2 * generic functions used by VFIO devices
4 * Copyright Red Hat, Inc. 2012
7 * Alex Williamson <alex.williamson@redhat.com>
9 * This work is licensed under the terms of the GNU GPL, version 2. See
10 * the COPYING file in the top-level directory.
12 * Based on qemu-kvm device-assignment:
13 * Adapted for KVM by Qumranet.
14 * Copyright (c) 2007, Neocleus, Alex Novik (alex@neocleus.com)
15 * Copyright (c) 2007, Neocleus, Guy Zana (guy@neocleus.com)
16 * Copyright (C) 2008, Qumranet, Amit Shah (amit.shah@qumranet.com)
17 * Copyright (C) 2008, Red Hat, Amit Shah (amit.shah@redhat.com)
18 * Copyright (C) 2008, IBM, Muli Ben-Yehuda (muli@il.ibm.com)
21 #include "qemu/osdep.h"
22 #include <sys/ioctl.h>
24 #include <linux/kvm.h>
26 #include <linux/vfio.h>
28 #include "hw/vfio/vfio-common.h"
29 #include "hw/vfio/pci.h"
30 #include "exec/address-spaces.h"
31 #include "exec/memory.h"
32 #include "exec/ram_addr.h"
34 #include "qemu/error-report.h"
35 #include "qemu/main-loop.h"
36 #include "qemu/range.h"
37 #include "sysemu/kvm.h"
38 #include "sysemu/reset.h"
39 #include "sysemu/runstate.h"
41 #include "qapi/error.h"
42 #include "migration/misc.h"
43 #include "migration/blocker.h"
44 #include "migration/qemu-file.h"
45 #include "sysemu/tpm.h"
47 VFIODeviceList vfio_device_list
=
48 QLIST_HEAD_INITIALIZER(vfio_device_list
);
49 static QLIST_HEAD(, VFIOAddressSpace
) vfio_address_spaces
=
50 QLIST_HEAD_INITIALIZER(vfio_address_spaces
);
54 * We have a single VFIO pseudo device per KVM VM. Once created it lives
55 * for the life of the VM. Closing the file descriptor only drops our
56 * reference to it and the device's reference to kvm. Therefore once
57 * initialized, this file descriptor is only released on QEMU exit and
58 * we'll re-use it should another vfio device be attached before then.
60 int vfio_kvm_device_fd
= -1;
64 * Device state interfaces
67 bool vfio_mig_active(void)
71 if (QLIST_EMPTY(&vfio_device_list
)) {
75 QLIST_FOREACH(vbasedev
, &vfio_device_list
, global_next
) {
76 if (vbasedev
->migration_blocker
) {
83 static Error
*multiple_devices_migration_blocker
;
86 * Multiple devices migration is allowed only if all devices support P2P
87 * migration. Single device migration is allowed regardless of P2P migration
90 static bool vfio_multiple_devices_migration_is_supported(void)
93 unsigned int device_num
= 0;
94 bool all_support_p2p
= true;
96 QLIST_FOREACH(vbasedev
, &vfio_device_list
, global_next
) {
97 if (vbasedev
->migration
) {
100 if (!(vbasedev
->migration
->mig_flags
& VFIO_MIGRATION_P2P
)) {
101 all_support_p2p
= false;
106 return all_support_p2p
|| device_num
<= 1;
109 int vfio_block_multiple_devices_migration(VFIODevice
*vbasedev
, Error
**errp
)
113 if (vfio_multiple_devices_migration_is_supported()) {
117 if (vbasedev
->enable_migration
== ON_OFF_AUTO_ON
) {
118 error_setg(errp
, "Multiple VFIO devices migration is supported only if "
119 "all of them support P2P migration");
123 if (multiple_devices_migration_blocker
) {
127 error_setg(&multiple_devices_migration_blocker
,
128 "Multiple VFIO devices migration is supported only if all of "
129 "them support P2P migration");
130 ret
= migrate_add_blocker_normal(&multiple_devices_migration_blocker
, errp
);
135 void vfio_unblock_multiple_devices_migration(void)
137 if (!multiple_devices_migration_blocker
||
138 !vfio_multiple_devices_migration_is_supported()) {
142 migrate_del_blocker(&multiple_devices_migration_blocker
);
145 bool vfio_viommu_preset(VFIODevice
*vbasedev
)
147 return vbasedev
->bcontainer
->space
->as
!= &address_space_memory
;
150 static void vfio_set_migration_error(int ret
)
152 if (migration_is_setup_or_active()) {
153 migration_file_set_error(ret
, NULL
);
157 bool vfio_device_state_is_running(VFIODevice
*vbasedev
)
159 VFIOMigration
*migration
= vbasedev
->migration
;
161 return migration
->device_state
== VFIO_DEVICE_STATE_RUNNING
||
162 migration
->device_state
== VFIO_DEVICE_STATE_RUNNING_P2P
;
165 bool vfio_device_state_is_precopy(VFIODevice
*vbasedev
)
167 VFIOMigration
*migration
= vbasedev
->migration
;
169 return migration
->device_state
== VFIO_DEVICE_STATE_PRE_COPY
||
170 migration
->device_state
== VFIO_DEVICE_STATE_PRE_COPY_P2P
;
173 static bool vfio_devices_all_dirty_tracking(VFIOContainerBase
*bcontainer
)
175 VFIODevice
*vbasedev
;
177 if (!migration_is_active() && !migration_is_device()) {
181 QLIST_FOREACH(vbasedev
, &bcontainer
->device_list
, container_next
) {
182 VFIOMigration
*migration
= vbasedev
->migration
;
188 if (vbasedev
->pre_copy_dirty_page_tracking
== ON_OFF_AUTO_OFF
&&
189 (vfio_device_state_is_running(vbasedev
) ||
190 vfio_device_state_is_precopy(vbasedev
))) {
197 bool vfio_devices_all_device_dirty_tracking(const VFIOContainerBase
*bcontainer
)
199 VFIODevice
*vbasedev
;
201 QLIST_FOREACH(vbasedev
, &bcontainer
->device_list
, container_next
) {
202 if (!vbasedev
->dirty_pages_supported
) {
211 * Check if all VFIO devices are running and migration is active, which is
212 * essentially equivalent to the migration being in pre-copy phase.
