vfio: Support VFIO_NOIOMMU with iommufd

Add a small amount of emulation to vfio_compat to accept the SET_IOMMU to
VFIO_NOIOMMU_IOMMU and have vfio just ignore iommufd if it is working on a
no-iommu enabled device.

Move the enable_unsafe_noiommu_mode module out of container.c into
vfio_main.c so that it is always available even if VFIO_CONTAINER=n.

This passes Alex's mini-test:

https://github.com/awilliam/tests/blob/master/vfio-noiommu-pci-device-open.c

Link: https://lore.kernel.org/r/0-v3-480cd64a16f7+1ad0-iommufd_noiommu_jgg@nvidia.com
Reviewed-by: Kevin Tian <kevin.tian@intel.com>
Acked-by: Alex Williamson <alex.williamson@redhat.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>

diff --git a/drivers/iommu/iommufd/Kconfig b/drivers/iommu/iommufd/Kconfig
index 8306616b6d819802f1c8f8c1807d35506316bca6..ada693ea51a78e9e95289fda64afe0eb75b376b8 100644 (file)
--- a/drivers/iommu/iommufd/Kconfig
+++ b/drivers/iommu/iommufd/Kconfig
@@ -23,7 +23,7 @@ config IOMMUFD_VFIO_CONTAINER
          removed.
 
          IOMMUFD VFIO container emulation is known to lack certain features
-         of the native VFIO container, such as no-IOMMU support, peer-to-peer
+         of the native VFIO container, such as peer-to-peer
          DMA mapping, PPC IOMMU support, as well as other potentially
          undiscovered gaps.  This option is currently intended for the
          purpose of testing IOMMUFD with unmodified userspace supporting VFIO

diff --git a/drivers/iommu/iommufd/iommufd_private.h b/drivers/iommu/iommufd/iommufd_private.h
index 222e86591f8ac98a5ac11a5e56fb9245d16a35d4..9d7f71510ca1bc2277d788fe8ee16e4fa1f1ed2a 100644 (file)
--- a/drivers/iommu/iommufd/iommufd_private.h
+++ b/drivers/iommu/iommufd/iommufd_private.h
@@ -18,6 +18,8 @@ struct iommufd_ctx {
        struct xarray objects;
 
        u8 account_mode;
+       /* Compatibility with VFIO no iommu */
+       u8 no_iommu_mode;
        struct iommufd_ioas *vfio_ioas;
 };
 

diff --git a/drivers/iommu/iommufd/vfio_compat.c b/drivers/iommu/iommufd/vfio_compat.c
index 3ceca0e8311c39fab2a4a1f06664d7dc4742cc81..8e38bb02d5e1e6002f4cda8f2bcb739c45051b85 100644 (file)
--- a/drivers/iommu/iommufd/vfio_compat.c
+++ b/drivers/iommu/iommufd/vfio_compat.c
@@ -26,39 +26,84 @@ out_unlock:
 }
 
 /**
- * iommufd_vfio_compat_ioas_id - Return the IOAS ID that vfio should use
+ * iommufd_vfio_compat_ioas_get_id - Ensure a compat IOAS exists
+ * @ictx: Context to operate on
+ * @out_ioas_id: The IOAS ID of the compatibility IOAS
+ *
+ * Return the ID of the current compatibility IOAS. The ID can be passed into
+ * other functions that take an ioas_id.
+ */
+int iommufd_vfio_compat_ioas_get_id(struct iommufd_ctx *ictx, u32 *out_ioas_id)
+{
+       struct iommufd_ioas *ioas;
+
+       ioas = get_compat_ioas(ictx);
+       if (IS_ERR(ioas))
+               return PTR_ERR(ioas);
+       *out_ioas_id = ioas->obj.id;
+       iommufd_put_object(&ioas->obj);
+       return 0;
+}
+EXPORT_SYMBOL_NS_GPL(iommufd_vfio_compat_ioas_get_id, IOMMUFD_VFIO);
+
+/**
+ * iommufd_vfio_compat_set_no_iommu - Called when a no-iommu device is attached
+ * @ictx: Context to operate on
+ *
+ * This allows selecting the VFIO_NOIOMMU_IOMMU and blocks normal types.
+ */
+int iommufd_vfio_compat_set_no_iommu(struct iommufd_ctx *ictx)
+{
+       int ret;
+
+       xa_lock(&ictx->objects);
+       if (!ictx->vfio_ioas) {
+               ictx->no_iommu_mode = 1;
+               ret = 0;
+       } else {
+               ret = -EINVAL;
+       }
+       xa_unlock(&ictx->objects);
+       return ret;
+}
+EXPORT_SYMBOL_NS_GPL(iommufd_vfio_compat_set_no_iommu, IOMMUFD_VFIO);
+
+/**
+ * iommufd_vfio_compat_ioas_create - Ensure the compat IOAS is created
  * @ictx: Context to operate on
- * @out_ioas_id: The ioas_id the caller should use
  *
  * The compatibility IOAS is the IOAS that the vfio compatibility ioctls operate
  * on since they do not have an IOAS ID input in their ABI. Only attaching a
- * group should cause a default creation of the internal ioas, this returns the
- * existing ioas if it has already been assigned somehow.
+ * group should cause a default creation of the internal ioas, this does nothing
+ * if an existing ioas has already been assigned somehow.
  */
-int iommufd_vfio_compat_ioas_id(struct iommufd_ctx *ictx, u32 *out_ioas_id)
+int iommufd_vfio_compat_ioas_create(struct iommufd_ctx *ictx)
 {
        struct iommufd_ioas *ioas = NULL;
-       struct iommufd_ioas *out_ioas;
+       int ret;
 
