Merge tag 'kvmgt-vfio-mdev-for-v4.10-rc1' of git://github.com/01org/gvt-linux

Pull i915/gvt KVMGT updates from Zhenyu Wang:
 "KVMGT support depending on the VFIO/mdev framework"

* tag 'kvmgt-vfio-mdev-for-v4.10-rc1' of git://github.com/01org/gvt-linux:
  drm/i915/gvt/kvmgt: add vfio/mdev support to KVMGT
  drm/i915/gvt/kvmgt: read/write GPA via KVM API
  drm/i915/gvt/kvmgt: replace kmalloc() by kzalloc()

4 files changed, 923 insertions, 61 deletions

diff --git a/drivers/gpu/drm/i915/Kconfig b/drivers/gpu/drm/i915/Kconfig
index 5ddde7349fbd..183f5dc1c3f2 100644
--- a/drivers/gpu/drm/i915/Kconfig
+++ b/drivers/gpu/drm/i915/Kconfig
@@ -116,6 +116,7 @@ config DRM_I915_GVT_KVMGT
         tristate "Enable KVM/VFIO support for Intel GVT-g"
         depends on DRM_I915_GVT
         depends on KVM
+        depends on VFIO_MDEV && VFIO_MDEV_DEVICE
         default n
         help
           Choose this option if you want to enable KVMGT support for
diff --git a/drivers/gpu/drm/i915/gvt/Makefile b/drivers/gpu/drm/i915/gvt/Makefile
index 8a46a7f31d53..b123c20e2097 100644
--- a/drivers/gpu/drm/i915/gvt/Makefile
+++ b/drivers/gpu/drm/i915/gvt/Makefile
@@ -5,6 +5,4 @@ GVT_SOURCE := gvt.o aperture_gm.o handlers.o vgpu.o trace_points.o firmware.o \
 
 ccflags-y                               += -I$(src) -I$(src)/$(GVT_DIR) -Wall
 i915-y                                  += $(addprefix $(GVT_DIR)/, $(GVT_SOURCE))
-
-CFLAGS_kvmgt.o                          := -Wno-unused-function
 obj-$(CONFIG_DRM_I915_GVT_KVMGT)        += $(GVT_DIR)/kvmgt.o
diff --git a/drivers/gpu/drm/i915/gvt/gvt.h b/drivers/gpu/drm/i915/gvt/gvt.h
index b1a7c8dd4b5f..ad0e9364ee70 100644
--- a/drivers/gpu/drm/i915/gvt/gvt.h
+++ b/drivers/gpu/drm/i915/gvt/gvt.h
@@ -164,15 +164,17 @@ struct intel_vgpu {
 
 #if IS_ENABLED(CONFIG_DRM_I915_GVT_KVMGT)
         struct {
-                struct device *mdev;
+                struct mdev_device *mdev;
                 struct vfio_region *region;
                 int num_regions;
                 struct eventfd_ctx *intx_trigger;
                 struct eventfd_ctx *msi_trigger;
                 struct rb_root cache;
                 struct mutex cache_lock;
-                void *vfio_group;
                 struct notifier_block iommu_notifier;
+                struct notifier_block group_notifier;
+                struct kvm *kvm;
+                struct work_struct release_work;
         } vdev;
 #endif
 };
diff --git a/drivers/gpu/drm/i915/gvt/kvmgt.c b/drivers/gpu/drm/i915/gvt/kvmgt.c
index dc0365033157..4dd6722a7339 100644
--- a/drivers/gpu/drm/i915/gvt/kvmgt.c
+++ b/drivers/gpu/drm/i915/gvt/kvmgt.c
@@ -31,6 +31,7 @@
 #include <linux/init.h>
 #include <linux/device.h>
 #include <linux/mm.h>
+#include <linux/mmu_context.h>
 #include <linux/types.h>
 #include <linux/list.h>
 #include <linux/rbtree.h>
@@ -39,24 +40,13 @@
 #include <linux/uuid.h>
 #include <linux/kvm_host.h>
 #include <linux/vfio.h>
+#include <linux/mdev.h>
 
 #include "i915_drv.h"
 #include "gvt.h"
 
-static inline long kvmgt_pin_pages(struct device *dev, unsigned long *user_pfn,
-                        long npage, int prot, unsigned long *phys_pfn)
-{
-        return 0;
-}
-static inline long kvmgt_unpin_pages(struct device *dev, unsigned long *pfn,
-                        long npage)
-{
-        return 0;
-}
-
 static const struct intel_gvt_ops *intel_gvt_ops;
 
-
 /* helper macros copied from vfio-pci */
 #define VFIO_PCI_OFFSET_SHIFT   40
 #define VFIO_PCI_OFFSET_TO_INDEX(off)   (off >> VFIO_PCI_OFFSET_SHIFT)
@@ -90,6 +80,15 @@ struct gvt_dma {
         kvm_pfn_t pfn;
 };
 
+static inline bool handle_valid(unsigned long handle)
+{
+        return !!(handle & ~0xff);
+}
+
+static int kvmgt_guest_init(struct mdev_device *mdev);
+static void intel_vgpu_release_work(struct work_struct *work);
+static bool kvmgt_guest_exit(struct kvmgt_guest_info *info);
+
 static struct gvt_dma *__gvt_cache_find(struct intel_vgpu *vgpu, gfn_t gfn)
 {
         struct rb_node *node = vgpu->vdev.cache.rb_node;
@@ -167,9 +166,10 @@ static void __gvt_cache_remove_entry(struct intel_vgpu *vgpu,
 
 static void gvt_cache_remove(struct intel_vgpu *vgpu, gfn_t gfn)
 {
-        struct device *dev = vgpu->vdev.mdev;
+        struct device *dev = &vgpu->vdev.mdev->dev;
         struct gvt_dma *this;
-        unsigned long pfn;
+        unsigned long g1;
+        int rc;
 
         mutex_lock(&vgpu->vdev.cache_lock);
         this  = __gvt_cache_find(vgpu, gfn);
@@ -178,8 +178,9 @@ static void gvt_cache_remove(struct intel_vgpu *vgpu, gfn_t gfn)
                 return;
         }
 
