[PATCH] drm/virtio: use the DMA API for resource backing on Xen

[PATCH] drm/virtio: use the DMA API for resource backing on Xen

[Benjamin Leggett via B4 Relay]

From: Benjamin Leggett <benjamin@edera.io>

On a Xen PV domain page addresses bear no relation to the real machine
addresses the host would have to use to reach it.
virtio_ring.c handles this correctly, vring_use_map_api() returns true
for any xen_domain() regardless of VIRTIO_F_ACCESS_PLATFORM.

virtio-gpu makes the same decision independently, but its copy
looks only at the feature bit:

	bool use_dma_api = !virtio_has_dma_quirk(vgdev->vdev);

QEMU does not set iommu_platform on virtio-vga by default, so
VIRTIO_F_ACCESS_PLATFORM is not negotiated, use_dma_api is false, and
virtio_gpu_object_shmem_init() describes the framebuffer's backing pages
to the host with sg_phys().  Those are guest-physical addresses. In a PV
domain they resolve, on the host side, to pages belonging to some other
domain, so the host scans out unrelated memory.

Move the decision into virtio_gpu_use_dma_api() and give it the
xen_domain() check, like vring_use_map_api() has. This
additionally enables the dma_sync_sgtable_for_device() calls in
virtgpu_vq.c, which are required for correctness whenever swiotlb
is in play.

Reproduced with a Xen 4.21 PV dom0 nested inside QEMU 8.2 with
virtio-vga, on both a distro 6.8 kernel and 6.18 LTS. A PVH dom0
works fine and doesn't need this fix because it is identity-mapped,
only PV dom0s are affected.

Fixes: a3b815f09bb8 ("drm/virtio: add iommu support.")
Signed-off-by: Ben Leggett <benjamin@edera.io>
---
 drivers/gpu/drm/virtio/virtgpu_drv.h    | 20 ++++++++++++++++++++
 drivers/gpu/drm/virtio/virtgpu_object.c |  2 +-
 drivers/gpu/drm/virtio/virtgpu_vq.c     |  6 +++---
 3 files changed, 24 insertions(+), 4 deletions(-)

diff --git a/drivers/gpu/drm/virtio/virtgpu_drv.h b/drivers/gpu/drm/virtio/virtgpu_drv.h
index 17a6a4d26516..09da7973387e 100644
--- a/drivers/gpu/drm/virtio/virtgpu_drv.h
+++ b/drivers/gpu/drm/virtio/virtgpu_drv.h
@@ -43,6 +43,8 @@
 #include <drm/drm_probe_helper.h>
 #include <drm/virtgpu_drm.h>
 
+#include <xen/xen.h>
+
 #define DRIVER_NAME "virtio_gpu"
 #define DRIVER_DESC "virtio GPU"
 
@@ -60,6 +62,24 @@
 /* See virtio_gpu_ctx_create. One additional character for NULL terminator. */
 #define DEBUG_NAME_MAX_LEN 65
 
+/*
+ * Whether the host must be told about resource backing pages by DMA address
+ * rather than guest-physical address.
+ *
+ * This mirrors vring_use_map_api() in drivers/virtio/virtio_ring.c, including
+ * its xen_domain() case.
+ */
+static inline bool virtio_gpu_use_dma_api(const struct virtio_device *vdev)
+{
+	if (!virtio_has_dma_quirk(vdev))
+		return true;
+
+	if (xen_domain())
+		return true;
+
+	return false;
+}
+
 struct virtio_gpu_object_params {
 	unsigned long size;
 	bool dumb;
diff --git a/drivers/gpu/drm/virtio/virtgpu_object.c b/drivers/gpu/drm/virtio/virtgpu_object.c
index 9bc0bd68c314..49899485be6f 100644
--- a/drivers/gpu/drm/virtio/virtgpu_object.c
+++ b/drivers/gpu/drm/virtio/virtgpu_object.c
@@ -173,7 +173,7 @@ static int virtio_gpu_object_shmem_init(struct virtio_gpu_device *vgdev,
 					struct virtio_gpu_mem_entry **ents,
 					unsigned int *nents)
 {
-	bool use_dma_api = !virtio_has_dma_quirk(vgdev->vdev);
+	bool use_dma_api = virtio_gpu_use_dma_api(vgdev->vdev);
 	struct scatterlist *sg;
 	struct sg_table *pages;
 	int si;
diff --git a/drivers/gpu/drm/virtio/virtgpu_vq.c b/drivers/gpu/drm/virtio/virtgpu_vq.c
index 905b1f42cd98..568fefd713e0 100644
--- a/drivers/gpu/drm/virtio/virtgpu_vq.c
+++ b/drivers/gpu/drm/virtio/virtgpu_vq.c
@@ -764,7 +764,7 @@ int virtio_gpu_panic_cmd_transfer_to_host_2d(struct virtio_gpu_device *vgdev,
 	struct virtio_gpu_object *bo = gem_to_virtio_gpu_obj(objs->objs[0]);
 	struct virtio_gpu_transfer_to_host_2d *cmd_p;
 	struct virtio_gpu_vbuffer *vbuf;
-	bool use_dma_api = !virtio_has_dma_quirk(vgdev->vdev);
+	bool use_dma_api = virtio_gpu_use_dma_api(vgdev->vdev);
 