        ioas = iommufd_ioas_alloc(ictx);
        if (IS_ERR(ioas))
                return PTR_ERR(ioas);
 
        xa_lock(&ictx->objects);
-       if (ictx->vfio_ioas && iommufd_lock_obj(&ictx->vfio_ioas->obj))
-               out_ioas = ictx->vfio_ioas;
-       else {
-               out_ioas = ioas;
-               ictx->vfio_ioas = ioas;
+       /*
+        * VFIO won't allow attaching a container to both iommu and no iommu
+        * operation
+        */
+       if (ictx->no_iommu_mode) {
+               ret = -EINVAL;
+               goto out_abort;
        }
-       xa_unlock(&ictx->objects);
 
-       *out_ioas_id = out_ioas->obj.id;
-       if (out_ioas != ioas) {
-               iommufd_put_object(&out_ioas->obj);
-               iommufd_object_abort(ictx, &ioas->obj);
-               return 0;
+       if (ictx->vfio_ioas && iommufd_lock_obj(&ictx->vfio_ioas->obj)) {
+               ret = 0;
+               iommufd_put_object(&ictx->vfio_ioas->obj);
+               goto out_abort;
        }
+       ictx->vfio_ioas = ioas;
+       xa_unlock(&ictx->objects);
+
        /*
         * An automatically created compat IOAS is treated as a userspace
         * created object. Userspace can learn the ID via IOMMU_VFIO_IOAS_GET,
@@ -67,8 +112,13 @@ int iommufd_vfio_compat_ioas_id(struct iommufd_ctx *ictx, u32 *out_ioas_id)
         */
        iommufd_object_finalize(ictx, &ioas->obj);
        return 0;
+
+out_abort:
+       xa_unlock(&ictx->objects);
+       iommufd_object_abort(ictx, &ioas->obj);
+       return ret;
 }
-EXPORT_SYMBOL_NS_GPL(iommufd_vfio_compat_ioas_id, IOMMUFD_VFIO);
+EXPORT_SYMBOL_NS_GPL(iommufd_vfio_compat_ioas_create, IOMMUFD_VFIO);
 
 int iommufd_vfio_ioas(struct iommufd_ucmd *ucmd)
 {
@@ -235,6 +285,9 @@ static int iommufd_vfio_check_extension(struct iommufd_ctx *ictx,
        case VFIO_UNMAP_ALL:
                return 1;
 
+       case VFIO_NOIOMMU_IOMMU:
+               return IS_ENABLED(CONFIG_VFIO_NOIOMMU);
+
        case VFIO_DMA_CC_IOMMU:
                return iommufd_vfio_cc_iommu(ictx);
 
@@ -261,10 +314,24 @@ static int iommufd_vfio_check_extension(struct iommufd_ctx *ictx,
 
 static int iommufd_vfio_set_iommu(struct iommufd_ctx *ictx, unsigned long type)
 {
+       bool no_iommu_mode = READ_ONCE(ictx->no_iommu_mode);
        struct iommufd_ioas *ioas = NULL;
        int rc = 0;
 
-       if (type != VFIO_TYPE1_IOMMU && type != VFIO_TYPE1v2_IOMMU)
+       /*
+        * Emulation for NOIOMMU is imperfect in that VFIO blocks almost all
+        * other ioctls. We let them keep working but they mostly fail since no
+        * IOAS should exist.
+        */
+       if (IS_ENABLED(CONFIG_VFIO_NOIOMMU) && type == VFIO_NOIOMMU_IOMMU &&
+           no_iommu_mode) {
+               if (!capable(CAP_SYS_RAWIO))
+                       return -EPERM;
+               return 0;
+       }
+
+       if ((type != VFIO_TYPE1_IOMMU && type != VFIO_TYPE1v2_IOMMU) ||
+           no_iommu_mode)
                return -EINVAL;
 
