xref: /linux/drivers/vfio/vfio_main.c (revision ff40b5769a50fab654a70575ff0f49853b799b0e)
1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3  * VFIO core
4  *
5  * Copyright (C) 2012 Red Hat, Inc.  All rights reserved.
6  *     Author: Alex Williamson <alex.williamson@redhat.com>
7  *
8  * Derived from original vfio:
9  * Copyright 2010 Cisco Systems, Inc.  All rights reserved.
10  * Author: Tom Lyon, pugs@cisco.com
11  */
12 
13 #include <linux/cdev.h>
14 #include <linux/compat.h>
15 #include <linux/device.h>
16 #include <linux/fs.h>
17 #include <linux/idr.h>
18 #include <linux/iommu.h>
19 #ifdef CONFIG_HAVE_KVM
20 #include <linux/kvm_host.h>
21 #endif
22 #include <linux/list.h>
23 #include <linux/miscdevice.h>
24 #include <linux/module.h>
25 #include <linux/mutex.h>
26 #include <linux/pci.h>
27 #include <linux/rwsem.h>
28 #include <linux/sched.h>
29 #include <linux/slab.h>
30 #include <linux/stat.h>
31 #include <linux/string.h>
32 #include <linux/uaccess.h>
33 #include <linux/vfio.h>
34 #include <linux/wait.h>
35 #include <linux/sched/signal.h>
36 #include <linux/pm_runtime.h>
37 #include <linux/interval_tree.h>
38 #include <linux/iova_bitmap.h>
39 #include <linux/iommufd.h>
40 #include "vfio.h"
41 
42 #define DRIVER_VERSION	"0.3"
43 #define DRIVER_AUTHOR	"Alex Williamson <alex.williamson@redhat.com>"
44 #define DRIVER_DESC	"VFIO - User Level meta-driver"
45 
46 static struct vfio {
47 	struct class			*device_class;
48 	struct ida			device_ida;
49 } vfio;
50 
51 #ifdef CONFIG_VFIO_NOIOMMU
52 bool vfio_noiommu __read_mostly;
53 module_param_named(enable_unsafe_noiommu_mode,
54 		   vfio_noiommu, bool, S_IRUGO | S_IWUSR);
55 MODULE_PARM_DESC(enable_unsafe_noiommu_mode, "Enable UNSAFE, no-IOMMU mode.  This mode provides no device isolation, no DMA translation, no host kernel protection, cannot be used for device assignment to virtual machines, requires RAWIO permissions, and will taint the kernel.  If you do not know what this is for, step away. (default: false)");
56 #endif
57 
58 static DEFINE_XARRAY(vfio_device_set_xa);
59 
60 int vfio_assign_device_set(struct vfio_device *device, void *set_id)
61 {
62 	unsigned long idx = (unsigned long)set_id;
63 	struct vfio_device_set *new_dev_set;
64 	struct vfio_device_set *dev_set;
65 
66 	if (WARN_ON(!set_id))
67 		return -EINVAL;
68 
69 	/*
70 	 * Atomically acquire a singleton object in the xarray for this set_id
71 	 */
72 	xa_lock(&vfio_device_set_xa);
73 	dev_set = xa_load(&vfio_device_set_xa, idx);
74 	if (dev_set)
75 		goto found_get_ref;
76 	xa_unlock(&vfio_device_set_xa);
77 
78 	new_dev_set = kzalloc(sizeof(*new_dev_set), GFP_KERNEL);
79 	if (!new_dev_set)
80 		return -ENOMEM;
81 	mutex_init(&new_dev_set->lock);
82 	INIT_LIST_HEAD(&new_dev_set->device_list);
83 	new_dev_set->set_id = set_id;
84 
85 	xa_lock(&vfio_device_set_xa);
86 	dev_set = __xa_cmpxchg(&vfio_device_set_xa, idx, NULL, new_dev_set,
87 			       GFP_KERNEL);
88 	if (!dev_set) {
89 		dev_set = new_dev_set;
90 		goto found_get_ref;
91 	}
92 
93 	kfree(new_dev_set);
94 	if (xa_is_err(dev_set)) {
95 		xa_unlock(&vfio_device_set_xa);
96 		return xa_err(dev_set);
97 	}
98 
99 found_get_ref:
100 	dev_set->device_count++;
101 	xa_unlock(&vfio_device_set_xa);
102 	mutex_lock(&dev_set->lock);
103 	device->dev_set = dev_set;
104 	list_add_tail(&device->dev_set_list, &dev_set->device_list);
105 	mutex_unlock(&dev_set->lock);
106 	return 0;
107 }
108 EXPORT_SYMBOL_GPL(vfio_assign_device_set);
109 
110 static void vfio_release_device_set(struct vfio_device *device)
111 {
112 	struct vfio_device_set *dev_set = device->dev_set;
113 
114 	if (!dev_set)
115 		return;
116 
117 	mutex_lock(&dev_set->lock);
118 	list_del(&device->dev_set_list);
119 	mutex_unlock(&dev_set->lock);
120 
121 	xa_lock(&vfio_device_set_xa);
122 	if (!--dev_set->device_count) {
123 		__xa_erase(&vfio_device_set_xa,
124 			   (unsigned long)dev_set->set_id);
125 		mutex_destroy(&dev_set->lock);
126 		kfree(dev_set);
127 	}
128 	xa_unlock(&vfio_device_set_xa);
129 }
130 
131 unsigned int vfio_device_set_open_count(struct vfio_device_set *dev_set)
132 {
133 	struct vfio_device *cur;
134 	unsigned int open_count = 0;
135 
136 	lockdep_assert_held(&dev_set->lock);
137 
138 	list_for_each_entry(cur, &dev_set->device_list, dev_set_list)
139 		open_count += cur->open_count;
140 	return open_count;
141 }
142 EXPORT_SYMBOL_GPL(vfio_device_set_open_count);
143 
144 /*
145  * Device objects - create, release, get, put, search
146  */
147 /* Device reference always implies a group reference */
148 void vfio_device_put_registration(struct vfio_device *device)
149 {
150 	if (refcount_dec_and_test(&device->refcount))
151 		complete(&device->comp);
152 }
153 
154 bool vfio_device_try_get_registration(struct vfio_device *device)
155 {
156 	return refcount_inc_not_zero(&device->refcount);
157 }
158 
159 /*
160  * VFIO driver API
161  */
162 /* Release helper called by vfio_put_device() */
163 static void vfio_device_release(struct device *dev)
164 {
165 	struct vfio_device *device =
166 			container_of(dev, struct vfio_device, device);
167 
168 	vfio_release_device_set(device);
169 	ida_free(&vfio.device_ida, device->index);
170 
171 	if (device->ops->release)
172 		device->ops->release(device);
173 
174 	kvfree(device);
175 }
176 
177 static int vfio_init_device(struct vfio_device *device, struct device *dev,
178 			    const struct vfio_device_ops *ops);
179 
180 /*
181  * Allocate and initialize vfio_device so it can be registered to vfio
182  * core.
183  *
184  * Drivers should use the wrapper vfio_alloc_device() for allocation.
185  * @size is the size of the structure to be allocated, including any
186  * private data used by the driver.
187  *
188  * Driver may provide an @init callback to cover device private data.
189  *
190  * Use vfio_put_device() to release the structure after success return.
