From: Manish Honap <[email protected]> The HDM memory region is mmap-able, so an fd holder can fault its struct-page-less device memory in from the host CPU. A memory error on that range cannot be routed through the normal struct-page path and would otherwise escalate to a fatal host SError.
Register the range with memory_failure() via register_pfn_address_space() so such an error is instead contained to a SIGBUS to each process that maps the poisoned page. Provide a pfn-to-vma-offset callback so memory_failure() can map a poisoned pfn back to the file offset of each user mapping; the region is a single linear range at hpa_range.start, so recover the offset the same way the fault handler derived the pfn. register_pfn_address_space() returns -EOPNOTSUPP when CONFIG_MEMORY_FAILURE is off, in which case expose the region without containment. Unregister the range on close. Assisted-by: LLM Signed-off-by: Manish Honap <[email protected]> --- drivers/vfio/pci/cxl/vfio_cxl_core.c | 84 +++++++++++++++++++++++++++- 1 file changed, 83 insertions(+), 1 deletion(-) diff --git a/drivers/vfio/pci/cxl/vfio_cxl_core.c b/drivers/vfio/pci/cxl/vfio_cxl_core.c index 977d0c9c747a..f2f7ddfc80bb 100644 --- a/drivers/vfio/pci/cxl/vfio_cxl_core.c +++ b/drivers/vfio/pci/cxl/vfio_cxl_core.c @@ -9,6 +9,7 @@ #include <linux/cleanup.h> #include <linux/delay.h> #include <linux/io.h> +#include <linux/memory-failure.h> #include <linux/mm.h> #include <linux/module.h> #include <linux/pci.h> @@ -27,6 +28,7 @@ * @hpa_range: host physical range of the HDM region * @hpa_res: exclusive reservation of @hpa_range, held for the bind * @hdm: copy of the HDM state cached at PCI enumeration, taken at bind + * @hdm_pfn_space: HDM-region pfn range registered with memory_failure() * @hdm_valid: true when host CPU access to the HDM range is safe; under memory_lock * @await_mem_active: the device reported its memory active at bind, so wait * for Memory_Active before host access reopens after a reset or low power @@ -38,6 +40,7 @@ struct vfio_cxl_state { struct range hpa_range; struct resource *hpa_res; struct cxl_hdm_info *hdm; + struct pfn_address_space hdm_pfn_space; bool hdm_valid; bool await_mem_active; unsigned int mem_region_index; @@ -211,6 +214,63 @@ static const struct vfio_pci_regops vfio_cxl_mem_regops = { .release = vfio_cxl_region_release, }; +/* + * Map a poisoned HDM-region pfn back to the file offset of each user mapping so + * memory_failure() can find the mapping and signal its owner. The region is a + * single linear range at hpa_range.start; recover the per-vma file offset the + * same way the fault handler derived the pfn. + */ +static int vfio_cxl_pfn_to_vma_pgoff(struct vm_area_struct *vma, + unsigned long pfn, pgoff_t *pgoff) +{ + struct vfio_pci_core_device *vdev; + struct vfio_cxl_state *cxl; + pgoff_t vma_off, pfn_off; + unsigned long start_pfn; + + if (vma->vm_ops != &vfio_cxl_mem_vm_ops) + return -ENOENT; + + vdev = vma->vm_private_data; + cxl = vdev->cxl; + + start_pfn = PHYS_PFN(cxl->hpa_range.start); + if (pfn < start_pfn || + pfn >= start_pfn + (range_len(&cxl->hpa_range) >> PAGE_SHIFT)) + return -EFAULT; + + pfn_off = pfn - start_pfn; + vma_off = vma->vm_pgoff & + ((1UL << (VFIO_PCI_OFFSET_SHIFT - PAGE_SHIFT)) - 1); + /* Skip VMAs that do not map the pfn, e.g. a partial mmap of the region. */ + if (pfn_off < vma_off || pfn_off - vma_off >= vma_pages(vma)) + return -EFAULT; + + *pgoff = vma->vm_pgoff + (pfn_off - vma_off); + return 0; +} + +/* + * The HDM region is struct-page-less device memory, so a memory error on it + * cannot be routed through the normal page path. Register the range with + * memory_failure() so such an error is contained to a SIGBUS to each process + * that maps the poisoned page, instead of escalating to a host SError. The + * mapping itself is not torn down. + */ +static int vfio_cxl_register_pfn_space(struct vfio_pci_core_device *vdev) +{ + struct vfio_cxl_state *cxl = vdev->cxl; + unsigned long start_pfn = PHYS_PFN(cxl->hpa_range.start); + + cxl->hdm_pfn_space.node.start = start_pfn; + cxl->hdm_pfn_space.node.last = + start_pfn + (range_len(&cxl->hpa_range) >> PAGE_SHIFT) - 1; + cxl->hdm_pfn_space.mapping = vdev->vdev.inode->i_mapping; + cxl->hdm_pfn_space.pfn_to_vma_pgoff = vfio_cxl_pfn_to_vma_pgoff; + + return register_pfn_address_space(&cxl->hdm_pfn_space); +} + /* * Create the CXL device state and join the device to the CXL topology. The * caller groups these devres allocations, so return on the first error. @@ -482,13 +542,35 @@ static int vfio_cxl_open_device(struct vfio_pci_core_device *vdev) /* Record where the HDM memory region landed, to revoke it later. */ cxl->mem_region_index = VFIO_PCI_NUM_REGIONS + vdev->num_regions - 1; + /* + * The HDM region is advertised mmap-able, so a fd holder can fault its + * struct-page-less device memory in from the host CPU. Register it with + * memory_failure() to contain a memory error. -EOPNOTSUPP means + * CONFIG_MEMORY_FAILURE is off, so run without containment. + */ + ret = vfio_cxl_register_pfn_space(vdev); + if (ret && ret != -EOPNOTSUPP) + goto err_index; + return 0; + +err_index: + /* + * A failed open never reaches close_device, and vfio-pci-core frees + * the regions: forget the index, or a later revoke of the HDM gate + * (runtime suspend of the closed device) names a region that is gone. + */ + cxl->mem_region_index = 0; + return ret; } static void vfio_cxl_close_device(struct vfio_pci_core_device *vdev) { + struct vfio_cxl_state *cxl = vdev->cxl; + + unregister_pfn_address_space(&cxl->hdm_pfn_space); /* vfio-pci-core frees the regions after this returns. */ - vdev->cxl->mem_region_index = 0; + cxl->mem_region_index = 0; } static void vfio_cxl_reset_prepare(struct vfio_pci_core_device *vdev) -- 2.53.0