215 vfio_devices_all_running_and_mig_active(const VFIOContainerBase
*bcontainer
)
217 VFIODevice
*vbasedev
;
219 if (!migration_is_active()) {
223 QLIST_FOREACH(vbasedev
, &bcontainer
->device_list
, container_next
) {
224 VFIOMigration
*migration
= vbasedev
->migration
;
230 if (vfio_device_state_is_running(vbasedev
) ||
231 vfio_device_state_is_precopy(vbasedev
)) {
240 static bool vfio_listener_skipped_section(MemoryRegionSection
*section
)
242 return (!memory_region_is_ram(section
->mr
) &&
243 !memory_region_is_iommu(section
->mr
)) ||
244 memory_region_is_protected(section
->mr
) ||
246 * Sizing an enabled 64-bit BAR can cause spurious mappings to
247 * addresses in the upper part of the 64-bit address space. These
248 * are never accessed by the CPU and beyond the address width of
249 * some IOMMU hardware. TODO: VFIO should tell us the IOMMU width.
251 section
->offset_within_address_space
& (1ULL << 63);
254 /* Called with rcu_read_lock held. */
255 static bool vfio_get_xlat_addr(IOMMUTLBEntry
*iotlb
, void **vaddr
,
256 ram_addr_t
*ram_addr
, bool *read_only
,
259 bool ret
, mr_has_discard_manager
;
261 ret
= memory_get_xlat_addr(iotlb
, vaddr
, ram_addr
, read_only
,
262 &mr_has_discard_manager
, errp
);
263 if (ret
&& mr_has_discard_manager
) {
265 * Malicious VMs might trigger discarding of IOMMU-mapped memory. The
266 * pages will remain pinned inside vfio until unmapped, resulting in a
267 * higher memory consumption than expected. If memory would get
268 * populated again later, there would be an inconsistency between pages
269 * pinned by vfio and pages seen by QEMU. This is the case until
270 * unmapped from the IOMMU (e.g., during device reset).
272 * With malicious guests, we really only care about pinning more memory
273 * than expected. RLIMIT_MEMLOCK set for the user/process can never be
274 * exceeded and can be used to mitigate this problem.
276 warn_report_once("Using vfio with vIOMMUs and coordinated discarding of"
277 " RAM (e.g., virtio-mem) works, however, malicious"
278 " guests can trigger pinning of more memory than"
279 " intended via an IOMMU. It's possible to mitigate "
280 " by setting/adjusting RLIMIT_MEMLOCK.");
285 static void vfio_iommu_map_notify(IOMMUNotifier
*n
, IOMMUTLBEntry
*iotlb
)
287 VFIOGuestIOMMU
*giommu
= container_of(n
, VFIOGuestIOMMU
, n
);
288 VFIOContainerBase
*bcontainer
= giommu
->bcontainer
;
289 hwaddr iova
= iotlb
->iova
+ giommu
->iommu_offset
;
292 Error
*local_err
= NULL
;
294 trace_vfio_iommu_map_notify(iotlb
->perm
== IOMMU_NONE
? "UNMAP" : "MAP",
295 iova
, iova
+ iotlb
->addr_mask
);
297 if (iotlb
->target_as
!= &address_space_memory
) {
298 error_report("Wrong target AS \"%s\", only system memory is allowed",
299 iotlb
->target_as
->name
? iotlb
->target_as
->name
: "none");
300 vfio_set_migration_error(-EINVAL
);
306 if ((iotlb
->perm
& IOMMU_RW
) != IOMMU_NONE
) {
309 if (!vfio_get_xlat_addr(iotlb
, &vaddr
, NULL
, &read_only
, &local_err
)) {
310 error_report_err(local_err
);
314 * vaddr is only valid until rcu_read_unlock(). But after
315 * vfio_dma_map has set up the mapping the pages will be
316 * pinned by the kernel. This makes sure that the RAM backend
317 * of vaddr will always be there, even if the memory object is
318 * destroyed and its backing memory munmap-ed.
320 ret
= vfio_container_dma_map(bcontainer
, iova
,
321 iotlb
->addr_mask
+ 1, vaddr
,
324 error_report("vfio_container_dma_map(%p, 0x%"HWADDR_PRIx
", "
325 "0x%"HWADDR_PRIx
", %p) = %d (%s)",
327 iotlb
->addr_mask
+ 1, vaddr
, ret
, strerror(-ret
));
330 ret
= vfio_container_dma_unmap(bcontainer
, iova
,
331 iotlb
->addr_mask
+ 1, iotlb
);
333 error_report("vfio_container_dma_unmap(%p, 0x%"HWADDR_PRIx
", "
334 "0x%"HWADDR_PRIx
") = %d (%s)",
336 iotlb
->addr_mask
+ 1, ret
, strerror(-ret
));
337 vfio_set_migration_error(ret
);
344 static void vfio_ram_discard_notify_discard(RamDiscardListener
*rdl
,
345 MemoryRegionSection
*section
)
347 VFIORamDiscardListener
*vrdl
= container_of(rdl
, VFIORamDiscardListener
,
349 VFIOContainerBase
*bcontainer
= vrdl
->bcontainer
;
350 const hwaddr size
= int128_get64(section
->size
);
351 const hwaddr iova
= section
->offset_within_address_space
;
354 /* Unmap with a single call. */
355 ret
= vfio_container_dma_unmap(bcontainer
, iova
, size
, NULL
);
357 error_report("%s: vfio_container_dma_unmap() failed: %s", __func__
,
362 static int vfio_ram_discard_notify_populate(RamDiscardListener
*rdl
,
363 MemoryRegionSection
*section
)
365 VFIORamDiscardListener
*vrdl
= container_of(rdl
, VFIORamDiscardListener
,
367 VFIOContainerBase
*bcontainer
= vrdl
->bcontainer
;
368 const hwaddr end
= section
->offset_within_region
+
369 int128_get64(section
->size
);
370 hwaddr start
, next
, iova
;
375 * Map in (aligned within memory region) minimum granularity, so we can
376 * unmap in minimum granularity later.