191  */
192 struct vfio_device *_vfio_alloc_device(size_t size, struct device *dev,
193 				       const struct vfio_device_ops *ops)
194 {
195 	struct vfio_device *device;
196 	int ret;
197 
198 	if (WARN_ON(size < sizeof(struct vfio_device)))
199 		return ERR_PTR(-EINVAL);
200 
201 	device = kvzalloc(size, GFP_KERNEL);
202 	if (!device)
203 		return ERR_PTR(-ENOMEM);
204 
205 	ret = vfio_init_device(device, dev, ops);
206 	if (ret)
207 		goto out_free;
208 	return device;
209 
210 out_free:
211 	kvfree(device);
212 	return ERR_PTR(ret);
213 }
214 EXPORT_SYMBOL_GPL(_vfio_alloc_device);
215 
216 /*
217  * Initialize a vfio_device so it can be registered to vfio core.
218  */
219 static int vfio_init_device(struct vfio_device *device, struct device *dev,
220 			    const struct vfio_device_ops *ops)
221 {
222 	int ret;
223 
224 	ret = ida_alloc_max(&vfio.device_ida, MINORMASK, GFP_KERNEL);
225 	if (ret < 0) {
226 		dev_dbg(dev, "Error to alloc index\n");
227 		return ret;
228 	}
229 
230 	device->index = ret;
231 	init_completion(&device->comp);
232 	device->dev = dev;
233 	device->ops = ops;
234 
235 	if (ops->init) {
236 		ret = ops->init(device);
237 		if (ret)
238 			goto out_uninit;
239 	}
240 
241 	device_initialize(&device->device);
242 	device->device.release = vfio_device_release;
243 	device->device.class = vfio.device_class;
244 	device->device.parent = device->dev;
245 	return 0;
246 
247 out_uninit:
248 	vfio_release_device_set(device);
249 	ida_free(&vfio.device_ida, device->index);
250 	return ret;
251 }
252 
253 static int __vfio_register_dev(struct vfio_device *device,
254 			       enum vfio_group_type type)
255 {
256 	int ret;
257 
258 	if (WARN_ON(IS_ENABLED(CONFIG_IOMMUFD) &&
259 		    (!device->ops->bind_iommufd ||
260 		     !device->ops->unbind_iommufd ||
261 		     !device->ops->attach_ioas)))
262 		return -EINVAL;
263 
264 	/*
265 	 * If the driver doesn't specify a set then the device is added to a
266 	 * singleton set just for itself.
267 	 */
268 	if (!device->dev_set)
269 		vfio_assign_device_set(device, device);
270 
271 	ret = dev_set_name(&device->device, "vfio%d", device->index);
272 	if (ret)
273 		return ret;
274 
275 	ret = vfio_device_set_group(device, type);
276 	if (ret)
277 		return ret;
278 
279 	ret = device_add(&device->device);
280 	if (ret)
281 		goto err_out;
282 
283 	/* Refcounting can't start until the driver calls register */
284 	refcount_set(&device->refcount, 1);
285 
286 	vfio_device_group_register(device);
287 
288 	return 0;
289 err_out:
290 	vfio_device_remove_group(device);
291 	return ret;
292 }
293 
294 int vfio_register_group_dev(struct vfio_device *device)
295 {
296 	return __vfio_register_dev(device, VFIO_IOMMU);
297 }
298 EXPORT_SYMBOL_GPL(vfio_register_group_dev);
299 
300 /*
301  * Register a virtual device without IOMMU backing.  The user of this
302  * device must not be able to directly trigger unmediated DMA.
303  */
304 int vfio_register_emulated_iommu_dev(struct vfio_device *device)
305 {
306 	return __vfio_register_dev(device, VFIO_EMULATED_IOMMU);
307 }
308 EXPORT_SYMBOL_GPL(vfio_register_emulated_iommu_dev);
309 
310 /*
311  * Decrement the device reference count and wait for the device to be
312  * removed.  Open file descriptors for the device... */
313 void vfio_unregister_group_dev(struct vfio_device *device)
314 {
315 	unsigned int i = 0;
316 	bool interrupted = false;
317 	long rc;
318 
319 	vfio_device_put_registration(device);
320 	rc = try_wait_for_completion(&device->comp);
321 	while (rc <= 0) {
322 		if (device->ops->request)
323 			device->ops->request(device, i++);
324 
325 		if (interrupted) {
326 			rc = wait_for_completion_timeout(&device->comp,
327 							 HZ * 10);
328 		} else {
329 			rc = wait_for_completion_interruptible_timeout(
330 				&device->comp, HZ * 10);
331 			if (rc < 0) {
332 				interrupted = true;
333 				dev_warn(device->dev,
334 					 "Device is currently in use, task"
335 					 " \"%s\" (%d) "
336 					 "blocked until device is released",
337 					 current->comm, task_pid_nr(current));
338 			}
339 		}
340 	}
341 
342 	vfio_device_group_unregister(device);
343 
344 	/* Balances device_add in register path */
345 	device_del(&device->device);
346 
347 	/* Balances vfio_device_set_group in register path */
348 	vfio_device_remove_group(device);
349 }
350 EXPORT_SYMBOL_GPL(vfio_unregister_group_dev);
351 
352 #ifdef CONFIG_HAVE_KVM
353 void _vfio_device_get_kvm_safe(struct vfio_device *device, struct kvm *kvm)
354 {
355 	void (*pfn)(struct kvm *kvm);
356 	bool (*fn)(struct kvm *kvm);
357 	bool ret;
358 
359 	lockdep_assert_held(&device->dev_set->lock);
360 
361 	pfn = symbol_get(kvm_put_kvm);
362 	if (WARN_ON(!pfn))
363 		return;
364 
365 	fn = symbol_get(kvm_get_kvm_safe);
366 	if (WARN_ON(!fn)) {
367 		symbol_put(kvm_put_kvm);
368 		return;
369 	}
370 
371 	ret = fn(kvm);
372 	symbol_put(kvm_get_kvm_safe);
373 	if (!ret) {
374 		symbol_put(kvm_put_kvm);
375 		return;
376 	}
377 
378 	device->put_kvm = pfn;
379 	device->kvm = kvm;
380 }
381 
382 void vfio_device_put_kvm(struct vfio_device *device)
383 {
384 	lockdep_assert_held(&device->dev_set->lock);
385 
386 	if (!device->kvm)
387 		return;
388 
389 	if (WARN_ON(!device->put_kvm))
390 		goto clear;
391 
392 	device->put_kvm(device->kvm);
393 	device->put_kvm = NULL;
394 	symbol_put(kvm_put_kvm);
395 
396 clear:
397 	device->kvm = NULL;
398 }
399 #endif
400 
401 /* true if the vfio_device has open_device() called but not close_device() */
402 static bool vfio_assert_device_open(struct vfio_device *device)
403 {
404 	return !WARN_ON_ONCE(!READ_ONCE(device->open_count));
405 }
406 
407 static int vfio_device_first_open(struct vfio_device *device,
408 				  struct iommufd_ctx *iommufd)
409 {
410 	int ret;
411 
412 	lockdep_assert_held(&device->dev_set->lock);
413 
414 	if (!try_module_get(device->dev->driver->owner))
415 		return -ENODEV;
416 
417 	if (iommufd)
418 		ret = vfio_iommufd_bind(device, iommufd);
419 	else
420 		ret = vfio_device_group_use_iommu(device);
421 	if (ret)
422 		goto err_module_put;
423 
424 	if (device->ops->open_device) {
425 		ret = device->ops->open_device(device);
426 		if (ret)
427 			goto err_unuse_iommu;
428 	}
429 	return 0;
430 
431 err_unuse_iommu:
432 	if (iommufd)
433 		vfio_iommufd_unbind(device);
434 	else
435 		vfio_device_group_unuse_iommu(device);
436 err_module_put:
437 	module_put(device->dev->driver->owner);
438 	return ret;
439 }
440 
441 static void vfio_device_last_close(struct vfio_device *device,
442 				   struct iommufd_ctx *iommufd)
443 {
444 	lockdep_assert_held(&device->dev_set->lock);
445 
446 	if (device->ops->close_device)
447 		device->ops->close_device(device);
448 	if (iommufd)
449 		vfio_iommufd_unbind(device);
450 	else
451 		vfio_device_group_unuse_iommu(device);
452 	module_put(device->dev->driver->owner);
453 }
454 
455 int vfio_device_open(struct vfio_device *device, struct iommufd_ctx *iommufd)
456 {
457 	int ret = 0;
458 
459 	lockdep_assert_held(&device->dev_set->lock);
460 
461 	device->open_count++;
462 	if (device->open_count == 1) {
463 		ret = vfio_device_first_open(device, iommufd);
464 		if (ret)
465 			device->open_count--;
466 	}
467 
468 	return ret;
469 }
470 
471 void vfio_device_close(struct vfio_device *device,
472 		       struct iommufd_ctx *iommufd)
473 {
474 	lockdep_assert_held(&device->dev_set->lock);
475 
476 	vfio_assert_device_open(device);
477 	if (device->open_count == 1)
478 		vfio_device_last_close(device, iommufd);
479 	device->open_count--;
480 }
481 
482 /*
483  * Wrapper around pm_runtime_resume_and_get().
