129 | |
| 130 | trace_vfio_region_read(vbasedev->name, region->nr, addr, size, data); |
| 131 | |
| 132 | /* Same as write above */ |
| 133 | vbasedev->ops->vfio_eoi(vbasedev); |
| 134 | |
| 135 | return data; |
| 136 | } |
| 137 | |
| 138 | static const MemoryRegionOps vfio_region_ops = { |
| 139 | .read = vfio_region_read, |
| 140 | .write = vfio_region_write, |
| 141 | .endianness = DEVICE_LITTLE_ENDIAN, |
| 142 | .valid = { |
| 143 | .min_access_size = 1, |
| 144 | .max_access_size = 8, |
| 145 | }, |
| 146 | .impl = { |
| 147 | .min_access_size = 1, |
| 148 | .max_access_size = 8, |
| 149 | }, |
| 150 | }; |
| 151 | |
| 152 | static int vfio_mmap_compare_offset(const void *a, const void *b) |
| 153 | { |
| 154 | const VFIOMmap *mmap_a = a; |
| 155 | const VFIOMmap *mmap_b = b; |
| 156 | |
| 157 | if (mmap_a->offset < mmap_b->offset) { |
| 158 | return -1; |
| 159 | } else if (mmap_a->offset > mmap_b->offset) { |
| 160 | return 1; |
| 161 | } |
| 162 | return 0; |
| 163 | } |
| 164 | |
| 165 | static int vfio_setup_region_sparse_mmaps(VFIORegion *region, |
| 166 | struct vfio_region_info *info, |
| 167 | Error **errp) |
| 168 | { |
| 169 | struct vfio_info_cap_header *hdr; |
| 170 | struct vfio_region_info_cap_sparse_mmap *sparse; |
| 171 | int i, j; |
| 172 | |
| 173 | hdr = vfio_get_region_info_cap(info, VFIO_REGION_INFO_CAP_SPARSE_MMAP); |
| 174 | if (!hdr) { |
| 175 | return -ENODEV; |
| 176 | } |
| 177 | |
| 178 | sparse = container_of(hdr, struct vfio_region_info_cap_sparse_mmap, header); |
| 179 | |
| 180 | trace_vfio_region_sparse_mmap_header(region->vbasedev->name, |
| 181 | region->nr, sparse->nr_areas); |
| 182 | |
| 183 | region->mmaps = g_new0(VFIOMmap, sparse->nr_areas); |
| 184 | |
| 185 | for (i = 0, j = 0; i < sparse->nr_areas; i++) { |
| 186 | if (sparse->areas[i].size) { |
| 187 | trace_vfio_region_sparse_mmap_entry(i, sparse->areas[i].offset, |
| 188 | sparse->areas[i].offset + |
| 189 | sparse->areas[i].size - 1); |
| 190 | region->mmaps[j].offset = sparse->areas[i].offset; |
| 191 | region->mmaps[j].size = sparse->areas[i].size; |
| 192 | j++; |
| 193 | } |
| 194 | } |
| 195 | |
| 196 | region->nr_mmaps = j; |
| 197 | region->mmaps = g_realloc(region->mmaps, j * sizeof(VFIOMmap)); |
| 198 | |
| 199 | /* |
| 200 | * Sort sparse mmaps by offset to ensure proper handling of gaps |
| 201 | * and predictable mapping order in vfio_region_mmap(). |
| 202 | */ |
| 203 | if (region->nr_mmaps > 1) { |
| 204 | qsort(region->mmaps, region->nr_mmaps, sizeof(VFIOMmap), |
| 205 | vfio_mmap_compare_offset); |
| 206 | |
| 207 | /* |
| 208 | * Validate that sparse regions don't overlap after sorting. |
| 209 | */ |
| 210 | for (i = 1; i < region->nr_mmaps; i++) { |
| 211 | off_t prev_end = region->mmaps[i - 1].offset + |
| 212 | region->mmaps[i - 1].size; |
| 213 | if (prev_end > region->mmaps[i].offset) { |
| 214 | error_setg(errp, "%s: overlapping sparse mmap regions detected " |
| 215 | "in region %d: [0x%"PRIx64"-0x%"PRIx64"] overlaps " |
| 216 | "with [0x%"PRIx64"-0x%"PRIx64"]", |
| 217 | __func__, region->nr, region->mmaps[i - 1].offset, |
| 218 | prev_end - 1, region->mmaps[i].offset, |
| 219 | region->mmaps[i].offset + region->mmaps[i].size - 1); |
| 220 | g_free(region->mmaps); |
| 221 | region->mmaps = NULL; |
| 222 | region->nr_mmaps = 0; |
| 223 | return -EINVAL; |
| 224 | } |
| 225 | } |
| 226 | } |
| 227 | |
| 228 | return 0; |
| 229 | } |
| 230 | |
| 231 | int vfio_region_setup(Object *obj, VFIODevice *vbasedev, VFIORegion *region, |
