1 // SPDX-License-Identifier: GPL-2.0-only
2 /* Copyright (C) 2021 Intel Corporation
3 * Copyright (c) 2021-2022, NVIDIA CORPORATION & AFFILIATES
5 * iommufd provides control over the IOMMU HW objects created by IOMMU kernel
6 * drivers. IOMMU HW objects revolve around IO page tables that map incoming DMA
7 * addresses (IOVA) to CPU addresses.
9 #define pr_fmt(fmt) "iommufd: " fmt
11 #include <linux/bug.h>
12 #include <linux/file.h>
14 #include <linux/iommufd.h>
15 #include <linux/miscdevice.h>
16 #include <linux/module.h>
17 #include <linux/mutex.h>
18 #include <linux/slab.h>
19 #include <uapi/linux/iommufd.h>
21 #include "io_pagetable.h"
22 #include "iommufd_private.h"
23 #include "iommufd_test.h"
25 struct iommufd_object_ops {
26 void (*destroy)(struct iommufd_object *obj);
27 void (*abort)(struct iommufd_object *obj);
29 static const struct iommufd_object_ops iommufd_object_ops[];
30 static struct miscdevice vfio_misc_dev;
33 * Allow concurrent access to the object.
35 * Once another thread can see the object pointer it can prevent object
36 * destruction. Expect for special kernel-only objects there is no in-kernel way
37 * to reliably destroy a single object. Thus all APIs that are creating objects
38 * must use iommufd_object_abort() to handle their errors and only call
39 * iommufd_object_finalize() once object creation cannot fail.
41 void iommufd_object_finalize(struct iommufd_ctx *ictx,
42 struct iommufd_object *obj)
44 XA_STATE(xas, &ictx->objects, obj->id);
47 xa_lock(&ictx->objects);
48 old = xas_store(&xas, obj);
49 xa_unlock(&ictx->objects);
50 /* obj->id was returned from xa_alloc() so the xas_store() cannot fail */
51 WARN_ON(old != XA_ZERO_ENTRY);
54 /* Undo _iommufd_object_alloc() if iommufd_object_finalize() was not called */
55 void iommufd_object_abort(struct iommufd_ctx *ictx, struct iommufd_object *obj)
57 XA_STATE(xas, &ictx->objects, obj->id);
60 xa_lock(&ictx->objects);
61 old = xas_store(&xas, NULL);
62 xa_unlock(&ictx->objects);
63 WARN_ON(old != XA_ZERO_ENTRY);
68 * Abort an object that has been fully initialized and needs destroy, but has
71 void iommufd_object_abort_and_destroy(struct iommufd_ctx *ictx,
72 struct iommufd_object *obj)
74 if (iommufd_object_ops[obj->type].abort)
75 iommufd_object_ops[obj->type].abort(obj);
77 iommufd_object_ops[obj->type].destroy(obj);
78 iommufd_object_abort(ictx, obj);
81 struct iommufd_object *iommufd_get_object(struct iommufd_ctx *ictx, u32 id,
82 enum iommufd_object_type type)
84 struct iommufd_object *obj;
86 if (iommufd_should_fail())
87 return ERR_PTR(-ENOENT);
89 xa_lock(&ictx->objects);
90 obj = xa_load(&ictx->objects, id);
91 if (!obj || (type != IOMMUFD_OBJ_ANY && obj->type != type) ||
92 !iommufd_lock_obj(obj))
93 obj = ERR_PTR(-ENOENT);
94 xa_unlock(&ictx->objects);
98 static int iommufd_object_dec_wait_shortterm(struct iommufd_ctx *ictx,
99 struct iommufd_object *to_destroy)
101 if (refcount_dec_and_test(&to_destroy->shortterm_users))
104 if (wait_event_timeout(ictx->destroy_wait,
105 refcount_read(&to_destroy->shortterm_users) ==
107 msecs_to_jiffies(60000)))
110 pr_crit("Time out waiting for iommufd object to become free\n");
111 refcount_inc(&to_destroy->shortterm_users);
116 * Remove the given object id from the xarray if the only reference to the
117 * object is held by the xarray.