378 for (start
= section
->offset_within_region
; start
< end
; start
= next
) {
379 next
= ROUND_UP(start
+ 1, vrdl
->granularity
);
380 next
= MIN(next
, end
);
382 iova
= start
- section
->offset_within_region
+
383 section
->offset_within_address_space
;
384 vaddr
= memory_region_get_ram_ptr(section
->mr
) + start
;
386 ret
= vfio_container_dma_map(bcontainer
, iova
, next
- start
,
387 vaddr
, section
->readonly
);
390 vfio_ram_discard_notify_discard(rdl
, section
);
397 static void vfio_register_ram_discard_listener(VFIOContainerBase
*bcontainer
,
398 MemoryRegionSection
*section
)
400 RamDiscardManager
*rdm
= memory_region_get_ram_discard_manager(section
->mr
);
401 VFIORamDiscardListener
*vrdl
;
403 /* Ignore some corner cases not relevant in practice. */
404 g_assert(QEMU_IS_ALIGNED(section
->offset_within_region
, TARGET_PAGE_SIZE
));
405 g_assert(QEMU_IS_ALIGNED(section
->offset_within_address_space
,
407 g_assert(QEMU_IS_ALIGNED(int128_get64(section
->size
), TARGET_PAGE_SIZE
));
409 vrdl
= g_new0(VFIORamDiscardListener
, 1);
410 vrdl
->bcontainer
= bcontainer
;
411 vrdl
->mr
= section
->mr
;
412 vrdl
->offset_within_address_space
= section
->offset_within_address_space
;
413 vrdl
->size
= int128_get64(section
->size
);
414 vrdl
->granularity
= ram_discard_manager_get_min_granularity(rdm
,
417 g_assert(vrdl
->granularity
&& is_power_of_2(vrdl
->granularity
));
418 g_assert(bcontainer
->pgsizes
&&
419 vrdl
->granularity
>= 1ULL << ctz64(bcontainer
->pgsizes
));
421 ram_discard_listener_init(&vrdl
->listener
,
422 vfio_ram_discard_notify_populate
,
423 vfio_ram_discard_notify_discard
, true);
424 ram_discard_manager_register_listener(rdm
, &vrdl
->listener
, section
);
425 QLIST_INSERT_HEAD(&bcontainer
->vrdl_list
, vrdl
, next
);
428 * Sanity-check if we have a theoretically problematic setup where we could
429 * exceed the maximum number of possible DMA mappings over time. We assume
430 * that each mapped section in the same address space as a RamDiscardManager
431 * section consumes exactly one DMA mapping, with the exception of
432 * RamDiscardManager sections; i.e., we don't expect to have gIOMMU sections
433 * in the same address space as RamDiscardManager sections.
435 * We assume that each section in the address space consumes one memslot.
436 * We take the number of KVM memory slots as a best guess for the maximum
437 * number of sections in the address space we could have over time,
438 * also consuming DMA mappings.
440 if (bcontainer
->dma_max_mappings
) {
441 unsigned int vrdl_count
= 0, vrdl_mappings
= 0, max_memslots
= 512;
445 max_memslots
= kvm_get_max_memslots();
449 QLIST_FOREACH(vrdl
, &bcontainer
->vrdl_list
, next
) {
452 start
= QEMU_ALIGN_DOWN(vrdl
->offset_within_address_space
,
454 end
= ROUND_UP(vrdl
->offset_within_address_space
+ vrdl
->size
,
456 vrdl_mappings
+= (end
- start
) / vrdl
->granularity
;
460 if (vrdl_mappings
+ max_memslots
- vrdl_count
>
461 bcontainer
->dma_max_mappings
) {
462 warn_report("%s: possibly running out of DMA mappings. E.g., try"
463 " increasing the 'block-size' of virtio-mem devies."
464 " Maximum possible DMA mappings: %d, Maximum possible"
465 " memslots: %d", __func__
, bcontainer
->dma_max_mappings
,
471 static void vfio_unregister_ram_discard_listener(VFIOContainerBase
*bcontainer
,
472 MemoryRegionSection
*section
)
474 RamDiscardManager
*rdm
= memory_region_get_ram_discard_manager(section
->mr
);
475 VFIORamDiscardListener
*vrdl
= NULL
;
477 QLIST_FOREACH(vrdl
, &bcontainer
->vrdl_list
, next
) {
478 if (vrdl
->mr
== section
->mr
&&
479 vrdl
->offset_within_address_space
==
480 section
->offset_within_address_space
) {
486 hw_error("vfio: Trying to unregister missing RAM discard listener");
489 ram_discard_manager_unregister_listener(rdm
, &vrdl
->listener
);
490 QLIST_REMOVE(vrdl
, next
);
494 static bool vfio_known_safe_misalignment(MemoryRegionSection
*section
)
496 MemoryRegion
*mr
= section
->mr
;
498 if (!TPM_IS_CRB(mr
->owner
)) {
502 /* this is a known safe misaligned region, just trace for debug purpose */
503 trace_vfio_known_safe_misalignment(memory_region_name(mr
),
504 section
->offset_within_address_space
,
505 section
->offset_within_region
,
506 qemu_real_host_page_size());
510 static bool vfio_listener_valid_section(MemoryRegionSection
*section
,
513 if (vfio_listener_skipped_section(section
)) {
514 trace_vfio_listener_region_skip(name
,
515 section
->offset_within_address_space
,
516 section
->offset_within_address_space
+
517 int128_get64(int128_sub(section
->size
, int128_one())));
521 if (unlikely((section
->offset_within_address_space
&
522 ~qemu_real_host_page_mask()) !=
523 (section
->offset_within_region
& ~qemu_real_host_page_mask()))) {
524 if (!vfio_known_safe_misalignment(section
)) {
525 error_report("%s received unaligned region %s iova=0x%"PRIx64
526 " offset_within_region=0x%"PRIx64
527 " qemu_real_host_page_size=0x%"PRIxPTR
,
528 __func__
, memory_region_name(section
->mr
),
529 section
->offset_within_address_space
,
530 section
->offset_within_region
,
531 qemu_real_host_page_size());
539 static bool vfio_get_section_iova_range(VFIOContainerBase
*bcontainer
,
540 MemoryRegionSection
*section
,
541 hwaddr
*out_iova
, hwaddr
*out_end
,
547 iova
= REAL_HOST_PAGE_ALIGN(section
->offset_within_address_space
);
548 llend
= int128_make64(section
->offset_within_address_space
);
549 llend
= int128_add(llend
, section
->size
);
550 llend
= int128_and(llend
, int128_exts64(qemu_real_host_page_mask()));
552 if (int128_ge(int128_make64(iova
), llend
)) {
557 *out_end
= int128_get64(int128_sub(llend
, int128_one()));
564 static void vfio_listener_region_add(MemoryListener
*listener
,
565 MemoryRegionSection
*section
)
567 VFIOContainerBase
*bcontainer
= container_of(listener
, VFIOContainerBase
,
570 Int128 llend
, llsize
;
575 if (!vfio_listener_valid_section(section
, "region_add")) {
579 if (!vfio_get_section_iova_range(bcontainer
, section
, &iova
, &end
,
581 if (memory_region_is_ram_device(section
->mr
)) {
582 trace_vfio_listener_region_add_no_dma_map(
583 memory_region_name(section
->mr
),
584 section
->offset_within_address_space
,
585 int128_getlo(section
->size
),
586 qemu_real_host_page_size());
591 if (!vfio_container_add_section_window(bcontainer
, section
, &err
)) {
595 memory_region_ref(section
->mr
);
597 if (memory_region_is_iommu(section
->mr
)) {
598 VFIOGuestIOMMU
*giommu
;
599 IOMMUMemoryRegion
*iommu_mr
= IOMMU_MEMORY_REGION(section
->mr
);
602 trace_vfio_listener_region_add_iommu(iova
, end
);
604 * FIXME: For VFIO iommu types which have KVM acceleration to
605 * avoid bouncing all map/unmaps through qemu this way, this
606 * would be the right place to wire that up (tell the KVM
607 * device emulation the VFIO iommu handles to use).
