[Linaro-mm-sig] Re: [PATCH v2 2/9] vfio/pci: Add a helper to look up PFNs for DMABUFs

On Wed, 27 May 2026 03:23:05 -0700 Matt Evans mattev@meta.com wrote:

Add vfio_pci_dma_buf_find_pfn(), which a VMA fault handler can use to find a PFN.

This supports multi-range DMABUFs, which typically would be used to represent scattered spans but might even represent overlapping or aliasing spans of PFNs.

Because this is intended to be used in vfio_pci_core.c, we also need to expose the struct vfio_pci_dma_buf in the vfio_pci_priv.h header.

Signed-off-by: Matt Evans mattev@meta.com

drivers/vfio/pci/vfio_pci_dmabuf.c | 142 ++++++++++++++++++++++++++--- drivers/vfio/pci/vfio_pci_priv.h | 20 ++++ 2 files changed, 149 insertions(+), 13 deletions(-)

diff --git a/drivers/vfio/pci/vfio_pci_dmabuf.c b/drivers/vfio/pci/vfio_pci_dmabuf.c index c16f460c01d6..0d132c4ca95f 100644 --- a/drivers/vfio/pci/vfio_pci_dmabuf.c +++ b/drivers/vfio/pci/vfio_pci_dmabuf.c @@ -9,19 +9,6 @@ MODULE_IMPORT_NS("DMA_BUF"); -struct vfio_pci_dma_buf {

• struct dma_buf *dmabuf;
• struct vfio_pci_core_device *vdev;
• struct list_head dmabufs_elm;
• size_t size;
• struct phys_vec *phys_vec;
• struct p2pdma_provider *provider;
• u32 nr_ranges;
• struct kref kref;
• struct completion comp;
• u8 revoked : 1;

-};

static int vfio_pci_dma_buf_attach(struct dma_buf *dmabuf, struct dma_buf_attachment *attachment) { @@ -106,6 +93,135 @@ static const struct dma_buf_ops vfio_pci_dmabuf_ops = { .release = vfio_pci_dma_buf_release, }; +int vfio_pci_dma_buf_find_pfn(struct vfio_pci_dma_buf *vpdmabuf,

This private dmabuf object pointer is named priv pretty consistently throughout the rest of the file.

• 	      struct vm_area_struct *vma,
  

• 	      unsigned long address,
  

• 	      unsigned int order,
  

• 	      unsigned long *out_pfn)
  

+{

• /*

• * Given a VMA (start, end, pgoffs) and a fault address,
  

• * search the corresponding DMABUF's phys_vec[] to find the
  

• * range representing the address's offset into the VMA, and
  

• * its PFN.
  

• *
  

• * The phys_vec[] ranges represent contiguous spans of VAs
  

• * upwards from the buffer offset 0; the actual PFNs might be
  

• * in any order, overlap/alias, etc.  Calculate an offset of
  

• * the desired page given VMA start/pgoff and address, then
  

• * search upwards from 0 to find which span contains it.
  

• *
  

• * On success, a valid PFN for a page sized by 'order' is
  

• * returned into out_pfn.
  

• *
  

• * Failure occurs if:
  

• * - The page would cross the edge of the VMA
  

• * - The page isn't entirely contained within a range
  

• * - We find a range, but the final PFN isn't aligned to the
  

• *   requested order.
  

• *
  

• * (Upon failure, the caller is expected to try again with a
  

• * smaller order; the tests above will always succeed for
  

• * order=0 as the limit case.)
  

• *
  

• * It's suboptimal if DMABUFs are created with neigbouring
  

• * ranges that are physically contiguous, since hugepages
  

• * can't straddle range boundaries.  (The construction of the
  

• * ranges vector should merge such ranges.)
  

• *
  

• * Finally, vma_pgoff_adjust is used for a DMABUF representing
  

• * a VFIO BAR mmap, which is created from the start of the
  

• * offset region.  It should be zero, or equal vm_pgoff.
  

• */
  

• const unsigned long pagesize = PAGE_SIZE << order;
• unsigned long vma_off = ((vma->vm_pgoff - vpdmabuf->vma_pgoff_adjust) <<

• 		 PAGE_SHIFT) & VFIO_PCI_OFFSET_MASK;
  

• unsigned long rounded_page_addr = ALIGN_DOWN(address, pagesize);
• unsigned long rounded_page_end = rounded_page_addr + pagesize;
• unsigned long page_buf_offset;
• unsigned long range_buf_offset = 0;
• unsigned int i;
• if (rounded_page_addr < vma->vm_start || rounded_page_end > vma->vm_end) {

• if (order > 0)
  

• 	return -EAGAIN;
  

• /* A fault address outside of the VMA is absurd. */
  

• WARN(1, "Fault addr 0x%lx outside VMA 0x%lx-0x%lx\n",
  

•      address, vma->vm_start, vma->vm_end);
  

• return -EFAULT;
  

• }
• if (vpdmabuf->vma_pgoff_adjust != 0 &&

•    vpdmabuf->vma_pgoff_adjust != (vma->vm_pgoff &
  

• 			   (VFIO_PCI_OFFSET_MASK >> PAGE_SHIFT))) {
  

• WARN(1, "Unexpected vma_pgoff_adjust 0x%lx (vm_pgoff 0x%lx)\n",
  

•      vpdmabuf->vma_pgoff_adjust, vma->vm_pgoff);
  

• return -EFAULT;
  

• }

This appears to be user trigger'able, by causing a vma to be split, and also unnecessary as it seems the math works out correctly for the split case.