| 232 | int index, const char *name, Error **errp) |
| 233 | { |
| 234 | struct vfio_region_info *info = NULL; |
| 235 | int ret; |
| 236 | |
| 237 | ret = vfio_device_get_region_info(vbasedev, index, &info); |
| 238 | if (ret) { |
| 239 | error_setg_errno(errp, -ret, "failed to get region %d info", index); |
| 240 | return ret; |
| 241 | } |
| 242 | |
| 243 | region->vbasedev = vbasedev; |
| 244 | region->flags = info->flags; |
| 245 | region->size = info->size; |
| 246 | region->fd_offset = info->offset; |
| 247 | region->nr = index; |
| 248 | region->post_wr = false; |
| 249 | |
| 250 | if (region->size) { |
| 251 | region->mem = g_new0(MemoryRegion, 1); |
| 252 | memory_region_init_io(region->mem, obj, &vfio_region_ops, |
| 253 | region, name, region->size); |
| 254 | |
| 255 | if (!vbasedev->no_mmap && |
| 256 | region->flags & VFIO_REGION_INFO_FLAG_MMAP) { |
| 257 | |
| 258 | ret = vfio_setup_region_sparse_mmaps(region, info, errp); |
| 259 | |
| 260 | if (ret == -ENODEV) { |
| 261 | region->nr_mmaps = 1; |
| 262 | region->mmaps = g_new0(VFIOMmap, region->nr_mmaps); |
| 263 | region->mmaps[0].offset = 0; |
| 264 | region->mmaps[0].size = region->size; |
| 265 | } else if (ret) { |
| 266 | return ret; |
| 267 | } |
| 268 | } |
| 269 | } |
| 270 | |
| 271 | trace_vfio_region_setup(vbasedev->name, index, name, |
| 272 | region->flags, region->fd_offset, region->size); |
| 273 | return 0; |
| 274 | } |
| 275 | |
| 276 | static void vfio_subregion_unmap(VFIORegion *region, int index) |
| 277 | { |
| 278 | trace_vfio_region_unmap(memory_region_name(®ion->mmaps[index].mem), |
| 279 | region->mmaps[index].offset, |
| 280 | region->mmaps[index].offset + |
| 281 | region->mmaps[index].size - 1); |
| 282 | memory_region_del_subregion(region->mem, ®ion->mmaps[index].mem); |
| 283 | munmap(region->mmaps[index].mmap, region->mmaps[index].size); |
| 284 | object_unparent(OBJECT(®ion->mmaps[index].mem)); |
| 285 | region->mmaps[index].mmap = NULL; |
| 286 | } |
| 287 | |
| 288 | static bool vfio_region_create_dma_buf(VFIORegion *region, Error **errp) |
| 289 | { |
| 290 | g_autofree struct vfio_device_feature *feature = NULL; |
| 291 | VFIODevice *vbasedev = region->vbasedev; |
| 292 | struct vfio_device_feature_dma_buf *dma_buf; |
| 293 | size_t total_size; |
| 294 | int i, ret; |
| 295 | |
| 296 | /* Check if backend supports DMA-BUF creation */ |
| 297 | if (!(vbasedev->io_ops->capabilities & VFIO_IO_CAP_DMA_BUF)) { |
| 298 | return true; |
| 299 | } |
| 300 | |
| 301 | total_size = sizeof(*feature) + sizeof(*dma_buf) + |
| 302 | sizeof(struct vfio_region_dma_range) * region->nr_mmaps; |
| 303 | feature = g_malloc0(total_size); |
| 304 | *feature = (struct vfio_device_feature) { |
| 305 | .argsz = total_size, |
| 306 | .flags = VFIO_DEVICE_FEATURE_GET | VFIO_DEVICE_FEATURE_DMA_BUF, |
| 307 | }; |
| 308 | |
| 309 | dma_buf = (void *)feature->data; |
| 310 | *dma_buf = (struct vfio_device_feature_dma_buf) { |
| 311 | .region_index = region->nr, |
| 312 | .open_flags = O_RDWR, |
| 313 | .nr_ranges = region->nr_mmaps, |
| 314 | }; |
| 315 | |
| 316 | for (i = 0; i < region->nr_mmaps; i++) { |
| 317 | dma_buf->dma_ranges[i].offset = region->mmaps[i].offset; |
| 318 | dma_buf->dma_ranges[i].length = region->mmaps[i].size; |
| 319 | } |
| 320 | |
| 321 | ret = vfio_device_get_feature(vbasedev, feature); |
| 322 | if (ret < 0) { |
| 323 | if (ret == -ENOTTY) { |
| 324 | warn_report_once("VFIO dma-buf not supported in kernel, " |
| 325 | "using mmap fallback, P2P DMA will not work"); |