484  * Return error code on failure or 0 on success.
485  */
486 static inline int vfio_device_pm_runtime_get(struct vfio_device *device)
487 {
488 	struct device *dev = device->dev;
489 
490 	if (dev->driver && dev->driver->pm) {
491 		int ret;
492 
493 		ret = pm_runtime_resume_and_get(dev);
494 		if (ret) {
495 			dev_info_ratelimited(dev,
496 				"vfio: runtime resume failed %d\n", ret);
497 			return -EIO;
498 		}
499 	}
500 
501 	return 0;
502 }
503 
504 /*
505  * Wrapper around pm_runtime_put().
506  */
507 static inline void vfio_device_pm_runtime_put(struct vfio_device *device)
508 {
509 	struct device *dev = device->dev;
510 
511 	if (dev->driver && dev->driver->pm)
512 		pm_runtime_put(dev);
513 }
514 
515 /*
516  * VFIO Device fd
517  */
518 static int vfio_device_fops_release(struct inode *inode, struct file *filep)
519 {
520 	struct vfio_device *device = filep->private_data;
521 
522 	vfio_device_group_close(device);
523 
524 	vfio_device_put_registration(device);
525 
526 	return 0;
527 }
528 
529 /*
530  * vfio_mig_get_next_state - Compute the next step in the FSM
531  * @cur_fsm - The current state the device is in
532  * @new_fsm - The target state to reach
533  * @next_fsm - Pointer to the next step to get to new_fsm
534  *
535  * Return 0 upon success, otherwise -errno
536  * Upon success the next step in the state progression between cur_fsm and
537  * new_fsm will be set in next_fsm.
538  *
539  * This breaks down requests for combination transitions into smaller steps and
540  * returns the next step to get to new_fsm. The function may need to be called
541  * multiple times before reaching new_fsm.
542  *
543  */
544 int vfio_mig_get_next_state(struct vfio_device *device,
545 			    enum vfio_device_mig_state cur_fsm,
546 			    enum vfio_device_mig_state new_fsm,
547 			    enum vfio_device_mig_state *next_fsm)
548 {
549 	enum { VFIO_DEVICE_NUM_STATES = VFIO_DEVICE_STATE_PRE_COPY_P2P + 1 };
550 	/*
551 	 * The coding in this table requires the driver to implement the
552 	 * following FSM arcs:
553 	 *         RESUMING -> STOP
554 	 *         STOP -> RESUMING
555 	 *         STOP -> STOP_COPY
556 	 *         STOP_COPY -> STOP
557 	 *
558 	 * If P2P is supported then the driver must also implement these FSM
559 	 * arcs:
560 	 *         RUNNING -> RUNNING_P2P
561 	 *         RUNNING_P2P -> RUNNING
562 	 *         RUNNING_P2P -> STOP
563 	 *         STOP -> RUNNING_P2P
564 	 *
565 	 * If precopy is supported then the driver must support these additional
566 	 * FSM arcs:
567 	 *         RUNNING -> PRE_COPY
568 	 *         PRE_COPY -> RUNNING
569 	 *         PRE_COPY -> STOP_COPY
570 	 * However, if precopy and P2P are supported together then the driver
571 	 * must support these additional arcs beyond the P2P arcs above:
572 	 *         PRE_COPY -> RUNNING
573 	 *         PRE_COPY -> PRE_COPY_P2P
574 	 *         PRE_COPY_P2P -> PRE_COPY
575 	 *         PRE_COPY_P2P -> RUNNING_P2P
576 	 *         PRE_COPY_P2P -> STOP_COPY
577 	 *         RUNNING -> PRE_COPY
578 	 *         RUNNING_P2P -> PRE_COPY_P2P
579 	 *
580 	 * Without P2P and precopy the driver must implement:
581 	 *         RUNNING -> STOP
582 	 *         STOP -> RUNNING
583 	 *
584 	 * The coding will step through multiple states for some combination
585 	 * transitions; if all optional features are supported, this means the
586 	 * following ones:
587 	 *         PRE_COPY -> PRE_COPY_P2P -> STOP_COPY
588 	 *         PRE_COPY -> RUNNING -> RUNNING_P2P
589 	 *         PRE_COPY -> RUNNING -> RUNNING_P2P -> STOP
590 	 *         PRE_COPY -> RUNNING -> RUNNING_P2P -> STOP -> RESUMING
591 	 *         PRE_COPY_P2P -> RUNNING_P2P -> RUNNING
592 	 *         PRE_COPY_P2P -> RUNNING_P2P -> STOP
593 	 *         PRE_COPY_P2P -> RUNNING_P2P -> STOP -> RESUMING
594 	 *         RESUMING -> STOP -> RUNNING_P2P
595 	 *         RESUMING -> STOP -> RUNNING_P2P -> PRE_COPY_P2P
596 	 *         RESUMING -> STOP -> RUNNING_P2P -> RUNNING
597 	 *         RESUMING -> STOP -> RUNNING_P2P -> RUNNING -> PRE_COPY
598 	 *         RESUMING -> STOP -> STOP_COPY
599 	 *         RUNNING -> RUNNING_P2P -> PRE_COPY_P2P
600 	 *         RUNNING -> RUNNING_P2P -> STOP
601 	 *         RUNNING -> RUNNING_P2P -> STOP -> RESUMING
602 	 *         RUNNING -> RUNNING_P2P -> STOP -> STOP_COPY
603 	 *         RUNNING_P2P -> RUNNING -> PRE_COPY
604 	 *         RUNNING_P2P -> STOP -> RESUMING
605 	 *         RUNNING_P2P -> STOP -> STOP_COPY
606 	 *         STOP -> RUNNING_P2P -> PRE_COPY_P2P
607 	 *         STOP -> RUNNING_P2P -> RUNNING
608 	 *         STOP -> RUNNING_P2P -> RUNNING -> PRE_COPY
609 	 *         STOP_COPY -> STOP -> RESUMING
610 	 *         STOP_COPY -> STOP -> RUNNING_P2P
611 	 *         STOP_COPY -> STOP -> RUNNING_P2P -> RUNNING
612 	 *
613 	 *  The following transitions are blocked:
614 	 *         STOP_COPY -> PRE_COPY
615 	 *         STOP_COPY -> PRE_COPY_P2P
616 	 */
617 	static const u8 vfio_from_fsm_table[VFIO_DEVICE_NUM_STATES][VFIO_DEVICE_NUM_STATES] = {
618 		[VFIO_DEVICE_STATE_STOP] = {
619 			[VFIO_DEVICE_STATE_STOP] = VFIO_DEVICE_STATE_STOP,
620 			[VFIO_DEVICE_STATE_RUNNING] = VFIO_DEVICE_STATE_RUNNING_P2P,
621 			[VFIO_DEVICE_STATE_PRE_COPY] = VFIO_DEVICE_STATE_RUNNING_P2P,
622 			[VFIO_DEVICE_STATE_PRE_COPY_P2P] = VFIO_DEVICE_STATE_RUNNING_P2P,
623 			[VFIO_DEVICE_STATE_STOP_COPY] = VFIO_DEVICE_STATE_STOP_COPY,