 	if (virtio_gpu_is_shmem(bo) && use_dma_api)
 		dma_sync_sgtable_for_device(vgdev->vdev->dev.parent,
@@ -795,7 +795,7 @@ void virtio_gpu_cmd_transfer_to_host_2d(struct virtio_gpu_device *vgdev,
 	struct virtio_gpu_object *bo = gem_to_virtio_gpu_obj(objs->objs[0]);
 	struct virtio_gpu_transfer_to_host_2d *cmd_p;
 	struct virtio_gpu_vbuffer *vbuf;
-	bool use_dma_api = !virtio_has_dma_quirk(vgdev->vdev);
+	bool use_dma_api = virtio_gpu_use_dma_api(vgdev->vdev);
 
 	if (virtio_gpu_is_shmem(bo) && use_dma_api)
 		dma_sync_sgtable_for_device(vgdev->vdev->dev.parent,
@@ -1231,7 +1231,7 @@ void virtio_gpu_cmd_transfer_to_host_3d(struct virtio_gpu_device *vgdev,
 	struct virtio_gpu_object *bo = gem_to_virtio_gpu_obj(objs->objs[0]);
 	struct virtio_gpu_transfer_host_3d *cmd_p;
 	struct virtio_gpu_vbuffer *vbuf;
-	bool use_dma_api = !virtio_has_dma_quirk(vgdev->vdev);
+	bool use_dma_api = virtio_gpu_use_dma_api(vgdev->vdev);
 
 	if (virtio_gpu_is_shmem(bo) && use_dma_api)
 		dma_sync_sgtable_for_device(vgdev->vdev->dev.parent,

---
base-commit: bd4f284df04d76fd65e57141cb1e6e7a49e4c3cb
change-id: 20260806-virtgpu-xen-dma-559fab712250

Best regards,
-- 
Benjamin Leggett <benjamin@edera.io>

[PATCH] drm/virtio: use the DMA API for resource backing on Xen

[Benjamin Leggett]

On a Xen PV domain page addresses bear no relation to the real machine
addresses the host would have to use to reach it.
virtio_ring.c handles this correctly, vring_use_map_api() returns true
for any xen_domain() regardless of VIRTIO_F_ACCESS_PLATFORM.

virtio-gpu makes the same decision independently, but its copy
looks only at the feature bit:

	bool use_dma_api = !virtio_has_dma_quirk(vgdev->vdev);

QEMU does not set iommu_platform on virtio-vga by default, so
VIRTIO_F_ACCESS_PLATFORM is not negotiated, use_dma_api is false, and
virtio_gpu_object_shmem_init() describes the framebuffer's backing pages
to the host with sg_phys().  Those are guest-physical addresses. In a PV
domain they resolve, on the host side, to pages belonging to some other
domain, so the host scans out unrelated memory.

Move the decision into virtio_gpu_use_dma_api() and give it the
xen_domain() check, like vring_use_map_api() has. This
additionally enables the dma_sync_sgtable_for_device() calls in
virtgpu_vq.c, which are required for correctness whenever swiotlb
is in play.

Reproduced with a Xen 4.21 PV dom0 nested inside QEMU 8.2 with
virtio-vga, on both a distro 6.8 kernel and 6.18 LTS. A PVH dom0
works fine and doesn't need this fix because it is identity-mapped,
only PV dom0s are affected.

