diff mbox

[qemu,v18,4/5] vfio/spapr: Create DMA window dynamically (SPAPR IOMMU v2)

Message ID 1466471645-5396-5-git-send-email-aik@ozlabs.ru
State New
Headers show

Commit Message

Alexey Kardashevskiy June 21, 2016, 1:14 a.m. UTC
New VFIO_SPAPR_TCE_v2_IOMMU type supports dynamic DMA window management.
This adds ability to VFIO common code to dynamically allocate/remove
DMA windows in the host kernel when new VFIO container is added/removed.

This adds a helper to vfio_listener_region_add which makes
VFIO_IOMMU_SPAPR_TCE_CREATE ioctl and adds just created IOMMU into
the host IOMMU list; the opposite action is taken in
vfio_listener_region_del.

When creating a new window, this uses heuristic to decide on the TCE table
levels number.

This should cause no guest visible change in behavior.

Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>
---
Changes:
v18:
* moved trace definitions under hw/vfio/spapr.c section
* moved trace_vfio_spapr_remove_window to vfio_spapr_remove_window()
* vfio_host_win_del() now checks for exact window size
* one ctz() less in vfio_spapr_create_window()

v17:
* moved spapr window create/remove helpers to separate file
* added hw_error() if vfio_host_win_del() failed

v16:
* used memory_region_iommu_get_page_sizes() in vfio_listener_region_add()
* enforced no intersections between windows

v14:
* new to the series
---
 hw/vfio/common.c              | 79 +++++++++++++++++++++++++++++++++++++------
 hw/vfio/spapr.c               | 71 ++++++++++++++++++++++++++++++++++++++
 include/hw/vfio/vfio-common.h |  6 ++++
 trace-events                  |  2 ++
 4 files changed, 148 insertions(+), 10 deletions(-)

Comments

David Gibson June 22, 2016, 1:29 a.m. UTC | #1
On Tue, Jun 21, 2016 at 11:14:04AM +1000, Alexey Kardashevskiy wrote:
> New VFIO_SPAPR_TCE_v2_IOMMU type supports dynamic DMA window management.
> This adds ability to VFIO common code to dynamically allocate/remove
> DMA windows in the host kernel when new VFIO container is added/removed.
> 
> This adds a helper to vfio_listener_region_add which makes
> VFIO_IOMMU_SPAPR_TCE_CREATE ioctl and adds just created IOMMU into
> the host IOMMU list; the opposite action is taken in
> vfio_listener_region_del.
> 
> When creating a new window, this uses heuristic to decide on the TCE table
> levels number.
> 
> This should cause no guest visible change in behavior.
> 
> Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>