609 giommu
= g_malloc0(sizeof(*giommu
));
610 giommu
->iommu_mr
= iommu_mr
;
611 giommu
->iommu_offset
= section
->offset_within_address_space
-
612 section
->offset_within_region
;
613 giommu
->bcontainer
= bcontainer
;
614 llend
= int128_add(int128_make64(section
->offset_within_region
),
616 llend
= int128_sub(llend
, int128_one());
617 iommu_idx
= memory_region_iommu_attrs_to_index(iommu_mr
,
618 MEMTXATTRS_UNSPECIFIED
);
619 iommu_notifier_init(&giommu
->n
, vfio_iommu_map_notify
,
620 IOMMU_NOTIFIER_IOTLB_EVENTS
,
621 section
->offset_within_region
,
625 ret
= memory_region_iommu_set_page_size_mask(giommu
->iommu_mr
,
633 ret
= memory_region_register_iommu_notifier(section
->mr
, &giommu
->n
,
639 QLIST_INSERT_HEAD(&bcontainer
->giommu_list
, giommu
, giommu_next
);
640 memory_region_iommu_replay(giommu
->iommu_mr
, &giommu
->n
);
645 /* Here we assume that memory_region_is_ram(section->mr)==true */
648 * For RAM memory regions with a RamDiscardManager, we only want to map the
649 * actually populated parts - and update the mapping whenever we're notified
652 if (memory_region_has_ram_discard_manager(section
->mr
)) {
653 vfio_register_ram_discard_listener(bcontainer
, section
);
657 vaddr
= memory_region_get_ram_ptr(section
->mr
) +
658 section
->offset_within_region
+
659 (iova
- section
->offset_within_address_space
);
661 trace_vfio_listener_region_add_ram(iova
, end
, vaddr
);
663 llsize
= int128_sub(llend
, int128_make64(iova
));
665 if (memory_region_is_ram_device(section
->mr
)) {
666 hwaddr pgmask
= (1ULL << ctz64(bcontainer
->pgsizes
)) - 1;
668 if ((iova
& pgmask
) || (int128_get64(llsize
) & pgmask
)) {
669 trace_vfio_listener_region_add_no_dma_map(
670 memory_region_name(section
->mr
),
671 section
->offset_within_address_space
,
672 int128_getlo(section
->size
),
678 ret
= vfio_container_dma_map(bcontainer
, iova
, int128_get64(llsize
),
679 vaddr
, section
->readonly
);
681 error_setg(&err
, "vfio_container_dma_map(%p, 0x%"HWADDR_PRIx
", "
682 "0x%"HWADDR_PRIx
", %p) = %d (%s)",
683 bcontainer
, iova
, int128_get64(llsize
), vaddr
, ret
,
685 if (memory_region_is_ram_device(section
->mr
)) {
686 /* Allow unexpected mappings not to be fatal for RAM devices */
687 error_report_err(err
);
696 if (memory_region_is_ram_device(section
->mr
)) {
697 error_reportf_err(err
, "PCI p2p may not work: ");
701 * On the initfn path, store the first error in the container so we
702 * can gracefully fail. Runtime, there's not much we can do other
703 * than throw a hardware error.
705 if (!bcontainer
->initialized
) {
706 if (!bcontainer
->error
) {
707 error_propagate_prepend(&bcontainer
->error
, err
,
709 memory_region_name(section
->mr
));
714 error_report_err(err
);
715 hw_error("vfio: DMA mapping failed, unable to continue");
719 static void vfio_listener_region_del(MemoryListener
*listener
,
720 MemoryRegionSection
*section
)
722 VFIOContainerBase
*bcontainer
= container_of(listener
, VFIOContainerBase
,
725 Int128 llend
, llsize
;
727 bool try_unmap
= true;
729 if (!vfio_listener_valid_section(section
, "region_del")) {
733 if (memory_region_is_iommu(section
->mr
)) {
734 VFIOGuestIOMMU
*giommu
;
736 QLIST_FOREACH(giommu
, &bcontainer
->giommu_list
, giommu_next
) {
737 if (MEMORY_REGION(giommu
->iommu_mr
) == section
->mr
&&
738 giommu
->n
.start
== section
->offset_within_region
) {
739 memory_region_unregister_iommu_notifier(section
->mr
,
741 QLIST_REMOVE(giommu
, giommu_next
);
748 * FIXME: We assume the one big unmap below is adequate to
749 * remove any individual page mappings in the IOMMU which
750 * might have been copied into VFIO. This works for a page table
751 * based IOMMU where a big unmap flattens a large range of IO-PTEs.
752 * That may not be true for all IOMMU types.