        /* VFIO fails the set_iommu if there is no group */

diff --git a/drivers/vfio/Kconfig b/drivers/vfio/Kconfig
index a8f54462946742661820ed9dd42560a54aa0ceb4..89e06c981e435d45fa86425e8e622eaff1185a85 100644 (file)
--- a/drivers/vfio/Kconfig
+++ b/drivers/vfio/Kconfig
@@ -32,6 +32,7 @@ config VFIO_IOMMU_SPAPR_TCE
        tristate
        depends on SPAPR_TCE_IOMMU
        default VFIO
+endif
 
 config VFIO_NOIOMMU
        bool "VFIO No-IOMMU support"
@@ -46,7 +47,6 @@ config VFIO_NOIOMMU
          this mode since there is no IOMMU to provide DMA translation.
 
          If you don't know what to do here, say N.
-endif
 
 config VFIO_VIRQFD
        bool

diff --git a/drivers/vfio/container.c b/drivers/vfio/container.c
index b7a9560ab25e486ae88c4dfe9feab750972a22fb..89f10becf96255c92a7b3a8a1efd22b10a608f71 100644 (file)
--- a/drivers/vfio/container.c
+++ b/drivers/vfio/container.c
@@ -29,13 +29,6 @@ static struct vfio {
        struct mutex                    iommu_drivers_lock;
 } vfio;
 
-#ifdef CONFIG_VFIO_NOIOMMU
-bool vfio_noiommu __read_mostly;
-module_param_named(enable_unsafe_noiommu_mode,
-                  vfio_noiommu, bool, S_IRUGO | S_IWUSR);
-MODULE_PARM_DESC(enable_unsafe_noiommu_mode, "Enable UNSAFE, no-IOMMU mode.  This mode provides no device isolation, no DMA translation, no host kernel protection, cannot be used for device assignment to virtual machines, requires RAWIO permissions, and will taint the kernel.  If you do not know what this is for, step away. (default: false)");
-#endif
-
 static void *vfio_noiommu_open(unsigned long arg)
 {
        if (arg != VFIO_NOIOMMU_IOMMU)

diff --git a/drivers/vfio/group.c b/drivers/vfio/group.c
index bb24b2f0271e03c3b1a027b0ef8e717951f157ab..e166ad7ce6e75529d9ce922b5500456899b314d1 100644 (file)
--- a/drivers/vfio/group.c
+++ b/drivers/vfio/group.c
@@ -133,9 +133,12 @@ static int vfio_group_ioctl_set_container(struct vfio_group *group,
 
        iommufd = iommufd_ctx_from_file(f.file);
        if (!IS_ERR(iommufd)) {
-               u32 ioas_id;
+               if (IS_ENABLED(CONFIG_VFIO_NOIOMMU) &&
+                   group->type == VFIO_NO_IOMMU)
+                       ret = iommufd_vfio_compat_set_no_iommu(iommufd);
+               else
+                       ret = iommufd_vfio_compat_ioas_create(iommufd);
 
-               ret = iommufd_vfio_compat_ioas_id(iommufd, &ioas_id);
                if (ret) {
                        iommufd_ctx_put(group->iommufd);
                        goto out_unlock;

diff --git a/drivers/vfio/iommufd.c b/drivers/vfio/iommufd.c
index 4f82a6fa7c6c7fcc25da29c4a497ee673f34d618..db4efbd560425fafeac42b02b5fb2ef6b798028e 100644 (file)
--- a/drivers/vfio/iommufd.c
+++ b/drivers/vfio/iommufd.c
@@ -18,6 +18,20 @@ int vfio_iommufd_bind(struct vfio_device *vdev, struct iommufd_ctx *ictx)
 
        lockdep_assert_held(&vdev->dev_set->lock);
 
+       if (vfio_device_is_noiommu(vdev)) {
+               if (!capable(CAP_SYS_RAWIO))
+                       return -EPERM;
+
+               /*
+                * Require no compat ioas to be assigned to proceed. The basic
+                * statement is that the user cannot have done something that
+                * implies they expected translation to exist
+                */
+               if (!iommufd_vfio_compat_ioas_get_id(ictx, &ioas_id))
+                       return -EPERM;
+               return 0;
+       }
+
        /*
         * If the driver doesn't provide this op then it means the device does
         * not do DMA at all. So nothing to do.
@@ -29,7 +43,7 @@ int vfio_iommufd_bind(struct vfio_device *vdev, struct iommufd_ctx *ictx)
        if (ret)
                return ret;
 