Reviewed-by: David Gibson <david@gibson.dropbear.id.au>


> ---
> Changes:
> v18:
> * moved trace definitions under hw/vfio/spapr.c section
> * moved trace_vfio_spapr_remove_window to vfio_spapr_remove_window()
> * vfio_host_win_del() now checks for exact window size
> * one ctz() less in vfio_spapr_create_window()
> 
> v17:
> * moved spapr window create/remove helpers to separate file
> * added hw_error() if vfio_host_win_del() failed
> 
> v16:
> * used memory_region_iommu_get_page_sizes() in vfio_listener_region_add()
> * enforced no intersections between windows
> 
> v14:
> * new to the series
> ---
>  hw/vfio/common.c              | 79 +++++++++++++++++++++++++++++++++++++------
>  hw/vfio/spapr.c               | 71 ++++++++++++++++++++++++++++++++++++++
>  include/hw/vfio/vfio-common.h |  6 ++++
>  trace-events                  |  2 ++
>  4 files changed, 148 insertions(+), 10 deletions(-)
> 
> diff --git a/hw/vfio/common.c b/hw/vfio/common.c
> index b53a1db..8e3466c 100644
> --- a/hw/vfio/common.c
> +++ b/hw/vfio/common.c
> @@ -265,6 +265,21 @@ static void vfio_host_win_add(VFIOContainer *container,
>      QLIST_INSERT_HEAD(&container->hostwin_list, hostwin, hostwin_next);
>  }
>  
> +static int vfio_host_win_del(VFIOContainer *container, hwaddr min_iova,
> +                             hwaddr max_iova)
> +{
> +    VFIOHostDMAWindow *hostwin;
> +
> +    QLIST_FOREACH(hostwin, &container->hostwin_list, hostwin_next) {
> +        if (hostwin->min_iova == min_iova && hostwin->max_iova == max_iova) {
> +            QLIST_REMOVE(hostwin, hostwin_next);
> +            return 0;
> +        }
> +    }
> +
> +    return -1;
> +}
> +
>  static bool vfio_listener_skipped_section(MemoryRegionSection *section)
>  {
>      return (!memory_region_is_ram(section->mr) &&
> @@ -380,6 +395,30 @@ static void vfio_listener_region_add(MemoryListener *listener,
>      }
>      end = int128_get64(int128_sub(llend, int128_one()));
>  
> +    if (container->iommu_type == VFIO_SPAPR_TCE_v2_IOMMU) {
> +        VFIOHostDMAWindow *hostwin;
> +        hwaddr pgsize = 0;
> +
> +        /* For now intersections are not allowed, we may relax this later */
> +        QLIST_FOREACH(hostwin, &container->hostwin_list, hostwin_next) {
> +            if (ranges_overlap(hostwin->min_iova,
> +                               hostwin->max_iova - hostwin->min_iova + 1,
> +                               section->offset_within_address_space,
> +                               int128_get64(section->size))) {
> +                goto fail;
> +            }
> +        }
> +
> +        ret = vfio_spapr_create_window(container, section, &pgsize);
> +        if (ret) {
> +            goto fail;
> +        }
> +
> +        vfio_host_win_add(container, section->offset_within_address_space,
> +                          section->offset_within_address_space +
> +                          int128_get64(section->size) - 1, pgsize);
> +    }
> +
>      hostwin_found = false;
>      QLIST_FOREACH(hostwin, &container->hostwin_list, hostwin_next) {
>          if (hostwin->min_iova <= iova && end <= hostwin->max_iova) {
> @@ -522,6 +561,18 @@ static void vfio_listener_region_del(MemoryListener *listener,
>                       "0x%"HWADDR_PRIx") = %d (%m)",
>                       container, iova, int128_get64(llsize), ret);
>      }
> +
> +    if (container->iommu_type == VFIO_SPAPR_TCE_v2_IOMMU) {
> +        vfio_spapr_remove_window(container,
> +                                 section->offset_within_address_space);
> +        if (vfio_host_win_del(container,
> +                              section->offset_within_address_space,
> +                              section->offset_within_address_space +
> +                              int128_get64(section->size) - 1) < 0) {
> +            hw_error("%s: Cannot delete missing window at %"HWADDR_PRIx,
> +                     __func__, section->offset_within_address_space);
> +        }
> +    }
>  }
>  
>  static const MemoryListener vfio_memory_listener = {
> @@ -960,11 +1011,6 @@ static int vfio_connect_container(VFIOGroup *group, AddressSpace *as)
>              }
>          }
>  
> -        /*
> -         * This only considers the host IOMMU's 32-bit window.  At
> -         * some point we need to add support for the optional 64-bit
> -         * window and dynamic windows
> -         */
>          info.argsz = sizeof(info);
>          ret = ioctl(fd, VFIO_IOMMU_SPAPR_TCE_GET_INFO, &info);
>          if (ret) {
> @@ -976,11 +1022,24 @@ static int vfio_connect_container(VFIOGroup *group, AddressSpace *as)