624 			[VFIO_DEVICE_STATE_RESUMING] = VFIO_DEVICE_STATE_RESUMING,
625 			[VFIO_DEVICE_STATE_RUNNING_P2P] = VFIO_DEVICE_STATE_RUNNING_P2P,
626 			[VFIO_DEVICE_STATE_ERROR] = VFIO_DEVICE_STATE_ERROR,
627 		},
628 		[VFIO_DEVICE_STATE_RUNNING] = {
629 			[VFIO_DEVICE_STATE_STOP] = VFIO_DEVICE_STATE_RUNNING_P2P,
630 			[VFIO_DEVICE_STATE_RUNNING] = VFIO_DEVICE_STATE_RUNNING,
631 			[VFIO_DEVICE_STATE_PRE_COPY] = VFIO_DEVICE_STATE_PRE_COPY,
632 			[VFIO_DEVICE_STATE_PRE_COPY_P2P] = VFIO_DEVICE_STATE_RUNNING_P2P,
633 			[VFIO_DEVICE_STATE_STOP_COPY] = VFIO_DEVICE_STATE_RUNNING_P2P,
634 			[VFIO_DEVICE_STATE_RESUMING] = VFIO_DEVICE_STATE_RUNNING_P2P,
635 			[VFIO_DEVICE_STATE_RUNNING_P2P] = VFIO_DEVICE_STATE_RUNNING_P2P,
636 			[VFIO_DEVICE_STATE_ERROR] = VFIO_DEVICE_STATE_ERROR,
637 		},
638 		[VFIO_DEVICE_STATE_PRE_COPY] = {
639 			[VFIO_DEVICE_STATE_STOP] = VFIO_DEVICE_STATE_RUNNING,
640 			[VFIO_DEVICE_STATE_RUNNING] = VFIO_DEVICE_STATE_RUNNING,
641 			[VFIO_DEVICE_STATE_PRE_COPY] = VFIO_DEVICE_STATE_PRE_COPY,
642 			[VFIO_DEVICE_STATE_PRE_COPY_P2P] = VFIO_DEVICE_STATE_PRE_COPY_P2P,
643 			[VFIO_DEVICE_STATE_STOP_COPY] = VFIO_DEVICE_STATE_PRE_COPY_P2P,
644 			[VFIO_DEVICE_STATE_RESUMING] = VFIO_DEVICE_STATE_RUNNING,
645 			[VFIO_DEVICE_STATE_RUNNING_P2P] = VFIO_DEVICE_STATE_RUNNING,
646 			[VFIO_DEVICE_STATE_ERROR] = VFIO_DEVICE_STATE_ERROR,
647 		},
648 		[VFIO_DEVICE_STATE_PRE_COPY_P2P] = {
649 			[VFIO_DEVICE_STATE_STOP] = VFIO_DEVICE_STATE_RUNNING_P2P,
650 			[VFIO_DEVICE_STATE_RUNNING] = VFIO_DEVICE_STATE_RUNNING_P2P,
651 			[VFIO_DEVICE_STATE_PRE_COPY] = VFIO_DEVICE_STATE_PRE_COPY,
652 			[VFIO_DEVICE_STATE_PRE_COPY_P2P] = VFIO_DEVICE_STATE_PRE_COPY_P2P,
653 			[VFIO_DEVICE_STATE_STOP_COPY] = VFIO_DEVICE_STATE_STOP_COPY,
654 			[VFIO_DEVICE_STATE_RESUMING] = VFIO_DEVICE_STATE_RUNNING_P2P,
655 			[VFIO_DEVICE_STATE_RUNNING_P2P] = VFIO_DEVICE_STATE_RUNNING_P2P,
656 			[VFIO_DEVICE_STATE_ERROR] = VFIO_DEVICE_STATE_ERROR,
657 		},
658 		[VFIO_DEVICE_STATE_STOP_COPY] = {
659 			[VFIO_DEVICE_STATE_STOP] = VFIO_DEVICE_STATE_STOP,
660 			[VFIO_DEVICE_STATE_RUNNING] = VFIO_DEVICE_STATE_STOP,
661 			[VFIO_DEVICE_STATE_PRE_COPY] = VFIO_DEVICE_STATE_ERROR,
662 			[VFIO_DEVICE_STATE_PRE_COPY_P2P] = VFIO_DEVICE_STATE_ERROR,
663 			[VFIO_DEVICE_STATE_STOP_COPY] = VFIO_DEVICE_STATE_STOP_COPY,
664 			[VFIO_DEVICE_STATE_RESUMING] = VFIO_DEVICE_STATE_STOP,
665 			[VFIO_DEVICE_STATE_RUNNING_P2P] = VFIO_DEVICE_STATE_STOP,
666 			[VFIO_DEVICE_STATE_ERROR] = VFIO_DEVICE_STATE_ERROR,
667 		},
668 		[VFIO_DEVICE_STATE_RESUMING] = {
669 			[VFIO_DEVICE_STATE_STOP] = VFIO_DEVICE_STATE_STOP,
670 			[VFIO_DEVICE_STATE_RUNNING] = VFIO_DEVICE_STATE_STOP,
671 			[VFIO_DEVICE_STATE_PRE_COPY] = VFIO_DEVICE_STATE_STOP,
672 			[VFIO_DEVICE_STATE_PRE_COPY_P2P] = VFIO_DEVICE_STATE_STOP,
673 			[VFIO_DEVICE_STATE_STOP_COPY] = VFIO_DEVICE_STATE_STOP,
674 			[VFIO_DEVICE_STATE_RESUMING] = VFIO_DEVICE_STATE_RESUMING,
675 			[VFIO_DEVICE_STATE_RUNNING_P2P] = VFIO_DEVICE_STATE_STOP,
676 			[VFIO_DEVICE_STATE_ERROR] = VFIO_DEVICE_STATE_ERROR,
677 		},
678 		[VFIO_DEVICE_STATE_RUNNING_P2P] = {
679 			[VFIO_DEVICE_STATE_STOP] = VFIO_DEVICE_STATE_STOP,
680 			[VFIO_DEVICE_STATE_RUNNING] = VFIO_DEVICE_STATE_RUNNING,
681 			[VFIO_DEVICE_STATE_PRE_COPY] = VFIO_DEVICE_STATE_RUNNING,
682 			[VFIO_DEVICE_STATE_PRE_COPY_P2P] = VFIO_DEVICE_STATE_PRE_COPY_P2P,
683 			[VFIO_DEVICE_STATE_STOP_COPY] = VFIO_DEVICE_STATE_STOP,
684 			[VFIO_DEVICE_STATE_RESUMING] = VFIO_DEVICE_STATE_STOP,
685 			[VFIO_DEVICE_STATE_RUNNING_P2P] = VFIO_DEVICE_STATE_RUNNING_P2P,
686 			[VFIO_DEVICE_STATE_ERROR] = VFIO_DEVICE_STATE_ERROR,
687 		},
688 		[VFIO_DEVICE_STATE_ERROR] = {
689 			[VFIO_DEVICE_STATE_STOP] = VFIO_DEVICE_STATE_ERROR,
690 			[VFIO_DEVICE_STATE_RUNNING] = VFIO_DEVICE_STATE_ERROR,
691 			[VFIO_DEVICE_STATE_PRE_COPY] = VFIO_DEVICE_STATE_ERROR,
692 			[VFIO_DEVICE_STATE_PRE_COPY_P2P] = VFIO_DEVICE_STATE_ERROR,
693 			[VFIO_DEVICE_STATE_STOP_COPY] = VFIO_DEVICE_STATE_ERROR,
694 			[VFIO_DEVICE_STATE_RESUMING] = VFIO_DEVICE_STATE_ERROR,
695 			[VFIO_DEVICE_STATE_RUNNING_P2P] = VFIO_DEVICE_STATE_ERROR,
696 			[VFIO_DEVICE_STATE_ERROR] = VFIO_DEVICE_STATE_ERROR,
697 		},
698 	};
699 
700 	static const unsigned int state_flags_table[VFIO_DEVICE_NUM_STATES] = {
701 		[VFIO_DEVICE_STATE_STOP] = VFIO_MIGRATION_STOP_COPY,
702 		[VFIO_DEVICE_STATE_RUNNING] = VFIO_MIGRATION_STOP_COPY,
703 		[VFIO_DEVICE_STATE_PRE_COPY] =
704 			VFIO_MIGRATION_STOP_COPY | VFIO_MIGRATION_PRE_COPY,
705 		[VFIO_DEVICE_STATE_PRE_COPY_P2P] = VFIO_MIGRATION_STOP_COPY |
706 						   VFIO_MIGRATION_P2P |
707 						   VFIO_MIGRATION_PRE_COPY,
708 		[VFIO_DEVICE_STATE_STOP_COPY] = VFIO_MIGRATION_STOP_COPY,
709 		[VFIO_DEVICE_STATE_RESUMING] = VFIO_MIGRATION_STOP_COPY,
710 		[VFIO_DEVICE_STATE_RUNNING_P2P] =
711 			VFIO_MIGRATION_STOP_COPY | VFIO_MIGRATION_P2P,
712 		[VFIO_DEVICE_STATE_ERROR] = ~0U,
713 	};
714 
715 	if (WARN_ON(cur_fsm >= ARRAY_SIZE(vfio_from_fsm_table) ||
716 		    (state_flags_table[cur_fsm] & device->migration_flags) !=
717 			state_flags_table[cur_fsm]))
718 		return -EINVAL;
719 
720 	if (new_fsm >= ARRAY_SIZE(vfio_from_fsm_table) ||
721 	   (state_flags_table[new_fsm] & device->migration_flags) !=
722 			state_flags_table[new_fsm])
723 		return -EINVAL;
724 
725 	/*
