vfio-iommufd: Allow iommufd to be used in place of a container fd

This makes VFIO_GROUP_SET_CONTAINER accept both a vfio container FD and an
iommufd.

In iommufd mode an IOAS will exist after the SET_CONTAINER, but it will
not be attached to any groups.

For VFIO this means that the VFIO_GROUP_GET_STATUS and
VFIO_GROUP_FLAGS_VIABLE works subtly differently. With the container FD
the iommu_group_claim_dma_owner() is done during SET_CONTAINER but for
IOMMUFD this is done during VFIO_GROUP_GET_DEVICE_FD. Meaning that
VFIO_GROUP_FLAGS_VIABLE could be set but GET_DEVICE_FD will fail due to
viability.

As GET_DEVICE_FD can fail for many reasons already this is not expected to
be a meaningful difference.

Reorganize the tests for if the group has an assigned container or iommu
into a vfio_group_has_iommu() function and consolidate all the duplicated
WARN_ON's etc related to this.

Call container functions only if a container is actually present on the
group.

Link: https://lore.kernel.org/r/5-v4-42cd2eb0e3eb+335a-vfio_iommufd_jgg@nvidia.com
Reviewed-by: Kevin Tian <kevin.tian@intel.com>
Reviewed-by: Alex Williamson <alex.williamson@redhat.com>
Tested-by: Alex Williamson <alex.williamson@redhat.com>
Tested-by: Nicolin Chen <nicolinc@nvidia.com>
Tested-by: Yi Liu <yi.l.liu@intel.com>
Tested-by: Lixiao Yang <lixiao.yang@intel.com>
Tested-by: Matthew Rosato <mjrosato@linux.ibm.com>
Tested-by: Yu He <yu.he@intel.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>

diff --git a/drivers/vfio/Kconfig b/drivers/vfio/Kconfig
index 86c381ceb9a1e95e95643dcce8a20fc74c5b1559..1118d322eec97d6671ba74426fb3ad02f409d011 100644 (file)
--- a/drivers/vfio/Kconfig
+++ b/drivers/vfio/Kconfig
@@ -2,6 +2,7 @@
 menuconfig VFIO
        tristate "VFIO Non-Privileged userspace driver framework"
        select IOMMU_API
+       depends on IOMMUFD || !IOMMUFD
        select VFIO_IOMMU_TYPE1 if MMU && (X86 || S390 || ARM || ARM64)
        select INTERVAL_TREE
        help

diff --git a/drivers/vfio/container.c b/drivers/vfio/container.c
index d97747dfb05d02b93c89336b64969763bf2f4495..8772dad680853916ea02aad5fe6ff8b0ba5304ac 100644 (file)
--- a/drivers/vfio/container.c
+++ b/drivers/vfio/container.c
@@ -516,8 +516,11 @@ int vfio_group_use_container(struct vfio_group *group)
 {
        lockdep_assert_held(&group->group_lock);
 
-       if (!group->container || !group->container->iommu_driver ||
-           WARN_ON(!group->container_users))
+       /*
+        * The container fd has been assigned with VFIO_GROUP_SET_CONTAINER but
+        * VFIO_SET_IOMMU hasn't been done yet.
+        */
+       if (!group->container->iommu_driver)
                return -EINVAL;
 
        if (group->type == VFIO_NO_IOMMU && !capable(CAP_SYS_RAWIO))

diff --git a/drivers/vfio/vfio.h b/drivers/vfio/vfio.h
index 731561258704279d033e24cb5a26a3d36d6ae286..a9dd0615266cb996bde8f656ecdff1240729ae2c 100644 (file)
--- a/drivers/vfio/vfio.h
+++ b/drivers/vfio/vfio.h
@@ -10,6 +10,7 @@
 #include <linux/cdev.h>
 #include <linux/module.h>
 
+struct iommufd_ctx;
 struct iommu_group;
 struct vfio_device;
 struct vfio_container;
@@ -60,6 +61,7 @@ struct vfio_group {
        struct kvm                      *kvm;
        struct file                     *opened_file;
        struct blocking_notifier_head   notifier;
+       struct iommufd_ctx              *iommufd;
 };
 
 /* events for the backend driver notify callback */

diff --git a/drivers/vfio/vfio_main.c b/drivers/vfio/vfio_main.c
index 77d6c0ba6a83026af928f1acbbe9f7894691a41e..f11157d056e6cc286f8d45cad5ff028cf6c0396a 100644 (file)
--- a/drivers/vfio/vfio_main.c
+++ b/drivers/vfio/vfio_main.c
@@ -35,6 +35,7 @@
 #include <linux/pm_runtime.h>
 #include <linux/interval_tree.h>
 #include <linux/iova_bitmap.h>
+#include <linux/iommufd.h>
 #include "vfio.h"
 
 #define DRIVER_VERSION "0.3"
@@ -662,6 +663,18 @@ EXPORT_SYMBOL_GPL(vfio_unregister_group_dev);
 /*
  * VFIO Group fd, /dev/vfio/$GROUP
  */
+static bool vfio_group_has_iommu(struct vfio_group *group)
+{
+       lockdep_assert_held(&group->group_lock);
+       /*
+        * There can only be users if there is a container, and if there is a
+        * container there must be users.
+        */
+       WARN_ON(!group->container != !group->container_users);
+
+       return group->container || group->iommufd;
+}
+
 /*
  * VFIO_GROUP_UNSET_CONTAINER should fail if there are other users or
  * if there was no container to unset.  Since the ioctl is called on
@@ -673,15 +686,21 @@ static int vfio_group_ioctl_unset_container(struct vfio_group *group)
        int ret = 0;
 