>              goto listener_release_exit;
>          }
>  
> -        /* The default table uses 4K pages */
> -        vfio_host_win_add(container, info.dma32_window_start,
> -                          info.dma32_window_start +
> -                          info.dma32_window_size - 1,
> -                          0x1000);
> +        if (v2) {
> +            /*
> +             * There is a default window in just created container.
> +             * To make region_add/del simpler, we better remove this
> +             * window now and let those iommu_listener callbacks
> +             * create/remove them when needed.
> +             */
> +            ret = vfio_spapr_remove_window(container, info.dma32_window_start);
> +            if (ret) {
> +                goto free_container_exit;
> +            }
> +        } else {
> +            /* The default table uses 4K pages */
> +            vfio_host_win_add(container, info.dma32_window_start,
> +                              info.dma32_window_start +
> +                              info.dma32_window_size - 1,
> +                              0x1000);
> +        }
>      } else {
>          error_report("vfio: No available IOMMU models");
>          ret = -EINVAL;
> diff --git a/hw/vfio/spapr.c b/hw/vfio/spapr.c
> index 5c29bec..852da0b 100644
> --- a/hw/vfio/spapr.c
> +++ b/hw/vfio/spapr.c
> @@ -137,3 +137,74 @@ const MemoryListener vfio_prereg_listener = {
>      .region_add = vfio_prereg_listener_region_add,
>      .region_del = vfio_prereg_listener_region_del,
>  };
> +
> +int vfio_spapr_create_window(VFIOContainer *container,
> +                             MemoryRegionSection *section,
> +                             hwaddr *pgsize)
> +{
> +    int ret;
> +    unsigned pagesize = memory_region_iommu_get_min_page_size(section->mr);
> +    unsigned entries, pages;
> +    struct vfio_iommu_spapr_tce_create create = { .argsz = sizeof(create) };
> +
> +    /*
> +     * FIXME: For VFIO iommu types which have KVM acceleration to
> +     * avoid bouncing all map/unmaps through qemu this way, this
> +     * would be the right place to wire that up (tell the KVM
> +     * device emulation the VFIO iommu handles to use).
> +     */
> +    create.window_size = int128_get64(section->size);
> +    create.page_shift = ctz64(pagesize);
> +    /*
> +     * SPAPR host supports multilevel TCE tables, there is some
> +     * heuristic to decide how many levels we want for our table:
> +     * 0..64 = 1; 65..4096 = 2; 4097..262144 = 3; 262145.. = 4
> +     */
> +    entries = create.window_size >> create.page_shift;
> +    pages = MAX((entries * sizeof(uint64_t)) / getpagesize(), 1);
> +    pages = MAX(pow2ceil(pages) - 1, 1); /* Round up */
> +    create.levels = ctz64(pages) / 6 + 1;
> +
> +    ret = ioctl(container->fd, VFIO_IOMMU_SPAPR_TCE_CREATE, &create);
> +    if (ret) {
> +        error_report("Failed to create a window, ret = %d (%m)", ret);
> +        return -errno;
> +    }
> +
> +    if (create.start_addr != section->offset_within_address_space) {
> +        vfio_spapr_remove_window(container, create.start_addr);
> +
> +        error_report("Host doesn't support DMA window at %"HWADDR_PRIx", must be %"PRIx64,
> +                     section->offset_within_address_space,
> +                     create.start_addr);
> +        ioctl(container->fd, VFIO_IOMMU_SPAPR_TCE_REMOVE, &remove);
> +        return -EINVAL;
> +    }
> +    trace_vfio_spapr_create_window(create.page_shift,
> +                                   create.window_size,
> +                                   create.start_addr);
> +    *pgsize = pagesize;
> +
> +    return 0;
> +}
> +
> +int vfio_spapr_remove_window(VFIOContainer *container,
> +                             hwaddr offset_within_address_space)
> +{
> +    struct vfio_iommu_spapr_tce_remove remove = {
> +        .argsz = sizeof(remove),
> +        .start_addr = offset_within_address_space,
> +    };
> +    int ret;
> +
> +    ret = ioctl(container->fd, VFIO_IOMMU_SPAPR_TCE_REMOVE, &remove);
> +    if (ret) {
> +        error_report("Failed to remove window at %"PRIx64,
> +                     remove.start_addr);
> +        return -errno;
> +    }
> +
> +    trace_vfio_spapr_remove_window(offset_within_address_space);
> +
> +    return 0;
> +}
> diff --git a/include/hw/vfio/vfio-common.h b/include/hw/vfio/vfio-common.h
> index b1f3e92..07f7188 100644
> --- a/include/hw/vfio/vfio-common.h
> +++ b/include/hw/vfio/vfio-common.h
