From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 3165FC53219 for ; Wed, 29 Jul 2026 17:52:55 +0000 (UTC) Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id BD2DE10ED49; Wed, 29 Jul 2026 17:52:53 +0000 (UTC) Authentication-Results: gabe.freedesktop.org; dkim=pass (2048-bit key; unprotected) header.d=shazbot.org header.i=@shazbot.org header.b="nvUT3I/e"; dkim=pass (2048-bit key; unprotected) header.d=messagingengine.com header.i=@messagingengine.com header.b="pFOiY6DC"; dkim-atps=neutral Received: from fhigh-b1-smtp.messagingengine.com (fhigh-b1-smtp.messagingengine.com [202.12.124.152]) by gabe.freedesktop.org (Postfix) with ESMTPS id 1BFD310ED3C for ; Wed, 29 Jul 2026 17:52:46 +0000 (UTC) Received: from phl-compute-06.internal (phl-compute-06.internal [10.202.2.46]) by mailfhigh.stl.internal (Postfix) with ESMTP id 10D2C7A0188; Wed, 29 Jul 2026 13:52:45 -0400 (EDT) Received: from phl-frontend-03 ([10.202.2.162]) by phl-compute-06.internal (MEProxy); Wed, 29 Jul 2026 13:52:45 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=shazbot.org; h= cc:cc:content-transfer-encoding:content-type:content-type:date :date:from:from:in-reply-to:in-reply-to:message-id:mime-version :references:reply-to:subject:subject:to:to; s=fm2; t=1785347564; x=1785433964; bh=GBitJTtcIqXnrlN3xd4UOvlCHqOUWjl/e++pPoM2e+Y=; b= nvUT3I/eju6BYAFes1UluAKSSTa9gxcKGopZrsY//+UJev5BmVFuZwMJtxc7pY1u 1E6h6shzKo773F96KsOCPAJnRbbglOmzYp41NS075K2DZNGEfUlM3gdHcIzGvOFe FZIWAKhmYHp5L9oanKCJjDFuLPhUbJr61tI4Hy0Xqinucy6QB1LqpBBUqsCzTbN2 qwTB/0Tj0ahZs8F2MTxtjUOcbBNGunTnA8g2SMkH9LmESoAb5gG9+hNJJ33o9TEn 6JBux7tNPoMQ8vkTx/ekeoQPlPHjyZK/3au3iapmA2RZBATiAHvwc8DgkX3mhhTx l6hEowDd5JNNyWS6pQolAA== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:cc:content-transfer-encoding :content-type:content-type:date:date:feedback-id:feedback-id :from:from:in-reply-to:in-reply-to:message-id:mime-version :references:reply-to:subject:subject:to:to:x-me-proxy :x-me-sender:x-me-sender:x-sasl-enc; s=fm2; t=1785347564; x= 1785433964; bh=GBitJTtcIqXnrlN3xd4UOvlCHqOUWjl/e++pPoM2e+Y=; b=p FOiY6DC4HSlPlZTURXA8sB0Qyl7rLUtVoXL/PpX1iFWsew5NspEIkswQNoVqa4/K a/sBtamQbY8QExuiFo7YJh0EJTXYWzlDrcw7mmlcR/CWGeuQdSShbkyNhZyEeIdU uunvAMWuIeWXMGMc2Nvij35/ZTHRTsAYRC4bHtMrQAuSUWF8tJWZFq4UDUWLk6OK ZZ2wYTCkZtwqEpOQ1Qoogm/K9RtM2TydWkS0IjGBmAuEBBS+K0dMon4l+bN/3m51 Gk7Q6cpop5egWmyMpZBuKBSsMUmW0ImtqPCDBOdFBBP3MZVzk7wo5UOv4SyngCjK r8NQospnc4LOEmZw3d67g== X-ME-Sender: X-ME-Received: X-ME-Proxy-Cause: dmFkZTEEKmvm6usZpfT8gTSOJbqanlO3Pfaw1SwlI8f/Y1kQuB5PNxzg3aOh42AlQ5x0re mEkbtzhui+wLYtqWZK72Xd/sdJJEBvaXRotkM6Vk0bPPvLVaNTNCx4v9cPIE7guN0chqZG xBk0FjLQTleHOrHFXXErnyGCptkTDYgk7zSCFRUjOu4hbmap/73RGBIgA9cJ0wq9zAoT+n iQ8tOqSb+FQ4ww6H9mq9hRsOLrowOesvFEIXGg5PbgzKo3PTE5X8d/73KQfrp4YMVmYaaN ygTQrCIHZp6Q1vuJ9i+D5kwdZMjX9SfNAWiOB7hAYx70kmcGovcy9tx9FXQs3RN4UEbWH6 /n+3VBkQ6EiDPpAo1vrM/bNhi8lepDnIpUdzPH/qnhE/PXluBtDQ6DNdqaXw1FOG/ikujT n3zi8HCtZ4xqpM9ZQUC4sx3Wqi7Zg9pFQb/FTppazPihg8lZ4A3lePE8RN86Z6sPn4i7p6 E7VDlGiI4XJLeoVnNQiHPWiCmg5TWaGm57YV1ot/OdRJfYTchU8+pT0J7z1OYWXm0HrL7P drPeAlkXyKViajw7vo35RE5A425RY0t8w1zmwo7/kQCnyjuryGIQ/ahxP7qON8BfrobXZ+ 2X8YLEEAdt05nzOIvraay3u9hNQD8a2ce+n2uBhWTiLljknvvGcPFS6ZQ25A X-ME-Proxy: Feedback-ID: i03f14258:Fastmail Received: by mail.messagingengine.com (Postfix) with ESMTPA; Wed, 29 Jul 2026 13:52:42 -0400 (EDT) Date: Wed, 29 Jul 2026 11:52:10 -0600 From: Alex Williamson To: Matt Evans Cc: Leon Romanovsky , Jason Gunthorpe , Alex Mastro , Christian =?UTF-8?B?S8O2bmln?