119 int iommufd_object_remove(struct iommufd_ctx *ictx,
120 struct iommufd_object *to_destroy, u32 id,
123 struct iommufd_object *obj;
124 XA_STATE(xas, &ictx->objects, id);
125 bool zerod_shortterm = false;
129 * The purpose of the shortterm_users is to ensure deterministic
130 * destruction of objects used by external drivers and destroyed by this
131 * function. Any temporary increment of the refcount must increment
132 * shortterm_users, such as during ioctl execution.
134 if (flags & REMOVE_WAIT_SHORTTERM) {
135 ret = iommufd_object_dec_wait_shortterm(ictx, to_destroy);
138 * We have a bug. Put back the callers reference and
139 * defer cleaning this object until close.
141 refcount_dec(&to_destroy->users);
144 zerod_shortterm = true;
147 xa_lock(&ictx->objects);
148 obj = xas_load(&xas);
151 * If the caller is holding a ref on obj we put it here under
154 refcount_dec(&obj->users);
156 if (WARN_ON(obj != to_destroy)) {
160 } else if (xa_is_zero(obj) || !obj) {
165 if (!refcount_dec_if_one(&obj->users)) {
170 xas_store(&xas, NULL);
171 if (ictx->vfio_ioas == container_of(obj, struct iommufd_ioas, obj))
172 ictx->vfio_ioas = NULL;
173 xa_unlock(&ictx->objects);
176 * Since users is zero any positive users_shortterm must be racing
177 * iommufd_put_object(), or we have a bug.
179 if (!zerod_shortterm) {
180 ret = iommufd_object_dec_wait_shortterm(ictx, obj);
185 iommufd_object_ops[obj->type].destroy(obj);
190 if (zerod_shortterm) {
191 /* Restore the xarray owned reference */
192 refcount_set(&obj->shortterm_users, 1);
194 xa_unlock(&ictx->objects);
196 /* The returned object reference count is zero */
200 static int iommufd_destroy(struct iommufd_ucmd *ucmd)
202 struct iommu_destroy *cmd = ucmd->cmd;
204 return iommufd_object_remove(ucmd->ictx, NULL, cmd->id, 0);
207 static int iommufd_fops_open(struct inode *inode, struct file *filp)
209 struct iommufd_ctx *ictx;
211 ictx = kzalloc(sizeof(*ictx), GFP_KERNEL_ACCOUNT);
216 * For compatibility with VFIO when /dev/vfio/vfio is opened we default
217 * to the same rlimit accounting as vfio uses.
219 if (IS_ENABLED(CONFIG_IOMMUFD_VFIO_CONTAINER) &&
220 filp->private_data == &vfio_misc_dev) {
221 ictx->account_mode = IOPT_PAGES_ACCOUNT_MM;
222 pr_info_once("IOMMUFD is providing /dev/vfio/vfio, not VFIO.\n");
225 init_rwsem(&ictx->ioas_creation_lock);
226 xa_init_flags(&ictx->objects, XA_FLAGS_ALLOC1 | XA_FLAGS_ACCOUNT);
227 xa_init(&ictx->groups);
229 init_waitqueue_head(&ictx->destroy_wait);
230 filp->private_data = ictx;
234 static int iommufd_fops_release(struct inode *inode, struct file *filp)
236 struct iommufd_ctx *ictx = filp->private_data;
237 struct iommufd_object *obj;
240 * The objects in the xarray form a graph of "users" counts, and we have
241 * to destroy them in a depth first manner. Leaf objects will reduce the
242 * users count of interior objects when they are destroyed.
244 * Repeatedly destroying all the "1 users" leaf objects will progress
245 * until the entire list is destroyed. If this can't progress then there
246 * is some bug related to object refcounting.