> @@ -168,4 +168,10 @@ int vfio_get_dev_region_info(VFIODevice *vbasedev, uint32_t type,
>  #endif
>  extern const MemoryListener vfio_prereg_listener;
>  
> +int vfio_spapr_create_window(VFIOContainer *container,
> +                             MemoryRegionSection *section,
> +                             hwaddr *pgsize);
> +int vfio_spapr_remove_window(VFIOContainer *container,
> +                             hwaddr offset_within_address_space);
> +
>  #endif /* !HW_VFIO_VFIO_COMMON_H */
> diff --git a/trace-events b/trace-events
> index 0b1583f..7e94d92 100644
> --- a/trace-events
> +++ b/trace-events
> @@ -1775,6 +1775,8 @@ vfio_prereg_listener_region_add_skip(uint64_t start, uint64_t end) "SKIPPING reg
>  vfio_prereg_listener_region_del_skip(uint64_t start, uint64_t end) "SKIPPING region_del %"PRIx64" - %"PRIx64
>  vfio_prereg_register(uint64_t va, uint64_t size, int ret) "va=%"PRIx64" size=%"PRIx64" ret=%d"
>  vfio_prereg_unregister(uint64_t va, uint64_t size, int ret) "va=%"PRIx64" size=%"PRIx64" ret=%d"
> +vfio_spapr_create_window(int ps, uint64_t ws, uint64_t off) "pageshift=0x%x winsize=0x%"PRIx64" offset=0x%"PRIx64
> +vfio_spapr_remove_window(uint64_t off) "offset=%"PRIx64
>  
>  # hw/vfio/platform.c
>  vfio_platform_base_device_init(char *name, int groupid) "%s belongs to group #%d"
Laurent Vivier June 22, 2016, 2:38 p.m. UTC | #2
On 21/06/2016 03:14, Alexey Kardashevskiy wrote:
> New VFIO_SPAPR_TCE_v2_IOMMU type supports dynamic DMA window management.
> This adds ability to VFIO common code to dynamically allocate/remove
> DMA windows in the host kernel when new VFIO container is added/removed.
> 
> This adds a helper to vfio_listener_region_add which makes
> VFIO_IOMMU_SPAPR_TCE_CREATE ioctl and adds just created IOMMU into
> the host IOMMU list; the opposite action is taken in
> vfio_listener_region_del.
> 
> When creating a new window, this uses heuristic to decide on the TCE table
> levels number.
> 
> This should cause no guest visible change in behavior.
> 
> Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>
> ---
> Changes:
> v18:
> * moved trace definitions under hw/vfio/spapr.c section
> * moved trace_vfio_spapr_remove_window to vfio_spapr_remove_window()
> * vfio_host_win_del() now checks for exact window size
> * one ctz() less in vfio_spapr_create_window()
> 
> v17:
> * moved spapr window create/remove helpers to separate file
> * added hw_error() if vfio_host_win_del() failed
> 
> v16:
> * used memory_region_iommu_get_page_sizes() in vfio_listener_region_add()
> * enforced no intersections between windows
> 
> v14:
> * new to the series
> ---
>  hw/vfio/common.c              | 79 +++++++++++++++++++++++++++++++++++++------
>  hw/vfio/spapr.c               | 71 ++++++++++++++++++++++++++++++++++++++
>  include/hw/vfio/vfio-common.h |  6 ++++
>  trace-events                  |  2 ++
>  4 files changed, 148 insertions(+), 10 deletions(-)
> 
> diff --git a/hw/vfio/common.c b/hw/vfio/common.c
> index b53a1db..8e3466c 100644
> --- a/hw/vfio/common.c
> +++ b/hw/vfio/common.c
> @@ -265,6 +265,21 @@ static void vfio_host_win_add(VFIOContainer *container,
>      QLIST_INSERT_HEAD(&container->hostwin_list, hostwin, hostwin_next);
>  }
>  
> +static int vfio_host_win_del(VFIOContainer *container, hwaddr min_iova,
> +                             hwaddr max_iova)
> +{
> +    VFIOHostDMAWindow *hostwin;
> +
> +    QLIST_FOREACH(hostwin, &container->hostwin_list, hostwin_next) {
> +        if (hostwin->min_iova == min_iova && hostwin->max_iova == max_iova) {
> +            QLIST_REMOVE(hostwin, hostwin_next);
> +            return 0;
> +        }
> +    }
> +
> +    return -1;
> +}
> +
>  static bool vfio_listener_skipped_section(MemoryRegionSection *section)
>  {
>      return (!memory_region_is_ram(section->mr) &&
> @@ -380,6 +395,30 @@ static void vfio_listener_region_add(MemoryListener *listener,
>      }
>      end = int128_get64(int128_sub(llend, int128_one()));
>  
> +    if (container->iommu_type == VFIO_SPAPR_TCE_v2_IOMMU) {
> +        VFIOHostDMAWindow *hostwin;
> +        hwaddr pgsize = 0;
> +
> +        /* For now intersections are not allowed, we may relax this later */
> +        QLIST_FOREACH(hostwin, &container->hostwin_list, hostwin_next) {
> +            if (ranges_overlap(hostwin->min_iova,
> +                               hostwin->max_iova - hostwin->min_iova + 1,
> +                               section->offset_within_address_space,
> +                               int128_get64(section->size))) {
> +                goto fail;