-        pfn = this->pfn;
-        WARN_ON((kvmgt_unpin_pages(dev, &pfn, 1) != 1));
+        g1 = gfn;
+        rc = vfio_unpin_pages(dev, &g1, 1);
+        WARN_ON(rc != 1);
         __gvt_cache_remove_entry(vgpu, this);
         mutex_unlock(&vgpu->vdev.cache_lock);
 }
@@ -194,15 +195,15 @@ static void gvt_cache_destroy(struct intel_vgpu *vgpu)
 {
         struct gvt_dma *dma;
         struct rb_node *node = NULL;
-        struct device *dev = vgpu->vdev.mdev;
-        unsigned long pfn;
+        struct device *dev = &vgpu->vdev.mdev->dev;
+        unsigned long gfn;
 
         mutex_lock(&vgpu->vdev.cache_lock);
         while ((node = rb_first(&vgpu->vdev.cache))) {
                 dma = rb_entry(node, struct gvt_dma, node);
-                pfn = dma->pfn;
+                gfn = dma->gfn;
 
-                kvmgt_unpin_pages(dev, &pfn, 1);
+                vfio_unpin_pages(dev, &gfn, 1);
                 __gvt_cache_remove_entry(vgpu, dma);
         }
         mutex_unlock(&vgpu->vdev.cache_lock);
@@ -226,7 +227,53 @@ static struct intel_vgpu_type *intel_gvt_find_vgpu_type(struct intel_gvt *gvt,
         return NULL;
 }
 
+static ssize_t available_instance_show(struct kobject *kobj, struct device *dev,
+                char *buf)
+{
+        struct intel_vgpu_type *type;
+        unsigned int num = 0;
+        void *gvt = kdev_to_i915(dev)->gvt;
+
+        type = intel_gvt_find_vgpu_type(gvt, kobject_name(kobj));
+        if (!type)
+                num = 0;
+        else
+                num = type->avail_instance;
+
+        return sprintf(buf, "%u\n", num);
+}
+
+static ssize_t device_api_show(struct kobject *kobj, struct device *dev,
+                char *buf)
+{
+        return sprintf(buf, "%s\n", VFIO_DEVICE_API_PCI_STRING);
+}
+
+static ssize_t description_show(struct kobject *kobj, struct device *dev,
+                char *buf)
+{
+        struct intel_vgpu_type *type;
+        void *gvt = kdev_to_i915(dev)->gvt;
+
+        type = intel_gvt_find_vgpu_type(gvt, kobject_name(kobj));
+        if (!type)
+                return 0;
+
+        return sprintf(buf, "low_gm_size: %dMB\nhigh_gm_size: %dMB\n"
+                                "fence: %d\n",
+                                BYTES_TO_MB(type->low_gm_size),
+                                BYTES_TO_MB(type->high_gm_size),
+                                type->fence);
+}
+
+static MDEV_TYPE_ATTR_RO(available_instance);
+static MDEV_TYPE_ATTR_RO(device_api);
+static MDEV_TYPE_ATTR_RO(description);
+
 static struct attribute *type_attrs[] = {
+        &mdev_type_attr_available_instance.attr,
+        &mdev_type_attr_device_api.attr,
+        &mdev_type_attr_description.attr,
         NULL,
 };
 
@@ -322,7 +369,7 @@ static void kvmgt_protect_table_add(struct kvmgt_guest_info *info, gfn_t gfn)
         if (kvmgt_gfn_is_write_protected(info, gfn))
                 return;
 
-        p = kmalloc(sizeof(struct kvmgt_pgfn), GFP_ATOMIC);
+        p = kzalloc(sizeof(struct kvmgt_pgfn), GFP_ATOMIC);
         if (WARN(!p, "gfn: 0x%llx\n", gfn))
                 return;
 
@@ -342,6 +389,720 @@ static void kvmgt_protect_table_del(struct kvmgt_guest_info *info,
         }
 }
 