726 	 * Arcs touching optional and unsupported states are skipped over. The
727 	 * driver will instead see an arc from the original state to the next
728 	 * logical state, as per the above comment.
729 	 */
730 	*next_fsm = vfio_from_fsm_table[cur_fsm][new_fsm];
731 	while ((state_flags_table[*next_fsm] & device->migration_flags) !=
732 			state_flags_table[*next_fsm])
733 		*next_fsm = vfio_from_fsm_table[*next_fsm][new_fsm];
734 
735 	return (*next_fsm != VFIO_DEVICE_STATE_ERROR) ? 0 : -EINVAL;
736 }
737 EXPORT_SYMBOL_GPL(vfio_mig_get_next_state);
738 
739 /*
740  * Convert the drivers's struct file into a FD number and return it to userspace
741  */
742 static int vfio_ioct_mig_return_fd(struct file *filp, void __user *arg,
743 				   struct vfio_device_feature_mig_state *mig)
744 {
745 	int ret;
746 	int fd;
747 
748 	fd = get_unused_fd_flags(O_CLOEXEC);
749 	if (fd < 0) {
750 		ret = fd;
751 		goto out_fput;
752 	}
753 
754 	mig->data_fd = fd;
755 	if (copy_to_user(arg, mig, sizeof(*mig))) {
756 		ret = -EFAULT;
757 		goto out_put_unused;
758 	}
759 	fd_install(fd, filp);
760 	return 0;
761 
762 out_put_unused:
763 	put_unused_fd(fd);
764 out_fput:
765 	fput(filp);
766 	return ret;
767 }
768 
769 static int
770 vfio_ioctl_device_feature_mig_device_state(struct vfio_device *device,
771 					   u32 flags, void __user *arg,
772 					   size_t argsz)
773 {
774 	size_t minsz =
775 		offsetofend(struct vfio_device_feature_mig_state, data_fd);
776 	struct vfio_device_feature_mig_state mig;
777 	struct file *filp = NULL;
778 	int ret;
779 
780 	if (!device->mig_ops)
781 		return -ENOTTY;
782 
783 	ret = vfio_check_feature(flags, argsz,
784 				 VFIO_DEVICE_FEATURE_SET |
785 				 VFIO_DEVICE_FEATURE_GET,
786 				 sizeof(mig));
787 	if (ret != 1)
788 		return ret;
789 
790 	if (copy_from_user(&mig, arg, minsz))
791 		return -EFAULT;
792 
793 	if (flags & VFIO_DEVICE_FEATURE_GET) {
794 		enum vfio_device_mig_state curr_state;
795 
796 		ret = device->mig_ops->migration_get_state(device,
797 							   &curr_state);
798 		if (ret)
799 			return ret;
800 		mig.device_state = curr_state;
801 		goto out_copy;
802 	}
803 
804 	/* Handle the VFIO_DEVICE_FEATURE_SET */
805 	filp = device->mig_ops->migration_set_state(device, mig.device_state);
806 	if (IS_ERR(filp) || !filp)
807 		goto out_copy;
808 
809 	return vfio_ioct_mig_return_fd(filp, arg, &mig);
810 out_copy:
811 	mig.data_fd = -1;
812 	if (copy_to_user(arg, &mig, sizeof(mig)))
813 		return -EFAULT;
814 	if (IS_ERR(filp))
815 		return PTR_ERR(filp);
816 	return 0;
817 }
818 
819 static int
820 vfio_ioctl_device_feature_migration_data_size(struct vfio_device *device,
821 					      u32 flags, void __user *arg,
822 					      size_t argsz)
823 {
824 	struct vfio_device_feature_mig_data_size data_size = {};
825 	unsigned long stop_copy_length;
826 	int ret;
827 
828 	if (!device->mig_ops)
829 		return -ENOTTY;
830 
831 	ret = vfio_check_feature(flags, argsz, VFIO_DEVICE_FEATURE_GET,
832 				 sizeof(data_size));
833 	if (ret != 1)
834 		return ret;
835 
836 	ret = device->mig_ops->migration_get_data_size(device, &stop_copy_length);
837 	if (ret)
838 		return ret;
839 
840 	data_size.stop_copy_length = stop_copy_length;
841 	if (copy_to_user(arg, &data_size, sizeof(data_size)))
842 		return -EFAULT;
843 
844 	return 0;
845 }
846 
847 static int vfio_ioctl_device_feature_migration(struct vfio_device *device,
848 					       u32 flags, void __user *arg,
849 					       size_t argsz)
850 {
851 	struct vfio_device_feature_migration mig = {
852 		.flags = device->migration_flags,
853 	};
854 	int ret;
855 
856 	if (!device->mig_ops)
857 		return -ENOTTY;
858 
859 	ret = vfio_check_feature(flags, argsz, VFIO_DEVICE_FEATURE_GET,
860 				 sizeof(mig));
861 	if (ret != 1)
862 		return ret;
863 	if (copy_to_user(arg, &mig, sizeof(mig)))
864 		return -EFAULT;
865 	return 0;
866 }
867 
868 /* Ranges should fit into a single kernel page */
869 #define LOG_MAX_RANGES \
870 	(PAGE_SIZE / sizeof(struct vfio_device_feature_dma_logging_range))
871 
872 static int
873 vfio_ioctl_device_feature_logging_start(struct vfio_device *device,
874 					u32 flags, void __user *arg,
875 					size_t argsz)
876 {
877 	size_t minsz =
878 		offsetofend(struct vfio_device_feature_dma_logging_control,
879 			    ranges);
880 	struct vfio_device_feature_dma_logging_range __user *ranges;
881 	struct vfio_device_feature_dma_logging_control control;
882 	struct vfio_device_feature_dma_logging_range range;
883 	struct rb_root_cached root = RB_ROOT_CACHED;
884 	struct interval_tree_node *nodes;
885 	u64 iova_end;
886 	u32 nnodes;
887 	int i, ret;
888 
889 	if (!device->log_ops)
890 		return -ENOTTY;
891 
892 	ret = vfio_check_feature(flags, argsz,
893 				 VFIO_DEVICE_FEATURE_SET,
894 				 sizeof(control));
895 	if (ret != 1)
896 		return ret;
897 
898 	if (copy_from_user(&control, arg, minsz))
899 		return -EFAULT;
900 
901 	nnodes = control.num_ranges;
902 	if (!nnodes)
903 		return -EINVAL;
904 
905 	if (nnodes > LOG_MAX_RANGES)
906 		return -E2BIG;
907 
908 	ranges = u64_to_user_ptr(control.ranges);
909 	nodes = kmalloc_array(nnodes, sizeof(struct interval_tree_node),
910 			      GFP_KERNEL);
911 	if (!nodes)
912 		return -ENOMEM;
913 
914 	for (i = 0; i < nnodes; i++) {
915 		if (copy_from_user(&range, &ranges[i], sizeof(range))) {
916 			ret = -EFAULT;
917 			goto end;
918 		}