ret is not initialized and it is used in "fail:".

hw/vfio/common.c: In function ‘vfio_listener_region_add’:
hw/vfio/common.c:493:30: error: ‘ret’ may be used uninitialized in this
function [-Werror=maybe-uninitialized]
             container->error = ret;

Laurent
Alexey Kardashevskiy June 23, 2016, 3:59 a.m. UTC | #3
On 23/06/16 00:38, Laurent Vivier wrote:
> 
> 
> On 21/06/2016 03:14, Alexey Kardashevskiy wrote:
>> New VFIO_SPAPR_TCE_v2_IOMMU type supports dynamic DMA window management.
>> This adds ability to VFIO common code to dynamically allocate/remove
>> DMA windows in the host kernel when new VFIO container is added/removed.
>>
>> This adds a helper to vfio_listener_region_add which makes
>> VFIO_IOMMU_SPAPR_TCE_CREATE ioctl and adds just created IOMMU into
>> the host IOMMU list; the opposite action is taken in
>> vfio_listener_region_del.
>>
>> When creating a new window, this uses heuristic to decide on the TCE table
>> levels number.
>>
>> This should cause no guest visible change in behavior.
>>
>> Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>
>> ---
>> Changes:
>> v18:
>> * moved trace definitions under hw/vfio/spapr.c section
>> * moved trace_vfio_spapr_remove_window to vfio_spapr_remove_window()
>> * vfio_host_win_del() now checks for exact window size
>> * one ctz() less in vfio_spapr_create_window()
>>
>> v17:
>> * moved spapr window create/remove helpers to separate file
>> * added hw_error() if vfio_host_win_del() failed
>>
>> v16:
>> * used memory_region_iommu_get_page_sizes() in vfio_listener_region_add()
>> * enforced no intersections between windows
>>
>> v14:
>> * new to the series
>> ---
>>  hw/vfio/common.c              | 79 +++++++++++++++++++++++++++++++++++++------
>>  hw/vfio/spapr.c               | 71 ++++++++++++++++++++++++++++++++++++++
>>  include/hw/vfio/vfio-common.h |  6 ++++
>>  trace-events                  |  2 ++
>>  4 files changed, 148 insertions(+), 10 deletions(-)
>>
>> diff --git a/hw/vfio/common.c b/hw/vfio/common.c
>> index b53a1db..8e3466c 100644
>> --- a/hw/vfio/common.c
>> +++ b/hw/vfio/common.c
>> @@ -265,6 +265,21 @@ static void vfio_host_win_add(VFIOContainer *container,
>>      QLIST_INSERT_HEAD(&container->hostwin_list, hostwin, hostwin_next);
>>  }
>>  
>> +static int vfio_host_win_del(VFIOContainer *container, hwaddr min_iova,
>> +                             hwaddr max_iova)
>> +{
>> +    VFIOHostDMAWindow *hostwin;
>> +
>> +    QLIST_FOREACH(hostwin, &container->hostwin_list, hostwin_next) {
>> +        if (hostwin->min_iova == min_iova && hostwin->max_iova == max_iova) {
>> +            QLIST_REMOVE(hostwin, hostwin_next);
>> +            return 0;
>> +        }
>> +    }
>> +
>> +    return -1;
>> +}
>> +
>>  static bool vfio_listener_skipped_section(MemoryRegionSection *section)
>>  {
>>      return (!memory_region_is_ram(section->mr) &&
>> @@ -380,6 +395,30 @@ static void vfio_listener_region_add(MemoryListener *listener,
>>      }
>>      end = int128_get64(int128_sub(llend, int128_one()));
>>  
>> +    if (container->iommu_type == VFIO_SPAPR_TCE_v2_IOMMU) {
>> +        VFIOHostDMAWindow *hostwin;
>> +        hwaddr pgsize = 0;
>> +
>> +        /* For now intersections are not allowed, we may relax this later */
>> +        QLIST_FOREACH(hostwin, &container->hostwin_list, hostwin_next) {
>> +            if (ranges_overlap(hostwin->min_iova,
>> +                               hostwin->max_iova - hostwin->min_iova + 1,
>> +                               section->offset_within_address_space,
>> +                               int128_get64(section->size))) {
>> +                goto fail;
> 
> ret is not initialized and it is used in "fail:".
> 
> hw/vfio/common.c: In function ‘vfio_listener_region_add’:
> hw/vfio/common.c:493:30: error: ‘ret’ may be used uninitialized in this
> function [-Werror=maybe-uninitialized]
>              container->error = ret;