+static int intel_vgpu_create(struct kobject *kobj, struct mdev_device *mdev)
+{
+        struct intel_vgpu *vgpu;
+        struct intel_vgpu_type *type;
+        struct device *pdev;
+        void *gvt;
+
+        pdev = mdev->parent->dev;
+        gvt = kdev_to_i915(pdev)->gvt;
+
+        type = intel_gvt_find_vgpu_type(gvt, kobject_name(kobj));
+        if (!type) {
+                gvt_err("failed to find type %s to create\n",
+                                                kobject_name(kobj));
+                return -EINVAL;
+        }
+
+        vgpu = intel_gvt_ops->vgpu_create(gvt, type);
+        if (IS_ERR_OR_NULL(vgpu)) {
+                gvt_err("create intel vgpu failed\n");
+                return -EINVAL;
+        }
+
+        INIT_WORK(&vgpu->vdev.release_work, intel_vgpu_release_work);
+
+        vgpu->vdev.mdev = mdev;
+        mdev_set_drvdata(mdev, vgpu);
+
+        gvt_dbg_core("intel_vgpu_create succeeded for mdev: %s\n",
+                     dev_name(&mdev->dev));
+        return 0;
+}
+
+static int intel_vgpu_remove(struct mdev_device *mdev)
+{
+        struct intel_vgpu *vgpu = mdev_get_drvdata(mdev);
+
+        if (handle_valid(vgpu->handle))
+                return -EBUSY;
+
+        intel_gvt_ops->vgpu_destroy(vgpu);
+        return 0;
+}
+
+static int intel_vgpu_iommu_notifier(struct notifier_block *nb,
+                                     unsigned long action, void *data)
+{
+        struct intel_vgpu *vgpu = container_of(nb,
+                                        struct intel_vgpu,
+                                        vdev.iommu_notifier);
+
+        if (action == VFIO_IOMMU_NOTIFY_DMA_UNMAP) {
+                struct vfio_iommu_type1_dma_unmap *unmap = data;
+                unsigned long gfn, end_gfn;
+
+                gfn = unmap->iova >> PAGE_SHIFT;
+                end_gfn = gfn + unmap->size / PAGE_SIZE;
+
+                while (gfn < end_gfn)
+                        gvt_cache_remove(vgpu, gfn++);
+        }
+
+        return NOTIFY_OK;
+}
+
+static int intel_vgpu_group_notifier(struct notifier_block *nb,
+                                     unsigned long action, void *data)
+{
+        struct intel_vgpu *vgpu = container_of(nb,
+                                        struct intel_vgpu,
+                                        vdev.group_notifier);
+
+        /* the only action we care about */
+        if (action == VFIO_GROUP_NOTIFY_SET_KVM) {
+                vgpu->vdev.kvm = data;
+
+                if (!data)
+                        schedule_work(&vgpu->vdev.release_work);
+        }
+
+        return NOTIFY_OK;
+}
+
+static int intel_vgpu_open(struct mdev_device *mdev)
+{
+        struct intel_vgpu *vgpu = mdev_get_drvdata(mdev);
+        unsigned long events;
+        int ret;
+
+        vgpu->vdev.iommu_notifier.notifier_call = intel_vgpu_iommu_notifier;
+        vgpu->vdev.group_notifier.notifier_call = intel_vgpu_group_notifier;
+
+        events = VFIO_IOMMU_NOTIFY_DMA_UNMAP;
+        ret = vfio_register_notifier(&mdev->dev, VFIO_IOMMU_NOTIFY, &events,
+                                &vgpu->vdev.iommu_notifier);
+        if (ret != 0) {
+                gvt_err("vfio_register_notifier for iommu failed: %d\n", ret);
+                goto out;
+        }
+
+        events = VFIO_GROUP_NOTIFY_SET_KVM;
+        ret = vfio_register_notifier(&mdev->dev, VFIO_GROUP_NOTIFY, &events,
+                                &vgpu->vdev.group_notifier);
+        if (ret != 0) {
+                gvt_err("vfio_register_notifier for group failed: %d\n", ret);
+                goto undo_iommu;
+        }
+
+        return kvmgt_guest_init(mdev);
+
+undo_iommu:
+        vfio_unregister_notifier(&mdev->dev, VFIO_IOMMU_NOTIFY,
+                                        &vgpu->vdev.iommu_notifier);
+out:
+        return ret;
+}
+
+static void __intel_vgpu_release(struct intel_vgpu *vgpu)
+{
+        struct kvmgt_guest_info *info;
+
+        if (!handle_valid(vgpu->handle))
+                return;
+
+        vfio_unregister_notifier(&vgpu->vdev.mdev->dev, VFIO_IOMMU_NOTIFY,
+                                        &vgpu->vdev.iommu_notifier);
+        vfio_unregister_notifier(&vgpu->vdev.mdev->dev, VFIO_GROUP_NOTIFY,
+                                        &vgpu->vdev.group_notifier);
+
+        info = (struct kvmgt_guest_info *)vgpu->handle;
+        kvmgt_guest_exit(info);
+        vgpu->handle = 0;
+}
+
+static void intel_vgpu_release(struct mdev_device *mdev)
+{
+        struct intel_vgpu *vgpu = mdev_get_drvdata(mdev);
+
+        __intel_vgpu_release(vgpu);
+}
+
+static void intel_vgpu_release_work(struct work_struct *work)
+{
+        struct intel_vgpu *vgpu = container_of(work, struct intel_vgpu,
+                                        vdev.release_work);
+        __intel_vgpu_release(vgpu);
+}
+
+static uint64_t intel_vgpu_get_bar0_addr(struct intel_vgpu *vgpu)
+{
+        u32 start_lo, start_hi;
+        u32 mem_type;
+        int pos = PCI_BASE_ADDRESS_0;
+
+        start_lo = (*(u32 *)(vgpu->cfg_space.virtual_cfg_space + pos)) &
+                        PCI_BASE_ADDRESS_MEM_MASK;
+        mem_type = (*(u32 *)(vgpu->cfg_space.virtual_cfg_space + pos)) &
+                        PCI_BASE_ADDRESS_MEM_TYPE_MASK;
+
+        switch (mem_type) {
+        case PCI_BASE_ADDRESS_MEM_TYPE_64:
+                start_hi = (*(u32 *)(vgpu->cfg_space.virtual_cfg_space
+                                                + pos + 4));
+                break;
+        case PCI_BASE_ADDRESS_MEM_TYPE_32:
+        case PCI_BASE_ADDRESS_MEM_TYPE_1M:
+                /* 1M mem BAR treated as 32-bit BAR */
+        default:
+                /* mem unknown type treated as 32-bit BAR */
+                start_hi = 0;
+                break;
+        }
+
+        return ((u64)start_hi << 32) | start_lo;
+}
+
+static ssize_t intel_vgpu_rw(struct mdev_device *mdev, char *buf,
+                        size_t count, loff_t *ppos, bool is_write)
+{
+        struct intel_vgpu *vgpu = mdev_get_drvdata(mdev);
+        unsigned int index = VFIO_PCI_OFFSET_TO_INDEX(*ppos);
+        uint64_t pos = *ppos & VFIO_PCI_OFFSET_MASK;
+        int ret = -EINVAL;
+
+
+        if (index >= VFIO_PCI_NUM_REGIONS) {
+                gvt_err("invalid index: %u\n", index);
+                return -EINVAL;
+        }
+
+        switch (index) {
+        case VFIO_PCI_CONFIG_REGION_INDEX:
+                if (is_write)
+                        ret = intel_gvt_ops->emulate_cfg_write(vgpu, pos,
+                                                buf, count);
+                else
+                        ret = intel_gvt_ops->emulate_cfg_read(vgpu, pos,