Fixes: a3b815f09bb8 ("drm/virtio: add iommu support.")
Signed-off-by: Ben Leggett <benjamin@edera.io>
---
 drivers/gpu/drm/virtio/virtgpu_drv.h    | 20 ++++++++++++++++++++
 drivers/gpu/drm/virtio/virtgpu_object.c |  2 +-
 drivers/gpu/drm/virtio/virtgpu_vq.c     |  6 +++---
 3 files changed, 24 insertions(+), 4 deletions(-)

diff --git a/drivers/gpu/drm/virtio/virtgpu_drv.h b/drivers/gpu/drm/virtio/virtgpu_drv.h
index 17a6a4d26516..09da7973387e 100644
--- a/drivers/gpu/drm/virtio/virtgpu_drv.h
+++ b/drivers/gpu/drm/virtio/virtgpu_drv.h
@@ -43,6 +43,8 @@
 #include <drm/drm_probe_helper.h>
 #include <drm/virtgpu_drm.h>
 
+#include <xen/xen.h>
+
 #define DRIVER_NAME "virtio_gpu"
 #define DRIVER_DESC "virtio GPU"
 
@@ -60,6 +62,24 @@
 /* See virtio_gpu_ctx_create. One additional character for NULL terminator. */
 #define DEBUG_NAME_MAX_LEN 65
 
+/*
+ * Whether the host must be told about resource backing pages by DMA address
+ * rather than guest-physical address.
+ *
+ * This mirrors vring_use_map_api() in drivers/virtio/virtio_ring.c, including
+ * its xen_domain() case.
+ */
+static inline bool virtio_gpu_use_dma_api(const struct virtio_device *vdev)
+{
+	if (!virtio_has_dma_quirk(vdev))
+		return true;
+
+	if (xen_domain())
+		return true;
+
+	return false;
+}
+
 struct virtio_gpu_object_params {
 	unsigned long size;
 	bool dumb;
diff --git a/drivers/gpu/drm/virtio/virtgpu_object.c b/drivers/gpu/drm/virtio/virtgpu_object.c
index 9bc0bd68c314..49899485be6f 100644
--- a/drivers/gpu/drm/virtio/virtgpu_object.c
+++ b/drivers/gpu/drm/virtio/virtgpu_object.c
@@ -173,7 +173,7 @@ static int virtio_gpu_object_shmem_init(struct virtio_gpu_device *vgdev,
 					struct virtio_gpu_mem_entry **ents,
 					unsigned int *nents)
 {
-	bool use_dma_api = !virtio_has_dma_quirk(vgdev->vdev);
+	bool use_dma_api = virtio_gpu_use_dma_api(vgdev->vdev);
 	struct scatterlist *sg;
 	struct sg_table *pages;
 	int si;
diff --git a/drivers/gpu/drm/virtio/virtgpu_vq.c b/drivers/gpu/drm/virtio/virtgpu_vq.c
index 905b1f42cd98..568fefd713e0 100644
--- a/drivers/gpu/drm/virtio/virtgpu_vq.c
+++ b/drivers/gpu/drm/virtio/virtgpu_vq.c
@@ -764,7 +764,7 @@ int virtio_gpu_panic_cmd_transfer_to_host_2d(struct virtio_gpu_device *vgdev,
 	struct virtio_gpu_object *bo = gem_to_virtio_gpu_obj(objs->objs[0]);
 	struct virtio_gpu_transfer_to_host_2d *cmd_p;
 	struct virtio_gpu_vbuffer *vbuf;
-	bool use_dma_api = !virtio_has_dma_quirk(vgdev->vdev);
+	bool use_dma_api = virtio_gpu_use_dma_api(vgdev->vdev);
 
 	if (virtio_gpu_is_shmem(bo) && use_dma_api)
 		dma_sync_sgtable_for_device(vgdev->vdev->dev.parent,
@@ -795,7 +795,7 @@ void virtio_gpu_cmd_transfer_to_host_2d(struct virtio_gpu_device *vgdev,
 	struct virtio_gpu_object *bo = gem_to_virtio_gpu_obj(objs->objs[0]);
 	struct virtio_gpu_transfer_to_host_2d *cmd_p;
 	struct virtio_gpu_vbuffer *vbuf;
-	bool use_dma_api = !virtio_has_dma_quirk(vgdev->vdev);
+	bool use_dma_api = virtio_gpu_use_dma_api(vgdev->vdev);
 
 	if (virtio_gpu_is_shmem(bo) && use_dma_api)
 		dma_sync_sgtable_for_device(vgdev->vdev->dev.parent,
@@ -1231,7 +1231,7 @@ void virtio_gpu_cmd_transfer_to_host_3d(struct virtio_gpu_device *vgdev,
 	struct virtio_gpu_object *bo = gem_to_virtio_gpu_obj(objs->objs[0]);
 	struct virtio_gpu_transfer_host_3d *cmd_p;
 	struct virtio_gpu_vbuffer *vbuf;
-	bool use_dma_api = !virtio_has_dma_quirk(vgdev->vdev);
+	bool use_dma_api = virtio_gpu_use_dma_api(vgdev->vdev);
 
 	if (virtio_gpu_is_shmem(bo) && use_dma_api)
 		dma_sync_sgtable_for_device(vgdev->vdev->dev.parent,