Oh. Thanks for reporting. I use cross gcc and there must be something I am
doing wrong as I do not see these warnings but I do see them when compile
with native compiler...
Alexey Kardashevskiy June 23, 2016, 4:55 a.m. UTC | #4
On 23/06/16 13:59, Alexey Kardashevskiy wrote:

>> ret is not initialized and it is used in "fail:".
>>
>> hw/vfio/common.c: In function ‘vfio_listener_region_add’:
>> hw/vfio/common.c:493:30: error: ‘ret’ may be used uninitialized in this
>> function [-Werror=maybe-uninitialized]
>>              container->error = ret;
> 
> Oh. Thanks for reporting. I use cross gcc and there must be something I am
> doing wrong as I do not see these warnings but I do see them when compile
> with native compiler...

Ah, figured out - gcc -O2 enables the warning, and I always configure with
--enable-debug so gcc is not getting -O2. Will pay attention to this from
now on.
diff mbox

Patch

diff --git a/hw/vfio/common.c b/hw/vfio/common.c
index b53a1db..8e3466c 100644
--- a/hw/vfio/common.c
+++ b/hw/vfio/common.c
@@ -265,6 +265,21 @@  static void vfio_host_win_add(VFIOContainer *container,
     QLIST_INSERT_HEAD(&container->hostwin_list, hostwin, hostwin_next);
 }
 
+static int vfio_host_win_del(VFIOContainer *container, hwaddr min_iova,
+                             hwaddr max_iova)
+{
+    VFIOHostDMAWindow *hostwin;
+
+    QLIST_FOREACH(hostwin, &container->hostwin_list, hostwin_next) {
+        if (hostwin->min_iova == min_iova && hostwin->max_iova == max_iova) {
+            QLIST_REMOVE(hostwin, hostwin_next);
+            return 0;
+        }
+    }
+
+    return -1;
+}
+
 static bool vfio_listener_skipped_section(MemoryRegionSection *section)
 {
     return (!memory_region_is_ram(section->mr) &&
@@ -380,6 +395,30 @@  static void vfio_listener_region_add(MemoryListener *listener,
     }
     end = int128_get64(int128_sub(llend, int128_one()));
 