248 while (!xa_empty(&ictx->objects)) {
249 unsigned int destroyed = 0;
252 xa_for_each(&ictx->objects, index, obj) {
253 if (!refcount_dec_if_one(&obj->users))
256 xa_erase(&ictx->objects, index);
257 iommufd_object_ops[obj->type].destroy(obj);
260 /* Bug related to users refcount */
261 if (WARN_ON(!destroyed))
264 WARN_ON(!xa_empty(&ictx->groups));
269 static int iommufd_option(struct iommufd_ucmd *ucmd)
271 struct iommu_option *cmd = ucmd->cmd;
277 switch (cmd->option_id) {
278 case IOMMU_OPTION_RLIMIT_MODE:
279 rc = iommufd_option_rlimit_mode(cmd, ucmd->ictx);
281 case IOMMU_OPTION_HUGE_PAGES:
282 rc = iommufd_ioas_option(ucmd);
289 if (copy_to_user(&((struct iommu_option __user *)ucmd->ubuffer)->val64,
290 &cmd->val64, sizeof(cmd->val64)))
296 struct iommu_destroy destroy;
297 struct iommu_fault_alloc fault;
298 struct iommu_hw_info info;
299 struct iommu_hwpt_alloc hwpt;
300 struct iommu_hwpt_get_dirty_bitmap get_dirty_bitmap;
301 struct iommu_hwpt_invalidate cache;
302 struct iommu_hwpt_set_dirty_tracking set_dirty_tracking;
303 struct iommu_ioas_alloc alloc;
304 struct iommu_ioas_allow_iovas allow_iovas;
305 struct iommu_ioas_copy ioas_copy;
306 struct iommu_ioas_iova_ranges iova_ranges;
307 struct iommu_ioas_map map;
308 struct iommu_ioas_unmap unmap;
309 struct iommu_option option;
310 struct iommu_vdevice_alloc vdev;
311 struct iommu_vfio_ioas vfio_ioas;
312 struct iommu_viommu_alloc viommu;
313 #ifdef CONFIG_IOMMUFD_TEST
314 struct iommu_test_cmd test;
318 struct iommufd_ioctl_op {
320 unsigned int min_size;
321 unsigned int ioctl_num;
322 int (*execute)(struct iommufd_ucmd *ucmd);
325 #define IOCTL_OP(_ioctl, _fn, _struct, _last) \
326 [_IOC_NR(_ioctl) - IOMMUFD_CMD_BASE] = { \
327 .size = sizeof(_struct) + \
328 BUILD_BUG_ON_ZERO(sizeof(union ucmd_buffer) < \
330 .min_size = offsetofend(_struct, _last), \
331 .ioctl_num = _ioctl, \
334 static const struct iommufd_ioctl_op iommufd_ioctl_ops[] = {
335 IOCTL_OP(IOMMU_DESTROY, iommufd_destroy, struct iommu_destroy, id),
336 IOCTL_OP(IOMMU_FAULT_QUEUE_ALLOC, iommufd_fault_alloc,
337 struct iommu_fault_alloc, out_fault_fd),
338 IOCTL_OP(IOMMU_GET_HW_INFO, iommufd_get_hw_info, struct iommu_hw_info,
340 IOCTL_OP(IOMMU_HWPT_ALLOC, iommufd_hwpt_alloc, struct iommu_hwpt_alloc,
342 IOCTL_OP(IOMMU_HWPT_GET_DIRTY_BITMAP, iommufd_hwpt_get_dirty_bitmap,
343 struct iommu_hwpt_get_dirty_bitmap, data),
344 IOCTL_OP(IOMMU_HWPT_INVALIDATE, iommufd_hwpt_invalidate,
345 struct iommu_hwpt_invalidate, __reserved),
346 IOCTL_OP(IOMMU_HWPT_SET_DIRTY_TRACKING, iommufd_hwpt_set_dirty_tracking,
347 struct iommu_hwpt_set_dirty_tracking, __reserved),
348 IOCTL_OP(IOMMU_IOAS_ALLOC, iommufd_ioas_alloc_ioctl,