= , Bjorn Helgaas , Logan Gunthorpe , Kevin Tian , Pranjal Shrivastava , Longfang Liu , Mahmoud Adam , David Matlack , =?UTF-8?B?QmrDtnJuIFTDtnBlbA==?= , Sumit Semwal , Ankit Agrawal , Alistair Popple , Vivek Kasireddy , linux-kernel@vger.kernel.org, linux-media@vger.kernel.org, dri-devel@lists.freedesktop.org, linaro-mm-sig@lists.linaro.org, kvm@vger.kernel.org, linux-pci@vger.kernel.org, alex@shazbot.org Subject: Re: [PATCH v5 3/9] vfio/pci: Add a helper to look up PFNs for DMABUFs Message-ID: <20260729115210.753ab8ce@shazbot.org> In-Reply-To: <20260715174737.15287-4-matt@ozlabs.org> References: <20260715174737.15287-1-matt@ozlabs.org> <20260715174737.15287-4-matt@ozlabs.org> X-Mailer: Claws Mail 4.4.0 (GTK 3.24.52; x86_64-pc-linux-gnu) MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit X-BeenThere: dri-devel@lists.freedesktop.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Direct Rendering Infrastructure - Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" On Wed, 15 Jul 2026 18:47:26 +0100 Matt Evans wrote: > Add vfio_pci_dma_buf_find_pfn(), which a VMA fault handler can use to > find a PFN. > > This supports multi-range DMABUFs, which typically would be used to > represent scattered spans but might even represent overlapping or > aliasing spans of PFNs. > > Because this is intended to be used in vfio_pci_core.c, we also need > to expose the struct vfio_pci_dma_buf in the vfio_pci_priv.h header. Nit, it would be useful to mention the addition of vma_pgoff_adjust here and justification for it added here as a static zero versus later in the series where its value is updated. > > Signed-off-by: Matt Evans > --- > drivers/vfio/pci/vfio_pci_dmabuf.c | 153 ++++++++++++++++++++++++++--- > drivers/vfio/pci/vfio_pci_priv.h | 20 ++++ > 2 files changed, 160 insertions(+), 13 deletions(-) > > diff --git a/drivers/vfio/pci/vfio_pci_dmabuf.c b/drivers/vfio/pci/vfio_pci_dmabuf.c > index c16f460c01d6..7c047400dfd1 100644 > --- a/drivers/vfio/pci/vfio_pci_dmabuf.c > +++ b/drivers/vfio/pci/vfio_pci_dmabuf.c > @@ -9,19 +9,6 @@ > > MODULE_IMPORT_NS("DMA_BUF"); > > -struct vfio_pci_dma_buf { > - struct dma_buf *dmabuf; > - struct vfio_pci_core_device *vdev; > - struct list_head dmabufs_elm; > - size_t size; > - struct phys_vec *phys_vec; > - struct p2pdma_provider *provider; > - u32 nr_ranges; > - struct kref kref; > - struct completion comp; > - u8 revoked : 1; > -}; > - > static int vfio_pci_dma_buf_attach(struct dma_buf *dmabuf, > struct dma_buf_attachment *attachment) > { > @@ -106,6 +93,146 @@ static const struct dma_buf_ops vfio_pci_dmabuf_ops = { > .release = vfio_pci_dma_buf_release, > }; > > +int vfio_pci_dma_buf_find_pfn(struct vfio_pci_dma_buf *priv, > + struct vm_area_struct *vma, > + unsigned long fault_addr, > + unsigned int order, > + unsigned long *out_pfn) > +{ > + /* > + * Given a VMA (start, end, pgoffs) and a fault address, > + * search the corresponding DMABUF's phys_vec[] to find the > + * range representing the address's offset into the VMA, and > + * its PFN. > + * > + * The phys_vec[] ranges represent contiguous spans of VAs > + * upwards from the buffer offset 0; the actual