On Wed, Jun 10, 2026 at 04:43:16PM +0100, Matt Evans wrote:
> Add vfio_pci_dma_buf_find_pfn(), which a VMA fault handler can use to
> find a PFN.
>
> This supports multi-range DMABUFs, which typically would be used to
> represent scattered spans but might even represent overlapping or
> aliasing spans of PFNs.
>
> Because this is intended to be used in vfio_pci_core.c, we also need
> to expose the struct vfio_pci_dma_buf in the vfio_pci_priv.h header.
>
> Signed-off-by: Matt Evans <[email protected]>
> ---
> drivers/vfio/pci/vfio_pci_dmabuf.c | 137 ++++++++++++++++++++++++++---
> drivers/vfio/pci/vfio_pci_priv.h | 20 +++++
> 2 files changed, 144 insertions(+), 13 deletions(-)
>
> diff --git a/drivers/vfio/pci/vfio_pci_dmabuf.c
> b/drivers/vfio/pci/vfio_pci_dmabuf.c
> index c16f460c01d6..9e5e865f6fb6 100644
> --- a/drivers/vfio/pci/vfio_pci_dmabuf.c
> +++ b/drivers/vfio/pci/vfio_pci_dmabuf.c
> @@ -9,19 +9,6 @@
>
> MODULE_IMPORT_NS("DMA_BUF");
>
> -struct vfio_pci_dma_buf {
> - struct dma_buf *dmabuf;
> - struct vfio_pci_core_device *vdev;
> - struct list_head dmabufs_elm;
> - size_t size;
> - struct phys_vec *phys_vec;
> - struct p2pdma_provider *provider;
> - u32 nr_ranges;
> - struct kref kref;
> - struct completion comp;
> - u8 revoked : 1;
> -};
> -
> static int vfio_pci_dma_buf_attach(struct dma_buf *dmabuf,
> struct dma_buf_attachment *attachment)
> {
> @@ -106,6 +93,130 @@ static const struct dma_buf_ops vfio_pci_dmabuf_ops = {
> .release = vfio_pci_dma_buf_release,
> };
>
> +int vfio_pci_dma_buf_find_pfn(struct vfio_pci_dma_buf *priv,
> + struct vm_area_struct *vma,
> + unsigned long address,
Nit: s/address/fault_addr ?
> + unsigned int order,
> + unsigned long *out_pfn)
> +{
> + /*
> + * Given a VMA (start, end, pgoffs) and a fault address,
> + * search the corresponding DMABUF's phys_vec[] to find the
> + * range representing the address's offset into the VMA, and
> + * its PFN.
> + *
> + * The phys_vec[] ranges represent contiguous spans of VAs
> + * upwards from the buffer offset 0; the actual PFNs might be
> + * in any order, overlap/alias, etc. Calculate an offset of
> + * the desired page given VMA start/pgoff and address, then
> + * search upwards from 0 to find which span contains it.
> + *
> + * On success, a valid PFN for a page sized by 'order' is
> + * returned into out_pfn.
> + *
> + * Failure occurs if:
> + * - The page would cross the edge of the VMA
> + * - The page isn't entirely contained within a range
> + * - We find a range, but the final PFN isn't aligned to the
> + * requested order.
> + *
> + * (Upon failure, the caller is expected to try again with a
> + * smaller order; the tests above will always succeed for
> + * order=0 as the limit case.)
> + *
> + * It's suboptimal if DMABUFs are created with neigbouring
> + * ranges that are physically contiguous, since hugepages
> + * can't straddle range boundaries. (The construction of the
> + * ranges vector should merge such ranges.)
> + *
> + * Finally, vma_pgoff_adjust is used for a DMABUF representing
> + * a VFIO BAR mmap, which is created from the start of the
> + * offset region.