349 struct iommu_ioas_alloc, out_ioas_id),
350 IOCTL_OP(IOMMU_IOAS_ALLOW_IOVAS, iommufd_ioas_allow_iovas,
351 struct iommu_ioas_allow_iovas, allowed_iovas),
352 IOCTL_OP(IOMMU_IOAS_CHANGE_PROCESS, iommufd_ioas_change_process,
353 struct iommu_ioas_change_process, __reserved),
354 IOCTL_OP(IOMMU_IOAS_COPY, iommufd_ioas_copy, struct iommu_ioas_copy,
356 IOCTL_OP(IOMMU_IOAS_IOVA_RANGES, iommufd_ioas_iova_ranges,
357 struct iommu_ioas_iova_ranges, out_iova_alignment),
358 IOCTL_OP(IOMMU_IOAS_MAP, iommufd_ioas_map, struct iommu_ioas_map, iova),
359 IOCTL_OP(IOMMU_IOAS_MAP_FILE, iommufd_ioas_map_file,
360 struct iommu_ioas_map_file, iova),
361 IOCTL_OP(IOMMU_IOAS_UNMAP, iommufd_ioas_unmap, struct iommu_ioas_unmap,
363 IOCTL_OP(IOMMU_OPTION, iommufd_option, struct iommu_option, val64),
364 IOCTL_OP(IOMMU_VDEVICE_ALLOC, iommufd_vdevice_alloc_ioctl,
365 struct iommu_vdevice_alloc, virt_id),
366 IOCTL_OP(IOMMU_VFIO_IOAS, iommufd_vfio_ioas, struct iommu_vfio_ioas,
368 IOCTL_OP(IOMMU_VIOMMU_ALLOC, iommufd_viommu_alloc_ioctl,
369 struct iommu_viommu_alloc, out_viommu_id),
370 #ifdef CONFIG_IOMMUFD_TEST
371 IOCTL_OP(IOMMU_TEST_CMD, iommufd_test, struct iommu_test_cmd, last),
375 static long iommufd_fops_ioctl(struct file *filp, unsigned int cmd,
378 struct iommufd_ctx *ictx = filp->private_data;
379 const struct iommufd_ioctl_op *op;
380 struct iommufd_ucmd ucmd = {};
381 union ucmd_buffer buf;
386 if (nr < IOMMUFD_CMD_BASE ||
387 (nr - IOMMUFD_CMD_BASE) >= ARRAY_SIZE(iommufd_ioctl_ops))
388 return iommufd_vfio_ioctl(ictx, cmd, arg);
391 ucmd.ubuffer = (void __user *)arg;
392 ret = get_user(ucmd.user_size, (u32 __user *)ucmd.ubuffer);
396 op = &iommufd_ioctl_ops[nr - IOMMUFD_CMD_BASE];
397 if (op->ioctl_num != cmd)
399 if (ucmd.user_size < op->min_size)
403 ret = copy_struct_from_user(ucmd.cmd, op->size, ucmd.ubuffer,
407 ret = op->execute(&ucmd);
411 static const struct file_operations iommufd_fops = {
412 .owner = THIS_MODULE,
413 .open = iommufd_fops_open,
414 .release = iommufd_fops_release,
415 .unlocked_ioctl = iommufd_fops_ioctl,
419 * iommufd_ctx_get - Get a context reference
420 * @ictx: Context to get
422 * The caller must already hold a valid reference to ictx.
424 void iommufd_ctx_get(struct iommufd_ctx *ictx)
426 get_file(ictx->file);
428 EXPORT_SYMBOL_NS_GPL(iommufd_ctx_get, "IOMMUFD");
431 * iommufd_ctx_from_file - Acquires a reference to the iommufd context
432 * @file: File to obtain the reference from
434 * Returns a pointer to the iommufd_ctx, otherwise ERR_PTR. The struct file
435 * remains owned by the caller and the caller must still do fput. On success
436 * the caller is responsible to call iommufd_ctx_put().