---
base-commit: bd4f284df04d76fd65e57141cb1e6e7a49e4c3cb
change-id: 20260806-virtgpu-xen-dma-559fab712250

Best regards,
-- 
Benjamin Leggett <benjamin@edera.io>

Re: [PATCH] drm/virtio: use the DMA API for resource backing on Xen

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Missing dma_sync_sgtable_for_cpu() in guest-bound transfer paths causes data corruption with SWIOTLB bounce buffers.
--

--- Patch [1]: [PATCH] drm/virtio: use the DMA API for resource backing on Xen ---
commit 5102ee1180b3819921a73a9ff7e4e18ce5a910f1
Author: Benjamin Leggett <benjamin@edera.io>

drm/virtio: use the DMA API for resource backing on Xen

This commit enables the use of the DMA API for virtio-gpu resource backing
on Xen PV domains, regardless of the VIRTIO_F_ACCESS_PLATFORM feature bit.
It introduces virtio_gpu_use_dma_api() and updates the resource
initialization and transfer paths to use it. This ensures that the host
receives correct DMA addresses instead of guest-physical addresses when
swiotlb is active.

> diff --git a/drivers/gpu/drm/virtio/virtgpu_vq.c b/drivers/gpu/drm/virtio/virtgpu_vq.c
> index 905b1f42cd983..568fefd713e0f 100644
> --- a/drivers/gpu/drm/virtio/virtgpu_vq.c
> +++ b/drivers/gpu/drm/virtio/virtgpu_vq.c

[ ... ]

> @@ -1231,7 +1231,7 @@ void virtio_gpu_cmd_transfer_to_host_3d(struct virtio_gpu_device *vgdev,
>  	struct virtio_gpu_object *bo = gem_to_virtio_gpu_obj(objs->objs[0]);
>  	struct virtio_gpu_transfer_host_3d *cmd_p;
>  	struct virtio_gpu_vbuffer *vbuf;
> -	bool use_dma_api = !virtio_has_dma_quirk(vgdev->vdev);
> +	bool use_dma_api = virtio_gpu_use_dma_api(vgdev->vdev);
>  
>  	if (virtio_gpu_is_shmem(bo) && use_dma_api)
>  		dma_sync_sgtable_for_device(vgdev->vdev->dev.parent,
>  					    bo->base.sgt, DMA_TO_DEVICE);

[Severity: High]
This is a pre-existing issue, but while enabling the DMA API for Xen PV
domains, does this leave guest-bound transfers vulnerable to data corruption
with SWIOTLB bounce buffers?

While this patch ensures dma_sync_sgtable_for_device() is called for
host-bound transfers (DMA_TO_DEVICE), it appears that guest-bound transfers
are missing the corresponding CPU synchronization:

drivers/gpu/drm/virtio/virtgpu_vq.c:virtio_gpu_cmd_transfer_from_host_3d() {
    ...
    // Missing dma_sync_sgtable_for_cpu() or
    // dma_sync_sgtable_for_device(..., DMA_FROM_DEVICE)
}

If a user-space application maps a virtio-gpu SHMEM buffer and triggers a
VIRTIO_GPU_CMD_TRANSFER_FROM_HOST_3D via
DRM_IOCTL_VIRTGPU_TRANSFER_FROM_HOST, will the CPU read stale data from
the original backing pages?

Because the driver never calls dma_sync_sgtable_for_cpu() when the transfer
completes, it looks like the SWIOTLB will never copy the bounce buffer
contents back to the original physical pages.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260806-virtgpu-xen-dma-v1-1-e499b345bbad@edera.io?part=1

Re: [PATCH] drm/virtio: use the DMA API for resource backing on Xen

[Benjamin Leggett]

sashiko-bot@kernel.org writes:

> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
>
> [Severity: High]
> This is a pre-existing issue, but while enabling the DMA API for Xen PV
> domains, does this leave guest-bound transfers vulnerable to data corruption
> with SWIOTLB bounce buffers?