-       ret = iommufd_vfio_compat_ioas_id(ictx, &ioas_id);
+       ret = iommufd_vfio_compat_ioas_get_id(ictx, &ioas_id);
        if (ret)
                goto err_unbind;
        ret = vdev->ops->attach_ioas(vdev, &ioas_id);
@@ -52,6 +66,9 @@ void vfio_iommufd_unbind(struct vfio_device *vdev)
 {
        lockdep_assert_held(&vdev->dev_set->lock);
 
+       if (vfio_device_is_noiommu(vdev))
+               return;
+
        if (vdev->ops->unbind_iommufd)
                vdev->ops->unbind_iommufd(vdev);
 }

diff --git a/drivers/vfio/vfio.h b/drivers/vfio/vfio.h
index f8219a438bfbf58d3f7c08e907a3dc4f660dfed5..9e94abcf8ee1a83cf7c76899e8862a88e698befe 100644 (file)
--- a/drivers/vfio/vfio.h
+++ b/drivers/vfio/vfio.h
@@ -10,10 +10,10 @@
 #include <linux/device.h>
 #include <linux/cdev.h>
 #include <linux/module.h>
+#include <linux/vfio.h>
 
 struct iommufd_ctx;
 struct iommu_group;
-struct vfio_device;
 struct vfio_container;
 
 void vfio_device_put_registration(struct vfio_device *device);
@@ -88,6 +88,12 @@ bool vfio_device_has_container(struct vfio_device *device);
 int __init vfio_group_init(void);
 void vfio_group_cleanup(void);
 
+static inline bool vfio_device_is_noiommu(struct vfio_device *vdev)
+{
+       return IS_ENABLED(CONFIG_VFIO_NOIOMMU) &&
+              vdev->group->type == VFIO_NO_IOMMU;
+}
+
 #if IS_ENABLED(CONFIG_VFIO_CONTAINER)
 /* events for the backend driver notify callback */
 enum vfio_iommu_notify_type {

diff --git a/drivers/vfio/vfio_main.c b/drivers/vfio/vfio_main.c
index 5177bb061b17b51b9e8e9030d9bdf13c0b6a2b4a..90541fc949888c1859b988ff86421364e172581f 100644 (file)
--- a/drivers/vfio/vfio_main.c
+++ b/drivers/vfio/vfio_main.c
@@ -45,6 +45,13 @@ static struct vfio {
        struct ida                      device_ida;
 } vfio;
 
+#ifdef CONFIG_VFIO_NOIOMMU
+bool vfio_noiommu __read_mostly;
+module_param_named(enable_unsafe_noiommu_mode,
+                  vfio_noiommu, bool, S_IRUGO | S_IWUSR);
+MODULE_PARM_DESC(enable_unsafe_noiommu_mode, "Enable UNSAFE, no-IOMMU mode.  This mode provides no device isolation, no DMA translation, no host kernel protection, cannot be used for device assignment to virtual machines, requires RAWIO permissions, and will taint the kernel.  If you do not know what this is for, step away. (default: false)");
+#endif
+
 static DEFINE_XARRAY(vfio_device_set_xa);
 
 int vfio_assign_device_set(struct vfio_device *device, void *set_id)

diff --git a/include/linux/iommufd.h b/include/linux/iommufd.h
index 650d45629647a708534212dd34ec266d8df5e2c9..c0b5b3ac34f1e0316ee1a8b49c570067434a9c93 100644 (file)
--- a/include/linux/iommufd.h
+++ b/include/linux/iommufd.h
@@ -57,7 +57,9 @@ void iommufd_access_unpin_pages(struct iommufd_access *access,
                                unsigned long iova, unsigned long length);
 int iommufd_access_rw(struct iommufd_access *access, unsigned long iova,
                      void *data, size_t len, unsigned int flags);
-int iommufd_vfio_compat_ioas_id(struct iommufd_ctx *ictx, u32 *out_ioas_id);
+int iommufd_vfio_compat_ioas_get_id(struct iommufd_ctx *ictx, u32 *out_ioas_id);
+int iommufd_vfio_compat_ioas_create(struct iommufd_ctx *ictx);
+int iommufd_vfio_compat_set_no_iommu(struct iommufd_ctx *ictx);
 #else /* !CONFIG_IOMMUFD */
 static inline struct iommufd_ctx *iommufd_ctx_from_file(struct file *file)
 {
@@ -89,8 +91,12 @@ static inline int iommufd_access_rw(struct iommufd_access *access, unsigned long
        return -EOPNOTSUPP;
 }
 
-static inline int iommufd_vfio_compat_ioas_id(struct iommufd_ctx *ictx,
-                                             u32 *out_ioas_id)
+static inline int iommufd_vfio_compat_ioas_create(struct iommufd_ctx *ictx)
+{
+       return -EOPNOTSUPP;
+}
+
+static inline int iommufd_vfio_compat_set_no_iommu(struct iommufd_ctx *ictx)
 {
        return -EOPNOTSUPP;
 }