756 if (!vfio_get_section_iova_range(bcontainer
, section
, &iova
, &end
,
761 llsize
= int128_sub(llend
, int128_make64(iova
));
763 trace_vfio_listener_region_del(iova
, end
);
765 if (memory_region_is_ram_device(section
->mr
)) {
768 pgmask
= (1ULL << ctz64(bcontainer
->pgsizes
)) - 1;
769 try_unmap
= !((iova
& pgmask
) || (int128_get64(llsize
) & pgmask
));
770 } else if (memory_region_has_ram_discard_manager(section
->mr
)) {
771 vfio_unregister_ram_discard_listener(bcontainer
, section
);
772 /* Unregistering will trigger an unmap. */
777 if (int128_eq(llsize
, int128_2_64())) {
778 /* The unmap ioctl doesn't accept a full 64-bit span. */
779 llsize
= int128_rshift(llsize
, 1);
780 ret
= vfio_container_dma_unmap(bcontainer
, iova
,
781 int128_get64(llsize
), NULL
);
783 error_report("vfio_container_dma_unmap(%p, 0x%"HWADDR_PRIx
", "
784 "0x%"HWADDR_PRIx
") = %d (%s)",
785 bcontainer
, iova
, int128_get64(llsize
), ret
,
788 iova
+= int128_get64(llsize
);
790 ret
= vfio_container_dma_unmap(bcontainer
, iova
,
791 int128_get64(llsize
), NULL
);
793 error_report("vfio_container_dma_unmap(%p, 0x%"HWADDR_PRIx
", "
794 "0x%"HWADDR_PRIx
") = %d (%s)",
795 bcontainer
, iova
, int128_get64(llsize
), ret
,
800 memory_region_unref(section
->mr
);
802 vfio_container_del_section_window(bcontainer
, section
);
805 typedef struct VFIODirtyRanges
{
814 typedef struct VFIODirtyRangesListener
{
815 VFIOContainerBase
*bcontainer
;
816 VFIODirtyRanges ranges
;
817 MemoryListener listener
;
818 } VFIODirtyRangesListener
;
820 static bool vfio_section_is_vfio_pci(MemoryRegionSection
*section
,
821 VFIOContainerBase
*bcontainer
)
823 VFIOPCIDevice
*pcidev
;
824 VFIODevice
*vbasedev
;
827 owner
= memory_region_owner(section
->mr
);
829 QLIST_FOREACH(vbasedev
, &bcontainer
->device_list
, container_next
) {
830 if (vbasedev
->type
!= VFIO_DEVICE_TYPE_PCI
) {
833 pcidev
= container_of(vbasedev
, VFIOPCIDevice
, vbasedev
);
834 if (OBJECT(pcidev
) == owner
) {
842 static void vfio_dirty_tracking_update_range(VFIODirtyRanges
*range
,
843 hwaddr iova
, hwaddr end
,
849 * The address space passed to the dirty tracker is reduced to three ranges:
850 * one for 32-bit DMA ranges, one for 64-bit DMA ranges and one for the
853 * The underlying reports of dirty will query a sub-interval of each of
856 * The purpose of the three range handling is to handle known cases of big
857 * holes in the address space, like the x86 AMD 1T hole, and firmware (like
858 * OVMF) which may relocate the pci-hole64 to the end of the address space.
859 * The latter would otherwise generate large ranges for tracking, stressing
860 * the limits of supported hardware. The pci-hole32 will always be below 4G
861 * (overlapping or not) so it doesn't need special handling and is part of
864 * The alternative would be an IOVATree but that has a much bigger runtime
865 * overhead and unnecessary complexity.
867 if (update_pci
&& iova
>= UINT32_MAX
) {
868 min
= &range
->minpci64
;
869 max
= &range
->maxpci64
;
871 min
= (end
<= UINT32_MAX
) ? &range
->min32
: &range
->min64
;
872 max
= (end
<= UINT32_MAX
) ? &range
->max32
: &range
->max64
;
881 trace_vfio_device_dirty_tracking_update(iova
, end
, *min
, *max
);
884 static void vfio_dirty_tracking_update(MemoryListener
*listener
,
885 MemoryRegionSection
*section
)
887 VFIODirtyRangesListener
*dirty
=
888 container_of(listener
, VFIODirtyRangesListener
, listener
);
891 if (!vfio_listener_valid_section(section
, "tracking_update") ||
892 !vfio_get_section_iova_range(dirty
->bcontainer
, section
,
893 &iova
, &end
, NULL
)) {
897 vfio_dirty_tracking_update_range(&dirty
->ranges
, iova
, end
,
898 vfio_section_is_vfio_pci(section
, dirty
->bcontainer
));
901 static const MemoryListener vfio_dirty_tracking_listener
= {
902 .name
= "vfio-tracking",
903 .region_add
= vfio_dirty_tracking_update
,
906 static void vfio_dirty_tracking_init(VFIOContainerBase
*bcontainer
,
907 VFIODirtyRanges
*ranges
)
909 VFIODirtyRangesListener dirty
;
911 memset(&dirty
, 0, sizeof(dirty
));
912 dirty
.ranges
.min32
= UINT32_MAX
;
913 dirty
.ranges
.min64
= UINT64_MAX
;
914 dirty
.ranges
.minpci64
= UINT64_MAX
;
915 dirty
.listener
= vfio_dirty_tracking_listener
;
916 dirty
.bcontainer
= bcontainer
;
918 memory_listener_register(&dirty
.listener
,
919 bcontainer
->space
->as
);
921 *ranges
= dirty
.ranges
;
924 * The memory listener is synchronous, and used to calculate the range
925 * to dirty tracking. Unregister it after we are done as we are not
926 * interested in any follow-up updates.
928 memory_listener_unregister(&dirty
.listener
);
931 static void vfio_devices_dma_logging_stop(VFIOContainerBase
*bcontainer
)
933 uint64_t buf
[DIV_ROUND_UP(sizeof(struct vfio_device_feature
),
934 sizeof(uint64_t))] = {};
935 struct vfio_device_feature
*feature
= (struct vfio_device_feature
*)buf
;
936 VFIODevice
*vbasedev
;
938 feature
->argsz
= sizeof(buf
);
939 feature
->flags
= VFIO_DEVICE_FEATURE_SET
|
940 VFIO_DEVICE_FEATURE_DMA_LOGGING_STOP
;
942 QLIST_FOREACH(vbasedev
, &bcontainer
->device_list
, container_next
) {
943 if (!vbasedev
->dirty_tracking
) {
947 if (ioctl(vbasedev
->fd
, VFIO_DEVICE_FEATURE
, feature
)) {
948 warn_report("%s: Failed to stop DMA logging, err %d (%s)",
949 vbasedev
->name
, -errno
, strerror(errno
));
951 vbasedev
->dirty_tracking
= false;
955 static struct vfio_device_feature
*
956 vfio_device_feature_dma_logging_start_create(VFIOContainerBase
*bcontainer
,
957 VFIODirtyRanges
*tracking
)
959 struct vfio_device_feature
*feature
;
961 struct vfio_device_feature_dma_logging_control
*control
;
962 struct vfio_device_feature_dma_logging_range
*ranges
;
964 feature_size
= sizeof(struct vfio_device_feature
) +
965 sizeof(struct vfio_device_feature_dma_logging_control
);
966 feature
= g_try_malloc0(feature_size
);
971 feature
->argsz
= feature_size
;
972 feature
->flags
= VFIO_DEVICE_FEATURE_SET
|
973 VFIO_DEVICE_FEATURE_DMA_LOGGING_START
;
975 control
= (struct vfio_device_feature_dma_logging_control
*)feature
->data
;
976 control
->page_size
= qemu_real_host_page_size();
979 * DMA logging uAPI guarantees to support at least a number of ranges that
980 * fits into a single host kernel base page.