        mutex_lock(&group->group_lock);
-       if (!group->container) {
+       if (!vfio_group_has_iommu(group)) {
                ret = -EINVAL;
                goto out_unlock;
        }
-       if (group->container_users != 1) {
-               ret = -EBUSY;
-               goto out_unlock;
+       if (group->container) {
+               if (group->container_users != 1) {
+                       ret = -EBUSY;
+                       goto out_unlock;
+               }
+               vfio_group_detach_container(group);
+       }
+       if (group->iommufd) {
+               iommufd_ctx_put(group->iommufd);
+               group->iommufd = NULL;
        }
-       vfio_group_detach_container(group);
 
 out_unlock:
        mutex_unlock(&group->group_lock);
@@ -692,6 +711,7 @@ static int vfio_group_ioctl_set_container(struct vfio_group *group,
                                          int __user *arg)
 {
        struct vfio_container *container;
+       struct iommufd_ctx *iommufd;
        struct fd f;
        int ret;
        int fd;
@@ -704,7 +724,7 @@ static int vfio_group_ioctl_set_container(struct vfio_group *group,
                return -EBADF;
 
        mutex_lock(&group->group_lock);
-       if (group->container || WARN_ON(group->container_users)) {
+       if (vfio_group_has_iommu(group)) {
                ret = -EINVAL;
                goto out_unlock;
        }
@@ -714,12 +734,28 @@ static int vfio_group_ioctl_set_container(struct vfio_group *group,
        }
 
        container = vfio_container_from_file(f.file);
-       ret = -EINVAL;
        if (container) {
                ret = vfio_container_attach_group(container, group);
                goto out_unlock;
        }
 
+       iommufd = iommufd_ctx_from_file(f.file);
+       if (!IS_ERR(iommufd)) {
+               u32 ioas_id;
+
+               ret = iommufd_vfio_compat_ioas_id(iommufd, &ioas_id);
+               if (ret) {
+                       iommufd_ctx_put(group->iommufd);
+                       goto out_unlock;
+               }
+
+               group->iommufd = iommufd;
+               goto out_unlock;
+       }
+
+       /* The FD passed is not recognized. */
+       ret = -EBADFD;
+
 out_unlock:
        mutex_unlock(&group->group_lock);
        fdput(f);
@@ -749,9 +785,16 @@ static int vfio_device_first_open(struct vfio_device *device)
         * during close_device.
         */
        mutex_lock(&device->group->group_lock);
-       ret = vfio_group_use_container(device->group);
-       if (ret)
+       if (!vfio_group_has_iommu(device->group)) {
+               ret = -EINVAL;
                goto err_module_put;
+       }
+
+       if (device->group->container) {
+               ret = vfio_group_use_container(device->group);
+               if (ret)
+                       goto err_module_put;
+       }
 
        device->kvm = device->group->kvm;
        if (device->ops->open_device) {
@@ -759,13 +802,15 @@ static int vfio_device_first_open(struct vfio_device *device)
                if (ret)
                        goto err_container;
        }
-       vfio_device_container_register(device);
+       if (device->group->container)
+               vfio_device_container_register(device);
        mutex_unlock(&device->group->group_lock);
        return 0;
 
 err_container:
        device->kvm = NULL;
-       vfio_group_unuse_container(device->group);
+       if (device->group->container)
+               vfio_group_unuse_container(device->group);
 err_module_put:
        mutex_unlock(&device->group->group_lock);
        module_put(device->dev->driver->owner);
@@ -777,11 +822,13 @@ static void vfio_device_last_close(struct vfio_device *device)
        lockdep_assert_held(&device->dev_set->lock);
 
        mutex_lock(&device->group->group_lock);
-       vfio_device_container_unregister(device);
+       if (device->group->container)
+               vfio_device_container_unregister(device);
        if (device->ops->close_device)
                device->ops->close_device(device);
        device->kvm = NULL;
-       vfio_group_unuse_container(device->group);
+       if (device->group->container)
+               vfio_group_unuse_container(device->group);
        mutex_unlock(&device->group->group_lock);
        module_put(device->dev->driver->owner);
 }
@@ -897,7 +944,14 @@ static int vfio_group_ioctl_get_status(struct vfio_group *group,
                return -ENODEV;
        }
 
-       if (group->container)
+       /*
+        * With the container FD the iommu_group_claim_dma_owner() is done
+        * during SET_CONTAINER but for IOMMFD this is done during
+        * VFIO_GROUP_GET_DEVICE_FD. Meaning that with iommufd
+        * VFIO_GROUP_FLAGS_VIABLE could be set but GET_DEVICE_FD will fail due
+        * to viability.
+        */
+       if (vfio_group_has_iommu(group))
                status.flags |= VFIO_GROUP_FLAGS_CONTAINER_SET |
                                VFIO_GROUP_FLAGS_VIABLE;
        else if (!iommu_group_dma_owner_claimed(group->iommu_group))
@@ -980,6 +1034,10 @@ static int vfio_group_fops_release(struct inode *inode, struct file *filep)
        WARN_ON(group->notifier.head);
        if (group->container)
                vfio_group_detach_container(group);
+       if (group->iommufd) {
+               iommufd_ctx_put(group->iommufd);
+               group->iommufd = NULL;
+       }
        group->opened_file = NULL;
        mutex_unlock(&group->group_lock);
        return 0;
@@ -1878,6 +1936,8 @@ static void __exit vfio_cleanup(void)
 module_init(vfio_init);
 module_exit(vfio_cleanup);
 
+MODULE_IMPORT_NS(IOMMUFD);
+MODULE_IMPORT_NS(IOMMUFD_VFIO);
 MODULE_VERSION(DRIVER_VERSION);
 MODULE_LICENSE("GPL v2");
 MODULE_AUTHOR(DRIVER_AUTHOR);