> + */
> +
> + const unsigned long pagesize = PAGE_SIZE << order;
> + unsigned long vma_off = ((vma->vm_pgoff - priv->vma_pgoff_adjust) <<
> + PAGE_SHIFT) & VFIO_PCI_OFFSET_MASK;
> + unsigned long rounded_page_addr = ALIGN_DOWN(address, pagesize);
> + unsigned long rounded_page_end = rounded_page_addr + pagesize;
> + unsigned long page_buf_offset;
> + unsigned long page_buf_offset_end;
> + unsigned long range_buf_offset = 0;
> + unsigned int i;
> +
> + if (rounded_page_addr < vma->vm_start || rounded_page_end >
> vma->vm_end) {
> + if (order > 0)
> + return -EAGAIN;
> +
> + /* A fault address outside of the VMA is absurd. */
> + WARN(1, "Fault addr 0x%lx outside VMA 0x%lx-0x%lx\n",
> + address, vma->vm_start, vma->vm_end);
This could flood dmesg if triggered repeatedly by userspace :(
Since a fault outside the VMA is an invalid access that already results
in a SIGBUS, we could probably avoid the WARN here?
Perhaps pr_warn_ratelimited() should suffice?
> + return -EFAULT;
> + }
> +
> + /*
> + * page_buff_offset[_end] is the span of DMABUF offsets
> + * corresponding to the faulting page:
> + */
> + if (unlikely(check_add_overflow(rounded_page_addr - vma->vm_start,
> + vma_off, &page_buf_offset) ||
> + check_add_overflow(page_buf_offset, pagesize,
> + &page_buf_offset_end)))
> + return -EFAULT;
> +
> + for (i = 0; i < priv->nr_ranges; i++) {
> + size_t range_len = priv->phys_vec[i].len;
> + phys_addr_t range_start = priv->phys_vec[i].paddr;
> +
> + /*
> + * If the current range starts after the page's span,
> + * this and any future range won't match. Bail early.
> + */
> + if (page_buf_offset_end <= range_buf_offset)
> + break;
> +
> + if (page_buf_offset >= range_buf_offset &&
> + page_buf_offset_end <= range_buf_offset + range_len) {
> + /*
> + * The faulting page is wholly contained
> + * within the span represented by the range.
> + * Validate PFN alignment for the order:
> + */
> + unsigned long pfn = (range_start + page_buf_offset -
> + range_buf_offset) / PAGE_SIZE;
Minor nit: I'm aware that decent compilers convert pow(2) divides to >>
However, we seem to be using `>> PAGE_SHIFT` across vfio-pci. E.g.:
return (pci_resource_start(vdev->pdev, index) >> PAGE_SHIFT) + pgoff;
unsigned long pgoff = (addr - vma->vm_start) >> PAGE_SHIFT;
Let's consider using the same pattern?
> +
> + if (IS_ALIGNED(pfn, 1 << order)) {
> + *out_pfn = pfn;
> + return 0;
> + }
> + /* Retry with smaller order */
> + return -EAGAIN;
> + }
> + range_buf_offset += range_len;
> + }
> +
> + /*
> + * A hugepage straddling a range boundary will fail to match a
> + * range, but the address will (eventually) match when retried
> + * with a smaller page.
> + */
> + if (order > 0)
> + return -EAGAIN;
> +
> + /*
> + * If we get here, the address fell outside of the span
> + * represented by the (concatenated) ranges. Setup of a
Nit: double space before "Setup" and "But" below.
> + * mapping must ensure that the VMA is <= the total size of
> + * the ranges, so this should never happen. But, if it does,
> + * force SIGBUS for the access and warn.
> + */
> + WARN_ONCE(1, "No range for addr 0x%lx, order %d: VMA 0x%lx-0x%lx pgoff
> 0x%lx, %u ranges, size 0x%zx\n",
> + address, order, vma->vm_start, vma->vm_end, vma->vm_pgoff,
> + priv->nr_ranges, priv->size);
> +
> + return -EFAULT;
The fall-through logic at the end feels a bit redundant.
If we've exhausted the phys_vec list without finding a match, returning
-EAGAIN for order > 0 seems like the correct fallback behavior.
However, the subsequent WARN_ONCE for the order == 0 seems unnecessary?
An out-of-bounds access is an error that should simply return -EFAULT
(converting to SIGBUS) without polluting the kernel log with stackdumps?
Can we instead convert this to a pr_warn or something? Something like:
ret = order ? -EAGAIN : -EFAULT;
if (ret == -EFAULT)
pr_warn_ratelimited("No range for addr 0x%lx...\n", address);
return ret;
(with appropriate comments)
Thanks,
Praan