+                                                buf, count);
+                break;
+        case VFIO_PCI_BAR0_REGION_INDEX:
+        case VFIO_PCI_BAR1_REGION_INDEX:
+                if (is_write) {
+                        uint64_t bar0_start = intel_vgpu_get_bar0_addr(vgpu);
+
+                        ret = intel_gvt_ops->emulate_mmio_write(vgpu,
+                                                bar0_start + pos, buf, count);
+                } else {
+                        uint64_t bar0_start = intel_vgpu_get_bar0_addr(vgpu);
+
+                        ret = intel_gvt_ops->emulate_mmio_read(vgpu,
+                                                bar0_start + pos, buf, count);
+                }
+                break;
+        case VFIO_PCI_BAR2_REGION_INDEX:
+        case VFIO_PCI_BAR3_REGION_INDEX:
+        case VFIO_PCI_BAR4_REGION_INDEX:
+        case VFIO_PCI_BAR5_REGION_INDEX:
+        case VFIO_PCI_VGA_REGION_INDEX:
+        case VFIO_PCI_ROM_REGION_INDEX:
+        default:
+                gvt_err("unsupported region: %u\n", index);
+        }
+
+        return ret == 0 ? count : ret;
+}
+
+static ssize_t intel_vgpu_read(struct mdev_device *mdev, char __user *buf,
+                        size_t count, loff_t *ppos)
+{
+        unsigned int done = 0;
+        int ret;
+
+        while (count) {
+                size_t filled;
+
+                if (count >= 4 && !(*ppos % 4)) {
+                        u32 val;
+
+                        ret = intel_vgpu_rw(mdev, (char *)&val, sizeof(val),
+                                        ppos, false);
+                        if (ret <= 0)
+                                goto read_err;
+
+                        if (copy_to_user(buf, &val, sizeof(val)))
+                                goto read_err;
+
+                        filled = 4;
+                } else if (count >= 2 && !(*ppos % 2)) {
+                        u16 val;
+
+                        ret = intel_vgpu_rw(mdev, (char *)&val, sizeof(val),
+                                        ppos, false);
+                        if (ret <= 0)
+                                goto read_err;
+
+                        if (copy_to_user(buf, &val, sizeof(val)))
+                                goto read_err;
+
+                        filled = 2;
+                } else {
+                        u8 val;
+
+                        ret = intel_vgpu_rw(mdev, &val, sizeof(val), ppos,
+                                        false);
+                        if (ret <= 0)
+                                goto read_err;
+
+                        if (copy_to_user(buf, &val, sizeof(val)))
+                                goto read_err;
+
+                        filled = 1;
+                }
+
+                count -= filled;
+                done += filled;
+                *ppos += filled;
+                buf += filled;
+        }
+
+        return done;
+
+read_err:
+        return -EFAULT;
+}
+
+static ssize_t intel_vgpu_write(struct mdev_device *mdev,
+                                const char __user *buf,
+                                size_t count, loff_t *ppos)
+{
+        unsigned int done = 0;
+        int ret;
+
+        while (count) {
+                size_t filled;
+
+                if (count >= 4 && !(*ppos % 4)) {
+                        u32 val;
+
+                        if (copy_from_user(&val, buf, sizeof(val)))
+                                goto write_err;
+
+                        ret = intel_vgpu_rw(mdev, (char *)&val, sizeof(val),
+                                        ppos, true);
+                        if (ret <= 0)
+                                goto write_err;
+
+                        filled = 4;
+                } else if (count >= 2 && !(*ppos % 2)) {
+                        u16 val;
+
+                        if (copy_from_user(&val, buf, sizeof(val)))
+                                goto write_err;
+
+                        ret = intel_vgpu_rw(mdev, (char *)&val,
+                                        sizeof(val), ppos, true);
+                        if (ret <= 0)
+                                goto write_err;
+
+                        filled = 2;
+                } else {
+                        u8 val;
+
+                        if (copy_from_user(&val, buf, sizeof(val)))
+                                goto write_err;
+
+                        ret = intel_vgpu_rw(mdev, &val, sizeof(val),
+                                        ppos, true);
+                        if (ret <= 0)
+                                goto write_err;
+
+                        filled = 1;
+                }
+
+                count -= filled;
+                done += filled;
+                *ppos += filled;
+                buf += filled;
+        }
+
+        return done;
+write_err:
+        return -EFAULT;
+}
+
+static int intel_vgpu_mmap(struct mdev_device *mdev, struct vm_area_struct *vma)
+{
+        unsigned int index;
+        u64 virtaddr;
+        unsigned long req_size, pgoff = 0;
+        pgprot_t pg_prot;
+        struct intel_vgpu *vgpu = mdev_get_drvdata(mdev);
+
+        index = vma->vm_pgoff >> (VFIO_PCI_OFFSET_SHIFT - PAGE_SHIFT);
+        if (index >= VFIO_PCI_ROM_REGION_INDEX)
+                return -EINVAL;
+
+        if (vma->vm_end < vma->vm_start)
+                return -EINVAL;
+        if ((vma->vm_flags & VM_SHARED) == 0)
+                return -EINVAL;
+        if (index != VFIO_PCI_BAR2_REGION_INDEX)
+                return -EINVAL;
+
+        pg_prot = vma->vm_page_prot;
+        virtaddr = vma->vm_start;
+        req_size = vma->vm_end - vma->vm_start;
+        pgoff = vgpu_aperture_pa_base(vgpu) >> PAGE_SHIFT;
+
+        return remap_pfn_range(vma, virtaddr, pgoff, req_size, pg_prot);
+}
+
+static int intel_vgpu_get_irq_count(struct intel_vgpu *vgpu, int type)
+{
+        if (type == VFIO_PCI_INTX_IRQ_INDEX || type == VFIO_PCI_MSI_IRQ_INDEX)
+                return 1;
+
+        return 0;
+}
+
+static int intel_vgpu_set_intx_mask(struct intel_vgpu *vgpu,
+                        unsigned int index, unsigned int start,
+                        unsigned int count, uint32_t flags,
+                        void *data)
+{
+        return 0;
+}
+
+static int intel_vgpu_set_intx_unmask(struct intel_vgpu *vgpu,
+                        unsigned int index, unsigned int start,
+                        unsigned int count, uint32_t flags, void *data)
+{
+        return 0;
+}
+
+static int intel_vgpu_set_intx_trigger(struct intel_vgpu *vgpu,
+                unsigned int index, unsigned int start, unsigned int count,
+                uint32_t flags, void *data)
+{
+        return 0;
+}