982 control
->num_ranges
= !!tracking
->max32
+ !!tracking
->max64
+
983 !!tracking
->maxpci64
;
984 ranges
= g_try_new0(struct vfio_device_feature_dma_logging_range
,
985 control
->num_ranges
);
993 control
->ranges
= (uintptr_t)ranges
;
994 if (tracking
->max32
) {
995 ranges
->iova
= tracking
->min32
;
996 ranges
->length
= (tracking
->max32
- tracking
->min32
) + 1;
999 if (tracking
->max64
) {
1000 ranges
->iova
= tracking
->min64
;
1001 ranges
->length
= (tracking
->max64
- tracking
->min64
) + 1;
1004 if (tracking
->maxpci64
) {
1005 ranges
->iova
= tracking
->minpci64
;
1006 ranges
->length
= (tracking
->maxpci64
- tracking
->minpci64
) + 1;
1009 trace_vfio_device_dirty_tracking_start(control
->num_ranges
,
1010 tracking
->min32
, tracking
->max32
,
1011 tracking
->min64
, tracking
->max64
,
1012 tracking
->minpci64
, tracking
->maxpci64
);
1017 static void vfio_device_feature_dma_logging_start_destroy(
1018 struct vfio_device_feature
*feature
)
1020 struct vfio_device_feature_dma_logging_control
*control
=
1021 (struct vfio_device_feature_dma_logging_control
*)feature
->data
;
1022 struct vfio_device_feature_dma_logging_range
*ranges
=
1023 (struct vfio_device_feature_dma_logging_range
*)(uintptr_t)control
->ranges
;
1029 static bool vfio_devices_dma_logging_start(VFIOContainerBase
*bcontainer
,
1032 struct vfio_device_feature
*feature
;
1033 VFIODirtyRanges ranges
;
1034 VFIODevice
*vbasedev
;
1037 vfio_dirty_tracking_init(bcontainer
, &ranges
);
1038 feature
= vfio_device_feature_dma_logging_start_create(bcontainer
,
1041 error_setg_errno(errp
, errno
, "Failed to prepare DMA logging");
1045 QLIST_FOREACH(vbasedev
, &bcontainer
->device_list
, container_next
) {
1046 if (vbasedev
->dirty_tracking
) {
1050 ret
= ioctl(vbasedev
->fd
, VFIO_DEVICE_FEATURE
, feature
);
1053 error_setg_errno(errp
, errno
, "%s: Failed to start DMA logging",
1057 vbasedev
->dirty_tracking
= true;
1062 vfio_devices_dma_logging_stop(bcontainer
);
1065 vfio_device_feature_dma_logging_start_destroy(feature
);
1070 static bool vfio_listener_log_global_start(MemoryListener
*listener
,
1074 VFIOContainerBase
*bcontainer
= container_of(listener
, VFIOContainerBase
,
1078 if (vfio_devices_all_device_dirty_tracking(bcontainer
)) {
1079 ret
= vfio_devices_dma_logging_start(bcontainer
, errp
);
1081 ret
= vfio_container_set_dirty_page_tracking(bcontainer
, true, errp
) == 0;
1085 error_prepend(errp
, "vfio: Could not start dirty page tracking - ");
1090 static void vfio_listener_log_global_stop(MemoryListener
*listener
)
1092 VFIOContainerBase
*bcontainer
= container_of(listener
, VFIOContainerBase
,
1094 Error
*local_err
= NULL
;
1097 if (vfio_devices_all_device_dirty_tracking(bcontainer
)) {
1098 vfio_devices_dma_logging_stop(bcontainer
);
1100 ret
= vfio_container_set_dirty_page_tracking(bcontainer
, false,
1105 error_prepend(&local_err
,
1106 "vfio: Could not stop dirty page tracking - ");
1107 error_report_err(local_err
);
1108 vfio_set_migration_error(ret
);
1112 static int vfio_device_dma_logging_report(VFIODevice
*vbasedev
, hwaddr iova
,
1113 hwaddr size
, void *bitmap
)
1115 uint64_t buf
[DIV_ROUND_UP(sizeof(struct vfio_device_feature
) +
1116 sizeof(struct vfio_device_feature_dma_logging_report
),
1117 sizeof(uint64_t))] = {};
1118 struct vfio_device_feature
*feature
= (struct vfio_device_feature
*)buf
;
1119 struct vfio_device_feature_dma_logging_report
*report
=
1120 (struct vfio_device_feature_dma_logging_report
*)feature
->data
;
1122 report
->iova
= iova
;
1123 report
->length
= size
;
1124 report
->page_size
= qemu_real_host_page_size();
1125 report
->bitmap
= (uintptr_t)bitmap
;
1127 feature
->argsz
= sizeof(buf
);
1128 feature
->flags
= VFIO_DEVICE_FEATURE_GET
|
1129 VFIO_DEVICE_FEATURE_DMA_LOGGING_REPORT
;
1131 if (ioctl(vbasedev
->fd
, VFIO_DEVICE_FEATURE
, feature
)) {
1138 int vfio_devices_query_dirty_bitmap(const VFIOContainerBase
*bcontainer
,
1139 VFIOBitmap
*vbmap
, hwaddr iova
, hwaddr size
, Error
**errp
)
1141 VFIODevice
*vbasedev
;
1144 QLIST_FOREACH(vbasedev
, &bcontainer
->device_list
, container_next
) {
1145 ret
= vfio_device_dma_logging_report(vbasedev
, iova
, size
,
1148 error_setg_errno(errp
, -ret
,
1149 "%s: Failed to get DMA logging report, iova: "
1150 "0x%" HWADDR_PRIx
", size: 0x%" HWADDR_PRIx
,
1151 vbasedev
->name
, iova
, size
);
1160 int vfio_get_dirty_bitmap(const VFIOContainerBase
*bcontainer
, uint64_t iova
,
1161 uint64_t size
, ram_addr_t ram_addr
, Error
**errp
)
1163 bool all_device_dirty_tracking
=
1164 vfio_devices_all_device_dirty_tracking(bcontainer
);
1165 uint64_t dirty_pages
;
1169 if (!bcontainer