| 326 | return true; |
| 327 | } |
| 328 | error_setg_errno(errp, -ret, "%s: dma-buf unavailable, " |
| 329 | "using mmap fallback, P2P DMA will not work", |
| 330 | memory_region_name(region->mem)); |
| 331 | return false; |
| 332 | } |
| 333 | |
| 334 | /* Assign the dmabuf fd to associated RAMBlock */ |
| 335 | for (i = 0; i < region->nr_mmaps; i++) { |
| 336 | MemoryRegion *mr = ®ion->mmaps[i].mem; |
| 337 | RAMBlock *ram_block = mr->ram_block; |
| 338 | |
| 339 | ram_block->fd = ret; |
| 340 | ram_block->fd_offset = region->mmaps[i].offset; |
| 341 | trace_vfio_region_dmabuf(region->vbasedev->name, ret, region->nr, |
| 342 | memory_region_name(region->mem), |
| 343 | region->mmaps[i].offset, |
| 344 | region->mmaps[i].size); |
| 345 | } |
| 346 | return true; |
| 347 | } |
| 348 | |
| 349 | int vfio_region_mmap(VFIORegion *region) |
| 350 | { |
| 351 | void *map_base, *map_align; |
| 352 | Error *local_err = NULL; |
| 353 | int i, ret, prot = 0; |
| 354 | off_t map_offset = 0; |
| 355 | size_t align; |
| 356 | char *name; |
| 357 | int fd; |
| 358 | |
| 359 | if (!region->mem || !region->nr_mmaps) { |
| 360 | return 0; |
| 361 | } |
| 362 | |
| 363 | prot |= region->flags & VFIO_REGION_INFO_FLAG_READ ? PROT_READ : 0; |
| 364 | prot |= region->flags & VFIO_REGION_INFO_FLAG_WRITE ? PROT_WRITE : 0; |
| 365 | |
| 366 | /* |
| 367 | * Align the mmap for more efficient mapping in the kernel. Ideally |
| 368 | * we'd know the PMD and PUD mapping sizes to use as discrete alignment |
| 369 | * intervals, but we don't. As of Linux v6.19, the largest PUD size |
| 370 | * supporting huge pfnmap is 1GiB (ARCH_SUPPORTS_PUD_PFNMAP is only set |
| 371 | * on x86_64). |
| 372 | * |
| 373 | * Align by power-of-two of the size of the entire region - capped |
| 374 | * by 1G - and place the sparse subregions at their appropriate offset. |
| 375 | * This will get maximum alignment. |
| 376 | * |
| 377 | * NB. qemu_memalign() and friends actually allocate memory, whereas |
| 378 | * the region size here can exceed host memory, therefore we manually |
| 379 | * create an oversized anonymous mapping and clean it up for alignment. |
| 380 | */ |
| 381 | |
| 382 | align = MIN(pow2ceil(region->size), 1 * GiB); |
| 383 | |
| 384 | map_base = mmap(0, region->size + align, PROT_NONE, |
| 385 | MAP_PRIVATE | MAP_ANONYMOUS, -1, 0); |
| 386 | if (map_base == MAP_FAILED) { |
| 387 | ret = -errno; |
| 388 | trace_vfio_region_mmap_fault(memory_region_name(region->mem), -1, |
| 389 | region->fd_offset, |
| 390 | region->fd_offset + region->size - 1, ret); |
| 391 | return ret; |
| 392 | } |
| 393 | |
| 394 | fd = vfio_device_get_region_fd(region->vbasedev, region->nr); |
| 395 | |
| 396 | map_align = (void *)ROUND_UP((uintptr_t)map_base, (uintptr_t)align); |
| 397 | munmap(map_base, map_align - map_base); |
| 398 | munmap(map_align + region->size, |
| 399 | align - (map_align - map_base)); |
| 400 | |
| 401 | /* |
| 402 | * Regions should already be sorted by vfio_setup_region_sparse_mmaps(). |
| 403 | * This is critical for the following algorithm which relies on range |
| 404 | * offsets being in ascending order. |
| 405 | */ |
| 406 | for (i = 0; i < region->nr_mmaps; i++) { |
| 407 | munmap(map_align + map_offset, region->mmaps[i].offset - map_offset); |
| 408 | region->mmaps[i].mmap = mmap(map_align + region->mmaps[i].offset, |
| 409 | region->mmaps[i].size, prot, |
| 410 | MAP_SHARED | MAP_FIXED, fd, |
| 411 | region->fd_offset + |
| 412 | region->mmaps[i].offset); |
| 413 | if (region->mmaps[i].mmap == MAP_FAILED) { |