+
+static int intel_vgpu_set_msi_trigger(struct intel_vgpu *vgpu,
+                unsigned int index, unsigned int start, unsigned int count,
+                uint32_t flags, void *data)
+{
+        struct eventfd_ctx *trigger;
+
+        if (flags & VFIO_IRQ_SET_DATA_EVENTFD) {
+                int fd = *(int *)data;
+
+                trigger = eventfd_ctx_fdget(fd);
+                if (IS_ERR(trigger)) {
+                        gvt_err("eventfd_ctx_fdget failed\n");
+                        return PTR_ERR(trigger);
+                }
+                vgpu->vdev.msi_trigger = trigger;
+        }
+
+        return 0;
+}
+
+static int intel_vgpu_set_irqs(struct intel_vgpu *vgpu, uint32_t flags,
+                unsigned int index, unsigned int start, unsigned int count,
+                void *data)
+{
+        int (*func)(struct intel_vgpu *vgpu, unsigned int index,
+                        unsigned int start, unsigned int count, uint32_t flags,
+                        void *data) = NULL;
+
+        switch (index) {
+        case VFIO_PCI_INTX_IRQ_INDEX:
+                switch (flags & VFIO_IRQ_SET_ACTION_TYPE_MASK) {
+                case VFIO_IRQ_SET_ACTION_MASK:
+                        func = intel_vgpu_set_intx_mask;
+                        break;
+                case VFIO_IRQ_SET_ACTION_UNMASK:
+                        func = intel_vgpu_set_intx_unmask;
+                        break;
+                case VFIO_IRQ_SET_ACTION_TRIGGER:
+                        func = intel_vgpu_set_intx_trigger;
+                        break;
+                }
+                break;
+        case VFIO_PCI_MSI_IRQ_INDEX:
+                switch (flags & VFIO_IRQ_SET_ACTION_TYPE_MASK) {
+                case VFIO_IRQ_SET_ACTION_MASK:
+                case VFIO_IRQ_SET_ACTION_UNMASK:
+                        /* XXX Need masking support exported */
+                        break;
+                case VFIO_IRQ_SET_ACTION_TRIGGER:
+                        func = intel_vgpu_set_msi_trigger;
+                        break;
+                }
+                break;
+        }
+
+        if (!func)
+                return -ENOTTY;
+
+        return func(vgpu, index, start, count, flags, data);
+}
+
+static long intel_vgpu_ioctl(struct mdev_device *mdev, unsigned int cmd,
+                             unsigned long arg)
+{
+        struct intel_vgpu *vgpu = mdev_get_drvdata(mdev);
+        unsigned long minsz;
+
+        gvt_dbg_core("vgpu%d ioctl, cmd: %d\n", vgpu->id, cmd);
+
+        if (cmd == VFIO_DEVICE_GET_INFO) {
+                struct vfio_device_info info;
+
+                minsz = offsetofend(struct vfio_device_info, num_irqs);
+
+                if (copy_from_user(&info, (void __user *)arg, minsz))
+                        return -EFAULT;
+
+                if (info.argsz < minsz)
+                        return -EINVAL;
+
+                info.flags = VFIO_DEVICE_FLAGS_PCI;
+                info.flags |= VFIO_DEVICE_FLAGS_RESET;
+                info.num_regions = VFIO_PCI_NUM_REGIONS;
+                info.num_irqs = VFIO_PCI_NUM_IRQS;
+
+                return copy_to_user((void __user *)arg, &info, minsz) ?
+                        -EFAULT : 0;
+
+        } else if (cmd == VFIO_DEVICE_GET_REGION_INFO) {
+                struct vfio_region_info info;
+                struct vfio_info_cap caps = { .buf = NULL, .size = 0 };
+                int i, ret;
+                struct vfio_region_info_cap_sparse_mmap *sparse = NULL;
+                size_t size;
+                int nr_areas = 1;
+                int cap_type_id;
+
+                minsz = offsetofend(struct vfio_region_info, offset);
+
+                if (copy_from_user(&info, (void __user *)arg, minsz))
+                        return -EFAULT;
+
+                if (info.argsz < minsz)
+                        return -EINVAL;
+
+                switch (info.index) {
+                case VFIO_PCI_CONFIG_REGION_INDEX:
+                        info.offset = VFIO_PCI_INDEX_TO_OFFSET(info.index);
+                        info.size = INTEL_GVT_MAX_CFG_SPACE_SZ;
+                        info.flags = VFIO_REGION_INFO_FLAG_READ |
+                                     VFIO_REGION_INFO_FLAG_WRITE;
+                        break;
+                case VFIO_PCI_BAR0_REGION_INDEX:
+                        info.offset = VFIO_PCI_INDEX_TO_OFFSET(info.index);
+                        info.size = vgpu->cfg_space.bar[info.index].size;
+                        if (!info.size) {
+                                info.flags = 0;
+                                break;
+                        }
+
+                        info.flags = VFIO_REGION_INFO_FLAG_READ |
+                                     VFIO_REGION_INFO_FLAG_WRITE;
+                        break;
+                case VFIO_PCI_BAR1_REGION_INDEX:
+                        info.offset = VFIO_PCI_INDEX_TO_OFFSET(info.index);
+                        info.size = 0;
+                        info.flags = 0;
+                        break;
+                case VFIO_PCI_BAR2_REGION_INDEX:
+                        info.offset = VFIO_PCI_INDEX_TO_OFFSET(info.index);
+                        info.flags = VFIO_REGION_INFO_FLAG_CAPS |
+                                        VFIO_REGION_INFO_FLAG_MMAP |
+                                        VFIO_REGION_INFO_FLAG_READ |
+                                        VFIO_REGION_INFO_FLAG_WRITE;
+                        info.size = gvt_aperture_sz(vgpu->gvt);
+
+                        size = sizeof(*sparse) +
+                                        (nr_areas * sizeof(*sparse->areas));
+                        sparse = kzalloc(size, GFP_KERNEL);
+                        if (!sparse)
+                                return -ENOMEM;
+
+                        sparse->nr_areas = nr_areas;
+                        cap_type_id = VFIO_REGION_INFO_CAP_SPARSE_MMAP;
+                        sparse->areas[0].offset =
+                                        PAGE_ALIGN(vgpu_aperture_offset(vgpu));
+                        sparse->areas[0].size = vgpu_aperture_sz(vgpu);
+                        if (!caps.buf) {
+                                kfree(caps.buf);
+                                caps.buf = NULL;
+                                caps.size = 0;
+                        }
+                        break;
+
+                case VFIO_PCI_BAR3_REGION_INDEX ... VFIO_PCI_BAR5_REGION_INDEX:
+                        info.offset = VFIO_PCI_INDEX_TO_OFFSET(info.index);
+                        info.size = 0;
+
+                        info.flags = 0;
+                        gvt_dbg_core("get region info bar:%d\n", info.index);