919 		if (!IS_ALIGNED(range.iova, control.page_size) ||
920 		    !IS_ALIGNED(range.length, control.page_size)) {
921 			ret = -EINVAL;
922 			goto end;
923 		}
924 
925 		if (check_add_overflow(range.iova, range.length, &iova_end) ||
926 		    iova_end > ULONG_MAX) {
927 			ret = -EOVERFLOW;
928 			goto end;
929 		}
930 
931 		nodes[i].start = range.iova;
932 		nodes[i].last = range.iova + range.length - 1;
933 		if (interval_tree_iter_first(&root, nodes[i].start,
934 					     nodes[i].last)) {
935 			/* Range overlapping */
936 			ret = -EINVAL;
937 			goto end;
938 		}
939 		interval_tree_insert(nodes + i, &root);
940 	}
941 
942 	ret = device->log_ops->log_start(device, &root, nnodes,
943 					 &control.page_size);
944 	if (ret)
945 		goto end;
946 
947 	if (copy_to_user(arg, &control, sizeof(control))) {
948 		ret = -EFAULT;
949 		device->log_ops->log_stop(device);
950 	}
951 
952 end:
953 	kfree(nodes);
954 	return ret;
955 }
956 
957 static int
958 vfio_ioctl_device_feature_logging_stop(struct vfio_device *device,
959 				       u32 flags, void __user *arg,
960 				       size_t argsz)
961 {
962 	int ret;
963 
964 	if (!device->log_ops)
965 		return -ENOTTY;
966 
967 	ret = vfio_check_feature(flags, argsz,
968 				 VFIO_DEVICE_FEATURE_SET, 0);
969 	if (ret != 1)
970 		return ret;
971 
972 	return device->log_ops->log_stop(device);
973 }
974 
975 static int vfio_device_log_read_and_clear(struct iova_bitmap *iter,
976 					  unsigned long iova, size_t length,
977 					  void *opaque)
978 {
979 	struct vfio_device *device = opaque;
980 
981 	return device->log_ops->log_read_and_clear(device, iova, length, iter);
982 }
983 
984 static int
985 vfio_ioctl_device_feature_logging_report(struct vfio_device *device,
986 					 u32 flags, void __user *arg,
987 					 size_t argsz)
988 {
989 	size_t minsz =
990 		offsetofend(struct vfio_device_feature_dma_logging_report,
991 			    bitmap);
992 	struct vfio_device_feature_dma_logging_report report;
993 	struct iova_bitmap *iter;
994 	u64 iova_end;
995 	int ret;
996 
997 	if (!device->log_ops)
998 		return -ENOTTY;
999 
1000 	ret = vfio_check_feature(flags, argsz,
1001 				 VFIO_DEVICE_FEATURE_GET,
1002 				 sizeof(report));
1003 	if (ret != 1)
1004 		return ret;
1005 
1006 	if (copy_from_user(&report, arg, minsz))
1007 		return -EFAULT;
1008 
1009 	if (report.page_size < SZ_4K || !is_power_of_2(report.page_size))
1010 		return -EINVAL;
1011 
1012 	if (check_add_overflow(report.iova, report.length, &iova_end) ||
1013 	    iova_end > ULONG_MAX)
1014 		return -EOVERFLOW;
1015 
1016 	iter = iova_bitmap_alloc(report.iova, report.length,
1017 				 report.page_size,
1018 				 u64_to_user_ptr(report.bitmap));
1019 	if (IS_ERR(iter))
1020 		return PTR_ERR(iter);
1021 
1022 	ret = iova_bitmap_for_each(iter, device,
1023 				   vfio_device_log_read_and_clear);
1024 
1025 	iova_bitmap_free(iter);
1026 	return ret;
1027 }
1028 
1029 static int vfio_ioctl_device_feature(struct vfio_device *device,
1030 				     struct vfio_device_feature __user *arg)
1031 {
1032 	size_t minsz = offsetofend(struct vfio_device_feature, flags);
1033 	struct vfio_device_feature feature;
1034 
1035 	if (copy_from_user(&feature, arg, minsz))
1036 		return -EFAULT;
1037 
1038 	if (feature.argsz < minsz)
1039 		return -EINVAL;
1040 
1041 	/* Check unknown flags */
1042 	if (feature.flags &
1043 	    ~(VFIO_DEVICE_FEATURE_MASK | VFIO_DEVICE_FEATURE_SET |
1044 	      VFIO_DEVICE_FEATURE_GET | VFIO_DEVICE_FEATURE_PROBE))
1045 		return -EINVAL;
1046 
1047 	/* GET & SET are mutually exclusive except with PROBE */
1048 	if (!(feature.flags & VFIO_DEVICE_FEATURE_PROBE) &&
1049 	    (feature.flags & VFIO_DEVICE_FEATURE_SET) &&
1050 	    (feature.flags & VFIO_DEVICE_FEATURE_GET))
1051 		return -EINVAL;
1052 
1053 	switch (feature.flags & VFIO_DEVICE_FEATURE_MASK) {
1054 	case VFIO_DEVICE_FEATURE_MIGRATION:
1055 		return vfio_ioctl_device_feature_migration(
1056 			device, feature.flags, arg->data,
1057 			feature.argsz - minsz);
1058 	case VFIO_DEVICE_FEATURE_MIG_DEVICE_STATE:
1059 		return vfio_ioctl_device_feature_mig_device_state(
1060 			device, feature.flags, arg->data,
1061 			feature.argsz - minsz);
1062 	case VFIO_DEVICE_FEATURE_DMA_LOGGING_START:
1063 		return vfio_ioctl_device_feature_logging_start(
1064 			device, feature.flags, arg->data,
1065 			feature.argsz - minsz);
1066 	case VFIO_DEVICE_FEATURE_DMA_LOGGING_STOP:
1067 		return vfio_ioctl_device_feature_logging_stop(
1068 			device, feature.flags, arg->data,
1069 			feature.argsz - minsz);
1070 	case VFIO_DEVICE_FEATURE_DMA_LOGGING_REPORT:
1071 		return vfio_ioctl_device_feature_logging_report(
1072 			device, feature.flags, arg->data,
1073 			feature.argsz - minsz);
1074 	case VFIO_DEVICE_FEATURE_MIG_DATA_SIZE:
1075 		return vfio_ioctl_device_feature_migration_data_size(
1076 			device, feature.flags, arg->data,
1077 			feature.argsz - minsz);
1078 	default:
1079 		if (unlikely(!device->ops->device_feature))
1080 			return -EINVAL;
1081 		return device->ops->device_feature(device, feature.flags,
1082 						   arg->data,
1083 						   feature.argsz - minsz);
1084 	}
1085 }
1086 
1087 static long vfio_device_fops_unl_ioctl(struct file *filep,
1088 				       unsigned int cmd, unsigned long arg)
1089 {
1090 	struct vfio_device *device = filep->private_data;
1091 	int ret;
1092 