+    if (container->iommu_type == VFIO_SPAPR_TCE_v2_IOMMU) {
+        VFIOHostDMAWindow *hostwin;
+        hwaddr pgsize = 0;
+
+        /* For now intersections are not allowed, we may relax this later */
+        QLIST_FOREACH(hostwin, &container->hostwin_list, hostwin_next) {
+            if (ranges_overlap(hostwin->min_iova,
+                               hostwin->max_iova - hostwin->min_iova + 1,
+                               section->offset_within_address_space,
+                               int128_get64(section->size))) {
+                goto fail;
+            }
+        }
+
+        ret = vfio_spapr_create_window(container, section, &pgsize);
+        if (ret) {
+            goto fail;
+        }
+
+        vfio_host_win_add(container, section->offset_within_address_space,
+                          section->offset_within_address_space +
+                          int128_get64(section->size) - 1, pgsize);
+    }
+
     hostwin_found = false;
     QLIST_FOREACH(hostwin, &container->hostwin_list, hostwin_next) {
         if (hostwin->min_iova <= iova && end <= hostwin->max_iova) {
@@ -522,6 +561,18 @@  static void vfio_listener_region_del(MemoryListener *listener,
                      "0x%"HWADDR_PRIx") = %d (%m)",
                      container, iova, int128_get64(llsize), ret);
     }
+
+    if (container->iommu_type == VFIO_SPAPR_TCE_v2_IOMMU) {
+        vfio_spapr_remove_window(container,
+                                 section->offset_within_address_space);
+        if (vfio_host_win_del(container,
+                              section->offset_within_address_space,
+                              section->offset_within_address_space +
+                              int128_get64(section->size) - 1) < 0) {
+            hw_error("%s: Cannot delete missing window at %"HWADDR_PRIx,
+                     __func__, section->offset_within_address_space);
+        }
+    }
 }
 
 static const MemoryListener vfio_memory_listener = {
@@ -960,11 +1011,6 @@  static int vfio_connect_container(VFIOGroup *group, AddressSpace *as)
             }
         }
 
-        /*
-         * This only considers the host IOMMU's 32-bit window.  At
-         * some point we need to add support for the optional 64-bit
-         * window and dynamic windows
-         */
         info.argsz = sizeof(info);
         ret = ioctl(fd, VFIO_IOMMU_SPAPR_TCE_GET_INFO, &info);
         if (ret) {
@@ -976,11 +1022,24 @@  static int vfio_connect_container(VFIOGroup *group, AddressSpace *as)
             goto listener_release_exit;
         }
 