438 struct iommufd_ctx *iommufd_ctx_from_file(struct file *file)
440 struct iommufd_ctx *ictx;
442 if (file->f_op != &iommufd_fops)
443 return ERR_PTR(-EBADFD);
444 ictx = file->private_data;
445 iommufd_ctx_get(ictx);
448 EXPORT_SYMBOL_NS_GPL(iommufd_ctx_from_file, "IOMMUFD");
451 * iommufd_ctx_from_fd - Acquires a reference to the iommufd context
452 * @fd: File descriptor to obtain the reference from
454 * Returns a pointer to the iommufd_ctx, otherwise ERR_PTR. On success
455 * the caller is responsible to call iommufd_ctx_put().
457 struct iommufd_ctx *iommufd_ctx_from_fd(int fd)
463 return ERR_PTR(-EBADF);
465 if (file->f_op != &iommufd_fops) {
467 return ERR_PTR(-EBADFD);
469 /* fget is the same as iommufd_ctx_get() */
470 return file->private_data;
472 EXPORT_SYMBOL_NS_GPL(iommufd_ctx_from_fd, "IOMMUFD");
475 * iommufd_ctx_put - Put back a reference
476 * @ictx: Context to put back
478 void iommufd_ctx_put(struct iommufd_ctx *ictx)
482 EXPORT_SYMBOL_NS_GPL(iommufd_ctx_put, "IOMMUFD");
484 static const struct iommufd_object_ops iommufd_object_ops[] = {
485 [IOMMUFD_OBJ_ACCESS] = {
486 .destroy = iommufd_access_destroy_object,
488 [IOMMUFD_OBJ_DEVICE] = {
489 .destroy = iommufd_device_destroy,
491 [IOMMUFD_OBJ_FAULT] = {
492 .destroy = iommufd_fault_destroy,
494 [IOMMUFD_OBJ_HWPT_PAGING] = {
495 .destroy = iommufd_hwpt_paging_destroy,
496 .abort = iommufd_hwpt_paging_abort,
498 [IOMMUFD_OBJ_HWPT_NESTED] = {
499 .destroy = iommufd_hwpt_nested_destroy,
500 .abort = iommufd_hwpt_nested_abort,
502 [IOMMUFD_OBJ_IOAS] = {
503 .destroy = iommufd_ioas_destroy,
505 [IOMMUFD_OBJ_VDEVICE] = {
506 .destroy = iommufd_vdevice_destroy,
508 [IOMMUFD_OBJ_VIOMMU] = {
509 .destroy = iommufd_viommu_destroy,
511 #ifdef CONFIG_IOMMUFD_TEST
512 [IOMMUFD_OBJ_SELFTEST] = {
513 .destroy = iommufd_selftest_destroy,
518 static struct miscdevice iommu_misc_dev = {
519 .minor = MISC_DYNAMIC_MINOR,
521 .fops = &iommufd_fops,
527 static struct miscdevice vfio_misc_dev = {
530 .fops = &iommufd_fops,
531 .nodename = "vfio/vfio",
535 static int __init iommufd_init(void)
539 ret = misc_register(&iommu_misc_dev);
543 if (IS_ENABLED(CONFIG_IOMMUFD_VFIO_CONTAINER)) {
544 ret = misc_register(&vfio_misc_dev);
548 ret = iommufd_test_init();
554 if (IS_ENABLED(CONFIG_IOMMUFD_VFIO_CONTAINER))
555 misc_deregister(&vfio_misc_dev);
557 misc_deregister(&iommu_misc_dev);
561 static void __exit iommufd_exit(void)
564 if (IS_ENABLED(CONFIG_IOMMUFD_VFIO_CONTAINER))
565 misc_deregister(&vfio_misc_dev);
566 misc_deregister(&iommu_misc_dev);
569 module_init(iommufd_init);
570 module_exit(iommufd_exit);
572 #if IS_ENABLED(CONFIG_IOMMUFD_VFIO_CONTAINER)
573 MODULE_ALIAS_MISCDEV(VFIO_MINOR);
574 MODULE_ALIAS("devname:vfio/vfio");
576 MODULE_IMPORT_NS("IOMMUFD_INTERNAL");
577 MODULE_IMPORT_NS("IOMMUFD");
578 MODULE_DESCRIPTION("I/O Address Space Management for passthrough devices");
579 MODULE_LICENSE("GPL");