+                        break;
+
+                case VFIO_PCI_ROM_REGION_INDEX:
+                case VFIO_PCI_VGA_REGION_INDEX:
+                        gvt_dbg_core("get region info index:%d\n", info.index);
+                        break;
+                default:
+                        {
+                                struct vfio_region_info_cap_type cap_type;
+
+                                if (info.index >= VFIO_PCI_NUM_REGIONS +
+                                                vgpu->vdev.num_regions)
+                                        return -EINVAL;
+
+                                i = info.index - VFIO_PCI_NUM_REGIONS;
+
+                                info.offset =
+                                        VFIO_PCI_INDEX_TO_OFFSET(info.index);
+                                info.size = vgpu->vdev.region[i].size;
+                                info.flags = vgpu->vdev.region[i].flags;
+
+                                cap_type.type = vgpu->vdev.region[i].type;
+                                cap_type.subtype = vgpu->vdev.region[i].subtype;
+
+                                ret = vfio_info_add_capability(&caps,
+                                                VFIO_REGION_INFO_CAP_TYPE,
+                                                &cap_type);
+                                if (ret)
+                                        return ret;
+                        }
+                }
+
+                if ((info.flags & VFIO_REGION_INFO_FLAG_CAPS) && sparse) {
+                        switch (cap_type_id) {
+                        case VFIO_REGION_INFO_CAP_SPARSE_MMAP:
+                                ret = vfio_info_add_capability(&caps,
+                                        VFIO_REGION_INFO_CAP_SPARSE_MMAP,
+                                        sparse);
+                                kfree(sparse);
+                                if (ret)
+                                        return ret;
+                                break;
+                        default:
+                                return -EINVAL;
+                        }
+                }
+
+                if (caps.size) {
+                        if (info.argsz < sizeof(info) + caps.size) {
+                                info.argsz = sizeof(info) + caps.size;
+                                info.cap_offset = 0;
+                        } else {
+                                vfio_info_cap_shift(&caps, sizeof(info));
+                                if (copy_to_user((void __user *)arg +
+                                                  sizeof(info), caps.buf,
+                                                  caps.size)) {
+                                        kfree(caps.buf);
+                                        return -EFAULT;
+                                }
+                                info.cap_offset = sizeof(info);
+                        }
+
+                        kfree(caps.buf);
+                }
+
+                return copy_to_user((void __user *)arg, &info, minsz) ?
+                        -EFAULT : 0;
+        } else if (cmd == VFIO_DEVICE_GET_IRQ_INFO) {
+                struct vfio_irq_info info;
+
+                minsz = offsetofend(struct vfio_irq_info, count);
+
+                if (copy_from_user(&info, (void __user *)arg, minsz))
+                        return -EFAULT;
+
+                if (info.argsz < minsz || info.index >= VFIO_PCI_NUM_IRQS)
+                        return -EINVAL;
+
+                switch (info.index) {
+                case VFIO_PCI_INTX_IRQ_INDEX:
+                case VFIO_PCI_MSI_IRQ_INDEX:
+                        break;
+                default:
+                        return -EINVAL;
+                }
+
+                info.flags = VFIO_IRQ_INFO_EVENTFD;
+
+                info.count = intel_vgpu_get_irq_count(vgpu, info.index);
+
+                if (info.index == VFIO_PCI_INTX_IRQ_INDEX)
+                        info.flags |= (VFIO_IRQ_INFO_MASKABLE |
+                                       VFIO_IRQ_INFO_AUTOMASKED);
+                else
+                        info.flags |= VFIO_IRQ_INFO_NORESIZE;
+
+                return copy_to_user((void __user *)arg, &info, minsz) ?
+                        -EFAULT : 0;
+        } else if (cmd == VFIO_DEVICE_SET_IRQS) {
+                struct vfio_irq_set hdr;
+                u8 *data = NULL;
+                int ret = 0;
+                size_t data_size = 0;
+
+                minsz = offsetofend(struct vfio_irq_set, count);
+
+                if (copy_from_user(&hdr, (void __user *)arg, minsz))
+                        return -EFAULT;
+
+                if (!(hdr.flags & VFIO_IRQ_SET_DATA_NONE)) {
+                        int max = intel_vgpu_get_irq_count(vgpu, hdr.index);
+
+                        ret = vfio_set_irqs_validate_and_prepare(&hdr, max,
+                                                VFIO_PCI_NUM_IRQS, &data_size);
+                        if (ret) {
+                                gvt_err("intel:vfio_set_irqs_validate_and_prepare failed\n");
+                                return -EINVAL;
+                        }
+                        if (data_size) {
+                                data = memdup_user((void __user *)(arg + minsz),
+                                                   data_size);
+                                if (IS_ERR(data))
+                                        return PTR_ERR(data);
+                        }
+                }
+
+                ret = intel_vgpu_set_irqs(vgpu, hdr.flags, hdr.index,
+                                        hdr.start, hdr.count, data);
+                kfree(data);
+
+                return ret;
+        } else if (cmd == VFIO_DEVICE_RESET) {
+                intel_gvt_ops->vgpu_reset(vgpu);
+                return 0;
+        }
+
+        return 0;
+}
+
+static const struct parent_ops intel_vgpu_ops = {
+        .supported_type_groups  = intel_vgpu_type_groups,
+        .create                 = intel_vgpu_create,
+        .remove                 = intel_vgpu_remove,
+
+        .open                   = intel_vgpu_open,
+        .release                = intel_vgpu_release,
+
+        .read                   = intel_vgpu_read,
+        .write                  = intel_vgpu_write,
+        .mmap                   = intel_vgpu_mmap,
+        .ioctl                  = intel_vgpu_ioctl,
+};
+
 static int kvmgt_host_init(struct device *dev, void *gvt, const void *ops)
 {
         if (!intel_gvt_init_vgpu_type_groups(gvt))
@@ -349,22 +1110,28 @@ static int kvmgt_host_init(struct device *dev, void *gvt, const void *ops)
 