-        /* The default table uses 4K pages */
-        vfio_host_win_add(container, info.dma32_window_start,
-                          info.dma32_window_start +
-                          info.dma32_window_size - 1,
-                          0x1000);
+        if (v2) {
+            /*
+             * There is a default window in just created container.
+             * To make region_add/del simpler, we better remove this
+             * window now and let those iommu_listener callbacks
+             * create/remove them when needed.
+             */
+            ret = vfio_spapr_remove_window(container, info.dma32_window_start);
+            if (ret) {
+                goto free_container_exit;
+            }
+        } else {
+            /* The default table uses 4K pages */
+            vfio_host_win_add(container, info.dma32_window_start,
+                              info.dma32_window_start +
+                              info.dma32_window_size - 1,
+                              0x1000);
+        }
     } else {
         error_report("vfio: No available IOMMU models");
         ret = -EINVAL;
diff --git a/hw/vfio/spapr.c b/hw/vfio/spapr.c
index 5c29bec..852da0b 100644
--- a/hw/vfio/spapr.c
+++ b/hw/vfio/spapr.c
@@ -137,3 +137,74 @@  const MemoryListener vfio_prereg_listener = {
     .region_add = vfio_prereg_listener_region_add,
     .region_del = vfio_prereg_listener_region_del,
 };
+
+int vfio_spapr_create_window(VFIOContainer *container,
+                             MemoryRegionSection *section,
+                             hwaddr *pgsize)
+{
+    int ret;
+    unsigned pagesize = memory_region_iommu_get_min_page_size(section->mr);
+    unsigned entries, pages;
+    struct vfio_iommu_spapr_tce_create create = { .argsz = sizeof(create) };
+
+    /*
+     * FIXME: For VFIO iommu types which have KVM acceleration to
+     * avoid bouncing all map/unmaps through qemu this way, this
+     * would be the right place to wire that up (tell the KVM
+     * device emulation the VFIO iommu handles to use).
+     */
+    create.window_size = int128_get64(section->size);
+    create.page_shift = ctz64(pagesize);
+    /*
+     * SPAPR host supports multilevel TCE tables, there is some
+     * heuristic to decide how many levels we want for our table:
+     * 0..64 = 1; 65..4096 = 2; 4097..262144 = 3; 262145.. = 4
+     */
+    entries = create.window_size >> create.page_shift;
+    pages = MAX((entries * sizeof(uint64_t)) / getpagesize(), 1);
+    pages = MAX(pow2ceil(pages) - 1, 1); /* Round up */
+    create.levels = ctz64(pages) / 6 + 1;
+
+    ret = ioctl(container->fd, VFIO_IOMMU_SPAPR_TCE_CREATE, &create);
+    if (ret) {
+        error_report("Failed to create a window, ret = %d (%m)", ret);
+        return -errno;
+    }
+
+    if (create.start_addr != section->offset_within_address_space) {
+        vfio_spapr_remove_window(container, create.start_addr);
+
+        error_report("Host doesn't support DMA window at %"HWADDR_PRIx", must be %"PRIx64,
+                     section->offset_within_address_space,
+                     create.start_addr);
+        ioctl(container->fd, VFIO_IOMMU_SPAPR_TCE_REMOVE, &remove);
+        return -EINVAL;
+    }
+    trace_vfio_spapr_create_window(create.page_shift,
+                                   create.window_size,
+                                   create.start_addr);
+    *pgsize = pagesize;
+
+    return 0;
+}
+
+int vfio_spapr_remove_window(VFIOContainer *container,
+                             hwaddr offset_within_address_space)
+{
+    struct vfio_iommu_spapr_tce_remove remove = {
+        .argsz = sizeof(remove),
+        .start_addr = offset_within_address_space,
+    };
+    int ret;
+
+    ret = ioctl(container->fd, VFIO_IOMMU_SPAPR_TCE_REMOVE, &remove);
+    if (ret) {
+        error_report("Failed to remove window at %"PRIx64,
+                     remove.start_addr);
+        return -errno;
+    }
+
+    trace_vfio_spapr_remove_window(offset_within_address_space);
+
+    return 0;
+}
diff --git a/include/hw/vfio/vfio-common.h b/include/hw/vfio/vfio-common.h
index b1f3e92..07f7188 100644
--- a/include/hw/vfio/vfio-common.h
+++ b/include/hw/vfio/vfio-common.h
@@ -168,4 +168,10 @@  int vfio_get_dev_region_info(VFIODevice *vbasedev, uint32_t type,
 #endif
 extern const MemoryListener vfio_prereg_listener;
 
+int vfio_spapr_create_window(VFIOContainer *container,
+                             MemoryRegionSection *section,
+                             hwaddr *pgsize);
+int vfio_spapr_remove_window(VFIOContainer *container,
+                             hwaddr offset_within_address_space);
+
 #endif /* !HW_VFIO_VFIO_COMMON_H */
diff --git a/trace-events b/trace-events
index 0b1583f..7e94d92 100644
--- a/trace-events
+++ b/trace-events
@@ -1775,6 +1775,8 @@  vfio_prereg_listener_region_add_skip(uint64_t start, uint64_t end) "SKIPPING reg
 vfio_prereg_listener_region_del_skip(uint64_t start, uint64_t end) "SKIPPING region_del %"PRIx64" - %"PRIx64
 vfio_prereg_register(uint64_t va, uint64_t size, int ret) "va=%"PRIx64" size=%"PRIx64" ret=%d"
 vfio_prereg_unregister(uint64_t va, uint64_t size, int ret) "va=%"PRIx64" size=%"PRIx64" ret=%d"
+vfio_spapr_create_window(int ps, uint64_t ws, uint64_t off) "pageshift=0x%x winsize=0x%"PRIx64" offset=0x%"PRIx64
+vfio_spapr_remove_window(uint64_t off) "offset=%"PRIx64
 
 # hw/vfio/platform.c
 vfio_platform_base_device_init(char *name, int groupid) "%s belongs to group #%d"