Yep, preexisting issue, but not reachable via plain `virtio-vga`.

Only reachable, AFAICT, if `has_virgl_3d` is enabled. The missing `_for_cpu`` sync
is pre-existing since 8f44ca223345 and pretty orthogonal to this patch.

A correct fix belongs in the completion path rather than at submission,
anyway, so it should be its own separate patch.

Happy to do that in a followup/separate patch, if requested.

Re: [PATCH] drm/virtio: use the DMA API for resource backing on Xen

[Benjamin Leggett]

sashiko-bot@kernel.org writes:

> [Severity: High]
> This is a pre-existing issue, but while enabling the DMA API for Xen PV
> domains, does this leave guest-bound transfers vulnerable to data corruption
> with SWIOTLB bounce buffers?

Yep, preexisting issue, but not reachable via plain `virtio-vga`.

Only reachable, AFAICT, if `has_virgl_3d` is enabled. The missing `_for_cpu`` sync
is pre-existing since 8f44ca223345 and pretty orthogonal to this change.

A correct fix most likely belongs in the completion path rather than at submission,
anyway, so I’m not sure it makes a lot of sense to include in this patch.

Happy to do that in a followup/separate patch, if requested.

Ben

Re: [PATCH] drm/virtio: use the DMA API for resource backing on Xen

[Dmitry Osipenko]