         intel_gvt_ops = ops;
 
-        /* MDEV is not yet available */
-        return -ENODEV;
+        return mdev_register_device(dev, &intel_vgpu_ops);
 }
 
 static void kvmgt_host_exit(struct device *dev, void *gvt)
 {
         intel_gvt_cleanup_vgpu_type_groups(gvt);
+        mdev_unregister_device(dev);
 }
 
 static int kvmgt_write_protect_add(unsigned long handle, u64 gfn)
 {
-        struct kvmgt_guest_info *info = (struct kvmgt_guest_info *)handle;
-        struct kvm *kvm = info->kvm;
+        struct kvmgt_guest_info *info;
+        struct kvm *kvm;
         struct kvm_memory_slot *slot;
         int idx;
 
+        if (!handle_valid(handle))
+                return -ESRCH;
+
+        info = (struct kvmgt_guest_info *)handle;
+        kvm = info->kvm;
+
         idx = srcu_read_lock(&kvm->srcu);
         slot = gfn_to_memslot(kvm, gfn);
 
@@ -384,11 +1151,17 @@ out:
 
 static int kvmgt_write_protect_remove(unsigned long handle, u64 gfn)
 {
-        struct kvmgt_guest_info *info = (struct kvmgt_guest_info *)handle;
-        struct kvm *kvm = info->kvm;
+        struct kvmgt_guest_info *info;
+        struct kvm *kvm;
         struct kvm_memory_slot *slot;
         int idx;
 
+        if (!handle_valid(handle))
+                return 0;
+
+        info = (struct kvmgt_guest_info *)handle;
+        kvm = info->kvm;
+
         idx = srcu_read_lock(&kvm->srcu);
         slot = gfn_to_memslot(kvm, gfn);
 
@@ -476,6 +1249,85 @@ static int kvmgt_detect_host(void)
         return kvmgt_check_guest() ? -ENODEV : 0;
 }
 