1093 	ret = vfio_device_pm_runtime_get(device);
1094 	if (ret)
1095 		return ret;
1096 
1097 	switch (cmd) {
1098 	case VFIO_DEVICE_FEATURE:
1099 		ret = vfio_ioctl_device_feature(device, (void __user *)arg);
1100 		break;
1101 
1102 	default:
1103 		if (unlikely(!device->ops->ioctl))
1104 			ret = -EINVAL;
1105 		else
1106 			ret = device->ops->ioctl(device, cmd, arg);
1107 		break;
1108 	}
1109 
1110 	vfio_device_pm_runtime_put(device);
1111 	return ret;
1112 }
1113 
1114 static ssize_t vfio_device_fops_read(struct file *filep, char __user *buf,
1115 				     size_t count, loff_t *ppos)
1116 {
1117 	struct vfio_device *device = filep->private_data;
1118 
1119 	if (unlikely(!device->ops->read))
1120 		return -EINVAL;
1121 
1122 	return device->ops->read(device, buf, count, ppos);
1123 }
1124 
1125 static ssize_t vfio_device_fops_write(struct file *filep,
1126 				      const char __user *buf,
1127 				      size_t count, loff_t *ppos)
1128 {
1129 	struct vfio_device *device = filep->private_data;
1130 
1131 	if (unlikely(!device->ops->write))
1132 		return -EINVAL;
1133 
1134 	return device->ops->write(device, buf, count, ppos);
1135 }
1136 
1137 static int vfio_device_fops_mmap(struct file *filep, struct vm_area_struct *vma)
1138 {
1139 	struct vfio_device *device = filep->private_data;
1140 
1141 	if (unlikely(!device->ops->mmap))
1142 		return -EINVAL;
1143 
1144 	return device->ops->mmap(device, vma);
1145 }
1146 
1147 const struct file_operations vfio_device_fops = {
1148 	.owner		= THIS_MODULE,
1149 	.release	= vfio_device_fops_release,
1150 	.read		= vfio_device_fops_read,
1151 	.write		= vfio_device_fops_write,
1152 	.unlocked_ioctl	= vfio_device_fops_unl_ioctl,
1153 	.compat_ioctl	= compat_ptr_ioctl,
1154 	.mmap		= vfio_device_fops_mmap,
1155 };
1156 
1157 /*
1158  * Sub-module support
1159  */
1160 /*
1161  * Helper for managing a buffer of info chain capabilities, allocate or
1162  * reallocate a buffer with additional @size, filling in @id and @version
1163  * of the capability.  A pointer to the new capability is returned.
1164  *
1165  * NB. The chain is based at the head of the buffer, so new entries are
1166  * added to the tail, vfio_info_cap_shift() should be called to fixup the
1167  * next offsets prior to copying to the user buffer.
1168  */
1169 struct vfio_info_cap_header *vfio_info_cap_add(struct vfio_info_cap *caps,
1170 					       size_t size, u16 id, u16 version)
1171 {
1172 	void *buf;
1173 	struct vfio_info_cap_header *header, *tmp;
1174 
1175 	buf = krealloc(caps->buf, caps->size + size, GFP_KERNEL);
1176 	if (!buf) {
1177 		kfree(caps->buf);
1178 		caps->buf = NULL;
1179 		caps->size = 0;
1180 		return ERR_PTR(-ENOMEM);
1181 	}
1182 
1183 	caps->buf = buf;
1184 	header = buf + caps->size;
1185 
1186 	/* Eventually copied to user buffer, zero */
1187 	memset(header, 0, size);
1188 
1189 	header->id = id;
1190 	header->version = version;
1191 
1192 	/* Add to the end of the capability chain */
1193 	for (tmp = buf; tmp->next; tmp = buf + tmp->next)
1194 		; /* nothing */
1195 
1196 	tmp->next = caps->size;
1197 	caps->size += size;
1198 
1199 	return header;
1200 }
1201 EXPORT_SYMBOL_GPL(vfio_info_cap_add);
1202 
1203 void vfio_info_cap_shift(struct vfio_info_cap *caps, size_t offset)
1204 {
1205 	struct vfio_info_cap_header *tmp;
1206 	void *buf = (void *)caps->buf;
1207 
1208 	for (tmp = buf; tmp->next; tmp = buf + tmp->next - offset)
1209 		tmp->next += offset;
1210 }
1211 EXPORT_SYMBOL(vfio_info_cap_shift);
1212 
1213 int vfio_info_add_capability(struct vfio_info_cap *caps,
1214 			     struct vfio_info_cap_header *cap, size_t size)
1215 {
1216 	struct vfio_info_cap_header *header;
1217 
1218 	header = vfio_info_cap_add(caps, size, cap->id, cap->version);
1219 	if (IS_ERR(header))
1220 		return PTR_ERR(header);
1221 
1222 	memcpy(header + 1, cap + 1, size - sizeof(*header));
1223 
1224 	return 0;
1225 }
1226 EXPORT_SYMBOL(vfio_info_add_capability);
1227 
1228 int vfio_set_irqs_validate_and_prepare(struct vfio_irq_set *hdr, int num_irqs,
1229 				       int max_irq_type, size_t *data_size)
1230 {
1231 	unsigned long minsz;
1232 	size_t size;
1233 
1234 	minsz = offsetofend(struct vfio_irq_set, count);
1235 
1236 	if ((hdr->argsz < minsz) || (hdr->index >= max_irq_type) ||
1237 	    (hdr->count >= (U32_MAX - hdr->start)) ||
1238 	    (hdr->flags & ~(VFIO_IRQ_SET_DATA_TYPE_MASK |
1239 				VFIO_IRQ_SET_ACTION_TYPE_MASK)))
1240 		return -EINVAL;
1241 
1242 	if (data_size)
1243 		*data_size = 0;
1244 
1245 	if (hdr->start >= num_irqs || hdr->start + hdr->count > num_irqs)
1246 		return -EINVAL;
1247 
1248 	switch (hdr->flags & VFIO_IRQ_SET_DATA_TYPE_MASK) {
1249 	case VFIO_IRQ_SET_DATA_NONE:
1250 		size = 0;
1251 		break;
1252 	case VFIO_IRQ_SET_DATA_BOOL:
1253 		size = sizeof(uint8_t);
1254 		break;
1255 	case VFIO_IRQ_SET_DATA_EVENTFD:
1256 		size = sizeof(int32_t);
1257 		break;
1258 	default:
1259 		return -EINVAL;
1260 	}
1261 
1262 	if (size) {
1263 		if (hdr->argsz - minsz < hdr->count * size)
1264 			return -EINVAL;
1265 
1266 		if (!data_size)
1267 			return -EINVAL;
1268 
1269 		*data_size = hdr->count * size;
1270 	}
1271 
1272 	return 0;
1273 }
1274 EXPORT_SYMBOL(vfio_set_irqs_validate_and_prepare);
1275 
1276 /*
1277  * Pin contiguous user pages and return their associated host pages for local
1278  * domain only.