| 414 | ret = -errno; |
| 415 | /* |
| 416 | * Only unmap the rest of the region. Any mmaps that were successful |
| 417 | * will be unmapped in no_mmap. |
| 418 | */ |
| 419 | munmap(map_align + region->mmaps[i].offset, |
| 420 | region->size - region->mmaps[i].offset); |
| 421 | goto no_mmap; |
| 422 | } |
| 423 | |
| 424 | name = g_strdup_printf("%s mmaps[%d]", |
| 425 | memory_region_name(region->mem), i); |
| 426 | memory_region_init_ram_device_ptr(®ion->mmaps[i].mem, |
| 427 | memory_region_owner(region->mem), |
| 428 | name, region->mmaps[i].size, |
| 429 | region->mmaps[i].mmap); |
| 430 | g_free(name); |
| 431 | memory_region_add_subregion(region->mem, region->mmaps[i].offset, |
| 432 | ®ion->mmaps[i].mem); |
| 433 | |
| 434 | trace_vfio_region_mmap(memory_region_name(®ion->mmaps[i].mem), |
| 435 | region->mmaps[i].offset, |
| 436 | region->mmaps[i].offset + |
| 437 | region->mmaps[i].size - 1); |
| 438 | |
| 439 | map_offset = region->mmaps[i].offset + region->mmaps[i].size; |
| 440 | } |
| 441 | |
| 442 | /* |
| 443 | * Unmap the rest of the region not covered by sparse mmap. |
| 444 | */ |
| 445 | if (map_offset < region->size) { |
| 446 | munmap(map_align + map_offset, region->size - map_offset); |
| 447 | } |
| 448 | |
| 449 | if (!vfio_region_create_dma_buf(region, &local_err)) { |
| 450 | warn_report_err_once(local_err); |
| 451 | } |
| 452 | |
| 453 | return 0; |
| 454 | |
| 455 | no_mmap: |
| 456 | trace_vfio_region_mmap_fault(memory_region_name(region->mem), i, |
| 457 | region->fd_offset + region->mmaps[i].offset, |
| 458 | region->fd_offset + region->mmaps[i].offset + |
| 459 | region->mmaps[i].size - 1, ret); |
| 460 | |
| 461 | region->mmaps[i].mmap = NULL; |
| 462 | |
| 463 | for (i--; i >= 0; i--) { |
| 464 | vfio_subregion_unmap(region, i); |
| 465 | } |
| 466 | |
| 467 | return ret; |
| 468 | } |
| 469 | |
| 470 | void vfio_region_exit(VFIORegion *region) |
| 471 | { |
| 472 | int i; |
| 473 | |
| 474 | if (!region->mem) { |
| 475 | return; |
| 476 | } |
| 477 | |
| 478 | for (i = 0; i < region->nr_mmaps; i++) { |
| 479 | if (region->mmaps[i].mmap) { |
| 480 | memory_region_del_subregion(region->mem, ®ion->mmaps[i].mem); |
| 481 | } |
| 482 | } |
| 483 | |
| 484 | trace_vfio_region_exit(region->vbasedev->name, region->nr); |
| 485 | } |
| 486 | |
| 487 | void vfio_region_finalize(VFIORegion *region) |
| 488 | { |
| 489 | int i; |
| 490 | |
| 491 | if (!region->mem) { |
| 492 | return; |
| 493 | } |
| 494 | |
| 495 | for (i = 0; i < region->nr_mmaps; i++) { |
| 496 | if (region->mmaps[i].mmap) { |
| 497 | munmap(region->mmaps[i].mmap, region->mmaps[i].size); |
| 498 | } |
| 499 | } |
| 500 | |
| 501 | g_free(region->mem); |
| 502 | g_free(region->mmaps); |
| 503 | |
| 504 | trace_vfio_region_finalize(region->vbasedev->name, region->nr); |
| 505 | |
| 506 | region->mem = NULL; |
| 507 | region->mmaps = NULL; |
| 508 | region->nr_mmaps = 0; |
| 509 | region->size = 0; |
| 510 | region->flags = 0; |
| 511 | region->nr = 0; |
| 512 | } |
| 513 | |
| 514 | void vfio_region_mmaps_set_enabled(VFIORegion *region, bool enabled) |
| 515 | { |
| 516 | int i; |
| 517 | |
| 518 | if (!region->mem) { |
| 519 | return; |
| 520 | } |
| 521 | |
| 522 | for (i = 0; i < region->nr_mmaps; i++) { |
| 523 | if (region->mmaps[i].mmap) { |
| 524 | memory_region_set_enabled(®ion->mmaps[i].mem, enabled); |
| 525 | } |
| 526 | } |
| 527 | |
| 528 | trace_vfio_region_mmaps_set_enabled(memory_region_name(region->mem), |
| 529 | enabled); |
| 530 | } |