+static bool __kvmgt_vgpu_exist(struct intel_vgpu *vgpu, struct kvm *kvm)
+{
+        struct intel_vgpu *itr;
+        struct kvmgt_guest_info *info;
+        int id;
+        bool ret = false;
+
+        mutex_lock(&vgpu->gvt->lock);
+        for_each_active_vgpu(vgpu->gvt, itr, id) {
+                if (!handle_valid(itr->handle))
+                        continue;
+
+                info = (struct kvmgt_guest_info *)itr->handle;
+                if (kvm && kvm == info->kvm) {
+                        ret = true;
+                        goto out;
+                }
+        }
+out:
+        mutex_unlock(&vgpu->gvt->lock);
+        return ret;
+}
+
+static int kvmgt_guest_init(struct mdev_device *mdev)
+{
+        struct kvmgt_guest_info *info;
+        struct intel_vgpu *vgpu;
+        struct kvm *kvm;
+
+        vgpu = mdev_get_drvdata(mdev);
+        if (handle_valid(vgpu->handle))
+                return -EEXIST;
+
+        kvm = vgpu->vdev.kvm;
+        if (!kvm || kvm->mm != current->mm) {
+                gvt_err("KVM is required to use Intel vGPU\n");
+                return -ESRCH;
+        }
+
+        if (__kvmgt_vgpu_exist(vgpu, kvm))
+                return -EEXIST;
+
+        info = vzalloc(sizeof(struct kvmgt_guest_info));
+        if (!info)
+                return -ENOMEM;
+
+        vgpu->handle = (unsigned long)info;
+        info->vgpu = vgpu;
+        info->kvm = kvm;
+
+        kvmgt_protect_table_init(info);
+        gvt_cache_init(vgpu);
+
+        info->track_node.track_write = kvmgt_page_track_write;
+        info->track_node.track_flush_slot = kvmgt_page_track_flush_slot;
+        kvm_page_track_register_notifier(kvm, &info->track_node);
+
+        return 0;
+}
+
+static bool kvmgt_guest_exit(struct kvmgt_guest_info *info)
+{
+        struct intel_vgpu *vgpu;
+
+        if (!info) {
+                gvt_err("kvmgt_guest_info invalid\n");
+                return false;
+        }
+
+        vgpu = info->vgpu;
+
+        kvm_page_track_unregister_notifier(info->kvm, &info->track_node);
+        kvmgt_protect_table_destroy(info);
+        gvt_cache_destroy(vgpu);
+        vfree(info);
+
+        return true;
+}
+
 static int kvmgt_attach_vgpu(void *vgpu, unsigned long *handle)
 {
         /* nothing to do here */
@@ -489,63 +1341,72 @@ static void kvmgt_detach_vgpu(unsigned long handle)
 
 static int kvmgt_inject_msi(unsigned long handle, u32 addr, u16 data)
 {
-        struct kvmgt_guest_info *info = (struct kvmgt_guest_info *)handle;
-        struct intel_vgpu *vgpu = info->vgpu;
+        struct kvmgt_guest_info *info;
+        struct intel_vgpu *vgpu;
 
-        if (vgpu->vdev.msi_trigger)
-                return eventfd_signal(vgpu->vdev.msi_trigger, 1) == 1;
+        if (!handle_valid(handle))
+                return -ESRCH;
 
-        return false;
+        info = (struct kvmgt_guest_info *)handle;
+        vgpu = info->vgpu;
+
+        if (eventfd_signal(vgpu->vdev.msi_trigger, 1) == 1)
+                return 0;
+
+        return -EFAULT;
 }
 
 static unsigned long kvmgt_gfn_to_pfn(unsigned long handle, unsigned long gfn)
 {
         unsigned long pfn;
-        struct kvmgt_guest_info *info = (struct kvmgt_guest_info *)handle;
+        struct kvmgt_guest_info *info;
+        struct device *dev;
         int rc;
 
+        if (!handle_valid(handle))
+                return INTEL_GVT_INVALID_ADDR;
+
+        info = (struct kvmgt_guest_info *)handle;
         pfn = gvt_cache_find(info->vgpu, gfn);
         if (pfn != 0)
                 return pfn;
 
-        rc = kvmgt_pin_pages(info->vgpu->vdev.mdev, &gfn, 1,
-                             IOMMU_READ | IOMMU_WRITE, &pfn);
+        pfn = INTEL_GVT_INVALID_ADDR;
+        dev = &info->vgpu->vdev.mdev->dev;
+        rc = vfio_pin_pages(dev, &gfn, 1, IOMMU_READ | IOMMU_WRITE, &pfn);
         if (rc != 1) {
-                gvt_err("vfio_pin_pages failed for gfn: 0x%lx\n", gfn);
-                return 0;
+                gvt_err("vfio_pin_pages failed for gfn 0x%lx: %d\n", gfn, rc);
+                return INTEL_GVT_INVALID_ADDR;
         }
 
         gvt_cache_add(info->vgpu, gfn, pfn);
         return pfn;
 }
 
-static void *kvmgt_gpa_to_hva(unsigned long handle, unsigned long gpa)
+static int kvmgt_rw_gpa(unsigned long handle, unsigned long gpa,
+                        void *buf, unsigned long len, bool write)
 {
-        unsigned long pfn;
-        gfn_t gfn = gpa_to_gfn(gpa);
+        struct kvmgt_guest_info *info;
+        struct kvm *kvm;
+        int ret;
+        bool kthread = current->mm == NULL;
 
-        pfn = kvmgt_gfn_to_pfn(handle, gfn);
-        if (!pfn)
-                return NULL;
+        if (!handle_valid(handle))
+                return -ESRCH;
 
-        return (char *)pfn_to_kaddr(pfn) + offset_in_page(gpa);
-}
+        info = (struct kvmgt_guest_info *)handle;
+        kvm = info->kvm;
 
-static int kvmgt_rw_gpa(unsigned long handle, unsigned long gpa,
-                        void *buf, unsigned long len, bool write)
-{
-        void *hva = NULL;
+        if (kthread)
+                use_mm(kvm->mm);
 
-        hva = kvmgt_gpa_to_hva(handle, gpa);
-        if (!hva)
-                return -EFAULT;
+        ret = write ? kvm_write_guest(kvm, gpa, buf, len) :
+                      kvm_read_guest(kvm, gpa, buf, len);
 
-        if (write)
-                memcpy(hva, buf, len);
-        else
-                memcpy(buf, hva, len);
+        if (kthread)
+                unuse_mm(kvm->mm);
 
-        return 0;
+        return ret;
 }
 
 static int kvmgt_read_gpa(unsigned long handle, unsigned long gpa,