• if (unlikely(check_add_overflow(rounded_page_addr - vma->vm_start,

• 			vma_off, &page_buf_offset)))
  

• return -EFAULT;
  

• for (i = 0; i < vpdmabuf->nr_ranges; i++) {

• unsigned long page_buf_offset_end;
  

• size_t range_len = vpdmabuf->phys_vec[i].len;
  

• phys_addr_t range_start = vpdmabuf->phys_vec[i].paddr;
  

• if (unlikely(check_add_overflow(page_buf_offset, pagesize,
  

• 				&page_buf_offset_end)))
  

• 	return -EFAULT;
  

Why is this inside the loop, the args are invariant of anything modified in the loop. Thanks,

Alex

• /*
  

•  * If the current range starts after the page's span,
  

•  * this and any future range won't match.  Bail early.
  

•  */
  

• if (page_buf_offset_end <= range_buf_offset)
  

• 	break;
  

• if (page_buf_offset >= range_buf_offset &&
  

•     page_buf_offset_end <= range_buf_offset + range_len) {
  

• 	/*
  

• 	 * The faulting page is wholly contained
  

• 	 * within the span represented by the range.
  

• 	 * Validate PFN alignment for the order:
  

• 	 */
  

• 	unsigned long pfn = (range_start + page_buf_offset -
  

• 			     range_buf_offset) / PAGE_SIZE;
  

• 	if (IS_ALIGNED(pfn, 1 << order)) {
  

• 		*out_pfn = pfn;
  

• 		return 0;
  

• 	}
  

• 	/* Retry with smaller order */
  

• 	return -EAGAIN;
  

• }
  

• range_buf_offset += range_len;
  

• }
• /*

• * A hugepage straddling a range boundary will fail to match a
  

• * range, but the address will (eventually) match when retried
  

• * with a smaller page.
  

• */
  

• if (order > 0)

• return -EAGAIN;
  

• /*

• * If we get here, the address fell outside of the span
  

• * represented by the (concatenated) ranges.  Setup of a
  

• * mapping must ensure that the VMA is <= the total size of
  

• * the ranges, so this should never happen.  But, if it does,
  

• * force SIGBUS for the access and warn.
  

• */
  

• WARN_ONCE(1, "No range for addr 0x%lx, order %d: VMA 0x%lx-0x%lx pgoff 0x%lx, %u ranges, size 0x%zx\n",

•   address, order, vma->vm_start, vma->vm_end, vma->vm_pgoff,
  

•   vpdmabuf->nr_ranges, vpdmabuf->size);
  

• return -EFAULT;

+}

/*

• This is a temporary "private interconnect" between VFIO DMABUF and iommufd.
• It allows the two co-operating drivers to exchange the physical address of

diff --git a/drivers/vfio/pci/vfio_pci_priv.h b/drivers/vfio/pci/vfio_pci_priv.h index fca9d0dfac90..c8f6f959056a 100644 --- a/drivers/vfio/pci/vfio_pci_priv.h +++ b/drivers/vfio/pci/vfio_pci_priv.h @@ -23,6 +23,20 @@ struct vfio_pci_ioeventfd { bool test_mem; }; +struct vfio_pci_dma_buf {

• struct dma_buf *dmabuf;
• struct vfio_pci_core_device *vdev;
• struct list_head dmabufs_elm;
• size_t size;
• struct phys_vec *phys_vec;
• struct p2pdma_provider *provider;
• u32 nr_ranges;
• struct kref kref;
• struct completion comp;
• unsigned long vma_pgoff_adjust;
• u8 revoked : 1;

+};

bool vfio_pci_intx_mask(struct vfio_pci_core_device *vdev); void vfio_pci_intx_unmask(struct vfio_pci_core_device *vdev); @@ -114,6 +128,12 @@ static inline bool vfio_pci_is_vga(struct pci_dev *pdev) return (pdev->class >> 8) == PCI_CLASS_DISPLAY_VGA; } +int vfio_pci_dma_buf_find_pfn(struct vfio_pci_dma_buf *vpdmabuf,

• 	      struct vm_area_struct *vma,
  

• 	      unsigned long address,
  

• 	      unsigned int order,
  

• 	      unsigned long *out_pfn);
  

#ifdef CONFIG_VFIO_PCI_DMABUF int vfio_pci_core_feature_dma_buf(struct vfio_pci_core_device *vdev, u32 flags, struct vfio_device_feature_dma_buf __user *arg,