1279  * @device [in]  : device
1280  * @iova [in]    : starting IOVA of user pages to be pinned.
1281  * @npage [in]   : count of pages to be pinned.  This count should not
1282  *		   be greater than VFIO_PIN_PAGES_MAX_ENTRIES.
1283  * @prot [in]    : protection flags
1284  * @pages[out]   : array of host pages
1285  * Return error or number of pages pinned.
1286  *
1287  * A driver may only call this function if the vfio_device was created
1288  * by vfio_register_emulated_iommu_dev() due to vfio_device_container_pin_pages().
1289  */
1290 int vfio_pin_pages(struct vfio_device *device, dma_addr_t iova,
1291 		   int npage, int prot, struct page **pages)
1292 {
1293 	/* group->container cannot change while a vfio device is open */
1294 	if (!pages || !npage || WARN_ON(!vfio_assert_device_open(device)))
1295 		return -EINVAL;
1296 	if (vfio_device_has_container(device))
1297 		return vfio_device_container_pin_pages(device, iova,
1298 						       npage, prot, pages);
1299 	if (device->iommufd_access) {
1300 		int ret;
1301 
1302 		if (iova > ULONG_MAX)
1303 			return -EINVAL;
1304 		/*
1305 		 * VFIO ignores the sub page offset, npages is from the start of
1306 		 * a PAGE_SIZE chunk of IOVA. The caller is expected to recover
1307 		 * the sub page offset by doing:
1308 		 *     pages[0] + (iova % PAGE_SIZE)
1309 		 */
1310 		ret = iommufd_access_pin_pages(
1311 			device->iommufd_access, ALIGN_DOWN(iova, PAGE_SIZE),
1312 			npage * PAGE_SIZE, pages,
1313 			(prot & IOMMU_WRITE) ? IOMMUFD_ACCESS_RW_WRITE : 0);
1314 		if (ret)
1315 			return ret;
1316 		return npage;
1317 	}
1318 	return -EINVAL;
1319 }
1320 EXPORT_SYMBOL(vfio_pin_pages);
1321 
1322 /*
1323  * Unpin contiguous host pages for local domain only.
1324  * @device [in]  : device
1325  * @iova [in]    : starting address of user pages to be unpinned.
1326  * @npage [in]   : count of pages to be unpinned.  This count should not
1327  *                 be greater than VFIO_PIN_PAGES_MAX_ENTRIES.
1328  */
1329 void vfio_unpin_pages(struct vfio_device *device, dma_addr_t iova, int npage)
1330 {
1331 	if (WARN_ON(!vfio_assert_device_open(device)))
1332 		return;
1333 
1334 	if (vfio_device_has_container(device)) {
1335 		vfio_device_container_unpin_pages(device, iova, npage);
1336 		return;
1337 	}
1338 	if (device->iommufd_access) {
1339 		if (WARN_ON(iova > ULONG_MAX))
1340 			return;
1341 		iommufd_access_unpin_pages(device->iommufd_access,
1342 					   ALIGN_DOWN(iova, PAGE_SIZE),
1343 					   npage * PAGE_SIZE);
1344 		return;
1345 	}
1346 }
1347 EXPORT_SYMBOL(vfio_unpin_pages);
1348 
1349 /*
1350  * This interface allows the CPUs to perform some sort of virtual DMA on
1351  * behalf of the device.
1352  *
1353  * CPUs read/write from/into a range of IOVAs pointing to user space memory
1354  * into/from a kernel buffer.
1355  *
1356  * As the read/write of user space memory is conducted via the CPUs and is
1357  * not a real device DMA, it is not necessary to pin the user space memory.
1358  *
1359  * @device [in]		: VFIO device
1360  * @iova [in]		: base IOVA of a user space buffer
1361  * @data [in]		: pointer to kernel buffer
1362  * @len [in]		: kernel buffer length
1363  * @write		: indicate read or write
1364  * Return error code on failure or 0 on success.
1365  */
1366 int vfio_dma_rw(struct vfio_device *device, dma_addr_t iova, void *data,
1367 		size_t len, bool write)
1368 {
1369 	if (!data || len <= 0 || !vfio_assert_device_open(device))
1370 		return -EINVAL;
1371 
1372 	if (vfio_device_has_container(device))
1373 		return vfio_device_container_dma_rw(device, iova,
1374 						    data, len, write);
1375 
1376 	if (device->iommufd_access) {
1377 		unsigned int flags = 0;
1378 
1379 		if (iova > ULONG_MAX)
1380 			return -EINVAL;
1381 
1382 		/* VFIO historically tries to auto-detect a kthread */
1383 		if (!current->mm)
1384 			flags |= IOMMUFD_ACCESS_RW_KTHREAD;
1385 		if (write)
1386 			flags |= IOMMUFD_ACCESS_RW_WRITE;
1387 		return iommufd_access_rw(device->iommufd_access, iova, data,
1388 					 len, flags);
1389 	}
1390 	return -EINVAL;
1391 }
1392 EXPORT_SYMBOL(vfio_dma_rw);
1393 
1394 /*
1395  * Module/class support
1396  */
1397 static int __init vfio_init(void)
1398 {
1399 	int ret;
1400 
1401 	ida_init(&vfio.device_ida);
1402 
1403 	ret = vfio_group_init();
1404 	if (ret)
1405 		return ret;
1406 
1407 	ret = vfio_virqfd_init();
1408 	if (ret)
1409 		goto err_virqfd;
1410 
1411 	/* /sys/class/vfio-dev/vfioX */
1412 	vfio.device_class = class_create("vfio-dev");
1413 	if (IS_ERR(vfio.device_class)) {
1414 		ret = PTR_ERR(vfio.device_class);
1415 		goto err_dev_class;
1416 	}
1417 
1418 	pr_info(DRIVER_DESC " version: " DRIVER_VERSION "\n");
1419 	return 0;
1420 
1421 err_dev_class:
1422 	vfio_virqfd_exit();
1423 err_virqfd:
1424 	vfio_group_cleanup();
1425 	return ret;
1426 }
1427 
1428 static void __exit vfio_cleanup(void)
1429 {
1430 	ida_destroy(&vfio.device_ida);
1431 	class_destroy(vfio.device_class);
1432 	vfio.device_class = NULL;
1433 	vfio_virqfd_exit();
1434 	vfio_group_cleanup();
1435 	xa_destroy(&vfio_device_set_xa);
1436 }
1437 
1438 module_init(vfio_init);
1439 module_exit(vfio_cleanup);
1440 
1441 MODULE_VERSION(DRIVER_VERSION);
1442 MODULE_LICENSE("GPL v2");
1443 MODULE_AUTHOR(DRIVER_AUTHOR);
1444 MODULE_DESCRIPTION(DRIVER_DESC);
1445 MODULE_SOFTDEP("post: vfio_iommu_type1 vfio_iommu_spapr_tce");
1446