->dirty_pages_supported
&& !all_device_dirty_tracking
) {
1170 cpu_physical_memory_set_dirty_range(ram_addr
, size
,
1171 tcg_enabled() ? DIRTY_CLIENTS_ALL
:
1172 DIRTY_CLIENTS_NOCODE
);
1176 ret
= vfio_bitmap_alloc(&vbmap
, size
);
1178 error_setg_errno(errp
, -ret
,
1179 "Failed to allocate dirty tracking bitmap");
1183 if (all_device_dirty_tracking
) {
1184 ret
= vfio_devices_query_dirty_bitmap(bcontainer
, &vbmap
, iova
, size
,
1187 ret
= vfio_container_query_dirty_bitmap(bcontainer
, &vbmap
, iova
, size
,
1195 dirty_pages
= cpu_physical_memory_set_dirty_lebitmap(vbmap
.bitmap
, ram_addr
,
1198 trace_vfio_get_dirty_bitmap(iova
, size
, vbmap
.size
, ram_addr
, dirty_pages
);
1200 g_free(vbmap
.bitmap
);
1207 VFIOGuestIOMMU
*giommu
;
1208 } vfio_giommu_dirty_notifier
;
1210 static void vfio_iommu_map_dirty_notify(IOMMUNotifier
*n
, IOMMUTLBEntry
*iotlb
)
1212 vfio_giommu_dirty_notifier
*gdn
= container_of(n
,
1213 vfio_giommu_dirty_notifier
, n
);
1214 VFIOGuestIOMMU
*giommu
= gdn
->giommu
;
1215 VFIOContainerBase
*bcontainer
= giommu
->bcontainer
;
1216 hwaddr iova
= iotlb
->iova
+ giommu
->iommu_offset
;
1217 ram_addr_t translated_addr
;
1218 Error
*local_err
= NULL
;
1221 trace_vfio_iommu_map_dirty_notify(iova
, iova
+ iotlb
->addr_mask
);
1223 if (iotlb
->target_as
!= &address_space_memory
) {
1224 error_report("Wrong target AS \"%s\", only system memory is allowed",
1225 iotlb
->target_as
->name
? iotlb
->target_as
->name
: "none");
1230 if (!vfio_get_xlat_addr(iotlb
, NULL
, &translated_addr
, NULL
, &local_err
)) {
1231 error_report_err(local_err
);
1235 ret
= vfio_get_dirty_bitmap(bcontainer
, iova
, iotlb
->addr_mask
+ 1,
1236 translated_addr
, &local_err
);
1238 error_prepend(&local_err
,
1239 "vfio_iommu_map_dirty_notify(%p, 0x%"HWADDR_PRIx
", "
1240 "0x%"HWADDR_PRIx
") failed - ", bcontainer
, iova
,
1241 iotlb
->addr_mask
+ 1);
1242 error_report_err(local_err
);
1250 vfio_set_migration_error(ret
);
1254 static int vfio_ram_discard_get_dirty_bitmap(MemoryRegionSection
*section
,
1257 const hwaddr size
= int128_get64(section
->size
);
1258 const hwaddr iova
= section
->offset_within_address_space
;
1259 const ram_addr_t ram_addr
= memory_region_get_ram_addr(section
->mr
) +
1260 section
->offset_within_region
;
1261 VFIORamDiscardListener
*vrdl
= opaque
;
1262 Error
*local_err
= NULL
;
1266 * Sync the whole mapped region (spanning multiple individual mappings)
1269 ret
= vfio_get_dirty_bitmap(vrdl
->bcontainer
, iova
, size
, ram_addr
,
1272 error_report_err(local_err
);
1278 vfio_sync_ram_discard_listener_dirty_bitmap(VFIOContainerBase
*bcontainer
,
1279 MemoryRegionSection
*section
)
1281 RamDiscardManager
*rdm
= memory_region_get_ram_discard_manager(section
->mr
);
1282 VFIORamDiscardListener
*vrdl
= NULL
;
1284 QLIST_FOREACH(vrdl
, &bcontainer
->vrdl_list
, next
) {
1285 if (vrdl
->mr
== section
->mr
&&
1286 vrdl
->offset_within_address_space
==
1287 section
->offset_within_address_space
) {
1293 hw_error("vfio: Trying to sync missing RAM discard listener");
1297 * We only want/can synchronize the bitmap for actually mapped parts -
1298 * which correspond to populated parts. Replay all populated parts.
1300 return ram_discard_manager_replay_populated(rdm
, section
,
1301 vfio_ram_discard_get_dirty_bitmap
,
1305 static int vfio_sync_iommu_dirty_bitmap(VFIOContainerBase
*bcontainer
,
1306 MemoryRegionSection
*section
)
1308 VFIOGuestIOMMU
*giommu
;
1311 vfio_giommu_dirty_notifier gdn
;
1314 QLIST_FOREACH(giommu
, &bcontainer
->giommu_list
, giommu_next
) {
1315 if (MEMORY_REGION(giommu
->iommu_mr
) == section
->mr
&&
1316 giommu
->n
.start
== section
->offset_within_region
) {
1326 gdn
.giommu
= giommu
;
1327 idx
= memory_region_iommu_attrs_to_index(giommu
->iommu_mr
,
1328 MEMTXATTRS_UNSPECIFIED
);
1330 llend
= int128_add(int128_make64(section
->offset_within_region
),
1332 llend
= int128_sub(llend
, int128_one());
1334 iommu_notifier_init(&gdn
.n
, vfio_iommu_map_dirty_notify
, IOMMU_NOTIFIER_MAP
,
1335 section
->offset_within_region
, int128_get64(llend
),
1337 memory_region_iommu_replay(giommu
->iommu_mr
, &gdn
.n
);
1342 static int vfio_sync_dirty_bitmap(VFIOContainerBase
*bcontainer
,
1343 MemoryRegionSection
*section
, Error
**errp
)
1345 ram_addr_t ram_addr
;
1347 if (memory_region_is_iommu(section
->mr
)) {
1348 return vfio_sync_iommu_dirty_bitmap(bcontainer
, section
);
1349 } else if (memory_region_has_ram_discard_manager(section
->mr
)) {
1352 ret
= vfio_sync_ram_discard_listener_dirty_bitmap(bcontainer
, section
);
1355 "Failed to sync dirty bitmap with RAM discard listener");
1360 ram_addr
= memory_region_get_ram_addr(section