PFNs might be > + * in any order, overlap/alias, etc. Calculate an offset of > + * the desired page given VMA start/pgoff and address, then > + * search upwards from 0 to find which span contains it. > + * > + * On success, a valid PFN for a page sized by 'order' is > + * returned into out_pfn. > + * > + * Failure occurs if: > + * - A hugepage would cross the edge of the VMA, > + * - A hugepage isn't entirely contained within a range > + * (including where it straddles the boundary between > + * ranges), > + * - We find a range, but the final PFN isn't aligned to the > + * requested order. > + * > + * Upon failure, -EAGAIN is returned and the caller is > + * expected to try again with a smaller order, which will > + * eventually succeed (order=0 will always work). We typically use -EAGAIN to indicate a transient error where the caller should try again with the same args. We're documenting here that -EAGAIN means to try again with different args. Why wouldn't we use something like -ERANGE to indicate that? > + * > + * It's suboptimal if DMABUFs are created with neighbouring > + * ranges that are physically contiguous, since hugepages > + * can't straddle range boundaries. (The construction of the > + * ranges should merge them in this case.) > + * > + * Finally, vma_pgoff_adjust is used with a DMABUF created for > + * a VFIO BAR mmap: a BAR mapped with vm_pgoff > 0 creates a > + * DMABUF such that byte 0 of the VMA corresponds to byte 0 of > + * the DMABUF and byte 'vm_pgoff << PAGE_SHIFT' into the BAR. > + * To avoid double-offsetting in this scenario, subtracting > + * vma_pgoff_adjust from this (non-zero) vm_pgoff generates > + * the effective offset. > + */ > + > + const unsigned long pagesize = PAGE_SIZE << order; > + unsigned long vma_off = ((vma->vm_pgoff - priv->vma_pgoff_adjust) << > + PAGE_SHIFT) & VFIO_PCI_OFFSET_MASK; > + unsigned long rounded_page_addr = ALIGN_DOWN(fault_addr, pagesize); > + unsigned long rounded_page_end = rounded_page_addr + pagesize; > + unsigned long fault_offset; > + unsigned long fault_offset_end; > + unsigned long range_start_offset = 0; > + unsigned int i; > + int ret; > + AIUI, find_pfn should only act on a live dmabuf, but we're relying on the caller to guarantee that it's live and not racing a revoke. The dmabuf is live if !revoked under memory_lock. Should this annotate and validate that requirement by adding a vdev arg so we can do: lockdep_assert_held(&vdev->memory_lock); if (priv->revoked) // later updated to status return -ENODEV; This also removes one level of dereferencing in the below dev_warns, which is otherwise a bit suspect without the validation. I realize the mmap path does the validation, but this is an exposed internal API, not a static function there. Thanks, Alex > + if (rounded_page_addr < vma->vm_start || rounded_page_end > vma->vm_end) { > + if (order > 0) > + return -EAGAIN; > + > + /* A fault address outside of the VMA is absurd. */ > + dev_warn_ratelimited( > + &priv->vdev->pdev->dev, > + "Fault addr 0x%lx outside VMA 0x%lx-0x%lx\n", > + fault_addr, vma->vm_start, vma->vm_end); > + return -EFAULT; > + } > + > + /* > + * fault_offset[_end] is the span within the DMABUF > + * corresponding to the faulting page: > + */ > + if (unlikely(check_add_overflow(rounded_page_addr - vma->vm_start, > + vma_off, &fault_offset) || > + check_add_overflow(fault_offset, pagesize, > + &fault_offset_end))) > + return -EFAULT; > + > + /* > + * Iterate over ranges in the buffer, summing their lengths: > + * range_start_offset represents the current range's starting > + * offset in the buffer (from 0 upwards). > + * > + * A failure for order == 0 is unexpected, and triggers a > + * fault/warn. > + */ > + ret = (order == 0) ? -EFAULT : -EAGAIN; > + > + for (i = 0; i < priv->nr_ranges; i++) { > + size_t range_len = priv->phys_vec[i].len; > + > + /* Early exit if range starts after the page end */ > + if (fault_offset_end <= range_start_offset) > + break; > + > + if (fault_offset >= range_start_offset && > + fault_offset_end <= range_start_offset + range_len) { > + /* > + * The faulting page is wholly contained > + * within the span represented by this range, > + * so validate PFN alignment for the order. > + * The if() condition ensures the pfn > + * arithmetic won't overflow. > + */ > + unsigned long pfn = > + ((fault_offset - range_start_offset) + > + priv->phys_vec[i].paddr) >> PAGE_SHIFT; > + > + if (IS_ALIGNED(pfn, 1 << order)) { > + *out_pfn = pfn; > + ret = 0; > + } > + /* > + * Else order > 0; EAGAIN retries with smaller > + * order > + */ > + break; > + } > + range_start_offset += range_len; > + } > + > + if (order == 0 && ret != 0) > + /* > + * The address fell outside of the span represented by > + * the (concatenated) ranges. As setup of a mapping > + * ensures that the VMA is <= the total size of the > + * ranges this should never happen. If it does, warn > + * and SIGBUS. > + */ > + dev_warn_ratelimited( > + &priv->vdev->pdev->dev, > + "No range for addr 0x%lx, order %d: VMA 0x%lx-0x%lx pgoff 0x%lx, %u ranges, size 0x%zx\n", > + fault_addr, order, vma->vm_start, vma->vm_end, > + vma->vm_pgoff, priv->nr_ranges, priv->size); > + > + return ret; > +} > + > /* > * This is a temporary "private interconnect" between VFIO DMABUF and iommufd. > * It allows the two co-operating drivers to exchange the physical address of > diff --git a/drivers/vfio/pci/vfio_pci_priv.h b/drivers/vfio/pci/vfio_pci_priv.h > index fca9d0dfac90..c8f6f959056a 100644 > --- a/drivers/vfio/pci/vfio_pci_priv.h > +++ b/drivers/vfio/pci/vfio_pci_priv.h > @@ -23,6 +23,20 @@ struct vfio_pci_ioeventfd { > bool test_mem; > }; > > +struct vfio_pci_dma_buf { > + struct dma_buf *dmabuf; > + struct vfio_pci_core_device *vdev; > + struct list_head dmabufs_elm; > + size_t size; > + struct phys_vec *phys_vec; > + struct p2pdma_provider *provider; > + u32 nr_ranges; > + struct kref kref; > + struct completion comp; > + unsigned long vma_pgoff_adjust; > + u8 revoked : 1; > +}; > + > bool vfio_pci_intx_mask(struct vfio_pci_core_device *vdev); > void vfio_pci_intx_unmask(struct vfio_pci_core_device *vdev); > > @@ -114,6 +128,12 @@ static inline bool vfio_pci_is_vga(struct pci_dev *pdev) > return (pdev->class >> 8) == PCI_CLASS_DISPLAY_VGA; > } > > +int vfio_pci_dma_buf_find_pfn(struct vfio_pci_dma_buf *vpdmabuf, > + struct vm_area_struct *vma, > + unsigned long address, > + unsigned int order, > + unsigned long *out_pfn); > + > #ifdef CONFIG_VFIO_PCI_DMABUF > int vfio_pci_core_feature_dma_buf(struct vfio_pci_core_device *vdev, u32 flags, > struct vfio_device_feature_dma_buf __user *arg,