On 8/7/26 01:54, Benjamin Leggett via B4 Relay wrote:
> From: Benjamin Leggett <benjamin@edera.io>
> 
> On a Xen PV domain page addresses bear no relation to the real machine
> addresses the host would have to use to reach it.
> virtio_ring.c handles this correctly, vring_use_map_api() returns true
> for any xen_domain() regardless of VIRTIO_F_ACCESS_PLATFORM.
> 
> virtio-gpu makes the same decision independently, but its copy
> looks only at the feature bit:
> 
> 	bool use_dma_api = !virtio_has_dma_quirk(vgdev->vdev);
> 
> QEMU does not set iommu_platform on virtio-vga by default, so
> VIRTIO_F_ACCESS_PLATFORM is not negotiated, use_dma_api is false, and
> virtio_gpu_object_shmem_init() describes the framebuffer's backing pages
> to the host with sg_phys().  Those are guest-physical addresses. In a PV
> domain they resolve, on the host side, to pages belonging to some other
> domain, so the host scans out unrelated memory.
> 
> Move the decision into virtio_gpu_use_dma_api() and give it the
> xen_domain() check, like vring_use_map_api() has. This
> additionally enables the dma_sync_sgtable_for_device() calls in
> virtgpu_vq.c, which are required for correctness whenever swiotlb
> is in play.
> 
> Reproduced with a Xen 4.21 PV dom0 nested inside QEMU 8.2 with
> virtio-vga, on both a distro 6.8 kernel and 6.18 LTS. A PVH dom0
> works fine and doesn't need this fix because it is identity-mapped,
> only PV dom0s are affected.
> 
> Fixes: a3b815f09bb8 ("drm/virtio: add iommu support.")
> Signed-off-by: Ben Leggett <benjamin@edera.io>
> ---
>  drivers/gpu/drm/virtio/virtgpu_drv.h    | 20 ++++++++++++++++++++
>  drivers/gpu/drm/virtio/virtgpu_object.c |  2 +-
>  drivers/gpu/drm/virtio/virtgpu_vq.c     |  6 +++---
>  3 files changed, 24 insertions(+), 4 deletions(-)
> 
> diff --git a/drivers/gpu/drm/virtio/virtgpu_drv.h b/drivers/gpu/drm/virtio/virtgpu_drv.h
> index 17a6a4d26516..09da7973387e 100644
> --- a/drivers/gpu/drm/virtio/virtgpu_drv.h
> +++ b/drivers/gpu/drm/virtio/virtgpu_drv.h
> @@ -43,6 +43,8 @@
>  #include <drm/drm_probe_helper.h>
>  #include <drm/virtgpu_drm.h>
>  
> +#include <xen/xen.h>
> +
>  #define DRIVER_NAME "virtio_gpu"
>  #define DRIVER_DESC "virtio GPU"
>  
> @@ -60,6 +62,24 @@
>  /* See virtio_gpu_ctx_create. One additional character for NULL terminator. */
>  #define DEBUG_NAME_MAX_LEN 65
>  
> +/*
> + * Whether the host must be told about resource backing pages by DMA address
> + * rather than guest-physical address.
> + *
> + * This mirrors vring_use_map_api() in drivers/virtio/virtio_ring.c, including
> + * its xen_domain() case.
> + */
> +static inline bool virtio_gpu_use_dma_api(const struct virtio_device *vdev)
> +{
> +	if (!virtio_has_dma_quirk(vdev))
> +		return true;
> +
> +	if (xen_domain())
> +		return true;
> +
> +	return false;
> +}
> +
>  struct virtio_gpu_object_params {
>  	unsigned long size;
>  	bool dumb;
> diff --git a/drivers/gpu/drm/virtio/virtgpu_object.c b/drivers/gpu/drm/virtio/virtgpu_object.c
> index 9bc0bd68c314..49899485be6f 100644
> --- a/drivers/gpu/drm/virtio/virtgpu_object.c
> +++ b/drivers/gpu/drm/virtio/virtgpu_object.c
> @@ -173,7 +173,7 @@ static int virtio_gpu_object_shmem_init(struct virtio_gpu_device *vgdev,
>  					struct virtio_gpu_mem_entry **ents,
>  					unsigned int *nents)
>  {
> -	bool use_dma_api = !virtio_has_dma_quirk(vgdev->vdev);
> +	bool use_dma_api = virtio_gpu_use_dma_api(vgdev->vdev);
>  	struct scatterlist *sg;
>  	struct sg_table *pages;
>  	int si;
> diff --git a/drivers/gpu/drm/virtio/virtgpu_vq.c b/drivers/gpu/drm/virtio/virtgpu_vq.c
> index 905b1f42cd98..568fefd713e0 100644
> --- a/drivers/gpu/drm/virtio/virtgpu_vq.c
> +++ b/drivers/gpu/drm/virtio/virtgpu_vq.c
> @@ -764,7 +764,7 @@ int virtio_gpu_panic_cmd_transfer_to_host_2d(struct virtio_gpu_device *vgdev,
>  	struct virtio_gpu_object *bo = gem_to_virtio_gpu_obj(objs->objs[0]);
>  	struct virtio_gpu_transfer_to_host_2d *cmd_p;
>  	struct virtio_gpu_vbuffer *vbuf;
> -	bool use_dma_api = !virtio_has_dma_quirk(vgdev->vdev);
> +	bool use_dma_api = virtio_gpu_use_dma_api(vgdev->vdev);
>  
>  	if (virtio_gpu_is_shmem(bo) && use_dma_api)
>  		dma_sync_sgtable_for_device(vgdev->vdev->dev.parent,
> @@ -795,7 +795,7 @@ void virtio_gpu_cmd_transfer_to_host_2d(struct virtio_gpu_device *vgdev,
>  	struct virtio_gpu_object *bo = gem_to_virtio_gpu_obj(objs->objs[0]);
>  	struct virtio_gpu_transfer_to_host_2d *cmd_p;
>  	struct virtio_gpu_vbuffer *vbuf;
> -	bool use_dma_api = !virtio_has_dma_quirk(vgdev->vdev);
> +	bool use_dma_api = virtio_gpu_use_dma_api(vgdev->vdev);
>  
>  	if (virtio_gpu_is_shmem(bo) && use_dma_api)
>  		dma_sync_sgtable_for_device(vgdev->vdev->dev.parent,
> @@ -1231,7 +1231,7 @@ void virtio_gpu_cmd_transfer_to_host_3d(struct virtio_gpu_device *vgdev,
>  	struct virtio_gpu_object *bo = gem_to_virtio_gpu_obj(objs->objs[0]);
>  	struct virtio_gpu_transfer_host_3d *cmd_p;
>  	struct virtio_gpu_vbuffer *vbuf;
> -	bool use_dma_api = !virtio_has_dma_quirk(vgdev->vdev);
> +	bool use_dma_api = virtio_gpu_use_dma_api(vgdev->vdev);
>  
>  	if (virtio_gpu_is_shmem(bo) && use_dma_api)
>  		dma_sync_sgtable_for_device(vgdev->vdev->dev.parent,
> 
> ---
> base-commit: bd4f284df04d76fd65e57141cb1e6e7a49e4c3cb
> change-id: 20260806-virtgpu-xen-dma-559fab712250
> 
> Best regards,

Looks okay, though I'm not familiar with Xen. Will apply to -next in a
day if nobody will have objections.

Acked-by: Dmitry Osipenko <dmitry.osipenko@collabora.com>

-- 
Best regards,
Dmitry