->mr
) +
1361 section
->offset_within_region
;
1363 return vfio_get_dirty_bitmap(bcontainer
,
1364 REAL_HOST_PAGE_ALIGN(section
->offset_within_address_space
),
1365 int128_get64(section
->size
), ram_addr
, errp
);
1368 static void vfio_listener_log_sync(MemoryListener
*listener
,
1369 MemoryRegionSection
*section
)
1371 VFIOContainerBase
*bcontainer
= container_of(listener
, VFIOContainerBase
,
1374 Error
*local_err
= NULL
;
1376 if (vfio_listener_skipped_section(section
)) {
1380 if (vfio_devices_all_dirty_tracking(bcontainer
)) {
1381 ret
= vfio_sync_dirty_bitmap(bcontainer
, section
, &local_err
);
1383 error_report_err(local_err
);
1384 vfio_set_migration_error(ret
);
1389 const MemoryListener vfio_memory_listener
= {
1391 .region_add
= vfio_listener_region_add
,
1392 .region_del
= vfio_listener_region_del
,
1393 .log_global_start
= vfio_listener_log_global_start
,
1394 .log_global_stop
= vfio_listener_log_global_stop
,
1395 .log_sync
= vfio_listener_log_sync
,
1398 void vfio_reset_handler(void *opaque
)
1400 VFIODevice
*vbasedev
;
1402 QLIST_FOREACH(vbasedev
, &vfio_device_list
, global_next
) {
1403 if (vbasedev
->dev
->realized
) {
1404 vbasedev
->ops
->vfio_compute_needs_reset(vbasedev
);
1408 QLIST_FOREACH(vbasedev
, &vfio_device_list
, global_next
) {
1409 if (vbasedev
->dev
->realized
&& vbasedev
->needs_reset
) {
1410 vbasedev
->ops
->vfio_hot_reset_multi(vbasedev
);
1415 int vfio_kvm_device_add_fd(int fd
, Error
**errp
)
1418 struct kvm_device_attr attr
= {
1419 .group
= KVM_DEV_VFIO_FILE
,
1420 .attr
= KVM_DEV_VFIO_FILE_ADD
,
1421 .addr
= (uint64_t)(unsigned long)&fd
,
1424 if (!kvm_enabled()) {
1428 if (vfio_kvm_device_fd
< 0) {
1429 struct kvm_create_device cd
= {
1430 .type
= KVM_DEV_TYPE_VFIO
,
1433 if (kvm_vm_ioctl(kvm_state
, KVM_CREATE_DEVICE
, &cd
)) {
1434 error_setg_errno(errp
, errno
, "Failed to create KVM VFIO device");
1438 vfio_kvm_device_fd
= cd
.fd
;
1441 if (ioctl(vfio_kvm_device_fd
, KVM_SET_DEVICE_ATTR
, &attr
)) {
1442 error_setg_errno(errp
, errno
, "Failed to add fd %d to KVM VFIO device",
1450 int vfio_kvm_device_del_fd(int fd
, Error
**errp
)
1453 struct kvm_device_attr attr
= {
1454 .group
= KVM_DEV_VFIO_FILE
,
1455 .attr
= KVM_DEV_VFIO_FILE_DEL
,
1456 .addr
= (uint64_t)(unsigned long)&fd
,
1459 if (vfio_kvm_device_fd
< 0) {
1460 error_setg(errp
, "KVM VFIO device isn't created yet");
1464 if (ioctl(vfio_kvm_device_fd
, KVM_SET_DEVICE_ATTR
, &attr
)) {
1465 error_setg_errno(errp
, errno
,
1466 "Failed to remove fd %d from KVM VFIO device", fd
);
1473 VFIOAddressSpace
*vfio_get_address_space(AddressSpace
*as
)
1475 VFIOAddressSpace
*space
;
1477 QLIST_FOREACH(space
, &vfio_address_spaces
, list
) {
1478 if (space
->as
== as
) {
1483 /* No suitable VFIOAddressSpace, create a new one */
1484 space
= g_malloc0(sizeof(*space
));
1486 QLIST_INIT(&space
->containers
);
1488 if (QLIST_EMPTY(&vfio_address_spaces
)) {
1489 qemu_register_reset(vfio_reset_handler
, NULL
);
1492 QLIST_INSERT_HEAD(&vfio_address_spaces
, space
, list
);
1497 void vfio_put_address_space(VFIOAddressSpace
*space
)
1499 if (!QLIST_EMPTY(&space
->containers
)) {
1503 QLIST_REMOVE(space
, list
);
1506 if (QLIST_EMPTY(&vfio_address_spaces
)) {
1507 qemu_unregister_reset(vfio_reset_handler
, NULL
);
1511 void vfio_address_space_insert(VFIOAddressSpace
*space
,
1512 VFIOContainerBase
*bcontainer
)
1514 QLIST_INSERT_HEAD(&space
->containers
, bcontainer
, next
);
1515 bcontainer
->space
= space
;
1518 struct vfio_device_info
*vfio_get_device_info(int fd
)
1520 struct vfio_device_info
*info
;
1521 uint32_t argsz
= sizeof(*info
);
1523 info
= g_malloc0(argsz
);
1526 info
->argsz
= argsz
;
1528 if (ioctl(fd
, VFIO_DEVICE_GET_INFO
, info
)) {
1533 if (info
->argsz
> argsz
) {
1534 argsz
= info
->argsz
;
1535 info
= g_realloc(info
, argsz
);
1542 bool vfio_attach_device(char *name
, VFIODevice
*vbasedev
,
1543 AddressSpace
*as
, Error
**errp
)
1545 const VFIOIOMMUClass
*ops
=
1546 VFIO_IOMMU_CLASS(object_class_by_name(TYPE_VFIO_IOMMU_LEGACY
));
1547 HostIOMMUDevice
*hiod
;
1549 if (vbasedev
->iommufd
) {
1550 ops
= VFIO_IOMMU_CLASS(object_class_by_name(TYPE_VFIO_IOMMU_IOMMUFD
));
1555 if (!ops
->attach_device(name
, vbasedev
, as
, errp
)) {
1559 hiod
= HOST_IOMMU_DEVICE(object_new(ops
->hiod_typename
));
1560 if (!HOST_IOMMU_DEVICE_GET_CLASS(hiod
)->realize(hiod
, vbasedev
, errp
)) {
1562 ops
->detach_device(vbasedev
);
1565 vbasedev
->hiod
= hiod
;
1570 void vfio_detach_device(VFIODevice
*vbasedev
)
1572 if (!vbasedev
->bcontainer
) {
1575 object_unref(vbasedev
->hiod
);
1576 VFIO_IOMMU_GET_CLASS(vbasedev
->bcontainer
)->detach_device(vbasedev
);